truecourse 0.7.0-next.4 → 0.7.0-next.6

package/server.mjs

@@ -28008,7 +28008,12 @@ var init_result = __esm({
       durationMs: external_exports.number().nonnegative(),
       /** Present on `fail` / `error`. */
       failure: GuardFailureDetailSchema.optional(),
-      /** Repo-relative pointer into `evidence/`; present on `fail` / `error`. */
+      /**
+       * Repo-relative pointer into `evidence/`; present on every EXECUTED outcome —
+       * `pass` (the run transcript proving what ran) as well as `fail` / `error`.
+       * Absent on non-executed `stale` / `orphaned`, and on pre-2026-07-08 runs whose
+       * passes were never given a bundle (optional keeps those parsing + rendering).
+       */
       evidencePath: external_exports.string().optional(),
       /**
        * Present when the bound section moved: the section kept its text but now
@@ -28404,6 +28409,153 @@ var init_guard = __esm({
   }
 });
 
+// packages/shared/dist/spec/overlap-resolution.js
+function coveringRelationInAreas(relations, a, b, areas) {
+  return relations.find((r) => {
+    const samePair = r.older === a && r.newer === b || r.older === b && r.newer === a;
+    return samePair && (r.scope === void 0 || areas.includes(r.scope));
+  });
+}
+function dedupeCrossAreaOverlaps(entries) {
+  const byPair = /* @__PURE__ */ new Map();
+  for (const e of entries) {
+    const key4 = unorderedPairKey(e.overlap.docs[0], e.overlap.docs[1]);
+    const list = byPair.get(key4);
+    if (list)
+      list.push(e);
+    else
+      byPair.set(key4, [e]);
+  }
+  const merged = [];
+  for (const members of byPair.values()) {
+    const parent = members.map((_, i) => i);
+    const find = (i) => {
+      while (parent[i] !== i) {
+        parent[i] = parent[parent[i]];
+        i = parent[i];
+      }
+      return i;
+    };
+    const union = (i, j) => {
+      const ri = find(i);
+      const rj = find(j);
+      if (ri !== rj)
+        parent[Math.max(ri, rj)] = Math.min(ri, rj);
+    };
+    const ptrOwner = /* @__PURE__ */ new Map();
+    members.forEach((m, i) => {
+      for (const ptr of sectionPointerKeys(m.overlap)) {
+        const owner = ptrOwner.get(ptr);
+        if (owner === void 0)
+          ptrOwner.set(ptr, i);
+        else
+          union(owner, i);
+      }
+    });
+    const components = /* @__PURE__ */ new Map();
+    members.forEach((_, i) => {
+      const root = find(i);
+      const list = components.get(root);
+      if (list)
+        list.push(i);
+      else
+        components.set(root, [i]);
+    });
+    for (const idxs of components.values()) {
+      const group = idxs.map((i) => members[i]);
+      const rep = [...group].sort((x, y) => {
+        const px = preambleCount(x.overlap);
+        const py = preambleCount(y.overlap);
+        if (px !== py)
+          return px - py;
+        if (x.area !== y.area)
+          return x.area < y.area ? -1 : 1;
+        return (x.overlap.note ?? "") < (y.overlap.note ?? "") ? -1 : 1;
+      })[0];
+      const span = /* @__PURE__ */ new Set();
+      for (const g of group) {
+        span.add(g.area);
+        for (const a of g.overlap.areas ?? [])
+          span.add(a);
+      }
+      merged.push({ area: rep.area, areas: [...span].sort(), overlap: rep.overlap });
+    }
+  }
+  merged.sort((x, y) => {
+    if (x.area !== y.area)
+      return x.area < y.area ? -1 : 1;
+    return unorderedPairKey(x.overlap.docs[0], x.overlap.docs[1]) < unorderedPairKey(y.overlap.docs[0], y.overlap.docs[1]) ? -1 : 1;
+  });
+  return merged;
+}
+function buildCorpusConflicts(corpus, decisions) {
+  const userRelations = decisions.relations ?? [];
+  const effectiveRels = [...corpus.relations, ...userRelations];
+  const excludes = new Set(decisions.manualExcludes ?? []);
+  const entries = [];
+  for (const area of corpus.areas)
+    for (const ov of area.overlaps)
+      entries.push({ area: area.id, overlap: ov });
