prodlint 0.10.3 → 0.10.5

package/dist/index.js

@@ -1,7 +1,7 @@
 // src/utils/file-walker.ts
 import fg from "fast-glob";
 import { readFile, stat, realpath } from "fs/promises";
-import { resolve, extname, sep } from "path";
+import { resolve, extname, basename, sep } from "path";
 
 // src/utils/patterns.ts
 function isApiRoute(relativePath) {
@@ -44,6 +44,19 @@ function isCommentLine(lines, lineIndex, commentMap) {
   const trimmed = lines[lineIndex]?.trim() ?? "";
   return trimmed.startsWith("//");
 }
+var NON_CODE = /\/\/.*|\/\*[\s\S]*?\*\/|'(?:[^'\\\n]|\\[\s\S])*'|"(?:[^"\\\n]|\\[\s\S])*"|`(?:[^`\\]|\\[\s\S])*`/g;
+function blankOut(source, strings) {
+  const blank = (s) => s.replace(/[^\n]/g, " ");
+  return source.replace(NON_CODE, (m) => m[0] === "/" ? blank(m) : strings ? m[0] + blank(m.slice(1, -1)) + m[0] : m);
+}
+function closingBrace(code, open) {
+  let depth = 0;
+  for (let i = open; i < code.length; i++) {
+    if (code[i] === "{") depth++;
+    else if (code[i] === "}" && --depth === 0) return i;
+  }
+  return -1;
+}
 function isLineSuppressed(lines, lineIndex, ruleId) {
   for (const line of lines) {
     const trimmed = line.trim();
@@ -68,7 +81,8 @@ function isLineSuppressed(lines, lineIndex, ruleId) {
   return false;
 }
 function isTestFile(relativePath) {
-  return /\.(test|spec)\.[jt]sx?$/.test(relativePath) || /(?:^|\/)__tests__\//.test(relativePath) || /(?:^|\/)tests?\//.test(relativePath) || /(?:^|\/)fixtures?\//.test(relativePath) || /(?:^|\/)mocks?\//.test(relativePath);
+  return /\.(test|spec)\.[jt]sx?$/.test(relativePath) || // Jest's __tests__ and __mocks__, jscodeshift's __testfixtures__
+  /(?:^|\/)__(?:tests|testfixtures|fixtures|mocks)__\//.test(relativePath) || /(?:^|\/)tests?\//.test(relativePath) || /(?:^|\/)fixtures?\//.test(relativePath) || /(?:^|\/)mocks?\//.test(relativePath);
 }
 function isScriptFile(relativePath) {
   if (/(?:^|\/)scripts?\//.test(relativePath)) return true;
@@ -382,6 +396,263 @@ var DEPENDENCY_TO_FRAMEWORK = {
 var SQL_SAFE_ORMS = /* @__PURE__ */ new Set(["prisma", "drizzle", "knex", "typeorm", "sequelize"]);
 var RATE_LIMIT_FRAMEWORKS = /* @__PURE__ */ new Set(["upstash-ratelimit", "express-rate-limit", "rate-limiter-flexible"]);
 
+// src/utils/middleware-matcher.ts
+function matcherExcludesApi(content, fileName) {
+  const sources = matcherSources(content, fileName);
+  if (!sources || sources.length === 0) return false;
+  return sources.every((source) => {
+    const matcher = compile(source);
+    return matcher !== null && !matcher.patterns.some(namesApi) && !apiPaths(matcher.literals).some((path) => matcher.regexp.test(path));
+  });
+}
+function matcherExcludesPages(content, fileName) {
+  const sources = matcherSources(content, fileName);
+  if (!sources || sources.length === 0) return false;
+  return sources.every((source) => {
+    const matcher = compile(source);
+    return matcher !== null && underApi(matcher.tokens);
+  });
+}
+function underApi(tokens) {
+  const [head, ...rest] = tokens;
+  if (typeof head !== "string") return false;
+  if (head.startsWith("/api/")) return true;
+  if (head !== "/api") return false;
+  for (const token of rest) {
+    const start = typeof token === "string" ? token : token.pattern ? prefixOf(token) : token.prefix + token.suffix;
+    if (!start.startsWith("/")) return false;
+    if (typeof token === "string" || token.modifier !== "?" && token.modifier !== "*") return true;
+  }
+  return true;
+}
+function apiPaths(literals) {
+  const paths = ["/api/x", "/api/x/y"];
+  for (const literal2 of literals) {
+    for (const head of ["", "/api", "/api/x"]) {
+      for (const tail of ["", "/x"]) paths.push(head + literal2 + tail);
+    }
+  }
+  return paths.filter((path) => path.startsWith("/api/"));
+}
+function matcherSources(content, fileName) {
+  const ast = parseFile(content, fileName);
+  if (!ast) return null;
+  for (const st of ast.program.body) {
+    if (st.type !== "ExportNamedDeclaration" || st.declaration?.type !== "VariableDeclaration") continue;
+    if (st.declaration.kind !== "const") continue;
+    for (const d of st.declaration.declarations) {
+      if (d.id.type !== "Identifier" || d.id.name !== "config" || !d.init) continue;
+      const config = unwrap(d.init);
+      if (config.type !== "ObjectExpression") return null;
+      if (config.properties.some((p) => p.type !== "ObjectProperty")) return null;
+      const matcher = property(config, "matcher");
+      if (!matcher) return void 0;
+      const values = matcher.type === "ArrayExpression" ? matcher.elements : [matcher];
+      const sources = [];
+      for (const value of values) {
+        const element = value ? unwrap(value) : null;
+        const source = element?.type === "ObjectExpression" ? property(element, "source") : element;
+        const text = source ? literal(source) : null;
+        if (text === null) return null;
+        sources.push(text);
+      }
+      return sources;
+    }
+  }
+  return void 0;
+}
+function unwrap(node) {
+  while (node.type === "TSSatisfiesExpression" || node.type === "TSAsExpression") node = node.expression;
+  return node;
+}
+function property(object, name) {
+  if (object.type !== "ObjectExpression") return void 0;
+  let value;
+  for (const p of object.properties) {
+    if (p.type !== "ObjectProperty" || p.computed) continue;
+    const key = p.key.type === "Identifier" ? p.key.name : p.key.type === "StringLiteral" ? p.key.value : null;
+    if (key === name) value = unwrap(p.value);
+  }
+  return value;
+}
+function literal(node) {
+  if (node.type === "StringLiteral") return node.value;
+  if (node.type === "TemplateLiteral" && node.expressions.length === 0) return node.quasis[0].value.cooked ?? null;
+  return null;
+}
+function namesApi(pattern) {
+  let kept = "";
+  const negative = [];
+  for (let i = 0; i < pattern.length; i++) {
+    const c = pattern[i];
+    const skipping = negative.includes(true);
+    if (c === "\\") {
+      if (!skipping) kept += pattern.slice(i, i + 2);
+      i++;
+    } else if (c === "(") {
+      negative.push(pattern.startsWith("(?!", i) || pattern.startsWith("(?<!", i));
+      if (!skipping) kept += c;
+    } else if (c === ")") {
+      negative.pop();
+      if (!negative.includes(true)) kept += c;
+    } else if (!skipping) {
+      kept += c;
+    }
+  }
+  return /\bapi\b/i.test(kept);
+}
+var DELIMITER = "/#?";
+var PREFIXES = "./";
+var escape = (s) => s.replace(/([.+*?=^!:${}()[\]|/\\])/g, "\\$1");
+var prefixOf = (token) => (token.modifier === "*" || token.modifier === "+") && !token.prefix && !token.suffix ? "/" : token.prefix;
+function lex(source) {
+  const tokens = [];
+  let i = 0;
+  while (i < source.length) {
+    const c = source[i];
+    if (c === "*" || c === "+" || c === "?") {
+      tokens.push({ type: "MODIFIER", value: source[i++] });
+    } else if (c === "\\") {
+      tokens.push({ type: "ESCAPED_CHAR", value: source[i + 1] });
+      i += 2;
+    } else if (c === "{" || c === "}") {
+      tokens.push({ type: c === "{" ? "OPEN" : "CLOSE", value: source[i++] });
+    } else if (c === ":") {
+      const name = /^\w+/.exec(source.slice(i + 1))?.[0];
+      if (!name) throw new TypeError(`Missing parameter name at ${i}`);
+      tokens.push({ type: "NAME", value: name });
+      i += 1 + name.length;
+    } else if (c === "(") {
+      let depth = 1;
+      let pattern = "";
+      let j = i + 1;
+      if (source[j] === "?") throw new TypeError(`Pattern cannot start with "?" at ${j}`);
+      while (j < source.length) {
+        if (source[j] === "\\") {
+          pattern += source[j++] + source[j++];
+          continue;
+        }
+        if (source[j] === ")") {
+          if (--depth === 0) {
+            j++;
+            break;
+          }
+        } else if (source[j] === "(") {
+          depth++;
+          if (source[j + 1] !== "?") throw new TypeError(`Capturing groups are not allowed at ${j}`);
+        }
+        pattern += source[j++];
+      }
+      if (depth) throw new TypeError(`Unbalanced pattern at ${i}`);
+      if (!pattern) throw new TypeError(`Missing pattern at ${i}`);
+      tokens.push({ type: "PATTERN", value: pattern });
+      i = j;
+    } else {
+      tokens.push({ type: "CHAR", value: source[i++] });
+    }
+  }
+  tokens.push({ type: "END", value: "" });
+  return tokens;
+}
+function parse2(source) {
+  const tokens = lex(source);
+  const result = [];
+  let i = 0;
+  let path = "";
+  const tryConsume = (type) => i < tokens.length && tokens[i].type === type ? tokens[i++].value : void 0;
+  const mustConsume = (type) => {
+    const value = tryConsume(type);
+    if (value === void 0) throw new TypeError(`Unexpected ${tokens[i].type}, expected ${type}`);
+    return value;
+  };
+  const consumeText = () => {
+    let text = "";
+    let value;
+    while (value = tryConsume("CHAR") || tryConsume("ESCAPED_CHAR")) text += value;
+    return text;
+  };
+  const safePattern = (prefix) => {
+    const prev = result[result.length - 1];
+    const prevText = prefix || (typeof prev === "string" ? prev : "");
+    if (prev && !prevText) throw new TypeError("Must have text between two parameters");
+    if (!prevText || [...DELIMITER].some((c) => prevText.includes(c))) return `[^${escape(DELIMITER)}]+?`;
+    return `(?:(?!${escape(prevText)})[^${escape(DELIMITER)}])+?`;
+  };
+  while (i < tokens.length) {
+    const char = tryConsume("CHAR");
+    const name = tryConsume("NAME");
+    const pattern = tryConsume("PATTERN");
+    if (name || pattern) {
+      let prefix = char || "";
+      if (!PREFIXES.includes(prefix)) {
+        path += prefix;
