slopbrick 0.15.0 → 0.17.1

package/dist/engine/worker.cjs

@@ -25,7 +25,7 @@ __export(worker_exports, {
 });
 module.exports = __toCommonJS(worker_exports);
 var import_node_worker_threads = require("worker_threads");
-var import_node_path6 = require("path");
+var import_node_path11 = require("path");
 
 // ../engine/dist/index.js
 var import_promises = require("fs/promises");
@@ -33771,6 +33771,339 @@ var importPathMismatchRule = createRule({
   }
 });
 
+// src/rules/db/duplicate-index.ts
+var import_pgsql_parser = require("pgsql-parser");
+var moduleReady = (0, import_pgsql_parser.loadModule)();
+function parseStatements(raw) {
+  let result;
+  try {
+    result = (0, import_pgsql_parser.parseSync)(raw);
+  } catch {
+    return null;
+  }
+  const stmts = [];
+  for (const wrapper of result?.stmts ?? []) {
+    const inner = wrapper.stmt ?? {};
+    const type = Object.keys(inner)[0] ?? "Other";
+    stmts.push({ type, ast: inner[type] });
+  }
+  return stmts;
+}
+var duplicateIndexRule = createRule({
+  id: "db/duplicate-index",
+  category: "db",
+  severity: "high",
+  aiSpecific: false,
+  description: "Two CREATE INDEX statements cover the same column list on the same table \u2014 drop one.",
+  create(context) {
+    return context;
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    const stmts = parseStatements(source);
+    if (!stmts) return issues;
+    const seen = /* @__PURE__ */ new Map();
+    for (const stmt of stmts) {
+      if (stmt.type !== "IndexStmt") continue;
+      const idx = stmt.ast;
+      const idxName = idx.idxname ?? "?";
+      const cols = (idx.indexParams ?? []).map((p) => p.IndexElem?.name ?? "?").sort();
+      const key = cols.join(",");
+      if (key === "") continue;
+      const table = idx.relation?.relname ?? "";
+      if (seen.has(key)) {
+        const prev = seen.get(key);
+        if (prev.indexName === idxName && prev.table === table) continue;
+        issues.push({
+          ruleId: "db/duplicate-index",
+          category: "db",
+          severity: "high",
+          aiSpecific: false,
+          message: `Index \`${idxName}\` duplicates \`${prev.indexName}\` on the same column list (${cols.join(", ")}).`,
+          line: 1,
+          column: 1,
+          advice: `Drop one of the two indexes \u2014 extra indexes slow writes without benefit.`
+        });
+      } else {
+        seen.set(key, { indexName: idxName, table });
+      }
+    }
+    return issues;
+  }
+});
+
+// src/rules/db/enum-sprawl.ts
+var import_pgsql_parser2 = require("pgsql-parser");
+var moduleReady2 = (0, import_pgsql_parser2.loadModule)();
+function parseStatements2(raw) {
+  let result;
+  try {
+    result = (0, import_pgsql_parser2.parseSync)(raw);
+  } catch {
+    return null;
+  }
+  const stmts = [];
+  for (const wrapper of result?.stmts ?? []) {
+    const inner = wrapper.stmt ?? {};
+    const type = Object.keys(inner)[0] ?? "Other";
+    stmts.push({ type, ast: inner[type] });
+  }
+  return stmts;
+}
+var ENUM_VALUES_MAX = 12;
+var enumSprawlRule = createRule({
+  id: "db/enum-sprawl",
+  category: "db",
+  severity: "low",
+  aiSpecific: false,
+  description: `CREATE TYPE \u2026 AS ENUM with >${ENUM_VALUES_MAX} values \u2014 brittle to extend; prefer a lookup table.`,
+  create(context) {
+    return context;
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    const stmts = parseStatements2(source);
+    if (!stmts) return issues;
+    for (const stmt of stmts) {
+      if (stmt.type !== "CreateEnumStmt") continue;
+      const en = stmt.ast;
+      const vals = (en.vals ?? []).map(
+        (v) => v.String?.sval ?? "?"
+      );
+      if (vals.length <= ENUM_VALUES_MAX) continue;
+      const typeName = (en.typeName?.names ?? []).map((n) => n.String?.sval).filter(Boolean).join(".");
+      issues.push({
+        ruleId: "db/enum-sprawl",
+        category: "db",
+        severity: "low",
+        aiSpecific: false,
+        message: `Enum \`${typeName}\` has ${vals.length} values (recommended max: ${ENUM_VALUES_MAX}).`,
+        line: 1,
+        column: 1,
+        advice: `Consider a lookup table. Enums with many values are brittle to extend and hard to localize.`
+      });
+    }
+    return issues;
+  }
+});
+
+// src/rules/db/missing-fk-index.ts
+var import_pgsql_parser3 = require("pgsql-parser");
+var moduleReady3 = (0, import_pgsql_parser3.loadModule)();
+function parseStatements3(raw) {
+  let result;
+  try {
+    result = (0, import_pgsql_parser3.parseSync)(raw);
+  } catch {
+    return null;
+  }
+  const stmts = [];
+  for (const wrapper of result?.stmts ?? []) {
+    const inner = wrapper.stmt ?? {};
+    const type = Object.keys(inner)[0] ?? "Other";
+    stmts.push({ type, ast: inner[type] });
+  }
+  return stmts;
+}
+var missingFkIndexRule = createRule({
+  id: "db/missing-fk-index",
+  category: "db",
+  severity: "high",
+  aiSpecific: false,
+  description: "Foreign key column without a matching CREATE INDEX in the same file \u2014 sequential scan on parent deletes.",
+  create(context) {
+    return context;
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    const stmts = parseStatements3(source);
+    if (!stmts) return issues;
+    const fkColsByTable = /* @__PURE__ */ new Map();
+    const idxColsByTable = /* @__PURE__ */ new Map();
+    for (const stmt of stmts) {
+      if (stmt.type === "CreateStmt") {
+        const cs = stmt.ast;
+        const tableName = cs?.relation?.relname;
+        if (!tableName || !Array.isArray(cs.tableElts)) continue;
+        for (const elt of cs.tableElts) {
+          const cd = elt.ColumnDef;
+          if (!cd || !Array.isArray(cd.constraints)) continue;
+          for (const con of cd.constraints) {
+            const c = con.Constraint;
+            if (!c) continue;
+            const isFk = c.contype === "CONSTR_FOREIGN" || Array.isArray(c.fk_attrs) && c.fk_attrs.length > 0 || c.pktable?.relation?.relname;
+            if (!isFk) continue;
+            if (!fkColsByTable.has(tableName)) fkColsByTable.set(tableName, /* @__PURE__ */ new Set());
