react-doctor 0.8.0 → 0.8.1-dev.0b0b5ac

package/dist/cli.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5cb8a881-e8fc-5561-8b89-ad2c8357acbc")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a9af63ed-7b82-56d3-8549-274ab7f23579")}catch(e){}}();
 import { createRequire } from "node:module";
 import * as NodeChildProcess from "node:child_process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
@@ -36242,7 +36242,7 @@ const SOCKET_FREE_USER_AGENT = "react-doctor-supply-chain";
 const FILE_LINT_CACHE_FILENAME = "file-lint-cache.json";
 const FILE_LINT_CACHE_MAX_FILE_COUNT = 5e4;
 const SIDECAR_LINT_CACHE_FILENAME = "sidecar-lint-cache.json";
-const CORE_PACKAGE_VERSION = "0.8.0";
+const CORE_PACKAGE_VERSION = "0.8.1";
 const DEAD_CODE_CACHE_FILENAME = "dead-code-cache.json";
 const DEAD_CODE_SUMMARY_CACHE_FILENAME = "dead-code-summaries.json";
 const SUPPLY_CHAIN_PLUGIN = "socket";
@@ -36571,10 +36571,10 @@ const FALLBACK_TSCONFIG_FILENAMES = ["tsconfig.app.json", "tsconfig.build.json"]
 const FRAMEWORK_PACKAGES = {
 	next: "nextjs",
 	"@tanstack/react-start": "tanstack-start",
-	vite: "vite",
-	"react-scripts": "cra",
 	"@remix-run/react": "remix",
 	gatsby: "gatsby",
+	vite: "vite",
+	"react-scripts": "cra",
 	expo: "expo",
 	"react-native": "react-native"
 };
@@ -36598,11 +36598,17 @@ const NEXT_CONFIG_FILENAMES = [
 ];
 const BABEL_CONFIG_FILENAMES = [
 	".babelrc",
+	".babelrc.js",
 	".babelrc.json",
+	".babelrc.cjs",
+	".babelrc.mjs",
+	".babelrc.cts",
 	"babel.config.js",
 	"babel.config.json",
 	"babel.config.cjs",
-	"babel.config.mjs"
+	"babel.config.mjs",
+	"babel.config.ts",
+	"babel.config.cts"
 ];
 const VITE_CONFIG_FILENAMES = [
 	"vite.config.js",
@@ -36614,12 +36620,28 @@ const VITE_CONFIG_FILENAMES = [
 	"vitest.config.ts",
 	"vitest.config.js"
 ];
+const RSBUILD_CONFIG_FILENAMES = [
+	"rsbuild.config.ts",
+	"rsbuild.config.js",
+	"rsbuild.config.mts",
+	"rsbuild.config.mjs",
+	"rsbuild.config.cts",
+	"rsbuild.config.cjs"
+];
+const RSPACK_CONFIG_FILENAMES = [
+	"rspack.config.ts",
+	"rspack.config.js",
+	"rspack.config.mts",
+	"rspack.config.mjs",
+	"rspack.config.cts",
+	"rspack.config.cjs"
+];
 const EXPO_APP_CONFIG_FILENAMES = [
 	"app.json",
 	"app.config.js",
 	"app.config.ts"
 ];
-const REACT_COMPILER_PACKAGE_REFERENCE_PATTERN = /babel-plugin-react-compiler|react-compiler-runtime|["']react-compiler["']/;
+const REACT_COMPILER_PACKAGE_REFERENCE_PATTERN = /babel-plugin-react-compiler|react-compiler-runtime|reactCompilerPreset\s*\(|["']react-compiler["']/;
 const REACT_COMPILER_ENABLED_FLAG_PATTERN = /["']?reactCompiler["']?\s*:\s*(?:true\b|\{)/;
 const STATIC_EXPORT_OUTPUT_PATTERN = /(?:^|[^.\w])["']?output["']?\s*:\s*["']export["']/m;
 const hasCompilerPackage = (packageJson, compilerPackages) => {
@@ -36654,6 +36676,8 @@ const detectReactCompiler = (directory, packageJson) => {
 	if (hasCompilerInConfigFiles(directory, NEXT_CONFIG_FILENAMES)) return true;
 	if (hasCompilerInConfigFiles(directory, BABEL_CONFIG_FILENAMES)) return true;
 	if (hasCompilerInConfigFiles(directory, VITE_CONFIG_FILENAMES)) return true;
+	if (hasCompilerInConfigFiles(directory, RSBUILD_CONFIG_FILENAMES)) return true;
+	if (hasCompilerInConfigFiles(directory, RSPACK_CONFIG_FILENAMES)) return true;
 	if (hasCompilerInConfigFiles(directory, EXPO_APP_CONFIG_FILENAMES)) return true;
 	return hasCompilerPackageInAncestors(directory, REACT_COMPILER_TRANSFORM_PACKAGES);
 };
@@ -37101,19 +37125,6 @@ const getPreactVersion = (packageJson) => {
 		...packageJson.devDependencies
 	}.preact ?? null;
 };
-const TANSTACK_QUERY_PACKAGES = new Set([
-	"@tanstack/react-query",
-	"@tanstack/query-core",
-	"react-query"
-]);
-const hasTanStackQuery = (packageJson) => {
-	const allDependencies = {
-		...packageJson.peerDependencies,
-		...packageJson.dependencies,
-		...packageJson.devDependencies
-	};
-	return Object.keys(allDependencies).some((packageName) => TANSTACK_QUERY_PACKAGES.has(packageName));
-};
 const resolveCatalogBackedDependencyVersion = ({ rootDirectory, rootPackageJson, packageName, version }) => {
 	if (version === null || !isCatalogReference(version)) return version;
 	const catalogName = extractCatalogName(version);
@@ -37316,7 +37327,60 @@ const listWorkspacePackages = (rootDirectory) => {
 	}
 	return packages;
 };
+const getPreferredDependencyVersion = ({ packageJson, packageNames }) => {
+	const allDependencies = {
+		...packageJson.devDependencies,
+		...packageJson.peerDependencies,
+		...packageJson.dependencies
+	};
+	for (const packageName of packageNames) {
+		const version = allDependencies[packageName];
+		if (version !== void 0) return version;
+	}
+	return null;
+};
+const TANSTACK_REACT_QUERY_PACKAGES = ["@tanstack/react-query", "react-query"];
+const getTanStackQueryVersion = (packageJson) => {
+	return getPreferredDependencyVersion({
+		packageJson,
+		packageNames: TANSTACK_REACT_QUERY_PACKAGES
+	});
+};
+const STYLED_COMPONENTS_PACKAGES = ["styled-components"];
+const getStyledComponentsVersion = (packageJson) => {
+	return getPreferredDependencyVersion({
+		packageJson,
+		packageNames: STYLED_COMPONENTS_PACKAGES
+	});
+};
+const I18N_PACKAGES = [
+	"i18next",
+	"react-i18next",
+	"next-i18next",
+	"react-intl",
+	"next-intl",
+	"use-intl",
+	"@formatjs/intl",
+	"@lingui/core",
+	"@lingui/react",
+	"typesafe-i18n",
+	"@tolgee/react",
+	"react-intl-universal"
+];
+const hasI18nDependency = (packageJson) => {
+	const allDependencies = {
+		...packageJson.peerDependencies,
+		...packageJson.dependencies,
+		...packageJson.devDependencies,
+		...packageJson.optionalDependencies
+	};
+	return I18N_PACKAGES.some((packageName) => allDependencies[packageName] !== void 0);
+};
 const REANIMATED_DEPENDENCY_NAME = "react-native-reanimated";
+const MOBX_REACT_PACKAGE_NAME = "mobx-react";
+const MOBX_REACT_LITE_PACKAGE_NAME = "mobx-react-lite";
+const MOBX_STATE_TREE_PACKAGE_NAME = "mobx-state-tree";
+const MOBX_REACT_OBSERVER_PACKAGE_NAME = "mobx-react-observer";
 const SHOPIFY_FLASH_LIST_PACKAGE_NAME = "@shopify/flash-list";
 const resolveWorkspaceDependencyVersion = ({ concreteVersion, packageName, rootDirectory, rootPackageJson, sections, workspaceDirectory, workspacePackageJson }) => {
 	const dependencyDeclaration = getDependencyDeclaration({
@@ -37335,7 +37399,26 @@ const shouldReplaceReactVersion = (currentVersion, nextVersion) => {
 	if (nextMajor === null) return false;
 	return nextMajor < currentMajor;
 };
-const evaluateManifestFacts = (facts, packageJson, directory) => {
+const shouldReplaceSupportedDependencyFact = (currentFact, nextFact, latestSupportedMajor) => {
+	if (currentFact.version === null) return true;
+	if (nextFact.version === null) return false;
+	const currentMajor = getLowestDependencyMajor(currentFact.version);
+	const nextMajor = getLowestDependencyMajor(nextFact.version);
+	if (currentMajor === null) return false;
+	if (nextMajor === null) return true;
+	if (currentMajor > latestSupportedMajor) return false;
+	if (nextMajor > latestSupportedMajor) return true;
+	return nextMajor < currentMajor;
+};
+const shouldReplaceStyledComponentsVersion = (currentVersion, nextVersion) => {
+	if (!currentVersion) return true;
+	const currentMajor = getLowestDependencyMajor(currentVersion);
+	const nextMajor = getLowestDependencyMajor(nextVersion);
+	if (currentMajor === null) return nextMajor !== null && nextMajor < 6;
+	if (nextMajor === null) return currentMajor >= 6;
+	return nextMajor < currentMajor;
+};
+const evaluateManifestFacts = (facts, packageJson, directory, rootDirectory, rootPackageJson) => {
 	if (facts.expo.version === null) {
 		const spec = getDependencySpec(packageJson, "expo");
 		if (spec !== null) facts.expo = {
@@ -37357,13 +37440,74 @@ const evaluateManifestFacts = (facts, packageJson, directory) => {
 			sourceDirectory: directory
 		};
 	}
+	const mobxSpec = getDependencySpec(packageJson, "mobx");
+	if (mobxSpec !== null) {
+		const nextMobxFact = {
+			version: resolveCatalogBackedDependencyVersion({
+				rootDirectory: directory,
+				rootPackageJson: packageJson,
+				packageName: "mobx",
+				version: mobxSpec
+			}),
+			sourceDirectory: directory
+		};
+		if (shouldReplaceSupportedDependencyFact(facts.mobx, nextMobxFact, 6)) facts.mobx = nextMobxFact;
+	}
+	facts.hasMobxReact = facts.hasMobxReact || getDependencySpec(packageJson, MOBX_REACT_PACKAGE_NAME) !== null;
+	facts.hasMobxReactLite = facts.hasMobxReactLite || getDependencySpec(packageJson, MOBX_REACT_LITE_PACKAGE_NAME) !== null;
+	facts.hasMobxStateTree = facts.hasMobxStateTree || getDependencySpec(packageJson, MOBX_STATE_TREE_PACKAGE_NAME) !== null;
+	facts.hasMobxReactObserver = facts.hasMobxReactObserver || getDependencySpec(packageJson, MOBX_REACT_OBSERVER_PACKAGE_NAME) !== null;
+	const zustandSpec = getDependencySpec(packageJson, "zustand");
+	if (zustandSpec !== null) {
+		const nextZustandFact = {
+			version: resolveCatalogBackedDependencyVersion({
+				rootDirectory: directory,
+				rootPackageJson: packageJson,
+				packageName: "zustand",
+				version: zustandSpec
+			}),
+			sourceDirectory: directory
+		};
+		if (shouldReplaceSupportedDependencyFact(facts.zustand, nextZustandFact, 5)) facts.zustand = nextZustandFact;
+	}
 	if (facts.reanimatedVersion === null) {
 		const spec = getDependencySpec(packageJson, REANIMATED_DEPENDENCY_NAME);
 		if (spec !== null) facts.reanimatedVersion = spec;
 	}
+	if (facts.valtioVersion === null) {
+		const spec = getDependencySpec(packageJson, "valtio");
+		if (spec !== null) facts.valtioVersion = spec;
+	}
+	facts.tanstackQueryVersion ??= getTanStackQueryVersion(packageJson);
+	const styledComponentsVersion = resolveCatalogBackedDependencyVersion({
+		rootDirectory: directory,
+		rootPackageJson: packageJson,
+		packageName: "styled-components",
+		version: getStyledComponentsVersion(packageJson)
+	});
+	if (styledComponentsVersion && shouldReplaceStyledComponentsVersion(facts.styledComponentsVersion, styledComponentsVersion)) facts.styledComponentsVersion = styledComponentsVersion;
+	facts.hasI18nLibrary = facts.hasI18nLibrary || hasI18nDependency(packageJson);
 	facts.hasReactNativeAwarePackage = facts.hasReactNativeAwarePackage || isPackageJsonReactNativeAware(packageJson);
 	facts.hasReanimatedAwarePackage = facts.hasReanimatedAwarePackage || isPackageJsonReanimatedAware(packageJson);
 	facts.hasSsrDependency = facts.hasSsrDependency || isPackageJsonSsrAware(packageJson);
+	const remotionSpec = getDependencySpec(packageJson, "remotion");
+	if (remotionSpec !== null) {
+		facts.hasRemotionDependency = true;
+		const resolvedRemotionVersion = resolveCatalogBackedDependencyVersion({
+			rootDirectory,
+			rootPackageJson,
+			packageName: "remotion",
+			version: remotionSpec
+		});
+		const remotionMajorVersion = resolvedRemotionVersion === null ? null : getLowestDependencyMajor(resolvedRemotionVersion);
+		if (remotionMajorVersion === null) {
+			facts.hasUnknownRemotionVersion = true;
+			facts.remotionVersion = null;
+		} else if (!facts.hasUnknownRemotionVersion) {
+			const currentRemotionMajorVersion = facts.remotionVersion === null ? null : getLowestDependencyMajor(facts.remotionVersion);
+			if (currentRemotionMajorVersion === null || remotionMajorVersion < currentRemotionMajorVersion) facts.remotionVersion = resolvedRemotionVersion;
+		}
+	}
 };
 const collectWorkspaceFacts = (rootDirectory, rootPackageJson, { collectReactGroup }) => {
 	const facts = {
@@ -37383,12 +37527,31 @@ const collectWorkspaceFacts = (rootDirectory, rootPackageJson, { collectReactGro
 			version: null,
 			sourceDirectory: null
 		},
+		valtioVersion: null,
+		mobx: {
+			version: null,
+			sourceDirectory: null
+		},
+		hasMobxReact: false,
+		hasMobxReactLite: false,
+		hasMobxStateTree: false,
+		hasMobxReactObserver: false,
+		zustand: {
+			version: null,
+			sourceDirectory: null
+		},
+		tanstackQueryVersion: null,
+		styledComponentsVersion: null,
+		hasI18nLibrary: false,
 		hasReactNativeAwarePackage: false,
 		hasReanimatedAwarePackage: false,
 		hasSsrDependency: false,
+		hasRemotionDependency: false,
+		hasUnknownRemotionVersion: false,
+		remotionVersion: null,
 		reanimatedVersion: null
 	};
-	evaluateManifestFacts(facts, rootPackageJson, rootDirectory);
+	evaluateManifestFacts(facts, rootPackageJson, rootDirectory, rootDirectory, rootPackageJson);
 	let isReactGroupSettled = !collectReactGroup;
 	const visitedDirectories = /* @__PURE__ */ new Set();
 	for (const pattern of getWorkspacePatterns(rootDirectory, rootPackageJson)) {