+        prefix = "";
+      }
+      if (path) {
+        result.push(path);
+        path = "";
+      }
+      result.push({ prefix, suffix: "", pattern: pattern || safePattern(prefix), modifier: tryConsume("MODIFIER") || "" });
+      continue;
+    }
+    const value = char || tryConsume("ESCAPED_CHAR");
+    if (value) {
+      path += value;
+      continue;
+    }
+    if (path) {
+      result.push(path);
+      path = "";
+    }
+    if (tryConsume("OPEN")) {
+      const prefix = consumeText();
+      const name2 = tryConsume("NAME") || "";
+      const pattern2 = tryConsume("PATTERN") || "";
+      const suffix = consumeText();
+      mustConsume("CLOSE");
+      result.push({ prefix, suffix, pattern: name2 && !pattern2 ? safePattern(prefix) : pattern2, modifier: tryConsume("MODIFIER") || "" });
+      continue;
+    }
+    mustConsume("END");
+  }
+  return result;
+}
+function compile(source) {
+  if (!source.startsWith("/")) return null;
+  try {
+    const tokens = parse2(source);
+    let route = "^";
+    for (const token of tokens) {
+      if (typeof token === "string") {
+        route += escape(token);
+        continue;
+      }
+      if (!token.pattern) {
+        route += `(?:${escape(token.prefix)}${escape(token.suffix)})${token.modifier}`;
+        continue;
+      }
+      const repeat = token.modifier === "*" || token.modifier === "+";
+      const prefix = escape(prefixOf(token));
+      const suffix = escape(token.suffix);
+      if (!prefix && !suffix) {
+        route += `(${token.pattern})${token.modifier}`;
+      } else if (repeat) {
+        route += `(?:${prefix}((?:${token.pattern})(?:${suffix}${prefix}(?:${token.pattern}))*)${suffix})${token.modifier === "*" ? "?" : ""}`;
+      } else {
+        route += `(?:${prefix}(${token.pattern})${suffix})${token.modifier}`;
+      }
+    }
+    return {
+      regexp: new RegExp(`${route}[${escape(DELIMITER)}]?$`),
+      tokens,
+      literals: tokens.filter((token) => typeof token === "string"),
+      patterns: tokens.flatMap((token) => typeof token === "string" ? [] : [token.pattern])
+    };
+  } catch {
+    return null;
+  }
+}
+
 // src/utils/file-walker.ts
 var DEFAULT_IGNORES = [
   "**/node_modules/**",
@@ -411,6 +682,37 @@ var SCAN_EXTENSIONS = [
 ];
 var AST_EXTENSIONS = /* @__PURE__ */ new Set(["ts", "tsx", "js", "jsx", "mjs", "cjs"]);
 var MAX_FILE_SIZE = 1024 * 1024;
+var MIDDLEWARE_FILES = [
+  "middleware.ts",
+  "middleware.js",
+  "src/middleware.ts",
+  "src/middleware.js",
+  "proxy.ts",
+  "proxy.js",
+  "src/proxy.ts",
+  "src/proxy.js"
+];
+var MIDDLEWARE_AUTH_PATTERNS = [
+  /getSession/i,
+  /getUser/i,
+  /auth\(\)/,
+  /withAuth/i,
+  /clerkMiddleware/i,
+  /authMiddleware/i,
+  /NextAuth/i,
+  /supabase.*auth/i,
+  /createMiddlewareClient/i,
+  /getToken/i,
+  /verifyToken/i,
+  /jwt/i,
+  /updateSession/i,
+  // Auth.js: export { auth as proxy } from '@/auth', export default auth((req) => …)
+  /\bauth\s+as\s+(?:proxy|middleware|default)\b/,
+  /\bauth\(/,
+  // NextAuth v4: export { default } from 'next-auth/middleware'
+  /['"]next-auth\/middleware['"]/
+];
+var MIDDLEWARE_RATE_LIMIT_PATTERNS = [/rateLimit/i, /throttle/i];
 async function walkFiles(root, extraIgnores = []) {
   const patterns = SCAN_EXTENSIONS.map((ext) => `**/*.${ext}`);
   patterns.push("**/.env", "**/.env.*");
@@ -434,7 +736,8 @@ async function readFileContext(root, relativePath) {
     if (fileStats.size > MAX_FILE_SIZE) return null;
     const content = await readFile(absolutePath, "utf-8");
     const lines = content.split(/\r?\n|\r/);
-    const ext = extname(relativePath).slice(1);
+    const rawExt = extname(relativePath).slice(1);
+    const ext = /^\.env(?:\.|$)/.test(basename(relativePath)) && !SCAN_EXTENSIONS.includes(rawExt) ? "env" : rawExt;
     let ast = void 0;
     if (AST_EXTENSIONS.has(ext)) {
       try {
@@ -548,6 +851,8 @@ async function buildProjectContext(root, files) {
   let declaredDependencies = /* @__PURE__ */ new Set();
   let tsconfigPaths = /* @__PURE__ */ new Set();
   let hasAuthMiddleware = false;
+  let authMiddlewareExcludesApi = false;
+  let authMiddlewareExcludesPages = false;
   let hasRateLimiting = false;
   const detectedFrameworks = /* @__PURE__ */ new Set();
   let gitignoreContent = null;
@@ -599,45 +904,19 @@ async function buildProjectContext(root, files) {
     }
   } catch {
   }
-  try {
-    for (const name of ["middleware.ts", "middleware.js", "src/middleware.ts", "src/middleware.js"]) {
-      try {
-        const content = await readFile(resolve(root, name), "utf-8");
-        const authPatterns = [
-          /getSession/i,
-          /getUser/i,
-          /auth\(\)/,
-          /withAuth/i,
-          /clerkMiddleware/i,
-          /authMiddleware/i,
-          /NextAuth/i,
-          /supabase.*auth/i,
-          /createMiddlewareClient/i,
-          /getToken/i,
-          /verifyToken/i,
-          /jwt/i,
-          /updateSession/i
-        ];
-        if (authPatterns.some((p) => p.test(content))) {
-          hasAuthMiddleware = true;
-          break;
-        }
-      } catch {
-      }
+  for (const name of MIDDLEWARE_FILES) {
+    let content;
+    try {
+      content = await readFile(resolve(root, name), "utf-8");
+    } catch {
+      continue;
     }
-  } catch {
-  }
-  if (!hasRateLimiting) {
-    for (const name of ["middleware.ts", "middleware.js", "src/middleware.ts", "src/middleware.js"]) {
-      try {
-        const content = await readFile(resolve(root, name), "utf-8");
-        if (/rateLimit/i.test(content) || /throttle/i.test(content)) {
-          hasRateLimiting = true;
-          break;
-        }
-      } catch {
-      }
+    if (MIDDLEWARE_AUTH_PATTERNS.some((p) => p.test(content))) {
+      authMiddlewareExcludesApi = (!hasAuthMiddleware || authMiddlewareExcludesApi) && matcherExcludesApi(content, name);
+      authMiddlewareExcludesPages = (!hasAuthMiddleware || authMiddlewareExcludesPages) && matcherExcludesPages(content, name);
+      hasAuthMiddleware = true;
     }
+    if (MIDDLEWARE_RATE_LIMIT_PATTERNS.some((p) => p.test(content))) hasRateLimiting = true;
   }
   try {
     gitignoreContent = await readFile(resolve(root, ".gitignore"), "utf-8");
@@ -650,6 +929,8 @@ async function buildProjectContext(root, files) {
     declaredDependencies,
     tsconfigPaths,
     hasAuthMiddleware,
+    authMiddlewareExcludesApi,
+    authMiddlewareExcludesPages,
     hasRateLimiting,
     detectedFrameworks,
     gitignoreContent,
@@ -740,12 +1021,21 @@ function summarizeFindings(findings) {
 }
 
 // src/rules/secrets.ts
+function nameJwt(token) {
+  try {
+    const claims = JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString("utf8"));
+    if (claims?.role === "anon") return null;
+    if (claims?.role === "service_role") return "Supabase service role key";
+  } catch {
+  }
+  return "JWT";
+}
 var SECRET_PATTERNS = [
   { name: "Stripe secret key", pattern: /sk_live_[a-zA-Z0-9]{8,}/ },
   { name: "Stripe test key", pattern: /sk_test_[a-zA-Z0-9]{8,}/ },
   { name: "AWS access key", pattern: /AKIA[0-9A-Z]{16}/ },
   { name: "AWS secret key", pattern: /(?:aws_secret_access_key|AWS_SECRET)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/ },
-  { name: "Supabase service role key", pattern: /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.[A-Za-z0-9_-]{50,}\.[A-Za-z0-9_-]{20,}/ },
+  { name: "JWT", pattern: /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.[A-Za-z0-9_-]{50,}\.[A-Za-z0-9_-]{20,}/, nameMatch: nameJwt },
   { name: "OpenAI API key (legacy)", pattern: /sk-[a-zA-Z0-9]{20,}T3BlbkFJ[a-zA-Z0-9]{20,}/ },
   { name: "OpenAI API key", pattern: /sk-proj-[a-zA-Z0-9_\-]{20,}/ },
   { name: "Anthropic API key", pattern: /sk-ant-(?:api|admin)[0-9]{2}-[a-zA-Z0-9_\-]{20,}/ },
@@ -780,15 +1070,17 @@ var secretsRule = {
     for (let i = 0; i < file.lines.length; i++) {
       const line = file.lines[i];
       if (isCommentLine(file.lines, i, file.commentMap)) continue;
-      for (const { name, pattern } of SECRET_PATTERNS) {
+      for (const { name, pattern, nameMatch } of SECRET_PATTERNS) {
         const match = pattern.exec(line);
         if (match) {
+          const reported = nameMatch ? nameMatch(match[0]) : name;
+          if (!reported) continue;
           findings.push({
             ruleId: "secrets",
             file: file.relativePath,
             line: i + 1,
             column: match.index + 1,
-            message: `Hardcoded ${name} detected`,
+            message: `Hardcoded ${reported} detected`,
             severity: "critical",
             category: "security",
             fix: "Move the secret to an environment variable and access via process.env.SECRET_NAME"
@@ -944,12 +1236,217 @@ var AUTH_PATTERNS = [
   /createRouteHandlerClient/,
   /createServerComponentClient/,
   /createMiddlewareClient/,
-  /authorization/i,
+  // Reading the request's Authorization header, not sending one upstream:
+  // headers.get('authorization'), req.headers.authorization, req.headers['authorization'], req.header('Authorization')
+  /\.(?:get|header)\(\s*['"`]authorization['"`]/i,
+  /\.headers\??\.authorization\b(?!\s*=(?!=))/i,
+  /\.headers\[\s*['"`]authorization['"`]\s*\](?!\s*=(?!=))/i,
   /getAuth\s*\(/,
   /withPageAuth/,
   /cookies\(\).*auth/s
 ];
-var MUTATION_EXPORT = /export\s+(?:async\s+)?function\s+(POST|PUT|PATCH|DELETE)\b/;
+var MUTATION_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+var HANDLER_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"]);
+var TRPC_ROUTE = /['"]@trpc\/server\/adapters\//;
+function servedUnderApi(relativePath) {
+  const pages = /(?:^|\/)pages\/api\/(.+)$/.exec(relativePath);