+  const mergedOverlaps = dedupeCrossAreaOverlaps(entries);
+  const flagged = [];
+  for (const m of mergedOverlaps) {
+    const [a, b] = m.overlap.docs;
+    const relation = coveringRelationInAreas(effectiveRels, a, b, m.areas);
+    const userRelation = coveringRelationInAreas(userRelations, a, b, m.areas);
+    const excludedRef = excludes.has(a) ? a : excludes.has(b) ? b : void 0;
+    flagged.push({
+      area: m.area,
+      areas: m.areas,
+      a,
+      b,
+      note: m.overlap.note ?? "",
+      resolved: relation !== void 0 || excludedRef !== void 0,
+      synthesized: false,
+      ...relation ? { relation } : {},
+      ...userRelation ? { userRelation } : {},
+      ...excludedRef ? { excludedRef } : {}
+    });
+  }
+  const coversFlagged = (r) => flagged.some((o) => {
+    const samePair = o.a === r.older && o.b === r.newer || o.a === r.newer && o.b === r.older;
+    return samePair && (r.scope === void 0 || o.areas.includes(r.scope));
+  });
+  const synthesized = userRelations.filter((r) => !coversFlagged(r)).map((r) => ({
+    area: r.scope ?? "",
+    areas: r.scope ? [r.scope] : [],
+    a: r.older,
+    b: r.newer,
+    note: r.note ?? "",
+    resolved: true,
+    synthesized: true,
+    relation: r,
+    userRelation: r
+  }));
+  return [...flagged, ...synthesized];
+}
+function openConflicts(corpus, decisions) {
+  return buildCorpusConflicts(corpus, decisions).filter((c) => !c.resolved);
+}
+var PREAMBLE_PTR, NUL, unorderedPairKey, sectionPointerKeys, preambleCount;
+var init_overlap_resolution = __esm({
+  "packages/shared/dist/spec/overlap-resolution.js"() {
+    "use strict";
+    PREAMBLE_PTR = "\0preamble";
+    NUL = "\0";
+    unorderedPairKey = (a, b) => a < b ? `${a}${NUL}${b}` : `${b}${NUL}${a}`;
+    sectionPointerKeys = (ov) => (ov.sections ?? []).map((s) => `${s.doc}${NUL}${s.heading ?? PREAMBLE_PTR}`);
+    preambleCount = (ov) => (ov.sections ?? []).filter((s) => s.heading === null || s.heading === void 0).length;
+  }
+});
+
+// packages/shared/dist/spec/index.js
+var init_spec = __esm({
+  "packages/shared/dist/spec/index.js"() {
+    "use strict";
+    init_overlap_resolution();
+  }
+});
+
 // node_modules/.pnpm/ignore@7.0.5/node_modules/ignore/index.js
 var require_ignore = __commonJS({
   "node_modules/.pnpm/ignore@7.0.5/node_modules/ignore/index.js"(exports, module) {
@@ -28994,6 +29146,7 @@ var init_dist = __esm({
     init_types2();
     init_schemas();
     init_guard();
+    init_spec();
     init_tcignore();
     init_skip_dirs();
     init_spec_scope();
@@ -44192,8 +44345,8 @@ function getMaxParameters(filePath) {
   }
   return 5;
 }
-function isBootstrapEntry(functionName, filePath) {
-  return LANGUAGE_CONFIGS.some((c) => c.bootstrap.functionNames.includes(functionName) && c.bootstrap.filePattern.test(filePath));
+function isBootstrapEntry(functionName2, filePath) {
+  return LANGUAGE_CONFIGS.some((c) => c.bootstrap.functionNames.includes(functionName2) && c.bootstrap.filePattern.test(filePath));
 }
 function getLanguageConfig(language) {
   const config2 = LANGUAGE_CONFIGS.find((c) => c.name === language);
@@ -48928,9 +49081,6 @@ function buildCSharpSymbolIndex(files, rootPath) {
 }
 function contributeCSharpEdges(files, rootPath) {
   const index = buildCSharpSymbolIndex(files, rootPath);
-  if (index.stats.ambiguousRefs > 0) {
-    console.warn(`[TrueCourse] C# symbol index: ${index.stats.ambiguousRefs} ambiguous type reference(s) skipped (same type name visible from multiple namespaces)`);
-  }
   return index.edges;
 }
 var TYPE_DECL_KINDS;
@@ -54259,12 +54409,9 @@ var init_lsp_client = __esm({
         this.process.stdout.on("data", (chunk3) => this.onData(chunk3));
         this.process.stderr.on("data", (chunk3) => {
         });
-        this.process.on("error", (err) => {
-          for (const pending of this.pendingRequests.values()) {
-            pending.reject(err);
-          }
