prodlint 0.10.4 → 0.10.5

package/dist/cli.js

@@ -87,7 +87,8 @@ function isLineSuppressed(lines, lineIndex, ruleId) {
   return false;
 }
 function isTestFile(relativePath) {
-  return /\.(test|spec)\.[jt]sx?$/.test(relativePath) || /(?:^|\/)__tests__\//.test(relativePath) || /(?:^|\/)tests?\//.test(relativePath) || /(?:^|\/)fixtures?\//.test(relativePath) || /(?:^|\/)mocks?\//.test(relativePath);
+  return /\.(test|spec)\.[jt]sx?$/.test(relativePath) || // Jest's __tests__ and __mocks__, jscodeshift's __testfixtures__
+  /(?:^|\/)__(?:tests|testfixtures|fixtures|mocks)__\//.test(relativePath) || /(?:^|\/)tests?\//.test(relativePath) || /(?:^|\/)fixtures?\//.test(relativePath) || /(?:^|\/)mocks?\//.test(relativePath);
 }
 function isScriptFile(relativePath) {
   if (/(?:^|\/)scripts?\//.test(relativePath)) return true;
@@ -401,6 +402,263 @@ var DEPENDENCY_TO_FRAMEWORK = {
 var SQL_SAFE_ORMS = /* @__PURE__ */ new Set(["prisma", "drizzle", "knex", "typeorm", "sequelize"]);
 var RATE_LIMIT_FRAMEWORKS = /* @__PURE__ */ new Set(["upstash-ratelimit", "express-rate-limit", "rate-limiter-flexible"]);
 
+// src/utils/middleware-matcher.ts
+function matcherExcludesApi(content, fileName) {
+  const sources = matcherSources(content, fileName);
+  if (!sources || sources.length === 0) return false;
+  return sources.every((source) => {
+    const matcher = compile(source);
+    return matcher !== null && !matcher.patterns.some(namesApi) && !apiPaths(matcher.literals).some((path) => matcher.regexp.test(path));
+  });
+}
+function matcherExcludesPages(content, fileName) {
+  const sources = matcherSources(content, fileName);
+  if (!sources || sources.length === 0) return false;
+  return sources.every((source) => {
+    const matcher = compile(source);
+    return matcher !== null && underApi(matcher.tokens);
+  });
+}
+function underApi(tokens) {
+  const [head, ...rest] = tokens;
+  if (typeof head !== "string") return false;
+  if (head.startsWith("/api/")) return true;
+  if (head !== "/api") return false;
+  for (const token of rest) {
+    const start = typeof token === "string" ? token : token.pattern ? prefixOf(token) : token.prefix + token.suffix;
+    if (!start.startsWith("/")) return false;
+    if (typeof token === "string" || token.modifier !== "?" && token.modifier !== "*") return true;
+  }
+  return true;
+}
+function apiPaths(literals) {
+  const paths = ["/api/x", "/api/x/y"];
+  for (const literal2 of literals) {
+    for (const head of ["", "/api", "/api/x"]) {
+      for (const tail of ["", "/x"]) paths.push(head + literal2 + tail);
+    }
+  }
+  return paths.filter((path) => path.startsWith("/api/"));
+}
+function matcherSources(content, fileName) {
+  const ast = parseFile(content, fileName);
+  if (!ast) return null;
+  for (const st of ast.program.body) {
+    if (st.type !== "ExportNamedDeclaration" || st.declaration?.type !== "VariableDeclaration") continue;
+    if (st.declaration.kind !== "const") continue;
+    for (const d of st.declaration.declarations) {
+      if (d.id.type !== "Identifier" || d.id.name !== "config" || !d.init) continue;
+      const config = unwrap(d.init);
+      if (config.type !== "ObjectExpression") return null;
+      if (config.properties.some((p) => p.type !== "ObjectProperty")) return null;
+      const matcher = property(config, "matcher");
+      if (!matcher) return void 0;
+      const values = matcher.type === "ArrayExpression" ? matcher.elements : [matcher];
+      const sources = [];
+      for (const value of values) {
+        const element = value ? unwrap(value) : null;
+        const source = element?.type === "ObjectExpression" ? property(element, "source") : element;
+        const text = source ? literal(source) : null;
+        if (text === null) return null;
+        sources.push(text);
+      }
+      return sources;
+    }
+  }
+  return void 0;
+}
+function unwrap(node) {
+  while (node.type === "TSSatisfiesExpression" || node.type === "TSAsExpression") node = node.expression;
+  return node;
+}
+function property(object, name) {
+  if (object.type !== "ObjectExpression") return void 0;
+  let value;
+  for (const p of object.properties) {
+    if (p.type !== "ObjectProperty" || p.computed) continue;
+    const key = p.key.type === "Identifier" ? p.key.name : p.key.type === "StringLiteral" ? p.key.value : null;
+    if (key === name) value = unwrap(p.value);
+  }
+  return value;
+}
+function literal(node) {