@@ -37397,7 +37560,7 @@ const collectWorkspaceFacts = (rootDirectory, rootPackageJson, { collectReactGro
 			if (visitedDirectories.has(workspaceDirectory)) continue;
 			visitedDirectories.add(workspaceDirectory);
 			const workspacePackageJson = readPackageJson$1(Path.join(workspaceDirectory, "package.json"));
-			evaluateManifestFacts(facts, workspacePackageJson, workspaceDirectory);
+			evaluateManifestFacts(facts, workspacePackageJson, workspaceDirectory, rootDirectory, rootPackageJson);
 			const info = extractDependencyInfo(workspacePackageJson);
 			if (info.framework !== "unknown" && frameworkMergeRank(info.framework) < frameworkMergeRank(facts.framework)) facts.framework = info.framework;
 			if (isReactGroupSettled) continue;
@@ -37618,11 +37781,27 @@ const discoverProjectWithoutPackageJson = (directory) => {
 		tailwindVersion: null,
 		zodVersion: null,
 		zodMajorVersion: null,
+		mobxVersion: null,
+		mobxMajorVersion: null,
+		hasMobxReact: false,
+		hasMobxReactLite: false,
+		hasMobxStateTree: false,
+		hasMobxReactObserver: false,
+		zustandVersion: null,
+		zustandMajorVersion: null,
 		framework: "unknown",
 		hasTypeScript: hasOwnTsConfig,
 		hasReactCompiler: false,
 		hasReactCompilerLintPlugin: false,
 		hasTanStackQuery: false,
+		valtioVersion: null,
+		valtioMajorVersion: null,
+		hasRemotion: false,
+		remotionVersion: null,
+		remotionMajorVersion: null,
+		hasI18nLibrary: false,
+		tanstackQueryVersion: null,
+		styledComponentsVersion: null,
 		hasSsrDependency: false,
 		preactVersion: null,
 		preactMajorVersion: null,
@@ -37721,6 +37900,12 @@ const discoverProject = (directory) => {
 		packageName: SHOPIFY_FLASH_LIST_PACKAGE_NAME,
 		version: workspaceFacts.shopifyFlashList.version
 	}) : null;
+	const zustandVersion = resolveCatalogBackedDependencyVersion({
+		rootDirectory: directory,
+		rootPackageJson: packageJson,
+		packageName: "zustand",
+		version: workspaceFacts.zustand.version
+	});
 	const hasReanimated = hasReactNativeWorkspace && workspaceFacts.hasReanimatedAwarePackage;
 	const reanimatedVersion = hasReanimated ? workspaceFacts.reanimatedVersion : null;
 	const nextjsVersion = framework === "nextjs" ? resolveCatalogBackedDependencyVersion({
@@ -37729,7 +37914,21 @@ const discoverProject = (directory) => {
 		packageName: "next",
 		version: workspaceFacts.next.version
 	}) : null;
+	const valtioVersion = resolveCatalogBackedDependencyVersion({
+		rootDirectory: directory,
+		rootPackageJson: packageJson,
+		packageName: "valtio",
+		version: workspaceFacts.valtioVersion
+	});
+	const mobxVersion = resolveCatalogBackedDependencyVersion({
+		rootDirectory: directory,
+		rootPackageJson: packageJson,
+		packageName: "mobx",
+		version: workspaceFacts.mobx.version
+	});
 	const preactVersion = getPreactVersion(packageJson);
+	const remotionVersion = workspaceFacts.remotionVersion;
+	const tanstackQueryVersion = getTanStackQueryVersion(packageJson) ?? workspaceFacts.tanstackQueryVersion;
 	const isPreES2023Target = hasTypeScript && detectPreES2023Target(directory);
 	const projectInfo = {
 		rootDirectory: directory,
@@ -37739,11 +37938,27 @@ const discoverProject = (directory) => {
 		tailwindVersion,
 		zodVersion,
 		zodMajorVersion: zodVersion === null ? null : getLowestDependencyMajor(zodVersion),
+		mobxVersion,
+		mobxMajorVersion: mobxVersion === null ? null : getLowestDependencyMajor(mobxVersion),
+		hasMobxReact: workspaceFacts.hasMobxReact,
+		hasMobxReactLite: workspaceFacts.hasMobxReactLite,
+		hasMobxStateTree: workspaceFacts.hasMobxStateTree,
+		hasMobxReactObserver: workspaceFacts.hasMobxReactObserver,
+		zustandVersion,
+		zustandMajorVersion: zustandVersion === null ? null : getLowestDependencyMajor(zustandVersion),
 		framework,
 		hasTypeScript,
 		hasReactCompiler: detectReactCompiler(directory, packageJson),
 		hasReactCompilerLintPlugin: detectReactCompilerLintPlugin(directory, packageJson),
-		hasTanStackQuery: hasTanStackQuery(packageJson),
+		hasTanStackQuery: tanstackQueryVersion !== null,
+		hasI18nLibrary: workspaceFacts.hasI18nLibrary,
+		tanstackQueryVersion,
+		styledComponentsVersion: workspaceFacts.styledComponentsVersion,
+		valtioVersion,
+		valtioMajorVersion: valtioVersion === null ? null : getLowestDependencyMajor(valtioVersion),
+		hasRemotion: workspaceFacts.hasRemotionDependency,
+		remotionVersion,
+		remotionMajorVersion: remotionVersion === null ? null : getLowestDependencyMajor(remotionVersion),
 		hasSsrDependency: workspaceFacts.hasSsrDependency,
 		preactVersion,
 		preactMajorVersion: parseReactMajor(preactVersion),
@@ -37977,7 +38192,6 @@ const LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY = {
 	"react/jsx-no-new-function-as-prop": "react-doctor/jsx-no-new-function-as-prop",
 	"react/jsx-no-new-object-as-prop": "react-doctor/jsx-no-new-object-as-prop",
 	"react/jsx-no-script-url": "react-doctor/jsx-no-script-url",
-	"react/jsx-no-target-blank": "react-doctor/jsx-no-target-blank",
 	"react/jsx-no-undef": "react-doctor/jsx-no-undef",
 	"react/jsx-no-useless-fragment": "react-doctor/jsx-no-useless-fragment",
 	"react/jsx-pascal-case": "react-doctor/jsx-pascal-case",
@@ -38359,6 +38573,9 @@ const SCRIPT_EXTENSION_FRAGMENT = "[cm]?[jt]sx?";
 const STORY_FILE_SUFFIX_PATTERN = new RegExp(`\\.(?:stories|story)\\.(?:${SCRIPT_EXTENSION_FRAGMENT})$`);
 const TEST_FILE_SUFFIX_PATTERN = new RegExp(`\\.(?:test|spec|fixture|fixtures)\\.(?:${SCRIPT_EXTENSION_FRAGMENT})$`);
 const TEST_FILE_DIRECTORY_PATTERN = /(?:^|\/)(?:__tests__|__test__|tests|test|__mocks__|cypress|e2e|playwright)\//;
+const AMBIGUOUS_TEST_ROUTE_DIRECTORY_PATTERN = /(?:^|\/)(?:tests|test)\//;
+const NEXT_APP_ROUTE_FILE_SUFFIX_PATTERN = /\/(?:default|error|forbidden|global-error|layout|loading|not-found|page|route|template|unauthorized)\.[cm]?[jt]sx?$/;
+const SCRIPT_FILE_SUFFIX_PATTERN = /\.[cm]?[jt]sx?$/;
 const FIXTURE_PROJECT_PATTERN = /\/(?:fixtures|__fixtures__)\//;
 const SOURCE_ROOT_PATTERN = /\/(?:src|app|lib|components|pages|features|modules|packages|apps|frontend|client)\//g;
 const stripAboveSourceRoot = (relativePath) => {
@@ -38369,6 +38586,14 @@ const stripAboveSourceRoot = (relativePath) => {
 	if (lastIdx >= 0) return relativePath.slice(lastIdx);
 	return relativePath.slice(fixtureMatch.index + fixtureMatch[0].length - 1);
 };
+const isFrameworkRouteBeforeAmbiguousTestDirectory = (relativePath) => {
+	const testDirectoryMatch = AMBIGUOUS_TEST_ROUTE_DIRECTORY_PATTERN.exec(relativePath);
+	if (testDirectoryMatch === null) return false;
+	let nearestRouteRoot;
+	for (const pathSegment of relativePath.slice(0, testDirectoryMatch.index).split("/")) if (pathSegment === "app" || pathSegment === "pages") nearestRouteRoot = pathSegment;
+	if (nearestRouteRoot === void 0) return false;
+	return nearestRouteRoot === "pages" ? SCRIPT_FILE_SUFFIX_PATTERN.test(relativePath) : NEXT_APP_ROUTE_FILE_SUFFIX_PATTERN.test(relativePath);
+};
 /**
 * Classifies where a file sits relative to shipped code. A finding in a
 * `.stories.tsx` or `.spec.ts` file never runs in front of users, so
@@ -38385,6 +38610,7 @@ const classifyFileContext = (relativePath) => {
 	if (STORY_FILE_SUFFIX_PATTERN.test(forwardSlashed)) return "story";
 	if (TEST_FILE_SUFFIX_PATTERN.test(forwardSlashed)) return "test";
 	const scoped = stripAboveSourceRoot(forwardSlashed);
+	if (isFrameworkRouteBeforeAmbiguousTestDirectory(scoped)) return "production";
 	return TEST_FILE_DIRECTORY_PATTERN.test(scoped) ? "test" : "production";
 };
 /**
@@ -39244,6 +39470,7 @@ const VALID_RULE_SEVERITIES = [
 	"warn",
 	"off"
 ];
+const VALID_INCLUDED_FILE_CONTEXTS = ["test", "story"];
 const KNOWN_CATEGORY_LABEL = DIAGNOSTIC_CATEGORY_BUCKETS.join(", ");
 const isDiagnosticCategoryBucket = (value) => DIAGNOSTIC_CATEGORY_BUCKETS.includes(value);
 const filterKnownCategories = (fieldName, categories) => categories.filter((category) => {
@@ -39278,6 +39505,7 @@ const SURFACE_CONTROL_FIELD_NAMES = [
 	"includeRules",
 	"excludeRules"
 ];
+const isIncludedFileContext = (value) => VALID_INCLUDED_FILE_CONTEXTS.some((fileContext) => fileContext === value);
 const SEVERITY_FIELD_NAMES = ["rules", "categories"];
 const isPlainObject$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const formatType = (value) => typeof value === "string" ? `"${value}"` : typeof value;
@@ -39312,6 +39540,15 @@ const validateSurfaceControls = (surface, rawControls) => {
 		return;
 	}
 	const validatedSurfaceControls = {};
+	if (rawControls.includeFileContexts !== void 0) {
+		const qualifiedName = `surfaces.${surface}.includeFileContexts`;
+		const result = validateStringArrayField(qualifiedName, rawControls.includeFileContexts);
+		if (result !== void 0) validatedSurfaceControls.includeFileContexts = result.filter((fileContext) => {
+			if (isIncludedFileContext(fileContext)) return true;
+			warnConfigIssue(`config field "${qualifiedName}" lists "${fileContext}", which is not a non-production file context (expected one of: ${VALID_INCLUDED_FILE_CONTEXTS.join(", ")}); ignoring the entry.`);
+			return false;
+		});
+	}
 	for (const fieldName of SURFACE_CONTROL_FIELD_NAMES) {
 		if (rawControls[fieldName] === void 0) continue;
 		const qualifiedName = `surfaces.${surface}.${fieldName}`;
@@ -40276,9 +40513,25 @@ const BABEL_CONFIG_FILE_NAMES = [
 	".babelrc.json"
 ];
 const LEGACY_PRESET_SPEC = "module:metro-react-native-babel-preset";
+const LEGACY_PRESET_PACKAGE = "metro-react-native-babel-preset";
+const REACT_NATIVE_PACKAGE = "react-native";
+const PRESET_RENAME_MINIMUM_REACT_NATIVE_VERSION = "0.73.0";
+const LEGACY_PRESET_REFERENCE = new RegExp(`['"]${LEGACY_PRESET_SPEC}['"]`);
 const MODERN_PRESET_REFERENCE = new RegExp(`['"]module:@react-native/babel-preset['"]`);
 const ENABLE_BABEL_RUNTIME_VERSION = /enableBabelRuntime["']?\s*:\s*['"]/;
+const isReactNativeVersionAtLeastPresetRename = (rootDirectory, packageJson) => {
+	const installedReactNativeManifestPath = Path.join(rootDirectory, "node_modules", REACT_NATIVE_PACKAGE, "package.json");
+	const reactNativeVersionSpec = (isFile(installedReactNativeManifestPath) ? readPackageJson$1(installedReactNativeManifestPath).version : void 0) ?? getDependencySpec(packageJson, REACT_NATIVE_PACKAGE);
+	if (reactNativeVersionSpec === null || reactNativeVersionSpec === void 0) return false;
+	const normalizedVersionRange = import_semver.validRange(reactNativeVersionSpec);
+	if (normalizedVersionRange === null) return false;
+	const minimumVersion = import_semver.minVersion(normalizedVersionRange);
+	return minimumVersion !== null && import_semver.gte(minimumVersion, PRESET_RENAME_MINIMUM_REACT_NATIVE_VERSION);
+};
+const canResolveLegacyPreset = (rootDirectory, packageJson) => getDependencySpec(packageJson, LEGACY_PRESET_PACKAGE) !== null || isFile(Path.join(rootDirectory, "node_modules", LEGACY_PRESET_PACKAGE, "package.json"));
 const checkReactNativeMetroBabelPreset = (rootDirectory) => {
+	const packageJson = readPackageJson$1(Path.join(rootDirectory, "package.json"));
+	const shouldReportLegacyPreset = isReactNativeVersionAtLeastPresetRename(rootDirectory, packageJson) && !canResolveLegacyPreset(rootDirectory, packageJson);
 	for (const fileName of BABEL_CONFIG_FILE_NAMES) {
 		const filePath = Path.join(rootDirectory, fileName);
 		if (!isFile(filePath)) continue;
@@ -40288,7 +40541,7 @@ const checkReactNativeMetroBabelPreset = (rootDirectory) => {
 		} catch {
 			continue;
 		}
-		if (contents.includes(LEGACY_PRESET_SPEC)) return [buildReactNativeDiagnostic({
+		if (shouldReportLegacyPreset && LEGACY_PRESET_REFERENCE.test(contents)) return [buildReactNativeDiagnostic({
 			filePath: fileName,
 			rule: "rn-no-metro-babel-preset",
 			severity: "error",
@@ -40311,12 +40564,6 @@ const checkReactNativeProject = (rootDirectory, project) => {
 	return [...checkReactNativeMetroBabelPreset(rootDirectory), ...checkReactNativeLibraryDependencies(rootDirectory)];
 };
 const RULE_KEY = "no-vulnerable-react-server-components";
-const DEPENDENCY_SECTIONS = [
-	"dependencies",
-	"devDependencies",
-	"peerDependencies",
-	"optionalDependencies"
-];
 const REACT_RSC_ADVISORIES_BY_MINOR = {
 	"19.0": {
 		rceFixedVersion: "19.0.1",
@@ -40363,20 +40610,13 @@ const enumerateWorkspaceDirectories = (workspaceRoot) => {
 	for (const pattern of patterns) for (const directory of resolveWorkspaceDirectories(workspaceRoot, pattern)) directories.add(directory);
 	return [...directories];
 };
-const readDeclaredSpec = (packageJson, packageName) => {
