react-doctor 0.7.1 → 0.7.2-dev.0eb5293

package/dist/cli.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8cb1a73e-b148-513d-a3eb-69f3a12430a5")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="91ba16f6-8b1a-5cd9-a5d2-fc0b6fce2508")}catch(e){}}();
 import { createRequire } from "node:module";
 import * as NodeChildProcess from "node:child_process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
@@ -9,7 +9,7 @@ import * as NFS from "node:fs";
 import fs, { mkdtempSync, rmSync } from "node:fs";
 import process$1 from "node:process";
 import * as ts from "typescript";
-import reactDoctorPlugin, { ALL_REACT_DOCTOR_RULE_KEYS, CROSS_FILE_DEPENDENCY_COLLECTORS, CROSS_FILE_RULE_IDS, FRAMEWORK_SPECIFIC_RULE_KEYS, MOTION_LIBRARY_PACKAGES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES, classifySecurityScanFile, collectCrossFileDependencyProbes, shouldReadSecurityScanContent } from "oxlint-plugin-react-doctor";
+import reactDoctorPlugin, { ALL_REACT_DOCTOR_RULE_KEYS, CROSS_FILE_DEPENDENCY_COLLECTORS, CROSS_FILE_RULE_IDS, FRAMEWORK_SPECIFIC_RULE_KEYS, MOTION_LIBRARY_PACKAGES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES, classifySecurityScanFile, collectCrossFileDependencyProbes, resetManifestCaches, shouldReadSecurityScanContent } from "oxlint-plugin-react-doctor";
 import * as OS from "node:os";
 import os, { tmpdir } from "node:os";
 import { parseJSON5 } from "confbox";
@@ -35959,6 +35959,25 @@ var AmbiguousProjectError = class extends Error {
 	}
 };
 const isProjectDiscoveryError = (value) => value instanceof ProjectNotFoundError || value instanceof NoReactDependencyError || value instanceof PackageJsonNotFoundError || value instanceof NotADirectoryError || value instanceof AmbiguousProjectError;
+const isErrnoException = (error) => error instanceof Error && "code" in error;
+const IGNORABLE_READDIR_ERROR_CODES = new Set([
+	"EACCES",
+	"EPERM",
+	"ENOENT",
+	"ENOTDIR",
+	"EINVAL",
+	"ELOOP",
+	"ENAMETOOLONG"
+]);
+const isIgnorableReaddirError = (error) => isErrnoException(error) && typeof error.code === "string" && IGNORABLE_READDIR_ERROR_CODES.has(error.code);
+const readDirectoryEntries = (directoryPath) => {
+	try {
+		return NFS.readdirSync(directoryPath, { withFileTypes: true });
+	} catch (error) {
+		if (isIgnorableReaddirError(error)) return [];
+		throw error;
+	}
+};
 const isFile = (filePath) => {
 	try {
 		return NFS.statSync(filePath).isFile();
@@ -35966,10 +35985,24 @@ const isFile = (filePath) => {
 		return false;
 	}
 };
+const isDirectory = (directoryPath) => {
+	try {
+		return NFS.statSync(directoryPath).isDirectory();
+	} catch {
+		return false;
+	}
+};
+const isPlainObject = (value) => {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === null || prototype === Object.prototype;
+};
 const SOURCE_FILE_PATTERN = /\.(tsx?|jsx?|mts|mjs)$/;
 const GENERATED_BUNDLE_FILE_PATTERN = /\.(iife|umd|global|min)\.m?js$/i;
+const GENERATED_SOURCE_DIRECTORY_PATTERN = /(?:^|\/)__generated__\//;
 const MINIFIED_SNIFF_BYTES = 65536;
 const GIT_LS_FILES_MAX_BUFFER_BYTES = 50 * 1024 * 1024;
+const SCANNED_DOT_DIRECTORIES = new Set([".dumi", ".storybook"]);
 const IGNORED_DIRECTORIES = new Set([
 	".angular",
 	".astro",
@@ -36144,7 +36177,7 @@ const SOCKET_FREE_USER_AGENT = "react-doctor-supply-chain";
 const FILE_LINT_CACHE_FILENAME = "file-lint-cache.json";
 const FILE_LINT_CACHE_MAX_FILE_COUNT = 5e4;
 const SIDECAR_LINT_CACHE_FILENAME = "sidecar-lint-cache.json";
-const CORE_PACKAGE_VERSION = "0.7.1";
+const CORE_PACKAGE_VERSION = "0.7.2";
 const DEAD_CODE_CACHE_FILENAME = "dead-code-cache.json";
 const DEAD_CODE_SUMMARY_CACHE_FILENAME = "dead-code-summaries.json";
 const SUPPLY_CHAIN_PLUGIN = "socket";
@@ -36154,8 +36187,9 @@ const SUPPLY_CHAIN_OVERLAP_TIMEOUT_MS = 9e4;
 const SUPPLY_CHAIN_CACHE_TTL_MS = 864e5;
 const SUPPLY_CHAIN_CACHE_SUBDIR = "supply-chain";
 const SUPPLY_CHAIN_IGNORED_PACKAGES = new Set(["next"]);
-const hasIgnoredPathSegment = (relativePath) => relativePath.split(/[/\\]/).slice(0, -1).some((segment) => IGNORED_DIRECTORIES.has(segment));
-const isLintableSourceFile = (filePath) => SOURCE_FILE_PATTERN.test(filePath) && !GENERATED_BUNDLE_FILE_PATTERN.test(filePath);
+const isIgnoredDirectoryName = (directoryName) => IGNORED_DIRECTORIES.has(directoryName) || directoryName.startsWith(".") && !SCANNED_DOT_DIRECTORIES.has(directoryName);
+const hasIgnoredPathSegment = (relativePath) => relativePath.split(/[/\\]/).slice(0, -1).some((segment) => isIgnoredDirectoryName(segment));
+const isLintableSourceFile = (filePath) => SOURCE_FILE_PATTERN.test(filePath) && !GENERATED_BUNDLE_FILE_PATTERN.test(filePath) && !GENERATED_SOURCE_DIRECTORY_PATTERN.test(filePath);
 const isMinifiedSource = (absolutePath) => {
 	let fileDescriptor;
 	try {
@@ -36189,25 +36223,6 @@ const isLargeMinifiedFile = (absolutePath, knownSizeBytes) => {
 	cachedIsLargeMinifiedByPath.set(absolutePath, result);
 	return result;
 };
-const isErrnoException = (error) => error instanceof Error && "code" in error;
-const IGNORABLE_READDIR_ERROR_CODES = new Set([
-	"EACCES",
-	"EPERM",
-	"ENOENT",
-	"ENOTDIR",
-	"EINVAL",
-	"ELOOP",
-	"ENAMETOOLONG"
-]);
-const isIgnorableReaddirError = (error) => isErrnoException(error) && typeof error.code === "string" && IGNORABLE_READDIR_ERROR_CODES.has(error.code);
-const readDirectoryEntries = (directoryPath) => {
-	try {
-		return NFS.readdirSync(directoryPath, { withFileTypes: true });
-	} catch (error) {
-		if (isIgnorableReaddirError(error)) return [];
-		throw error;
-	}
-};
 function* walkSourceTreeFiles(rootDirectory) {
 	const stack = [rootDirectory];
 	while (stack.length > 0) {
@@ -36216,7 +36231,7 @@ function* walkSourceTreeFiles(rootDirectory) {
 		for (const entry of readDirectoryEntries(currentDirectory)) {
 			const absolutePath = Path.join(currentDirectory, entry.name);
 			if (entry.isDirectory()) {
-				if (!IGNORED_DIRECTORIES.has(entry.name)) stack.push(absolutePath);
+				if (!isIgnoredDirectoryName(entry.name)) stack.push(absolutePath);
 				continue;
 			}
 			if (entry.isFile()) yield {
@@ -36310,6 +36325,146 @@ const findMonorepoRoot = (startDirectory) => {
 * byte-equivalent copy.
 */
 const isProjectBoundary = (directory) => NFS.existsSync(Path.join(directory, ".git")) || isMonorepoRoot(directory);
+const TSCONFIG_FILENAME = "tsconfig.json";
+const isRelativeExtendsValue = (extendsValue) => extendsValue.startsWith("./") || extendsValue.startsWith("../") || Path.isAbsolute(extendsValue);
+const ensureJsonExtension = (filePath) => Path.extname(filePath) === "" ? `${filePath}.json` : filePath;
+const resolvePackageExtendsPath = (extendsValue, fromConfigDirectory) => {
+	const requireFromConfig = createRequire(Path.join(fromConfigDirectory, "tsconfig.json"));
+	const candidates = [
+		extendsValue,
+		ensureJsonExtension(extendsValue),
+		`${extendsValue.replace(/\/$/, "")}/tsconfig.json`
+	];
+	for (const candidate of candidates) try {
+		return requireFromConfig.resolve(candidate);
+	} catch {
+		continue;
+	}
+	return null;
+};
+const resolveExtendsPath = (extendsValue, fromConfigDirectory) => {
+	if (isRelativeExtendsValue(extendsValue)) return ensureJsonExtension(Path.resolve(fromConfigDirectory, extendsValue));
+	return resolvePackageExtendsPath(extendsValue, fromConfigDirectory);
+};
+const normalizeCompilerOptions = (compilerOptions) => {
+	if (!isPlainObject(compilerOptions)) return { hasExplicitLib: false };
+	const target = typeof compilerOptions.target === "string" ? compilerOptions.target : void 0;
+	const hasExplicitLib = Object.hasOwn(compilerOptions, "lib");
+	return {
+		target,
+		lib: Array.isArray(compilerOptions.lib) ? compilerOptions.lib.filter((entry) => typeof entry === "string") : void 0,
+		hasExplicitLib
+	};
+};
+const readTsConfig = (filePath) => {
+	let content;
+	try {
+		content = NFS.readFileSync(filePath, "utf-8");
+	} catch {
+		return null;
+	}
+	const parsed = ts.parseConfigFileTextToJson(filePath, content);
+	if (!isPlainObject(parsed.config)) return null;
+	return {
+		extends: typeof parsed.config.extends === "string" ? parsed.config.extends : void 0,
+		referencePaths: normalizeReferencePaths(parsed.config.references),
+		compilerOptions: normalizeCompilerOptions(parsed.config.compilerOptions)
+	};
+};
+const normalizeReferencePaths = (references) => {
+	if (!Array.isArray(references)) return [];
+	return references.map((reference) => isPlainObject(reference) && typeof reference.path === "string" ? reference.path : null).filter((referencePath) => referencePath !== null);
+};
+const mergeCompilerOptions = (inherited, current) => {
+	const target = current.target ?? inherited?.target;
+	const hasExplicitLib = current.hasExplicitLib || Boolean(inherited?.hasExplicitLib);
+	return {
+		target,
+		lib: current.hasExplicitLib ? current.lib : inherited?.lib,
+		hasExplicitLib
+	};
+};
+const readResolvedCompilerOptions = (tsConfigPath, extendsDepth, visitedPaths) => {
+	const realPath = NFS.realpathSync.native(tsConfigPath);
+	if (visitedPaths.has(realPath)) return null;
+	const tsConfig = readTsConfig(realPath);
+	if (!tsConfig) return null;
+	const nextVisitedPaths = new Set(visitedPaths);
+	nextVisitedPaths.add(realPath);
+	if (tsConfig.extends && extendsDepth < 8) {
+		const parentPath = resolveExtendsPath(tsConfig.extends, Path.dirname(realPath));
+		if (parentPath && isFile(parentPath)) return mergeCompilerOptions(readResolvedCompilerOptions(parentPath, extendsDepth + 1, nextVisitedPaths), tsConfig.compilerOptions);
+	}
+	return tsConfig.compilerOptions;
+};
+const targetYearIsPreES2023 = (target) => {
+	const year = ES_TARGET_YEAR_BY_NAME[target.toLowerCase()];
+	return year !== void 0 && year < 2023;
+};
+const libEntryIncludesES2023Array = (entry) => {
+	const normalizedEntry = entry.toLowerCase();
+	if (normalizedEntry === "esnext" || normalizedEntry === "esnext.array") return true;
+	const esYearMatch = /^es(\d{4})(?:\.(.+))?$/.exec(normalizedEntry);
+	if (!esYearMatch) return false;
+	if (Number(esYearMatch[1]) < 2023) return false;
+	const component = esYearMatch[2];
+	return component === void 0 || component === "array";
+};
+const libIncludesES2023 = (lib) => lib.some(libEntryIncludesES2023Array);
+const compilerOptionsArePreES2023 = (compilerOptions) => {
+	if (compilerOptions.target) return targetYearIsPreES2023(compilerOptions.target);
+	if (compilerOptions.hasExplicitLib) return !libIncludesES2023(compilerOptions.lib ?? []);
+	return false;
+};
+const compilerOptionsDeclareTargetOrLib = (compilerOptions) => compilerOptions.hasExplicitLib || compilerOptions.target !== void 0;
+const detectPreES2023FromConfig = (tsConfigPath, visitedConfigPaths = /* @__PURE__ */ new Set()) => {
+	if (visitedConfigPaths.has(tsConfigPath)) return false;
+	const compilerOptions = readResolvedCompilerOptions(tsConfigPath, 0, /* @__PURE__ */ new Set());
+	if (!compilerOptions) return false;
+	if (!compilerOptionsDeclareTargetOrLib(compilerOptions)) {
+		const tsConfig = readTsConfig(tsConfigPath);
+		if (!tsConfig) return false;
+		const nextVisitedConfigPaths = new Set(visitedConfigPaths);
+		nextVisitedConfigPaths.add(tsConfigPath);
+		const configDirectory = Path.dirname(tsConfigPath);
+		return tsConfig.referencePaths.some((referencePath) => {
+			const resolvedReferencePath = Path.resolve(configDirectory, referencePath);
+			const referencedConfigPath = isFile(resolvedReferencePath) ? resolvedReferencePath : Path.join(resolvedReferencePath, TSCONFIG_FILENAME);
+			return isFile(referencedConfigPath) && detectPreES2023FromConfig(referencedConfigPath, nextVisitedConfigPaths);
+		});
+	}
+	return compilerOptionsArePreES2023(compilerOptions);
+};
+const detectPreES2023Target = (directory) => {
+	const tsConfigPath = Path.join(directory, TSCONFIG_FILENAME);
+	if (isFile(tsConfigPath)) return detectPreES2023FromConfig(tsConfigPath);
+	for (const fallbackFilename of FALLBACK_TSCONFIG_FILENAMES) {
+		const fallbackPath = Path.join(directory, fallbackFilename);
+		if (isFile(fallbackPath)) return detectPreES2023FromConfig(fallbackPath);
+	}
+	return false;
+};
+const FALLBACK_TSCONFIG_FILENAMES = ["tsconfig.app.json", "tsconfig.build.json"];
+const FRAMEWORK_PACKAGES = {
+	next: "nextjs",
+	"@tanstack/react-start": "tanstack-start",
+	vite: "vite",
+	"react-scripts": "cra",
+	"@remix-run/react": "remix",
+	gatsby: "gatsby",
+	expo: "expo",
+	"react-native": "react-native"
+};
+const detectFramework = (dependencies) => {
+	for (const [packageName, frameworkName] of Object.entries(FRAMEWORK_PACKAGES)) if (dependencies[packageName]) return frameworkName;
+	if (dependencies.preact && !dependencies.react) return "preact";
+	return "unknown";
+};
+const MOBILE_FRAMEWORKS = new Set(["expo", "react-native"]);
+const frameworkMergeRank = (framework) => {
+	if (framework === "unknown") return 3;
+	return MOBILE_FRAMEWORKS.has(framework) ? 2 : 1;
+};
 const REACT_COMPILER_PACKAGES = new Set([
 	"babel-plugin-react-compiler",
 	"react-compiler-runtime",
@@ -36346,6 +36501,7 @@ const EXPO_APP_CONFIG_FILENAMES = [
 ];
 const REACT_COMPILER_PACKAGE_REFERENCE_PATTERN = /babel-plugin-react-compiler|react-compiler-runtime|eslint-plugin-react-compiler|["']react-compiler["']/;
 const REACT_COMPILER_ENABLED_FLAG_PATTERN = /["']?reactCompiler["']?\s*:\s*(?:true\b|\{)/;
+const STATIC_EXPORT_OUTPUT_PATTERN = /(?:^|[^.\w])["']?output["']?\s*:\s*["']export["']/m;
 const hasCompilerPackage = (packageJson) => {
 	const allDependencies = {
 		...packageJson.peerDependencies,
@@ -36378,34 +36534,10 @@ const detectReactCompiler = (directory, packageJson) => {
 	}
 	return false;
 };
-const FRAMEWORK_PACKAGES = {
-	next: "nextjs",
-	"@tanstack/react-start": "tanstack-start",
-	vite: "vite",
-	"react-scripts": "cra",
-	"@remix-run/react": "remix",
-	gatsby: "gatsby",
-	expo: "expo",
-	"react-native": "react-native"
-};
-const FRAMEWORK_DISPLAY_NAMES = {
-	nextjs: "Next.js",
-	"tanstack-start": "TanStack Start",
-	vite: "Vite",
-	cra: "Create React App",
-	remix: "Remix",
-	gatsby: "Gatsby",
-	expo: "Expo",
-	"react-native": "React Native",
-	preact: "Preact",