+  if (pages) return !/^index\.\w+$/.test(pages[1]);
+  const segments = relativePath.split("/");
+  const app = segments.indexOf("app");
+  if (app === -1) return false;
+  const url = segments.slice(app + 1, -1).filter((s) => !/^\(.*\)$/.test(s) && !s.startsWith("@"));
+  return url[0] === "api" && url.length > 1;
+}
+var AUTH_WORD = /^(?:auth(?!or(?:s|ed|ing|ship)?$)|session)/i;
+var NO_AUTH_WORD = /^(?:without|no|non|skip|bypass|optional|public|anon|anonymous|guest)$/i;
+function words(name) {
+  return name.split(/[^A-Za-z0-9]+|(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/).filter(Boolean);
+}
+function saysAuth(name) {
+  const w = words(name);
+  return w.some((x) => AUTH_WORD.test(x)) && !w.some((x) => NO_AUTH_WORD.test(x));
+}
+function isAuthHelper(name, source) {
+  if (words(name).some((x) => NO_AUTH_WORD.test(x))) return false;
+  return saysAuth(name) || /^with[A-Z0-9_$]/.test(name) && source !== void 0 && saysAuth(source);
+}
+var AUTHED = { authed: true, local: true };
+var LOCAL = { authed: false, local: true };
+var ELSEWHERE = { authed: false, local: false };
+function handlersFromAst(program) {
+  const imports = /* @__PURE__ */ new Map();
+  const bindings = /* @__PURE__ */ new Map();
+  for (const st of program.body) {
+    if (st.type === "ImportDeclaration") {
+      for (const s of st.specifiers) imports.set(s.local.name, st.source.value);
+      continue;
+    }
+    const decl = st.type === "ExportNamedDeclaration" || st.type === "ExportDefaultDeclaration" ? st.declaration : st;
+    if (decl?.type === "FunctionDeclaration" && decl.id) bindings.set(decl.id.name, decl);
+    if (decl?.type === "VariableDeclaration") {
+      for (const d of decl.declarations) {
+        if (d.id.type === "Identifier" && d.init) bindings.set(d.id.name, d.init);
+      }
+    }
+  }
+  const helperOf = (callee) => {
+    if (callee.type === "CallExpression") return helperOf(callee.callee);
+    if (callee.type === "Identifier") return { name: callee.name, source: imports.get(callee.name) };
+    if (callee.type === "MemberExpression" && callee.property.type === "Identifier") {
+      let root = callee.object;
+      while (root.type === "MemberExpression") root = root.object;
+      return { name: callee.property.name, source: root.type === "Identifier" ? imports.get(root.name) : void 0 };
+    }
+    return null;
+  };
+  const classify = (node, seen) => {
+    while (node.type === "TSAsExpression" || node.type === "TSSatisfiesExpression" || node.type === "TSNonNullExpression" || node.type === "TSTypeAssertion" || node.type === "ParenthesizedExpression" || node.type === "AwaitExpression") {
+      node = node.type === "AwaitExpression" ? node.argument : node.expression;
+    }
+    switch (node.type) {
+      case "FunctionDeclaration":
+      case "FunctionExpression":
+      case "ArrowFunctionExpression":
+        return LOCAL;
+      case "Identifier": {
+        const bound = bindings.get(node.name);
+        if (!bound || seen.has(node.name)) return ELSEWHERE;
+        return classify(bound, new Set(seen).add(node.name));
+      }
+      case "CallExpression": {
+        const helper = helperOf(node.callee);
+        if (helper && isAuthHelper(helper.name, helper.source)) return AUTHED;
+        let local = false;
+        for (const arg of node.callee.type === "CallExpression" ? [node.callee, ...node.arguments] : node.arguments) {
+          const verdict = classify(arg, seen);
+          if (verdict.authed) return verdict;
+          local ||= verdict.local;
+        }
+        return { authed: false, local };
+      }
+    }
+    return ELSEWHERE;
+  };
+  const handlers = [];
+  const add = (method, at, verdict) => {
+    handlers.push({ method, line: at.loc?.start.line ?? 1, ...verdict });
+  };
+  for (const st of program.body) {
+    if (st.type === "ExportNamedDeclaration") {
+      const decl = st.declaration;
+      if (decl?.type === "FunctionDeclaration") {
+        if (decl.id && HANDLER_METHODS.has(decl.id.name)) add(decl.id.name, st, LOCAL);
+      } else if (decl?.type === "VariableDeclaration") {
+        for (const d of decl.declarations) {
+          if (d.id.type === "Identifier" && HANDLER_METHODS.has(d.id.name)) {
+            add(d.id.name, d, d.init ? classify(d.init, /* @__PURE__ */ new Set()) : ELSEWHERE);
+          } else if (d.id.type === "ObjectPattern") {
+            for (const p of d.id.properties) {
+              if (p.type === "ObjectProperty" && p.value.type === "Identifier" && HANDLER_METHODS.has(p.value.name)) {
+                add(p.value.name, d, ELSEWHERE);
+              }
+            }
+          }
+        }
+      } else if (!decl) {
+        for (const s of st.specifiers) {
+          if (s.type !== "ExportSpecifier") continue;
+          const name = s.exported.type === "Identifier" ? s.exported.name : s.exported.value;
+          if (name === "default" || HANDLER_METHODS.has(name)) add(name, s, st.source ? ELSEWHERE : classify(s.local, /* @__PURE__ */ new Set()));
+        }
+      }
+    } else if (st.type === "ExportDefaultDeclaration") {
+      add("default", st, classify(st.declaration, /* @__PURE__ */ new Set()));
+    } else if (st.type === "ExportAllDeclaration") {
+      add("*", st, ELSEWHERE);
+    }
+  }
+  return handlers;
+}
+var METHOD = "(GET|HEAD|POST|PUT|PATCH|DELETE)";
+var EXPORT_FUNCTION = new RegExp(`^\\s*export\\s+(?:async\\s+)?function\\s*\\*?\\s*${METHOD}(?![\\w$])`);
+var EXPORT_CONST = new RegExp(`^\\s*export\\s+(?:const|let|var)\\s+${METHOD}(?![\\w$])\\s*(?::[^=]*)?=(?![=>])(.*)$`);
+var EXPORT_DESTRUCTURED = /^\s*export\s+(?:const|let|var)\s*\{([^}]*)\}\s*=/;
+var EXPORT_DEFAULT = /^\s*export\s+default\s+(.*)$/;
+var EXPORT_ALL = /^\s*export\s*\*\s*from\b/;
+var EXPORT_LIST = /\bexport\s*\{([^}]*)\}(\s*from\b)?/g;
+var IMPORT = /\bimport\s+(?!type\b)([\w$*{}\s,]+?)\s+from\s*['"]([^'"]+)['"]/g;
+var INLINE_FUNCTION = /^(?:async\b|function\b|\([^)]*\)\s*(?::[^=]+)?=>|[\w$]+\s*=>)/;
+var CALL = /^([A-Za-z_$][\w$]*)(?:\s*\.\s*([A-Za-z_$][\w$]*))*\s*(?:<[^>()]*>)?\s*\(/;
+var IDENTIFIER = /^([A-Za-z_$][\w$]*)\s*(?:[,);\n]|$)/;
+function handlersFromText(file) {
+  const imports = /* @__PURE__ */ new Map();
+  for (const m of file.content.matchAll(IMPORT)) {
+    for (const part of m[1].replace(/[{}]/g, ",").split(",")) {
+      const spec = /^\s*(?:type\s+)?(?:\*\s+as\s+)?([\w$]+)(?:\s+as\s+([\w$]+))?\s*$/.exec(part);
+      if (spec) imports.set(spec[2] ?? spec[1], m[2]);
+    }
+  }
+  const code = (i) => !isCommentLine(file.lines, i, file.commentMap);
+  const value = (i, head) => [head, ...file.lines.slice(i + 1, i + 5).filter((_, k) => code(i + 1 + k))].join("\n");
+  const resolve4 = (name, seen) => {
+    const id = name.replace(/\$/g, "\\$");
+    const fn = new RegExp(`^\\s*(?:export\\s+)?(?:default\\s+)?(?:async\\s+)?function\\s*\\*?\\s*${id}(?![\\w$])`);
+    const variable = new RegExp(`^\\s*(?:export\\s+)?(?:const|let|var)\\s+${id}(?![\\w$])\\s*(?::[^=]*)?=(?![=>])(.*)$`);
+    for (let i = 0; i < file.lines.length; i++) {
+      if (!code(i)) continue;
+      if (fn.test(file.lines[i])) return LOCAL;
+      const m = variable.exec(file.lines[i]);
+      if (m) return classify(value(i, m[1]), seen);
+    }
+    return ELSEWHERE;
+  };
+  const classify = (text, seen) => {
+    const t = text.trim().replace(/^await\s+/, "");
+    if (INLINE_FUNCTION.test(t)) return LOCAL;
+    const call = CALL.exec(t);
+    if (call) {
+      if (isAuthHelper(call[2] ?? call[1], imports.get(call[1]))) return AUTHED;
+      let args = t.slice(call[0].length);
+      const curried = /^[^()]*\)\s*\(/.exec(args);
+      if (curried) args = args.slice(curried[0].length);
+      return classify(args, seen);
+    }
+    const id = IDENTIFIER.exec(t);
+    if (id && !seen.has(id[1])) return resolve4(id[1], new Set(seen).add(id[1]));
+    return ELSEWHERE;
+  };
+  const handlers = [];
+  for (let i = 0; i < file.lines.length; i++) {
+    if (!code(i)) continue;
+    const line = file.lines[i];
+    let m;
+    if (m = EXPORT_FUNCTION.exec(line)) {
+      handlers.push({ method: m[1], line: i + 1, ...LOCAL });
+    } else if (m = EXPORT_CONST.exec(line)) {
+      handlers.push({ method: m[1], line: i + 1, ...classify(value(i, m[2]), /* @__PURE__ */ new Set()) });
+    } else if (m = EXPORT_DESTRUCTURED.exec(line)) {
+      for (const part of m[1].split(",")) {
+        const name = part.split(":").pop()?.trim() ?? "";
+        if (HANDLER_METHODS.has(name)) handlers.push({ method: name, line: i + 1, ...ELSEWHERE });
+      }
+    } else if (m = EXPORT_DEFAULT.exec(line)) {
+      handlers.push({ method: "default", line: i + 1, ...classify(value(i, m[1]), /* @__PURE__ */ new Set()) });
+    } else if (EXPORT_ALL.test(line)) {
+      handlers.push({ method: "*", line: i + 1, ...ELSEWHERE });
+    }
+  }
+  const lineAt = (offset) => file.content.slice(0, offset).split("\n").length;
+  for (const m of file.content.matchAll(EXPORT_LIST)) {
+    if (!code(lineAt(m.index) - 1)) continue;
+    let offset = m.index + m[0].indexOf("{") + 1;
+    for (const part of m[1].split(",")) {
+      const spec = /^\s*(?:type\s+)?([\w$]+)(?:\s+as\s+([\w$]+))?\s*$/.exec(part);
+      const name = spec ? spec[2] ?? spec[1] : "";
+      if (spec && (name === "default" || HANDLER_METHODS.has(name))) {
+        const line = lineAt(offset + part.length - part.trimStart().length);
+        handlers.push({ method: name, line, ...m[2] ? ELSEWHERE : classify(spec[1], /* @__PURE__ */ new Set()) });
+      }
+      offset += part.length + 1;
+    }
+  }
+  return handlers.sort((a, b) => a.line - b.line);
+}
 var authChecksRule = {