-          this.pendingRequests.clear();
-        });
+        this.process.on("error", (err) => this.rejectAllPending(err));
+        this.process.stdin.on("error", (err) => this.rejectAllPending(new Error(`${this.config.name} LSP stdin error: ${err.message}`)));
+        this.process.on("exit", (code, signal) => this.rejectAllPending(new Error(`${this.config.name} LSP server exited (${signal ?? `code ${code}`}) before responding`)));
         const initResult = await this.sendRequest("initialize", {
           processId: process.pid,
           capabilities: {
@@ -54443,17 +54590,33 @@ var init_lsp_client = __esm({
       // -------------------------------------------------------------------------
       // Internal: JSON-RPC transport
       // -------------------------------------------------------------------------
+      /** Reject and clear every in-flight request — used when the server dies. */
+      rejectAllPending(err) {
+        if (this.pendingRequests.size === 0)
+          return;
+        for (const pending of this.pendingRequests.values())
+          pending.reject(err);
+        this.pendingRequests.clear();
+      }
       sendRequest(method, params) {
         return new Promise((resolve11, reject) => {
           const id = ++this.requestId;
           this.pendingRequests.set(id, { resolve: resolve11, reject });
           const msg = { jsonrpc: "2.0", id, method, params };
-          this.process.stdin.write(encodeMessage(msg));
+          try {
+            this.process.stdin.write(encodeMessage(msg));
+          } catch (err) {
+            this.pendingRequests.delete(id);
+            reject(err instanceof Error ? err : new Error(String(err)));
+          }
         });
       }
       sendNotification(method, params) {
         const msg = { jsonrpc: "2.0", method, params };
-        this.process.stdin.write(encodeMessage(msg));
+        try {
+          this.process.stdin.write(encodeMessage(msg));
+        } catch {
+        }
       }
       onData(chunk3) {
         this.buffer = Buffer.concat([this.buffer, chunk3]);
@@ -64938,7 +65101,8 @@ var init_deterministic4 = __esm({
         description: "Function parameter is never referenced in the function body \u2014 remove it or prefix with `_`.",
         enabled: true,
         severity: "low",
-        type: "deterministic"
+        type: "deterministic",
+        engine: "roslyn-host"
       },
       {
         key: "code-quality/deterministic/hardcoded-url",
@@ -76222,6 +76386,94 @@ var init_production_debug_enabled = __esm({
 });
 
 // packages/analyzer/dist/rules/security/visitors/javascript/insecure-random.js
+function isSecuritySensitiveName(name) {
+  const lower = name.toLowerCase();
+  return SECURITY_KEYWORDS.some((kw) => lower.includes(kw));
+}
+function securityContextName(callNode) {
+  let parent = callNode.parent;
+  while (parent) {
+    switch (parent.type) {
+      case "variable_declarator":
+        return leafName(parent.childForFieldName("name"));
+      case "assignment_expression":
+      case "augmented_assignment_expression":
+        return leafName(parent.childForFieldName("left"));
+      case "pair":
+        return leafName(parent.childForFieldName("key"));
+      case "public_field_definition":
+      case "field_definition":
+        return leafName(parent.childForFieldName("property") ?? parent.childForFieldName("name"));
+      // The value is returned from the enclosing function (e.g.
+      // `function generateToken() { return Math.random()... }`) — the
+      // function name is the security context.
+      case "return_statement":
+        return enclosingFunctionName(parent);
+      // Expression-bodied arrow returns the value directly, e.g.
+      // `const genToken = () => Math.random()...`.
+      case "arrow_function":
+        return functionName(parent);
+      // Structural boundaries: the random value is discarded or otherwise
+      // not bound to a name.