+  if (node.type === "StringLiteral") return node.value;
+  if (node.type === "TemplateLiteral" && node.expressions.length === 0) return node.quasis[0].value.cooked ?? null;
+  return null;
+}
+function namesApi(pattern) {
+  let kept = "";
+  const negative = [];
+  for (let i = 0; i < pattern.length; i++) {
+    const c = pattern[i];
+    const skipping = negative.includes(true);
+    if (c === "\\") {
+      if (!skipping) kept += pattern.slice(i, i + 2);
+      i++;
+    } else if (c === "(") {
+      negative.push(pattern.startsWith("(?!", i) || pattern.startsWith("(?<!", i));
+      if (!skipping) kept += c;
+    } else if (c === ")") {
+      negative.pop();
+      if (!negative.includes(true)) kept += c;
+    } else if (!skipping) {
+      kept += c;
+    }
+  }
+  return /\bapi\b/i.test(kept);
+}
+var DELIMITER = "/#?";
+var PREFIXES = "./";
+var escape = (s) => s.replace(/([.+*?=^!:${}()[\]|/\\])/g, "\\$1");
+var prefixOf = (token) => (token.modifier === "*" || token.modifier === "+") && !token.prefix && !token.suffix ? "/" : token.prefix;
+function lex(source) {
+  const tokens = [];
+  let i = 0;
+  while (i < source.length) {
+    const c = source[i];
+    if (c === "*" || c === "+" || c === "?") {
+      tokens.push({ type: "MODIFIER", value: source[i++] });
+    } else if (c === "\\") {
+      tokens.push({ type: "ESCAPED_CHAR", value: source[i + 1] });
+      i += 2;
+    } else if (c === "{" || c === "}") {
+      tokens.push({ type: c === "{" ? "OPEN" : "CLOSE", value: source[i++] });
+    } else if (c === ":") {
+      const name = /^\w+/.exec(source.slice(i + 1))?.[0];
+      if (!name) throw new TypeError(`Missing parameter name at ${i}`);
+      tokens.push({ type: "NAME", value: name });
+      i += 1 + name.length;
+    } else if (c === "(") {
+      let depth = 1;
+      let pattern = "";
+      let j = i + 1;
+      if (source[j] === "?") throw new TypeError(`Pattern cannot start with "?" at ${j}`);
+      while (j < source.length) {
+        if (source[j] === "\\") {
+          pattern += source[j++] + source[j++];
+          continue;
+        }
+        if (source[j] === ")") {
+          if (--depth === 0) {
+            j++;
+            break;
+          }
+        } else if (source[j] === "(") {
+          depth++;
+          if (source[j + 1] !== "?") throw new TypeError(`Capturing groups are not allowed at ${j}`);
+        }
+        pattern += source[j++];
+      }
+      if (depth) throw new TypeError(`Unbalanced pattern at ${i}`);
+      if (!pattern) throw new TypeError(`Missing pattern at ${i}`);
+      tokens.push({ type: "PATTERN", value: pattern });
+      i = j;
+    } else {
+      tokens.push({ type: "CHAR", value: source[i++] });
+    }
+  }
+  tokens.push({ type: "END", value: "" });
+  return tokens;
+}
+function parse2(source) {
+  const tokens = lex(source);
+  const result = [];
+  let i = 0;
+  let path = "";
+  const tryConsume = (type) => i < tokens.length && tokens[i].type === type ? tokens[i++].value : void 0;
+  const mustConsume = (type) => {
+    const value = tryConsume(type);
+    if (value === void 0) throw new TypeError(`Unexpected ${tokens[i].type}, expected ${type}`);
+    return value;
+  };
+  const consumeText = () => {
+    let text = "";
+    let value;
+    while (value = tryConsume("CHAR") || tryConsume("ESCAPED_CHAR")) text += value;
+    return text;
+  };
+  const safePattern = (prefix) => {
+    const prev = result[result.length - 1];
+    const prevText = prefix || (typeof prev === "string" ? prev : "");
+    if (prev && !prevText) throw new TypeError("Must have text between two parameters");
+    if (!prevText || [...DELIMITER].some((c) => prevText.includes(c))) return `[^${escape(DELIMITER)}]+?`;
+    return `(?:(?!${escape(prevText)})[^${escape(DELIMITER)}])+?`;
+  };
+  while (i < tokens.length) {
+    const char = tryConsume("CHAR");
+    const name = tryConsume("NAME");
+    const pattern = tryConsume("PATTERN");
+    if (name || pattern) {
+      let prefix = char || "";
+      if (!PREFIXES.includes(prefix)) {
+        path += prefix;
+        prefix = "";
+      }
+      if (path) {
+        result.push(path);
+        path = "";
+      }
+      result.push({ prefix, suffix: "", pattern: pattern || safePattern(prefix), modifier: tryConsume("MODIFIER") || "" });
+      continue;
+    }
+    const value = char || tryConsume("ESCAPED_CHAR");
+    if (value) {
+      path += value;