-	unknown: "React"
-};
-const formatFrameworkName = (framework) => FRAMEWORK_DISPLAY_NAMES[framework];
-const detectFramework = (dependencies) => {
-	for (const [packageName, frameworkName] of Object.entries(FRAMEWORK_PACKAGES)) if (dependencies[packageName]) return frameworkName;
-	if (dependencies.preact && !dependencies.react) return "preact";
-	return "unknown";
-};
+const detectNextjsStaticExport = (directory) => NEXT_CONFIG_FILENAMES.some((filename) => {
+	const filePath = Path.join(directory, filename);
+	return isFile(filePath) && STATIC_EXPORT_OUTPUT_PATTERN.test(NFS.readFileSync(filePath, "utf-8"));
+});
 const UNRESOLVABLE_PROTOCOL_VERSION = /^(?:file|git|github|https?|link|patch|portal|workspace|npm):/i;
 const DIST_TAG_VERSION = /^[a-z][a-z0-9._-]*$/i;
 const WILDCARD_VERSION = /^[*xX](?:\.[*xX])*$/;
@@ -36543,10 +36675,76 @@ const isConcreteDependencyVersion = (version) => {
 	const normalizedVersion = normalizeDependencyVersion(version);
 	return normalizedVersion !== null && /\d/.test(normalizedVersion);
 };
-const isPlainObject = (value) => {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
-	const prototype = Object.getPrototypeOf(value);
-	return prototype === null || prototype === Object.prototype;
+const isMajorMinorAtLeast = (detected, required) => {
+	if (detected === null) return true;
+	if (detected.major !== required.major) return detected.major > required.major;
+	return detected.minor >= required.minor;
+};
+const parseReactMajor = (reactVersion) => {
+	if (typeof reactVersion !== "string") return null;
+	return getLowestDependencyMajor(reactVersion);
+};
+const MAJOR_MINOR_PATTERN = /(\d{1,4})\.(\d{1,4})/;
+const MAJOR_ONLY_PATTERN = /(\d{1,4})/;
+const UPPER_BOUND_COMPARATOR_PATTERN = /<=?\s{0,8}\d{1,4}(?:\.\d{1,4}){0,2}(?:-[^\s,|]+)?/g;
+const parseReactMajorMinor = (reactVersion) => {
+	if (typeof reactVersion !== "string") return null;
+	const trimmed = reactVersion.trim();
+	if (trimmed.length === 0) return null;
+	const lowerBoundsOnly = trimmed.replace(UPPER_BOUND_COMPARATOR_PATTERN, " ").trim();
+	if (lowerBoundsOnly.length === 0) return null;
+	const majorMinorMatch = lowerBoundsOnly.match(MAJOR_MINOR_PATTERN);
+	if (majorMinorMatch) {
+		const major = Number.parseInt(majorMinorMatch[1], 10);
+		const minor = Number.parseInt(majorMinorMatch[2], 10);
+		if (!Number.isFinite(major) || major <= 0) return null;
+		if (!Number.isFinite(minor) || minor < 0) return null;
+		return {
+			major,
+			minor
+		};
+	}
+	const majorOnlyMatch = lowerBoundsOnly.match(MAJOR_ONLY_PATTERN);
+	if (!majorOnlyMatch) return null;
+	const major = Number.parseInt(majorOnlyMatch[1], 10);
+	if (!Number.isFinite(major) || major <= 0) return null;
+	return {
+		major,
+		minor: 0
+	};
+};
+const parseLowerBoundVersion = (versionSpec) => import_semver.validRange(versionSpec) !== null ? import_semver.minVersion(versionSpec) : import_semver.coerce(versionSpec);
+const parseTailwindMajorMinor = (tailwindVersion) => {
+	if (typeof tailwindVersion !== "string") return null;
+	const trimmed = tailwindVersion.trim();
+	if (trimmed.length === 0) return null;
+	const lowerBound = parseLowerBoundVersion(trimmed);
+	if (lowerBound === null || lowerBound.major <= 0) return null;
+	return {
+		major: lowerBound.major,
+		minor: lowerBound.minor
+	};
+};
+const hasUpperBoundOnlyPeerRange = (range) => {
+	if (typeof range !== "string") return false;
+	const normalizedRange = normalizeDependencyVersion(range);
+	if (normalizedRange === null) return false;
+	return splitDependencyVersionBranches(normalizedRange).some((branch) => {
+		const normalizedBranch = normalizeDependencyVersion(branch);
+		return normalizedBranch !== null && getBranchLowestMajor(normalizedBranch) === null && hasUpperBoundComparator(normalizedBranch);
+	});
+};
+const peerRangeMinMajor = (range) => {
+	if (typeof range !== "string") return null;
+	return getLowestDependencyMajor(range);
+};
+const resolveEffectiveReactMajor = (reactVersion, packageJson) => {
+	const installedReactMajor = parseReactMajor(reactVersion);
+	const peerReactRange = packageJson.peerDependencies?.react;
+	if (typeof peerReactRange !== "string") return installedReactMajor;
+	const peerFloor = peerRangeMinMajor(peerReactRange);
+	if (peerFloor === null) return hasUpperBoundOnlyPeerRange(peerReactRange) ? null : installedReactMajor;
+	return installedReactMajor !== null ? Math.min(installedReactMajor, peerFloor) : peerFloor;
 };
 const isCatalogReference = (version) => version.startsWith("catalog:");
 const extractCatalogName = (version) => {
@@ -36688,6 +36886,16 @@ const resolveCatalogVersion = (packageJson, packageName, rootDirectory, explicit
 	}
 	return null;
 };
+const REACT_SECTIONS = [
+	"dependencies",
+	"peerDependencies",
+	"devDependencies"
+];
+const TAILWIND_ZOD_SECTIONS = [
+	"dependencies",
+	"devDependencies",
+	"peerDependencies"
+];
 const EMPTY_DEPENDENCY_INFO = {
 	reactVersion: null,
 	tailwindVersion: null,
@@ -36728,6 +36936,10 @@ const extractDependencyInfo = (packageJson) => {
 		framework: detectFramework(allDependencies)
 	};
 };
+const getDependencySpec = (packageJson, packageName) => {
+	const spec = packageJson.dependencies?.[packageName] ?? packageJson.devDependencies?.[packageName] ?? packageJson.peerDependencies?.[packageName] ?? packageJson.optionalDependencies?.[packageName];
+	return typeof spec === "string" ? spec : null;
+};
 const getDependencyDeclaration = ({ packageJson, packageName, sections }) => {
 	for (const section of sections) {
 		const version = packageJson[section]?.[packageName];
@@ -36744,222 +36956,91 @@ const getDependencyDeclaration = ({ packageJson, packageName, sections }) => {
 		version: null
 	};
 };
-const isDirectory = (directoryPath) => {
-	try {
-		return NFS.statSync(directoryPath).isDirectory();
-	} catch {
-		return false;
-	}
-};
-const NX_PROJECT_DISCOVERY_DIRS = [
-	"apps",
-	"libs",
-	"packages"
-];
-const getNxWorkspaceDirectories = (rootDirectory) => {
-	if (!isFile(Path.join(rootDirectory, "nx.json"))) return [];
-	const collected = [];
-	for (const candidate of NX_PROJECT_DISCOVERY_DIRS) {
-		const candidatePath = Path.join(rootDirectory, candidate);
-		if (!isDirectory(candidatePath)) continue;
-		for (const entry of readDirectoryEntries(candidatePath)) {
-			if (!entry.isDirectory()) continue;
-			const projectDirectory = Path.join(candidatePath, entry.name);
-			if (isFile(Path.join(projectDirectory, "project.json")) || isFile(Path.join(projectDirectory, "package.json"))) collected.push(`${candidate}/${entry.name}`);
-		}
-	}
-	return collected;
-};
-const parsePnpmWorkspacePatterns = (rootDirectory) => {
-	const workspacePath = Path.join(rootDirectory, "pnpm-workspace.yaml");
-	if (!isFile(workspacePath)) return [];
-	const content = NFS.readFileSync(workspacePath, "utf-8");
-	const patterns = [];
-	let isInsidePackagesBlock = false;
-	for (const line of content.split("\n")) {
-		const trimmed = line.trim();
-		if (trimmed === "packages:") {
-			isInsidePackagesBlock = true;
-			continue;
-		}
-		if (isInsidePackagesBlock && trimmed.startsWith("-")) patterns.push(trimmed.replace(/^-\s*/, "").replace(/["']/g, ""));
-		else if (isInsidePackagesBlock && trimmed.length > 0 && !trimmed.startsWith("#")) isInsidePackagesBlock = false;
-	}
-	return patterns;
-};
-const getWorkspacePatterns = (rootDirectory, packageJson) => {
-	const pnpmPatterns = parsePnpmWorkspacePatterns(rootDirectory);
-	if (pnpmPatterns.length > 0) return pnpmPatterns;
-	if (Array.isArray(packageJson.workspaces)) return packageJson.workspaces;
-	if (packageJson.workspaces?.packages) return packageJson.workspaces.packages;
-	const nxPatterns = getNxWorkspaceDirectories(rootDirectory);
-	if (nxPatterns.length > 0) return nxPatterns;
-	return [];
-};
-const parseReactMajor = (reactVersion) => {
-	if (typeof reactVersion !== "string") return null;
-	return getLowestDependencyMajor(reactVersion);
+const REACT_DEPENDENCY_NAMES = new Set([
+	"react",
+	"react-native",
+	"next",
+	"preact"
+]);
+const hasReactDependency = (packageJson) => {
+	const allDependencies = {
+		...packageJson.peerDependencies,
+		...packageJson.dependencies,
+		...packageJson.devDependencies
+	};
+	return Object.keys(allDependencies).some((packageName) => REACT_DEPENDENCY_NAMES.has(packageName));
 };
-const resolveWorkspaceDirectories = (rootDirectory, pattern) => {
-	const cleanPattern = pattern.replace(/["']/g, "").replace(/\/\*\*$/, "/*");
-	if (!cleanPattern.includes("*")) {
-		const directoryPath = Path.join(rootDirectory, cleanPattern);
-		if (isDirectory(directoryPath) && isFile(Path.join(directoryPath, "package.json"))) return [directoryPath];
-		return [];
-	}
-	const wildcardIndex = cleanPattern.indexOf("*");
-	const baseDirectory = Path.join(rootDirectory, cleanPattern.slice(0, wildcardIndex));
-	const suffixAfterWildcard = cleanPattern.slice(wildcardIndex + 1);
-	if (!isDirectory(baseDirectory)) return [];
-	const resolved = [];
-	for (const entry of readDirectoryEntries(baseDirectory)) {
-		const entryPath = Path.join(baseDirectory, entry.name, suffixAfterWildcard);
-		if (isDirectory(entryPath) && isFile(Path.join(entryPath, "package.json"))) resolved.push(entryPath);
-	}
-	return resolved;
+const getPreactVersion = (packageJson) => {
+	return {
+		...packageJson.peerDependencies,
+		...packageJson.dependencies,
+		...packageJson.devDependencies
+	}.preact ?? null;
 };
-const resolveWorkspaceDependencyVersion = ({ concreteVersion, packageName, rootDirectory, rootPackageJson, sections, workspaceDirectory, workspacePackageJson }) => {
-	const dependencyDeclaration = getDependencyDeclaration({
-		packageJson: workspacePackageJson,
-		packageName,
-		sections
-	});
-	if (!dependencyDeclaration.hasDeclaration) return null;
-	return concreteVersion ?? resolveCatalogVersion(workspacePackageJson, packageName, workspaceDirectory, dependencyDeclaration.catalogReference) ?? resolveCatalogVersion(rootPackageJson, packageName, rootDirectory, dependencyDeclaration.catalogReference);
+const TANSTACK_QUERY_PACKAGES = new Set([
+	"@tanstack/react-query",
+	"@tanstack/query-core",
+	"react-query"
+]);
+const hasTanStackQuery = (packageJson) => {
+	const allDependencies = {
+		...packageJson.peerDependencies,
+		...packageJson.dependencies,
+		...packageJson.devDependencies
+	};
+	return Object.keys(allDependencies).some((packageName) => TANSTACK_QUERY_PACKAGES.has(packageName));
 };
-const shouldReplaceReactVersion = (currentVersion, nextVersion) => {
-	if (!currentVersion) return true;
-	const currentMajor = parseReactMajor(currentVersion);
-	const nextMajor = parseReactMajor(nextVersion);
-	if (currentMajor === null) return nextMajor !== null;
-	if (nextMajor === null) return false;
-	return nextMajor < currentMajor;
+const resolveCatalogBackedDependencyVersion = ({ rootDirectory, rootPackageJson, packageName, version }) => {
+	if (version === null || !isCatalogReference(version)) return version;
+	const catalogName = extractCatalogName(version);
+	const resolvedLocalVersion = resolveCatalogVersion(rootPackageJson, packageName, rootDirectory, catalogName);
+	if (resolvedLocalVersion) return resolvedLocalVersion;
+	const monorepoRoot = findMonorepoRoot(rootDirectory);
+	if (!monorepoRoot) return version;
+	const monorepoPackageJsonPath = Path.join(monorepoRoot, "package.json");
+	if (!isFile(monorepoPackageJsonPath)) return version;
+	return resolveCatalogVersion(readPackageJson$1(monorepoPackageJsonPath), packageName, monorepoRoot, catalogName) ?? version;
 };
-const findReactInWorkspaces = (rootDirectory, packageJson) => {
-	const patterns = getWorkspacePatterns(rootDirectory, packageJson);
-	const result = { ...EMPTY_DEPENDENCY_INFO };
-	for (const pattern of patterns) {
-		const directories = resolveWorkspaceDirectories(rootDirectory, pattern);
-		for (const workspaceDirectory of directories) {
-			const workspacePackageJson = readPackageJson$1(Path.join(workspaceDirectory, "package.json"));
-			const info = extractDependencyInfo(workspacePackageJson);
-			const reactVersion = resolveWorkspaceDependencyVersion({
-				concreteVersion: info.reactVersion,
-				packageName: "react",
-				rootDirectory,
-				rootPackageJson: packageJson,
-				sections: [
-					"dependencies",
-					"peerDependencies",
-					"devDependencies"
-				],
-				workspaceDirectory,
-				workspacePackageJson
-			});
-			const tailwindVersion = resolveWorkspaceDependencyVersion({
-				concreteVersion: info.tailwindVersion,
-				packageName: "tailwindcss",
-				rootDirectory,
-				rootPackageJson: packageJson,
-				sections: [
-					"dependencies",
-					"devDependencies",
-					"peerDependencies"
-				],
-				workspaceDirectory,
-				workspacePackageJson
-			});
-			const zodVersion = resolveWorkspaceDependencyVersion({
-				concreteVersion: info.zodVersion,
-				packageName: "zod",
-				rootDirectory,
-				rootPackageJson: packageJson,
-				sections: [
-					"dependencies",
-					"devDependencies",
-					"peerDependencies"
-				],
-				workspaceDirectory,
-				workspacePackageJson
-			});
-			if (reactVersion && shouldReplaceReactVersion(result.reactVersion, reactVersion)) result.reactVersion = reactVersion;
-			if (tailwindVersion && !result.tailwindVersion) result.tailwindVersion = tailwindVersion;
-			if (zodVersion && !result.zodVersion) result.zodVersion = zodVersion;
-			if (info.framework !== "unknown" && result.framework === "unknown") result.framework = info.framework;
-			const resultReactMajor = parseReactMajor(result.reactVersion);
-			if (result.reactVersion && result.tailwindVersion && result.framework !== "unknown" && resultReactMajor !== null && resultReactMajor <= 17) return result;
-		}
+/**
+* The chain of ancestor directories of `startDirectory`, nearest first, up to
+* and including the filesystem root. With `includeStart`, the chain begins at
+* `startDirectory` itself; otherwise at its parent. The one place the "walk up
+* the tree" traversal is expressed, so each caller adds only its own match /
+* stop policy instead of re-deriving the `path.dirname` loop.