+      case "expression_statement":
+      case "statement_block":
+      case "if_statement":
+      case "for_statement":
+      case "for_in_statement":
+      case "while_statement":
+      case "do_statement":
+      case "switch_statement":
+      case "function_declaration":
+      case "function_expression":
+      case "method_definition":
+        return null;
+    }
+    parent = parent.parent;
+  }
+  return null;
+}
+function enclosingFunctionName(node2) {
+  let p = node2.parent;
+  while (p) {
+    if (p.type === "function_declaration" || p.type === "generator_function_declaration" || p.type === "method_definition" || p.type === "arrow_function" || p.type === "function_expression") {
+      return functionName(p);
+    }
+    p = p.parent;
+  }
+  return null;
+}
+function functionName(fn) {
+  const nameField = fn.childForFieldName("name");
+  if (nameField)
+    return leafName(nameField);
+  const p = fn.parent;
+  if (!p)
+    return null;
+  if (p.type === "variable_declarator")
+    return leafName(p.childForFieldName("name"));
+  if (p.type === "pair")
+    return leafName(p.childForFieldName("key"));
+  if (p.type === "assignment_expression")
+    return leafName(p.childForFieldName("left"));
+  if (p.type === "public_field_definition" || p.type === "field_definition") {
+    return leafName(p.childForFieldName("property") ?? p.childForFieldName("name"));
+  }
+  return null;
+}
+function leafName(node2) {
+  if (!node2)
+    return null;
+  if (node2.type === "identifier" || node2.type === "property_identifier" || node2.type === "shorthand_property_identifier") {
+    return node2.text;
+  }
+  if (node2.type === "member_expression") {
+    return node2.childForFieldName("property")?.text ?? null;
+  }
+  if (node2.type === "string") {
+    return node2.text.slice(1, -1);
+  }
+  return node2.text;
+}
 function isFixtureOrTestFile(filePath) {
   const lower = filePath.toLowerCase();
   return /[\\/]seeds?[\\/]/.test(lower) || /[\\/](?:seed|seeds)\.(?:ts|tsx|js|jsx|mts|cts|mjs|cjs)$/.test(lower) || /\.seed\.(?:ts|tsx|js|jsx|mts|cts|mjs|cjs)$/.test(lower) || /[\\/]__tests__[\\/]/.test(lower) || /\.(?:test|spec)\.(?:ts|tsx|js|jsx|mts|cts|mjs|cjs)$/.test(lower);
@@ -76252,19 +76504,9 @@ var init_insecure_random = __esm({
               if (/\.length\b/.test(parentText))
                 return null;
             }
-            let parent = node2.parent;
-            while (parent) {
-              const parentText = parent.text.toLowerCase();
-              if (SECURITY_KEYWORDS.some((kw) => parentText.includes(kw))) {
-                const immediateParent = node2.parent;
-                if (immediateParent?.type === "binary_expression" && /\.length\b/.test(immediateParent.text)) {
-                  return null;
-                }
-                return makeViolation(this.ruleKey, node2, filePath, "high", "Insecure random number generator", "Math.random() is not cryptographically secure. Do not use it for tokens, keys, or secrets.", sourceCode, "Use crypto.randomBytes() or crypto.randomUUID() instead.");
-              }
-              if (parent.type === "expression_statement" || parent.type === "variable_declaration" || parent.type === "assignment_expression" || parent.type === "lexical_declaration")
-                break;
-              parent = parent.parent;
+            const contextName = securityContextName(node2);
+            if (contextName && isSecuritySensitiveName(contextName)) {
+              return makeViolation(this.ruleKey, node2, filePath, "high", "Insecure random number generator", "Math.random() is not cryptographically secure. Do not use it for tokens, keys, or secrets.", sourceCode, "Use crypto.randomBytes() or crypto.randomUUID() instead.");
             }
           }
         }
@@ -76693,6 +76935,11 @@ var init_unverified_cross_origin_message = __esm({
         }
         if (methodName3 !== "addEventListener")
           return null;
+        if (fn.type === "member_expression") {
+          const receiver = fn.childForFieldName("object")?.text ?? "";
+          if (receiver !== "window" && receiver !== "self" && receiver !== "globalThis")
+            return null;
+        }
         const args = node2.childForFieldName("arguments");
         if (!args)
           return null;
@@ -77175,7 +77422,11 @@ var init_timing_attack_comparison = __esm({
           return null;
         const leftLeaf = leafIdentifier(left);
         const rightLeaf = leafIdentifier(right);