+            fkColsByTable.get(tableName).add(cd.colname);
+          }
+        }
+      } else if (stmt.type === "IndexStmt") {
+        const idx = stmt.ast;
+        const tableName = idx.relation?.relname;
+        if (!tableName) continue;
+        if (!idxColsByTable.has(tableName)) idxColsByTable.set(tableName, /* @__PURE__ */ new Set());
+        for (const p of idx.indexParams ?? []) {
+          if (p.IndexElem?.name) idxColsByTable.get(tableName).add(p.IndexElem.name);
+        }
+      }
+    }
+    for (const [table, fkCols] of fkColsByTable) {
+      const idxCols = idxColsByTable.get(table) ?? /* @__PURE__ */ new Set();
+      for (const fk of fkCols) {
+        if (idxCols.has(fk)) continue;
+        issues.push({
+          ruleId: "db/missing-fk-index",
+          category: "db",
+          severity: "high",
+          aiSpecific: false,
+          message: `Foreign key column \`${table}.${fk}\` has no matching index.`,
+          line: 1,
+          column: 1,
+          advice: `Add \`CREATE INDEX ON ${table} (${fk});\`. Without an index, deletes on the parent table perform a sequential scan. Use \`CREATE INDEX CONCURRENTLY\` in production.`,
+          extras: { table, columnName: fk }
+        });
+      }
+    }
+    return issues;
+  }
+});
+
+// src/rules/db/missing-not-null.ts
+var import_pgsql_parser4 = require("pgsql-parser");
+var moduleReady4 = (0, import_pgsql_parser4.loadModule)();
+function parseStatements4(raw) {
+  let result;
+  try {
+    result = (0, import_pgsql_parser4.parseSync)(raw);
+  } catch {
+    return null;
+  }
+  const stmts = [];
+  for (const wrapper of result?.stmts ?? []) {
+    const inner = wrapper.stmt ?? {};
+    const type = Object.keys(inner)[0] ?? "Other";
+    stmts.push({ type, ast: inner[type] });
+  }
+  return stmts;
+}
+var REQUIRED_COLUMN_HEURISTIC = /^(id|user_?id|order_?id|product_?id|tenant_?id|customer_?id|email|created_?at|updated_?at|deleted_?at|expires_?at|status|uuid|slug|handle|key|name)$/i;
+var missingNotNullRule = createRule({
+  id: "db/missing-not-null",
+  category: "db",
+  severity: "high",
+  aiSpecific: false,
+  description: "Required-identifier column (id, email, created_at, \u2026) without NOT NULL \u2014 silent NULL inserts in production.",
+  create(context) {
+    return context;
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    const stmts = parseStatements4(source);
+    if (!stmts) return issues;
+    for (const stmt of stmts) {
+      if (stmt.type !== "CreateStmt") continue;
+      const cs = stmt.ast;
+      const tableName = cs?.relation?.relname;
+      if (!tableName || !Array.isArray(cs.tableElts)) continue;
+      for (const elt of cs.tableElts) {
+        const cd = elt.ColumnDef;
+        if (!cd) continue;
+        if (!REQUIRED_COLUMN_HEURISTIC.test(cd.colname ?? "")) continue;
+        const hasNotNull = (cd.constraints ?? []).some((c) => {
+          const con = c.Constraint;
+          return con?.contype === "CONSTR_NOTNULL" || con?.contype === "CONSTR_PRIMARY";
+        });
+        if (hasNotNull) continue;
+        issues.push({
+          ruleId: "db/missing-not-null",
+          category: "db",
+          severity: "high",
+          aiSpecific: false,
+          message: `Required column \`${tableName}.${cd.colname}\` is missing \`NOT NULL\`.`,
+          line: 1,
+          column: 1,
+          advice: `Add \`NOT NULL\` (or \`PRIMARY KEY\`). Optional identifiers are a common AI-generated SQL smell that leads to silent NULL inserts in production.`,
+          extras: { table: tableName, columnName: cd.colname }
+        });
+      }
+    }
+    return issues;
+  }
+});
+
+// src/rules/db/naming-inconsistency.ts
+var import_pgsql_parser5 = require("pgsql-parser");
+var moduleReady5 = (0, import_pgsql_parser5.loadModule)();
+function parseStatements5(raw) {
+  let result;
+  try {
+    result = (0, import_pgsql_parser5.parseSync)(raw);
+  } catch {
+    return null;
+  }
+  const stmts = [];
+  for (const wrapper of result?.stmts ?? []) {
+    const inner = wrapper.stmt ?? {};
+    const type = Object.keys(inner)[0] ?? "Other";
+    stmts.push({ type, ast: inner[type] });
+  }
+  return stmts;
+}
+var namingInconsistencyRule = createRule({
+  id: "db/naming-inconsistency",
+  category: "db",
+  severity: "low",
+  aiSpecific: false,
+  description: "snake_case and camelCase identifiers mix within one SQL file \u2014 standardize.",
+  create(context) {
+    return context;
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    const stmts = parseStatements5(source);
+    if (!stmts) return issues;
+    let snakeCount = 0;
+    let camelCount = 0;
+    function walk3(node) {
+      if (!node || typeof node !== "object") return;
+      if (Array.isArray(node)) {
+        for (const item of node) walk3(item);
+        return;
+      }
+      if (node.String?.sval && typeof node.String.sval === "string") {
+        const s = node.String.sval;
+        if (/^[a-z_][a-z0-9_]*$/.test(s)) snakeCount++;
+        else if (/^[a-z][A-Za-z0-9]*$/.test(s)) camelCount++;
+      }
+      for (const k of Object.keys(node)) walk3(node[k]);
+    }
+    walk3(stmts);
+    if (snakeCount >= 2 && camelCount >= 2) {
+      issues.push({
+        ruleId: "db/naming-inconsistency",
+        category: "db",
+        severity: "low",
+        aiSpecific: false,
+        message: `Mixed identifier styles: ${snakeCount} snake_case vs ${camelCount} camelCase.`,
+        line: 1,
+        column: 1,
+        advice: `Standardize on snake_case (Postgres convention) or document the deviation.`
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/utils.ts
 var LAYOUT_ARBITRARY_RE = /^(?:w|h|p|m|gap|space-x|space-y|px|py|mx|my|min-w|min-h|max-w|max-h|inset)-\[.*\]$/;
 var RADIUS_ARBITRARY_RE = /^(?:rounded|rounded-t|rounded-r|rounded-b|rounded-l|rounded-tl|rounded-tr|rounded-br|rounded-bl|rounded-ss|rounded-se|rounded-es|rounded-ee)-\[.*\]$/;
@@ -33929,6 +34262,577 @@ function parseStyleObject(source) {
   return entries;
 }
 
