react-doctor 0.9.1-dev.5d2f66d → 0.9.1-dev.8534d86

package/README.md

@@ -13,6 +13,8 @@ React Doctor deterministically scans your codebase and finds issues across state
 
 Works for all React frameworks and libraries - Next.js, Vite, TanStack, React Native, Expo, you name it.
 
+Scans JavaScript and TypeScript source files plus JavaScript in standard inline `<script>` blocks in `.html` files.
+
 [Website →](https://react.doctor/docs)
 
 ## Install

package/dist/cli.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ea274003-c9c6-5b5c-b839-b1545ccc48fa")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="68199c0f-9834-55ef-9753-efce9ed982ad")}catch(e){}}();
 import { createRequire } from "node:module";
 import * as NodeChildProcess from "node:child_process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
@@ -64616,7 +64616,8 @@ var AmbiguousProjectError = class extends Error {
 	}
 };
 const isProjectDiscoveryError = (value) => value instanceof ProjectNotFoundError || value instanceof NoReactDependencyError || value instanceof PackageJsonNotFoundError || value instanceof NotADirectoryError || value instanceof AmbiguousProjectError;
-const SOURCE_FILE_PATTERN = /\.(tsx?|jsx?|mts|mjs)$/;
+const HTML_FILE_PATTERN = /\.html$/i;
+const SOURCE_FILE_PATTERN = /\.(?:tsx?|jsx?|mts|mjs|[hH][tT][mM][lL])$/;
 const GENERATED_BUNDLE_FILE_PATTERN = /\.(iife|umd|global|min)\.m?js$/i;
 const GENERATED_SOURCE_DIRECTORY_PATTERN = /(?:^|\/)__generated__\//;
 const MINIFIED_SNIFF_BYTES = 65536;
@@ -73835,6 +73836,12 @@ const appendReanimatedSharedValueHint = (help, rule, project) => {
 	if (!help) return REANIMATED_SHARED_VALUE_HINT;
 	return `${help}\n\n${REANIMATED_SHARED_VALUE_HINT}`;
 };
+const columnOfUtf8Offset = (sourceBuffer, utf8Offset) => {
+	const boundedOffset = Math.min(Math.max(utf8Offset, 0), sourceBuffer.length);
+	let lineStartOffset = boundedOffset;
+	while (lineStartOffset > 0 && sourceBuffer[lineStartOffset - 1] !== 10) lineStartOffset--;
+	return sourceBuffer.subarray(lineStartOffset, boundedOffset).toString("utf8").length + 1;
+};
 const REDACTED_PLACEHOLDER = "<redacted>";
 const KEEP_PREFIX = `$1${REDACTED_PLACEHOLDER}`;
 const KNOWN_SECRET_RULES = [
@@ -74550,7 +74557,7 @@ const resolveMatchByOccurrence = (rule, category) => OCCURRENCE_MATCHED_CATEGORI
 * with empty text still carry a useful jump target, so they're kept
 * with a neutral message.
 */
-const buildRelatedLocations = (labels, filePath) => {
+const buildRelatedLocations = (labels, filePath, sourceBuffer) => {
 	if (labels.length <= 1) return [];
 	const related = [];
 	for (let labelIndex = 1; labelIndex < labels.length; labelIndex++) {
@@ -74558,8 +74565,8 @@ const buildRelatedLocations = (labels, filePath) => {
 		if (!label?.span) continue;
 		related.push({
 			filePath,
-			line: label.span.line ?? 0,
-			column: label.span.column ?? 0,
+			line: sourceBuffer === null ? label.span.line ?? 0 : lineOfUtf8Offset(sourceBuffer, label.span.offset),
+			column: sourceBuffer === null ? label.span.column ?? 0 : columnOfUtf8Offset(sourceBuffer, label.span.offset),
 			offset: label.span.offset,
 			length: label.span.length,
 			message: label.label ?? ""
@@ -74579,7 +74586,7 @@ const isOxlintOutput = (value) => isRecord$1(value) && Array.isArray(value.diagn
 * to the first `{`. Raises `OxlintOutputUnparseable` when the
 * stdout isn't valid JSON or doesn't carry a `diagnostics` array.