+*/
+const ancestorDirectories = (startDirectory, { includeStart }) => {
+	const directories = [];
+	let currentDirectory = includeStart ? startDirectory : Path.dirname(startDirectory);
+	while (true) {
+		directories.push(currentDirectory);
+		const parentDirectory = Path.dirname(currentDirectory);
+		if (parentDirectory === currentDirectory) return directories;
+		currentDirectory = parentDirectory;
 	}
-	return result;
 };
-const findDependencyInfoFromMonorepoRoot = (directory) => {
-	const monorepoRoot = findMonorepoRoot(directory);
-	if (!monorepoRoot) return EMPTY_DEPENDENCY_INFO;
-	const monorepoPackageJsonPath = Path.join(monorepoRoot, "package.json");
-	if (!isFile(monorepoPackageJsonPath)) return EMPTY_DEPENDENCY_INFO;
-	const rootPackageJson = readPackageJson$1(monorepoPackageJsonPath);
-	const rootInfo = extractDependencyInfo(rootPackageJson);
-	const leafPackageJsonPath = Path.join(directory, "package.json");
-	const leafPackageJson = isFile(leafPackageJsonPath) ? readPackageJson$1(leafPackageJsonPath) : null;
-	const leafReactDeclaration = leafPackageJson ? getDependencyDeclaration({
-		packageJson: leafPackageJson,
-		packageName: "react",
-		sections: [
-			"dependencies",
-			"peerDependencies",
-			"devDependencies"
-		]
-	}) : null;
-	const leafTailwindDeclaration = leafPackageJson ? getDependencyDeclaration({
-		packageJson: leafPackageJson,
-		packageName: "tailwindcss",
-		sections: [
-			"dependencies",
-			"devDependencies",
-			"peerDependencies"
-		]
-	}) : null;
-	const leafZodDeclaration = leafPackageJson ? getDependencyDeclaration({
-		packageJson: leafPackageJson,
-		packageName: "zod",
-		sections: [
-			"dependencies",
-			"devDependencies",
-			"peerDependencies"
-		]
-	}) : null;
-	const shouldUseReactFallback = !leafReactDeclaration?.hasDeclaration;
-	const shouldUseTailwindFallback = leafTailwindDeclaration?.hasDeclaration ?? true;
-	const shouldUseZodFallback = leafZodDeclaration?.hasDeclaration ?? true;
-	const reactCatalogVersion = shouldUseReactFallback ? resolveCatalogVersion(rootPackageJson, "react", monorepoRoot, leafReactDeclaration?.catalogReference) : null;
-	const tailwindCatalogVersion = shouldUseTailwindFallback ? resolveCatalogVersion(rootPackageJson, "tailwindcss", monorepoRoot, leafTailwindDeclaration?.catalogReference) : null;
-	const zodCatalogVersion = shouldUseZodFallback ? resolveCatalogVersion(rootPackageJson, "zod", monorepoRoot, leafZodDeclaration?.catalogReference) : null;
-	const workspaceInfo = findReactInWorkspaces(monorepoRoot, rootPackageJson);
-	return {
-		reactVersion: shouldUseReactFallback ? reactCatalogVersion ?? rootInfo.reactVersion ?? workspaceInfo.reactVersion : rootInfo.reactVersion ?? workspaceInfo.reactVersion,
-		tailwindVersion: shouldUseTailwindFallback ? tailwindCatalogVersion ?? rootInfo.tailwindVersion ?? workspaceInfo.tailwindVersion : null,
-		zodVersion: shouldUseZodFallback ? zodCatalogVersion ?? rootInfo.zodVersion ?? workspaceInfo.zodVersion : null,
-		framework: rootInfo.framework !== "unknown" ? rootInfo.framework : workspaceInfo.framework
-	};
-};
-const findInWorkspacePackageJsons = (rootDirectory, rootPackageJson, select) => {
-	const rootValue = select(rootPackageJson);
-	if (rootValue !== null) return rootValue;
-	const patterns = getWorkspacePatterns(rootDirectory, rootPackageJson);
-	if (patterns.length === 0) return null;
-	const visitedDirectories = /* @__PURE__ */ new Set();
-	for (const pattern of patterns) {
-		const directories = [...resolveWorkspaceDirectories(rootDirectory, pattern)].sort();
-		for (const workspaceDirectory of directories) {
-			if (visitedDirectories.has(workspaceDirectory)) continue;
-			visitedDirectories.add(workspaceDirectory);
-			const value = select(readPackageJson$1(Path.join(workspaceDirectory, "package.json")));
-			if (value !== null) return value;
-		}
+/**
+* Walk up from `startDirectory` to the nearest ancestor that owns a
+* `package.json`, stopping at (and including) the enclosing project boundary
+* — the working tree's git root or a monorepo root. Lets a scan of a package
+* subfolder that has no `package.json` of its own adopt the nearest enclosing
+* package as its project root, so it inherits that package's dependency +
+* framework detection instead of synthesizing an empty (React-blind) project.
+*
+* Generalizes the older monorepo-root-only lookup: the nearest ancestor is the
+* most specific owning package (a leaf workspace, not just the repo root), so
+* a subfolder of one workspace no longer borrows a sibling's capabilities.
+*
+* Returns `null` when no ancestor `package.json` exists inside the project
+* boundary (a loose tree of files, or a subfolder of a package-less repo).
+*/
+const findNearestAncestorPackageJson = (startDirectory) => {
+	if (isProjectBoundary(startDirectory)) return null;
+	for (const directory of ancestorDirectories(startDirectory, { includeStart: false })) {
+		if (isFile(Path.join(directory, "package.json"))) return directory;
+		if (isProjectBoundary(directory)) return null;
 	}
 	return null;
 };
-const someWorkspacePackageJson = (rootDirectory, rootPackageJson, predicate) => findInWorkspacePackageJsons(rootDirectory, rootPackageJson, (packageJson) => predicate(packageJson) ? true : null) !== null;
 const NAMES = new Set([
 	"react-native",
 	"react-native-tvos",
@@ -36992,47 +37073,7 @@ const isPackageJsonReactNativeAware = (packageJson) => {
 	if (containsAnyReactNativeDependency(packageJson.optionalDependencies)) return true;
 	return false;
 };
-const hasReactNativeWorkspaceAnywhere = (rootDirectory, rootPackageJson) => someWorkspacePackageJson(rootDirectory, rootPackageJson, isPackageJsonReactNativeAware);
-const getDependencySpec = (packageJson, packageName) => {
-	const spec = packageJson.dependencies?.[packageName] ?? packageJson.devDependencies?.[packageName] ?? packageJson.peerDependencies?.[packageName] ?? packageJson.optionalDependencies?.[packageName];
-	return typeof spec === "string" ? spec : null;
-};
-const findExpoVersion = (rootDirectory, rootPackageJson) => findInWorkspacePackageJsons(rootDirectory, rootPackageJson, (packageJson) => getDependencySpec(packageJson, "expo"));
-const SHOPIFY_FLASH_LIST_PACKAGE_NAME = "@shopify/flash-list";
-const findShopifyFlashListVersion = (rootDirectory, rootPackageJson) => findInWorkspacePackageJsons(rootDirectory, rootPackageJson, (packageJson) => getDependencySpec(packageJson, SHOPIFY_FLASH_LIST_PACKAGE_NAME));
-const resolveCatalogBackedDependencyVersion = ({ rootDirectory, rootPackageJson, packageName, version }) => {
-	if (version === null || !isCatalogReference(version)) return version;
-	const catalogName = extractCatalogName(version);
-	const resolvedLocalVersion = resolveCatalogVersion(rootPackageJson, packageName, rootDirectory, catalogName);
-	if (resolvedLocalVersion) return resolvedLocalVersion;
-	const monorepoRoot = findMonorepoRoot(rootDirectory);
-	if (!monorepoRoot) return version;
-	const monorepoPackageJsonPath = path.join(monorepoRoot, "package.json");
-	if (!isFile(monorepoPackageJsonPath)) return version;
-	return resolveCatalogVersion(readPackageJson$1(monorepoPackageJsonPath), packageName, monorepoRoot, catalogName) ?? version;
-};
-const findNextjsVersion = (rootDirectory, rootPackageJson) => findInWorkspacePackageJsons(rootDirectory, rootPackageJson, (packageJson) => getDependencySpec(packageJson, "next"));
-const getPreactVersion = (packageJson) => {
-	return {
-		...packageJson.peerDependencies,
-		...packageJson.dependencies,
-		...packageJson.devDependencies
-	}.preact ?? null;
-};
-const TANSTACK_QUERY_PACKAGES = new Set([
-	"@tanstack/react-query",
-	"@tanstack/query-core",
-	"react-query"
-]);
-const hasTanStackQuery = (packageJson) => {
-	const allDependencies = {
-		...packageJson.peerDependencies,
-		...packageJson.dependencies,
-		...packageJson.devDependencies
-	};
-	return Object.keys(allDependencies).some((packageName) => TANSTACK_QUERY_PACKAGES.has(packageName));
-};
-const REANIMATED_DEPENDENCY_NAME = "react-native-reanimated";
+const REANIMATED_DEPENDENCY_NAME$1 = "react-native-reanimated";
 const isPackageJsonReanimatedAware = (packageJson) => {
 	const allDependencies = {
 		...packageJson.peerDependencies,
@@ -37040,144 +37081,70 @@ const isPackageJsonReanimatedAware = (packageJson) => {
 		...packageJson.devDependencies,
 		...packageJson.optionalDependencies
 	};
-	return Object.hasOwn(allDependencies, REANIMATED_DEPENDENCY_NAME);
+	return Object.hasOwn(allDependencies, REANIMATED_DEPENDENCY_NAME$1);
 };
-const parseZodMajor = (zodVersion) => {
-	if (typeof zodVersion !== "string") return null;
-	return getLowestDependencyMajor(zodVersion);
-};
-const hasUpperBoundOnlyPeerRange = (range) => {
-	if (typeof range !== "string") return false;
-	const normalizedRange = normalizeDependencyVersion(range);
-	if (normalizedRange === null) return false;
-	return splitDependencyVersionBranches(normalizedRange).some((branch) => {
-		const normalizedBranch = normalizeDependencyVersion(branch);
-		return normalizedBranch !== null && getBranchLowestMajor(normalizedBranch) === null && hasUpperBoundComparator(normalizedBranch);
-	});
-};
-const peerRangeMinMajor = (range) => {
-	if (typeof range !== "string") return null;
-	return getLowestDependencyMajor(range);
-};
-const resolveEffectiveReactMajor = (reactVersion, packageJson) => {
-	const installedReactMajor = parseReactMajor(reactVersion);
-	const peerReactRange = packageJson.peerDependencies?.react;
-	if (typeof peerReactRange !== "string") return installedReactMajor;
-	const peerFloor = peerRangeMinMajor(peerReactRange);
-	if (peerFloor === null) return hasUpperBoundOnlyPeerRange(peerReactRange) ? null : installedReactMajor;
-	return installedReactMajor !== null ? Math.min(installedReactMajor, peerFloor) : peerFloor;
+const getWorkspacePatterns = (rootDirectory, packageJson) => {
+	const pnpmPatterns = parsePnpmWorkspacePatterns(rootDirectory);
+	if (pnpmPatterns.length > 0) return pnpmPatterns;
+	if (Array.isArray(packageJson.workspaces)) return packageJson.workspaces;
+	if (packageJson.workspaces?.packages) return packageJson.workspaces.packages;
+	const nxPatterns = getNxWorkspaceDirectories(rootDirectory);
+	if (nxPatterns.length > 0) return nxPatterns;
+	return [];
 };
-const TSCONFIG_FILENAME = "tsconfig.json";
-const isRelativeExtendsValue = (extendsValue) => extendsValue.startsWith("./") || extendsValue.startsWith("../") || Path.isAbsolute(extendsValue);
-const ensureJsonExtension = (filePath) => Path.extname(filePath) === "" ? `${filePath}.json` : filePath;
-const resolvePackageExtendsPath = (extendsValue, fromConfigDirectory) => {
-	const requireFromConfig = createRequire(Path.join(fromConfigDirectory, "tsconfig.json"));
-	const candidates = [
-		extendsValue,
-		ensureJsonExtension(extendsValue),
-		`${extendsValue.replace(/\/$/, "")}/tsconfig.json`
-	];
-	for (const candidate of candidates) try {
-		return requireFromConfig.resolve(candidate);
-	} catch {
-		continue;
+const parsePnpmWorkspacePatterns = (rootDirectory) => {
+	const workspacePath = Path.join(rootDirectory, "pnpm-workspace.yaml");
+	if (!isFile(workspacePath)) return [];
+	const content = NFS.readFileSync(workspacePath, "utf-8");
+	const patterns = [];
+	let isInsidePackagesBlock = false;
+	for (const line of content.split("\n")) {
+		const trimmed = line.trim();
+		if (trimmed === "packages:") {
+			isInsidePackagesBlock = true;
+			continue;
+		}
+		if (isInsidePackagesBlock && trimmed.startsWith("-")) patterns.push(trimmed.replace(/^-\s*/, "").replace(/["']/g, ""));
+		else if (isInsidePackagesBlock && trimmed.length > 0 && !trimmed.startsWith("#")) isInsidePackagesBlock = false;
 	}
-	return null;
-};
-const resolveExtendsPath = (extendsValue, fromConfigDirectory) => {
-	if (isRelativeExtendsValue(extendsValue)) return ensureJsonExtension(Path.resolve(fromConfigDirectory, extendsValue));
-	return resolvePackageExtendsPath(extendsValue, fromConfigDirectory);
-};
-const normalizeCompilerOptions = (compilerOptions) => {
-	if (!isPlainObject(compilerOptions)) return { hasExplicitLib: false };
-	const target = typeof compilerOptions.target === "string" ? compilerOptions.target : void 0;
-	const hasExplicitLib = Object.hasOwn(compilerOptions, "lib");
-	return {
-		target,
-		lib: Array.isArray(compilerOptions.lib) ? compilerOptions.lib.filter((entry) => typeof entry === "string") : void 0,
-		hasExplicitLib
-	};
+	return patterns;
 };
-const readTsConfig = (filePath) => {
-	let content;
-	try {
-		content = NFS.readFileSync(filePath, "utf-8");
-	} catch {
-		return null;
+const NX_PROJECT_DISCOVERY_DIRS = [
+	"apps",
+	"libs",
+	"packages"
+];
+const getNxWorkspaceDirectories = (rootDirectory) => {
+	if (!isFile(Path.join(rootDirectory, "nx.json"))) return [];
+	const collected = [];
+	for (const candidate of NX_PROJECT_DISCOVERY_DIRS) {
+		const candidatePath = Path.join(rootDirectory, candidate);
+		if (!isDirectory(candidatePath)) continue;
+		for (const entry of readDirectoryEntries(candidatePath)) {
+			if (!entry.isDirectory()) continue;
+			const projectDirectory = Path.join(candidatePath, entry.name);
+			if (isFile(Path.join(projectDirectory, "project.json")) || isFile(Path.join(projectDirectory, "package.json"))) collected.push(`${candidate}/${entry.name}`);
+		}
 	}
-	const parsed = ts.parseConfigFileTextToJson(filePath, content);
-	if (!isPlainObject(parsed.config)) return null;
-	return {
-		extends: typeof parsed.config.extends === "string" ? parsed.config.extends : void 0,
-		compilerOptions: normalizeCompilerOptions(parsed.config.compilerOptions)
-	};
-};
-const mergeCompilerOptions = (inherited, current) => {
-	const target = current.target ?? inherited?.target;
-	const hasExplicitLib = current.hasExplicitLib || Boolean(inherited?.hasExplicitLib);
-	return {
-		target,
-		lib: current.hasExplicitLib ? current.lib : inherited?.lib,
-		hasExplicitLib
-	};
+	return collected;
 };
-const readResolvedCompilerOptions = (tsConfigPath, extendsDepth, visitedPaths) => {
-	const realPath = NFS.realpathSync.native(tsConfigPath);
-	if (visitedPaths.has(realPath)) return null;
-	const tsConfig = readTsConfig(realPath);
-	if (!tsConfig) return null;
-	const nextVisitedPaths = new Set(visitedPaths);
-	nextVisitedPaths.add(realPath);
-	if (tsConfig.extends && extendsDepth < 8) {
-		const parentPath = resolveExtendsPath(tsConfig.extends, Path.dirname(realPath));
-		if (parentPath && isFile(parentPath)) return mergeCompilerOptions(readResolvedCompilerOptions(parentPath, extendsDepth + 1, nextVisitedPaths), tsConfig.compilerOptions);
+const resolveWorkspaceDirectories = (rootDirectory, pattern) => {
+	const cleanPattern = pattern.replace(/["']/g, "").replace(/\/\*\*$/, "/*");
+	if (!cleanPattern.includes("*")) {
+		const directoryPath = Path.join(rootDirectory, cleanPattern);
+		if (isDirectory(directoryPath) && isFile(Path.join(directoryPath, "package.json"))) return [directoryPath];
+		return [];
 	}
-	return tsConfig.compilerOptions;
-};
-const targetYearIsPreES2023 = (target) => {
-	const year = ES_TARGET_YEAR_BY_NAME[target.toLowerCase()];
-	return year !== void 0 && year < 2023;
-};
-const libEntryIncludesES2023Array = (entry) => {
-	const normalizedEntry = entry.toLowerCase();
-	if (normalizedEntry === "esnext" || normalizedEntry === "esnext.array") return true;
-	const esYearMatch = /^es(\d{4})(?:\.(.+))?$/.exec(normalizedEntry);
-	if (!esYearMatch) return false;
-	if (Number(esYearMatch[1]) < 2023) return false;
-	const component = esYearMatch[2];
-	return component === void 0 || component === "array";
-};
-const libIncludesES2023 = (lib) => lib.some(libEntryIncludesES2023Array);
-const compilerOptionsArePreES2023 = (compilerOptions) => {
-	if (compilerOptions.hasExplicitLib) return !libIncludesES2023(compilerOptions.lib ?? []);
-	if (compilerOptions.target) return targetYearIsPreES2023(compilerOptions.target);
-	return false;
-};
-const compilerOptionsDeclareTargetOrLib = (compilerOptions) => compilerOptions.hasExplicitLib || compilerOptions.target !== void 0;