+      continue;
+    }
+    if (path) {
+      result.push(path);
+      path = "";
+    }
+    if (tryConsume("OPEN")) {
+      const prefix = consumeText();
+      const name2 = tryConsume("NAME") || "";
+      const pattern2 = tryConsume("PATTERN") || "";
+      const suffix = consumeText();
+      mustConsume("CLOSE");
+      result.push({ prefix, suffix, pattern: name2 && !pattern2 ? safePattern(prefix) : pattern2, modifier: tryConsume("MODIFIER") || "" });
+      continue;
+    }
+    mustConsume("END");
+  }
+  return result;
+}
+function compile(source) {
+  if (!source.startsWith("/")) return null;
+  try {
+    const tokens = parse2(source);
+    let route = "^";
+    for (const token of tokens) {
+      if (typeof token === "string") {
+        route += escape(token);
+        continue;
+      }
+      if (!token.pattern) {
+        route += `(?:${escape(token.prefix)}${escape(token.suffix)})${token.modifier}`;
+        continue;
+      }
+      const repeat = token.modifier === "*" || token.modifier === "+";
+      const prefix = escape(prefixOf(token));
+      const suffix = escape(token.suffix);
+      if (!prefix && !suffix) {
+        route += `(${token.pattern})${token.modifier}`;
+      } else if (repeat) {
+        route += `(?:${prefix}((?:${token.pattern})(?:${suffix}${prefix}(?:${token.pattern}))*)${suffix})${token.modifier === "*" ? "?" : ""}`;
+      } else {
+        route += `(?:${prefix}(${token.pattern})${suffix})${token.modifier}`;
+      }
+    }
+    return {
+      regexp: new RegExp(`${route}[${escape(DELIMITER)}]?$`),
+      tokens,
+      literals: tokens.filter((token) => typeof token === "string"),
+      patterns: tokens.flatMap((token) => typeof token === "string" ? [] : [token.pattern])
+    };
+  } catch {
+    return null;
+  }
+}
+
 // src/utils/file-walker.ts
 var DEFAULT_IGNORES = [
   "**/node_modules/**",
@@ -430,6 +688,37 @@ var SCAN_EXTENSIONS = [
 ];
 var AST_EXTENSIONS = /* @__PURE__ */ new Set(["ts", "tsx", "js", "jsx", "mjs", "cjs"]);
 var MAX_FILE_SIZE = 1024 * 1024;
+var MIDDLEWARE_FILES = [
+  "middleware.ts",
+  "middleware.js",
+  "src/middleware.ts",
+  "src/middleware.js",
+  "proxy.ts",
+  "proxy.js",
+  "src/proxy.ts",
+  "src/proxy.js"
+];
+var MIDDLEWARE_AUTH_PATTERNS = [
+  /getSession/i,
+  /getUser/i,
+  /auth\(\)/,
+  /withAuth/i,
+  /clerkMiddleware/i,
+  /authMiddleware/i,
+  /NextAuth/i,
+  /supabase.*auth/i,
+  /createMiddlewareClient/i,
+  /getToken/i,
+  /verifyToken/i,
+  /jwt/i,
+  /updateSession/i,
+  // Auth.js: export { auth as proxy } from '@/auth', export default auth((req) => …)
+  /\bauth\s+as\s+(?:proxy|middleware|default)\b/,
+  /\bauth\(/,
+  // NextAuth v4: export { default } from 'next-auth/middleware'
+  /['"]next-auth\/middleware['"]/
+];
+var MIDDLEWARE_RATE_LIMIT_PATTERNS = [/rateLimit/i, /throttle/i];
 async function walkFiles(root, extraIgnores = []) {
   const patterns = SCAN_EXTENSIONS.map((ext) => `**/*.${ext}`);
   patterns.push("**/.env", "**/.env.*");
@@ -568,6 +857,8 @@ async function buildProjectContext(root, files) {
   let declaredDependencies = /* @__PURE__ */ new Set();
   let tsconfigPaths = /* @__PURE__ */ new Set();
   let hasAuthMiddleware = false;
+  let authMiddlewareExcludesApi = false;
+  let authMiddlewareExcludesPages = false;
   let hasRateLimiting = false;
   const detectedFrameworks = /* @__PURE__ */ new Set();
   let gitignoreContent = null;
@@ -619,45 +910,19 @@ async function buildProjectContext(root, files) {
     }
   } catch {
   }
-  try {
-    for (const name of ["middleware.ts", "middleware.js", "src/middleware.ts", "src/middleware.js"]) {
-      try {
-        const content = await readFile(resolve(root, name), "utf-8");
-        const authPatterns = [
-          /getSession/i,
-          /getUser/i,
-          /auth\(\)/,
-          /withAuth/i,
-          /clerkMiddleware/i,
-          /authMiddleware/i,
-          /NextAuth/i,
-          /supabase.*auth/i,
-          /createMiddlewareClient/i,
-          /getToken/i,
-          /verifyToken/i,
-          /jwt/i,
-          /updateSession/i
-        ];
-        if (authPatterns.some((p) => p.test(content))) {
-          hasAuthMiddleware = true;
-          break;
-        }
-      } catch {
-      }
+  for (const name of MIDDLEWARE_FILES) {
+    let content;
+    try {
+      content = await readFile(resolve(root, name), "utf-8");
+    } catch {
+      continue;
     }
-  } catch {