   id: "auth-checks",
   name: "Missing Auth Checks",
@@ -965,22 +1462,21 @@ var authChecksRule = {
     for (const pattern of AUTH_PATTERNS) {
       if (pattern.test(file.content)) return [];
     }
+    const handlers = file.ast ? handlersFromAst(file.ast.program) : handlersFromText(file);
+    const exposed = handlers.filter((h) => !h.authed);
+    if (handlers.length > 0 && exposed.length === 0) return [];
+    const middlewareSkipsRoute = project.hasAuthMiddleware && project.authMiddlewareExcludesApi === true && servedUnderApi(file.relativePath);
+    const middlewareAuth = project.hasAuthMiddleware && !middlewareSkipsRoute;
     let severity;
-    if (project.hasAuthMiddleware) {
+    if (middlewareAuth) {
       severity = "info";
-    } else if (MUTATION_EXPORT.test(file.content)) {
+    } else if (exposed.some((h) => h.local && MUTATION_METHODS.has(h.method)) && !TRPC_ROUTE.test(file.content)) {
       severity = "critical";
     } else {
       severity = "info";
     }
-    let handlerLine = 1;
-    for (let i = 0; i < file.lines.length; i++) {
-      if (/export\s+(async\s+)?function\s+(GET|POST|PUT|PATCH|DELETE|handler)/i.test(file.lines[i])) {
-        handlerLine = i + 1;
-        break;
-      }
-    }
-    const message = project.hasAuthMiddleware ? "API route has no inline auth check (middleware auth detected \u2014 verify coverage)" : "API route has no authentication check";
+    const handlerLine = exposed[0]?.line ?? 1;
+    const message = middlewareAuth ? "API route has no inline auth check (middleware auth detected \u2014 verify coverage)" : middlewareSkipsRoute ? "API route has no authentication check (middleware auth detected, but its matcher excludes /api)" : "API route has no authentication check";
     return [{
       ruleId: "auth-checks",
       file: file.relativePath,
@@ -1098,7 +1594,8 @@ var errorHandlingRule = {
 
 // src/rules/input-validation.ts
 var VALIDATION_PATTERNS = [
-  /\.parse\s*\(/,
+  // A schema's .parse(), but not parsers that validate nothing: JSON.parse(), Date.parse()...
+  /(?<!\b(?:JSON|Date|URL|path|qs|querystring))\.parse\s*\(/,
   /\.safeParse\s*\(/,
   /\.validate\s*\(/,
   /\.validateSync\s*\(/,
@@ -1399,6 +1896,40 @@ var aiSmellsRule = {
 };
 
 // src/rules/unsafe-html.ts
+var SANITIZER_NAME = /^(?:sanitize\w*|xss|filterXSS)$/i;
+var SANITIZER_CALL_TEXT = /^\s*(?:await\s+)?(?:[\w$.]*\.sanitize|sanitize\w*|xss|filterXSS)\s*\(/i;
+function isSanitizerCall(node) {
+  if (node.type === "AwaitExpression") return isSanitizerCall(node.argument);
+  if (node.type === "TSAsExpression" || node.type === "TSSatisfiesExpression" || node.type === "TSNonNullExpression") {
+    return isSanitizerCall(node.expression);
+  }
+  if (node.type !== "CallExpression" && node.type !== "OptionalCallExpression") return false;
+  const callee = node.callee;
+  if (callee.type === "MemberExpression" || callee.type === "OptionalMemberExpression") {
+    return callee.property.type === "Identifier" && callee.property.name === "sanitize";
+  }
+  return callee.type === "Identifier" && SANITIZER_NAME.test(callee.name);
+}
+function containsJsonStringify(node) {
+  return subtreeContains(node, (n) => {
+    if (n.type !== "CallExpression") return false;
+    const call = n;
+    if (call.callee.type === "MemberExpression") {
+      const mem = call.callee;
+      return mem.object.type === "Identifier" && mem.object.name === "JSON" && mem.property.type === "Identifier" && mem.property.name === "stringify";
+    }
+    return false;
+  });
+}
+function isSanitized(value, sanitizedNames) {
+  if (value.type === "JSXExpressionContainer") return isSanitized(value.expression, sanitizedNames);
+  if (value.type === "ObjectExpression") {
+    const html = value.properties.find((p) => p.type === "ObjectProperty" && (p.key.type === "Identifier" && p.key.name === "__html" || p.key.type === "StringLiteral" && p.key.value === "__html"));
+    return html?.type === "ObjectProperty" && isSanitized(html.value, sanitizedNames);
+  }
+  if (value.type === "Identifier") return sanitizedNames.has(value.name);
+  return isSanitizerCall(value);
+}
 var unsafeHtmlRule = {
   id: "unsafe-html",
   name: "Unsafe HTML Rendering",
@@ -1410,21 +1941,17 @@ var unsafeHtmlRule = {
     const findings = [];
     if (file.ast) {
       try {
+        const sanitizedNames = /* @__PURE__ */ new Set();
+        walkAST(file.ast.program, (node) => {
+          if (node.type === "VariableDeclarator" && node.id.type === "Identifier" && node.init && subtreeContains(node.init, isSanitizerCall)) {
+            sanitizedNames.add(node.id.name);
+          }
+        });
         walkAST(file.ast.program, (node) => {
           if (node.type === "JSXAttribute") {
             const attr = node;
             if (attr.name?.type === "JSXIdentifier" && attr.name.name === "dangerouslySetInnerHTML" && attr.loc) {
-              if (attr.value && subtreeContains(attr.value, (n) => {
-                if (n.type !== "CallExpression") return false;
-                const call = n;
-                if (call.callee.type === "MemberExpression") {
-                  const mem = call.callee;
-                  return mem.object.type === "Identifier" && mem.object.name === "JSON" && mem.property.type === "Identifier" && mem.property.name === "stringify";
-                }
-                return false;
-              })) {
-                return;
-              }
+              if (attr.value && (containsJsonStringify(attr.value) || isSanitized(attr.value, sanitizedNames))) return;
               const line = attr.loc.start.line;
               findings.push({
                 ruleId: "unsafe-html",
@@ -1441,17 +1968,7 @@ var unsafeHtmlRule = {
           if (node.type === "ObjectProperty") {
             const prop = node;
             if (prop.key?.type === "Identifier" && prop.key.name === "dangerouslySetInnerHTML" && prop.loc) {
-              if (prop.value && subtreeContains(prop.value, (n) => {
-                if (n.type !== "CallExpression") return false;
-                const call = n;
-                if (call.callee.type === "MemberExpression") {
-                  const mem = call.callee;
-                  return mem.object.type === "Identifier" && mem.object.name === "JSON" && mem.property.type === "Identifier" && mem.property.name === "stringify";
-                }
-                return false;
-              })) {
-                return;
-              }
+              if (prop.value && (containsJsonStringify(prop.value) || isSanitized(prop.value, sanitizedNames))) return;
               const line = prop.loc.start.line;
               findings.push({
                 ruleId: "unsafe-html",
@@ -1468,6 +1985,7 @@ var unsafeHtmlRule = {
           if (node.type === "AssignmentExpression") {
             const assign = node;
             if (assign.left?.type === "MemberExpression" && assign.left.property?.type === "Identifier" && assign.left.property.name === "innerHTML" && assign.loc) {
+              if (isSanitized(assign.right, sanitizedNames)) return;
               const line = assign.loc.start.line;
               findings.push({
                 ruleId: "unsafe-html",
@@ -1498,6 +2016,8 @@ var unsafeHtmlRule = {
         }
         const expr = context.join(" ");
         if (/__html\s*:\s*JSON\.stringify/.test(expr)) continue;
+        const html = /__html\s*:/.exec(expr);
+        if (html && SANITIZER_CALL_TEXT.test(expr.slice(html.index + html[0].length))) continue;
         findings.push({
           ruleId: "unsafe-html",
           file: file.relativePath,
@@ -1509,7 +2029,8 @@ var unsafeHtmlRule = {
           fix: "Sanitize HTML with DOMPurify before rendering: DOMPurify.sanitize(html)"
         });
       }
-      if (/\w\.innerHTML\s*=/.test(line)) {
+      const innerHtml = /\w\.innerHTML\s*=/.exec(line);
+      if (innerHtml && !SANITIZER_CALL_TEXT.test(line.slice(innerHtml.index + innerHtml[0].length))) {
         findings.push({
           ruleId: "unsafe-html",
           file: file.relativePath,
@@ -1688,9 +2209,16 @@ var staleFallbackRule = {
 };
 
 // src/rules/hallucinated-api.ts
+var DOM_CONTAINS_RECEIVER = /(?:\b(?:classList|relList)|\.current|\bdocument(?:\.(?:body|documentElement|head))?)\??$/;
+var DOM_CONTAINS_ARGUMENT = /^\s*(?:[\w$.?]*\.(?:target|relatedTarget|currentTarget|activeElement)\b|[^)]*\bas\s+(?:Node|Element|HTML\w*Element)\b)/;
 var HALLUCINATED_APIS = [
   { pattern: /\.flatten\s*\(/, fix: "Use .flat() instead of .flatten()", methodName: "flatten" },
-  { pattern: /\.contains\s*\(/, fix: "Use .includes() instead of .contains()", methodName: "contains" },
+  {
+    pattern: /\.contains\s*\(/,
+    fix: "Use .includes() instead of .contains() on arrays and strings \u2014 DOM classList and Node .contains() are valid",
+    methodName: "contains",
+    isValid: (before, after) => DOM_CONTAINS_RECEIVER.test(before) || DOM_CONTAINS_ARGUMENT.test(after)
+  },
   { pattern: /\.substr\s*\(/, fix: "Use .substring() or .slice() instead of deprecated .substr()", methodName: "substr" },
   { pattern: /\.trimLeft\s*\(/, fix: "Use .trimStart() instead of deprecated .trimLeft()", methodName: "trimLeft" },
   { pattern: /\.trimRight\s*\(/, fix: "Use .trimEnd() instead of deprecated .trimRight()", methodName: "trimRight" },
@@ -1712,10 +2240,11 @@ var hallucinatedApiRule = {
     for (let i = 0; i < file.lines.length; i++) {
       if (isCommentLine(file.lines, i, file.commentMap)) continue;
       const line = file.lines[i];
-      for (const { pattern, fix, methodName } of HALLUCINATED_APIS) {
+      for (const { pattern, fix, methodName, isValid } of HALLUCINATED_APIS) {