 */
-const parseOxlintOutput = (stdout, project, rootDirectory) => {
+const parseOxlintOutput = (stdout, project, rootDirectory, sourcePathByLintPath) => {
 	if (!stdout) return [];
 	const jsonStart = stdout.indexOf("{");
 	const sanitizedStdout = jsonStart > 0 ? stdout.slice(jsonStart) : stdout;
@@ -74596,8 +74603,10 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 	const sourceBufferCache = /* @__PURE__ */ new Map();
 	const sourceLinesCache = /* @__PURE__ */ new Map();
 	const resolveAbsolutePath = (filename) => Path.isAbsolute(filename) ? filename : Path.resolve(rootDirectory || ".", filename);
+	const resolveMappedSourceFilename = (filename) => sourcePathByLintPath?.get(Path.normalize(resolveAbsolutePath(filename)));
+	const resolveSourceFilename = (filename) => resolveMappedSourceFilename(filename) ?? filename;
 	const readSourceBuffer = (filename) => {
-		const absolutePath = resolveAbsolutePath(filename);
+		const absolutePath = resolveAbsolutePath(resolveSourceFilename(filename));
 		const cached = sourceBufferCache.get(absolutePath);
 		if (cached !== void 0) return cached;
 		let sourceBuffer;
@@ -74610,7 +74619,7 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 		return sourceBuffer;
 	};
 	const readSourceLines = (filename) => {
-		const absolutePath = resolveAbsolutePath(filename);
+		const absolutePath = resolveAbsolutePath(resolveSourceFilename(filename));
 		const cached = sourceLinesCache.get(absolutePath);
 		if (cached !== void 0) return cached;
 		const sourceBuffer = readSourceBuffer(filename);
@@ -74619,27 +74628,30 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 		return sourceLines;
 	};
 	const isMinifiedDiagnosticFile = (filename) => {
-		const absolutePath = resolveAbsolutePath(filename);
+		const absolutePath = resolveAbsolutePath(resolveSourceFilename(filename));
 		const cached = minifiedFileCache.get(absolutePath);
 		if (cached !== void 0) return cached;
 		const minified = isMinifiedSource(absolutePath);
 		minifiedFileCache.set(absolutePath, minified);
 		return minified;
 	};
-	return suppressMemoizationInBailedOutFunctions(parsed.diagnostics.filter((diagnostic) => isMappableOxlintDiagnostic(diagnostic) && isLintableSourceFile(diagnostic.filename) && !(TYPESCRIPT_DECLARATION_FILE_PATTERN.test(diagnostic.filename) && OXLINT_IGNORED_DECLARATION_DIAGNOSTIC_CODES.has(diagnostic.code)) && !isMinifiedDiagnosticFile(diagnostic.filename) && !shouldSuppressLocalUseHookDiagnostic(diagnostic, rootDirectory) && !shouldSuppressCompilerFindingInWorklet(diagnostic, project, rootDirectory)).map((diagnostic) => {
+	return suppressMemoizationInBailedOutFunctions(parsed.diagnostics.filter((diagnostic) => isMappableOxlintDiagnostic(diagnostic) && isLintableSourceFile(resolveSourceFilename(diagnostic.filename)) && !(TYPESCRIPT_DECLARATION_FILE_PATTERN.test(diagnostic.filename) && OXLINT_IGNORED_DECLARATION_DIAGNOSTIC_CODES.has(diagnostic.code)) && !isMinifiedDiagnosticFile(diagnostic.filename) && !shouldSuppressLocalUseHookDiagnostic(diagnostic, rootDirectory) && !shouldSuppressCompilerFindingInWorklet(diagnostic, project, rootDirectory)).map((diagnostic) => {
 		const { plugin, rule } = parseRuleCode(diagnostic.code);
 		const primaryLabel = diagnostic.labels[0];
 		const cleaned = cleanDiagnosticMessage(diagnostic.message, diagnostic.help, plugin, rule, project);
-		const normalizedFilePath = diagnostic.filename.replaceAll("\\", "/");
+		const mappedSourceFilename = resolveMappedSourceFilename(diagnostic.filename);
+		const normalizedFilePath = (mappedSourceFilename ?? diagnostic.filename).replaceAll("\\", "/");
 		const primarySpan = primaryLabel?.span;
 		const sourceBuffer = primarySpan ? readSourceBuffer(diagnostic.filename) : null;
-		const relatedLocations = buildRelatedLocations(diagnostic.labels, normalizedFilePath);
+		const relatedLocations = buildRelatedLocations(diagnostic.labels, normalizedFilePath, mappedSourceFilename === void 0 ? null : sourceBuffer);
 		const category = resolveDiagnosticCategory(plugin, rule);
 		const matchByOccurrence = resolveMatchByOccurrence(rule, category);
 		const sourceLines = primarySpan ? readSourceLines(diagnostic.filename) : null;
-		const primaryLineIndex = primarySpan ? primarySpan.line - 1 : -1;
+		const primaryLineNumber = primarySpan && mappedSourceFilename !== void 0 && sourceBuffer !== null ? lineOfUtf8Offset(sourceBuffer, primarySpan.offset) : primarySpan?.line ?? 0;
+		const primaryColumnNumber = primarySpan && mappedSourceFilename !== void 0 && sourceBuffer !== null ? columnOfUtf8Offset(sourceBuffer, primarySpan.offset) : primarySpan?.column ?? 0;
+		const primaryLineIndex = primarySpan ? primaryLineNumber - 1 : -1;
 		const primaryLine = sourceLines?.[primaryLineIndex];
-		const primaryColumnIndex = primarySpan ? primarySpan.column - 1 : -1;
+		const primaryColumnIndex = primarySpan ? primaryColumnNumber - 1 : -1;
 		const isJsxTagLabel = primaryLine !== void 0 && primaryColumnIndex >= 0 && (primaryLine[primaryColumnIndex] === "<" || primaryLine[primaryColumnIndex - 1] === "<");
 		const jsxOpenerEndLineIndex = sourceLines && isJsxTagLabel ? findJsxOpenerSpan(sourceLines, primaryLineIndex) : null;
 		const primarySpanEndLine = jsxOpenerEndLineIndex !== null ? jsxOpenerEndLineIndex + 1 : primarySpan && sourceBuffer ? lineOfUtf8Offset(sourceBuffer, primarySpan.offset + Math.max(primarySpan.length - 1, 0)) : void 0;
@@ -74652,8 +74664,8 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 			message: cleaned.message,
 			help: cleaned.help,
 			url: diagnostic.url,
-			line: primarySpan?.line ?? 0,
-			column: primarySpan?.column ?? 0,
+			line: primaryLineNumber,
+			column: primaryColumnNumber,
 			...primarySpan ? {
 				offset: primarySpan.offset,
 				length: primarySpan.length,
@@ -74841,7 +74853,11 @@ const isParallelismRelatedSpawnError = (error) => {
 * loop with a slimmer config in that case.