-  }
-  if (!hasRateLimiting) {
-    for (const name of ["middleware.ts", "middleware.js", "src/middleware.ts", "src/middleware.js"]) {
-      try {
-        const content = await readFile(resolve(root, name), "utf-8");
-        if (/rateLimit/i.test(content) || /throttle/i.test(content)) {
-          hasRateLimiting = true;
-          break;
-        }
-      } catch {
-      }
+    if (MIDDLEWARE_AUTH_PATTERNS.some((p) => p.test(content))) {
+      authMiddlewareExcludesApi = (!hasAuthMiddleware || authMiddlewareExcludesApi) && matcherExcludesApi(content, name);
+      authMiddlewareExcludesPages = (!hasAuthMiddleware || authMiddlewareExcludesPages) && matcherExcludesPages(content, name);
+      hasAuthMiddleware = true;
     }
+    if (MIDDLEWARE_RATE_LIMIT_PATTERNS.some((p) => p.test(content))) hasRateLimiting = true;
   }
   try {
     gitignoreContent = await readFile(resolve(root, ".gitignore"), "utf-8");
@@ -670,6 +935,8 @@ async function buildProjectContext(root, files) {
     declaredDependencies,
     tsconfigPaths,
     hasAuthMiddleware,
+    authMiddlewareExcludesApi,
+    authMiddlewareExcludesPages,
     hasRateLimiting,
     detectedFrameworks,
     gitignoreContent,
@@ -987,6 +1254,15 @@ var AUTH_PATTERNS = [
 var MUTATION_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
 var HANDLER_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE"]);
 var TRPC_ROUTE = /['"]@trpc\/server\/adapters\//;
+function servedUnderApi(relativePath) {
+  const pages = /(?:^|\/)pages\/api\/(.+)$/.exec(relativePath);
+  if (pages) return !/^index\.\w+$/.test(pages[1]);
+  const segments = relativePath.split("/");
+  const app = segments.indexOf("app");
+  if (app === -1) return false;
+  const url = segments.slice(app + 1, -1).filter((s) => !/^\(.*\)$/.test(s) && !s.startsWith("@"));
+  return url[0] === "api" && url.length > 1;
+}
 var AUTH_WORD = /^(?:auth(?!or(?:s|ed|ing|ship)?$)|session)/i;
 var NO_AUTH_WORD = /^(?:without|no|non|skip|bypass|optional|public|anon|anonymous|guest)$/i;
 function words(name) {
@@ -1195,8 +1471,10 @@ var authChecksRule = {
     const handlers = file.ast ? handlersFromAst(file.ast.program) : handlersFromText(file);
     const exposed = handlers.filter((h) => !h.authed);
     if (handlers.length > 0 && exposed.length === 0) return [];
+    const middlewareSkipsRoute = project.hasAuthMiddleware && project.authMiddlewareExcludesApi === true && servedUnderApi(file.relativePath);
+    const middlewareAuth = project.hasAuthMiddleware && !middlewareSkipsRoute;
     let severity;
-    if (project.hasAuthMiddleware) {
+    if (middlewareAuth) {
       severity = "info";
     } else if (exposed.some((h) => h.local && MUTATION_METHODS.has(h.method)) && !TRPC_ROUTE.test(file.content)) {
       severity = "critical";
@@ -1204,7 +1482,7 @@ var authChecksRule = {
       severity = "info";
     }
     const handlerLine = exposed[0]?.line ?? 1;
-    const message = project.hasAuthMiddleware ? "API route has no inline auth check (middleware auth detected \u2014 verify coverage)" : "API route has no authentication check";
+    const message = middlewareAuth ? "API route has no inline auth check (middleware auth detected \u2014 verify coverage)" : middlewareSkipsRoute ? "API route has no authentication check (middleware auth detected, but its matcher excludes /api)" : "API route has no authentication check";
     return [{
       ruleId: "auth-checks",
       file: file.relativePath,
@@ -2608,16 +2886,190 @@ var codebaseConsistencyRule = {
 };
 
 // src/rules/dead-exports.ts
-function isEntryPoint(relativePath) {
+function isEntryPoint(relativePath, appRoots, routeModules) {
   const name = relativePath.split("/").pop() ?? "";
-  return /^(page|layout|loading|error|not-found|route|middleware|instrumentation|opengraph-image|twitter-image|icon|apple-icon|sitemap|robots|manifest)\.(tsx?|jsx?)$/.test(name) || /^index\.(tsx?|jsx?)$/.test(name) || name === "global-error.tsx" || name === "global-error.jsx";
+  return /^(page|layout|loading|error|not-found|route|opengraph-image|twitter-image|icon|apple-icon|sitemap|robots|manifest)\.(tsx?|jsx?)$/.test(name) || isBarrel(relativePath) || name === "global-error.tsx" || name === "global-error.jsx" || // SvelteKit's route files: +page.ts, +page.server.ts, +layout.ts, +server.ts
+  /^\+(page|layout|server)(\.server)?\.(ts|js)$/.test(name) || // Storybook's stories: it reads a CSF file's default export as the meta, and each named