-const detectPreES2023FromConfig = (tsConfigPath) => {
-	const compilerOptions = readResolvedCompilerOptions(tsConfigPath, 0, /* @__PURE__ */ new Set());
-	if (!compilerOptions) return false;
-	if (!compilerOptionsDeclareTargetOrLib(compilerOptions)) return false;
-	return compilerOptionsArePreES2023(compilerOptions);
-};
-const detectPreES2023Target = (directory) => {
-	const tsConfigPath = Path.join(directory, TSCONFIG_FILENAME);
-	if (isFile(tsConfigPath)) return detectPreES2023FromConfig(tsConfigPath);
-	return false;
-};
-const REACT_DEPENDENCY_NAMES = new Set([
-	"react",
-	"react-native",
-	"next",
-	"preact"
-]);
-const hasReactDependency = (packageJson) => {
-	const allDependencies = {
-		...packageJson.peerDependencies,
-		...packageJson.dependencies,
-		...packageJson.devDependencies
-	};
-	return Object.keys(allDependencies).some((packageName) => REACT_DEPENDENCY_NAMES.has(packageName));
+	const wildcardIndex = cleanPattern.indexOf("*");
+	const baseDirectory = Path.join(rootDirectory, cleanPattern.slice(0, wildcardIndex));
+	const suffixAfterWildcard = cleanPattern.slice(wildcardIndex + 1);
+	if (!isDirectory(baseDirectory)) return [];
+	const resolved = [];
+	for (const entry of readDirectoryEntries(baseDirectory)) {
+		const entryPath = Path.join(baseDirectory, entry.name, suffixAfterWildcard);
+		if (isDirectory(entryPath) && isFile(Path.join(entryPath, "package.json"))) resolved.push(entryPath);
+	}
+	return resolved;
 };
 const listWorkspacePackages = (rootDirectory) => {
 	const packageJsonPath = Path.join(rootDirectory, "package.json");
@@ -37209,6 +37176,208 @@ const listWorkspacePackages = (rootDirectory) => {
 	}
 	return packages;
 };
+const REANIMATED_DEPENDENCY_NAME = "react-native-reanimated";
+const SHOPIFY_FLASH_LIST_PACKAGE_NAME = "@shopify/flash-list";
+const resolveWorkspaceDependencyVersion = ({ concreteVersion, packageName, rootDirectory, rootPackageJson, sections, workspaceDirectory, workspacePackageJson }) => {
+	const dependencyDeclaration = getDependencyDeclaration({
+		packageJson: workspacePackageJson,
+		packageName,
+		sections
+	});
+	if (!dependencyDeclaration.hasDeclaration) return null;
+	return concreteVersion ?? resolveCatalogVersion(workspacePackageJson, packageName, workspaceDirectory, dependencyDeclaration.catalogReference) ?? resolveCatalogVersion(rootPackageJson, packageName, rootDirectory, dependencyDeclaration.catalogReference);
+};
+const shouldReplaceReactVersion = (currentVersion, nextVersion) => {
+	if (!currentVersion) return true;
+	const currentMajor = parseReactMajor(currentVersion);
+	const nextMajor = parseReactMajor(nextVersion);
+	if (currentMajor === null) return nextMajor !== null;
+	if (nextMajor === null) return false;
+	return nextMajor < currentMajor;
+};
+const evaluateManifestFacts = (facts, packageJson, directory) => {
+	if (facts.expo.version === null) {
+		const spec = getDependencySpec(packageJson, "expo");
+		if (spec !== null) facts.expo = {
+			version: spec,
+			sourceDirectory: directory
+		};
+	}
+	if (facts.next.version === null) {
+		const spec = getDependencySpec(packageJson, "next");
+		if (spec !== null) facts.next = {
+			version: spec,
+			sourceDirectory: directory
+		};
+	}
+	if (facts.shopifyFlashList.version === null) {
+		const spec = getDependencySpec(packageJson, SHOPIFY_FLASH_LIST_PACKAGE_NAME);
+		if (spec !== null) facts.shopifyFlashList = {
+			version: spec,
+			sourceDirectory: directory
+		};
+	}
+	if (facts.reanimatedVersion === null) {
+		const spec = getDependencySpec(packageJson, REANIMATED_DEPENDENCY_NAME);
+		if (spec !== null) facts.reanimatedVersion = spec;
+	}
+	facts.hasReactNativeAwarePackage = facts.hasReactNativeAwarePackage || isPackageJsonReactNativeAware(packageJson);
+	facts.hasReanimatedAwarePackage = facts.hasReanimatedAwarePackage || isPackageJsonReanimatedAware(packageJson);
+};
+const collectWorkspaceFacts = (rootDirectory, rootPackageJson, { collectReactGroup }) => {
+	const facts = {
+		reactVersion: null,
+		tailwindVersion: null,
+		zodVersion: null,
+		framework: "unknown",
+		expo: {
+			version: null,
+			sourceDirectory: null
+		},
+		next: {
+			version: null,
+			sourceDirectory: null
+		},
+		shopifyFlashList: {
+			version: null,
+			sourceDirectory: null
+		},
+		hasReactNativeAwarePackage: false,
+		hasReanimatedAwarePackage: false,
+		reanimatedVersion: null
+	};
+	evaluateManifestFacts(facts, rootPackageJson, rootDirectory);
+	let isReactGroupSettled = !collectReactGroup;
+	const visitedDirectories = /* @__PURE__ */ new Set();
+	for (const pattern of getWorkspacePatterns(rootDirectory, rootPackageJson)) {
+		const directories = [...resolveWorkspaceDirectories(rootDirectory, pattern)].sort();
+		for (const workspaceDirectory of directories) {
+			if (visitedDirectories.has(workspaceDirectory)) continue;
+			visitedDirectories.add(workspaceDirectory);
+			const workspacePackageJson = readPackageJson$1(Path.join(workspaceDirectory, "package.json"));
+			evaluateManifestFacts(facts, workspacePackageJson, workspaceDirectory);
+			const info = extractDependencyInfo(workspacePackageJson);
+			if (info.framework !== "unknown" && frameworkMergeRank(info.framework) < frameworkMergeRank(facts.framework)) facts.framework = info.framework;
+			if (isReactGroupSettled) continue;
+			const reactVersion = resolveWorkspaceDependencyVersion({
+				concreteVersion: info.reactVersion,
+				packageName: "react",
+				rootDirectory,
+				rootPackageJson,
+				sections: REACT_SECTIONS,
+				workspaceDirectory,
+				workspacePackageJson
+			});
+			const tailwindVersion = resolveWorkspaceDependencyVersion({
+				concreteVersion: info.tailwindVersion,
+				packageName: "tailwindcss",
+				rootDirectory,
+				rootPackageJson,
+				sections: TAILWIND_ZOD_SECTIONS,
+				workspaceDirectory,
+				workspacePackageJson
+			});
+			const zodVersion = resolveWorkspaceDependencyVersion({
+				concreteVersion: info.zodVersion,
+				packageName: "zod",
+				rootDirectory,
+				rootPackageJson,
+				sections: TAILWIND_ZOD_SECTIONS,
+				workspaceDirectory,
+				workspacePackageJson
+			});
+			if (reactVersion && shouldReplaceReactVersion(facts.reactVersion, reactVersion)) facts.reactVersion = reactVersion;
+			if (tailwindVersion && !facts.tailwindVersion) facts.tailwindVersion = tailwindVersion;
+			if (zodVersion && !facts.zodVersion) facts.zodVersion = zodVersion;
+			const settledReactMajor = parseReactMajor(facts.reactVersion);
+			isReactGroupSettled = Boolean(facts.reactVersion && facts.tailwindVersion && facts.framework !== "unknown" && settledReactMajor !== null && settledReactMajor <= 17);
+		}
+	}
+	return facts;
+};
+const findDependencyInfoFromMonorepoRoot = (directory) => {
+	const monorepoRoot = findMonorepoRoot(directory);
+	if (!monorepoRoot) return EMPTY_DEPENDENCY_INFO;
+	const monorepoPackageJsonPath = Path.join(monorepoRoot, "package.json");
+	if (!isFile(monorepoPackageJsonPath)) return EMPTY_DEPENDENCY_INFO;
+	const rootPackageJson = readPackageJson$1(monorepoPackageJsonPath);
+	const rootInfo = extractDependencyInfo(rootPackageJson);
+	const leafPackageJsonPath = Path.join(directory, "package.json");
+	const leafPackageJson = isFile(leafPackageJsonPath) ? readPackageJson$1(leafPackageJsonPath) : null;
+	const leafReactDeclaration = leafPackageJson ? getDependencyDeclaration({
+		packageJson: leafPackageJson,
+		packageName: "react",
+		sections: REACT_SECTIONS
+	}) : null;
+	const leafTailwindDeclaration = leafPackageJson ? getDependencyDeclaration({
+		packageJson: leafPackageJson,
+		packageName: "tailwindcss",
+		sections: TAILWIND_ZOD_SECTIONS
+	}) : null;
+	const leafZodDeclaration = leafPackageJson ? getDependencyDeclaration({
+		packageJson: leafPackageJson,
+		packageName: "zod",
+		sections: TAILWIND_ZOD_SECTIONS
+	}) : null;
+	const shouldUseReactFallback = !leafReactDeclaration?.hasDeclaration;
+	const shouldUseTailwindFallback = leafTailwindDeclaration?.hasDeclaration ?? true;
+	const shouldUseZodFallback = leafZodDeclaration?.hasDeclaration ?? true;
+	const reactCatalogVersion = shouldUseReactFallback ? resolveCatalogVersion(rootPackageJson, "react", monorepoRoot, leafReactDeclaration?.catalogReference) : null;
+	const tailwindCatalogVersion = shouldUseTailwindFallback ? resolveCatalogVersion(rootPackageJson, "tailwindcss", monorepoRoot, leafTailwindDeclaration?.catalogReference) : null;
+	const zodCatalogVersion = shouldUseZodFallback ? resolveCatalogVersion(rootPackageJson, "zod", monorepoRoot, leafZodDeclaration?.catalogReference) : null;
+	const workspaceFacts = collectWorkspaceFacts(monorepoRoot, rootPackageJson, { collectReactGroup: true });
+	return {
+		reactVersion: shouldUseReactFallback ? reactCatalogVersion ?? rootInfo.reactVersion ?? workspaceFacts.reactVersion : rootInfo.reactVersion ?? workspaceFacts.reactVersion,
+		tailwindVersion: shouldUseTailwindFallback ? tailwindCatalogVersion ?? rootInfo.tailwindVersion ?? workspaceFacts.tailwindVersion : null,
+		zodVersion: shouldUseZodFallback ? zodCatalogVersion ?? rootInfo.zodVersion ?? workspaceFacts.zodVersion : null,
+		framework: rootInfo.framework !== "unknown" ? rootInfo.framework : workspaceFacts.framework
+	};
+};
+/**
+* Last-resort React detection: locate React the way Node's `node_modules`
+* resolution would from `directory` — check each `node_modules/react` up the
+* tree — but bounded to the enclosing repo so a globally installed React can't
+* masquerade as the project's version. Stops at (and including) the nearest
+* project boundary — the git root or a monorepo root — and returns the first
+* installed `version`.
+*
+* Makes "React is installed and importable" ⇒ "React is detected" an invariant
+* for packages whose only React declaration is a version-less spec
+* (`workspace:*`, `*`, a dist-tag) or where React lives solely in a hoisted
+* `node_modules` the declaration walks never reach — the profile of a component
+* package inside a monorepo. Matching the `node_modules/react` entry rather than
+* its realpath means a project whose `node_modules` is symlinked elsewhere (a
+* Docker volume, a shared store) still counts, while a global install outside
+* the repo does not.
+*
+* Returns `null` when React isn't installed within the repo or its package.json
+* carries no version string. A tree with no boundary marker at all bounds the
+* search to `directory`, so a dependency hoisted above the scanned package there
+* is conservatively not adopted.
+*/
+/**
+* The nearest enclosing project boundary (git root or monorepo root), or
+* `directory` itself when the scan target sits outside any repo. Bounds the
+* node_modules walk so a React hoisted anywhere inside the repo counts, but a
+* React in an ancestor above the repo — a home-directory or global
+* `node_modules` — can't leak in.
+*/
+const findContainmentRoot = (directory) => {
+	for (const ancestorDirectory of ancestorDirectories(directory, { includeStart: true })) if (isProjectBoundary(ancestorDirectory)) return ancestorDirectory;
+	return directory;
+};
+const resolveInstalledReactVersion = (directory) => {
+	const containmentRoot = findContainmentRoot(directory);
+	for (const ancestorDirectory of ancestorDirectories(directory, { includeStart: true })) {
+		const reactPackageJsonPath = Path.join(ancestorDirectory, "node_modules", "react", "package.json");
+		if (isFile(reactPackageJsonPath)) {
+			const installedVersion = readPackageJson$1(reactPackageJsonPath).version;
+			return typeof installedVersion === "string" ? installedVersion : null;
+		}
+		if (ancestorDirectory === containmentRoot) return null;
+	}
+	return null;
+};
 const toReactWorkspacePackages = (directories) => {
 	const packages = [];
 	for (const directory of directories) {
@@ -37289,8 +37458,8 @@ const cachedProjectInfos = /* @__PURE__ */ new Map();
 const discoverProjectWithoutPackageJson = (directory) => {
 	const sourceFileCount = countSourceFiles(directory);
 	const hasOwnTsConfig = NFS.existsSync(Path.join(directory, "tsconfig.json"));
-	const monorepoRoot = findMonorepoRoot(directory);
-	const enclosingProject = monorepoRoot !== null && isFile(Path.join(monorepoRoot, "package.json")) ? discoverProject(monorepoRoot) : null;
+	const enclosingProjectRoot = findNearestAncestorPackageJson(directory);
+	const enclosingProject = enclosingProjectRoot !== null ? discoverProject(enclosingProjectRoot) : null;
 	if (enclosingProject !== null) return {
 		...enclosingProject,
 		rootDirectory: directory,
@@ -37320,7 +37489,9 @@ const discoverProjectWithoutPackageJson = (directory) => {
 		shopifyFlashListVersion: null,
 		shopifyFlashListMajorVersion: null,
 		hasReanimated: false,
+		reanimatedVersion: null,
 		isPreES2023Target: hasOwnTsConfig && detectPreES2023Target(directory),
+		isStaticExport: false,
 		sourceFileCount
 	};
 };
@@ -37334,88 +37505,85 @@ const discoverProject = (directory) => {
 		return synthesized;
 	}
 	const packageJson = readPackageJson$1(packageJsonPath);
-	let { reactVersion, tailwindVersion, zodVersion, framework } = extractDependencyInfo(packageJson);
-	const reactDeclaration = getDependencyDeclaration({
-		packageJson,
-		packageName: "react",
-		sections: [
-			"dependencies",
-			"peerDependencies",
-			"devDependencies"
-		]
-	});
-	const tailwindDeclaration = getDependencyDeclaration({
-		packageJson,
-		packageName: "tailwindcss",
-		sections: [
-			"dependencies",
-			"devDependencies",
-			"peerDependencies"
-		]
-	});
-	const zodDeclaration = getDependencyDeclaration({
+	const rootInfo = extractDependencyInfo(packageJson);
+	let framework = rootInfo.framework;
+	const tracked = {
+		react: {
+			version: rootInfo.reactVersion,
+			sections: REACT_SECTIONS
+		},
+		tailwindcss: {
+			version: rootInfo.tailwindVersion,
+			sections: TAILWIND_ZOD_SECTIONS
+		},
+		zod: {
+			version: rootInfo.zodVersion,
+			sections: TAILWIND_ZOD_SECTIONS
+		}
+	};
+	const declarations = Object.fromEntries(Object.entries(tracked).map(([packageName, entry]) => [packageName, getDependencyDeclaration({
 		packageJson,
-		packageName: "zod",
-		sections: [
-			"dependencies",
-			"devDependencies",
-			"peerDependencies"
-		]
-	});
-	if (!reactVersion && reactDeclaration.hasDeclaration) reactVersion = resolveCatalogVersion(packageJson, "react", directory, reactDeclaration.catalogReference);
-	if (!tailwindVersion && tailwindDeclaration.hasDeclaration) tailwindVersion = resolveCatalogVersion(packageJson, "tailwindcss", directory, tailwindDeclaration.catalogReference);
-	if (!zodVersion && zodDeclaration.hasDeclaration) zodVersion = resolveCatalogVersion(packageJson, "zod", directory, zodDeclaration.catalogReference);
-	if (!reactVersion || !tailwindVersion || !zodVersion) {
+		packageName,
+		sections: entry.sections
+	})]));
+	const fillFromCatalogs = (source, sourceDirectory) => {
+		for (const [packageName, entry] of Object.entries(tracked)) if (!entry.version && declarations[packageName].hasDeclaration) entry.version = resolveCatalogVersion(source, packageName, sourceDirectory, declarations[packageName].catalogReference);
+	};
+	fillFromCatalogs(packageJson, directory);
+	if (!tracked.react.version || !tracked.tailwindcss.version || !tracked.zod.version) {
 		const monorepoRoot = findMonorepoRoot(directory);
 		if (monorepoRoot) {
 			const monorepoPackageJsonPath = Path.join(monorepoRoot, "package.json");
-			if (isFile(monorepoPackageJsonPath)) {
-				const rootPackageJson = readPackageJson$1(monorepoPackageJsonPath);
-				if (!reactVersion && reactDeclaration.hasDeclaration) reactVersion = resolveCatalogVersion(rootPackageJson, "react", monorepoRoot, reactDeclaration.catalogReference);
-				if (!tailwindVersion && tailwindDeclaration.hasDeclaration) tailwindVersion = resolveCatalogVersion(rootPackageJson, "tailwindcss", monorepoRoot, tailwindDeclaration.catalogReference);
-				if (!zodVersion && zodDeclaration.hasDeclaration) zodVersion = resolveCatalogVersion(rootPackageJson, "zod", monorepoRoot, zodDeclaration.catalogReference);
-			}