 */
 const spawnLintBatches = async (input) => {
-	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, onPartialFailure, onFileProgress, spawnTimeoutMs, outputMaxBytes, splitTotalBudgetMs = OXLINT_SPLIT_TOTAL_BUDGET_MS, splitMaxDepth = 8, signal, deadlineEpochMs } = input;
+	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, sourcePathByLintPath, onPartialFailure, onFileProgress, spawnTimeoutMs, outputMaxBytes, splitTotalBudgetMs = OXLINT_SPLIT_TOTAL_BUDGET_MS, splitMaxDepth = 8, signal, deadlineEpochMs } = input;
+	const resolveSourcePath = (filePath) => {
+		const absoluteFilePath = Path.isAbsolute(filePath) ? filePath : Path.resolve(rootDirectory, filePath);
+		return sourcePathByLintPath?.get(Path.normalize(absoluteFilePath)) ?? filePath;
+	};
 	const requestedConcurrency = resolveScanConcurrency(input.concurrency ?? 1);
 	let rescueDeadlineEpochMs;
 	const isPastDeadline = () => deadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(deadlineEpochMs) === 0 || rescueDeadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(rescueDeadlineEpochMs) === 0;
@@ -74861,7 +74877,7 @@ const spawnLintBatches = async (input) => {
 			}
 			const batchArgs = [...baseArgs, ...batch];
 			try {
-				return parseOxlintOutput(await spawnOxlint(batchArgs, rootDirectory, nodeBinaryPath, spawnTimeoutMs, outputMaxBytes, signal), project, rootDirectory);
+				return parseOxlintOutput(await spawnOxlint(batchArgs, rootDirectory, nodeBinaryPath, spawnTimeoutMs, outputMaxBytes, signal), project, rootDirectory, sourcePathByLintPath);
 			} catch (error) {
 				if (!isSplittableReactDoctorError(error)) throw error;
 				if (isPastDeadline()) {
@@ -74967,10 +74983,12 @@ const spawnLintBatches = async (input) => {
 		onPartialFailure(buildMessage(`${skippedFiles.slice(0, 3).join(", ")}${skippedFiles.length > 3 ? `, +${skippedFiles.length - 3} more` : ""}`));
 	};
 	const reasonHint = firstDropReason ? ` — first failure: ${firstDropReason}` : "";
-	reportSkippedFiles(droppedFiles, (fileListPreview) => `${droppedFiles.length} file(s) failed to lint and were skipped (${fileListPreview})${reasonHint}`);
-	reportSkippedFiles(outcome.deadlineSkippedFiles, (fileListPreview) => `${outcome.deadlineSkippedFiles.length} file(s) skipped — max scan duration reached before they were linted (${fileListPreview})`);
+	const droppedSourceFiles = [...new Set(droppedFiles.map(resolveSourcePath))];
+	const deadlineSkippedSourceFiles = [...new Set(outcome.deadlineSkippedFiles.map(resolveSourcePath))];
+	reportSkippedFiles(droppedSourceFiles, (fileListPreview) => `${droppedSourceFiles.length} file(s) failed to lint and were skipped (${fileListPreview})${reasonHint}`);
+	reportSkippedFiles(deadlineSkippedSourceFiles, (fileListPreview) => `${deadlineSkippedSourceFiles.length} file(s) skipped — max scan duration reached before they were linted (${fileListPreview})`);
 	const unavailableFiles = new Set([...droppedFiles, ...outcome.deadlineSkippedFiles]);
-	input.onAnalyzedFiles?.([...new Set(fileBatches.flat().filter((filePath) => !unavailableFiles.has(filePath)))].sort());
+	input.onAnalyzedFiles?.([...new Set(fileBatches.flat().filter((filePath) => !unavailableFiles.has(filePath)).map(resolveSourcePath))].sort());
 	return dedupeDiagnostics(diagnostics);
 };
 let didValidate = false;
@@ -75069,6 +75087,266 @@ const planLintBatches = ({ baseArgs, files, sizeByFile }) => {
 	}
 	return batches.filter((batch) => batch.fileIndexes.length > 0).map((batch) => batch.fileIndexes.sort((leftIndex, rightIndex) => leftIndex - rightIndex).map((fileIndex) => files[fileIndex]));
 };
+const THREE_MODULE_IMPORT_PATTERN = /\b(?:from\s*|import\s*(?:\(\s*)?|require\s*\(\s*)["']three(?:\/[^"']*)?["']/;
+const containsThreeModuleImport = (sourceText) => THREE_MODULE_IMPORT_PATTERN.test(sourceText);
+const COMMENT_OPEN = "<!--";
+const COMMENT_CLOSE = "-->";
+const FRONTMATTER_FENCE = "---";
+const SCRIPT_TAG_NAME = "script";
+const SCRIPT_OPEN = `<${SCRIPT_TAG_NAME}`;
+const SCRIPT_CLOSE = `</${SCRIPT_TAG_NAME}`;
+const TEMPLATE_TAG_NAME = "template";
+const TEMPLATE_CLOSE = `</${TEMPLATE_TAG_NAME}`;
+const JAVASCRIPT_MIME_TYPES = new Set([
+	"application/ecmascript",
+	"application/javascript",
+	"application/x-ecmascript",