+// src/rules/db/sql-concat.ts
+var TEMPLATE_SQL_RE = /`((?:SELECT|INSERT\s+INTO|UPDATE|DELETE\s+FROM|WITH)\b[^`]*\$\{[^}]+\}[^`]*)`/gi;
+var sqlConcatRule = createRule({
+  id: "db/sql-concat",
+  category: "db",
+  severity: "high",
+  aiSpecific: true,
+  description: "Template-literal SQL query with ${...} interpolation \u2014 use parameterized queries.",
+  create(context) {
+    return context;
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    TEMPLATE_SQL_RE.lastIndex = 0;
+    let m;
+    while ((m = TEMPLATE_SQL_RE.exec(source)) !== null) {
+      issues.push({
+        ruleId: "db/sql-concat",
+        category: "db",
+        severity: "high",
+        aiSpecific: true,
+        message: "Template-literal SQL query with `${...}` interpolation \u2014 string concatenation is a SQL injection vector and a common AI-generated smell.",
+        line: lineOfSource(source, m.index),
+        column: 1,
+        advice: "Use parameterized queries (`db.query('SELECT ... WHERE id = $1', [id])`) or an ORM."
+      });
+    }
+    return issues;
+  }
+});
+
+// src/rules/docs/broken-link.ts
+var import_node_fs6 = require("fs");
+var import_node_path6 = require("path");
+
+// src/engine/doc-freshness.ts
+var import_node_fs5 = require("fs");
+var import_node_path5 = require("path");
+var import_globby2 = require("globby");
+
+// src/mcp/patterns.ts
+var import_node_fs3 = require("fs");
+var import_node_path3 = require("path");
+
+// src/engine/discover.ts
+var import_globby = require("globby");
+var import_minimatch = require("minimatch");
+var import_node_path = require("path");
+var import_node_fs = require("fs");
+var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".vue", ".svelte", ".astro", ".html"]);
+var BACKEND_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".py",
+  ".go",
+  // v0.14.0
+  ".swift",
+  ".kt",
+  ".kts",
+  ".dart",
+  ".rs",
+  ".cpp",
+  ".cc",
+  ".cxx",
+  ".c",
+  ".h",
+  ".hpp",
+  ".hxx",
+  ".java",
+  ".rb",
+  ".php"
+]);
+var ALL_SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
+  ...SOURCE_EXTENSIONS,
+  ...BACKEND_EXTENSIONS
+]);
+
+// src/config/conventions.ts
+var import_node_fs2 = require("fs");
+var import_node_path2 = require("path");
+
+// src/mcp/patterns.ts
+var ESM_IMPORT_RE = /(?:^|\n)\s*(?:import\s+(?:type\s+)?(?:[\w*${},\s]+\s+from\s+)?|import\s+|export\s+(?:type\s+)?[\w*${},\s]+\s+from\s+)(['"])([^'"]+)\1/g;
+var DYNAMIC_IMPORT_RE = /import\s*\(\s*(['"])([^'"]+)\1\s*\)/g;
+var COMMONJS_REQUIRE_RE = /require\s*\(\s*(['"])([^'"]+)\1\s*\)/g;
+function extractImports(source) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  const push = (spec) => {
+    if (spec.startsWith(".") || spec.startsWith("/")) return;
+    if (seen.has(spec)) return;
+    seen.add(spec);
+    out.push(spec);
+  };
+  for (const re of [ESM_IMPORT_RE, DYNAMIC_IMPORT_RE, COMMONJS_REQUIRE_RE]) {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(source)) !== null) {
+      push(m[2]);
+    }
+  }
+  return out;
+}
+
+// src/rules/docs/expired-code-example.ts
+var CODE_LANGS = /* @__PURE__ */ new Set(["ts", "tsx", "js", "jsx", "javascript", "typescript"]);
+function stripSubpath(spec) {
+  if (spec.startsWith("@")) return spec.split("/").slice(0, 2).join("/");
+  return spec.split("/")[0] ?? spec;
+}
+var expiredCodeExampleRule = createRule({
+  id: "docs/expired-code-example",
+  category: "docs",
+  severity: "medium",
+  aiSpecific: false,
+  description: "A fenced code example imports a package that is not declared in package.json.",
+  create(context) {
+    return { ...context, packages: declaredPackages(context.cwd) };
+  },
+  analyze(context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    const blocks = extractFencedCodeBlocks(source);
+    for (const block of blocks) {
+      if (!CODE_LANGS.has(block.lang)) continue;
+      if (block.body.split("\n").length < 2) continue;
+      const imports = extractImports(block.body);
+      for (const imp of imports) {
+        const pkgName = stripSubpath(imp);
+        if (context.packages.has(pkgName)) continue;
+        issues.push({
+          ruleId: "docs/expired-code-example",
+          category: "docs",
+          severity: "medium",
+          aiSpecific: false,
+          message: `Code example imports \`${imp}\` but \`${pkgName}\` is not in package.json.`,
+          line: block.line,
+          column: block.column,
+          advice: `Add \`${pkgName}\` to package.json or update the example.`
+        });
+      }
+    }
+    return issues;
+  }
+});
+
+// src/rules/docs/stale-function-reference.ts
+var import_node_fs4 = require("fs");
+var import_node_path4 = require("path");
+var RESERVED = /* @__PURE__ */ new Set([
+  "true",
+  "false",
+  "null",
+  "undefined",
+  "this",
+  "self",
+  "get",
+  "set",
+  "init",
+  "destroy",
+  "value",
+  "key",
+  "id",
+  "name",
+  "data",
+  "error",
+  "info",
+  "debug",
+  "log",
+  "warn",
+  "type",
+  "class",
+  "function",
+  "const",
+  "let",
+  "var",
+  "return",
+  "if",
+  "else",
+  "for",
+  "while",
+  "do",
+  "switch",
+  "case",
+  "default",
+  "break",
+  "continue",
+  "new",
+  "delete",
+  "try",
+  "catch",
+  "finally",
+  "async",
+  "await",
+  "import",
+  "export",
+  "from",
+  "as",
+  "then",
+  "resolve",
+  "reject",
+  "next",
+  "prev",
+  "current",
+  "index",
+  "count",
+  "length",
+  "size",
+  "width",
+  "height",
+  "top",
+  "left",
+  "right",
+  "bottom",
+  "result",
+  "response",
+  "request",
+  "user",
+  "message",
+  "code",
+  "status",
+  "state",
+  "props",
+  "ctx",
+  "context",
+  "config",
+  "options",
+  "params",
+  "args",
+  "event",
+  "target",
+  "input",
+  "output",
+  "src",
+  "dest",
+  "path",
+  "file",
+  "dir",
+  "url",
+  "header",
+  "body",
+  "token",
+  "auth",
+  "session",
+  "react",
+  "node",
+  "next",
+  "vue",
+  "angular",
+  "svelte"
+]);
+var SOURCE_EXTS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]);
+var SOURCE_ROOTS = ["src", "lib", "app", "components"];
+var CAP = 200;
+function walk(dir, out, cap) {
+  if (!(0, import_node_fs4.existsSync)(dir) || out.length >= cap) return;
+  let entries;
+  try {
+    entries = (0, import_node_fs4.readdirSync)(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (out.length >= cap) return;
+    if (entry.name === "node_modules" || entry.name.startsWith(".")) continue;
+    const full = (0, import_node_path4.join)(dir, entry.name);
+    if (entry.isDirectory()) walk(full, out, cap);
+    else if (entry.isFile() && SOURCE_EXTS.has((0, import_node_path4.extname)(entry.name))) out.push(full);
+  }
+}
+function collectExports(cwd) {
+  const out = /* @__PURE__ */ new Set();
+  const files = [];
+  for (const root of SOURCE_ROOTS) walk((0, import_node_path4.join)(cwd, root), files, CAP);
+  for (const file of files) {
+    let source;
+    try {
+      source = (0, import_node_fs4.readFileSync)(file, "utf-8");
+    } catch {
+      continue;
+    }
+    for (const re of [
+      /\bexport\s+(?:async\s+)?function\s+([A-Za-z_$][\w$]*)/g,
+      /\bexport\s+(?:const|let|var)\s+([A-Za-z_$][\w$]*)/g,
+      /\bexport\s+class\s+([A-Za-z_$][\w$]*)/g,
+      /\bexport\s+interface\s+([A-Za-z_$][\w$]*)/g,
+      /\bexport\s+type\s+([A-Za-z_$][\w$]*)/g,
+      /\bexport\s+default\s+(?:function\s+|class\s+)?([A-Za-z_$][\w$]*)/g
+    ]) {
+      let m;
+      while ((m = re.exec(source)) !== null) {
+        const name = m[1];
+        if (name) out.add(name);
+      }
+    }
+  }
+  return out;
+}
+var staleFunctionReferenceRule = createRule({
+  id: "docs/stale-function-reference",
+  category: "docs",
+  severity: "medium",
+  aiSpecific: false,
+  description: "Markdown references an identifier in a calling context (foo()) that is not exported by the project.",
+  create(context) {
+    return { ...context, exports: collectExports(context.cwd) };
+  },