+  // export as a story
+  /\.stories\.(tsx?|jsx?|mjs)$/.test(name) || isNextRootFile(relativePath, appRoots) || isPagesRoute(relativePath, appRoots) || routeModules.has(relativePath);
+}
+function isBarrel(relativePath) {
+  return /(?:^|\/)index\.(tsx?|jsx?)$/.test(relativePath);
+}
+function isAppFolder(dir, appRoots) {
+  return appRoots.has(dir) || appRoots.has(dir.replace(/(?:^|\/)src$/, ""));
+}
+function isNextRootFile(relativePath, appRoots) {
+  const match = /^(?:(.*)\/)?(?:middleware|proxy|instrumentation|instrumentation-client)\.(tsx?|jsx?)$/.exec(relativePath);
+  return match !== null && isAppFolder(match[1] ?? "", appRoots);
+}
+function isPagesRoute(relativePath, appRoots) {
+  if (!/\.(tsx?|jsx?)$/.test(relativePath)) return false;
+  const parts = relativePath.split("/");
+  return parts.some((part, i) => part === "pages" && isAppFolder(parts.slice(0, i).join("/"), appRoots));
+}
+function findAppRoots(paths) {
+  const roots = /* @__PURE__ */ new Set([""]);
+  for (const path of paths) {
+    const match = /^(?:(.*)\/)?package\.json$/.exec(path);
+    if (match) roots.add(match[1] ?? "");
+  }
+  return roots;
+}
+function findRouteModules(files, paths, appRoots) {
+  const appFolders = [];
+  for (const path of paths) {
+    const match = /^(?:(.*)\/)?app\/root\.(tsx?|jsx?)$/.exec(path);
+    if (match && appRoots.has(match[1] ?? "")) appFolders.push(path.slice(0, path.lastIndexOf("/")));
+  }
+  const modules = /* @__PURE__ */ new Set();
+  for (const { relativePath, content } of files) {
+    const folder = appFolders.find((f) => relativePath.startsWith(`${f}/`));
+    if (folder === void 0) continue;
+    const path = relativePath.slice(folder.length + 1);
+    if (/^(?:root|entry\.server|routes\/.+)\.(tsx?|jsx?)$/.test(path)) {
+      modules.add(relativePath);
+    } else if (/^routes\.(?:[cm]?[jt]s|[jt]sx)$/.test(path)) {
+      for (const match of content.matchAll(/['"`]([^'"`\n]+\.(?:tsx?|jsx?))['"`]/g)) {
+        const module = normalizePath(`${folder}/${match[1]}`);
+        if (module !== null) modules.add(module);
+      }
+    }
+  }
+  return modules;
 }
 var IMPORT_NAMED = /\bimport\s*(?:type\s*)?(?:[\w$]+\s*,\s*)?\{([^}]*)\}\s*from\s*['"]([^'"]+)['"]/g;
 var IMPORT_DEFAULT = /\bimport\s+([\w$]+)\s*(?:,\s*\{[^}]*\}\s*)?from\s*['"]([^'"]+)['"]/g;
 var IMPORT_NAMESPACE = /\bimport\s+(?:[\w$]+\s*,\s*)?\*\s*as\s+[\w$]+\s+from\s*['"]([^'"]+)['"]/g;
-var FROM_SOURCE = /from\s+['"]([^'"]+)['"]/g;
-function sourceBasename(source) {
-  return source.split("/").pop()?.replace(/\.\w+$/, "") ?? "";
+var DYNAMIC_IMPORT = /(\btypeof\s+)?(?:\{([^{}]*)\}\s*=\s*await\s+)?\bimport\s*\(\s*['"`]([^'"`]+)['"`]\s*\)(?:\s*\.\s*([\w$]+))?/g;
+var REQUIRE = /(?:\{([^{}]*)\}\s*=\s*)?\brequire\s*\(\s*['"]([^'"]+)['"]\s*\)(?:\s*\.\s*([\w$]+))?/g;
+var REEXPORT_NAMED = /\bexport\s*(?:type\s*)?\{([^}]*)\}\s*from\s*['"]([^'"]+)['"]/g;
+var REEXPORT_ALL = /\bexport\s*\*\s*(?:as\s+([\w$]+)\s*)?from\s*['"]([^'"]+)['"]/g;
+var MODULE_EXTENSIONS = ["ts", "tsx", "js", "jsx", "mjs", "cjs"];
+var MODULE_EXTENSION = /\.(?:[cm]?[jt]s|[jt]sx)$/;
+function parseSpecifiers(list) {
+  return list.replace(/\/\/.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, "").split(",").map((s) => s.trim().replace(/^type\s+/, "")).filter(Boolean).map((s) => {
+    const [name, alias] = s.split(/\s+as\s+/).map((part) => part.trim());
+    return [name, alias ?? name];
+  });
+}
+function normalizePath(path) {
+  const parts = [];
+  for (const part of path.split("/")) {
+    if (part === "..") {
+      if (parts.length === 0) return null;
+      parts.pop();
+    } else if (part && part !== ".") {
+      parts.push(part);
+    }
+  }
+  return parts.join("/");
+}
+var EXTERNAL = { files: [], folders: [] };
+var UNKNOWN = { files: [], folders: [""] };
+function isAsset(source) {
+  const name = source.slice(source.lastIndexOf("/") + 1);
+  return /^[^.].*\.\w+$/.test(name) && !MODULE_EXTENSION.test(name);
+}
+function stringsIn(value) {
+  if (typeof value === "string") return [value];
+  if (Array.isArray(value)) return value.flatMap(stringsIn);
+  if (value && typeof value === "object") return Object.values(value).flatMap(stringsIn);
+  return [];
+}
+function createResolver(files, project) {
+  const modules = new Set(files.filter((f) => MODULE_EXTENSIONS.includes(f.ext)).map((f) => f.relativePath));
+  const byName = /* @__PURE__ */ new Map();
+  for (const path of modules) {