+	"application/x-javascript",
+	"text/ecmascript",
+	"text/javascript",
+	"text/javascript1.0",
+	"text/javascript1.1",
+	"text/javascript1.2",
+	"text/javascript1.3",
+	"text/javascript1.4",
+	"text/javascript1.5",
+	"text/jscript",
+	"text/livescript",
+	"text/x-ecmascript",
+	"text/x-javascript"
+]);
+const RAW_TEXT_TAG_NAMES = new Set([
+	"iframe",
+	"noembed",
+	"noframes",
+	"noscript",
+	"style",
+	"textarea",
+	"title",
+	"xmp"
+]);
+const PLAINTEXT_TAG_NAME = "plaintext";
+const TAG_OPEN_UTF8_BYTE = "<".charCodeAt(0);
+const TAG_CLOSE_UTF8_BYTE = ">".charCodeAt(0);
+const SINGLE_QUOTE_UTF8_BYTE = "'".charCodeAt(0);
+const DOUBLE_QUOTE_UTF8_BYTE = "\"".charCodeAt(0);
+const ATTRIBUTE_ASSIGNMENT_UTF8_BYTE = "=".charCodeAt(0);
+const TAG_SELF_CLOSE_UTF8_BYTE = "/".charCodeAt(0);
+const TAB_UTF8_BYTE = "	".charCodeAt(0);
+const FORM_FEED_UTF8_BYTE = "\f".charCodeAt(0);
+const isHtmlWhitespace = (byte) => byte === TAB_UTF8_BYTE || byte === 10 || byte === FORM_FEED_UTF8_BYTE || byte === 13 || byte === 32;
+const matchesAsciiCaseInsensitive = (sourceBuffer, startByte, expected) => {
+	if (startByte + expected.length > sourceBuffer.length) return false;
+	for (let expectedIndex = 0; expectedIndex < expected.length; expectedIndex++) {
+		const sourceByte = sourceBuffer[startByte + expectedIndex];
+		if (sourceByte === void 0 || String.fromCharCode(sourceByte).toLowerCase() !== expected[expectedIndex]) return false;
+	}
+	return true;
+};
+const isTagBoundary = (byte) => byte === TAG_CLOSE_UTF8_BYTE || byte === TAG_SELF_CLOSE_UTF8_BYTE || isHtmlWhitespace(byte);
+const isPotentialTagStart = (byte) => {
+	if (byte === void 0) return false;
+	return /[A-Za-z!/?]/.test(String.fromCharCode(byte));
+};
+const findLineEnd = (sourceBuffer, lineStartByte) => {
+	let byteIndex = lineStartByte;
+	while (byteIndex < sourceBuffer.length && sourceBuffer[byteIndex] !== 10 && sourceBuffer[byteIndex] !== 13) byteIndex++;
+	return byteIndex;
+};
+const findNextLineStart = (sourceBuffer, lineStartByte) => {
+	const lineEndByte = findLineEnd(sourceBuffer, lineStartByte);
+	if (sourceBuffer[lineEndByte] === 13 && sourceBuffer[lineEndByte + 1] === 10) return lineEndByte + 2;
+	return Math.min(lineEndByte + 1, sourceBuffer.length);
+};
+const isFrontmatterFenceLine = (sourceBuffer, lineStartByte) => {
+	if (!matchesAsciiCaseInsensitive(sourceBuffer, lineStartByte, FRONTMATTER_FENCE)) return false;
+	const lineEndByte = findLineEnd(sourceBuffer, lineStartByte);
+	for (let byteIndex = lineStartByte + 3; byteIndex < lineEndByte; byteIndex++) if (!isHtmlWhitespace(sourceBuffer[byteIndex])) return false;
+	return true;
+};
+const findFrontmatterEnd = (sourceBuffer) => {
+	if (!isFrontmatterFenceLine(sourceBuffer, 0)) return 0;
+	const openingFenceEndByte = findLineEnd(sourceBuffer, 0);
+	let lineStartByte = findNextLineStart(sourceBuffer, 0);
+	while (lineStartByte < sourceBuffer.length) {
+		if (isFrontmatterFenceLine(sourceBuffer, lineStartByte)) return findLineEnd(sourceBuffer, lineStartByte);
+		lineStartByte = findNextLineStart(sourceBuffer, lineStartByte);
+	}
+	return openingFenceEndByte;
+};
+const maskByteRange = (maskedBuffer, startByte, endByte) => {
+	for (let byteIndex = startByte; byteIndex < endByte; byteIndex++) {
+		const byte = maskedBuffer[byteIndex];
+		if (byte !== 10 && byte !== 13) maskedBuffer[byteIndex] = 32;
+	}
+};
+const readStartTagName = (sourceBuffer, tagStartByte) => {
+	const firstNameByte = sourceBuffer[tagStartByte + 1];
+	if (firstNameByte === void 0 || !/[A-Za-z]/.test(String.fromCharCode(firstNameByte))) return null;
+	let nameEndByte = tagStartByte + 2;
+	while (nameEndByte < sourceBuffer.length && /[A-Za-z0-9:-]/.test(String.fromCharCode(sourceBuffer[nameEndByte] ?? 32))) nameEndByte++;
+	return sourceBuffer.subarray(tagStartByte + 1, nameEndByte).toString("ascii").toLowerCase();
+};
+const findTagEnd = (sourceBuffer, startByte) => {
+	let quoteByte = null;
+	for (let byteIndex = startByte; byteIndex < sourceBuffer.length; byteIndex++) {
+		const byte = sourceBuffer[byteIndex];
+		if (quoteByte !== null) {
+			if (byte === quoteByte) quoteByte = null;
+			continue;
+		}
+		if (byte === SINGLE_QUOTE_UTF8_BYTE || byte === DOUBLE_QUOTE_UTF8_BYTE) {