+  analyze(context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    for (const span of extractInlineCodeSpans(source)) {
+      const text = span.text;
+      if (!/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(text)) continue;
+      if (text.length < 3) continue;
+      if (RESERVED.has(text.toLowerCase())) continue;
+      if (context.exports.has(text)) continue;
+      const end = Math.min(source.length, span.index + text.length + 50);
+      if (!/\(/.test(source.slice(span.index, end))) continue;
+      issues.push({
+        ruleId: "docs/stale-function-reference",
+        category: "docs",
+        severity: "medium",
+        aiSpecific: false,
+        message: `Documents \`${text}()\` but no such export exists.`,
+        line: span.line,
+        column: span.column,
+        advice: `Rename the doc reference, or add a \`${text}\` wrapper export.`,
+        extras: { identifier: text }
+      });
+    }
+    return issues;
+  }
+});
+
+// src/rules/docs/stale-package-reference.ts
+var ENGLISH_WORD_DENYLIST = /* @__PURE__ */ new Set([
+  "the",
+  "and",
+  "for",
+  "with",
+  "from",
+  "this",
+  "that",
+  "npm",
+  "npx",
+  "pnpm",
+  "yarn",
+  "node",
+  "git",
+  "cli",
+  "api",
+  "sdk",
+  "src",
+  "dist",
+  "lib",
+  "bin",
+  "doc",
+  "docs",
+  "test",
+  "spec",
+  "todo",
+  "fix",
+  "bug",
+  "feat",
+  "refactor",
+  "chore",
+  "http",
+  "https",
+  "url",
+  "json",
+  "xml",
+  "yaml",
+  "sql",
+  "orm",
+  "css",
+  "html",
+  "svg",
+  "png",
+  "jpg",
+  "pdf",
+  "csv",
+  "md",
+  "mdx",
+  "ts",
+  "tsx",
+  "js",
+  "jsx",
+  "ok",
+  "no",
+  "yes"
+]);
+var stalePackageReferenceRule = createRule({
+  id: "docs/stale-package-reference",
+  category: "docs",
+  severity: "medium",
+  aiSpecific: false,
+  description: "Markdown references a package (npm install / from / require) that is not in package.json.",
+  create(context) {
+    return { ...context, packages: declaredPackages(context.cwd) };
+  },
+  analyze(context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    const spans = extractInlineCodeSpans(source);
+    for (const span of spans) {
+      const lineStart = source.lastIndexOf("\n", span.index) + 1;
+      const lineEnd = source.indexOf("\n", span.index);
+      const line = source.slice(lineStart, lineEnd === -1 ? source.length : lineEnd);
+      let candidate;
+      const installMatch = /(npm\s+install|pnpm\s+add|yarn\s+add)\s+([A-Za-z0-9_./@-]+)/i.exec(line);
+      if (installMatch) candidate = installMatch[2];
+      if (!candidate) {
+        const fromMatch = /from\s+['"]([^'"]+)['"]/i.exec(line);
+        if (fromMatch) candidate = fromMatch[1];
+      }
+      if (!candidate) {
+        const requireMatch = /require\s*\(\s*['"]([^'"]+)['"]\s*\)/i.exec(line);
+        if (requireMatch) candidate = requireMatch[1];
+      }
+      if (!candidate) continue;
+      let pkgName = candidate;
+      if (pkgName.startsWith("@")) {
+        pkgName = pkgName.split("/").slice(0, 2).join("/");
+      } else {
+        pkgName = pkgName.split("/")[0] ?? pkgName;
+      }
+      if (!/^@?[a-z][a-z0-9._/-]*$/.test(pkgName)) continue;
+      if (pkgName.length < 2) continue;
+      if (ENGLISH_WORD_DENYLIST.has(pkgName)) continue;
+      if (context.packages.has(pkgName)) continue;
+      issues.push({
+        ruleId: "docs/stale-package-reference",
+        category: "docs",
+        severity: "medium",
+        aiSpecific: false,
+        message: `Documents \`${pkgName}\` but it is not in package.json.`,
+        line: span.line,
+        column: span.column,
+        advice: `Add \`${pkgName}\` to package.json or update the doc to reference an installed package.`,
+        extras: { package: pkgName }
+      });
+    }
+    return issues;
+  }
+});
+
+// src/engine/doc-freshness.ts
+function extractInlineCodeSpans(source) {
+  const hits = [];
+  const re = /`([^`\n]+?)`/g;
+  let m;
+  while ((m = re.exec(source)) !== null) {
+    const text = m[1] ?? "";
+    const upTo = source.slice(0, m.index);
+    const line = upTo.split("\n").length;
+    const lastNl = upTo.lastIndexOf("\n");
+    const column = lastNl === -1 ? m.index + 1 : m.index - lastNl;
+    hits.push({ text, line, column, index: m.index });
+  }
+  return hits;
+}
+function extractFencedCodeBlocks(source) {
+  const blocks = [];
+  const lines = source.split("\n");
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i] ?? "";
+    const fenceMatch = /^```(\w*)\s*$/.exec(line);
+    if (!fenceMatch) {
+      i++;
+      continue;
+    }
+    const lang = fenceMatch[1] ?? "";
+    const startLine = i + 1;
+    const bodyLines = [];
+    i++;
+    while (i < lines.length) {
+      if (/^```\s*$/.test(lines[i] ?? "")) {
+        i++;
+        break;
+      }
+      bodyLines.push(lines[i] ?? "");
+      i++;
+    }
+    blocks.push({
+      lang,
+      body: bodyLines.join("\n"),
+      line: startLine,
+      column: 1
+    });
+  }
+  return blocks;
+}
+function extractMarkdownLinks(source) {
+  const hits = [];
+  const re = /(?<!\!)\[([^\]]*)\]\(([^)\s]+)(?:\s+"[^"]*")?\)/g;
+  let m;
+  while ((m = re.exec(source)) !== null) {
+    const target = m[2] ?? "";
+    const upTo = source.slice(0, m.index);
+    const line = upTo.split("\n").length;
+    const lastNl = upTo.lastIndexOf("\n");
+    const column = lastNl === -1 ? m.index + 1 : m.index - lastNl;
+    hits.push({ target, line, column });
+  }
+  return hits;
+}
+function declaredPackages(cwd) {
+  const out = /* @__PURE__ */ new Set();
+  const pkgPath = (0, import_node_path5.join)(cwd, "package.json");
+  if (!(0, import_node_fs5.existsSync)(pkgPath)) return out;
+  try {
+    const raw = (0, import_node_fs5.readFileSync)(pkgPath, "utf-8");
+    const pkg = JSON.parse(raw);
+    for (const k of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
+      const v = pkg[k];
+      if (v && typeof v === "object") {
+        for (const name of Object.keys(v)) {
+          out.add(name);
+        }
+      }
+    }
+  } catch {
+  }
+  return out;
+}
+
+// src/rules/docs/broken-link.ts
+var brokenLinkRule = createRule({
+  id: "docs/broken-link",
+  category: "docs",
+  severity: "low",
+  aiSpecific: false,
+  description: "Markdown link target is relative and does not resolve to a file on disk.",
+  create(context) {
+    return context;
+  },
+  analyze(context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    const links = extractMarkdownLinks(source);
+    const docDir = (0, import_node_path6.dirname)((0, import_node_path6.resolve)(context.cwd, context.filePath));
+    for (const link of links) {
+      const target = link.target;
+      if (target.startsWith("http://") || target.startsWith("https://")) continue;
+      if (target.startsWith("mailto:") || target.startsWith("tel:")) continue;
+      if (target.startsWith("#")) continue;
+      if (target.startsWith("//")) continue;
+      if (target.startsWith("/")) continue;
+      const resolved = (0, import_node_path6.join)(docDir, target);
+      if ((0, import_node_fs6.existsSync)(resolved)) continue;
+      issues.push({
+        ruleId: "docs/broken-link",
+        category: "docs",
+        severity: "low",
+        aiSpecific: false,
+        message: `Relative link \`${target}\` does not exist.`,
+        line: link.line,
+        column: link.column,
+        advice: `Create the file or fix the link target.`,
+        extras: { link: target }
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/layout/gap-monopoly.ts
 var GAP_RE = /\bgap(?:-x|-y)?-(\d+)\b/g;
 var gapMonopolyRule = createRule({
@@ -34209,6 +35113,7 @@ var DEFAULT_CONFIG = {
     "wcag/dragging-movements": "medium",
     "wcag/focus-appearance": "high",
     "wcag/focus-obscured": "low",
+    "wcag/missing-alt": "medium",
     "wcag/target-size": "high",
     "test/weak-assertion": "medium",
     "test/duplicate-setup": "medium",
@@ -34280,16 +35185,16 @@ var DEFAULT_CONFIG = {
 };
 