-	for (const section of DEPENDENCY_SECTIONS) {
-		const spec = packageJson[section]?.[packageName];
-		if (typeof spec === "string") return spec;
-	}
-	return null;
-};
 const resolveVersionInDirectory = (directory, packageName, declaredSpecOverride) => {
 	const manifestPath = Path.join(directory, "node_modules", packageName, "package.json");
 	if (isFile(manifestPath)) {
 		const installedVersion = import_semver.valid(readPackageJson$1(manifestPath).version ?? null);
 		if (installedVersion !== null) return installedVersion;
 	}
-	const candidateSpecs = [readDeclaredSpec(readPackageJson$1(Path.join(directory, "package.json")), packageName), declaredSpecOverride];
+	const candidateSpecs = [getDependencySpec(readPackageJson$1(Path.join(directory, "package.json")), packageName), declaredSpecOverride];
 	for (const spec of candidateSpecs) {
 		const pinnedVersion = spec === null ? null : import_semver.valid(spec);
 		if (pinnedVersion !== null) return pinnedVersion;
@@ -41044,21 +41284,50 @@ const buildCapabilities = (project) => {
 	if (CLIENT_ONLY_FRAMEWORKS.has(project.framework)) capabilities.add("client-only");
 	if (project.isStaticExport) capabilities.add("nextjs:static-export");
 	if (project.nextjsMajorVersion !== null && project.nextjsMajorVersion >= 15) capabilities.add("nextjs:15");
+	if (project.nextjsMajorVersion !== null && project.nextjsMajorVersion >= 16) capabilities.add("nextjs:16");
 	addMajorLadder(capabilities, "react", project.reactMajorVersion, 17, 30);
 	if (project.reactMajorVersion !== null && project.reactMajorVersion >= 19 && isMajorMinorAtLeast(parseReactMajorMinor(project.reactVersion), {
 		major: 19,
 		minor: 2
 	})) capabilities.add("react:19.2");
-	if (project.tailwindVersion !== null) capabilities.add("tailwind");
-	if (project.tailwindVersion !== null && isMajorMinorAtLeast(parseTailwindMajorMinor(project.tailwindVersion), {
-		major: 3,
-		minor: 4
-	})) capabilities.add("tailwind:3.4");
+	if (project.tailwindVersion !== null) {
+		capabilities.add("tailwind");
+		const tailwindVersion = parseTailwindMajorMinor(project.tailwindVersion);
+		if (isMajorMinorAtLeast(tailwindVersion, {
+			major: 3,
+			minor: 4
+		})) capabilities.add("tailwind:3.4");
+		if (tailwindVersion !== null && isMajorMinorAtLeast(tailwindVersion, {
+			major: 4,
+			minor: 0
+		})) capabilities.add("tailwind:4");
+	}
 	if (project.zodVersion !== null) capabilities.add("zod");
 	if (project.zodMajorVersion !== null && project.zodMajorVersion >= 4) capabilities.add("zod:4");
+	if (project.mobxVersion !== void 0 && project.mobxVersion !== null || project.hasMobxReact === true || project.hasMobxReactLite === true || project.hasMobxStateTree === true || project.hasMobxReactObserver === true) capabilities.add("mobx");
+	if (project.hasMobxReact === true) capabilities.add("mobx-react");
+	if (project.hasMobxReactLite === true) capabilities.add("mobx-react-lite");
+	if (project.hasMobxReact === true || project.hasMobxReactLite === true) capabilities.add("mobx-react-binding");
+	if (project.hasMobxStateTree === true) capabilities.add("mobx-state-tree");
+	if (project.hasMobxReactObserver === true) capabilities.add("mobx-react-observer");
+	if (project.mobxMajorVersion !== void 0 && project.mobxMajorVersion !== null && project.mobxMajorVersion >= 4 && project.mobxMajorVersion <= 6) addMajorLadder(capabilities, "mobx", project.mobxMajorVersion, 4, 6);
+	if (project.zustandVersion !== void 0 && project.zustandVersion !== null) capabilities.add("zustand");
+	if (project.zustandMajorVersion !== void 0 && project.zustandMajorVersion !== null && project.zustandMajorVersion >= 1 && project.zustandMajorVersion <= 5) addMajorLadder(capabilities, "zustand", project.zustandMajorVersion, 1, 5);
 	if (project.isPreES2023Target) capabilities.add("pre-es2023");
 	if (project.hasReactCompiler) capabilities.add("react-compiler");
-	if (project.hasTanStackQuery) capabilities.add("tanstack-query");
+	if (Boolean(project.hasTanStackQuery) || Boolean(project.tanstackQueryVersion)) capabilities.add("tanstack-query");
+	if (project.styledComponentsVersion) {
+		capabilities.add("styled-components");
+		const styledComponentsMajor = getLowestDependencyMajor(project.styledComponentsVersion);
+		if (styledComponentsMajor !== null && styledComponentsMajor >= 6) capabilities.add("styled-components:6");
+	}
+	if (project.hasI18nLibrary) capabilities.add("i18n");
+	if (project.valtioVersion !== null) capabilities.add("valtio");
+	addMajorLadder(capabilities, "valtio", project.valtioMajorVersion, 1, 10);
+	if (project.hasRemotion) {
+		capabilities.add("remotion");
+		addMajorLadder(capabilities, "remotion", project.remotionMajorVersion ?? null, 4, 30);
+	}
 	if (project.hasTypeScript) capabilities.add("typescript");
 	if (project.preactVersion !== null) capabilities.add("preact");
 	addMajorLadder(capabilities, "preact", project.preactMajorVersion, 10, 20);
@@ -41073,7 +41342,7 @@ const getCapabilities = (project) => {
 	capabilitiesByProject.set(project, capabilities);
 	return capabilities;
 };
-const shouldEnableRule = (requires, tags, capabilities, ignoredTags, disabledWhen) => {
+const shouldEnableRule = (requires, tags, capabilities, ignoredTags, disabledWhen, includedTags) => {
 	if (requires) {
 		for (const capability of requires) if (!capabilities.has(capability)) return false;
 	}
@@ -41084,20 +41353,29 @@ const shouldEnableRule = (requires, tags, capabilities, ignoredTags, disabledWhe
 	if (tags) {
 		for (const tag of tags) if (ignoredTags.has(tag)) return false;
 	}
+	if (includedTags && includedTags.size > 0) {
+		if (!tags?.some((tag) => includedTags.has(tag))) return false;
+	}
 	return true;
 };
+const shouldEnableRuleByDefaultStatus = (options) => options.defaultEnabled !== false || options.hasExplicitOverride === true || options.includeTagDefaults && options.hasIncludedTags;
 const yieldToEventLoop = () => new Promise((resolve) => {
 	setImmediate(resolve);
 });
 const createSecurityScanSession = (rootDirectory, options) => {
 	const capabilities = options.project ? getCapabilities(options.project) : /* @__PURE__ */ new Set();
 	const ignoredTags = options.ignoredTags ?? /* @__PURE__ */ new Set();
+	const includedTags = options.includedTags ?? /* @__PURE__ */ new Set();
 	const enabledScanRules = REACT_DOCTOR_RULES.flatMap((entry) => {
 		const rule = entry.rule;
 		const scan = rule.scan;
 		if (typeof scan !== "function") return [];
-		if (rule.defaultEnabled === false) return [];
-		if (!shouldEnableRule(rule.requires, rule.tags, capabilities, ignoredTags, rule.disabledWhen)) return [];
+		if (!shouldEnableRuleByDefaultStatus({
+			defaultEnabled: rule.defaultEnabled,
+			includeTagDefaults: options.includeTagDefaults === true,
+			hasIncludedTags: includedTags.size > 0
+		})) return [];
+		if (!shouldEnableRule(rule.requires, rule.tags, capabilities, ignoredTags, rule.disabledWhen, includedTags)) return [];
 		return [{
 			entry,
 			scan,
@@ -42047,6 +42325,7 @@ const buildResolvedControls = (surface, userControls) => {
 	for (const tag of includeTags) excludeTags.delete(tag);
 	for (const tag of toStringSet(userControls?.excludeTags)) excludeTags.add(tag);
 	return {
+		includeFileContexts: toStringSet(userControls?.includeFileContexts),
 		includeTags,
 		excludeTags,
 		includeCategories: toStringSet(userControls?.includeCategories),
@@ -42062,7 +42341,7 @@ const isDiagnosticOnSurface = (diagnostic, surface, config) => {
 	if (resolved.includeRuleKeys.has(ruleKey)) return true;
 	if (resolved.includeCategories.has(category)) return true;
 	if (intersects(tags, resolved.includeTags)) return true;
-	if (diagnostic.fileContext !== void 0 && (surface === "score" || surface === "ciFailure")) return false;
+	if (diagnostic.fileContext !== void 0 && (surface === "score" || surface === "ciFailure") && !resolved.includeFileContexts.has(diagnostic.fileContext)) return false;
 	if (resolved.excludeRuleKeys.has(ruleKey)) return false;
 	if (resolved.excludeCategories.has(category)) return false;
 	if (intersects(tags, resolved.excludeTags)) return false;
@@ -42310,6 +42589,35 @@ const parseGithubViewerPermission = (stdout) => {
 	return /^[A-Z_]+$/.test(value) ? value.toLowerCase() : null;
 };
 const splitNullSeparated = (value) => value.split("\0").filter((entry) => entry.length > 0);
+const parseBaselineDiffPlan = (value) => {
+	const entries = splitNullSeparated(value);
+	const baseFiles = /* @__PURE__ */ new Set();
+	const headFiles = /* @__PURE__ */ new Set();
+	for (let entryIndex = 0; entryIndex < entries.length; entryIndex += 2) {
+		const status = entries[entryIndex];
+		const filePath = entries[entryIndex + 1];
+		if (status === void 0 || filePath === void 0 || status.length !== 1) return null;
+		if (status === "A") {
+			headFiles.add(filePath);
+			continue;
+		}
+		if (status === "D") {
+			baseFiles.add(filePath);
+			continue;
+		}
+		if (status === "M" || status === "T") {
+			baseFiles.add(filePath);
+			headFiles.add(filePath);
+			continue;
+		}
+		return null;
+	}
+	return {
+		baseFiles: [...baseFiles],
+		headFiles: [...headFiles],
+		untrackedFiles: []
+	};
+};
 const UNTRACKED_FILE_LAST_LINE = Number.MAX_SAFE_INTEGER;
 /**
 * `Git` wraps every `git`-via-subprocess call react-doctor makes
@@ -42512,6 +42820,45 @@ var Git = class Git extends Service()("react-doctor/Git") {
 			githubViewerPermission,
 			branchExists,
 			mergeBase,
+			baselineDiffPlan: (input) => {
+				if (!isSafeGitRevision(input.ref)) return succeed$2(null);
+				return gen(function* () {
+					const unmerged = yield* runGit(input.directory, [
+						"diff",
+						"--no-ext-diff",
+						"-z",
+						"--name-only",
+						"--diff-filter=U",
+						"--relative"
+					]);
+					if (unmerged.status !== 0 || unmerged.stdout.length > 0) return null;
+					const result = yield* runGit(input.directory, [
+						"diff",
+						"--no-ext-diff",
+						"--no-textconv",
+						"--no-renames",
+						"-z",
+						"--name-status",
+						"--relative",
+						input.ref
+					]);
+					if (result.status !== 0) return null;
+					const plan = parseBaselineDiffPlan(result.stdout);
+					if (plan === null) return null;
+					const untracked = yield* runGit(input.directory, [
+						"ls-files",
+						"--others",
+						"--exclude-standard",
+						"-z"
+					]);
+					if (untracked.status !== 0) return null;
+					return {
+						baseFiles: plan.baseFiles,
+						headFiles: plan.headFiles,
+						untrackedFiles: splitNullSeparated(untracked.stdout)
+					};
+				}).pipe(catch_$1(() => succeed$2(null)), withSpan("Git.baselineDiffPlan"));
+			},
 			diffSelection: ({ directory, explicitBaseBranch, includeUntracked = false }) => gen(function* () {
 				if (explicitBaseBranch !== void 0 && explicitBaseBranch.trim().length === 0) return yield* fail$4(new ReactDoctorError({ reason: new GitBaseBranchInvalid({ detail: "Diff base branch cannot be empty." }) }));
 				if (explicitBaseBranch !== void 0) {
@@ -42661,6 +43008,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 		githubViewerPermission: () => succeed$2(snapshot.githubViewerPermission ?? null),
 		branchExists: (_directory, branch) => succeed$2(snapshot.branchExists?.get(branch) ?? false),
 		mergeBase: ({ ref }) => succeed$2(snapshot.mergeBase?.get(ref) ?? null),
+		baselineDiffPlan: () => succeed$2(snapshot.baselineDiffPlan ?? null),
 		diffSelection: () => succeed$2(snapshot.diffSelection ?? null),
 		stagedFilePaths: () => succeed$2(snapshot.stagedFiles ?? []),
 		showStagedContent: (_directory, relativePath) => succeed$2(snapshot.stagedContent?.get(relativePath) ?? null),
@@ -43029,8 +43377,9 @@ const buildUserPluginRules = (userPlugin, severityControls) => {
 	}
 	return enabled;
 };
-const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, extendsPaths = [], ignoredTags = /* @__PURE__ */ new Set(), serverAuthFunctionNames, severityControls, userPlugins = [], disableReactHooksJsPlugin = false, ruleSelection, sidecarRuleIdFilter }) => {
-	const reactHooksJsPlugin = disableReactHooksJsPlugin || ruleSelection === "sidecar" ? null : resolveReactHooksJsPlugin(project.hasReactCompiler || project.hasReactCompilerLintPlugin === true, customRulesOnly);
+const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, extendsPaths = [], ignoredTags = /* @__PURE__ */ new Set(), includedTags = /* @__PURE__ */ new Set(), includeTagDefaults = false, serverAuthFunctionNames, severityControls, userPlugins = [], disableReactHooksJsPlugin = false, ruleSelection, sidecarRuleIdFilter }) => {