+			quoteByte = byte;
+			continue;
+		}
+		if (byte === TAG_CLOSE_UTF8_BYTE) return byteIndex;
+	}
+	return sourceBuffer.length;
+};
+const parseScriptAttributes = (sourceBuffer, attributesStartByte, tagEndByte) => {
+	let byteIndex = attributesStartByte;
+	let hasSource = false;
+	let language = null;
+	let scriptType = null;
+	while (byteIndex < tagEndByte) {
+		while (byteIndex < tagEndByte && (isHtmlWhitespace(sourceBuffer[byteIndex]) || sourceBuffer[byteIndex] === TAG_SELF_CLOSE_UTF8_BYTE)) byteIndex++;
+		const attributeNameStartByte = byteIndex;
+		while (byteIndex < tagEndByte && !isHtmlWhitespace(sourceBuffer[byteIndex]) && sourceBuffer[byteIndex] !== ATTRIBUTE_ASSIGNMENT_UTF8_BYTE && sourceBuffer[byteIndex] !== TAG_SELF_CLOSE_UTF8_BYTE) byteIndex++;
+		const attributeName = sourceBuffer.subarray(attributeNameStartByte, byteIndex).toString("ascii").toLowerCase();
+		while (byteIndex < tagEndByte && isHtmlWhitespace(sourceBuffer[byteIndex])) byteIndex++;
+		let attributeValue = "";
+		if (sourceBuffer[byteIndex] === ATTRIBUTE_ASSIGNMENT_UTF8_BYTE) {
+			byteIndex++;
+			while (byteIndex < tagEndByte && isHtmlWhitespace(sourceBuffer[byteIndex])) byteIndex++;
+			const quoteByte = sourceBuffer[byteIndex];
+			if (quoteByte === SINGLE_QUOTE_UTF8_BYTE || quoteByte === DOUBLE_QUOTE_UTF8_BYTE) {
+				const valueStartByte = byteIndex + 1;
+				byteIndex = valueStartByte;
+				while (byteIndex < tagEndByte && sourceBuffer[byteIndex] !== quoteByte) byteIndex++;
+				attributeValue = sourceBuffer.subarray(valueStartByte, byteIndex).toString("utf8");
+				if (byteIndex < tagEndByte) byteIndex++;
+			} else {
+				const valueStartByte = byteIndex;
+				while (byteIndex < tagEndByte && !isHtmlWhitespace(sourceBuffer[byteIndex]) && sourceBuffer[byteIndex] !== TAG_CLOSE_UTF8_BYTE) byteIndex++;
+				attributeValue = sourceBuffer.subarray(valueStartByte, byteIndex).toString("utf8");
+			}
+		}
+		if (attributeName === "src") hasSource = true;
+		else if (attributeName === "type" && scriptType === null) scriptType = attributeValue;
+		else if (attributeName === "language" && language === null) language = attributeValue;
+	}
+	return {
+		hasSource,
+		language,
+		type: scriptType
+	};
+};
+const isExecutableScript = (attributes) => {
+	if (attributes.hasSource) return false;
+	const type = attributes.type?.trim().toLowerCase() ?? "";
+	if (type !== "") {
+		const mimeType = type.split(";")[0]?.trim() ?? "";
+		return mimeType === "module" || JAVASCRIPT_MIME_TYPES.has(mimeType);
+	}
+	const language = attributes.language?.trim().toLowerCase() ?? "";
+	return language === "" || JAVASCRIPT_MIME_TYPES.has(`text/${language}`);
+};
+const findElementClose = (sourceBuffer, startByte, tagName) => {
+	const closeTagStart = `</${tagName}`;
+	for (let byteIndex = startByte; byteIndex < sourceBuffer.length; byteIndex++) if (sourceBuffer[byteIndex] === TAG_OPEN_UTF8_BYTE && matchesAsciiCaseInsensitive(sourceBuffer, byteIndex, closeTagStart) && isTagBoundary(sourceBuffer[byteIndex + closeTagStart.length])) return byteIndex;
+	return sourceBuffer.length;
+};
+const prepareHtmlScriptSource = (sourceBuffer) => {
+	const frontmatterEndByte = findFrontmatterEnd(sourceBuffer);
+	let maskedBuffer = frontmatterEndByte > 0 ? Buffer.from(sourceBuffer) : null;
+	if (maskedBuffer !== null) maskByteRange(maskedBuffer, 0, frontmatterEndByte);
+	const executableScriptBodies = [];
+	let byteIndex = frontmatterEndByte;
+	let templateDepth = 0;
+	while (byteIndex < sourceBuffer.length) {
+		if (sourceBuffer[byteIndex] !== TAG_OPEN_UTF8_BYTE) {
+			byteIndex++;
+			continue;
+		}
+		if (matchesAsciiCaseInsensitive(sourceBuffer, byteIndex, COMMENT_OPEN)) {
+			const commentEndByte = sourceBuffer.indexOf(COMMENT_CLOSE, byteIndex + 4);
+			byteIndex = commentEndByte === -1 ? sourceBuffer.length : commentEndByte + 3;
+			continue;
+		}
+		if (matchesAsciiCaseInsensitive(sourceBuffer, byteIndex, TEMPLATE_CLOSE) && isTagBoundary(sourceBuffer[byteIndex + TEMPLATE_CLOSE.length])) {
+			const tagEndByte = findTagEnd(sourceBuffer, byteIndex + TEMPLATE_CLOSE.length);
+			if (templateDepth > 0) templateDepth--;
+			byteIndex = Math.min(tagEndByte + 1, sourceBuffer.length);
+			continue;
+		}