 // src/config/detect/monorepo.ts
-var import_node_fs = require("fs");
-var import_node_path = require("path");
+var import_node_fs7 = require("fs");
+var import_node_path7 = require("path");
 
 // src/config/detect/styling.ts
-var import_node_fs2 = require("fs");
-var import_node_path2 = require("path");
+var import_node_fs8 = require("fs");
+var import_node_path8 = require("path");
 
 // src/config/detect/stack.ts
-var import_node_fs3 = require("fs");
-var import_node_path3 = require("path");
+var import_node_fs9 = require("fs");
+var import_node_path9 = require("path");
 
 // src/config/presets.ts
 var REACT_ONLY_RULES = {
@@ -34338,8 +35243,8 @@ var FRAMEWORK_PRESETS = {
 };
 
 // src/config/load.ts
-var import_node_fs5 = require("fs");
-var import_node_path5 = require("path");
+var import_node_fs10 = require("fs");
+var import_node_path10 = require("path");
 var import_node_module = require("module");
 
 // src/engine/logger.ts
@@ -34361,10 +35266,6 @@ function setLoggerQuiet(quiet) {
   logger = createLogger(quiet);
 }
 
-// src/config/conventions.ts
-var import_node_fs4 = require("fs");
-var import_node_path4 = require("path");
-
 // src/config/init.ts
 var STRICTNESS_PRESETS = {
   strict: {
@@ -34580,6 +35481,7 @@ var boundaryViolationRule = createRule({
   category: "logic",
   severity: "high",
   aiSpecific: false,
+  description: "Server-side data-layer / DB import leaked into a client component, or a client React hook used inside a server file (RSC boundary violation)",
   create(ruleContext) {
     return { clientHooks: CLIENT_HOOKS, supportsRsc: ruleContext.config.supportsRsc ?? true };
   },
@@ -34809,7 +35711,11 @@ var mathAnyDensityRule = createRule({
   category: "logic",
   severity: "high",
   aiSpecific: true,
-  description: RULE_DESCRIPTION,
+  // Self-match avoidance: the source uses string concatenation to keep the
+  // literal ": any" sequence out of the regex match — the description
+  // metadata is for humans, not the rule engine, so we keep it as a regular
+  // string literal here.
+  description: "`: any` density \u2265 3 per 100 lines \u2014 AI sprinkling of `any` types",
   create(context) {
     return context;
   },
@@ -35763,6 +36669,94 @@ var dangerousCorsRule = createRule({
   }
 });
 
+// src/rules/security/eval.ts
+var EVAL_CALL_RE = /\beval\s*\(/g;
+var NEW_FUNCTION_RE = /\bnew\s+Function\s*\(/g;
+var QUALIFIED_EVAL_RE = /\b(?:window|globalThis|self|global)\s*\.\s*eval\s*\(/g;
+var BLOCK_COMMENT_RE = /\/\*[\s\S]*?\*\//g;
+function scanForEvalCalls(source) {
+  const stripped = source.replace(
+    BLOCK_COMMENT_RE,
+    (match) => match.replace(/[^\n]/g, " ")
+  );
+  const hits = [];
+  let m;
+  EVAL_CALL_RE.lastIndex = 0;
+  while ((m = EVAL_CALL_RE.exec(stripped)) !== null) {
+    const before = source.slice(0, m.index);
+    const lastNewline = before.lastIndexOf("\n");
+    const lineStart = lastNewline + 1;
+    const lineBeforeMatch = source.slice(lineStart, m.index);
+    if (lineBeforeMatch.includes("//")) continue;
+    const quoteCount = (lineBeforeMatch.match(/['"`]/g) || []).length;
+    if (quoteCount % 2 === 1) continue;
+    hits.push({
+      message: "Avoid eval(): it is an RCE vector whenever the argument is or becomes attacker-controlled. Use JSON.parse, a sandboxed expression parser, or a precomputed dispatch table.",
+      line: lineOfSource(stripped, m.index),
+      column: m.index - lineStart + 1
+    });
+  }
+  NEW_FUNCTION_RE.lastIndex = 0;
+  while ((m = NEW_FUNCTION_RE.exec(stripped)) !== null) {
+    const before = source.slice(0, m.index);
+    const lastNewline = before.lastIndexOf("\n");
+    const lineStart = lastNewline + 1;
+    const lineBeforeMatch = source.slice(lineStart, m.index);
+    if (lineBeforeMatch.includes("//")) continue;
+    const quoteCount = (lineBeforeMatch.match(/['"`]/g) || []).length;
+    if (quoteCount % 2 === 1) continue;
+    hits.push({
+      message: "Avoid new Function(): the function-constructor evaluates a string at runtime \u2014 same RCE risk as eval().",
+      line: lineOfSource(stripped, m.index),
+      column: m.index - lineStart + 1
+    });
+  }
+  QUALIFIED_EVAL_RE.lastIndex = 0;
+  while ((m = QUALIFIED_EVAL_RE.exec(stripped)) !== null) {
+    const before = source.slice(0, m.index);
+    const lastNewline = before.lastIndexOf("\n");
+    const lineStart = lastNewline + 1;
+    const lineBeforeMatch = source.slice(lineStart, m.index);
+    if (lineBeforeMatch.includes("//")) continue;
+    const quoteCount = (lineBeforeMatch.match(/['"`]/g) || []).length;
+    if (quoteCount % 2 === 1) continue;
+    hits.push({
+      message: "Avoid window.eval() / globalThis.eval() \u2014 same RCE risk as bare eval().",
+      line: lineOfSource(stripped, m.index),
+      column: m.index - lineStart + 1
+    });
+  }
+  return hits;
+}
+var evalRule = createRule({
+  id: "security/eval",
+  category: "security",
+  severity: "high",
+  aiSpecific: false,
+  description: "eval() / new Function() / window.eval() \u2014 RCE vector when the argument is attacker-controlled (OWASP A03:2021)",
+  create(context) {
+    return context;
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    for (const hit of scanForEvalCalls(source)) {
+      issues.push({
+        ruleId: "security/eval",
+        category: "security",
+        severity: "high",
+        aiSpecific: false,
+        message: hit.message,
+        line: hit.line,
+        column: hit.column,
+        advice: "Replace eval() with JSON.parse, a sandboxed expression parser, or a precomputed dispatch table. If you must compile dynamic code, use a Web Worker with a strict CSP and no network access."
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/security/exposed-env-var.ts
 var CLIENT_PREFIXES = [
   "NEXT_PUBLIC_",
@@ -35948,6 +36942,86 @@ var hardcodedSecretRule = createRule({
   }
 });
 