+	const hasIncludedTags = includedTags.size > 0;
+	const reactHooksJsPlugin = disableReactHooksJsPlugin || ruleSelection === "sidecar" || hasIncludedTags ? null : resolveReactHooksJsPlugin(project.hasReactCompiler || project.hasReactCompilerLintPlugin === true, customRulesOnly);
 	const reactCompilerRules = reactHooksJsPlugin ? applyRuleSeverityControls(filterRulesToAvailable(REACT_COMPILER_RULES, "react-hooks-js", reactHooksJsPlugin.availableRuleNames), severityControls) : {};
 	const jsPlugins = [];
 	if (reactHooksJsPlugin) jsPlugins.push(reactHooksJsPlugin.entry);
@@ -43045,9 +43394,14 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 		if (rule.scan !== void 0) continue;
 		if (customRulesOnly && registryEntry.originallyExternal) continue;
 		if (rule.framework !== "global" && !rule.requires) continue;
-		if (!shouldEnableRule(rule.requires, rule.tags, capabilities, ignoredTags, rule.disabledWhen)) continue;
+		if (!shouldEnableRule(rule.requires, rule.tags, capabilities, ignoredTags, rule.disabledWhen, includedTags)) continue;
 		const explicitRuleOverride = resolveRuleSeverityOverride({ ruleKey: registryEntry.key }, severityControls);
-		if (rule.defaultEnabled === false && explicitRuleOverride === void 0) continue;
+		if (!shouldEnableRuleByDefaultStatus({
+			defaultEnabled: rule.defaultEnabled,
+			includeTagDefaults,
+			hasIncludedTags,
+			hasExplicitOverride: explicitRuleOverride !== void 0
+		})) continue;
 		const severity = resolveRuleSeverityOverride({
 			ruleKey: registryEntry.key,
 			category: rule.category
@@ -43056,7 +43410,7 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 		enabledReactDoctorRules[registryEntry.key] = severity;
 	}
 	const userPluginRules = {};
-	if (ruleSelection !== "sidecar") for (const userPlugin of userPlugins) {
+	if (ruleSelection !== "sidecar" && !hasIncludedTags) for (const userPlugin of userPlugins) {
 		Object.assign(userPluginRules, buildUserPluginRules(userPlugin, severityControls));
 		jsPlugins.push(userPlugin.entry);
 	}
@@ -43273,6 +43627,19 @@ const createSidecarLintCache = (cacheDirectory, rulesetHash) => {
 		}
 	};
 };
+const fingerprintCacheByFilePath = /* @__PURE__ */ new Map();
+const fingerprintFileContents = (filePath, fingerprintLength) => {
+	const fileStats = NFS.statSync(filePath, { bigint: true });
+	const cachedFingerprint = fingerprintCacheByFilePath.get(filePath);
+	if (cachedFingerprint?.modifiedTimeNanoseconds === fileStats.mtimeNs && cachedFingerprint.sizeBytes === fileStats.size) return cachedFingerprint.fingerprint;
+	const fingerprint = crypto.createHash("sha256").update(NFS.readFileSync(filePath)).digest("hex").slice(0, fingerprintLength);
+	fingerprintCacheByFilePath.set(filePath, {
+		fingerprint,
+		modifiedTimeNanoseconds: fileStats.mtimeNs,
+		sizeBytes: fileStats.size
+	});
+	return fingerprint;
+};
 const bundledRequire$3 = createRequire(import.meta.url);
 const childNodeVersionByBinaryPath = /* @__PURE__ */ new Map();
 const resolveChildNodeVersion = (nodeBinaryPath) => {
@@ -43296,6 +43663,13 @@ const TOOLCHAIN_PACKAGE_SPECIFIERS$1 = [
 	"oxlint-plugin-react-doctor/package.json",
 	"eslint-plugin-react-hooks/package.json"
 ];
+const resolvePluginFingerprint = () => {
+	try {
+		return fingerprintFileContents(bundledRequire$3.resolve("oxlint-plugin-react-doctor"), 16);
+	} catch {
+		return "unresolved";
+	}
+};
 const resolveOxlintToolchainVersions = (nodeBinaryPath = process.execPath) => {
 	const versions = [`node=${resolveChildNodeVersion(nodeBinaryPath)}`];
 	for (const specifier of TOOLCHAIN_PACKAGE_SPECIFIERS$1) try {
@@ -43305,6 +43679,7 @@ const resolveOxlintToolchainVersions = (nodeBinaryPath = process.execPath) => {
 	} catch {
 		versions.push(`${specifier}=missing`);
 	}
+	versions.push(`oxlint-plugin-react-doctor#fingerprint=${resolvePluginFingerprint()}`);
 	return versions;
 };
 const esmRequire = createRequire(import.meta.url);
@@ -43998,12 +44373,17 @@ const REACT_ERROR_BOUNDARY_MESSAGE = "This try/catch cannot catch errors thrown
 const REACT_COMPILER_IMPACT = "This component misses React Compiler's automatic memoization & re-renders more than it should";
 const REACT_COMPILER_ACTION = "Rewrite the flagged code so the compiler can optimize it.";
 const REACT_COMPILER_INCOMPATIBLE_LIBRARY_ACTION = "It's how the library works, not a bug in your code. Memoize values you pass from it into other memoized components, or suppress it with `// react-doctor-disable-next-line react-hooks-js/incompatible-library`.";
+const SET_STATE_IN_EFFECT_ACTION = "Prefer deriving or initializing the value before render. If the effect must read a browser API after mount, treat this as advisory or suppress it with `// react-doctor-disable-next-line react-hooks-js/set-state-in-effect`.";
 const REACT_COMPILER_GENERIC_MESSAGE = `${REACT_COMPILER_IMPACT}. ${REACT_COMPILER_ACTION}`;
 const buildReactCompilerMessage = (reasonSummary, action = REACT_COMPILER_ACTION) => {
 	const normalizedSummary = reasonSummary.replace(TRAILING_PERIOD_PATTERN, "");
 	if (!normalizedSummary) return `${REACT_COMPILER_IMPACT}. ${action}`;
 	return `${REACT_COMPILER_IMPACT}: ${normalizedSummary}. ${action}`;
 };
+const buildSetStateInEffectMessage = (reasonSummary) => {
+	const normalizedSummary = reasonSummary.replace(TRAILING_PERIOD_PATTERN, "");
+	return `This synchronous effect update causes an extra render${normalizedSummary ? `: ${normalizedSummary}` : ""}. ${SET_STATE_IN_EFFECT_ACTION}`;
+};
 const PLUGIN_CATEGORY_MAP = {
 	react: "Bugs",
 	"react-hooks": "Bugs",
@@ -44061,6 +44441,10 @@ const resolveCleanedDiagnostic = (message, help, plugin, rule, project) => {
 			message: REACT_ERROR_BOUNDARY_MESSAGE,
 			help: reasonDetail || help
 		};
+		if (rule === "set-state-in-effect") return {
+			message: buildSetStateInEffectMessage(reasonSummary.trim()),
+			help: reasonDetail || help
+		};
 		return {
 			message: buildReactCompilerMessage(reasonSummary.trim(), rule === "incompatible-library" ? REACT_COMPILER_INCOMPATIBLE_LIBRARY_ACTION : REACT_COMPILER_ACTION),
 			help: appendReanimatedSharedValueHint(reasonDetail || help, rule, project)
@@ -44771,7 +45155,7 @@ const reactHooksJsPluginDropNote = (error) => {
 *   6. always restore disable directives + clean up the temp dir
 */
 const runOxlint = async (options) => {
-	const { rootDirectory, project, includePaths, nodeBinaryPath = process.execPath, customRulesOnly = false, respectInlineDisables = true, adoptExistingLintConfig = true, ignoredTags = /* @__PURE__ */ new Set(), userConfig, configSourceDirectory = rootDirectory, onPartialFailure, onFileCoverage, perFileLintCacheEnabled = false, sidecarLintCacheEnabled = false, onCacheStats, onSidecarStats, spawnTimeoutMs, outputMaxBytes, lintBatchOrdering = "cost" } = options;
+	const { rootDirectory, project, includePaths, nodeBinaryPath = process.execPath, customRulesOnly = false, respectInlineDisables = true, adoptExistingLintConfig = true, ignoredTags = /* @__PURE__ */ new Set(), includedTags = /* @__PURE__ */ new Set(), includeTagDefaults = false, userConfig, configSourceDirectory = rootDirectory, onPartialFailure, onFileCoverage, perFileLintCacheEnabled = false, sidecarLintCacheEnabled = false, onCacheStats, onSidecarStats, spawnTimeoutMs, outputMaxBytes, lintBatchOrdering = "cost" } = options;
 	const serverAuthFunctionNames = Array.isArray(userConfig?.serverAuthFunctionNames) ? userConfig.serverAuthFunctionNames.filter((entry) => typeof entry === "string" && entry.length > 0) : void 0;
 	const severityControls = buildRuleSeverityControls(userConfig);
 	validateRuleRegistration();
@@ -44785,13 +45169,15 @@ const runOxlint = async (options) => {
 	}
 	const pluginPath = resolvePluginPath();
 	const extendsPaths = (adoptExistingLintConfig && !customRulesOnly ? detectUserLintConfigPaths(rootDirectory) : []).filter(canOxlintExtendConfig);
-	const userPlugins = resolveUserPlugins(userConfig?.plugins, configSourceDirectory);
+	const userPlugins = includedTags.size > 0 ? [] : resolveUserPlugins(userConfig?.plugins, configSourceDirectory);
 	const buildConfig = (overrides) => createOxlintConfig({
 		pluginPath,
 		project,
 		customRulesOnly,
 		extendsPaths: overrides.extendsPaths,
 		ignoredTags,
+		includedTags,
+		includeTagDefaults,
 		serverAuthFunctionNames,
 		severityControls,
 		userPlugins,
@@ -45180,6 +45566,8 @@ var Linter = class Linter extends Service()("react-doctor/Linter") {
 				respectInlineDisables: input.respectInlineDisables,
 				adoptExistingLintConfig: input.adoptExistingLintConfig,
 				ignoredTags: input.ignoredTags,
+				includedTags: input.includedTags,
+				includeTagDefaults: input.includeTagDefaults,
 				userConfig: input.userConfig ?? null,
 				configSourceDirectory: input.configSourceDirectory,
 				onPartialFailure: (reason) => {
@@ -46028,7 +46416,9 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	const securityScanFailedRef = yield* make$13(false);
 	const securityScanFiber = yield* forkChild(runCollect(applyPerElementPipeline(isDiffMode ? empty$4 : unwrap(tryPromise(() => checkSecurityScanCooperative(scanDirectory, {
 		project,
-		ignoredTags: input.ignoredTags
+		ignoredTags: input.ignoredTags,
+		includedTags: input.includedTags,
+		includeTagDefaults: input.includeTagDefaults
 	})).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)), catch_$1(() => set(securityScanFailedRef, true).pipe(as(empty$4))))))).pipe(withSpan("SecurityScan.run")));
 	const shouldRunSupplyChain = !isDiffMode || (input.supplyChainManifestChanged ?? false);
 	const supplyChainOverlapTimeout = yield* SupplyChainOverlapTimeoutMs;
@@ -46119,6 +46509,8 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		respectInlineDisables: input.respectInlineDisables,
 		adoptExistingLintConfig: input.adoptExistingLintConfig,
 		ignoredTags: input.ignoredTags,
+		includedTags: input.includedTags,
+		includeTagDefaults: input.includeTagDefaults,
 		userConfig: resolvedConfig.config ?? void 0,
 		configSourceDirectory: resolvedConfig.configSourceDirectory ?? void 0,
 		onFileProgress: (scannedFileCount, totalFileCount) => {
@@ -46397,12 +46789,19 @@ const isPathInsideDirectory = (childAbsolutePath, parentAbsolutePath) => {
 */
 const materializeSourceTree = (input) => gen(function* () {
 	const materializedFiles = [];
+	const unmaterializedFiles = [];
 	const resolvedTempDirectory = path.resolve(input.tempDirectory);
 	for (const relativePath of input.files) {
 		const content = yield* input.readContent(relativePath).pipe(orElseSucceed(() => null));
-		if (content === null) continue;
+		if (content === null) {
+			unmaterializedFiles.push(relativePath);
+			continue;
+		}
 		const candidateTargetPath = path.resolve(resolvedTempDirectory, relativePath);
-		if (!isPathInsideDirectory(candidateTargetPath, resolvedTempDirectory)) continue;
+		if (!isPathInsideDirectory(candidateTargetPath, resolvedTempDirectory)) {
+			unmaterializedFiles.push(relativePath);
+			continue;
+		}
 		yield* sync(() => {
 			fs.mkdirSync(path.dirname(candidateTargetPath), { recursive: true });
 			fs.writeFileSync(candidateTargetPath, content);
@@ -46419,6 +46818,7 @@ const materializeSourceTree = (input) => gen(function* () {
 	return {
 		tempDirectory: input.tempDirectory,
 		materializedFiles,
+		unmaterializedFiles,
 		cleanup: () => {
 			try {
 				fs.rmSync(input.tempDirectory, {
@@ -46688,54 +47088,80 @@ const buildSkippedChecks = (input) => {
 		skippedCheckReasons
 	};
 };
-const fingerprintDiagnostic = (diagnostic, lineText) => {
+const fingerprintText = (text) => createHash("sha256").update(text).digest("hex");
+const normalizeEvidence = (evidence) => evidence.replace(/\s+/g, " ").trim();
+const getDiagnosticMatchKeys = (diagnostic, evidence) => {
 	const ruleKey = `${diagnostic.plugin}/${diagnostic.rule}`;
-	const snippet = lineText === null || diagnostic.matchByOccurrence ? "" : createHash("sha1").update(lineText.trim()).digest("hex");
-	return `${diagnostic.filePath}\u0000${ruleKey}\u0000${snippet}`;
-};
-/**
-* Diffs a head scan against a base scan to isolate the diagnostics a change
-* introduced (and count the ones it resolved). Matching is a multiset over a
-* position-independent fingerprint — `(filePath, plugin/rule, hash(flagged
-* line text))` — so inserting lines above an existing issue doesn't make it
-* look new, while a genuinely new occurrence (new line text, or one more of
-* the same) surfaces. Identical repeated findings are matched by count.