+    const key = path.replace(/\.\w+$/, "").replace(/(?:^|\/)index$/, "");
+    const name = key.slice(key.lastIndexOf("/") + 1);
+    const list = byName.get(name);
+    if (list) list.push({ path, key });
+    else byName.set(name, [{ path, key }]);
+  }
+  const manifests = [];
+  for (const file of files) {
+    if (!/(?:^|\/)package\.json$/.test(file.relativePath)) continue;
+    try {
+      const json = JSON.parse(file.content);
+      if (json && typeof json === "object") manifests.push({ folder: file.relativePath.replace(/\/?package\.json$/, ""), json });
+    } catch {
+    }
+  }
+  const packages = /* @__PURE__ */ new Map();
+  for (const { folder, json } of manifests) {
+    if (typeof json.name === "string" && json.name) packages.set(json.name, [...packages.get(json.name) ?? [], folder]);
+  }
+  const findModule = (path) => {
+    const stem = path.replace(/\.(?:[cm]?js|jsx)$/, "");
+    const index = path ? `${path}/index` : "index";
+    return [
+      path,
+      // TypeScript's ESM style names the compiled file: ./format.js for format.ts
+      ...stem === path ? [] : [`${stem}.ts`, `${stem}.tsx`],
+      ...MODULE_EXTENSIONS.map((ext) => `${path}.${ext}`),
+      ...MODULE_EXTENSIONS.map((ext) => `${index}.${ext}`)
+    ].find((candidate) => modules.has(candidate));
+  };
+  const packageEntries = /* @__PURE__ */ new Set();
+  for (const { folder, json } of manifests) {
+    if (json.private === true) continue;
+    for (const target of stringsIn([json.main, json.module, json.types, json.typings, json.exports, json.bin])) {
+      const isSource = /\.(?:[cm]?ts|tsx)$/.test(target) && !/\.d\.[cm]?ts$/.test(target);
+      const path = isSource || target.includes("*") ? null : normalizePath(`${folder}/${target}`);
+      if (path === null) continue;
+      const stem = path.replace(/\.d\.ts$/, "").replace(MODULE_EXTENSION, "");
+      const entry = findModule(path) ?? findModule(stem) ?? findModule(stem.replace(/(^|\/)(?:dist|build|lib|out|esm|cjs)\//, "$1src/"));
+      if (entry) packageEntries.add(entry);
+    }
+  }
+  const resolveRelative = (path) => {
+    const normalized = normalizePath(path);
+    if (normalized?.includes("${")) {
+      const parts = normalized.split(/\$\{[^}]*\}/).map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+      const pattern = new RegExp(`^${parts.join(".*")}(?:\\.\\w+)?$`);
+      return { files: [...modules].filter((m) => pattern.test(m)), folders: [] };
+    }
+    const module = normalized === null ? void 0 : findModule(normalized);
+    if (module) return { files: [module], folders: [] };
+    return isAsset(path) ? EXTERNAL : UNKNOWN;
+  };
+  const resolveBare = (source) => {
+    if (/^[a-z][\w+.-]*:/i.test(source)) return EXTERNAL;
+    const name = source.startsWith("@") ? source.split("/").slice(0, 2).join("/") : source.split("/")[0];
+    const folders = packages.get(name);
+    if (folders) {
+      const subpath = source.slice(name.length + 1);
+      const found = folders.map((folder) => {
+        const base = folder ? `${folder}/` : "";
+        return subpath ? findModule(base + subpath) ?? findModule(`${base}src/${subpath}`) : findModule(folder) ?? findModule(`${base}src`);
+      });
+      return { files: found.filter((f) => f !== void 0), folders };
+    }
+    if (NODE_BUILTINS.has(name) || project.declaredDependencies.has(name)) return EXTERNAL;
+    const segments = source.replace(MODULE_EXTENSION, "").split("/").filter(Boolean);
+    const named = byName.get(segments[segments.length - 1] ?? "") ?? [];
+    for (let i = 0; i < segments.length; i++) {
+      const path = segments.slice(i).join("/");
+      const matches = named.filter((m) => m.key === path || m.key.endsWith(`/${path}`));
+      if (matches.length > 0) return i <= 1 ? { files: matches.map((m) => m.path), folders: [] } : UNKNOWN;
+    }
+    return isAsset(source) ? EXTERNAL : UNKNOWN;
+  };
+  const cache = /* @__PURE__ */ new Map();
+  const resolve4 = (source, from) => {
+    const clean = source.replace(/\?.*$/, "");
+    const relative = /^\.\.?(?:\/|$)/.test(clean);
+    const dir = relative ? from.slice(0, from.lastIndexOf("/") + 1) : "";
+    const key = `${dir}\0${clean}`;
+    let target = cache.get(key);
+    if (!target) {
+      target = relative ? resolveRelative(dir + clean) : resolveBare(clean);
+      cache.set(key, target);
+    }
+    return target;
+  };
+  return { resolve: resolve4, packageEntries };