+			if (isFile(monorepoPackageJsonPath)) fillFromCatalogs(readPackageJson$1(monorepoPackageJsonPath), monorepoRoot);
 		}
 	}
-	if (!reactVersion || framework === "unknown") {
-		const workspaceInfo = findReactInWorkspaces(directory, packageJson);
-		if (!reactVersion && workspaceInfo.reactVersion) reactVersion = workspaceInfo.reactVersion;
-		if (!tailwindVersion && workspaceInfo.tailwindVersion) tailwindVersion = workspaceInfo.tailwindVersion;
-		if (!zodVersion && workspaceInfo.zodVersion) zodVersion = workspaceInfo.zodVersion;
-		if (framework === "unknown" && workspaceInfo.framework !== "unknown") framework = workspaceInfo.framework;
+	const shouldCollectReactGroup = !tracked.react.version || framework === "unknown";
+	const workspaceFacts = collectWorkspaceFacts(directory, packageJson, { collectReactGroup: shouldCollectReactGroup });
+	if (shouldCollectReactGroup) {
+		tracked.react.version ||= workspaceFacts.reactVersion;
+		tracked.tailwindcss.version ||= workspaceFacts.tailwindVersion;
+		tracked.zod.version ||= workspaceFacts.zodVersion;
+		if (framework === "unknown" && workspaceFacts.framework !== "unknown") framework = workspaceFacts.framework;
 	}
-	if ((!reactVersion || framework === "unknown") && !isMonorepoRoot(directory)) {
+	if ((!tracked.react.version || framework === "unknown") && !isMonorepoRoot(directory)) {
 		const monorepoInfo = findDependencyInfoFromMonorepoRoot(directory);
-		if (!reactVersion) reactVersion = monorepoInfo.reactVersion;
-		if (!tailwindVersion) tailwindVersion = monorepoInfo.tailwindVersion;
-		if (!zodVersion) zodVersion = monorepoInfo.zodVersion;
+		tracked.react.version ||= monorepoInfo.reactVersion;
+		tracked.tailwindcss.version ||= monorepoInfo.tailwindVersion;
+		tracked.zod.version ||= monorepoInfo.zodVersion;
 		if (framework === "unknown") framework = monorepoInfo.framework;
 	}
-	if (!reactVersion && reactDeclaration.version && !isCatalogReference(reactDeclaration.version)) reactVersion = reactDeclaration.version;
-	if (!tailwindVersion && tailwindDeclaration.version && !isCatalogReference(tailwindDeclaration.version)) tailwindVersion = tailwindDeclaration.version;
-	if (!zodVersion && zodDeclaration.version && !isCatalogReference(zodDeclaration.version)) zodVersion = zodDeclaration.version;
+	for (const [packageName, entry] of Object.entries(tracked)) {
+		const declaredVersion = declarations[packageName].version;
+		if (!entry.version && declaredVersion && !isCatalogReference(declaredVersion)) entry.version = declaredVersion;
+	}
+	const { react, tailwindcss, zod } = tracked;
+	let reactVersion = react.version;
+	if (!reactVersion || parseReactMajor(reactVersion) === null) reactVersion = resolveInstalledReactVersion(directory) ?? reactVersion;
+	const tailwindVersion = tailwindcss.version;
+	const zodVersion = zod.version;
 	const projectName = packageJson.name ?? Path.basename(directory);
 	const hasTypeScript = NFS.existsSync(Path.join(directory, "tsconfig.json"));
 	const sourceFileCount = countSourceFiles(directory);
-	const hasReactNativeWorkspace = framework === "expo" || framework === "react-native" || hasReactNativeWorkspaceAnywhere(directory, packageJson);
+	const hasReactNativeWorkspace = framework === "expo" || framework === "react-native" || workspaceFacts.hasReactNativeAwarePackage;
 	const expoVersion = hasReactNativeWorkspace ? resolveCatalogBackedDependencyVersion({
 		rootDirectory: directory,
 		rootPackageJson: packageJson,
 		packageName: "expo",
-		version: findExpoVersion(directory, packageJson)
+		version: workspaceFacts.expo.version
 	}) : null;
 	const shopifyFlashListVersion = hasReactNativeWorkspace ? resolveCatalogBackedDependencyVersion({
 		rootDirectory: directory,
 		rootPackageJson: packageJson,
 		packageName: SHOPIFY_FLASH_LIST_PACKAGE_NAME,
-		version: findShopifyFlashListVersion(directory, packageJson)
+		version: workspaceFacts.shopifyFlashList.version
 	}) : null;
-	const hasReanimated = hasReactNativeWorkspace && someWorkspacePackageJson(directory, packageJson, isPackageJsonReanimatedAware);
+	const hasReanimated = hasReactNativeWorkspace && workspaceFacts.hasReanimatedAwarePackage;
+	const reanimatedVersion = hasReanimated ? workspaceFacts.reanimatedVersion : null;
 	const nextjsVersion = framework === "nextjs" ? resolveCatalogBackedDependencyVersion({
 		rootDirectory: directory,
 		rootPackageJson: packageJson,
 		packageName: "next",
-		version: findNextjsVersion(directory, packageJson)
+		version: workspaceFacts.next.version
 	}) : null;
 	const preactVersion = getPreactVersion(packageJson);
 	const isPreES2023Target = hasTypeScript && detectPreES2023Target(directory);
@@ -37426,7 +37594,7 @@ const discoverProject = (directory) => {
 		reactMajorVersion: resolveEffectiveReactMajor(reactVersion, packageJson),
 		tailwindVersion,
 		zodVersion,
-		zodMajorVersion: parseZodMajor(zodVersion),
+		zodMajorVersion: zodVersion === null ? null : getLowestDependencyMajor(zodVersion),
 		framework,
 		hasTypeScript,
 		hasReactCompiler: detectReactCompiler(directory, packageJson),
@@ -37440,7 +37608,9 @@ const discoverProject = (directory) => {
 		shopifyFlashListVersion,
 		shopifyFlashListMajorVersion: shopifyFlashListVersion === null ? null : getLowestDependencyMajor(shopifyFlashListVersion),
 		hasReanimated,
+		reanimatedVersion,
 		isPreES2023Target,
+		isStaticExport: framework === "nextjs" && detectNextjsStaticExport(workspaceFacts.next.sourceDirectory ?? directory),
 		sourceFileCount
 	};
 	cachedProjectInfos.set(directory, projectInfo);
@@ -37456,57 +37626,6 @@ const discoverProject = (directory) => {
 * single source file has nothing to analyze.
 */
 const isAnalyzableProject = (project) => project.reactVersion !== null || project.preactVersion !== null || project.sourceFileCount > 0;
-const MAJOR_MINOR_PATTERN = /(\d{1,4})\.(\d{1,4})/;
-const MAJOR_ONLY_PATTERN = /(\d{1,4})/;
-const UPPER_BOUND_COMPARATOR_PATTERN = /<=?\s{0,8}\d{1,4}(?:\.\d{1,4}){0,2}(?:-[^\s,|]+)?/g;
-const parseReactMajorMinor = (reactVersion) => {
-	if (typeof reactVersion !== "string") return null;
-	const trimmed = reactVersion.trim();
-	if (trimmed.length === 0) return null;
-	const lowerBoundsOnly = trimmed.replace(UPPER_BOUND_COMPARATOR_PATTERN, " ").trim();
-	if (lowerBoundsOnly.length === 0) return null;
-	const majorMinorMatch = lowerBoundsOnly.match(MAJOR_MINOR_PATTERN);
-	if (majorMinorMatch) {
-		const major = Number.parseInt(majorMinorMatch[1], 10);
-		const minor = Number.parseInt(majorMinorMatch[2], 10);
-		if (!Number.isFinite(major) || major <= 0) return null;
-		if (!Number.isFinite(minor) || minor < 0) return null;
-		return {
-			major,
-			minor
-		};
-	}
-	const majorOnlyMatch = lowerBoundsOnly.match(MAJOR_ONLY_PATTERN);
-	if (!majorOnlyMatch) return null;
-	const major = Number.parseInt(majorOnlyMatch[1], 10);
-	if (!Number.isFinite(major) || major <= 0) return null;
-	return {
-		major,
-		minor: 0
-	};
-};
-const isReactAtLeast = (detected, required) => {
-	if (detected === null) return true;
-	if (detected.major !== required.major) return detected.major > required.major;
-	return detected.minor >= required.minor;
-};
-const parseLowerBoundVersion = (versionSpec) => import_semver.validRange(versionSpec) !== null ? import_semver.minVersion(versionSpec) : import_semver.coerce(versionSpec);
-const parseTailwindMajorMinor = (tailwindVersion) => {
-	if (typeof tailwindVersion !== "string") return null;
-	const trimmed = tailwindVersion.trim();
-	if (trimmed.length === 0) return null;
-	const lowerBound = parseLowerBoundVersion(trimmed);
-	if (lowerBound === null || lowerBound.major <= 0) return null;
-	return {
-		major: lowerBound.major,
-		minor: lowerBound.minor
-	};
-};
-const isTailwindAtLeast = (detected, required) => {
-	if (detected === null) return true;
-	if (detected.major !== required.major) return detected.major > required.major;
-	return detected.minor >= required.minor;
-};
 const messageFromUnknown = (error) => error instanceof Error ? error.message : String(error);
 var InvalidGlobPatternError = class extends Error {
 	pattern;
@@ -37632,6 +37751,9 @@ const buildRuleSeverityControls = (config) => {
 		...config.buckets !== void 0 ? { buckets: config.buckets } : {}
 	};
 };
+const FOREIGN_INLINE_DISABLE_PATTERN = /(?:\/\/|\/\*)[ \t]*(eslint|oxlint)-disable-(next-line|line)(?![\w-])([^\r\n]*)/;
+const FOREIGN_BLOCK_DISABLE_PATTERN = /\/\*[ \t]*(eslint|oxlint)-disable(?![\w-])([^*\r\n]*)/;
+const FOREIGN_BLOCK_ENABLE_PATTERN = /\/\*[ \t]*(?:eslint|oxlint)-enable(?![\w-])([^*\r\n]*)/;
 const LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY = {
 	"effect/no-adjust-state-on-prop-change": "react-doctor/no-adjust-state-on-prop-change",
 	"effect/no-chain-state-updates": "react-doctor/no-chain-state-updates",
@@ -37709,6 +37831,7 @@ const LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY = {
 	"react/jsx-no-new-function-as-prop": "react-doctor/jsx-no-new-function-as-prop",
 	"react/jsx-no-new-object-as-prop": "react-doctor/jsx-no-new-object-as-prop",
 	"react/jsx-no-script-url": "react-doctor/jsx-no-script-url",
+	"react/jsx-no-target-blank": "react-doctor/jsx-no-target-blank",
 	"react/jsx-no-undef": "react-doctor/jsx-no-undef",
 	"react/jsx-no-useless-fragment": "react-doctor/jsx-no-useless-fragment",
 	"react/jsx-pascal-case": "react-doctor/jsx-pascal-case",
@@ -37793,9 +37916,6 @@ const tokenizeRuleList = (ruleList) => {
 	if (!ruleSection) return [];
 	return ruleSection.split(/[,\s]+/).map((token) => token.trim()).filter(Boolean);
 };
-const FOREIGN_INLINE_DISABLE_PATTERN = /(?:\/\/|\/\*)[ \t]*(eslint|oxlint)-disable-(next-line|line)(?![\w-])([^\r\n]*)/;
-const FOREIGN_BLOCK_DISABLE_PATTERN = /\/\*[ \t]*(eslint|oxlint)-disable(?![\w-])([^*\r\n]*)/;
-const FOREIGN_BLOCK_ENABLE_PATTERN = /\/\*[ \t]*(?:eslint|oxlint)-enable(?![\w-])([^*\r\n]*)/;
 const buildHint = (tool, token, ruleId) => `oxlint matches plugin rules only by their full name, so \`${token}\` in your ${tool}-disable comment does not silence \`${ruleId}\` — add \`${ruleId}\` to the comment (e.g. \`${token}, ${ruleId}\`).`;
 const tokenMisnamesRule = (token, ruleId) => token !== ruleId && isSameRuleKey(token, ruleId);
 const detectInlineNearMiss = (lines, diagnosticLineIndex, ruleId) => {
@@ -37849,6 +37969,53 @@ const detectForeignDisableNearMiss = (lines, diagnosticLineIndex, ruleId) => {
 	if (!ruleId.startsWith("react-doctor/")) return null;
 	return detectInlineNearMiss(lines, diagnosticLineIndex, ruleId) ?? detectBlockNearMiss(lines, diagnosticLineIndex, ruleId);
 };
+const ESLINT_REACT_HOOKS_PLUGIN_PREFIX = "react-hooks/";
+const buildAcceptedTokens = (ruleId) => {
+	const shortRuleId = ruleId.slice(15);
+	return new Set([ruleId, `${ESLINT_REACT_HOOKS_PLUGIN_PREFIX}${shortRuleId}`]);
+};
+const listNamesRule = (ruleList, acceptedTokens) => tokenizeRuleList(ruleList).some((token) => acceptedTokens.has(token));
+const isInlineDisabled = (lines, diagnosticLineIndex, acceptedTokens) => {
+	const candidates = [{
+		line: lines[diagnosticLineIndex],
+		requiredScope: "line"
+	}, {
+		line: lines[diagnosticLineIndex - 1],
+		requiredScope: "next-line"
+	}];
+	for (const { line, requiredScope } of candidates) {
+		const match = line?.match(FOREIGN_INLINE_DISABLE_PATTERN);
+		if (!match) continue;
+		const [, , scope, ruleList] = match;
+		if (scope !== requiredScope) continue;
+		if (listNamesRule(ruleList, acceptedTokens)) return true;
+	}
+	return false;
+};
+const isBlockDisabled = (lines, diagnosticLineIndex, acceptedTokens) => {
+	let isRangeOpen = false;
+	const lastLineIndex = Math.min(diagnosticLineIndex, lines.length - 1);
+	for (let lineIndex = 0; lineIndex <= lastLineIndex; lineIndex++) {
+		const line = lines[lineIndex];
+		if (line === void 0 || !line.includes("-disable") && !line.includes("-enable")) continue;
+		const disableMatch = line.match(FOREIGN_BLOCK_DISABLE_PATTERN);
+		if (disableMatch && listNamesRule(disableMatch[2], acceptedTokens)) {
+			isRangeOpen = true;
+			continue;
+		}
+		const enableMatch = line.match(FOREIGN_BLOCK_ENABLE_PATTERN);
+		if (enableMatch) {
+			const enabledRules = tokenizeRuleList(enableMatch[1]);
+			if (enabledRules.length === 0 || enabledRules.some((rule) => acceptedTokens.has(rule))) isRangeOpen = false;
+		}
+	}
+	return isRangeOpen;
+};
+const isCompilerRuleForeignDisabled = (lines, diagnosticLineIndex, ruleId) => {
+	if (!ruleId.startsWith("react-hooks-js/")) return false;
+	const acceptedTokens = buildAcceptedTokens(ruleId);
+	return isInlineDisabled(lines, diagnosticLineIndex, acceptedTokens) || isBlockDisabled(lines, diagnosticLineIndex, acceptedTokens);
+};
 const JSX_OPENER_TAG_PATTERN = /<[A-Za-z][\w.]*/g;
 const JSX_TAG_NAME_FOLLOW = /[A-Za-z]/;
 const isOpenerMatchInsideLineComment = (line, openerCharIndex) => {
@@ -37992,6 +38159,11 @@ const evaluateSuppression = (lines, diagnosticLineIndex, ruleId) => {
 		isSuppressed: true,
 		nearMissHint: null
 	};
+	if (isCompilerRuleForeignDisabled(lines, diagnosticLineIndex, ruleId)) return {
+		isSuppressed: true,
+		nearMissHint: null,
+		isForeignDirective: true
+	};
 	const directComments = findStackedDisableCommentsAbove(lines, diagnosticLineIndex);
 	if (hasChainSuppressor(directComments, ruleId)) return {
 		isSuppressed: true,
@@ -38273,12 +38445,18 @@ const collectStringSet = (values) => {
 	return new Set(values.filter((value) => typeof value === "string"));
 };
 const JSX_NO_UNDEF_IDENTIFIER_PATTERN = /^`([^`]+)`/;
+const NODE_CLI_PATH_SEGMENTS = new Set([
+	"scripts",
+	"bin",
+	"tools"
+]);
+const hasNodeCliPathSegment = (filePath) => filePath.split(/[\\/]/).slice(0, -1).some((segment) => NODE_CLI_PATH_SEGMENTS.has(segment));
 /**
 * Pre-compiles every stateful filter and returns a single
 * `apply(diagnostic)` closure that runs (in order):
 *
 * 1. auto-suppress (test-noise rules in test files; `migration-hint`
-*    wins over `test-noise`)
+*    wins over `test-noise`; `no-console` on Node CLI scripts)
 * 2. severity overrides (top-level `rules` / `categories`, with
 *    `"off"` dropping)
 * 3. warning suppression (only when `showWarnings` is false: drops every
@@ -38376,6 +38554,12 @@ const buildDiagnosticPipeline = (input) => {
 		if (hasRawTextWrappers && isInsideStringOnlyWrapper(lines, diagnostic.line, diagnostic.column, rawTextWrapperComponentNames)) return true;
 		return false;
 	};
+	const isNoConsoleOnNodeCliScript = (diagnostic) => {
+		if (diagnostic.rule !== "no-console") return false;
+		if (hasNodeCliPathSegment(diagnostic.filePath)) return true;
+		const lines = getFileLines(diagnostic.filePath);
+		return lines !== null && Boolean(lines[0]?.startsWith("#!"));
+	};
 	const isJsxNoUndefSuppressedByConfig = (diagnostic) => {
 		if (!hasRuntimeGlobals) return false;
 		if (diagnostic.rule !== "jsx-no-undef") return false;
@@ -38385,6 +38569,7 @@ const buildDiagnosticPipeline = (input) => {
 	return {
 		apply: (diagnostic) => {
 			if (shouldAutoSuppress(diagnostic)) return null;
+			if (isNoConsoleOnNodeCliScript(diagnostic)) return null;
 			let current = diagnostic;
 			let explicitSeverityOverride;
 			let explicitRuleOverride;
@@ -38414,7 +38599,7 @@ const buildDiagnosticPipeline = (input) => {
 				if (lines) {
 					const ruleIdentifier = `${current.plugin}/${current.rule}`;
 					const evaluation = evaluateSuppression(lines, current.line - 1, ruleIdentifier);
-					if (evaluation.isSuppressed) return suppress(current, "inline");
+					if (evaluation.isSuppressed) return suppress(current, evaluation.isForeignDirective ? "foreign-inline" : "inline");
 					if (evaluation.nearMissHint) current = {
 						...current,
 						suppressionHint: evaluation.nearMissHint
@@ -40251,64 +40436,64 @@ function* collectSecurityScanFiles(rootDirectory) {
 		}
 	}
 }
-/**
-* Whether project discovery resolved a React-compatible runtime (React or
-* Preact, which ships the same hooks + JSX model). This is the same
-* predicate that grants the `react` capability, so `false` means every
-* React-runtime rule family was gated off for the project.