-*
-* Diagnostics carrying `matchByOccurrence` (resolved at diagnostic creation:
-* every Accessibility-category finding, plus rules opting in via their
-* `matchByOccurrence` metadata flag) drop the line-text snippet and match by
-* `(filePath, plugin/rule)` occurrence count alone. Their identity is the
-* flagged element, not the line's text, so editing the line (reindentation,
-* prettier reflow, collapsing a multi-line JSX element) doesn't reclassify a
-* pre-existing finding as new — while one MORE occurrence of the same rule in
-* the file still surfaces. Expression-level rules keep the line-text snippet:
-* there the flagged expression IS the finding, so changed text means new +
-* fixed.
-*
-* v1 limitation: the fingerprint keys on the head-relative `filePath`, and base
-* content is read at that same path. A file renamed by the change therefore has
-* no base match, so its pre-existing findings are reported as new. This
-* over-reports (never hides a real issue) and is rare; rename-aware base
-* resolution is a follow-up.
+	const messageFingerprint = fingerprintText(`${diagnostic.title ?? ""}\0${diagnostic.message}`);
+	const normalizedEvidence = evidence === null ? "" : normalizeEvidence(evidence);
+	const stableEvidenceKey = normalizedEvidence.length > 0 ? `evidence\0${ruleKey}\0${messageFingerprint}\0${fingerprintText(normalizedEvidence)}` : null;
+	return {
+		stableEvidenceKey,
+		sameFileStableEvidenceKey: stableEvidenceKey === null ? null : `${diagnostic.filePath}\0${stableEvidenceKey}`,
+		sameFileFallbackKey: diagnostic.matchByOccurrence || normalizedEvidence.length === 0 ? `fallback\0${diagnostic.filePath}\0${ruleKey}\0${messageFingerprint}` : null
+	};
+};
+const addDiagnosticIndex = (buckets, key, diagnosticIndex) => {
+	if (key === null) return;
+	const diagnosticIndexes = buckets.get(key) ?? [];
+	diagnosticIndexes.push(diagnosticIndex);
+	buckets.set(key, diagnosticIndexes);
+};
+const takeMatchingDiagnosticIndex = (buckets, key, matchedDiagnosticIndexes) => {
+	if (key === null) return null;
+	for (const diagnosticIndex of buckets.get(key) ?? []) if (!matchedDiagnosticIndexes.has(diagnosticIndex)) return diagnosticIndex;
+	return null;
+};
+const readDiagnosticEvidence = (diagnostic, readEvidence, readLine) => readEvidence?.(diagnostic) ?? readLine(diagnostic.filePath, diagnostic.line);
+const buildMatchCandidates = (diagnostics, readEvidence, readLine) => diagnostics.map((diagnostic, diagnosticIndex) => ({
+	diagnosticIndex,
+	...getDiagnosticMatchKeys(diagnostic, readDiagnosticEvidence(diagnostic, readEvidence, readLine))
+}));
+/**
+* Diffs a head scan against a base scan using a multiset of construct-level
+* evidence. Stable identities combine plugin/rule, the diagnostic message,
+* and normalized diagnosed source, so unchanged findings can move across
+* files while changed constructs or messages remain new. Cardinality is
+* retained for identical findings. Diagnostics explicitly marked
+* `matchByOccurrence` may fall back to same-file plugin/rule/message matching
+* after same-file strict evidence matching. Cross-file evidence matching runs
+* last so a copy cannot consume a reformatted local occurrence. Unreadable
+* evidence uses the same conservative fallback rather than matching across
+* files without proof.
 */
 const computeDiagnosticDelta = (input) => {
-	const unmatchedBaseByFingerprint = /* @__PURE__ */ new Map();
-	for (const diagnostic of input.baseDiagnostics) {
-		const key = fingerprintDiagnostic(diagnostic, input.readBaseLine(diagnostic.filePath, diagnostic.line));
-		unmatchedBaseByFingerprint.set(key, (unmatchedBaseByFingerprint.get(key) ?? 0) + 1);
-	}
-	const newDiagnostics = [];
-	for (const diagnostic of input.headDiagnostics) {
-		const key = fingerprintDiagnostic(diagnostic, input.readHeadLine(diagnostic.filePath, diagnostic.line));
-		const availableMatches = unmatchedBaseByFingerprint.get(key) ?? 0;
-		if (availableMatches > 0) unmatchedBaseByFingerprint.set(key, availableMatches - 1);
-		else newDiagnostics.push(diagnostic);
-	}
-	let fixedCount = 0;
-	for (const remaining of unmatchedBaseByFingerprint.values()) fixedCount += remaining;
+	const baseCandidates = buildMatchCandidates(input.baseDiagnostics, input.readBaseEvidence, input.readBaseLine);
+	const headCandidates = buildMatchCandidates(input.headDiagnostics, input.readHeadEvidence, input.readHeadLine);
+	const baseByStableEvidence = /* @__PURE__ */ new Map();
+	const baseBySameFileStableEvidence = /* @__PURE__ */ new Map();
+	const baseBySameFileFallback = /* @__PURE__ */ new Map();
+	for (const candidate of baseCandidates) {
+		addDiagnosticIndex(baseByStableEvidence, candidate.stableEvidenceKey, candidate.diagnosticIndex);
+		addDiagnosticIndex(baseBySameFileStableEvidence, candidate.sameFileStableEvidenceKey, candidate.diagnosticIndex);
+		addDiagnosticIndex(baseBySameFileFallback, candidate.sameFileFallbackKey, candidate.diagnosticIndex);
+	}
+	const matchedHeadDiagnosticIndexes = /* @__PURE__ */ new Set();
+	const matchedBaseDiagnosticIndexes = /* @__PURE__ */ new Set();
+	const matchCandidates = (baseBuckets, getKey, onMatch) => {
+		for (const candidate of headCandidates) {
+			if (matchedHeadDiagnosticIndexes.has(candidate.diagnosticIndex)) continue;
+			const baseDiagnosticIndex = takeMatchingDiagnosticIndex(baseBuckets, getKey(candidate), matchedBaseDiagnosticIndexes);
+			if (baseDiagnosticIndex === null) continue;
+			matchedHeadDiagnosticIndexes.add(candidate.diagnosticIndex);
+			matchedBaseDiagnosticIndexes.add(baseDiagnosticIndex);
+			onMatch?.(candidate.diagnosticIndex, baseDiagnosticIndex);
+		}
+	};
+	matchCandidates(baseBySameFileStableEvidence, (candidate) => candidate.sameFileStableEvidenceKey);
+	matchCandidates(baseBySameFileFallback, (candidate) => candidate.sameFileFallbackKey);
+	let crossFileMatchCount = 0;
+	matchCandidates(baseByStableEvidence, (candidate) => candidate.stableEvidenceKey, (head, base) => {
+		if (input.headDiagnostics[head]?.filePath !== input.baseDiagnostics[base]?.filePath) crossFileMatchCount += 1;
+	});
 	return {
-		newDiagnostics,
-		fixedCount
+		newDiagnostics: input.headDiagnostics.filter((_diagnostic, diagnosticIndex) => !matchedHeadDiagnosticIndexes.has(diagnosticIndex)),
+		fixedCount: input.baseDiagnostics.length - matchedBaseDiagnosticIndexes.size,
+		crossFileMatchCount
 	};
 };
 /**
@@ -46767,6 +47193,12 @@ const getDiffInfo = (directory, explicitBaseBranch, includeUntracked) => runProm
 	};
 }).pipe(provide(Git.layerNode)));
 const filterSourceFiles = (filePaths) => filePaths.filter(isLintableSourceFile);
+const getBaselineDiffPlan = (directory, ref) => runPromise(gen(function* () {
+	return yield* (yield* Git).baselineDiffPlan({
+		directory,
+		ref
+	});
+}).pipe(provide(Git.layerNode)));
 /**
 * Programmatic façade over `Git.changedLineRanges` (the `lines` scope). Diffs
 * `files` with `--unified=0` against `baseRef` (or the index when `cached`),
@@ -47223,7 +47655,7 @@ const makeNoopConsole = () => ({
 });
 //#endregion
 //#region src/cli/utils/version.ts
-const VERSION = "0.8.0";
+const VERSION = "0.8.1-dev.0b0b5ac";
 //#endregion
 //#region src/cli/utils/json-mode.ts
 let context = null;
@@ -47310,7 +47742,11 @@ const getRunId = () => {
 };
 //#endregion
 //#region src/cli/utils/build-run-context.ts
-const ROOT_SUBCOMMANDS = new Set(["install", "setup"]);
+const ROOT_SUBCOMMANDS = new Set([
+	"design",
+	"install",
+	"setup"
+]);
 const detectInvokedVia = () => {
 	const userAgent = process.env.npm_config_user_agent;
 	if (!userAgent) return "unknown";
@@ -47394,7 +47830,9 @@ const buildSentryProjectContext = (projectInfo) => ({
 		reactMajorVersion: projectInfo.reactMajorVersion,
 		hasTypeScript: projectInfo.hasTypeScript,
 		hasReactCompiler: projectInfo.hasReactCompiler,
-		hasTanStackQuery: projectInfo.hasTanStackQuery,
+		tanstackQueryVersion: projectInfo.tanstackQueryVersion,
+		mobxVersion: projectInfo.mobxVersion,
+		styledComponentsVersion: projectInfo.styledComponentsVersion,
 		tailwindVersion: projectInfo.tailwindVersion,
 		zodVersion: projectInfo.zodVersion,
 		preactVersion: projectInfo.preactVersion,
@@ -47575,13 +48013,13 @@ const isDevVersion = (version) => version === "0.0.0" || version.includes("-");
 * uploads source-map artifacts under, so stack frames symbolicate. Honors the
 * standard `SENTRY_RELEASE` override.
 */
-const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.8.0`;
+const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.8.1-dev.0b0b5ac`;
 /**
 * Deployment environment shown in Sentry's environment filter. Defaults to
 * `production` for tagged releases and `development` for dev/unbuilt versions,
 * overridable via the standard `SENTRY_ENVIRONMENT` env var.
 */
-const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.8.0") ? "development" : "production");
+const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.8.1-dev.0b0b5ac") ? "development" : "production");
 /**
 * Performance-tracing sample rate in `[0, 1]`. Reads `SENTRY_TRACES_SAMPLE_RATE`
 * (set to `0` to disable tracing) and falls back to
@@ -59907,6 +60345,8 @@ const buildScanResultCacheKey = (input) => {
 			warnings: input.options.warnings,
 			adoptExistingLintConfig: input.options.adoptExistingLintConfig,
 			ignoredTags: [...input.options.ignoredTags].sort(),
+			includedTags: [...input.options.includedTags].sort(),
+			includeTagDefaults: input.options.includeTagDefaults,
 			concurrency: input.options.concurrency,
 			lintBatchOrdering: resolveLintBatchOrdering(),
 			baselineRef: input.options.baseline?.ref,
@@ -60204,6 +60644,7 @@ const buildOutcomeAttributes = (input) => {
 		new: summary.totalDiagnosticCount,
 		fixed: result.baselineDelta.fixedCount,
 		baseTotal: result.baselineDelta.baseTotalCount,
+		crossFileMatches: result.baselineDelta.crossFileMatchCount ?? null,
 		degraded: false
 	}));
 	else if (input.gateExempt) attributes["baseline.degraded"] = true;
@@ -60317,28 +60758,49 @@ const diagnosticIntersectsLineRanges = (diagnostic, lineRanges) => {
 	return lineRanges.some(([rangeStartLine, rangeEndLine]) => diagnostic.line <= rangeEndLine && diagnosticEndLine >= rangeStartLine);
 };
 //#endregion
+//#region src/cli/utils/is-materializable-git-source.ts
+const GIT_LFS_POINTER_HEADER = "version https://git-lfs.github.com/spec/v1";
+const isMaterializableGitSource = (content) => !content.includes("\0") && !content.startsWith(GIT_LFS_POINTER_HEADER);
+//#endregion
 //#region src/cli/utils/materialize-baseline-files.ts
 /**
-* Materializes the `ref` version of `files` into `tempDirectory` (via
-* `git show <ref>:<path>`), mirroring the project layout + head's config files
-* so the base lints under the same rules as head. Reuses the shared,
-* zip-slip-guarded `materializeSourceTree`. Per-file read misses (e.g. a file
-* the PR added, absent at base) are skipped, which is exactly what we want:
-* a brand-new file has no base counterpart, so all its findings are "new".
+* Materializes the base side of the `ref` → worktree diff into
+* `tempDirectory`, mirroring the project layout plus head's config files so
+* both sides lint under the same rules. Git rename heuristics are disabled by
+* the diff planner, so an old path is retained as a base deletion while its
+* new path is a head addition. Missing head-only additions are expected;
+* missing paths that the plan says must exist at base make `isComplete` false.