 }
 var THRESHOLD = 5;
 var deadExportsRule = {
@@ -2630,17 +3082,16 @@ var deadExportsRule = {
   check() {
     return [];
   },
-  checkProject(files, _project) {
+  checkProject(files, project) {
     const sourceFiles = files.filter(
       (f) => ["ts", "tsx", "js", "jsx"].includes(f.ext) && !isTestFile(f.relativePath) && !isScriptFile(f.relativePath)
     );
+    const appRoots = findAppRoots(project.allFiles);
+    const routeModules = findRouteModules(files, project.allFiles, appRoots);
+    const { resolve: resolve4, packageEntries } = createResolver(files, project);
     const exports = /* @__PURE__ */ new Map();
-    const imports = /* @__PURE__ */ new Map();
-    const allImportedSymbols = /* @__PURE__ */ new Set();
-    const importedFiles = /* @__PURE__ */ new Set();
-    const namespaceImported = /* @__PURE__ */ new Set();
     for (const file of sourceFiles) {
-      if (isEntryPoint(file.relativePath)) continue;
+      if (isEntryPoint(file.relativePath, appRoots, routeModules) || packageEntries.has(file.relativePath)) continue;
       let inTemplateLiteral = false;
       for (let i = 0; i < file.lines.length; i++) {
         const line = file.lines[i];
@@ -2681,38 +3132,92 @@ var deadExportsRule = {
         }
       }
     }
-    const addImport = (sym, source) => {
-      allImportedSymbols.add(sym);
-      const fromBasename = sourceBasename(source);
-      if (fromBasename) {
-        const set = imports.get(fromBasename) ?? /* @__PURE__ */ new Set();
-        set.add(sym);
-        imports.set(fromBasename, set);
+    const contents = new Map(files.map((f) => [f.relativePath, f.content]));
+    const used = /* @__PURE__ */ new Set();
+    const usedInFolder = /* @__PURE__ */ new Map();
+    const reexports = /* @__PURE__ */ new Map();
+    const reexportsOf = (file) => {
+      let list = reexports.get(file);
+      if (!list) {
+        list = [];
+        const content = contents.get(file) ?? "";
+        for (const match of content.matchAll(REEXPORT_NAMED)) {
+          for (const [imported, exported] of parseSpecifiers(match[1])) list.push({ source: match[2], imported, exported });
+        }
+        for (const match of content.matchAll(REEXPORT_ALL)) {
+          list.push(match[1] ? { source: match[2], imported: "*", exported: match[1] } : { source: match[2], imported: "", exported: "*" });
+        }
+        reexports.set(file, list);
+      }
+      return list;
+    };
+    const use = (target, name) => {
+      if (name !== "*" && name !== "default") {
+        for (const folder of target.folders) {
+          const names = usedInFolder.get(folder) ?? /* @__PURE__ */ new Set();
+          names.add(name);
+          usedInFolder.set(folder, names);
+        }
+      }
+      for (const file of target.files) {
+        const key = `${file}::${name}`;
+        if (used.has(key)) continue;
+        used.add(key);
+        for (const { source, imported, exported } of reexportsOf(file)) {
+          if (exported === "*") {
+            if (name !== "default") use(resolve4(source, file), name);
+          } else if (name === "*" || name === exported) {
+            use(resolve4(source, file), imported);
+          }
+        }
+      }
+    };
+    const useLoaded = (target, destructured, member, typeOnly) => {
+      if (member && !["then", "catch", "finally"].includes(member)) {
+        use(target, member);
+      } else if (typeOnly) {
+        return;
+      } else if (destructured !== void 0 && !destructured.includes("...")) {
+        for (const name of destructured.split(",").map((s) => s.split(/[:=]/)[0].trim()).filter(Boolean)) use(target, name);
+      } else {
+        use(target, "*");
       }
     };
     for (const file of files) {
+      const from = file.relativePath;
       for (const match of file.content.matchAll(IMPORT_NAMED)) {
-        const symbols = match[1].replace(/\/\/.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, "").split(",").map((s) => s.trim().replace(/^type\s+/, "").split(/\s+as\s+/)[0].trim()).filter(Boolean);
-        for (const sym of symbols) addImport(sym, match[2]);
+        for (const [name] of parseSpecifiers(match[1])) use(resolve4(match[2], from), name);
       }
       for (const match of file.content.matchAll(IMPORT_DEFAULT)) {
-        addImport(match[1], match[2]);
+        const target = resolve4(match[2], from);
+        use(target, "default");
+        use(target, match[1]);