-        if (SENSITIVE_COMPARISON_PATTERNS.test(leftLeaf) || SENSITIVE_COMPARISON_PATTERNS.test(rightLeaf)) {
+        const leftIsLiteral = left.type === "string" || left.type === "template_string";
+        const rightIsLiteral = right.type === "string" || right.type === "template_string";
+        const leftMatches = !leftIsLiteral && SENSITIVE_COMPARISON_PATTERNS.test(leftLeaf);
+        const rightMatches = !rightIsLiteral && SENSITIVE_COMPARISON_PATTERNS.test(rightLeaf);
+        if (leftMatches || rightMatches) {
           if (sourceCode.includes("timingSafeEqual"))
             return null;
           return makeViolation(this.ruleKey, node2, filePath, "medium", "Timing attack via string comparison", `Using ${operator.text} to compare what may be a secret/token. This is vulnerable to timing attacks.`, sourceCode, "Use crypto.timingSafeEqual() for comparing secrets and tokens.");
@@ -77762,6 +78013,14 @@ var init_mixed_http_methods = __esm({
 });
 
 // packages/analyzer/dist/rules/security/visitors/javascript/process-signaling.js
+function isOwnedProcessPid(node2) {
+  if (node2.type !== "member_expression")
+    return false;
+  if (node2.childForFieldName("property")?.text !== "pid")
+    return false;
+  const obj = node2.childForFieldName("object");
+  return obj?.type === "member_expression" && obj.childForFieldName("property")?.text === "process";
+}
 var processSignalingVisitor;
 var init_process_signaling = __esm({
   "packages/analyzer/dist/rules/security/visitors/javascript/process-signaling.js"() {
@@ -77789,6 +78048,8 @@ var init_process_signaling = __esm({
         const pidArg = args.namedChildren[0];
         if (!pidArg)
           return null;
+        if (isOwnedProcessPid(pidArg))
+          return null;
         if (pidArg.type !== "number") {
           return makeViolation(this.ruleKey, node2, filePath, "high", "Sending signals to arbitrary processes", "process.kill() called with a non-literal PID. If the PID is user-controlled, this enables process manipulation.", sourceCode, "Validate and sanitize the PID before passing it to process.kill().");
         }
@@ -79142,8 +79403,8 @@ var init_sql_injection2 = __esm({
         if (!firstArg)
           return null;
         if (firstArg.type === "string" && firstArg.text.startsWith("f")) {
-          const hasInterpolation2 = firstArg.namedChildren.some((c) => c.type === "interpolation");
-          if (hasInterpolation2) {
+          const hasInterpolation = firstArg.namedChildren.some((c) => c.type === "interpolation");
+          if (hasInterpolation) {
             const queryText = firstArg.text;
             if (/:[a-z_]\w*|%s|%\(\w+\)s/.test(queryText))
               return null;
@@ -79653,17 +79914,17 @@ var init_eval_usage2 = __esm({
             funcName = attr.text;
           const receiver = fn.childForFieldName("object");
           if (receiver) {
-            let leafName2 = null;
+            let leafName3 = null;
             if (receiver.type === "identifier") {
-              leafName2 = receiver.text;
+              leafName3 = receiver.text;
             } else if (receiver.type === "attribute") {
               const attrChild = receiver.childForFieldName("attribute");
               if (attrChild) {
-                leafName2 = attrChild.text.replace(/^_+/, "");
+                leafName3 = attrChild.text.replace(/^_+/, "");
               }
             }
-            if (leafName2 && SAFE_METHOD_RECEIVERS.has(leafName2)) {
-              const expectedSources = SAFE_RECEIVER_IMPORT_SOURCES[leafName2];
+            if (leafName3 && SAFE_METHOD_RECEIVERS.has(leafName3)) {
+              const expectedSources = SAFE_RECEIVER_IMPORT_SOURCES[leafName3];
               if (expectedSources) {
                 const sources = getPythonImportSources(node2);
                 for (const src of sources) {
@@ -83635,6 +83896,12 @@ var init_exclusions = __esm({
       /^https?:\/\/(?!hooks\.slack\.com|[a-z0-9]+\.webhook\.office\.com)/,
       // Docker / container image references
       /^(?:docker|ghcr|quay|gcr|ecr)\.io\//,
+      // PostHog public project API key (phc_…) — intentionally client-exposed,
+      // embedded in frontend code to send analytics events. Its 40+ char base62
+      // body collides with the generic Cohere-token shape, but it is not a
+      // private credential. Private PostHog keys use the phx_/phs_ prefixes and
+      // are deliberately NOT allowlisted here.