 */
 const materializeBaselineFiles = (input) => runPromise(gen(function* () {
 	const git = yield* Git;
-	return yield* materializeSourceTree({
+	const diffPlan = yield* git.baselineDiffPlan({
+		directory: input.directory,
+		ref: input.ref
+	});
+	const baseFiles = input.baseFiles ?? diffPlan?.baseFiles;
+	const headFiles = input.headFiles ?? diffPlan?.headFiles;
+	const untrackedFiles = diffPlan?.untrackedFiles ?? [];
+	if (baseFiles === void 0 || headFiles === void 0) return null;
+	const files = [...new Set([...input.files, ...baseFiles])];
+	const tree = yield* materializeSourceTree({
 		directory: input.directory,
-		files: input.files,
+		files,
 		tempDirectory: input.tempDirectory,
 		readContent: (relativePath) => git.showRefContent({
 			directory: input.directory,
 			ref: input.ref,
 			relativePath,
 			options: { maxBufferBytes: GIT_SHOW_MAX_BUFFER_BYTES }
-		})
+		}).pipe(map$3((content) => content !== null && isMaterializableGitSource(content) ? content : null))
 	});
+	const materializedFiles = new Set(tree.materializedFiles);
+	return {
+		...tree,
+		baseFiles,
+		headFiles,
+		isComplete: baseFiles.every((filePath) => materializedFiles.has(filePath)),
+		untrackedFiles
+	};
 }).pipe(provide(Git.layerNode)));
 /**
 * Resolves the commit a baseline scan should read base content from — the
@@ -60361,8 +60823,8 @@ const resolveMergeBaseRef = async (directory, ref) => {
 //#region src/cli/utils/read-source-line.ts
 /**
 * Builds a cached `(filePath, line) -> source text` reader rooted at
-* `rootDirectory`, used to fingerprint a diagnostic by the content of its
-* flagged line (see `computeDiagnosticDelta`). Wraps core's
+* `rootDirectory`, used as the fallback when construct-level diagnostic
+* evidence cannot be read. Wraps core's
 * `createNodeReadFileLinesSync` with per-file memoization + 1-indexed line
 * lookup; unreadable files / out-of-range lines return `null`.
 */
@@ -60377,10 +60839,342 @@ const createSourceLineReader = (rootDirectory) => {
 	};
 };
 //#endregion
+//#region src/cli/utils/read-diagnostic-evidence.ts
+const SOURCE_EXTENSIONS = [
+	".ts",
+	".tsx",
+	".js",
+	".jsx",
+	".mts",
+	".cts",
+	".mjs",
+	".cjs"
+];
+const COMPONENT_WRAPPER_NAMES = new Set(["memo", "forwardRef"]);
+const getScriptKind = (filePath) => {
+	const extension = path.extname(filePath).toLowerCase();
+	if (extension === ".tsx") return ts.ScriptKind.TSX;
+	if (extension === ".jsx") return ts.ScriptKind.JSX;
+	if (extension === ".js" || extension === ".mjs" || extension === ".cjs") return ts.ScriptKind.JS;
+	return ts.ScriptKind.TS;
+};
+const resolveSafeSourcePath = (rootDirectory, filePath) => {
+	try {
+		const resolvedRootDirectory = fs.realpathSync(rootDirectory);
+		const absolutePath = path.resolve(resolvedRootDirectory, filePath);
+		const relativePath = path.relative(resolvedRootDirectory, absolutePath);
+		if (relativePath.length === 0 || relativePath === ".." || relativePath.startsWith(`..${path.sep}`) || path.isAbsolute(relativePath)) return null;
+		const stats = fs.lstatSync(absolutePath);
+		if (!stats.isFile() || stats.isSymbolicLink()) return null;
+		const realPath = fs.realpathSync(absolutePath);
+		const realRelativePath = path.relative(resolvedRootDirectory, realPath);
+		return realRelativePath !== ".." && !realRelativePath.startsWith(`..${path.sep}`) && !path.isAbsolute(realRelativePath) ? realPath : null;
+	} catch {
+		return null;
+	}
+};
+const readSourceRecord = (rootDirectory, filePath, state) => {
+	const normalizedFilePath = filePath.replace(/\\/g, "/");
+	if (state.recordByFilePath.has(normalizedFilePath)) return state.recordByFilePath.get(normalizedFilePath) ?? null;
+	const absolutePath = resolveSafeSourcePath(rootDirectory, normalizedFilePath);
+	if (absolutePath === null) {
+		state.recordByFilePath.set(normalizedFilePath, null);
+		return null;
+	}
+	try {
+		const sourceText = fs.readFileSync(absolutePath, "utf-8");
+		const record = {
+			absolutePath,
+			filePath: normalizedFilePath,
+			sourceFile: ts.createSourceFile(absolutePath, sourceText, ts.ScriptTarget.Latest, true, getScriptKind(absolutePath)),
+			sourceText
+		};
+		state.recordByFilePath.set(normalizedFilePath, record);
+		return record;
+	} catch {
+		state.recordByFilePath.set(normalizedFilePath, null);
+		return null;
+	}
+};
+const listSourceRecords = (rootDirectory, state) => {
+	if (state.sourceRecords !== null) return state.sourceRecords;
+	state.sourceRecords = listSourceFiles(rootDirectory).flatMap((filePath) => {
+		const record = readSourceRecord(rootDirectory, filePath, state);
+		return record === null ? [] : [record];
+	});
+	return state.sourceRecords;
+};
+const unwrapExpression = (expression) => {
+	let currentExpression = expression;
+	while (ts.isParenthesizedExpression(currentExpression) || ts.isAsExpression(currentExpression) || ts.isTypeAssertionExpression(currentExpression) || ts.isNonNullExpression(currentExpression) || ts.isSatisfiesExpression(currentExpression)) currentExpression = currentExpression.expression;
+	return currentExpression;
+};
+const getCalleeName = (expression) => {
+	const unwrappedExpression = unwrapExpression(expression);
+	if (ts.isIdentifier(unwrappedExpression)) return unwrappedExpression.text;
+	if (ts.isPropertyAccessExpression(unwrappedExpression)) return unwrappedExpression.name.text;
+	return null;
+};
+const isComponentWrapperCall = (node) => {
+	const wrapperName = getCalleeName(node.expression);
+	return wrapperName !== null && COMPONENT_WRAPPER_NAMES.has(wrapperName);
+};
+const getFunctionName = (node) => {
+	if (ts.isFunctionDeclaration(node) && node.name !== void 0) return node.name.text;
+	if (ts.isArrowFunction(node) || ts.isFunctionExpression(node)) {
+		let componentExpression = node;
+		while (true) {
+			const parent = componentExpression.parent;
+			if (ts.isParenthesizedExpression(parent) || ts.isAsExpression(parent) || ts.isTypeAssertionExpression(parent) || ts.isNonNullExpression(parent) || ts.isSatisfiesExpression(parent)) {
+				componentExpression = parent;
+				continue;
+			}
+			if (ts.isCallExpression(parent) && parent.arguments[0] === componentExpression && isComponentWrapperCall(parent)) {
+				componentExpression = parent;
+				continue;
+			}
+			if (ts.isVariableDeclaration(parent) && ts.isIdentifier(parent.name)) return parent.name.text;
+			return node.name?.text ?? null;
+		}
+	}
+	return null;
+};
+const isComponentFunction = (node) => ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node) || ts.isArrowFunction(node);
+const isDefaultExportedComponent = (record, node, componentName) => {
+	if (ts.canHaveModifiers(node) && ts.getModifiers(node)?.some((modifier) => modifier.kind === ts.SyntaxKind.DefaultKeyword)) return true;
+	return record.sourceFile.statements.some((statement) => ts.isExportAssignment(statement) && ts.isIdentifier(statement.expression) && statement.expression.text === componentName);
+};
+const findEnclosingComponent = (record, diagnostic) => {
+	if (!Number.isInteger(diagnostic.line) || diagnostic.line < 1) return null;
+	const lineIndex = diagnostic.line - 1;
+	const lineStarts = record.sourceFile.getLineStarts();
+	const lineStart = lineStarts[lineIndex];
+	if (lineStart === void 0) return null;
+	const nextLineStart = lineStarts[lineIndex + 1] ?? record.sourceFile.end;
+	const lineEnd = Math.max(lineStart, nextLineStart - 1);
+	const columnIndex = Number.isInteger(diagnostic.column) ? Math.max(0, diagnostic.column - 1) : 0;
+	const diagnosticPosition = Math.min(lineStart + columnIndex, lineEnd);
+	let component = null;
+	let componentWidth = Number.POSITIVE_INFINITY;
+	const visit = (node) => {
+		if (diagnosticPosition < node.getStart(record.sourceFile) || diagnosticPosition > node.end) return;
+		if (isComponentFunction(node)) {
+			const name = getFunctionName(node);
+			const width = node.end - node.getStart(record.sourceFile);
+			if (name !== null && /^[A-Z]/.test(name) && width < componentWidth) {
+				component = {
+					isDefaultExport: isDefaultExportedComponent(record, node, name),
+					name,
+					node,
+					record
+				};
+				componentWidth = width;
+			}
+		}
+		ts.forEachChild(node, visit);
+	};
+	visit(record.sourceFile);
+	return component;
+};
+const moduleSpecifierTargetsComponent = (callerRecord, moduleSpecifier, componentRecord) => {
+	if (!moduleSpecifier.startsWith(".")) return false;
+	const unresolvedPath = path.resolve(path.dirname(callerRecord.absolutePath), moduleSpecifier);
+	const specifiedExtension = path.extname(unresolvedPath).toLowerCase();
+	const sourcePathWithoutExtension = SOURCE_EXTENSIONS.includes(specifiedExtension) ? unresolvedPath.slice(0, -specifiedExtension.length) : unresolvedPath;
+	return [
+		unresolvedPath,
+		...SOURCE_EXTENSIONS.map((extension) => `${sourcePathWithoutExtension}${extension}`),
+		...sourcePathWithoutExtension === unresolvedPath ? SOURCE_EXTENSIONS.map((extension) => path.join(unresolvedPath, `index${extension}`)) : []
+	].includes(componentRecord.absolutePath);
+};
+const getComponentTagNames = (record, component) => {
+	if (record.absolutePath === component.record.absolutePath) return new Set([component.name]);
+	const tagNames = /* @__PURE__ */ new Set();
+	for (const statement of record.sourceFile.statements) {
+		if (!ts.isImportDeclaration(statement) || !ts.isStringLiteral(statement.moduleSpecifier) || !moduleSpecifierTargetsComponent(record, statement.moduleSpecifier.text, component.record)) continue;
+		const importClause = statement.importClause;
+		if (component.isDefaultExport && importClause?.name !== void 0) tagNames.add(importClause.name.text);
+		const namedBindings = importClause?.namedBindings;
+		if (namedBindings !== void 0 && ts.isNamedImports(namedBindings)) {
+			for (const element of namedBindings.elements) if ((element.propertyName?.text ?? element.name.text) === component.name) tagNames.add(element.name.text);
+		}
+	}
+	return tagNames;
+};
+const getTransparentCall = (functionNode) => {
+	if (functionNode.body === void 0) return null;
+	if (!ts.isBlock(functionNode.body)) {
+		const expression = unwrapExpression(functionNode.body);
+		return ts.isCallExpression(expression) ? expression : null;
+	}
+	if (functionNode.body.statements.length !== 1) return null;
+	const statement = functionNode.body.statements[0];
+	if (statement === void 0) return null;
+	const expression = ts.isExpressionStatement(statement) || ts.isReturnStatement(statement) ? statement.expression : void 0;
+	if (expression === void 0) return null;
+	const unwrappedExpression = unwrapExpression(expression);
+	return ts.isCallExpression(unwrappedExpression) ? unwrappedExpression : null;
+};
+const resolveTransparentTarget = (functionNode) => {
+	const call = getTransparentCall(functionNode);
+	if (call === null) return null;
+	const target = unwrapExpression(call.expression);
+	if (!ts.isIdentifier(target) || call.arguments.length !== functionNode.parameters.length) return null;
+	for (const [parameterIndex, parameter] of functionNode.parameters.entries()) {
+		const argument = call.arguments[parameterIndex];
+		const unwrappedArgument = argument === void 0 ? null : unwrapExpression(argument);
+		if (!ts.isIdentifier(parameter.name) || unwrappedArgument === null || !ts.isIdentifier(unwrappedArgument) || unwrappedArgument.text !== parameter.name.text) return null;
+	}
+	return target.text;
+};
+const getForwardingFunction = (declaration) => {
+	if (ts.isFunctionDeclaration(declaration)) return declaration;
+	if (!ts.isVariableDeclaration(declaration) || declaration.initializer === void 0) return null;
+	const initializer = unwrapExpression(declaration.initializer);
+	if (ts.isArrowFunction(initializer) || ts.isFunctionExpression(initializer)) return initializer;
+	if (ts.isCallExpression(initializer) && getCalleeName(initializer.expression) === "useCallback") {
+		const callback = initializer.arguments[0];
+		if (callback !== void 0 && (ts.isArrowFunction(callback) || ts.isFunctionExpression(callback))) return callback;
+	}
+	return null;
+};
+const getDeclaredBindingName = (node) => {
+	if ((ts.isVariableDeclaration(node) || ts.isParameter(node) || ts.isBindingElement(node) || ts.isFunctionDeclaration(node)) && node.name !== void 0 && ts.isIdentifier(node.name)) return node.name.text;
+	if (ts.isImportClause(node)) return node.name?.text ?? null;
+	if (ts.isImportSpecifier(node) || ts.isNamespaceImport(node)) return node.name.text;
+	return null;
+};
+const findBindingScope = (node) => {
+	let currentNode = node;
+	while (currentNode !== void 0) {
+		if (ts.isParameter(currentNode) && ts.isFunctionLike(currentNode.parent)) return currentNode.parent;
+		if (ts.isBlock(currentNode) || ts.isModuleBlock(currentNode) || ts.isSourceFile(currentNode)) return currentNode;
+		currentNode = currentNode.parent;
+	}
+	return node.getSourceFile();
+};
+const findBindingDeclaration = (record, binding) => {
+	const usagePosition = binding.getStart(record.sourceFile);
+	const candidates = [];
+	const visit = (node) => {
+		if (getDeclaredBindingName(node) === binding.text) {
+			const scope = findBindingScope(node);
+			const isVisibleScope = usagePosition >= scope.getStart(record.sourceFile) && usagePosition <= scope.end;
+			const isVisibleDeclaration = ts.isFunctionDeclaration(node) || ts.isParameter(node) || ts.isBindingElement(node) || ts.isImportClause(node) || ts.isImportSpecifier(node) || ts.isNamespaceImport(node) || node.getStart(record.sourceFile) < usagePosition;
+			if (isVisibleScope && isVisibleDeclaration) candidates.push({
+				declaration: node,