       }
-      for (const match of file.content.matchAll(IMPORT_NAMESPACE)) {
-        namespaceImported.add(sourceBasename(match[1]));
+      for (const match of file.content.matchAll(IMPORT_NAMESPACE)) use(resolve4(match[1], from), "*");
+      for (const match of file.content.matchAll(DYNAMIC_IMPORT)) {
+        const [, typeOnly, destructured, source, member] = match;
+        useLoaded(resolve4(source, from), destructured, member, Boolean(typeOnly));
       }
-      for (const match of file.content.matchAll(FROM_SOURCE)) {
-        importedFiles.add(match[1]);
+      for (const match of file.content.matchAll(REQUIRE)) {
+        const [, destructured, source, member] = match;
+        useLoaded(resolve4(source, from), destructured, member, false);
       }
-    }
+      if (isEntryPoint(from, appRoots, routeModules) && !isBarrel(from)) use({ files: [from], folders: [] }, "*");
+    }
+    for (const entry of packageEntries) use({ files: [entry], folders: [] }, "*");
+    const usedInAFolderOf = (file, name) => {
+      let folder = file;
+      while (folder) {
+        folder = folder.slice(0, Math.max(folder.lastIndexOf("/"), 0));
+        if (usedInFolder.get(folder)?.has(name)) return true;
+      }
+      return false;
+    };
     const deadByFile = /* @__PURE__ */ new Map();
     for (const [key, loc] of exports) {
       const symbolName = key.split("::")[1];
-      const exportFileBasename = loc.file.split("/").pop()?.replace(/\.\w+$/, "") ?? "";
-      if (namespaceImported.has(exportFileBasename)) continue;
-      const importSet = imports.get(exportFileBasename);
-      const isImported = importSet?.has(symbolName) ?? false;
-      if (!isImported && !allImportedSymbols.has(symbolName)) {
+      const isUsed = used.has(key) || used.has(`${loc.file}::*`) || usedInAFolderOf(loc.file, symbolName);
+      if (!isUsed) {
         deadByFile.set(loc.file, (deadByFile.get(loc.file) ?? 0) + 1);
       }
     }
@@ -3826,7 +4331,6 @@ var serverActionAuthRule = {
   check(file, project) {
     if (isTestFile(file.relativePath)) return [];
     if (!USE_SERVER3.test(file.content)) return [];
-    if (project.hasAuthMiddleware) return [];
     for (const p of PUBLIC_ACTION_NAMES) {
       if (p.test(file.relativePath)) return [];
     }
@@ -3841,15 +4345,17 @@ var serverActionAuthRule = {
         break;
       }
     }
+    const middlewareSkipsPages = project.hasAuthMiddleware && project.authMiddlewareExcludesPages === true;
+    const middleware = project.hasAuthMiddleware && !middlewareSkipsPages;
     return [{
       ruleId: "server-action-auth",
       file: file.relativePath,
       line: reportLine,
       column: 1,
-      message: "Server action performs mutations without any authentication check \u2014 anyone can call this action",
-      severity: "warning",
+      message: middleware ? "Server action performs mutations without an inline auth check (middleware auth detected \u2014 verify coverage)" : middlewareSkipsPages ? "Server action performs mutations without any authentication check (middleware auth detected, but its matcher doesn't cover pages)" : "Server action performs mutations without any authentication check \u2014 anyone can call this action",
+      severity: middleware ? "info" : "warning",
       category: "security",
-      fix: 'Add auth check: const session = await auth(); if (!session) throw new Error("Unauthorized")'
+      fix: middleware ? 'Check the user in the action too, not only in middleware: const session = await auth(); if (!session) throw new Error("Unauthorized")' : 'Add auth check: const session = await auth(); if (!session) throw new Error("Unauthorized")'
     }];
   }
 };
@@ -5250,9 +5756,9 @@ function ipv6Groups(address) {
   const quad = address.match(/^(.*:)(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
   const hex = quad ? `${quad[1]}${(+quad[2] << 8 | +quad[3]).toString(16)}:${(+quad[4] << 8 | +quad[5]).toString(16)}` : address;
   const [head, tail] = hex.split("::");
-  const parse2 = (part) => part ? part.split(":").map((g) => parseInt(g, 16)) : [];
-  const front = parse2(head);
-  const back = parse2(tail);
+  const parse3 = (part) => part ? part.split(":").map((g) => parseInt(g, 16)) : [];
+  const front = parse3(head);
+  const back = parse3(tail);
   return tail === void 0 ? front : [...front, ...Array(8 - front.length - back.length).fill(0), ...back];
 }
 function embeddedIPv4(address) {