+		if (!matchesAsciiCaseInsensitive(sourceBuffer, byteIndex, SCRIPT_OPEN) || !isTagBoundary(sourceBuffer[byteIndex + SCRIPT_OPEN.length])) {
+			if (!isPotentialTagStart(sourceBuffer[byteIndex + 1])) {
+				byteIndex++;
+				continue;
+			}
+			const tagEndByte = findTagEnd(sourceBuffer, byteIndex + 1);
+			const tagName = readStartTagName(sourceBuffer, byteIndex);
+			if (tagName === PLAINTEXT_TAG_NAME) break;
+			if (tagName === TEMPLATE_TAG_NAME) templateDepth++;
+			if (tagName !== null && RAW_TEXT_TAG_NAMES.has(tagName)) {
+				const closeTagStartByte = findElementClose(sourceBuffer, tagEndByte + 1, tagName);
+				if (closeTagStartByte === sourceBuffer.length) break;
+				const closeTagEndByte = findTagEnd(sourceBuffer, closeTagStartByte + tagName.length + 2);
+				byteIndex = Math.min(closeTagEndByte + 1, sourceBuffer.length);
+				continue;
+			}
+			byteIndex = Math.min(tagEndByte + 1, sourceBuffer.length);
+			continue;
+		}
+		const tagEndByte = findTagEnd(sourceBuffer, byteIndex + SCRIPT_OPEN.length);
+		if (tagEndByte === sourceBuffer.length) break;
+		const bodyStartByte = tagEndByte + 1;
+		const bodyEndByte = findElementClose(sourceBuffer, bodyStartByte, SCRIPT_TAG_NAME);
+		const attributes = parseScriptAttributes(sourceBuffer, byteIndex + SCRIPT_OPEN.length, tagEndByte);
+		if (attributes.hasSource || templateDepth > 0) {
+			maskedBuffer ??= Buffer.from(sourceBuffer);
+			maskByteRange(maskedBuffer, bodyStartByte, bodyEndByte);
+		} else if (isExecutableScript(attributes)) executableScriptBodies.push(sourceBuffer.subarray(bodyStartByte, bodyEndByte));
+		if (bodyEndByte === sourceBuffer.length) break;
+		const closeTagEndByte = findTagEnd(sourceBuffer, bodyEndByte + SCRIPT_CLOSE.length);
+		byteIndex = Math.min(closeTagEndByte + 1, sourceBuffer.length);
+	}
+	return {
+		executableScriptBodies,
+		lintBuffer: maskedBuffer ?? sourceBuffer
+	};
+};
+const prepareHtmlLintSources = (rootDirectory, temporaryDirectory, candidateFiles) => {
+	const lintFiles = [];
+	const sourcePathByLintPath = /* @__PURE__ */ new Map();
+	const sizeByLintPath = /* @__PURE__ */ new Map();
+	const htmlSourcesDirectory = Path.join(temporaryDirectory, "html-sources");
+	let htmlFileIndex = 0;
+	let hasThreeModuleImport = false;
+	for (const candidateFile of candidateFiles) {
+		if (!HTML_FILE_PATTERN.test(candidateFile)) {
+			lintFiles.push(candidateFile);
+			continue;
+		}
+		const absoluteSourcePath = Path.isAbsolute(candidateFile) ? candidateFile : Path.resolve(rootDirectory, candidateFile);
+		const sourceBuffer = NFS.readFileSync(absoluteSourcePath);
+		const { executableScriptBodies, lintBuffer } = prepareHtmlScriptSource(sourceBuffer);
+		if (htmlFileIndex === 0) NFS.mkdirSync(htmlSourcesDirectory, { recursive: true });
+		const lintPath = Path.join(htmlSourcesDirectory, `${htmlFileIndex}.astro`);
+		NFS.writeFileSync(lintPath, lintBuffer);
+		lintFiles.push(lintPath);
+		sourcePathByLintPath.set(Path.resolve(lintPath), candidateFile);
+		sizeByLintPath.set(lintPath, sourceBuffer.length);
+		hasThreeModuleImport ||= executableScriptBodies.some((scriptBody) => containsThreeModuleImport(scriptBody.toString("utf8")));
+		htmlFileIndex++;
+	}
+	return {
+		lintFiles,
+		sourcePathByLintPath,
+		sizeByLintPath,
+		hasThreeModuleImport
+	};
+};
 /**
 * Atomically (re)writes the generated oxlintrc.json. Used twice in
 * the runner: once for the primary scan, once for the
@@ -75242,21 +75520,6 @@ const runOxlint = async (options) => {
 	const pluginPath = resolvePluginPath();
 	const extendsPaths = (adoptExistingLintConfig && !customRulesOnly ? detectUserLintConfigPaths(rootDirectory) : []).filter(canOxlintExtendConfig);
 	const userPlugins = includedTags.size > 0 ? [] : resolveUserPlugins(userConfig?.plugins, configSourceDirectory);
-	const buildConfig = (overrides) => createOxlintConfig({
-		pluginPath,
-		project,
-		customRulesOnly,
-		extendsPaths: overrides.extendsPaths,
-		ignoredTags,
-		includedTags,
-		includeTagDefaults,
-		serverAuthFunctionNames,
-		severityControls,
-		userPlugins,
-		disableReactHooksJsPlugin: overrides.disableReactHooksJsPlugin,
-		ruleSelection: overrides.ruleSelection,
-		sidecarRuleIdFilter: overrides.sidecarRuleIdFilter
-	});