+// src/rules/security/localstorage-token.ts
+var LS_SETITEM_RE = /(?:localStorage|sessionStorage)\s*\.\s*setItem\s*\(\s*(['"`])([^'"`]+)\1/g;
+var LS_SETITEM_VAR_RE = /(?:localStorage|sessionStorage)\s*\.\s*setItem\s*\(\s*(?!['"`])([A-Za-z_$][\w$]*)/g;
+var TOKEN_KEY_RE = /(token|jwt|bearer|access|refresh|auth|session[_-]?id|session[_-]?token|id[_-]?token|sso|api[_-]?key)/i;
+var NON_TOKEN_KEY_ALLOWLIST = /* @__PURE__ */ new Set([
+  "theme",
+  "lang",
+  "locale",
+  "i18n",
+  "user_pref",
+  "userprefs",
+  "prefs",
+  "preferences",
+  "settings",
+  "ui_theme",
+  "sidebar",
+  "view_mode",
+  "cart",
+  "last_seen",
+  "onboarding",
+  "dismissed"
+]);
+function isTokenY(rawKey) {
+  const k = rawKey.toLowerCase();
+  return !NON_TOKEN_KEY_ALLOWLIST.has(k) && TOKEN_KEY_RE.test(k);
+}
+function pushIssue(out, source, offset, message, advice) {
+  out.push({
+    ruleId: "security/localstorage-token",
+    category: "security",
+    severity: "high",
+    aiSpecific: false,
+    message,
+    advice,
+    line: lineOfSource(source, offset),
+    column: 1
+  });
+}
+var localstorageTokenRule = createRule({
+  id: "security/localstorage-token",
+  category: "security",
+  severity: "high",
+  aiSpecific: false,
+  description: "Auth token stored in localStorage \u2014 vulnerable to XSS exfiltration (OWASP A03:2021).",
+  create(context) {
+    return context;
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source ?? "";
+    if (!source) return issues;
+    let m;
+    LS_SETITEM_RE.lastIndex = 0;
+    while ((m = LS_SETITEM_RE.exec(source)) !== null) {
+      const key = m[2];
+      if (!isTokenY(key)) continue;
+      pushIssue(
+        issues,
+        source,
+        m.index,
+        `Auth key '${key}' written to localStorage / sessionStorage. Any page script can read it (XSS, malicious dep, browser extension).`,
+        "Issue the token as an httpOnly Secure SameSite cookie so JS cannot access it. Keep credentials out of client JS entirely."
+      );
+    }
+    LS_SETITEM_VAR_RE.lastIndex = 0;
+    while ((m = LS_SETITEM_VAR_RE.exec(source)) !== null) {
+      const ident = m[1];
+      if (!TOKEN_KEY_RE.test(ident)) continue;
+      pushIssue(
+        issues,
+        source,
+        m.index,
+        `localStorage.setItem('${ident}', ...) \u2014 identifier '${ident}' looks token-y. Verify the value is not a credential.`,
+        "Trace the value being persisted. Tokens must never reach localStorage; issue as httpOnly cookies and call them server-side only."
+      );
+    }
+    return issues;
+  }
+});
+
 // src/rules/security/missing-auth-check.ts
 var AUTH_PRIMITIVES = [
   "getServerSession",
@@ -36119,6 +37193,53 @@ var sqlConstructionRule = createRule({
   }
 });
 
+// src/rules/security/target-blank-no-noopener.ts
+var ANCHOR_TAG_RE = /<a\s+([^>]*?)>/gi;
+var TARGET_BLANK_RE = /\btarget\s*=\s*(["'])_blank\1/i;
+var REL_ATTR_RE = /\brel\s*=\s*["']([^"']*)["']/i;
+function hasSafeRel(attrs) {
+  const m = attrs.match(REL_ATTR_RE);
+  if (!m) return false;
+  const tokens = m[1].trim().toLowerCase().split(/\s+/).filter(Boolean);
+  return tokens.includes("noopener") || tokens.includes("noreferrer");
+}
+function pushIssue2(out, source, offset) {
+  out.push({
+    ruleId: "security/target-blank-no-noopener",
+    category: "security",
+    severity: "medium",
+    aiSpecific: false,
+    message: '<a target="_blank"> without rel="noopener" (or rel="noreferrer"). window.opener can navigate the originating tab \u2014 reverse tabnabbing.',
+    advice: 'Add rel="noopener" to the <a>. rel="noreferrer" implies noopener and also strips the Referer header.',
+    line: lineOfSource(source, offset),
+    column: 1
+  });
+}
+var targetBlankNoNoopenerRule = createRule({
+  id: "security/target-blank-no-noopener",
+  category: "security",
+  severity: "medium",
+  aiSpecific: false,
+  description: 'Link with target="_blank" missing rel="noopener" \u2014 window.opener can navigate the opener tab (reverse tabnabbing, MDN).',
+  create(context) {
+    return context;
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source ?? "";
+    if (!source) return issues;
+    let m;
+    ANCHOR_TAG_RE.lastIndex = 0;
+    while ((m = ANCHOR_TAG_RE.exec(source)) !== null) {
+      const attrs = m[1];
+      if (!TARGET_BLANK_RE.test(attrs)) continue;
+      if (hasSafeRel(attrs)) continue;
+      pushIssue2(issues, source, m.index);
+    }
+    return issues;
+  }
+});
+
 // src/rules/security/unsafe-html-render.ts
 var DANGEROUS_RE = /dangerouslySetInnerHTML\s*=\s*\{\s*\{\s*__html\s*:\s*([\s\S]+?)\}\s*\}\s*[\s/]/g;
 function isStaticLiteral(value) {
@@ -36539,7 +37660,7 @@ function looksRealistic(value) {
 
 // src/rules/test/missing-edge-case.ts
 var import_core3 = require("@swc/core");
-var import_node_fs6 = require("fs");
+var import_node_fs11 = require("fs");
 var MAX_PER_FILE = 20;
 var missingEdgeCaseRule = createRule({
   id: "test/missing-edge-case",
@@ -36561,7 +37682,7 @@ var missingEdgeCaseRule = createRule({
     const testFileSources = /* @__PURE__ */ new Map();
     for (const testFile of discoverTestFiles(cwd)) {
       try {
-        testFileSources.set(testFile, (0, import_node_fs6.readFileSync)(testFile, "utf-8"));
+        testFileSources.set(testFile, (0, import_node_fs11.readFileSync)(testFile, "utf-8"));
       } catch {
       }
     }
@@ -36815,16 +37936,16 @@ function discoverTestFiles(cwd) {
   const found = [];
   for (const root of roots) {
     const abs = `${cwd}/${root}`;
-    if (!(0, import_node_fs6.existsSync)(abs)) continue;
-    walk(abs, found, import_node_fs6.readdirSync, import_node_fs6.statSync);
+    if (!(0, import_node_fs11.existsSync)(abs)) continue;
+    walk2(abs, found, import_node_fs11.readdirSync, import_node_fs11.statSync);
     if (found.length > 200) break;
   }
   return found;
 }
-function walk(dir, out, readdirSync5, statSync5) {
+function walk2(dir, out, readdirSync6, statSync5) {
   let entries;
   try {
-    entries = readdirSync5(dir);
+    entries = readdirSync6(dir);
   } catch {
     return;
   }
@@ -36838,7 +37959,7 @@ function walk(dir, out, readdirSync5, statSync5) {
       continue;
     }
     if (stat.isDirectory()) {
-      walk(full, out, readdirSync5, statSync5);
+      walk2(full, out, readdirSync6, statSync5);
     } else if (stat.isFile()) {
       if (/\.(test|spec)\.[jt]sx?$/.test(entry) || /\.stories\.[jt]sx?$/.test(entry)) {
         out.push(full);
@@ -37212,12 +38333,81 @@ var mathCtaVocabularyRule = createRule({
   }
 });
 