         const match = pattern.exec(line);
         if (match) {
           if (isFrameworkSafeMethod(methodName, frameworks)) continue;
+          if (isValid?.(line.slice(0, match.index), line.slice(match.index + match[0].length))) continue;
           findings.push({
             ruleId: "hallucinated-api",
             file: file.relativePath,
@@ -2351,9 +2880,190 @@ var codebaseConsistencyRule = {
 };
 
 // src/rules/dead-exports.ts
-function isEntryPoint(relativePath) {
+function isEntryPoint(relativePath, appRoots, routeModules) {
   const name = relativePath.split("/").pop() ?? "";
-  return /^(page|layout|loading|error|not-found|route|middleware|instrumentation|opengraph-image|twitter-image|icon|apple-icon|sitemap|robots|manifest)\.(tsx?|jsx?)$/.test(name) || /^index\.(tsx?|jsx?)$/.test(name) || name === "global-error.tsx" || name === "global-error.jsx";
+  return /^(page|layout|loading|error|not-found|route|opengraph-image|twitter-image|icon|apple-icon|sitemap|robots|manifest)\.(tsx?|jsx?)$/.test(name) || isBarrel(relativePath) || name === "global-error.tsx" || name === "global-error.jsx" || // SvelteKit's route files: +page.ts, +page.server.ts, +layout.ts, +server.ts
+  /^\+(page|layout|server)(\.server)?\.(ts|js)$/.test(name) || // Storybook's stories: it reads a CSF file's default export as the meta, and each named
+  // export as a story
+  /\.stories\.(tsx?|jsx?|mjs)$/.test(name) || isNextRootFile(relativePath, appRoots) || isPagesRoute(relativePath, appRoots) || routeModules.has(relativePath);
+}
+function isBarrel(relativePath) {
+  return /(?:^|\/)index\.(tsx?|jsx?)$/.test(relativePath);
+}
+function isAppFolder(dir, appRoots) {
+  return appRoots.has(dir) || appRoots.has(dir.replace(/(?:^|\/)src$/, ""));
+}
+function isNextRootFile(relativePath, appRoots) {
+  const match = /^(?:(.*)\/)?(?:middleware|proxy|instrumentation|instrumentation-client)\.(tsx?|jsx?)$/.exec(relativePath);
+  return match !== null && isAppFolder(match[1] ?? "", appRoots);
+}
+function isPagesRoute(relativePath, appRoots) {
+  if (!/\.(tsx?|jsx?)$/.test(relativePath)) return false;
+  const parts = relativePath.split("/");
+  return parts.some((part, i) => part === "pages" && isAppFolder(parts.slice(0, i).join("/"), appRoots));
+}
+function findAppRoots(paths) {
+  const roots = /* @__PURE__ */ new Set([""]);
+  for (const path of paths) {
+    const match = /^(?:(.*)\/)?package\.json$/.exec(path);
+    if (match) roots.add(match[1] ?? "");
+  }
+  return roots;
+}
+function findRouteModules(files, paths, appRoots) {
+  const appFolders = [];
+  for (const path of paths) {
+    const match = /^(?:(.*)\/)?app\/root\.(tsx?|jsx?)$/.exec(path);
+    if (match && appRoots.has(match[1] ?? "")) appFolders.push(path.slice(0, path.lastIndexOf("/")));
+  }
+  const modules = /* @__PURE__ */ new Set();
+  for (const { relativePath, content } of files) {
+    const folder = appFolders.find((f) => relativePath.startsWith(`${f}/`));
+    if (folder === void 0) continue;
+    const path = relativePath.slice(folder.length + 1);
+    if (/^(?:root|entry\.server|routes\/.+)\.(tsx?|jsx?)$/.test(path)) {
+      modules.add(relativePath);
+    } else if (/^routes\.(?:[cm]?[jt]s|[jt]sx)$/.test(path)) {
+      for (const match of content.matchAll(/['"`]([^'"`\n]+\.(?:tsx?|jsx?))['"`]/g)) {
+        const module = normalizePath(`${folder}/${match[1]}`);
+        if (module !== null) modules.add(module);
+      }
+    }
+  }
+  return modules;
+}
+var IMPORT_NAMED = /\bimport\s*(?:type\s*)?(?:[\w$]+\s*,\s*)?\{([^}]*)\}\s*from\s*['"]([^'"]+)['"]/g;
+var IMPORT_DEFAULT = /\bimport\s+([\w$]+)\s*(?:,\s*\{[^}]*\}\s*)?from\s*['"]([^'"]+)['"]/g;
+var IMPORT_NAMESPACE = /\bimport\s+(?:[\w$]+\s*,\s*)?\*\s*as\s+[\w$]+\s+from\s*['"]([^'"]+)['"]/g;
+var DYNAMIC_IMPORT = /(\btypeof\s+)?(?:\{([^{}]*)\}\s*=\s*await\s+)?\bimport\s*\(\s*['"`]([^'"`]+)['"`]\s*\)(?:\s*\.\s*([\w$]+))?/g;
+var REQUIRE = /(?:\{([^{}]*)\}\s*=\s*)?\brequire\s*\(\s*['"]([^'"]+)['"]\s*\)(?:\s*\.\s*([\w$]+))?/g;
+var REEXPORT_NAMED = /\bexport\s*(?:type\s*)?\{([^}]*)\}\s*from\s*['"]([^'"]+)['"]/g;
+var REEXPORT_ALL = /\bexport\s*\*\s*(?:as\s+([\w$]+)\s*)?from\s*['"]([^'"]+)['"]/g;
+var MODULE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mjs", "cjs"];
+var MODULE_EXTENSION = /\.(?:[cm]?[jt]s|[jt]sx)$/;
+function parseSpecifiers(list) {
+  return list.replace(/\/\/.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, "").split(",").map((s) => s.trim().replace(/^type\s+/, "")).filter(Boolean).map((s) => {
+    const [name, alias] = s.split(/\s+as\s+/).map((part) => part.trim());
+    return [name, alias ?? name];
+  });
+}
+function normalizePath(path) {
+  const parts = [];
+  for (const part of path.split("/")) {
+    if (part === "..") {
+      if (parts.length === 0) return null;
+      parts.pop();
+    } else if (part && part !== ".") {
+      parts.push(part);
+    }
+  }
+  return parts.join("/");
+}
+var EXTERNAL = { files: [], folders: [] };
+var UNKNOWN = { files: [], folders: [""] };
+function isAsset(source) {
+  const name = source.slice(source.lastIndexOf("/") + 1);
+  return /^[^.].*\.\w+$/.test(name) && !MODULE_EXTENSION.test(name);
+}
+function stringsIn(value) {
+  if (typeof value === "string") return [value];
+  if (Array.isArray(value)) return value.flatMap(stringsIn);
+  if (value && typeof value === "object") return Object.values(value).flatMap(stringsIn);
+  return [];
+}
+function createResolver(files, project) {
+  const modules = new Set(files.filter((f) => MODULE_EXTENSIONS.includes(f.ext)).map((f) => f.relativePath));
+  const byName = /* @__PURE__ */ new Map();
+  for (const path of modules) {
+    const key = path.replace(/\.\w+$/, "").replace(/(?:^|\/)index$/, "");
+    const name = key.slice(key.lastIndexOf("/") + 1);
+    const list = byName.get(name);
+    if (list) list.push({ path, key });
+    else byName.set(name, [{ path, key }]);
+  }
+  const manifests = [];
+  for (const file of files) {
+    if (!/(?:^|\/)package\.json$/.test(file.relativePath)) continue;
+    try {
+      const json = JSON.parse(file.content);
+      if (json && typeof json === "object") manifests.push({ folder: file.relativePath.replace(/\/?package\.json$/, ""), json });
+    } catch {
+    }
+  }
+  const packages = /* @__PURE__ */ new Map();
+  for (const { folder, json } of manifests) {
+    if (typeof json.name === "string" && json.name) packages.set(json.name, [...packages.get(json.name) ?? [], folder]);
+  }
+  const findModule = (path) => {
+    const stem = path.replace(/\.(?:[cm]?js|jsx)$/, "");
+    const index = path ? `${path}/index` : "index";
+    return [
+      path,
+      // TypeScript's ESM style names the compiled file: ./format.js for format.ts
+      ...stem === path ? [] : [`${stem}.ts`, `${stem}.tsx`],
+      ...MODULE_EXTENSIONS.map((ext) => `${path}.${ext}`),
+      ...MODULE_EXTENSIONS.map((ext) => `${index}.${ext}`)
+    ].find((candidate) => modules.has(candidate));
+  };
+  const packageEntries = /* @__PURE__ */ new Set();
+  for (const { folder, json } of manifests) {
+    if (json.private === true) continue;
+    for (const target of stringsIn([json.main, json.module, json.types, json.typings, json.exports, json.bin])) {
+      const isSource = /\.(?:[cm]?ts|tsx)$/.test(target) && !/\.d\.[cm]?ts$/.test(target);
+      const path = isSource || target.includes("*") ? null : normalizePath(`${folder}/${target}`);
+      if (path === null) continue;
+      const stem = path.replace(/\.d\.ts$/, "").replace(MODULE_EXTENSION, "");
+      const entry = findModule(path) ?? findModule(stem) ?? findModule(stem.replace(/(^|\/)(?:dist|build|lib|out|esm|cjs)\//, "$1src/"));
+      if (entry) packageEntries.add(entry);
+    }
+  }
+  const resolveRelative = (path) => {
+    const normalized = normalizePath(path);
+    if (normalized?.includes("${")) {
+      const parts = normalized.split(/\$\{[^}]*\}/).map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+      const pattern = new RegExp(`^${parts.join(".*")}(?:\\.\\w+)?$`);
+      return { files: [...modules].filter((m) => pattern.test(m)), folders: [] };
+    }
+    const module = normalized === null ? void 0 : findModule(normalized);
+    if (module) return { files: [module], folders: [] };
+    return isAsset(path) ? EXTERNAL : UNKNOWN;
+  };
+  const resolveBare = (source) => {
+    if (/^[a-z][\w+.-]*:/i.test(source)) return EXTERNAL;
+    const name = source.startsWith("@") ? source.split("/").slice(0, 2).join("/") : source.split("/")[0];
+    const folders = packages.get(name);
+    if (folders) {
+      const subpath = source.slice(name.length + 1);
+      const found = folders.map((folder) => {
+        const base = folder ? `${folder}/` : "";
+        return subpath ? findModule(base + subpath) ?? findModule(`${base}src/${subpath}`) : findModule(folder) ?? findModule(`${base}src`);
+      });
+      return { files: found.filter((f) => f !== void 0), folders };
+    }
+    if (NODE_BUILTINS.has(name) || project.declaredDependencies.has(name)) return EXTERNAL;
+    const segments = source.replace(MODULE_EXTENSION, "").split("/").filter(Boolean);
+    const named = byName.get(segments[segments.length - 1] ?? "") ?? [];
+    for (let i = 0; i < segments.length; i++) {
+      const path = segments.slice(i).join("/");
+      const matches = named.filter((m) => m.key === path || m.key.endsWith(`/${path}`));
+      if (matches.length > 0) return i <= 1 ? { files: matches.map((m) => m.path), folders: [] } : UNKNOWN;
+    }
+    return isAsset(source) ? EXTERNAL : UNKNOWN;
+  };
+  const cache = /* @__PURE__ */ new Map();
+  const resolve4 = (source, from) => {
+    const clean = source.replace(/\?.*$/, "");