+      /^phc_[A-Za-z0-9]{30,}$/,
       // Common config patterns that aren't secrets
       /^\*+$/,
       // All asterisks (masked values)
@@ -85450,10 +85717,33 @@ var init_secret_scanner = __esm({
 });
 
 // packages/analyzer/dist/rules/security/visitors/universal.js
+function hasPasswordToken(text4) {
+  const lower = text4.toLowerCase();
+  return lower.includes("password") || lower.includes("passwd");
+}
+function isPasswordHashingContext(node2) {
+  let stmt = node2.parent;
+  while (stmt && !STATEMENT_NODE_TYPES2.has(stmt.type) && !FUNCTION_NODE_TYPES3.has(stmt.type)) {
+    stmt = stmt.parent;
+  }
+  if (stmt && STATEMENT_NODE_TYPES2.has(stmt.type) && hasPasswordToken(stmt.text))
+    return true;
+  let fnNode = node2.parent;
+  while (fnNode && !FUNCTION_NODE_TYPES3.has(fnNode.type))
+    fnNode = fnNode.parent;
+  if (fnNode) {
+    const nameNode = fnNode.childForFieldName("name");
+    const paramsNode = fnNode.childForFieldName("parameters") ?? fnNode.childForFieldName("parameter_list");
+    const signature = `${nameNode?.text ?? ""} ${paramsNode?.text ?? ""}`;
+    if (hasPasswordToken(signature))
+      return true;
+  }
+  return false;
+}
 function stripCommentMarkers(text4) {
   return text4.replace(/^\/{2,3}\s?/, "").replace(/^\/\*\s?/, "").replace(/\s?\*\/$/, "").replace(/^\s*\*\s?/gm, "").replace(/^#\s?/gm, "").trim();
 }
-var STRING_NODE_TYPES, hardcodedSecretVisitor, IPV4_REGEX, EXCLUDED_IPS, hardcodedIpVisitor, CLEARTEXT_PROTOCOLS, LOCALHOST_PREFIXES, clearTextProtocolVisitor, BIP39_COMMON_WORDS, hardcodedBlockchainMnemonicVisitor, DB_URL_PATTERN, DB_PASSWORD_KV_PATTERNS, NON_LITERAL_PASSWORD_SEGMENT, PLACEHOLDER_PASSWORDS, hardcodedDatabasePasswordVisitor, ldapUnauthenticatedVisitor, passwordStoredPlaintextVisitor, HASH_FUNCTIONS_NEEDING_SALT, unpredictableSaltMissingVisitor, sensitiveFileVisitor, hardcodedSecretInCommentVisitor, SECURITY_UNIVERSAL_VISITORS;
+var STRING_NODE_TYPES, hardcodedSecretVisitor, IPV4_REGEX, EXCLUDED_IPS, hardcodedIpVisitor, CLEARTEXT_PROTOCOLS, LOCALHOST_PREFIXES, clearTextProtocolVisitor, BIP39_COMMON_WORDS, hardcodedBlockchainMnemonicVisitor, DB_URL_PATTERN, DB_PASSWORD_KV_PATTERNS, NON_LITERAL_PASSWORD_SEGMENT, PLACEHOLDER_PASSWORDS, hardcodedDatabasePasswordVisitor, ldapUnauthenticatedVisitor, passwordStoredPlaintextVisitor, HASH_FUNCTIONS_NEEDING_SALT, STATEMENT_NODE_TYPES2, FUNCTION_NODE_TYPES3, unpredictableSaltMissingVisitor, sensitiveFileVisitor, hardcodedSecretInCommentVisitor, SECURITY_UNIVERSAL_VISITORS;
 var init_universal = __esm({
   "packages/analyzer/dist/rules/security/visitors/universal.js"() {
     "use strict";
@@ -86633,6 +86923,29 @@ var init_universal = __esm({
       "sha256",
       "sha512"
     ]);
+    STATEMENT_NODE_TYPES2 = /* @__PURE__ */ new Set([
+      "expression_statement",
+      "return_statement",
+      "lexical_declaration",
+      "variable_declaration",
+      "variable_declarator",
+      "local_declaration_statement",
+      "assignment",
+      "augmented_assignment",
+      "assignment_expression",
+      "augmented_assignment_expression"
+    ]);
+    FUNCTION_NODE_TYPES3 = /* @__PURE__ */ new Set([
+      "function_declaration",
+      "function_expression",
+      "arrow_function",
+      "generator_function_declaration",
+      "method_definition",
+      "function_definition",
+      "method_declaration",
+      "local_function_statement",
+      "constructor_declaration"
+    ]);