+				scope
+			});
+		}
+		ts.forEachChild(node, visit);
+	};
+	visit(record.sourceFile);
+	let nearestCandidate = null;
+	let nearestScopeWidth = Number.POSITIVE_INFINITY;
+	let isNearestScopeAmbiguous = false;
+	for (const candidate of candidates) {
+		const scopeWidth = candidate.scope.end - candidate.scope.getStart(record.sourceFile);
+		if (scopeWidth < nearestScopeWidth) {
+			nearestCandidate = candidate;
+			nearestScopeWidth = scopeWidth;
+			isNearestScopeAmbiguous = false;
+		} else if (scopeWidth === nearestScopeWidth) isNearestScopeAmbiguous = true;
+	}
+	if (isNearestScopeAmbiguous) return null;
+	const declaration = nearestCandidate?.declaration;
+	return declaration !== void 0 && (ts.isVariableDeclaration(declaration) || ts.isFunctionDeclaration(declaration)) ? declaration : null;
+};
+const resolveHandlerBinding = (record, binding) => {
+	const declaration = findBindingDeclaration(record, binding);
+	if (declaration === null) return binding.text;
+	const forwardingFunction = getForwardingFunction(declaration);
+	const target = forwardingFunction === null ? null : resolveTransparentTarget(forwardingFunction);
+	return target === null || target === binding.text ? binding.text : target;
+};
+const getJsxTagName = (node) => ts.isIdentifier(node.tagName) ? node.tagName.text : null;
+const getHandlerBinding = (node, propName) => {
+	for (const property of node.attributes.properties) {
+		if (!ts.isJsxAttribute(property) || property.name.getText() !== propName) continue;
+		const initializer = property.initializer;
+		if (initializer === void 0 || !ts.isJsxExpression(initializer)) return null;
+		if (initializer.expression === void 0) return null;
+		const expression = unwrapExpression(initializer.expression);
+		return ts.isIdentifier(expression) ? expression : null;
+	}
+	return null;
+};
+const getForwardedHandlerAliases = (rootDirectory, component, propNames, state) => {
+	const cacheKey = `${component.record.filePath}\0${component.name}\0${[...propNames].sort().join("\0")}`;
+	const cachedAliases = state.aliasesByComponent.get(cacheKey);
+	if (cachedAliases !== void 0) return cachedAliases;
+	const bindingsByPropName = /* @__PURE__ */ new Map();
+	const unresolvedPropNames = /* @__PURE__ */ new Set();
+	let callsiteCount = 0;
+	for (const record of listSourceRecords(rootDirectory, state)) {
+		const tagNames = getComponentTagNames(record, component);
+		if (tagNames.size === 0) continue;
+		const visit = (node) => {
+			if (record === component.record && node === component.node) return;
+			if (ts.isJsxOpeningElement(node) || ts.isJsxSelfClosingElement(node)) {
+				const tagName = getJsxTagName(node);
+				if (tagName !== null && tagNames.has(tagName)) {
+					callsiteCount += 1;
+					for (const propName of propNames) {
+						const binding = getHandlerBinding(node, propName);
+						if (binding === null) {
+							unresolvedPropNames.add(propName);
+							continue;
+						}
+						const bindings = bindingsByPropName.get(propName) ?? /* @__PURE__ */ new Set();
+						bindings.add(resolveHandlerBinding(record, binding));
+						bindingsByPropName.set(propName, bindings);
+					}
+				}
+			}
+			ts.forEachChild(node, visit);
+		};
+		visit(record.sourceFile);
+	}
+	const aliases = /* @__PURE__ */ new Map();
+	if (callsiteCount > 0) for (const [propName, bindings] of bindingsByPropName) {
+		if (bindings.size !== 1 || unresolvedPropNames.has(propName)) continue;
+		const [bindingName] = bindings;
+		if (bindingName !== void 0) aliases.set(propName, bindingName);
+	}
+	state.aliasesByComponent.set(cacheKey, aliases);
+	return aliases;
+};
+const normalizeForwardedHandlers = (evidence, aliases) => {
+	let normalizedEvidence = evidence;
+	for (const [propName, bindingName] of aliases) normalizedEvidence = normalizedEvidence.replace(new RegExp(`\\{\\s*${propName}\\s*\\}`, "g"), `{${bindingName}}`).replace(new RegExp(`=>\\s*${propName}\\s*\\(`, "g"), `=> ${bindingName}(`);
+	return normalizedEvidence;
+};
+const createDiagnosticEvidenceReader = (rootDirectory, options = {}) => {
+	const state = {
+		aliasesByComponent: /* @__PURE__ */ new Map(),
+		recordByFilePath: /* @__PURE__ */ new Map(),
+		sourceRecords: null
+	};
+	return (diagnostic) => {
+		const record = readSourceRecord(rootDirectory, diagnostic.filePath, state);
+		if (record === null || !Number.isInteger(diagnostic.line)) return null;
+		const sourceLines = record.sourceText.split(/\r?\n/);
+		const startLineIndex = Math.max(0, diagnostic.line - 1);
+		const endLineIndex = Math.max(startLineIndex, (diagnostic.endLine ?? diagnostic.line) - 1);
+		const evidence = sourceLines.slice(startLineIndex, endLineIndex + 1).join("\n");
+		if (!options.resolveForwardedHandlers) return evidence;
+		const propNames = new Set(evidence.match(/\bon[A-Z]\w*\b/g) ?? []);
+		if (propNames.size === 0) return evidence;
+		const component = findEnclosingComponent(record, diagnostic);
+		if (component === null) return evidence;
+		return normalizeForwardedHandlers(evidence, getForwardedHandlerAliases(rootDirectory, component, propNames, state));
+	};
+};
+//#endregion
 //#region src/cli/utils/build-no-score-message.ts
 const ENTERPRISE_CONTACT_HINT = `Want something custom to your company? Contact us at ${ENTERPRISE_CONTACT_URL}.`;
-const buildNoScoreMessage = (isScoreDisabled) => {
-	return `${isScoreDisabled ? "Score disabled by --no-score." : "Score unavailable (could not reach the score API)."} ${ENTERPRISE_CONTACT_HINT}`;
+const buildNoScoreMessage = (isScoreDisabled, disabledMessage) => {
+	return `${isScoreDisabled ? disabledMessage ?? "Score disabled by --no-score." : "Score unavailable (could not reach the score API)."} ${ENTERPRISE_CONTACT_HINT}`;
 };
 //#endregion
 //#region src/cli/utils/render-agent-guidance.ts
@@ -61505,40 +62299,47 @@ const buildChangedLineMatcher = (directory, changedLineRanges) => {
 		return diagnosticIntersectsLineRanges(diagnostic, ranges);
 	};
 };
-const buildIgnoredTags = (userConfig) => {
+const buildIgnoredTags = (userConfig, includedTags) => {
 	const tags = /* @__PURE__ */ new Set();
 	if (userConfig?.ignore?.tags) for (const tag of userConfig.ignore.tags) tags.add(tag);
+	for (const tag of includedTags) tags.delete(tag);
 	return tags;
 };
-const mergeInspectOptions = (inputOptions, userConfig) => ({
-	lint: inputOptions.lint ?? userConfig?.lint ?? true,
-	deadCode: inputOptions.deadCode ?? userConfig?.deadCode ?? true,
-	supplyChain: inputOptions.supplyChain ?? userConfig?.supplyChain?.enabled ?? true,
-	verbose: inputOptions.verbose ?? userConfig?.verbose ?? false,
-	outputDirectory: inputOptions.outputDirectory || null,
-	scoreOnly: inputOptions.scoreOnly ?? false,
-	noScore: inputOptions.noScore ?? userConfig?.noScore ?? false,
-	isCi: inputOptions.isCi ?? false,
-	isCiOrCodingAgentEnvironment: isCiOrCodingAgentEnvironment(),
-	isNonInteractiveEnvironment: isNonInteractiveEnvironment(),
-	silent: inputOptions.silent ?? false,
-	includePaths: inputOptions.includePaths ?? [],
-	customRulesOnly: userConfig?.customRulesOnly ?? false,
-	share: userConfig?.share ?? true,
-	respectInlineDisables: inputOptions.respectInlineDisables ?? userConfig?.respectInlineDisables ?? true,
-	warnings: inputOptions.warnings ?? userConfig?.warnings ?? true,
-	categoryFilters: new Set(resolveCliCategories(inputOptions.categoryFilters) ?? []),
-	adoptExistingLintConfig: userConfig?.adoptExistingLintConfig ?? true,
-	ignoredTags: buildIgnoredTags(userConfig),
-	outputSurface: inputOptions.outputSurface ?? "cli",
-	suppressRendering: inputOptions.suppressRendering ?? false,
-	concurrentScan: inputOptions.concurrentScan ?? false,
-	concurrency: inputOptions.concurrency,
-	maxDurationMs: inputOptions.maxDurationMs ?? null,
-	baseline: inputOptions.baseline ?? null,
-	changedLineRanges: inputOptions.changedLineRanges ?? null,
-	supplyChainManifestChanged: inputOptions.supplyChainManifestChanged ?? false
-});
+const mergeInspectOptions = (inputOptions, userConfig) => {
+	const includedTags = inputOptions.includedTags ?? /* @__PURE__ */ new Set();
+	return {
+		lint: inputOptions.lint ?? userConfig?.lint ?? true,
+		deadCode: inputOptions.deadCode ?? userConfig?.deadCode ?? true,
+		supplyChain: inputOptions.supplyChain ?? userConfig?.supplyChain?.enabled ?? true,
+		verbose: inputOptions.verbose ?? userConfig?.verbose ?? false,
+		outputDirectory: inputOptions.outputDirectory || null,
+		scoreOnly: inputOptions.scoreOnly ?? false,
+		noScore: inputOptions.noScore ?? userConfig?.noScore ?? false,
+		isCi: inputOptions.isCi ?? false,
+		isCiOrCodingAgentEnvironment: isCiOrCodingAgentEnvironment(),
+		isNonInteractiveEnvironment: isNonInteractiveEnvironment(),
+		silent: inputOptions.silent ?? false,
+		includePaths: inputOptions.includePaths ?? [],
+		customRulesOnly: includedTags.size > 0 ? false : userConfig?.customRulesOnly ?? false,
+		share: userConfig?.share ?? true,
+		respectInlineDisables: inputOptions.respectInlineDisables ?? userConfig?.respectInlineDisables ?? true,
+		warnings: inputOptions.warnings ?? userConfig?.warnings ?? true,
+		categoryFilters: new Set(resolveCliCategories(inputOptions.categoryFilters) ?? []),
+		adoptExistingLintConfig: includedTags.size > 0 ? false : userConfig?.adoptExistingLintConfig ?? true,
+		ignoredTags: buildIgnoredTags(userConfig, includedTags),
+		includedTags,
+		includeTagDefaults: inputOptions.includeTagDefaults ?? false,
+		scoreDisabledMessage: inputOptions.scoreDisabledMessage,
+		outputSurface: inputOptions.outputSurface ?? "cli",
+		suppressRendering: inputOptions.suppressRendering ?? false,
+		concurrentScan: inputOptions.concurrentScan ?? false,
+		concurrency: inputOptions.concurrency,
+		maxDurationMs: inputOptions.maxDurationMs ?? null,
+		baseline: inputOptions.baseline ?? null,
+		changedLineRanges: inputOptions.changedLineRanges ?? null,
+		supplyChainManifestChanged: inputOptions.supplyChainManifestChanged ?? false
+	};
+};
 const deriveScope = (options) => {
 	if (options.baseline) return "changed";
 	if (options.changedLineRanges !== null) return "lines";
@@ -61620,6 +62421,8 @@ const runBaselineComparison = async (params) => {
 		directory: params.directory,
 		ref: params.baselineRef,
 		files: params.options.includePaths,
+		baseFiles: params.baseFiles,
+		headFiles: params.headFiles,
 		tempDirectory
 	}).catch((error) => {
 		rmSync(tempDirectory, {
@@ -61628,7 +62431,24 @@ const runBaselineComparison = async (params) => {
 		});
 		throw error;
 	});
+	if (snapshot === null) {
+		rmSync(tempDirectory, {
+			recursive: true,
+			force: true
+		});
+		return null;
+	}
 	try {
+		if (!snapshot.isComplete) return null;
+		const analyzedHeadFiles = new Set(params.headAnalyzedFiles.map(toForwardSlashes));
+		const baseFiles = new Set(snapshot.baseFiles.map(toForwardSlashes));
+		const trackedHeadFiles = new Set(snapshot.headFiles.map(toForwardSlashes));
+		const expectedHeadFiles = new Set(trackedHeadFiles);
+		for (const filePath of params.options.includePaths) {
+			const normalizedFilePath = toForwardSlashes(filePath);
+			if (!baseFiles.has(normalizedFilePath)) expectedHeadFiles.add(normalizedFilePath);
+		}
+		if (filterSourceFiles([...expectedHeadFiles]).some((filePath) => !analyzedHeadFiles.has(filePath))) return null;
 		const baseLayers = buildRuntimeLayers({
 			directory: snapshot.tempDirectory,
 			hasConfigOverride: true,
@@ -61644,12 +62464,14 @@ const runBaselineComparison = async (params) => {
 		});
 		const baseOutput = await runPromise(restoreLegacyThrow(runInspect({
 			directory: snapshot.tempDirectory,
-			includePaths: params.options.includePaths,
+			includePaths: snapshot.materializedFiles,
 			customRulesOnly: params.options.customRulesOnly,
 			respectInlineDisables: params.options.respectInlineDisables,
 			warnings: params.options.warnings,
 			adoptExistingLintConfig: params.options.adoptExistingLintConfig,
 			ignoredTags: params.options.ignoredTags,
+			includedTags: params.options.includedTags,
+			includeTagDefaults: params.options.includeTagDefaults,
 			nodeBinaryPath: params.resolvedNodeBinaryPath ?? void 0,
 			runDeadCode: false,
 			isCi: params.options.isCi,
@@ -61661,18 +62483,22 @@ const runBaselineComparison = async (params) => {
 			deadlineEpochMs: params.deadlineEpochMs ?? void 0
 		}, {}).pipe(provide(baseLayers), provideService$2(PerFileLintCacheEnabled, false), provideService$2(SidecarLintCacheEnabled, false), provideService$2(Console, silentConsole))));
 		if (baseOutput.didLintFail || countIncompleteLintFiles(baseOutput.lintPartialFailures) > 0) return null;
+		const hasUnscannedUntrackedSourceFiles = filterSourceFiles(snapshot.untrackedFiles.map(toForwardSlashes)).some((filePath) => !analyzedHeadFiles.has(filePath));
 		const delta = computeDiagnosticDelta({
 			headDiagnostics: params.headDiagnostics,
 			baseDiagnostics: baseOutput.diagnostics,
 			readHeadLine: createSourceLineReader(params.directory),
-			readBaseLine: createSourceLineReader(snapshot.tempDirectory)
+			readBaseLine: createSourceLineReader(snapshot.tempDirectory),
+			readHeadEvidence: createDiagnosticEvidenceReader(params.directory, { resolveForwardedHandlers: true }),
+			readBaseEvidence: createDiagnosticEvidenceReader(snapshot.tempDirectory)
 		});
 		return {
 			displayDiagnostics: delta.newDiagnostics,
 			baselineDelta: {
 				baseRef: params.baselineRef,
-				fixedCount: delta.fixedCount,
-				baseTotalCount: baseOutput.diagnostics.length
+				fixedCount: hasUnscannedUntrackedSourceFiles ? 0 : delta.fixedCount,
+				baseTotalCount: baseOutput.diagnostics.length,