-*/
-const hasReactRuntime = (project) => project.reactVersion !== null || project.preactVersion !== null;
+const CLIENT_ONLY_FRAMEWORKS = new Set([
+	"vite",
+	"cra",
+	"gatsby",
+	"react-native",
+	"expo"
+]);
+const addMajorLadder = (capabilities, name, major, earliest, latest) => {
+	if (major === null) return;
+	const cappedMajor = Math.min(major, latest);
+	for (let candidate = earliest; candidate <= cappedMajor; candidate += 1) capabilities.add(`${name}:${candidate}`);
+};
 const buildCapabilities = (project) => {
 	const capabilities = /* @__PURE__ */ new Set();
 	capabilities.add(project.framework);
-	if (hasReactRuntime(project)) capabilities.add("react");
+	if (project.reactVersion !== null || project.preactVersion !== null) capabilities.add("react");
 	if (project.framework === "expo" || project.framework === "react-native" || project.hasReactNativeWorkspace) capabilities.add("react-native");
 	if (project.expoVersion !== null) capabilities.add("expo");
+	if ((project.framework === "nextjs" || project.framework === "tanstack-start" || project.framework === "remix") && !project.isStaticExport) capabilities.add("server-actions");
+	if (CLIENT_ONLY_FRAMEWORKS.has(project.framework)) capabilities.add("client-only");
+	if (project.isStaticExport) capabilities.add("nextjs:static-export");
 	if (project.nextjsMajorVersion !== null && project.nextjsMajorVersion >= 15) capabilities.add("nextjs:15");
-	const reactMajor = project.reactMajorVersion;
-	if (reactMajor !== null) {
-		const cappedReactMajor = Math.min(reactMajor, 30);
-		for (let major = 17; major <= cappedReactMajor; major++) capabilities.add(`react:${major}`);
-		if (reactMajor >= 19) {
-			if (isReactAtLeast(parseReactMajorMinor(project.reactVersion), {
-				major: 19,
-				minor: 2
-			})) capabilities.add("react:19.2");
-		}
-	}
-	if (project.tailwindVersion !== null) {
-		capabilities.add("tailwind");
-		if (isTailwindAtLeast(parseTailwindMajorMinor(project.tailwindVersion), {
-			major: 3,
-			minor: 4
-		})) capabilities.add("tailwind:3.4");
-	}
-	if (project.zodVersion !== null) {
-		capabilities.add("zod");
-		if (project.zodMajorVersion !== null && project.zodMajorVersion >= 4) capabilities.add("zod:4");
-	}
+	addMajorLadder(capabilities, "react", project.reactMajorVersion, 17, 30);
+	if (project.reactMajorVersion !== null && project.reactMajorVersion >= 19 && isMajorMinorAtLeast(parseReactMajorMinor(project.reactVersion), {
+		major: 19,
+		minor: 2
+	})) capabilities.add("react:19.2");
+	if (project.tailwindVersion !== null) capabilities.add("tailwind");
+	if (project.tailwindVersion !== null && isMajorMinorAtLeast(parseTailwindMajorMinor(project.tailwindVersion), {
+		major: 3,
+		minor: 4
+	})) capabilities.add("tailwind:3.4");
+	if (project.zodVersion !== null) capabilities.add("zod");
+	if (project.zodMajorVersion !== null && project.zodMajorVersion >= 4) capabilities.add("zod:4");
 	if (project.isPreES2023Target) capabilities.add("pre-es2023");
 	if (project.hasReactCompiler) capabilities.add("react-compiler");
 	if (project.hasTanStackQuery) capabilities.add("tanstack-query");
 	if (project.hasTypeScript) capabilities.add("typescript");
-	if (project.preactVersion !== null) {
-		capabilities.add("preact");
-		const preactMajor = project.preactMajorVersion;
-		if (preactMajor !== null) {
-			const cappedPreactMajor = Math.min(preactMajor, 20);
-			for (let major = 10; major <= cappedPreactMajor; major++) capabilities.add(`preact:${major}`);
-		}
-		if (project.reactVersion === null) capabilities.add("pure-preact");
-	}
+	if (project.preactVersion !== null) capabilities.add("preact");
+	addMajorLadder(capabilities, "preact", project.preactMajorVersion, 10, 20);
+	if (project.preactVersion !== null && project.reactVersion === null) capabilities.add("pure-preact");
 	return capabilities;
 };
-const shouldEnableRule = (requires, tags, capabilities, ignoredTags, disabledBy) => {
+const capabilitiesByProject = /* @__PURE__ */ new WeakMap();
+const getCapabilities = (project) => {
+	const cached = capabilitiesByProject.get(project);
+	if (cached !== void 0) return cached;
+	const capabilities = buildCapabilities(project);
+	capabilitiesByProject.set(project, capabilities);
+	return capabilities;
+};
+const shouldEnableRule = (requires, tags, capabilities, ignoredTags, disabledWhen) => {
 	if (requires) {
 		for (const capability of requires) if (!capabilities.has(capability)) return false;
 	}
 	if (tags?.includes("react-jsx-only") && !capabilities.has("react")) return false;
-	if (disabledBy) {
-		for (const capability of disabledBy) if (capabilities.has(capability)) return false;
+	if (disabledWhen) {
+		for (const capability of disabledWhen) if (capabilities.has(capability)) return false;
 	}
 	if (tags) {
 		for (const tag of tags) if (ignoredTags.has(tag)) return false;
@@ -40319,14 +40504,14 @@ const yieldToEventLoop = () => new Promise((resolve) => {
 	setImmediate(resolve);
 });
 const createSecurityScanSession = (rootDirectory, options) => {
-	const capabilities = options.project ? buildCapabilities(options.project) : /* @__PURE__ */ new Set();
+	const capabilities = options.project ? getCapabilities(options.project) : /* @__PURE__ */ new Set();
 	const ignoredTags = options.ignoredTags ?? /* @__PURE__ */ new Set();
 	const enabledScanRules = REACT_DOCTOR_RULES.flatMap((entry) => {
 		const rule = entry.rule;
 		const scan = rule.scan;
 		if (typeof scan !== "function") return [];
 		if (rule.defaultEnabled === false) return [];
-		if (!shouldEnableRule(rule.requires, rule.tags, capabilities, ignoredTags, rule.disabledBy)) return [];
+		if (!shouldEnableRule(rule.requires, rule.tags, capabilities, ignoredTags, rule.disabledWhen)) return [];
 		return [{
 			entry,
 			scan,
@@ -40346,6 +40531,7 @@ const createSecurityScanSession = (rootDirectory, options) => {
 		return status === true;
 	};
 	const scanFileByRule = function* (file) {
+		if (file === null) return;
 		for (const { entry, scan, committedFilesOnly } of enabledScanRules) {
 			for (const finding of scan(file)) {
 				if (committedFilesOnly && isFileGitIgnored(file)) continue;
@@ -41807,7 +41993,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 			})),
 			showStagedContent: (directory, relativePath, options) => runCommand({
 				command: "git",
-				args: ["show", `:${relativePath}`],
+				args: ["show", `:./${relativePath}`],
 				directory,
 				maxStdoutBytes: options?.maxBufferBytes
 			}).pipe(map$3((result) => result.status === 0 ? result.stdout : null)),
@@ -42242,7 +42428,7 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 	const reactCompilerRules = reactHooksJsPlugin ? applyRuleSeverityControls(filterRulesToAvailable(REACT_COMPILER_RULES, "react-hooks-js", reactHooksJsPlugin.availableRuleNames), severityControls) : {};
 	const jsPlugins = [];
 	if (reactHooksJsPlugin) jsPlugins.push(reactHooksJsPlugin.entry);
-	const capabilities = buildCapabilities(project);
+	const capabilities = getCapabilities(project);
 	const enabledReactDoctorRules = {};
 	for (const registryEntry of REACT_DOCTOR_RULES) {
 		const rule = reactDoctorPlugin.rules[registryEntry.id];
@@ -42253,7 +42439,7 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 		if (rule.scan !== void 0) continue;
 		if (customRulesOnly && registryEntry.originallyExternal) continue;
 		if (rule.framework !== "global" && !rule.requires) continue;
-		if (!shouldEnableRule(rule.requires, rule.tags, capabilities, ignoredTags, rule.disabledBy)) continue;
+		if (!shouldEnableRule(rule.requires, rule.tags, capabilities, ignoredTags, rule.disabledWhen)) continue;
 		const explicitRuleOverride = resolveRuleSeverityOverride({ ruleKey: registryEntry.key }, severityControls);
 		if (rule.defaultEnabled === false && explicitRuleOverride === void 0) continue;
 		const severity = resolveRuleSeverityOverride({
@@ -42284,6 +42470,7 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 		settings: { "react-doctor": {
 			framework: project.framework,
 			rootDirectory: resolveSettingsRootDirectory(project.rootDirectory),
+			capabilities: [...capabilities].sort(),
 			...project.shopifyFlashListMajorVersion !== null ? { shopifyFlashListMajorVersion: project.shopifyFlashListMajorVersion } : {},
 			...serverAuthFunctionNames && serverAuthFunctionNames.length > 0 ? { serverAuthFunctionNames: [...serverAuthFunctionNames] } : {}
 		} },
@@ -42574,25 +42761,18 @@ const mapWithConcurrency = async (items, concurrency, task) => {
 	if (errors.length > 0) throw errors[0];
 	return results;
 };
-const getPublicEnvPrefix = (framework) => {
-	switch (framework) {
-		case "nextjs": return "NEXT_PUBLIC_*";
-		case "vite":
-		case "tanstack-start": return "VITE_*";
-		case "cra": return "REACT_APP_*";
-		case "gatsby": return "GATSBY_*";
-		default: return null;
-	}
-};
-const buildNoSecretsRecommendation = (project, fallbackRecommendation) => {
-	const publicEnvPrefix = getPublicEnvPrefix(project.framework);
-	if (!publicEnvPrefix) return fallbackRecommendation;
-	return `Move secrets to server-only code. In ${formatFrameworkName(project.framework)}, only \`${publicEnvPrefix}\` env vars are exposed to the browser, and they must not contain secrets`;
-};
 const REANIMATED_SHARED_VALUE_HINT = "If this is a Reanimated shared value, prefer its React Compiler-compatible `.get()` / `.set()` accessors over `.value` — https://docs.swmansion.com/react-native-reanimated/docs/core/useSharedValue/#react-compiler-support";
+const ACCESSORS_MIN_VERSION = "3.15.0";
+const supportsAccessors = (reanimatedVersion) => {
+	if (reanimatedVersion === null) return true;
+	const lowerBound = import_semver.validRange(reanimatedVersion) !== null ? import_semver.minVersion(reanimatedVersion) : import_semver.coerce(reanimatedVersion);
+	if (lowerBound === null) return true;
+	return import_semver.gte(lowerBound, ACCESSORS_MIN_VERSION);
+};
 const appendReanimatedSharedValueHint = (help, rule, project) => {
 	if (rule !== "immutability") return help;
 	if (!project.hasReanimated) return help;
+	if (!supportsAccessors(project.reanimatedVersion)) return help;
 	if (!help) return REANIMATED_SHARED_VALUE_HINT;
 	return `${help}\n\n${REANIMATED_SHARED_VALUE_HINT}`;
 };
@@ -42754,13 +42934,13 @@ const REACT_USE_BINDING_RESOLUTION = {
 	isReactUseBinding: true,
 	isReactNamespaceBinding: false
 };
-const getScriptKind = (filename) => {
+const getScriptKind$2 = (filename) => {
 	if (filename.endsWith(".tsx")) return ts.ScriptKind.TSX;
 	if (filename.endsWith(".jsx")) return ts.ScriptKind.JSX;
 	if (filename.endsWith(".ts")) return ts.ScriptKind.TS;
 	return ts.ScriptKind.JS;
 };
-const getUtf16Offset = (sourceText, utf8Offset) => Buffer.from(sourceText).subarray(0, utf8Offset).toString("utf8").length;
+const getUtf16Offset$1 = (sourceText, utf8Offset) => Buffer.from(sourceText).subarray(0, utf8Offset).toString("utf8").length;
 const unwrapExpression = (expression) => {
 	let currentExpression = expression;
 	while (ts.isParenthesizedExpression(currentExpression) || ts.isAsExpression(currentExpression) || ts.isSatisfiesExpression(currentExpression) || ts.isNonNullExpression(currentExpression) || ts.isTypeAssertionExpression(currentExpression)) currentExpression = currentExpression.expression;
@@ -43009,8 +43189,8 @@ const findUseCallIdentifier = (sourceFile, useOffset) => {
 	return matchedIdentifier;
 };
 const resolveUseCallBinding = (sourceText, filename, utf8Offset) => {
-	const sourceFile = ts.createSourceFile(filename, sourceText, ts.ScriptTarget.Latest, true, getScriptKind(filename));
-	const useIdentifier = findUseCallIdentifier(sourceFile, getUtf16Offset(sourceText, utf8Offset));
+	const sourceFile = ts.createSourceFile(filename, sourceText, ts.ScriptTarget.Latest, true, getScriptKind$2(filename));
+	const useIdentifier = findUseCallIdentifier(sourceFile, getUtf16Offset$1(sourceText, utf8Offset));
 	if (!useIdentifier) return null;
 	return resolveIdentifierBinding(useIdentifier, collectReactImportBindings(sourceFile), sourceFile);
 };
@@ -43031,6 +43211,201 @@ const shouldSuppressLocalUseHookDiagnostic = (diagnostic, rootDirectory) => {
 	const bindingResolution = resolveUseCallBinding(sourceText, absolutePath, primaryLabel.span.offset);
 	return bindingResolution !== null && !bindingResolution.isReactUseBinding;
 };
+const SUPPRESSED_COMPILER_CODES = new Set(["react-hooks-js(immutability)", "react-hooks-js(refs)"]);
+const WORKLET_DIRECTIVE = "worklet";
+const WORKLET_ACCEPTING_CALLEES = new Set([
+	"useAnimatedStyle",
+	"useAnimatedProps",
+	"useDerivedValue",
+	"useAnimatedReaction",
+	"useAnimatedScrollHandler",
+	"useAnimatedGestureHandler",
+	"useFrameCallback",
+	"runOnUI",
+	"executeOnUIRuntimeSync"
+]);
+const GESTURE_ROOT_IDENTIFIER = "Gesture";
+const getScriptKind$1 = (filename) => {
+	if (filename.endsWith(".tsx")) return ts.ScriptKind.TSX;
+	if (filename.endsWith(".jsx")) return ts.ScriptKind.JSX;
+	if (filename.endsWith(".ts")) return ts.ScriptKind.TS;
+	return ts.ScriptKind.JS;
+};
+const getUtf16Offset = (sourceText, utf8Offset) => Buffer.from(sourceText).subarray(0, utf8Offset).toString("utf8").length;
+const hasWorkletDirective = (node) => {
+	if (!ts.isFunctionDeclaration(node) && !ts.isFunctionExpression(node) && !ts.isArrowFunction(node) && !ts.isMethodDeclaration(node)) return false;
+	const body = node.body;
+	if (!body || !ts.isBlock(body)) return false;
+	for (const statement of body.statements) {
+		if (!ts.isExpressionStatement(statement)) return false;
+		if (!ts.isStringLiteral(statement.expression)) return false;
+		if (statement.expression.text === WORKLET_DIRECTIVE) return true;
+	}
+	return false;
+};
+const rootIdentifierOfCallChain = (expression) => {
+	let currentExpression = expression;
+	while (true) {
+		if (ts.isIdentifier(currentExpression)) return currentExpression.text;
+		if (ts.isPropertyAccessExpression(currentExpression)) {
+			currentExpression = currentExpression.expression;
+			continue;
+		}
+		if (ts.isCallExpression(currentExpression)) {
+			currentExpression = currentExpression.expression;
+			continue;
+		}
+		return null;
+	}
+};
+const isWorkletAcceptingCall = (callExpression) => {
+	const callee = callExpression.expression;
+	if (ts.isIdentifier(callee)) return WORKLET_ACCEPTING_CALLEES.has(callee.text);
+	if (ts.isPropertyAccessExpression(callee)) {
+		if (WORKLET_ACCEPTING_CALLEES.has(callee.name.text)) return true;
+		return rootIdentifierOfCallChain(callee) === GESTURE_ROOT_IDENTIFIER;
+	}
+	return false;
+};
+const isFunctionWorklet = (functionNode) => {
+	if (hasWorkletDirective(functionNode)) return true;
+	const parent = functionNode.parent;
+	return ts.isCallExpression(parent) && parent.arguments.some((argument) => argument === functionNode) && isWorkletAcceptingCall(parent);
+};
+const findNodeAtOffset = (sourceFile, targetOffset) => {
+	let matchedNode = null;
+	const visit = (node) => {
+		if (node.getStart(sourceFile) > targetOffset || node.getEnd() <= targetOffset) return;
+		matchedNode = node;
+		ts.forEachChild(node, visit);
+	};
+	visit(sourceFile);
+	return matchedNode;
+};
+const isOffsetInsideWorklet = (sourceFile, targetOffset) => {
+	let currentNode = findNodeAtOffset(sourceFile, targetOffset);
+	while (currentNode) {
+		if (ts.isFunctionLike(currentNode) && isFunctionWorklet(currentNode)) return true;
+		currentNode = currentNode.parent;
+	}
+	return false;
+};
+const shouldSuppressCompilerFindingInWorklet = (diagnostic, project, rootDirectory) => {
+	if (!SUPPRESSED_COMPILER_CODES.has(diagnostic.code)) return false;
+	if (!project.hasReanimated) return false;
+	const primaryLabel = diagnostic.labels[0];
+	if (!primaryLabel) return false;
+	const absolutePath = Path.isAbsolute(diagnostic.filename) ? diagnostic.filename : Path.join(rootDirectory, diagnostic.filename);
+	let sourceText;
+	try {
+		sourceText = NFS.readFileSync(absolutePath, "utf-8");
+	} catch {
+		return false;
+	}
+	return isOffsetInsideWorklet(ts.createSourceFile(absolutePath, sourceText, ts.ScriptTarget.Latest, true, getScriptKind$1(absolutePath)), getUtf16Offset(sourceText, primaryLabel.span.offset));
+};
+const MANUAL_MEMOIZATION_PLUGIN = "react-doctor";
+const MANUAL_MEMOIZATION_RULE = "react-compiler-no-manual-memoization";
+const REACT_COMPILER_PLUGIN = "react-hooks-js";
+const getScriptKind = (filename) => {
+	if (filename.endsWith(".tsx")) return ts.ScriptKind.TSX;
+	if (filename.endsWith(".jsx")) return ts.ScriptKind.JSX;
+	if (filename.endsWith(".ts")) return ts.ScriptKind.TS;
+	return ts.ScriptKind.JS;
+};
+const isManualMemoizationDiagnostic = (diagnostic) => diagnostic.plugin === MANUAL_MEMOIZATION_PLUGIN && diagnostic.rule === MANUAL_MEMOIZATION_RULE;
+const nodeLineRange = (sourceFile, node) => ({
+	startLine: sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1,
+	endLine: sourceFile.getLineAndCharacterOfPosition(node.getEnd()).line + 1
+});
+const findOutermostEnclosingFunctionRange = (sourceFile, targetLine) => {
+	let foundRange = null;
+	const visit = (node) => {
+		if (foundRange) return;
+		if (ts.isFunctionLike(node)) {
+			const range = nodeLineRange(sourceFile, node);
+			if (range.startLine <= targetLine && targetLine <= range.endLine) foundRange = range;
+			return;
+		}
+		ts.forEachChild(node, visit);
+	};
+	visit(sourceFile);
+	return foundRange;
+};
+const NEWLINE_BYTE = 10;
+const lineOfUtf8Offset = (sourceBuffer, utf8Offset) => {
+	let lineNumber = 1;
+	const scanEnd = Math.min(utf8Offset, sourceBuffer.length);
+	for (let byteIndex = 0; byteIndex < scanEnd; byteIndex++) if (sourceBuffer[byteIndex] === NEWLINE_BYTE) lineNumber++;
+	return lineNumber;
+};
+/**
+* Drops `react-doctor/react-compiler-no-manual-memoization` diagnostics
+* whose enclosing function also carries a `react-hooks-js` (React
+* Compiler) diagnostic. Every react-hooks-js finding marks a function the
+* compiler could NOT compile (a bail-out / skip / preserve-manual-
+* memoization failure), so "React Compiler already caches every value
+* here" is false for that function and the manual memoization is
+* load-bearing, not dead weight.