     unpredictableSaltMissingVisitor = {
       ruleKey: "security/deterministic/unpredictable-salt-missing",
       nodeTypes: ["call_expression", "call", "invocation_expression"],
@@ -86650,21 +86963,12 @@ var init_universal = __esm({
         }
         if (!HASH_FUNCTIONS_NEEDING_SALT.has(methodName3))
           return null;
-        let parent = node2.parent;
-        while (parent) {
-          const parentText = parent.text.toLowerCase();
-          if (parentText.includes("password") || parentText.includes("passwd")) {
-            const args = node2.childForFieldName("arguments");
-            if (args && args.namedChildren.length < 2) {
-              return makeViolation(this.ruleKey, node2, filePath, "high", "Missing salt in hash", `${methodName3}() called without a salt in a password context. This allows rainbow table attacks.`, sourceCode, "Use a password hashing function like bcrypt, argon2, or PBKDF2 which handle salting automatically.");
-            }
-            return null;
-          }
-          if (parent.type === "function_declaration" || parent.type === "function_definition" || parent.type === "method_definition" || parent.type === "program" || parent.type === "method_declaration" || parent.type === "compilation_unit")
-            break;
-          parent = parent.parent;
-        }
-        return null;
+        const args = node2.childForFieldName("arguments");
+        if (!args || args.namedChildren.length >= 2)
+          return null;
+        if (!isPasswordHashingContext(node2))
+          return null;
+        return makeViolation(this.ruleKey, node2, filePath, "high", "Missing salt in hash", `${methodName3}() called without a salt in a password context. This allows rainbow table attacks.`, sourceCode, "Use a password hashing function like bcrypt, argon2, or PBKDF2 which handle salting automatically.");
       }
     };
     sensitiveFileVisitor = {
@@ -86757,7 +87061,7 @@ function isLiteralNode(n) {
   }
   return false;
 }
-var JS_LANGUAGES, TS_LANGUAGES, COMPARISON_OPERATORS, CONSTANT_LITERALS, TERMINAL_TYPES, VALID_TYPEOF_VALUES, LITERAL_TYPES, ARRAY_METHODS_REQUIRING_RETURN, PRIMITIVE_TYPES, PURE_ARRAY_METHODS, KNOWN_ARG_ORDERS, VOID_RETURNING_METHODS, VOID_RETURNING_GLOBALS, NON_CONSTRUCTORS, PROTOTYPE_BUILTINS, NON_CALLABLE_GLOBALS, READ_ONLY_GLOBALS, RESTRICTED_NAMES, THROWABLE_TYPES;
+var JS_LANGUAGES, TS_LANGUAGES, COMPARISON_OPERATORS, CONSTANT_LITERALS, TERMINAL_TYPES, VALID_TYPEOF_VALUES, LITERAL_TYPES, ARRAY_METHODS_REQUIRING_RETURN, PRIMITIVE_TYPES, PURE_ARRAY_METHODS, SOCKET_IO_RECEIVERS, KNOWN_ARG_ORDERS, VOID_RETURNING_METHODS, VOID_RETURNING_GLOBALS, NON_CONSTRUCTORS, PROTOTYPE_BUILTINS, NON_CALLABLE_GLOBALS, READ_ONLY_GLOBALS, RESTRICTED_NAMES, THROWABLE_TYPES;
 var init_helpers = __esm({
   "packages/analyzer/dist/rules/bugs/visitors/javascript/_helpers.js"() {
     "use strict";
@@ -86815,6 +87119,7 @@ var init_helpers = __esm({
       "reduce",
       "reduceRight"
     ]);
+    SOCKET_IO_RECEIVERS = /* @__PURE__ */ new Set(["socket", "sockets"]);
     KNOWN_ARG_ORDERS = [
       { fn: "startsWith", params: [["prefix", "str", "string", "start", "needle", "search"]] },
       { fn: "endsWith", params: [["suffix", "str", "string", "end", "needle", "search"]] },
@@ -87451,6 +87756,15 @@ var init_loss_of_precision = __esm({
         const num = Number(text4);
         if (!Number.isFinite(num))
           return null;
+        const parent = node2.parent;