+    const relative = /^\.\.?(?:\/|$)/.test(clean);
+    const dir = relative ? from.slice(0, from.lastIndexOf("/") + 1) : "";
+    const key = `${dir}\0${clean}`;
+    let target = cache.get(key);
+    if (!target) {
+      target = relative ? resolveRelative(dir + clean) : resolveBare(clean);
+      cache.set(key, target);
+    }
+    return target;
+  };
+  return { resolve: resolve4, packageEntries };
 }
 var THRESHOLD = 5;
 var deadExportsRule = {
@@ -2366,16 +3076,16 @@ var deadExportsRule = {
   check() {
     return [];
   },
-  checkProject(files, _project) {
+  checkProject(files, project) {
     const sourceFiles = files.filter(
       (f) => ["ts", "tsx", "js", "jsx"].includes(f.ext) && !isTestFile(f.relativePath) && !isScriptFile(f.relativePath)
     );
+    const appRoots = findAppRoots(project.allFiles);
+    const routeModules = findRouteModules(files, project.allFiles, appRoots);
+    const { resolve: resolve4, packageEntries } = createResolver(files, project);
     const exports = /* @__PURE__ */ new Map();
-    const imports = /* @__PURE__ */ new Map();
-    const allImportedSymbols = /* @__PURE__ */ new Set();
-    const importedFiles = /* @__PURE__ */ new Set();
     for (const file of sourceFiles) {
-      if (isEntryPoint(file.relativePath)) continue;
+      if (isEntryPoint(file.relativePath, appRoots, routeModules) || packageEntries.has(file.relativePath)) continue;
       let inTemplateLiteral = false;
       for (let i = 0; i < file.lines.length; i++) {
         const line = file.lines[i];
@@ -2416,45 +3126,92 @@ var deadExportsRule = {
         }
       }
     }
-    for (const file of files) {
-      for (const line of file.lines) {
-        let match;
-        const fromMatch = line.match(/from\s+['"]([^'"]+)['"]/);
-        const fromBasename = fromMatch ? fromMatch[1].split("/").pop()?.replace(/\.\w+$/, "") ?? "" : "";
-        const bracesRe = /import\s*(?:type\s*)?\{([^}]+)\}\s*from/g;
-        while ((match = bracesRe.exec(line)) !== null) {
-          const symbols = match[1].split(",").map((s) => s.trim().split(/\s+as\s+/)[0].trim()).filter(Boolean);
-          for (const sym of symbols) {
-            allImportedSymbols.add(sym);
-            if (fromBasename) {
-              const set = imports.get(fromBasename) ?? /* @__PURE__ */ new Set();
-              set.add(sym);
-              imports.set(fromBasename, set);
-            }
-          }
+    const contents = new Map(files.map((f) => [f.relativePath, f.content]));
+    const used = /* @__PURE__ */ new Set();
+    const usedInFolder = /* @__PURE__ */ new Map();
+    const reexports = /* @__PURE__ */ new Map();
+    const reexportsOf = (file) => {
+      let list = reexports.get(file);
+      if (!list) {
+        list = [];
+        const content = contents.get(file) ?? "";
+        for (const match of content.matchAll(REEXPORT_NAMED)) {
+          for (const [imported, exported] of parseSpecifiers(match[1])) list.push({ source: match[2], imported, exported });
         }
-        const defaultRe = /import\s+(\w+)\s+from/g;
-        while ((match = defaultRe.exec(line)) !== null) {
-          allImportedSymbols.add(match[1]);
-          if (fromBasename) {
-            const set = imports.get(fromBasename) ?? /* @__PURE__ */ new Set();
-            set.add(match[1]);
-            imports.set(fromBasename, set);
-          }
+        for (const match of content.matchAll(REEXPORT_ALL)) {
+          list.push(match[1] ? { source: match[2], imported: "*", exported: match[1] } : { source: match[2], imported: "", exported: "*" });
         }
-        const fromRe = /from\s+['"]([^'"]+)['"]/g;
-        while ((match = fromRe.exec(line)) !== null) {
-          importedFiles.add(match[1]);
+        reexports.set(file, list);
+      }
+      return list;
+    };
+    const use = (target, name) => {
+      if (name !== "*" && name !== "default") {
+        for (const folder of target.folders) {
+          const names = usedInFolder.get(folder) ?? /* @__PURE__ */ new Set();
+          names.add(name);
+          usedInFolder.set(folder, names);
         }
       }
+      for (const file of target.files) {
+        const key = `${file}::${name}`;
+        if (used.has(key)) continue;
+        used.add(key);
+        for (const { source, imported, exported } of reexportsOf(file)) {
+          if (exported === "*") {
+            if (name !== "default") use(resolve4(source, file), name);
+          } else if (name === "*" || name === exported) {
+            use(resolve4(source, file), imported);
+          }
+        }
+      }
+    };
+    const useLoaded = (target, destructured, member, typeOnly) => {
+      if (member && !["then", "catch", "finally"].includes(member)) {
+        use(target, member);
+      } else if (typeOnly) {
+        return;
+      } else if (destructured !== void 0 && !destructured.includes("...")) {
+        for (const name of destructured.split(",").map((s) => s.split(/[:=]/)[0].trim()).filter(Boolean)) use(target, name);
+      } else {
+        use(target, "*");
+      }
+    };
+    for (const file of files) {
+      const from = file.relativePath;
+      for (const match of file.content.matchAll(IMPORT_NAMED)) {
+        for (const [name] of parseSpecifiers(match[1])) use(resolve4(match[2], from), name);
+      }
+      for (const match of file.content.matchAll(IMPORT_DEFAULT)) {
+        const target = resolve4(match[2], from);
+        use(target, "default");
+        use(target, match[1]);
+      }
+      for (const match of file.content.matchAll(IMPORT_NAMESPACE)) use(resolve4(match[1], from), "*");
+      for (const match of file.content.matchAll(DYNAMIC_IMPORT)) {
+        const [, typeOnly, destructured, source, member] = match;
+        useLoaded(resolve4(source, from), destructured, member, Boolean(typeOnly));
+      }
+      for (const match of file.content.matchAll(REQUIRE)) {
+        const [, destructured, source, member] = match;
+        useLoaded(resolve4(source, from), destructured, member, false);
+      }
+      if (isEntryPoint(from, appRoots, routeModules) && !isBarrel(from)) use({ files: [from], folders: [] }, "*");
     }
+    for (const entry of packageEntries) use({ files: [entry], folders: [] }, "*");
+    const usedInAFolderOf = (file, name) => {
+      let folder = file;
+      while (folder) {
+        folder = folder.slice(0, Math.max(folder.lastIndexOf("/"), 0));
+        if (usedInFolder.get(folder)?.has(name)) return true;
+      }
+      return false;
+    };
     const deadByFile = /* @__PURE__ */ new Map();
     for (const [key, loc] of exports) {
       const symbolName = key.split("::")[1];
-      const exportFileBasename = loc.file.split("/").pop()?.replace(/\.\w+$/, "") ?? "";
-      const importSet = imports.get(exportFileBasename);
-      const isImported = importSet?.has(symbolName) ?? false;
-      if (!isImported && !allImportedSymbols.has(symbolName)) {
+      const isUsed = used.has(key) || used.has(`${loc.file}::*`) || usedInAFolderOf(loc.file, symbolName);
+      if (!isUsed) {
         deadByFile.set(loc.file, (deadByFile.get(loc.file) ?? 0) + 1);
       }
     }
@@ -2521,19 +3278,6 @@ function catchFinding(file, catchLine, body) {
     fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
   };
 }
-var NON_CODE = /\/\/.*|\/\*[\s\S]*?\*\/|'(?:[^'\\\n]|\\[\s\S])*'|"(?:[^"\\\n]|\\[\s\S])*"|`(?:[^`\\]|\\[\s\S])*`/g;
-function blankOut(source, strings) {
-  const blank = (s) => s.replace(/[^\n]/g, " ");
-  return source.replace(NON_CODE, (m) => m[0] === "/" ? blank(m) : strings ? m[0] + blank(m.slice(1, -1)) + m[0] : m);
-}
-function closingBrace(code, open) {
-  let depth = 0;
-  for (let i = open; i < code.length; i++) {
-    if (code[i] === "{") depth++;
-    else if (code[i] === "}" && --depth === 0) return i;
-  }
-  return -1;
-}
 function returnedValues(code, text) {
   const values = [];
   for (const m of code.matchAll(/(?<![\w$.])return\b/g)) {
@@ -2711,47 +3455,46 @@ var comprehensionDebtRule = {
 };
 
 // src/rules/phantom-dependency.ts
-var PHANTOM_PACKAGES = /* @__PURE__ */ new Set([
-  "huggingface-cli",
-  // hallucinated, real: huggingface_hub
-  "flask-hierarchical",
-  // hallucinated
-  "beautifulsoup",
-  // real is beautifulsoup4
-  "python-dotenv",
-  // real is python-dotenv (this one exists but confusable)
-  "openai-sdk",
-  // hallucinated, real: openai
-  "anthropic-sdk",
-  // hallucinated, real: @anthropic-ai/sdk
-  "langchain-core",
-  // confusable with @langchain/core
-  "react-native-utils",
-  // hallucinated generic
-  "next-middleware",
-  // hallucinated
-  "supabase-client",
-  // hallucinated, real: @supabase/supabase-js
-  "stripe-sdk",
-  // hallucinated, real: stripe
-  "prisma-client",
-  // hallucinated, real: @prisma/client
-  "tailwind-utils",
-  // hallucinated
-  "express-validator-v2",
-  // hallucinated
-  "node-postgres-pool",
-  // hallucinated, real: pg
-  "mongo-client",
-  // hallucinated, real: mongodb
-  "redis-client",
-  // hallucinated, real: redis or ioredis
-  "aws-s3-upload",
-  // hallucinated
-  "gpt-tokenizer"
-  // exists but often confused
+var PHANTOM_PACKAGES = /* @__PURE__ */ new Map([
+  ["huggingface-cli", ["@huggingface/hub"]],
+  // a Python CLI; an npm placeholder
+  ["flask-hierarchical", []],
+  // not on npm
+  ["beautifulsoup", ["cheerio"]],
+  // a Python library (beautifulsoup4); not on npm
+  ["python-dotenv", ["dotenv"]],
+  // a Python library; an npm placeholder
+  ["openai-sdk", ["openai"]],
+  // unpublished
+  ["anthropic-sdk", ["@anthropic-ai/sdk"]],
+  // an npm placeholder
+  ["langchain-core", ["@langchain/core"]],
+  // deprecated