+*
+* Matching is per enclosing function, not per file: a bailed-out
+* component must not silence redundant-memo findings in a sibling
+* component the compiler did optimize.
+*
+* Module-scope `memo(() => …)` wrappers have no enclosing function; for
+* those the memo call's own span is the containment range, so a bail-out
+* inside the inline-wrapped component still suppresses. Every failure
+* path (unreadable file, missing span) fails open and keeps the
+* diagnostic.
+*/
+const suppressMemoizationInBailedOutFunctions = (diagnostics, rootDirectory) => {
+	const compilerDiagnosticLinesByFile = /* @__PURE__ */ new Map();
+	let hasManualMemoizationDiagnostic = false;
+	for (const diagnostic of diagnostics) {
+		if (isManualMemoizationDiagnostic(diagnostic)) {
+			hasManualMemoizationDiagnostic = true;
+			continue;
+		}
+		if (diagnostic.plugin !== REACT_COMPILER_PLUGIN || diagnostic.line <= 0) continue;
+		const lines = compilerDiagnosticLinesByFile.get(diagnostic.filePath);
+		if (lines) lines.push(diagnostic.line);
+		else compilerDiagnosticLinesByFile.set(diagnostic.filePath, [diagnostic.line]);
+	}
+	if (!hasManualMemoizationDiagnostic || compilerDiagnosticLinesByFile.size === 0) return diagnostics;
+	const parsedFileCache = /* @__PURE__ */ new Map();
+	const readAndParse = (filePath) => {
+		const cached = parsedFileCache.get(filePath);
+		if (cached !== void 0) return cached;
+		const absolutePath = Path.isAbsolute(filePath) ? filePath : Path.resolve(rootDirectory || ".", filePath);
+		let parsed;
+		try {
+			const buffer = NFS.readFileSync(absolutePath);
+			parsed = {
+				sourceFile: ts.createSourceFile(absolutePath, buffer.toString("utf8"), ts.ScriptTarget.Latest, true, getScriptKind(absolutePath)),
+				buffer
+			};
+		} catch {
+			parsed = null;
+		}
+		parsedFileCache.set(filePath, parsed);
+		return parsed;
+	};
+	const isInsideBailedOutFunction = (diagnostic) => {
+		const compilerLines = compilerDiagnosticLinesByFile.get(diagnostic.filePath);
+		if (!compilerLines || diagnostic.line <= 0) return false;
+		const parsed = readAndParse(diagnostic.filePath);
+		if (!parsed) return false;
+		let containmentRange = findOutermostEnclosingFunctionRange(parsed.sourceFile, diagnostic.line);
+		if (!containmentRange && diagnostic.offset !== void 0 && diagnostic.length !== void 0) containmentRange = {
+			startLine: diagnostic.line,
+			endLine: lineOfUtf8Offset(parsed.buffer, diagnostic.offset + diagnostic.length)
+		};
+		if (!containmentRange) return false;
+		const { startLine, endLine } = containmentRange;
+		return compilerLines.some((compilerLine) => startLine <= compilerLine && compilerLine <= endLine);
+	};
+	return diagnostics.filter((diagnostic) => !isManualMemoizationDiagnostic(diagnostic) || !isInsideBailedOutFunction(diagnostic));
+};
 const FILEPATH_WITH_LOCATION_PATTERN = /\S+\.\w+:\d+:\d+[\s\S]*$/;
 const LEADING_SEVERITY_LABEL_PATTERN = /^(?:Error|Warning):\s*/;
 const TRAILING_PERIOD_PATTERN = /\.$/;
@@ -43066,8 +43441,14 @@ const PLUGIN_CATEGORY_MAP = {
 };
 const lookupOwnString = (record, key) => Object.hasOwn(record, key) ? record[key] : void 0;
 const getRuleRecommendation = (ruleName, project) => {
-	if (ruleName === "no-secrets-in-client-code") return buildNoSecretsRecommendation(project, reactDoctorPlugin.rules["no-secrets-in-client-code"]?.recommendation ?? "Move secrets to server-only code");
-	return reactDoctorPlugin.rules[ruleName]?.recommendation;
+	const rule = reactDoctorPlugin.rules[ruleName];
+	if (!rule) return void 0;
+	if (rule.recommendationFor) {
+		const capabilities = getCapabilities(project);
+		const conditionalRecommendation = rule.recommendationFor((capability) => capabilities.has(capability));
+		if (conditionalRecommendation !== void 0) return conditionalRecommendation;
+	}
+	return rule.recommendation;
 };
 const getRuleCategory = (ruleName) => reactDoctorPlugin.rules[ruleName]?.category;
 const getRuleTitle = (ruleName) => reactDoctorPlugin.rules[ruleName]?.title;
@@ -43170,7 +43551,7 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 		minifiedFileCache.set(absolutePath, minified);
 		return minified;
 	};
-	return parsed.diagnostics.filter((diagnostic) => diagnostic.code && isLintableSourceFile(diagnostic.filename) && !isMinifiedDiagnosticFile(diagnostic.filename) && !shouldSuppressLocalUseHookDiagnostic(diagnostic, rootDirectory)).map((diagnostic) => {
+	return suppressMemoizationInBailedOutFunctions(parsed.diagnostics.filter((diagnostic) => diagnostic.code && isLintableSourceFile(diagnostic.filename) && !isMinifiedDiagnosticFile(diagnostic.filename) && !shouldSuppressLocalUseHookDiagnostic(diagnostic, rootDirectory) && !shouldSuppressCompilerFindingInWorklet(diagnostic, project, rootDirectory)).map((diagnostic) => {
 		const { plugin, rule } = parseRuleCode(diagnostic.code);
 		const primaryLabel = diagnostic.labels[0];
 		const cleaned = cleanDiagnosticMessage(diagnostic.message, diagnostic.help, plugin, rule, project);
@@ -43197,7 +43578,7 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 			...resolveMatchByOccurrence(rule, category) ? { matchByOccurrence: true } : {},
 			...relatedLocations.length > 0 ? { relatedLocations } : {}
 		};
-	});
+	}), rootDirectory);
 };
 const buildOxlintChildEnv = (sourceEnv) => {
 	const childEnv = {};
@@ -43708,6 +44089,7 @@ const runOxlint = async (options) => {
 	const serverAuthFunctionNames = Array.isArray(userConfig?.serverAuthFunctionNames) ? userConfig.serverAuthFunctionNames.filter((entry) => typeof entry === "string" && entry.length > 0) : void 0;
 	const severityControls = buildRuleSeverityControls(userConfig);
 	validateRuleRegistration();
+	resetManifestCaches();
 	if (includePaths !== void 0 && includePaths.length === 0) return [];
 	const pluginPath = resolvePluginPath();
 	const extendsPaths = (adoptExistingLintConfig && !customRulesOnly ? detectUserLintConfigPaths(rootDirectory) : []).filter(canOxlintExtendConfig);
@@ -44370,9 +44752,10 @@ const CONTEXT_AXES = [
 	}
 ];
 const SCORE_AXES = [...GATED_AXES, ...CONTEXT_AXES];
-const worstGatedAxis = (score) => {
-	let worst = GATED_AXES[0];
-	for (const axis of GATED_AXES) if (score[axis.key] < score[worst.key]) worst = axis;
+const gatedAxesForSection = (section) => section === "devDependencies" ? GATED_AXES.filter((axis) => axis.key !== "vulnerability") : GATED_AXES;
+const worstGatedAxis = (score, gatedAxes) => {
+	let worst = gatedAxes[0];
+	for (const axis of gatedAxes) if (score[axis.key] < score[worst.key]) worst = axis;
 	return worst;
 };
 const clampScore = (value) => {
@@ -44396,6 +44779,69 @@ const resolveConcreteVersion = (spec) => {
 	if (range === null || range === "*") return null;
 	return import_semver.minVersion(trimmed)?.version ?? null;
 };
+const readTextFileOrNull = (filePath) => {
+	try {
+		return NFS.readFileSync(filePath, "utf-8");
+	} catch {
+		return null;
+	}
+};
+const buildNpmLockLookup = (lockText) => {
+	let parsed;
+	try {
+		parsed = JSON.parse(lockText);
+	} catch {
+		return null;
+	}
+	if (typeof parsed !== "object" || parsed === null) return null;
+	const lock = parsed;
+	return (name) => {
+		const entry = lock.packages?.[`node_modules/${name}`] ?? lock.dependencies?.[name];
+		return typeof entry?.version === "string" ? entry.version : null;
+	};
+};
+const buildYarnLockLookup = (lockText) => {
+	const lines = lockText.split(/\r?\n/);
+	return (name, spec) => {
+		const descriptor = `${name}@${spec}`;
+		const berryDescriptor = `${name}@npm:${spec}`;
+		for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
+			const line = lines[lineIndex];
+			if (line.startsWith(" ") || line.startsWith("#") || !line.includes(":")) continue;
+			const descriptors = line.replace(/:\s*$/, "").split(",").map((part) => part.trim().replace(/^"|"$/g, ""));
+			if (!descriptors.includes(descriptor) && !descriptors.includes(berryDescriptor)) continue;
+			for (let bodyIndex = lineIndex + 1; bodyIndex < lines.length && (lines[bodyIndex].startsWith(" ") || lines[bodyIndex] === ""); bodyIndex += 1) {
+				const versionMatch = /^\s+version:?\s+"?([^"\s]+)"?/.exec(lines[bodyIndex]);
+				if (versionMatch) return versionMatch[1];
+			}
+			return null;
+		}
+		return null;
+	};
+};
+const buildPnpmLockLookup = (lockText) => {
+	return (name) => {
+		const entryPattern = new RegExp(`^ {4,8}['"]?${name.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&")}['"]?:\\s*$`);
+		const lines = lockText.split(/\r?\n/);
+		for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
+			if (!entryPattern.test(lines[lineIndex])) continue;
+			for (let bodyIndex = lineIndex + 1; bodyIndex < lines.length && /^ {5,}\S/.test(lines[bodyIndex]); bodyIndex += 1) {
+				const versionMatch = /^\s+version:\s+['"]?([^'"\s(]+)/.exec(lines[bodyIndex]);
+				if (versionMatch) return versionMatch[1];
+			}
+		}
+		return null;
+	};
+};
+const buildLockedVersionLookup = (rootDirectory) => {
+	const npmLockText = readTextFileOrNull(Path.join(rootDirectory, "package-lock.json"));
+	if (npmLockText !== null) return buildNpmLockLookup(npmLockText);
+	const yarnLockText = readTextFileOrNull(Path.join(rootDirectory, "yarn.lock"));
+	if (yarnLockText !== null) return buildYarnLockLookup(yarnLockText);
+	const pnpmLockText = readTextFileOrNull(Path.join(rootDirectory, "pnpm-lock.yaml"));
+	if (pnpmLockText !== null) return buildPnpmLockLookup(pnpmLockText);
+	return null;
+};
 const locateDependencyKey = (packageJsonText, section, name) => {
 	const needle = `"${name}"`;
 	const sectionHeader = new RegExp(`"${section}"\\s*:\\s*\\{`);
@@ -44422,7 +44868,7 @@ const locateDependencyKey = (packageJsonText, section, name) => {
 	}
 	return null;
 };
-const collectDependenciesToScore = (packageJson, packageJsonText, includeDevDependencies) => {
+const collectDependenciesToScore = (packageJson, packageJsonText, includeDevDependencies, lockedVersionLookup) => {
 	const sectionByName = /* @__PURE__ */ new Map();
 	for (const name of Object.keys(packageJson.dependencies ?? {})) sectionByName.set(name, "dependencies");
 	if (includeDevDependencies) {
@@ -44432,13 +44878,18 @@ const collectDependenciesToScore = (packageJson, packageJsonText, includeDevDepe
 	for (const [name, section] of sectionByName) {
 		if (SUPPLY_CHAIN_IGNORED_PACKAGES.has(name)) continue;
 		const spec = (packageJson[section] ?? {})[name] ?? "";
-		const version = resolveConcreteVersion(spec);
-		if (version === null) continue;
+		const floorVersion = resolveConcreteVersion(spec);
+		if (floorVersion === null) continue;
+		const lockedVersion = lockedVersionLookup?.(name, spec) ?? null;
+		const lockSatisfiesSpec = lockedVersion !== null && import_semver.valid(lockedVersion) !== null && import_semver.satisfies(lockedVersion, spec);
+		const isExactPin = import_semver.valid(spec.trim()) !== null;
 		const location = locateDependencyKey(packageJsonText, section, name);
 		dependencies.push({
 			name,
-			version,
+			version: lockSatisfiesSpec ? lockedVersion : floorVersion,
 			spec,
+			section,
+			resolution: isExactPin ? "pin" : lockSatisfiesSpec ? "locked" : "floor",
 			line: location?.line ?? 0,
 			column: location?.column ?? 0
 		});
@@ -44589,7 +45040,11 @@ const formatAlertReason = (topAlerts, totalCount) => {
 	}
 	return `Socket flagged ${totalCount} alerts (${topAlerts.map((alert) => friendlyAlertType(alert.type)).join(", ")}${totalCount > topAlerts.length ? ` (+${totalCount - topAlerts.length} more)` : ""}); most severe: ${displaySeverity(topAlerts[0].severity)}.`;
 };
-const formatDependencyIdentity = (dependency) => import_semver.valid(dependency.spec) !== null ? `${dependency.name}@${dependency.version}` : `${dependency.name}@${dependency.version} (lowest version "${dependency.spec}" allows)`;
+const formatDependencyIdentity = (dependency) => {
+	if (dependency.resolution === "pin") return `${dependency.name}@${dependency.version}`;
+	if (dependency.resolution === "locked") return `${dependency.name}@${dependency.version} (lockfile resolution of "${dependency.spec}")`;
+	return `${dependency.name}@${dependency.version} (lowest version "${dependency.spec}" allows)`;
+};
 const buildSupplyChainHelp = (dependency, failingAxis, topAlerts, packagePageUrl, options) => {
 	const hasCriticalAlert = topAlerts.some((alert) => alert.severity.toLowerCase() === "critical");
 	const entry = `\`"${dependency.name}": "${dependency.spec}"\``;
@@ -44632,7 +45087,7 @@ const buildLowScoreDiagnostic = (dependency, artifact, failingAxis, options) =>
 const checkSupplyChain = (input) => gen(function* () {
 	const options = resolveOptions(input.userConfig);
 	const packageJsonPath = Path.join(input.rootDirectory, "package.json");
-	const dependencies = collectDependenciesToScore(readPackageJson$1(packageJsonPath), readPackageJsonText(packageJsonPath), options.includeDevDependencies);
+	const dependencies = collectDependenciesToScore(readPackageJson$1(packageJsonPath), readPackageJsonText(packageJsonPath), options.includeDevDependencies, buildLockedVersionLookup(input.rootDirectory));
 	if (dependencies.length === 0) return [];
 	const cacheDirectory = isSupplyChainCacheDisabled() ? null : resolveReactDoctorCacheDir(input.rootDirectory);
 	if (cacheDirectory !== null) pruneExpiredSocketCache(cacheDirectory);
@@ -44641,7 +45096,7 @@ const checkSupplyChain = (input) => gen(function* () {
 	for (let index = 0; index < dependencies.length; index += 1) {
 		const artifact = artifacts[index];
 		if (!artifact) continue;
-		const worstAxis = worstGatedAxis(artifact.score);
+		const worstAxis = worstGatedAxis(artifact.score, gatedAxesForSection(dependencies[index].section));
 		if (toHundred(artifact.score[worstAxis.key]) >= options.minScore) continue;
 		diagnostics.push(buildLowScoreDiagnostic(dependencies[index], artifact, worstAxis, options));
 	}
@@ -45342,6 +45797,13 @@ const summarizeDiagnostics = (diagnostics, worstScore = null, worstScoreLabel =
 		scoreLabel: worstScoreLabel
 	};
 };
+/**
+* Whether project discovery resolved a React-compatible runtime (React or
+* Preact, which ships the same hooks + JSX model). This is the same
+* predicate that grants the `react` capability, so `false` means every
+* React-runtime rule family was gated off for the project.