+// src/rules/typo/placeholder-text.ts
+var BAD_PATTERNS = [
+  /\blorem\s+ipsum\b/i,
+  /\bplaceholder\b/i,
+  /\b(todo|fixme|xxx|aaa)\b/i,
+  /\benter\s+text\b/i,
+  /\btype\s+here\b/i,
+  /\byour\s+text\s+here\b/i,
+  /\bclick\s+here\b/i,
+  /\b(asdf|qwerty)\b/i,
+  /^(test|foo|bar|baz|sample)$/i
+];
+function isBadPlaceholder(value, config) {
+  const trimmed = value.trim();
+  if (config.allowlist && config.allowlist.includes(trimmed)) return false;
+  const minLength = config.minLength ?? 3;
+  if (trimmed.length < minLength) return false;
+  return BAD_PATTERNS.some((re) => re.test(trimmed));
+}
+function scanForBadPlaceholders(source, config) {
+  const hits = [];
+  const seen = /* @__PURE__ */ new Set();
+  const re = /placeholder\s*=\s*(?:"([^"]*)"|'([^']*)'|\{\s*"([^"]*)"\s*\}|\{\s*'([^']*)'\s*\})/gi;
+  let m;
+  while ((m = re.exec(source)) !== null) {
+    if (seen.has(m.index)) continue;
+    seen.add(m.index);
+    const value = m[1] ?? m[2] ?? m[3] ?? m[4] ?? "";
+    if (!isBadPlaceholder(value, config)) continue;
+    hits.push({
+      message: `Placeholder text "${value}" is a dev/AI default. Replace with real copy describing the expected input (e.g. "Search products", "Email address").`,
+      line: lineOfSource(source, m.index),
+      column: m.index - source.lastIndexOf("\n", m.index - 1),
+      value
+    });
+  }
+  return hits;
+}
+var placeholderTextRule = createRule({
+  id: "typo/placeholder-text",
+  category: "typo",
+  severity: "low",
+  aiSpecific: false,
+  description: "Placeholder text contains dev/AI defaults (Lorem ipsum, Enter text here, TODO, etc.) \u2014 unfinished UI.",
+  create(context) {
+    return context;
+  },
+  analyze(context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    const config = context.config.ruleConfig["typo/placeholder-text"] ?? {};
+    for (const hit of scanForBadPlaceholders(source, config)) {
+      issues.push({
+        ruleId: "typo/placeholder-text",
+        category: "typo",
+        severity: "low",
+        aiSpecific: false,
+        message: hit.message,
+        line: hit.line,
+        column: hit.column,
+        advice: "Replace with specific, user-facing copy."
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/visual/arbitrary-escape.ts
 var arbitraryEscapeRule = createRule({
   id: "visual/arbitrary-escape",
   category: "visual",
   severity: "medium",
   aiSpecific: true,
+  description: "Bracket-notation Tailwind values (e.g. `p-[13px]`, `bg-[#7c3aed]`) \u2014 AI agents reach for arbitrary escapes instead of design tokens (Refactoring UI; M\xE4ntyl\xE4 2003)",
   create(context) {
     return {
       allowlist: context.config.arbitraryValueAllowlist
@@ -38084,6 +39274,7 @@ var focusAppearanceRule = createRule({
   category: "wcag",
   severity: "high",
   aiSpecific: false,
+  description: "Inject a global focus-ring CSS block (`*:focus-visible { outline: ... }`) \u2014 WCAG 2.4.7 (Focus Visible)",
   create(context) {
     return { globalCssTarget: context.config.globalCssTarget };
   },
@@ -38160,6 +39351,55 @@ var focusObscuredRule = createRule({
   }
 });
 
+// src/rules/wcag/missing-alt.ts
+var IMG_OPEN_RE = /<img\b[^>]*>/gi;
+var HAS_ALT_RE = /\balt\s*=\s*("[^"]*"|'[^']*')/i;
+var HAS_PRESENTATION_ROLE_RE = /\brole\s*=\s*["'](?:presentation|none)["']/i;
+function scanForMissingAlt(source) {
+  const hits = [];
+  IMG_OPEN_RE.lastIndex = 0;
+  let m;
+  while ((m = IMG_OPEN_RE.exec(source)) !== null) {
+    const tagText = m[0];
+    if (HAS_ALT_RE.test(tagText)) continue;
+    if (HAS_PRESENTATION_ROLE_RE.test(tagText)) continue;
+    hits.push({
+      message: '<img> element is missing an `alt` attribute. WCAG 2.1 SC 1.1.1 requires alt text for non-text content. Use alt="" for purely decorative images, or role="presentation" to remove it from the accessibility tree.',
+      line: lineOfSource(source, m.index),
+      column: m.index - source.lastIndexOf("\n", m.index - 1)
+    });
+  }
+  return hits;
+}
+var missingAltRule = createRule({
+  id: "wcag/missing-alt",
+  category: "wcag",
+  severity: "medium",
+  aiSpecific: false,
+  description: "<img> element is missing an `alt` attribute (WCAG 2.1 SC 1.1.1, Level A).",
+  create(context) {
+    return context;
+  },
+  analyze(_context, facts) {
+    const issues = [];
+    const source = facts.v2?._source;
+    if (!source) return issues;
+    for (const hit of scanForMissingAlt(source)) {
+      issues.push({
+        ruleId: "wcag/missing-alt",
+        category: "wcag",
+        severity: "medium",
+        aiSpecific: false,
+        message: hit.message,
+        line: hit.line,
+        column: hit.column,
+        advice: 'Add `alt="..."` describing the image, or `alt=""` (or role="presentation") for purely decorative images.'
+      });
+    }
+    return issues;
+  }
+});
+
 // src/rules/wcag/target-size.ts
 var SIZE_PREFIX_RE = /^(min-w|min-h|max-w|max-h|h|w|size)-(.+)$/;
 var PAD_PREFIX_RE = /^(p|px|py)-(.+)$/;
@@ -38341,6 +39581,16 @@ var builtinRules = [
   multipleComponentsPerFileRule,
   shadcnPropMismatchRule,
   importPathMismatchRule,
+  duplicateIndexRule,
+  enumSprawlRule,
+  missingFkIndexRule,
+  missingNotNullRule,
+  namingInconsistencyRule,
+  sqlConcatRule,
+  brokenLinkRule,
+  expiredCodeExampleRule,
+  staleFunctionReferenceRule,
+  stalePackageReferenceRule,
   gapMonopolyRule,
   mathElementUniformityRule,
   mathGridUniformityRule,
@@ -38366,12 +39616,15 @@ var builtinRules = [
   terminologyDriftRule,
   uxPatternFragmentationRule,
   dangerousCorsRule,
+  evalRule,
   exposedEnvVarRule,
   failOpenAuthRule,
   hardcodedSecretRule,
+  localstorageTokenRule,
   missingAuthCheckRule,
   publicAdminRouteRule,
   sqlConstructionRule,
+  targetBlankNoNoopenerRule,
   unsafeHtmlRenderRule,
   duplicateSetupRule,
   fakePlaceholderRule,
@@ -38382,6 +39635,7 @@ var builtinRules = [
   clampOffscaleRule,
   mathButtonLabelUniformityRule,
   mathCtaVocabularyRule,
+  placeholderTextRule,
   arbitraryEscapeRule,
   clampSoupRule,
   forcedLayoutRule,
@@ -38399,6 +39653,7 @@ var builtinRules = [
   draggingMovementsRule,
   focusAppearanceRule,
   focusObscuredRule,
+  missingAltRule,
   targetSizeRule
 ];
 