 	const restoreDisableDirectives = respectInlineDisables ? () => {} : await neutralizeDisableDirectives(rootDirectory, includePaths);
 	const configDirectory = NFS.mkdtempSync(Path.join(os.tmpdir(), "react-doctor-oxlintrc-"));
 	const configPath = Path.join(configDirectory, "oxlintrc.json");
@@ -75292,7 +75555,30 @@ const runOxlint = async (options) => {
 		await yieldToEventLoop();
 		const sizedScanFiles = includePaths === void 0 ? listSourceFilesWithSize(rootDirectory) : null;
 		const candidateFiles = includePaths !== void 0 ? includePaths : (sizedScanFiles ?? []).map((entry) => entry.path);
+		const preparedHtmlSources = prepareHtmlLintSources(rootDirectory, configDirectory, candidateFiles);
+		const lintFiles = preparedHtmlSources.lintFiles;
+		const hasHtmlFiles = preparedHtmlSources.sourcePathByLintPath.size > 0;
+		const lintProject = !project.hasThree && preparedHtmlSources.hasThreeModuleImport ? {
+			...project,
+			hasThree: true
+		} : project;
+		const buildConfig = (overrides) => createOxlintConfig({
+			pluginPath,
+			project: lintProject,
+			customRulesOnly,
+			extendsPaths: overrides.extendsPaths,
+			ignoredTags,
+			includedTags,
+			includeTagDefaults,
+			serverAuthFunctionNames,
+			severityControls,
+			userPlugins,
+			disableReactHooksJsPlugin: overrides.disableReactHooksJsPlugin,
+			ruleSelection: overrides.ruleSelection,
+			sidecarRuleIdFilter: overrides.sidecarRuleIdFilter
+		});
 		const sizeByFile = sizedScanFiles !== null && lintBatchOrdering === "cost" ? new Map(sizedScanFiles.map((entry) => [entry.path, entry.sizeBytes])) : null;
+		if (sizeByFile !== null) for (const [lintPath, sizeBytes] of preparedHtmlSources.sizeByLintPath) sizeByFile.set(lintPath, sizeBytes);
 		const buildFileBatches = (passBaseArgs, passFiles) => sizeByFile !== null ? planLintBatches({
 			baseArgs: passBaseArgs,
 			files: passFiles,
@@ -75321,7 +75607,8 @@ const runOxlint = async (options) => {
 					fileBatches: passFileBatches,
 					rootDirectory,
 					nodeBinaryPath,
-					project,
+					project: lintProject,
+					sourcePathByLintPath: preparedHtmlSources.sourcePathByLintPath,
 					onPartialFailure: reportPartialFailure,
 					onAnalyzedFiles: (filePaths) => {
 						analyzedFiles = filePaths;
@@ -75356,7 +75643,7 @@ const runOxlint = async (options) => {
 				};
 			}
 		};
-		if (perFileLintCacheEnabled && !project.hasReactCompiler && project.hasReactCompilerLintPlugin !== true && extendsPaths.length === 0 && userPlugins.length === 0) {
+		if (perFileLintCacheEnabled && !project.hasReactCompiler && project.hasReactCompilerLintPlugin !== true && extendsPaths.length === 0 && userPlugins.length === 0 && !hasHtmlFiles) {
 			const rulesetHash = computeRulesetHash({
 				config: buildConfig({
 					extendsPaths: [],
@@ -75514,14 +75801,15 @@ const runOxlint = async (options) => {
 			]);
 		}
 		const baseArgs = makeBaseArgs(configPath);
-		const fileBatches = buildFileBatches(baseArgs, candidateFiles);
+		const fileBatches = buildFileBatches(baseArgs, lintFiles);
 		let analyzedFiles = [];
 		const runBatches = () => spawnLintBatches({
 			baseArgs,
 			fileBatches,
 			rootDirectory,
 			nodeBinaryPath,
-			project,
+			project: lintProject,
+			sourcePathByLintPath: preparedHtmlSources.sourcePathByLintPath,
 			onPartialFailure,
 			onAnalyzedFiles: (filePaths) => {
 				analyzedFiles = filePaths;
@@ -77728,7 +78016,7 @@ const makeNoopConsole = () => ({
 });
 //#endregion
 //#region src/cli/utils/version.ts
-const VERSION = "0.9.1-dev.5d2f66d";
+const VERSION = "0.9.1-dev.8534d86";
 //#endregion
 //#region src/cli/utils/json-mode.ts
 let context = null;
@@ -78086,13 +78374,13 @@ const isDevVersion = (version) => version === "0.0.0" || version.includes("-");
 * uploads source-map artifacts under, so stack frames symbolicate. Honors the
 * standard `SENTRY_RELEASE` override.
 */
-const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.9.1-dev.5d2f66d`;
+const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.9.1-dev.8534d86`;
 /**
 * Deployment environment shown in Sentry's environment filter. Defaults to
 * `production` for tagged releases and `development` for dev/unbuilt versions,
 * overridable via the standard `SENTRY_ENVIRONMENT` env var.