+*/
+const hasReactRuntime = (project) => project.reactVersion !== null || project.preactVersion !== null;
 const toJsonDiff = (diff) => {
 	if (!diff) return null;
 	return {
@@ -45924,7 +46386,7 @@ const makeNoopConsole = () => ({
 });
 //#endregion
 //#region src/cli/utils/version.ts
-const VERSION = "0.7.1";
+const VERSION = "0.7.2-dev.0eb5293";
 //#endregion
 //#region src/cli/utils/json-mode.ts
 let context = null;
@@ -46293,13 +46755,13 @@ const isDevVersion = (version) => version === "0.0.0" || version.includes("-");
 * uploads source-map artifacts under, so stack frames symbolicate. Honors the
 * standard `SENTRY_RELEASE` override.
 */
-const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.7.1`;
+const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.7.2-dev.0eb5293`;
 /**
 * Deployment environment shown in Sentry's environment filter. Defaults to
 * `production` for tagged releases and `development` for dev/unbuilt versions,
 * overridable via the standard `SENTRY_ENVIRONMENT` env var.
 */
-const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.7.1") ? "development" : "production");
+const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.7.2-dev.0eb5293") ? "development" : "production");
 /**
 * Performance-tracing sample rate in `[0, 1]`. Reads `SENTRY_TRACES_SAMPLE_RATE`
 * (set to `0` to disable tracing) and falls back to
@@ -58143,7 +58605,7 @@ const buildRuntimeLayers = (input) => {
 	const linterLayer = input.shouldSkipLint ? Linter.layerOf([]) : Linter.layerOxlint;
 	const deadCodeLayer = input.shouldRunDeadCode ? DeadCode.layerNode : DeadCode.layerOf([]);
 	const scoreLayer = input.shouldComputeScore ? Score.layerHttp : Score.layerOf(null);
-	const supplyChainLayer = input.userConfig?.supplyChain?.enabled === false ? SupplyChain.layerOf([]) : SupplyChain.layerNode;
+	const supplyChainLayer = input.shouldRunSupplyChain ? SupplyChain.layerNode : SupplyChain.layerOf([]);
 	const projectLayer = input.projectInfoOverride === void 0 ? Project.layerNode : Project.layerOf(input.projectInfoOverride);
 	const progressLayer = input.shouldShowProgressSpinners ? Progress.layerOra(buildSpinnerProgressHandle) : Progress.layerNoop;
 	const baseLayers = mergeAll$1(projectLayer, input.hasConfigOverride ? Config.layerOf({
@@ -58499,21 +58961,22 @@ const resolveDotenvFingerprint = (projectDirectory) => {
 		return [];
 	}
 };
-const hasHiddenTrackedFileState = (projectDirectory) => {
+const isGitIdentityTrustworthy = (projectDirectory) => {
 	const output = runGit(projectDirectory, ["ls-files", "-v"]);
-	if (output === null) return true;
-	return output.split("\n").some((line) => line.length > 0 && line[0] !== "H");
+	if (output === null) return false;
+	const entryLines = output.split("\n").filter((line) => line.length > 0);
+	return entryLines.length > 0 && entryLines.every((line) => line[0] === "H");
 };
 const resolveCacheFilePath = (projectDirectory) => path.join(resolveReactDoctorCacheDir(projectDirectory), SCAN_RESULT_CACHE_FILENAME);
 const readPersistedCache = (cacheFilePath) => {
 	try {
 		const parsed = JSON.parse(fs.readFileSync(cacheFilePath, "utf8"));
-		if (!isRecord(parsed) || parsed.version !== 3) return {
-			version: 3,
+		if (!isRecord(parsed) || parsed.version !== 4) return {
+			version: 4,
 			entries: []
 		};
 		if (!Array.isArray(parsed.entries)) return {
-			version: 3,
+			version: 4,
 			entries: []
 		};
 		const entries = [];
@@ -58523,12 +58986,12 @@ const readPersistedCache = (cacheFilePath) => {
 			entries.push(entry);
 		}
 		return {
-			version: 3,
+			version: 4,
 			entries
 		};
 	} catch {
 		return {
-			version: 3,
+			version: 4,
 			entries: []
 		};
 	}
@@ -58560,6 +59023,7 @@ const resolveProjectIdentity = (projectDirectory) => {
 		return path.resolve(projectDirectory);
 	}
 };
+const resolveManifestContentHash = (projectDirectory) => hashFileContents(getPackageJsonPath(projectDirectory));
 const fileFingerprint = (filePath) => {
 	try {
 		const stat = fs.statSync(filePath);
@@ -58582,14 +59046,14 @@ const resolveToolchainFingerprint = (nodeBinaryPath) => {
 };
 const buildScanResultCacheKey = (input) => {
 	if (isCacheGloballyDisabled()) return null;
-	if (hasHiddenTrackedFileState(input.projectDirectory)) return null;
+	if (!isGitIdentityTrustworthy(input.projectDirectory)) return null;
 	const worktreeFingerprint = buildWorktreeFingerprint(input.projectDirectory);
 	if (worktreeFingerprint === null) return null;
 	const headSha = readHeadSha(input.projectDirectory);
 	if (headSha === null) return null;
 	if (stringifyStableJson(input.userConfig) === null) return null;
 	const cacheKeyJson = stringifyStableJson({
-		schemaVersion: 3,
+		schemaVersion: 4,
 		projectIdentity: resolveProjectIdentity(input.projectDirectory),
 		headSha,
 		worktreeFingerprint,
@@ -58604,6 +59068,7 @@ const buildScanResultCacheKey = (input) => {
 		engineOptions: {
 			lint: input.options.lint,
 			deadCode: input.options.deadCode,
+			supplyChain: input.options.supplyChain,
 			includePaths: [...input.options.includePaths].sort(),
 			customRulesOnly: input.options.customRulesOnly,
 			respectInlineDisables: input.options.respectInlineDisables,
@@ -58629,17 +59094,24 @@ const createScanResultCache = (projectDirectory) => {
 	for (const entry of persistedCache.entries) entries.set(entry.key, entry);
 	const persist = () => {
 		writePersistedCache(cacheFilePath, {
-			version: 3,
+			version: 4,
 			entries: [...entries.values()].sort((firstEntry, secondEntry) => secondEntry.createdAtMs - firstEntry.createdAtMs).slice(0, 20)
 		});
 	};
 	return {
-		lookup: (key) => entries.get(key)?.payload ?? null,
+		lookup: (key) => {
+			const payload = entries.get(key)?.payload;
+			if (payload === void 0) return null;
+			return resolveProjectIdentity(payload.directory) === resolveProjectIdentity(projectDirectory) && (payload.manifestContentHash ?? null) === resolveManifestContentHash(projectDirectory) ? payload : null;
+		},
 		store: (key, payload) => {
 			entries.set(key, {
 				key,
 				createdAtMs: Date.now(),
-				payload
+				payload: {
+					...payload,
+					manifestContentHash: resolveManifestContentHash(projectDirectory)
+				}
 			});
 			persist();
 		}
@@ -58806,13 +59278,15 @@ const buildOutcomeAttributes = (input) => {
 		const countBySource = {
 			config: 0,
 			override: 0,
-			inline: 0
+			inline: 0,
+			"foreign-inline": 0
 		};
 		for (const suppression of input.suppressedRuleCounts) countBySource[suppression.source] += suppression.count;
-		suppressionRollup.suppressed = countBySource.config + countBySource.override + countBySource.inline;
+		suppressionRollup.suppressed = countBySource.config + countBySource.override + countBySource.inline + countBySource["foreign-inline"];
 		suppressionRollup.suppressedConfig = countBySource.config;
 		suppressionRollup.suppressedOverride = countBySource.override;
 		suppressionRollup.suppressedInline = countBySource.inline;
+		suppressionRollup.suppressedForeignInline = countBySource["foreign-inline"];
 	}
 	const attributes = {
 		...withNamespace("outcome", {
@@ -58904,6 +59378,7 @@ const buildScanAttributes = (input) => {
 		maxDurationMs: input.maxDurationMs,
 		lint: input.lint,
 		deadCode: input.deadCode,
+		supplyChain: input.supplyChain,
 		scoreOnly: input.scoreOnly,
 		noScore: input.noScore,
 		respectInlineDisables: input.respectInlineDisables,
@@ -60178,6 +60653,7 @@ const buildIgnoredTags = (userConfig) => {
 const mergeInspectOptions = (inputOptions, userConfig) => ({
 	lint: inputOptions.lint ?? userConfig?.lint ?? true,
 	deadCode: inputOptions.deadCode ?? userConfig?.deadCode ?? true,
+	supplyChain: inputOptions.supplyChain ?? userConfig?.supplyChain?.enabled ?? true,
 	verbose: inputOptions.verbose ?? userConfig?.verbose ?? false,
 	outputDirectory: inputOptions.outputDirectory || null,
 	scoreOnly: inputOptions.scoreOnly ?? false,
@@ -60217,6 +60693,7 @@ const buildRunEventConfig = (options, userConfig, hasCustomConfig, resolvedWorke
 		maxDurationMs: options.maxDurationMs,
 		lint: options.lint,
 		deadCode: options.deadCode,
+		supplyChain: options.supplyChain,
 		scoreOnly: options.scoreOnly,
 		noScore: options.noScore,
 		respectInlineDisables: options.respectInlineDisables,
@@ -60300,6 +60777,7 @@ const runBaselineComparison = async (params) => {
 			projectInfoOverride: params.headProjectInfo,
 			shouldSkipLint: !params.options.lint || !params.resolvedNodeBinaryPath,
 			shouldRunDeadCode: false,
+			shouldRunSupplyChain: params.options.supplyChain,
 			shouldComputeScore: false,
 			shouldShowProgressSpinners: false,
 			oxlintConcurrency: params.options.concurrency
@@ -60388,6 +60866,7 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		configSourceDirectory,
 		shouldSkipLint: !options.lint || lintBindingMissing,
 		shouldRunDeadCode: options.deadCode,
+		shouldRunSupplyChain: options.supplyChain,
 		shouldComputeScore: !options.noScore,
 		shouldShowProgressSpinners,
 		oxlintConcurrency: options.concurrency
@@ -62673,8 +63152,8 @@ const resolveParallelFlag = (parallel) => parallel === false ? 1 : void 0;
 * accepts. Flag-derived fields only (`scoreOnly`, `noScore`, `silent`,
 * `isCi`): every `userConfig` fallback — including `noScore` — lives in
 * `inspect()`'s merge layer, which sees each project's module-merged
-* config. The plain boolean knobs (`lint`, `deadCode`, `verbose`) pass
-* through unchanged for the same reason. This resolver reads
+* config. The plain boolean knobs (`lint`, `deadCode`, `supplyChain`,
+* `verbose`) pass through unchanged for the same reason. This resolver reads
 * `userConfig` only to decide the `--blocking warning` gate.
 */
 const resolveCliInspectOptions = (flags, userConfig) => {
@@ -62682,6 +63161,7 @@ const resolveCliInspectOptions = (flags, userConfig) => {
 	return {
 		lint: flags.lint,
 		deadCode: flags.deadCode,
+		supplyChain: flags.supplyChain,
 		verbose: flags.verbose,
 		outputDirectory: flags.outputDir,
 		respectInlineDisables: flags.respectInlineDisables === false ? false : void 0,
@@ -63232,7 +63712,7 @@ const inspectAction = async (directory, flags) => {
 			const scanDirectory = projectScanTarget.resolvedDirectory;
 			const projectConfig = projectDirectory === resolvedDirectory ? userConfig : mergeReactDoctorConfigs(userConfig, projectScanTarget.userConfig ?? void 0);
 			const projectConfigSourceDirectory = projectScanTarget.userConfig?.plugins === void 0 ? scanTarget.configSourceDirectory : projectScanTarget.configSourceDirectory;
-			const supplyChainEnabled = projectConfig?.supplyChain?.enabled !== false;
+			const supplyChainEnabled = flags.supplyChain ?? projectConfig?.supplyChain?.enabled !== false;
 			let includePaths;
 			let supplyChainManifestChanged = false;
 			if (isDiffMode) {
@@ -64152,10 +64632,12 @@ const ROOT_FLAG_SPEC = {
 		"--no-parallel",
 		"--no-respect-inline-disables",
 		"--no-score",
+		"--no-supply-chain",
 		"--no-telemetry",
 		"--no-warnings",
 		"--score",
 		"--staged",
+		"--supply-chain",
 		"--verbose",
 		"--version",
 		"--warnings",
@@ -64404,7 +64886,7 @@ ${highlighter.dim("Learn more:")}
   ${highlighter.info(CI_URL)}
 `;
 const collectCategoryOption = (value, previousValues) => [...previousValues ?? [], value];
-const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("--json-out <path>", "with --json, write the report to a file instead of stdout").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much to scan/report: full (default), files, changed (only new issues vs base), or lines (only changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--max-duration <seconds>", "scan time budget for the whole run, shared across workspace projects: past it, remaining lint batches and dead-code are skipped and partial results are reported (skipped files are listed in the JSON report)").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
+const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--supply-chain", "enable the dependency supply-chain scan (default)").option("--no-supply-chain", "skip the dependency supply-chain scan (Socket.dev dependency health checks)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("--json-out <path>", "with --json, write the report to a file instead of stdout").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much to scan/report: full (default), files, changed (only new issues vs base), or lines (only changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--max-duration <seconds>", "scan time budget for the whole run, shared across workspace projects: past it, remaining lint batches and dead-code are skipped and partial results are reported (skipped files are listed in the JSON report)").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
 program.action(inspectAction);
 program.command("why <location>").description("Explain why a rule fired (or why a suppression didn't apply) at a file:line").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple)").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").action((location, options) => whyAction(location, options));
 program.command("install").alias("setup").description("Install the react-doctor skill into your coding agents and optional git hook").option("-y, --yes", "skip prompts, install for all detected agents").option("--dry-run", "show what would be installed without writing files").option("--agent-hooks", "install native non-blocking agent hooks for Claude Code and Cursor").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderInstallHelpEpilog).action(installAction);
@@ -64454,4 +64936,4 @@ Promise.resolve().then(() => assertNoRemovedFlags(process.argv)).then(() => prog
 export {};
 
 //# sourceMappingURL=cli.js.map
-//# debugId=8cb1a73e-b148-513d-a3eb-69f3a12430a5
+//# debugId=91ba16f6-8b1a-5cd9-a5d2-fc0b6fce2508