+  ["react-native-utils", []],
+  // a 2015 native module
+  ["next-middleware", []],
+  // a 2017 0.0.1; Next.js has middleware built in
+  ["supabase-client", ["@supabase/supabase-js"]],
+  // unpublished
+  ["stripe-sdk", ["stripe"]],
+  // not on npm
+  ["prisma-client", ["@prisma/client"]],
+  // an empty 0.0.0 placeholder
+  ["tailwind-utils", []],
+  // a 2021 alpha
+  ["express-validator-v2", ["express-validator"]],
+  // not on npm
+  ["node-postgres-pool", ["pg"]],
+  // not on npm
+  ["mongo-client", ["mongodb"]],
+  // a 2013 wrapper
+  ["redis-client", ["redis", "ioredis"]],
+  // a 2015 client
+  ["aws-s3-upload", ["@aws-sdk/client-s3"]]
+  // a 2018 0.0.2
 ]);
-var KNOWN_SHORT_PACKAGES = /* @__PURE__ */ new Set([
+var KNOWN_PACKAGES = /* @__PURE__ */ new Set([
+  // 2-char names
   "pg",
   "ws",
   "ms",
@@ -2765,7 +3508,31 @@ var KNOWN_SHORT_PACKAGES = /* @__PURE__ */ new Set([
   "io",
   "db",
   "fp",
-  "rx"
+  "rx",
+  // -js suffix
+  "crypto-js",
+  "chroma-js",
+  "libphonenumber-js",
+  "ua-parser-js",
+  "keycloak-js",
+  "pusher-js",
+  "matter-js",
+  "amplitude-js",
+  // Vanity prefixes
+  "fast-glob",
+  "fast-deep-equal",
+  "fast-json-stable-stringify",
+  "fast-xml-parser",
+  "fast-levenshtein",
+  "fast-safe-stringify",
+  "fast-uri",
+  "fast-equals",
+  "fast-csv",
+  "fast-check",
+  "fast-diff",
+  "simple-git",
+  "simple-peer",
+  "simple-icons"
 ]);
 var SUSPICIOUS_PATTERNS = [
   /^[a-z]{1,2}$/,
@@ -2775,6 +3542,9 @@ var SUSPICIOUS_PATTERNS = [
   /^(the|my|simple|easy|fast|super|mega|ultra)-/
   // vanity prefixes
 ];
+function quoteList(names) {
+  return names.map((n) => `"${n}"`).join(" or ");
+}
 var phantomDependencyRule = {
   id: "phantom-dependency",
   name: "Phantom Dependency",
@@ -2793,20 +3563,21 @@ var phantomDependencyRule = {
       ...project.packageJson.devDependencies ?? {}
     };
     for (const [name, _version] of Object.entries(deps)) {
-      if (PHANTOM_PACKAGES.has(name)) {
+      const meant = PHANTOM_PACKAGES.get(name);
+      if (meant) {
         findings.push({
           ruleId: "phantom-dependency",
           file: "package.json",
           line: 1,
           column: 1,
-          message: `"${name}" is a commonly hallucinated package name \u2014 verify it exists and is the correct package`,
+          message: meant.length > 0 ? `"${name}" is a commonly hallucinated package name \u2014 did you mean ${quoteList(meant)}?` : `"${name}" is a commonly hallucinated package name \u2014 verify it exists and is the correct package`,
           severity: "warning",
           category: "security",
-          fix: "Add the missing package to dependencies in package.json, or remove the import if the package is hallucinated"
+          fix: meant.length > 0 ? `Check "${name}" on npm before relying on it. If you meant ${quoteList(meant)}, install that instead and update the code that imports "${name}"` : `Check "${name}" on npm before relying on it \u2014 it may not exist, or may not be the package you meant`
         });
       }
       for (const pattern of SUSPICIOUS_PATTERNS) {
-        if (pattern.test(name) && !name.startsWith("@") && !KNOWN_SHORT_PACKAGES.has(name)) {
+        if (pattern.test(name) && !name.startsWith("@") && !KNOWN_PACKAGES.has(name)) {
           findings.push({
             ruleId: "phantom-dependency",
             file: "package.json",
@@ -2992,10 +3763,11 @@ var insecureRandomRule = {
 };
 
 // src/rules/next-server-action-validation.ts
-var USE_SERVER = /['"]use server['"]/;
+var USE_SERVER = /^\s*['"]use server['"]/m;
 var FORM_DATA_GET = /formData\.get\s*\(/;
 var VALIDATION_PATTERNS2 = [
-  /\.parse\s*\(/,
+  // A schema's .parse(), but not parsers that validate nothing: JSON.parse(), Date.parse()...
+  /(?<!\b(?:JSON|Date|URL|path|qs|querystring))\.parse\s*\(/,
   /\.safeParse\s*\(/,
   /\bvalidate\s*\(/,
   /\.parseAsync\s*\(/,
@@ -3146,6 +3918,30 @@ function findEnclosingFunction(node, parentMap) {
 }
 
 // src/rules/redirect-in-try-catch.ts
+var RETHROW_HELPERS = /^(?:unstable_rethrow|isRedirectError|isNextRouterError)$/;
+function rethrowsRedirect(handler) {
+  const param = handler.param?.type === "Identifier" ? handler.param.name : void 0;
+  if (param && handler.body.body.some((statement) => statement.type === "ThrowStatement" && statement.argument.type === "Identifier" && statement.argument.name === param)) {
+    return true;
+  }
+  return subtreeContains(handler.body, (n) => n.type === "CallExpression" && n.callee.type === "Identifier" && RETHROW_HELPERS.test(n.callee.name) || n.type === "StringLiteral" && n.value.includes("NEXT_REDIRECT"));
+}
+function bodyRethrowsRedirect(body, param) {
+  if (/\b(?:unstable_rethrow|isRedirectError|isNextRouterError)\s*\(|NEXT_REDIRECT/.test(body)) return true;
+  return param !== void 0 && new RegExp(`\\bthrow\\s+${param.replace(/\$/g, "\\$")}(?![\\w$])`).test(body);
+}
+function redirectFinding(file, line, column) {
+  return {
+    ruleId: "redirect-in-try-catch",
+    file: file.relativePath,
+    line,
+    column,
+    message: "redirect() inside try/catch \u2014 Next.js redirect throws internally, the catch block will intercept it",
+    severity: "critical",
+    category: "reliability",
+    fix: 'Move redirect() outside the try/catch block, or re-throw redirect errors in the catch: if (e instanceof Error && e.message === "NEXT_REDIRECT") throw e'
+  };
+}
 var redirectInTryCatchRule = {
   id: "redirect-in-try-catch",
   name: "Redirect Inside Try/Catch",
@@ -3157,44 +3953,42 @@ var redirectInTryCatchRule = {
     if (isTestFile(file.relativePath)) return [];
     if (!/redirect\s*\(/.test(file.content)) return [];
     const findings = [];
-    let tryDepth = 0;
-    for (let i = 0; i < file.lines.length; i++) {
-      if (isCommentLine(file.lines, i, file.commentMap)) continue;
-      const line = file.lines[i];
-      const trimmed = line.trim();
-      if (/\btry\s*\{/.test(trimmed) || trimmed === "try {") {
-        tryDepth++;
-      }
-      if (/\}\s*catch\s*[\s(]/.test(trimmed)) {
-      }
-      if (tryDepth > 0) {
-        const match = /\bredirect\s*\(/.exec(line);
-        if (match && !/\/\//.test(line.slice(0, match.index))) {
-          findings.push({
-            ruleId: "redirect-in-try-catch",
-            file: file.relativePath,
-            line: i + 1,
-            column: match.index + 1,
-            message: "redirect() inside try/catch \u2014 Next.js redirect throws internally, the catch block will intercept it",
-            severity: "critical",
-            category: "reliability",
-            fix: 'Move redirect() outside the try/catch block, or re-throw redirect errors in the catch: if (e instanceof Error && e.message === "NEXT_REDIRECT") throw e'
+    const seen = /* @__PURE__ */ new Set();
+    if (file.ast) {
+      try {
+        walkAST(file.ast.program, (node) => {
+          if (node.type !== "TryStatement" || !node.handler || rethrowsRedirect(node.handler)) return;
+          walkAST(node.block, (n) => {
+            if (n.type !== "CallExpression" || n.callee.type !== "Identifier" || n.callee.name !== "redirect") return;
+            if (!n.loc || n.start == null || seen.has(n.start)) return;
+            seen.add(n.start);
+            findings.push(redirectFinding(file, n.loc.start.line, n.loc.start.column + 1));
           });
-        }
-      }
-      for (const ch of trimmed) {
-        if (ch === "{" && tryDepth > 0) {
-        }
+        });
+        return findings;
+      } catch {
+        findings.length = 0;
+        seen.clear();
       }
-      if (tryDepth > 0 && /^\}\s*$/.test(trimmed)) {
-        let nextLine = "";
-        for (let j = i + 1; j < file.lines.length; j++) {
-          nextLine = file.lines[j].trim();
-          if (nextLine) break;
-        }
-        if (!/^catch\b/.test(nextLine) && !/^finally\b/.test(nextLine)) {
-          tryDepth--;
-        }
+    }
+    const source = file.lines.join("\n");
+    const code = blankOut(source, true);
+    const noComments = blankOut(source, false);
+    for (const tryMatch of code.matchAll(/(?<![\w$.])try\s*\{/g)) {
+      const open = tryMatch.index + tryMatch[0].length - 1;
+      const close = closingBrace(code, open);
+      if (close === -1) continue;
+      const catchMatch = /^\s*catch\s*(?:\(\s*([A-Za-z_$][\w$]*)?[^)]*\)\s*)?\{/.exec(code.slice(close + 1));
+      if (!catchMatch) continue;
+      const catchOpen = close + 1 + catchMatch[0].length - 1;
+      const catchClose = closingBrace(code, catchOpen);
+      if (bodyRethrowsRedirect(noComments.slice(catchOpen + 1, catchClose === -1 ? code.length : catchClose), catchMatch[1])) continue;
+      for (const call of code.slice(open + 1, close).matchAll(/(?<![\w$.])redirect\s*\(/g)) {
+        const offset = open + 1 + call.index;
+        if (seen.has(offset)) continue;
+        seen.add(offset);
+        const lineStart = source.lastIndexOf("\n", offset - 1) + 1;
+        findings.push(redirectFinding(file, source.slice(0, offset).split("\n").length, offset - lineStart + 1));
       }
     }
     return findings;
@@ -3487,7 +4281,7 @@ var missingWebhookVerificationRule = {
 };
 
 // src/rules/server-action-auth.ts
-var USE_SERVER3 = /['"]use server['"]/;
+var USE_SERVER3 = /^\s*['"]use server['"]/m;
 var AUTH_PATTERNS2 = [
   /getServerSession\s*\(/,
   /getSession\s*\(/,
@@ -3504,7 +4298,13 @@ var AUTH_PATTERNS2 = [
   /currentUser\s*\(/,
   /getAuth\s*\(/,
   /cookies\(\).*auth/s,
-  /session/i
+  // Session lookups, not just any "session" text (a `sessionId` form field isn't auth):
+  // verifySession(), getIronSession(), lucia.validateSession(), getServerAuthSession()...