@@ -39192,6 +40447,156 @@ var signal_strength_default = {
     lastCalibratedAt: "2026-06-27T12:00:00Z",
     verdict: "USEFUL",
     _calibrationNote: "v7 corpus re-calibration (2026-06-27, min-date=2025-01-01): 184488 neg + 239054 pos. USEFUL \u2014 TP=1912, FP=175, P=91.6%, FPR=0.09%, lift=8.4. aiSpecific=True."
+  },
+  "db/missing-fk-index": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-06-30T00:00:00Z",
+    verdict: "DORMANT",
+    defaultOff: true,
+    _calibrationNote: "v0.17.0 ship \u2014 not in v7 per-rule table. Default-off until calibration data lands. Backed by: PostgreSQL Global Development Group (2024), *PostgreSQL 16 Documentation \xA75.4 (Constraints)*, https://www.postgresql.org/docs/16/ddl-constraints.html; Squawk (2023), *Postgres linter rules*, https://github.com/sqllabs/squawk, rule `require-index-for-fk`. (Foreign key columns need a matching index \u2014 sequential scan on parent delete is a canonical Postgres anti-pattern.)"
+  },
+  "db/duplicate-index": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-06-30T00:00:00Z",
+    verdict: "DORMANT",
+    defaultOff: true,
+    _calibrationNote: "v0.17.0 ship \u2014 not in v7 per-rule table. Default-off until calibration data lands. Backed by: PostgreSQL Global Development Group (2024), *PostgreSQL 16 Documentation \xA711.2 (Index Types)*; Heroku Postgres Team (2018), *Efficient Use of PostgreSQL Indexes*. (Duplicate indexes silently double write cost without read benefit \u2014 Postgres does not warn.)"
+  },
+  "db/missing-not-null": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-06-30T00:00:00Z",
+    verdict: "DORMANT",
+    defaultOff: true,
+    _calibrationNote: "v0.17.0 ship \u2014 not in v7 per-rule table. Default-off until calibration data lands. Backed by: PostgreSQL Global Development Group (2024), *PostgreSQL 16 Documentation \xA75.4.1 (Check Constraints)*; Kleppmann, M. (2017), *Designing Data-Intensive Applications*, O'Reilly, ch.4 (NULL semantics in RDBMS). (Required-identifier columns without NOT NULL produce silent NULL inserts \u2014 canonical AI SQL smell.)"
+  },
+  "db/enum-sprawl": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-06-30T00:00:00Z",
+    verdict: "DORMANT",
+    defaultOff: true,
+    _calibrationNote: "v0.17.0 ship \u2014 not in v7 per-rule table. Default-off until calibration data lands. Backed by: PostgreSQL Global Development Group (2024), *PostgreSQL 16 Documentation \xA78.7 (Enumerated Types)*; Borkowski, A. (2022), *PostgreSQL enum types: when to use them and when not to*, pgconfig.org. (Enums with >12 values are brittle to extend and hard to localize \u2014 lookup table is the standard replacement.)"
+  },
+  "db/naming-inconsistency": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-06-30T00:00:00Z",
+    verdict: "DORMANT",
+    defaultOff: true,
+    _calibrationNote: "v0.17.0 ship \u2014 not in v7 per-rule table. Default-off until calibration data lands. Backed by: PostgreSQL Global Development Group (2024), *PostgreSQL 16 Documentation \xA74.1.1 (Identifiers and Key Words)*; pgsql-hackers (2018), *Re: snake_case vs camelCase in Postgres identifiers*. (snake_case is the Postgres convention; mixing styles in the same schema breaks ORM generators.)"
+  },
+  "db/sql-concat": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-06-30T00:00:00Z",
+    verdict: "DORMANT",
+    defaultOff: true,
+    _calibrationNote: "v0.17.0 ship \u2014 not in v7 per-rule table. Default-off until calibration data lands. Backed by: OWASP Foundation (2021), *OWASP Top 10 \u2014 A03:2021 Injection*, https://owasp.org/Top10/A03_2021-Injection/; OWASP Foundation (2017), *SQL Injection Prevention Cheat Sheet*. (Template-literal SQL with ${...} interpolation is the #1 SQL injection vector in AI-generated TypeScript code.)"
+  },
+  "docs/stale-package-reference": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-06-30T00:00:00Z",
+    verdict: "DORMANT",
+    defaultOff: true,
+    _calibrationNote: "v0.17.0 ship \u2014 not in v7 per-rule table. Default-off until calibration data lands. Backed by: Meng, M. et al. (2020), *The Cost of Fixing Code Documentation: An Empirical Study on Open-Source Software*, ICSE 2020; Aghajani, E. et al. (2019), *Software documentation: a practitioners' perspective*, ICSE 2019. (Doc references to undeclared packages are copy-paste rot from previous projects \u2014 high-signal doc drift.)"
+  },
+  "docs/stale-function-reference": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-06-30T00:00:00Z",
+    verdict: "DORMANT",
+    defaultOff: true,
+    _calibrationNote: "v0.17.0 ship \u2014 not in v7 per-rule table. Default-off until calibration data lands. Backed by: Meng, M. et al. (2020), *The Cost of Fixing Code Documentation*; Chen, Z. et al. (2022), *An Empirical Study on Code Documentation Adequacy*, MSR 2022. (Doc callouts to non-existent exports \u2014 readers copy-paste and hit a runtime error.)"
+  },
+  "docs/expired-code-example": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-06-30T00:00:00Z",
+    verdict: "DORMANT",
+    defaultOff: true,
+    _calibrationNote: "v0.17.0 ship \u2014 not in v7 per-rule table. Default-off until calibration data lands. Backed by: Parnas, D.L. (2010), *Precise Documentation: The Key to Better Software*, Springer (canonical doc-correctness argument); Chen, Z. et al. (2022). (Fenced code examples with broken imports erode trust in the entire docs site.)"
+  },
+  "docs/broken-link": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-06-30T00:00:00Z",
+    verdict: "DORMANT",
+    defaultOff: true,
+    _calibrationNote: "v0.17.0 ship \u2014 not in v7 per-rule table. Default-off until calibration data lands. Backed by: Nielsen, J. (2000), *Designing Web Usability*, New Riders (broken links as a top-5 trust erosion signal); Google Search Central (2024), *Crawl errors documentation*, https://developers.google.com/search/docs/crawling-indexing. (Broken internal links cost SEO crawl budget and reader trust.)"
+  },
+  "security/eval": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-06-30T00:00:00Z",
+    verdict: "DORMANT",
+    defaultOff: true,
+    _calibrationNote: "v0.16.0 ship \u2014 not in v7 per-rule table. Default-off until calibration data lands. Backed by: OWASP Foundation (2021), *OWASP Top 10 \u2014 A03:2021 Injection*; Mozilla Developer Network (2024), *eval() \u2014 MDN Web Docs*, https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval (Security Considerations). (eval() and new Function() are RCE vectors if the input is ever attacker-controlled.)"
+  },
+  "security/localstorage-token": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-06-30T00:00:00Z",
+    verdict: "DORMANT",
+    defaultOff: true,
+    _calibrationNote: "v0.16.0 ship \u2014 not in v7 per-rule table. Default-off until calibration data lands. Backed by: OWASP Foundation (2021), *OWASP Top 10 \u2014 A07:2021 Identification and Authentication Failures*; OWASP Foundation (2022), *HTML5 Security Cheat Sheet \xA72.1 (Local Storage)*. (JWT/access/refresh tokens in localStorage are readable by any XSS payload \u2014 issue as httpOnly cookies instead.)"
+  },
+  "security/target-blank-no-noopener": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-06-30T00:00:00Z",
+    verdict: "DORMANT",
+    defaultOff: true,
+    _calibrationNote: 'v0.16.0 ship \u2014 not in v7 per-rule table. Default-off until calibration data lands. Backed by: OWASP Foundation (2022), *HTML5 Security Cheat Sheet \xA72.3 (Tabnabbing)*; WHATWG (2024), *HTML Living Standard \u2014 Link types: noopener*. (target="_blank" without rel="noopener" lets the linked page control window.opener \u2014 reverse tabnabbing.)'
+  },
+  "wcag/missing-alt": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-06-30T00:00:00Z",
+    verdict: "DORMANT",
+    defaultOff: true,
+    _calibrationNote: 'v0.16.0 ship \u2014 not in v7 per-rule table. Default-off until calibration data lands. Backed by: W3C (2023), *Web Content Accessibility Guidelines (WCAG) 2.2 \u2014 1.1.1 Non-text Content*, https://www.w3.org/TR/WCAG22/. (Every <img> needs alt text. Decorative: alt="". Informative: describe the image.)'
+  },
+  "typo/placeholder-text": {
+    recall: 0,
+    fpRate: 0,
+    ratio: 0,
+    precision: 0,
+    lastCalibratedAt: "2026-06-30T00:00:00Z",
+    verdict: "DORMANT",
+    defaultOff: true,
+    _calibrationNote: "v0.16.0 ship \u2014 not in v7 per-rule table. Default-off until calibration data lands. Backed by: Nielsen, J. (2000), *Designing Web Usability* (placeholder copy as a top-10 trust erosion signal); Krug, S. (2000), *Don't Make Me Think*, 2nd ed. (TODO/placeholder text in shipped UI signals incomplete work.)"
   }
 };
 
@@ -39217,7 +40622,7 @@ function applyRuleOverrides(issues, rules) {
   return result;
 }
 async function scanFile(filePath, config, registry, cwd = process.cwd()) {
-  const ext = (0, import_node_path6.extname)(filePath).toLowerCase();
+  const ext = (0, import_node_path11.extname)(filePath).toLowerCase();
   const UNSUPPORTED_LANGS = /* @__PURE__ */ new Set([
     ".swift",
     ".kt",