+				crossFileMatchCount: delta.crossFileMatchCount
 			}
 		};
 	} finally {
@@ -61739,6 +62565,8 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		warnings: options.warnings,
 		adoptExistingLintConfig: options.adoptExistingLintConfig,
 		ignoredTags: options.ignoredTags,
+		includedTags: options.includedTags,
+		includeTagDefaults: options.includeTagDefaults,
 		nodeBinaryPath: resolvedNodeBinaryPath ?? void 0,
 		runDeadCode: options.deadCode,
 		isCi: options.isCi,
@@ -61779,6 +62607,9 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 			headDiagnostics: output.diagnostics,
 			resolvedNodeBinaryPath,
 			baselineRef: options.baseline.ref,
+			baseFiles: options.baseline.baseFiles,
+			headFiles: options.baseline.headFiles,
+			headAnalyzedFiles: output.analyzedFiles,
 			deadlineEpochMs
 		});
 		if (comparison) {
@@ -61924,7 +62755,7 @@ const finalizeAndRender = (input) => gen(function* () {
 		securityScanFailed
 	});
 	const hasSkippedChecks = skippedChecks.length > 0;
-	const noScoreMessage = buildNoScoreMessage(options.noScore);
+	const noScoreMessage = buildNoScoreMessage(options.noScore, options.scoreDisabledMessage);
 	const buildResult = () => ({
 		diagnostics: [...diagnostics],
 		score,
@@ -64029,21 +64860,25 @@ const resolveParallelFlag = (parallel) => parallel === false ? 1 : void 0;
 */
 const resolveCliInspectOptions = (flags, userConfig) => {
 	const wantsWarningGate = pickBlockingLevel(flags, userConfig) === "warning";
+	const isDesignScan = flags.design === true;
 	return {
 		lint: flags.lint,
-		deadCode: flags.deadCode,
-		supplyChain: flags.supplyChain,
+		deadCode: isDesignScan ? false : flags.deadCode,
+		supplyChain: isDesignScan ? false : flags.supplyChain,
 		verbose: flags.verbose,
 		outputDirectory: flags.outputDir,
 		respectInlineDisables: flags.respectInlineDisables === false ? false : void 0,
 		warnings: wantsWarningGate ? true : flags.warnings,
 		scoreOnly: flags.score === true,
-		noScore: flags.score === false || flags.telemetry === false ? true : void 0,
+		noScore: isDesignScan || flags.score === false || flags.telemetry === false ? true : void 0,
 		isCi: isCiEnvironment(),
 		silent: Boolean(flags.json),
 		concurrency: resolveParallelFlag(flags.parallel),
 		maxDurationMs: resolveMaxDurationFlag(flags.maxDuration),
-		categoryFilters: resolveCliCategories(flags.category)
+		categoryFilters: resolveCliCategories(flags.category),
+		includedTags: isDesignScan ? new Set(["design"]) : void 0,
+		includeTagDefaults: isDesignScan ? true : void 0,
+		scoreDisabledMessage: isDesignScan ? "Design scans do not affect the React health score." : void 0
 	};
 };
 //#endregion
@@ -64063,20 +64898,25 @@ const resolveProjectRelativeDirectory = (rootDirectory, projectDirectory) => {
 	return relativeProjectDirectory;
 };
 //#endregion
-//#region src/cli/utils/resolve-project-diff-include-paths.ts
-const resolveProjectDiffIncludePaths = (rootDirectory, projectDirectory, diffInfo) => {
+//#region src/cli/utils/resolve-project-source-file-paths.ts
+const resolveProjectSourceFilePaths = (rootDirectory, projectDirectory, filePaths) => {
 	const relativeProjectDirectory = resolveProjectRelativeDirectory(rootDirectory, projectDirectory);
 	if (relativeProjectDirectory === null) return [];
-	const changedSourceFiles = filterSourceFiles(diffInfo.changedFiles);
-	if (relativeProjectDirectory.length === 0) return changedSourceFiles;
+	const sourceFilePaths = filterSourceFiles([...filePaths]);
+	if (relativeProjectDirectory.length === 0) return sourceFilePaths;
 	const projectPrefix = `${relativeProjectDirectory}/`;
-	return changedSourceFiles.flatMap((filePath) => {
+	return sourceFilePaths.flatMap((filePath) => {
 		const normalizedFilePath = toForwardSlashes(filePath);
 		if (!normalizedFilePath.startsWith(projectPrefix)) return [];
 		const projectRelativePath = normalizedFilePath.slice(projectPrefix.length);
 		return projectRelativePath.length > 0 ? [projectRelativePath] : [];
 	});
 };
+//#endregion
+//#region src/cli/utils/resolve-project-diff-include-paths.ts
+const resolveProjectDiffIncludePaths = (rootDirectory, projectDirectory, diffInfo) => {
+	return resolveProjectSourceFilePaths(rootDirectory, projectDirectory, diffInfo.changedFiles);
+};
 /**
 * Re-keys repo-relative changed line ranges (from `getChangedLineRanges`) to
 * the scanned project, mirroring `resolveProjectDiffIncludePaths`'s boundary
@@ -64456,7 +65296,7 @@ const maybeMigrateLegacyConfig = async (requestedDirectory, { isQuiet, isStaged
 	if (!(!isQuiet && !isStaged && process.stdout.isTTY === true && !isCiOrCodingAgentEnvironment())) return;
 	await runProjectMigrations(requestedDirectory);
 };
-const inspectAction = async (directory, flags) => {
+const inspectAction = async (directory, flags, invocationCommand = "inspect") => {
 	const isScoreOnly = Boolean(flags.score);
 	const isJsonMode = Boolean(flags.json);
 	const isQuiet = isScoreOnly || isJsonMode;
@@ -64470,7 +65310,7 @@ const inspectAction = async (directory, flags) => {
 		});
 		if (flags.jsonOut) recordCount(METRIC.jsonOutUsed, 1);
 	}
-	recordCount(METRIC.cliInvoked, 1, { command: "inspect" });
+	recordCount(METRIC.cliInvoked, 1, { command: invocationCommand });
 	try {
 		validateModeFlags(flags);
 		if (flags.staged) setJsonReportMode("staged");
@@ -64615,6 +65455,7 @@ const inspectAction = async (directory, flags) => {
 		const isDiffMode = scope !== "full";
 		const comparisonBaseRef = isDiffMode && diffInfo && !diffInfo.isCurrentChanges ? diffInfo.baseSha ? await resolveMergeBaseRef(resolvedDirectory, diffInfo.baseSha) : diffInfo.diffBaseRef ?? await resolveMergeBaseRef(resolvedDirectory, diffInfo.baseBranch) : null;
 		const baselineRef = scope === "changed" ? comparisonBaseRef : null;
+		const baselineDiffPlan = baselineRef === null ? null : await getBaselineDiffPlan(resolvedDirectory, baselineRef);
 		const linesBaseRef = diffInfo?.isCurrentChanges ? "HEAD" : comparisonBaseRef;
 		const changedLineRanges = scope === "lines" && diffInfo !== null && (diffInfo.isCurrentChanges || linesBaseRef !== null) && diffInfo !== null ? await getChangedLineRanges({
 			directory: resolvedDirectory,
@@ -64645,10 +65486,13 @@ const inspectAction = async (directory, flags) => {
 			const supplyChainEnabled = flags.supplyChain ?? projectConfig?.supplyChain?.enabled !== false;
 			let includePaths;
 			let supplyChainManifestChanged = false;
+			const projectBaselineBaseFiles = baselineDiffPlan === null ? null : resolveProjectSourceFilePaths(resolvedDirectory, scanDirectory, baselineDiffPlan.baseFiles);
+			const projectBaselineHeadFiles = baselineDiffPlan === null ? null : resolveProjectSourceFilePaths(resolvedDirectory, scanDirectory, baselineDiffPlan.headFiles);
 			if (isDiffMode) {
 				const changedSourceFiles = diffInfo === null ? [] : resolveProjectDiffIncludePaths(resolvedDirectory, scanDirectory, diffInfo);
 				supplyChainManifestChanged = supplyChainEnabled && diffInfo !== null && projectManifestChanged(resolvedDirectory, scanDirectory, diffInfo);
-				if (changedSourceFiles.length === 0 && !supplyChainManifestChanged) {
+				const hasBaselineOnlyFiles = (projectBaselineBaseFiles?.length ?? 0) > 0;
+				if (changedSourceFiles.length === 0 && !supplyChainManifestChanged && !hasBaselineOnlyFiles) {
 					if (!isQuiet) {
 						cliLogger.dim(`No changed source files in ${scanDirectory}, skipping.`);
 						cliLogger.break();
@@ -64656,6 +65500,7 @@ const inspectAction = async (directory, flags) => {
 					return null;
 				}
 				includePaths = [...changedSourceFiles];
+				if (includePaths.length === 0 && hasBaselineOnlyFiles) includePaths.push(...projectBaselineBaseFiles ?? []);
 				if (supplyChainManifestChanged) includePaths.push("package.json");
 			}
 			if (!isQuiet && !isMultiProject) cliLogger.dim("  ");
@@ -64667,7 +65512,11 @@ const inspectAction = async (directory, flags) => {
 				configSourceDirectory: projectConfigSourceDirectory ?? void 0,
 				suppressRendering: isMultiProject,
 				concurrentScan: isMultiProject,
-				baseline: baselineRef ? { ref: baselineRef } : void 0,
+				baseline: baselineRef !== null && projectBaselineBaseFiles !== null && projectBaselineHeadFiles !== null ? {
+					ref: baselineRef,
+					baseFiles: projectBaselineBaseFiles,
+					headFiles: projectBaselineHeadFiles
+				} : void 0,
 				changedLineRanges: scope === "lines" && changedLineRanges !== null ? resolveProjectChangedLineRanges(resolvedDirectory, scanDirectory, changedLineRanges) : void 0,
 				supplyChainManifestChanged
 			});
@@ -64773,6 +65622,13 @@ const inspectAction = async (directory, flags) => {
 	}
 };
 //#endregion
+//#region src/cli/commands/design.ts
+const designAction = async (directory, flags) => inspectAction(directory, {
+	...flags,
+	design: true,
+	lint: flags.lint ?? true
+}, "design");
+//#endregion
 //#region src/cli/commands/install.ts
 const installAction = async (options, command) => {
 	recordCount(METRIC.cliInvoked, 1, { command: "install" });
@@ -65609,6 +66465,7 @@ const INSTALL_FLAG_SPEC = {
 	shortOptionsWithRequiredValues: new Set(["-c"])
 };
 const COMMAND_FLAG_SPECS = new Map([
+	["design", ROOT_FLAG_SPEC],
 	["install", INSTALL_FLAG_SPEC],
 	["setup", INSTALL_FLAG_SPEC],
 	["version", {
@@ -65765,6 +66622,7 @@ ${formatExampleLines([
 	["react-doctor --scope changed --base main", "scan only new issues vs. main"],
 	["react-doctor --project modules/a,modules/b", "score each module separately (names or paths)"],
 	["react-doctor --staged", "scan staged files (pre-commit hook)"],
+	["react-doctor design", "run the focused UI design audit"],
 	["react-doctor --category Security", "show only one diagnostic category"],
 	["react-doctor --blocking warning", "fail CI on warnings too (default: error)"],
 	["react-doctor --json > report.json", "write a machine-readable report"],
@@ -65798,6 +66656,20 @@ ${highlighter.dim("Managing CI:")}
 ${highlighter.dim("Learn more:")}
   ${highlighter.info(CANONICAL_GITHUB_URL)}
 `;
+const renderDesignHelpEpilog = () => `
+${highlighter.dim("Examples:")}
+${formatExampleLines([
+	["react-doctor design", "audit UI design in the current project"],
+	["react-doctor design ./apps/web", "audit one application"],
+	["react-doctor design --verbose", "show every design finding"],
+	["react-doctor design --json", "write a design-only JSON report"]
+])}
+
+${highlighter.dim("Scope:")}
+  Runs only rules tagged ${highlighter.info("design")}, including focused rules that stay opt-in during a general health scan.
+  Dead-code, supply-chain, external lint-config, custom-plugin, and health-score passes are skipped.
+  Standard scan flags such as ${highlighter.info("--scope")}, ${highlighter.info("--project")}, ${highlighter.info("--verbose")}, and ${highlighter.info("--json")} still work.
+`;
 const renderCiHelpEpilog = () => `
 ${highlighter.dim("Examples:")}
 ${formatExampleLines([
@@ -65819,6 +66691,7 @@ ${highlighter.dim("Learn more:")}
 const collectCategoryOption = (value, previousValues) => [...previousValues ?? [], value];
 const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--supply-chain", "enable the dependency supply-chain scan (default)").option("--no-supply-chain", "skip the dependency supply-chain scan (Socket.dev dependency health checks)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("--json-out <path>", "with --json, write the report to a file instead of stdout").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much supported JS/TS source to scan/report: full (default), files, changed (only new issues vs base), or lines (issues whose source spans touch changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").option("--include-untracked", "with --scope files/changed/lines, also scan ordinary untracked files (respects .gitignore)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--max-duration <seconds>", "scan time budget for the whole run, shared across workspace projects: past it, remaining lint batches and dead-code are skipped and partial results are reported (skipped files are listed in the JSON report)").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
 program.action(inspectAction);
+program.command("design [directory]").description("Run only the focused UI design diagnostics").addHelpText("after", renderDesignHelpEpilog).action((directory, _options, command) => designAction(directory ?? ".", command.optsWithGlobals()));
 program.command("why <location>").description("Explain why a rule fired (or why a suppression didn't apply) at a file:line").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple)").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").action((location, options) => whyAction(location, options));
 program.command("install").alias("setup").description("Install the react-doctor skill into your coding agents and optional git hook").option("-y, --yes", "skip prompts, install for all detected agents").option("--dry-run", "show what would be installed without writing files").option("--agent-hooks", "install native non-blocking agent hooks for Claude Code and Cursor").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderInstallHelpEpilog).action(installAction);
 const providerOption = ["--provider <name>", "ci provider: github-actions or gitlab-ci (auto-detected by default)"];
@@ -65867,4 +66740,4 @@ Promise.resolve().then(() => assertNoRemovedFlags(process.argv)).then(() => prog
 export {};
 
 //# sourceMappingURL=cli.js.map
-//# debugId=5cb8a881-e8fc-5561-8b89-ad2c8357acbc
+//# debugId=a9af63ed-7b82-56d3-8549-274ab7f23579