 */
-const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.9.1-dev.5d2f66d") ? "development" : "production");
+const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.9.1-dev.8534d86") ? "development" : "production");
 /**
 * Performance-tracing sample rate in `[0, 1]`. Reads `SENTRY_TRACES_SAMPLE_RATE`
 * (set to `0` to disable tracing) and falls back to
@@ -90757,6 +91045,7 @@ const buildScanAttributes = (input) => {
 		rulesDisabled: ruleKeys.filter((key) => ruleOverrides[key] === "off").length,
 		fileCount: input.result?.scannedFileCount ?? null,
 		nonJsxFileCount: input.result?.analyzedFiles?.filter((filePath) => !JSX_FILE_PATTERN.test(filePath)).length ?? null,
+		htmlFileCount: input.result?.analyzedFiles?.filter((filePath) => HTML_FILE_PATTERN.test(filePath)).length ?? null,
 		multilineDiagnosticCount: input.result?.diagnostics.filter((diagnostic) => (diagnostic.endLine ?? diagnostic.line) > diagnostic.line).length ?? null
 	});
 };
@@ -96810,7 +97099,7 @@ ${highlighter.dim("Learn more:")}
   ${highlighter.info(CI_URL)}
 `;
 const collectCategoryOption = (value, previousValues) => [...previousValues ?? [], value];
-const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--supply-chain", "enable the dependency supply-chain scan (default)").option("--no-supply-chain", "skip the dependency supply-chain scan (Socket.dev dependency health checks)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("--json-out <path>", "with --json, write the report to a file instead of stdout").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much supported JS/TS source to scan/report: full (default), files, changed (only new issues vs base), or lines (issues whose source spans touch changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").option("--include-untracked", "with --scope files/changed/lines, also scan ordinary untracked files (respects .gitignore)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--max-duration <seconds>", "scan time budget for the whole run, shared across workspace projects: past it, remaining lint batches and dead-code are skipped and partial results are reported (skipped files are listed in the JSON report)").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
+const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--supply-chain", "enable the dependency supply-chain scan (default)").option("--no-supply-chain", "skip the dependency supply-chain scan (Socket.dev dependency health checks)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("--json-out <path>", "with --json, write the report to a file instead of stdout").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much supported JS/TS and inline HTML script source to scan/report: full (default), files, changed (only new issues vs base), or lines (issues whose source spans touch changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").option("--include-untracked", "with --scope files/changed/lines, also scan ordinary untracked files (respects .gitignore)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks").option("--max-duration <seconds>", "scan time budget for the whole run, shared across workspace projects: past it, remaining lint batches and dead-code are skipped and partial results are reported (skipped files are listed in the JSON report)").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
 program.action(inspectAction);
 program.command("design [directory]").description("Run only the focused UI design diagnostics").addHelpText("after", renderDesignHelpEpilog).action((directory, _options, command) => designAction(directory ?? ".", command.optsWithGlobals()));
 program.command("why <location>").description("Explain why a rule fired (or why a suppression didn't apply) at a file:line").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple)").option("-c, --cwd <cwd>", "working directory", process.cwd()).option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").action((location, options) => whyAction(location, options));
@@ -96890,4 +97179,4 @@ Promise.resolve().then(() => assertNoRemovedFlags(process.argv)).then(() => prog
 export { toForwardSlashes as A, highlighter as B, buildRulePriorityMap as C, resolveBlockingLevel as D, formatLearnMoreLine as E, isCiEnvironment as F, sync as G, mergeReactDoctorConfigs as H, DIAGNOSTIC_CATEGORY_BUCKETS as I, void_ as K, Progress as L, isUnicodeSupported as M, METRIC as N, isReactDoctorWorkflowInstalled as O, TUI_REPORT_DETAIL_WIDTH_FRACTION as P, Reporter as R, hasLintHardFailure as S, formatFixRecipeLine as T, resolveScanTarget as U, mapWithConcurrency as V, runPromise as W, canAnimateOnboarding as _, resolveCliInspectOptions as a, buildCodeFrame as b, detectLaunchableAgents as c, launchCliAgent as d, isShareOptedOut as f, doctorFace as g, easeOutCubic as h, selectProjects as i, findNearestPackageDirectory as j, recordCount as k, CLI_AGENT_BINARIES as l, printFooter as m, shouldFailScanGate as n, countUniqueScannedFiles as o, inspect as p, succeed$3 as q, discoverWorkspacePackages as r, setUpGitHubActions as s, exitGracefully as t, copyToClipboard as u, computeProjectedScore as v, buildSortedRuleGroups as w, buildNoScoreMessage as x, formatElapsedTime as y, getCategoryImpact as z };
 
 //# sourceMappingURL=cli.js.map
-//# debugId=ea274003-c9c6-5b5c-b839-b1545ccc48fa
+//# debugId=68199c0f-9834-55ef-9753-efce9ed982ad

package/dist/index.d.ts

@@ -9706,7 +9706,7 @@ interface DiagnoseOptions {
   /** See `ReactDoctorConfig.deadCode`. Ignored in diff mode. */
   deadCode?: boolean;
   verbose?: boolean;
-  /** Restrict linting to these supported JS/TS source files. */
+  /** Restrict linting to supported JS/TS files and inline scripts in HTML files. */
   includePaths?: string[];
   /**
    * Per-call override for `ReactDoctorConfig.respectInlineDisables`.
@@ -9969,7 +9969,7 @@ interface JsonReportProjectEntry {
   skippedCheckReasons?: Record<string, string>;
   /**
    * Number of source files this scan's linter examined. In diff / changed
-   * mode it's the count of changed supported JS/TS source files; in a full
+   * mode it's the count of changed supported JS/TS and HTML source files; in a full
    * scan it's the whole source tree. `0` in a diff scan means the changed
    * files held nothing React Doctor lints —
    * the GitHub Action reads that as "nothing to report" (skips the PR comment;