+  /\w*session\w*\s*\(/i,
+  // ...reading a session cookie, or using and guarding a session object
+  /cookie\w*\(?\)?\)?\s*\.get\(\s*['"`][\w-]*(?:session|auth|token)/i,
+  /\bsession\??\.user(?:Id)?\b/,
+  /!\s*session\b/
 ];
 var PUBLIC_ACTION_NAMES = [
   /contact/i,
@@ -3525,7 +4325,6 @@ var serverActionAuthRule = {
   check(file, project) {
     if (isTestFile(file.relativePath)) return [];
     if (!USE_SERVER3.test(file.content)) return [];
-    if (project.hasAuthMiddleware) return [];
     for (const p of PUBLIC_ACTION_NAMES) {
       if (p.test(file.relativePath)) return [];
     }
@@ -3540,15 +4339,17 @@ var serverActionAuthRule = {
         break;
       }
     }
+    const middlewareSkipsPages = project.hasAuthMiddleware && project.authMiddlewareExcludesPages === true;
+    const middleware = project.hasAuthMiddleware && !middlewareSkipsPages;
     return [{
       ruleId: "server-action-auth",
       file: file.relativePath,
       line: reportLine,
       column: 1,
-      message: "Server action performs mutations without any authentication check \u2014 anyone can call this action",
-      severity: "warning",
+      message: middleware ? "Server action performs mutations without an inline auth check (middleware auth detected \u2014 verify coverage)" : middlewareSkipsPages ? "Server action performs mutations without any authentication check (middleware auth detected, but its matcher doesn't cover pages)" : "Server action performs mutations without any authentication check \u2014 anyone can call this action",
+      severity: middleware ? "info" : "warning",
       category: "security",
-      fix: 'Add auth check: const session = await auth(); if (!session) throw new Error("Unauthorized")'
+      fix: middleware ? 'Check the user in the action too, not only in middleware: const session = await auth(); if (!session) throw new Error("Unauthorized")' : 'Add auth check: const session = await auth(); if (!session) throw new Error("Unauthorized")'
     }];
   }
 };
@@ -3678,13 +4479,15 @@ var nextPublicSensitiveRule = {
   description: "Detects NEXT_PUBLIC_ prefix on environment variables that should be server-only \u2014 exposes secrets to the browser",
   category: "security",
   severity: "critical",
-  fileExtensions: ["ts", "tsx", "js", "jsx", "mjs", "env", "env.local", "env.production"],
+  // The scanner gives every dotenv file (.env, .env.local, .env.production...) the ext 'env'
+  fileExtensions: ["ts", "tsx", "js", "jsx", "mjs", "env"],
   check(file, _project) {
     if (isTestFile(file.relativePath)) return [];
     const findings = [];
+    const isEnvFile = file.ext === "env";
     for (let i = 0; i < file.lines.length; i++) {
-      if (isCommentLine(file.lines, i, file.commentMap)) continue;
       const line = file.lines[i];
+      if (isEnvFile ? line.trim().startsWith("#") : isCommentLine(file.lines, i, file.commentMap)) continue;
       const match = SENSITIVE_PATTERN.exec(line);
       if (match) {
         findings.push({
@@ -4147,7 +4950,17 @@ var unsafeFileUploadRule = {
 
 // src/rules/supabase-missing-rls.ts
 var CREATE_TABLE = /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:public\.)?(\w+)/gi;
-var ENABLE_RLS = /ALTER\s+TABLE\s+(?:(?:public|"public")\.)?(\w+)\s+ENABLE\s+ROW\s+LEVEL\s+SECURITY/gi;
+var ENABLE_RLS = /ALTER\s+TABLE\s+(?:IF\s+EXISTS\s+)?(?:ONLY\s+)?(?:(?:public|"public")\.)?"?(\w+)"?\s+ENABLE\s+ROW\s+LEVEL\s+SECURITY/gi;
+function isMigrationFile(file) {
+  return file.ext === "sql" && !isTestFile(file.relativePath) && /migration|supabase|schema/i.test(file.relativePath);
+}
+function sqlProject(relativePath) {
+  const dirs = relativePath.split("/").slice(0, -1);
+  const supabase = dirs.map((d) => d.toLowerCase() === "supabase").lastIndexOf(true);
+  const migrations = dirs.map((d) => /^migrations?$/i.test(d)).lastIndexOf(true);
+  const end = supabase !== -1 ? supabase : migrations !== -1 ? migrations : dirs.length;
+  return dirs.slice(0, end).join("/");
+}
 var supabaseMissingRlsRule = {
   id: "supabase-missing-rls",
   name: "Missing Row-Level Security",
@@ -4155,42 +4968,36 @@ var supabaseMissingRlsRule = {
   category: "security",
   severity: "critical",
   fileExtensions: ["sql"],
-  check(file, project) {
-    if (isTestFile(file.relativePath)) return [];
-    if (!/migration|supabase|schema/i.test(file.relativePath)) return [];
-    const content = file.content;
+  check() {
+    return [];
+  },
+  checkProject(files, _project) {
     const findings = [];
-    const tables = [];
-    CREATE_TABLE.lastIndex = 0;
-    let match;
-    while ((match = CREATE_TABLE.exec(content)) !== null) {
-      const name = match[1];
-      if (name.startsWith("_") || name === "schema_migrations") continue;
-      const beforeMatch = content.slice(0, match.index);
-      const line = beforeMatch.split("\n").length;
-      tables.push({ name, line });
-    }
-    if (tables.length === 0) return [];
     const rlsTables = /* @__PURE__ */ new Set();
-    ENABLE_RLS.lastIndex = 0;
-    while ((match = ENABLE_RLS.exec(content)) !== null) {
-      rlsTables.add(match[1].toLowerCase());
-    }
-    for (const filePath of project.allFiles) {
-      if (!filePath.endsWith(".sql")) continue;
-      if (filePath === file.relativePath) continue;
+    for (const file of files) {
+      if (file.ext !== "sql" || isTestFile(file.relativePath)) continue;
+      const project = sqlProject(file.relativePath);
+      for (const match of file.content.matchAll(ENABLE_RLS)) {
+        rlsTables.add(`${project}::${match[1].toLowerCase()}`);
+      }
     }
-    for (const table of tables) {
-      if (!rlsTables.has(table.name.toLowerCase())) {
+    for (const file of files) {
+      if (!isMigrationFile(file)) continue;
+      const content = file.content;
+      const project = sqlProject(file.relativePath);
+      for (const match of content.matchAll(CREATE_TABLE)) {
+        const name = match[1];
+        if (name.startsWith("_") || name === "schema_migrations") continue;
+        if (rlsTables.has(`${project}::${name.toLowerCase()}`)) continue;
         findings.push({
           ruleId: "supabase-missing-rls",
           file: file.relativePath,
-          line: table.line,
+          line: content.slice(0, match.index).split("\n").length,
           column: 1,
-          message: `Table "${table.name}" created without ENABLE ROW LEVEL SECURITY \u2014 all rows are publicly accessible via the Supabase API`,
+          message: `Table "${name}" created without ENABLE ROW LEVEL SECURITY \u2014 all rows are publicly accessible via the Supabase API`,
           severity: "critical",
           category: "security",
-          fix: `Add: ALTER TABLE ${table.name} ENABLE ROW LEVEL SECURITY; and create appropriate policies`
+          fix: `Add: ALTER TABLE ${name} ENABLE ROW LEVEL SECURITY; and create appropriate policies`
         });
       }
     }
@@ -4521,10 +5328,15 @@ async function scan(options) {
       }
     }
   }
+  const filesByPath = new Map(allFiles.map((file) => [file.relativePath, file]));
   for (const rule of rules) {
     if (rule.checkProject) {
-      const projectFindings = rule.checkProject(allFiles, project);
-      findings.push(...projectFindings);
+      for (const finding of rule.checkProject(allFiles, project)) {
+        const file = filesByPath.get(finding.file);
+        if (!file || !isLineSuppressed(file.lines, finding.line - 1, finding.ruleId)) {
+          findings.push(finding);
+        }
+      }
     }
   }
   const { overallScore, categoryScores } = calculateScores(findings);
@@ -4693,11 +5505,7 @@ function reportSarif(result) {
       ]
     };
     if (f.fix) {
-      sarifResult.fixes = [
-        {
-          description: { text: f.fix }
-        }
-      ];
+      sarifResult.properties = { fix: f.fix };
     }
     return sarifResult;
   });
@@ -4907,9 +5715,9 @@ function ipv6Groups(address) {
   const quad = address.match(/^(.*:)(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
   const hex = quad ? `${quad[1]}${(+quad[2] << 8 | +quad[3]).toString(16)}:${(+quad[4] << 8 | +quad[5]).toString(16)}` : address;
   const [head, tail] = hex.split("::");
-  const parse2 = (part) => part ? part.split(":").map((g) => parseInt(g, 16)) : [];
-  const front = parse2(head);
-  const back = parse2(tail);
+  const parse3 = (part) => part ? part.split(":").map((g) => parseInt(g, 16)) : [];
+  const front = parse3(head);
+  const back = parse3(tail);
   return tail === void 0 ? front : [...front, ...Array(8 - front.length - back.length).fill(0), ...back];
 }
 function embeddedIPv4(address) {