+        if (parent?.type === "arguments") {
+          const call = parent.parent;
+          if (call?.type === "call_expression") {
+            const fn = call.childForFieldName("function");
+            if (fn?.type === "identifier" && fn.text === "BigInt")
+              return null;
+          }
+        }
         if (!Number.isSafeInteger(num)) {
           return makeViolation(this.ruleKey, node2, filePath, "high", "Loss of precision", `\`${text4}\` exceeds Number.MAX_SAFE_INTEGER and will lose precision at runtime.`, sourceCode, `Use BigInt (\`${text4}n\`) or restructure to avoid large integer literals.`);
         }
@@ -89722,6 +90036,17 @@ var init_useless_increment = __esm({
 });
 
 // packages/analyzer/dist/rules/bugs/visitors/javascript/ignored-return-value.js
+function receiverBaseName(obj) {
+  if (!obj)
+    return null;
+  if (obj.type === "identifier")
+    return obj.text.toLowerCase();
+  if (obj.type === "member_expression") {
+    const prop = obj.childForFieldName("property");
+    return prop ? prop.text.toLowerCase() : null;
+  }
+  return null;
+}
 var ignoredReturnValueVisitor;
 var init_ignored_return_value = __esm({
   "packages/analyzer/dist/rules/bugs/visitors/javascript/ignored-return-value.js"() {
@@ -89742,6 +90067,11 @@ var init_ignored_return_value = __esm({
         const prop = fn.childForFieldName("property");
         if (!prop || !PURE_ARRAY_METHODS.has(prop.text))
           return null;
+        if (prop.text === "join") {
+          const base = receiverBaseName(fn.childForFieldName("object"));
+          if (base && SOCKET_IO_RECEIVERS.has(base))
+            return null;
+        }
         return makeViolation(this.ruleKey, expr, filePath, "high", "Ignored return value", `The return value of \`.${prop.text}()\` is ignored \u2014 this method does not mutate the array in place; the result must be used.`, sourceCode, `Assign the result: \`const result = arr.${prop.text}(...)\`.`);
       }
     };
@@ -90403,7 +90733,12 @@ var init_global_this_usage = __esm({
         let current = node2.parent;
         while (current) {
           const t = current.type;
-          if (t === "function_declaration" || t === "function" || t === "method_definition" || t === "class_declaration" || t === "class") {
+          if (t === "function_declaration" || t === "function" || // Modern tree-sitter-javascript names a `function () {}` expression
+          // `function_expression` (only the legacy grammar used bare `function`).
+          // Without it, `this` inside any function-expression callback / IIFE /
+          // prototype-assigned method walks up to program scope and is wrongly
+          // reported as a global reference.
+          t === "function_expression" || t === "generator_function" || t === "generator_function_declaration" || t === "method_definition" || t === "class_declaration" || t === "class") {
             return null;
           }
           if (t === "arrow_function") {
@@ -93069,6 +93404,9 @@ var init_missing_await = __esm({
           return null;
         if (!isInsideAsyncFunction(node2))
           return null;
+        const declaredName = node2.childForFieldName("name");
+        if (declaredName?.type === "identifier" && /Promise$/.test(declaredName.text))
+          return null;
         const isPromise = typeQuery.isPromiseLike(filePath, value.startPosition.row, value.startPosition.column, value.endPosition.row, value.endPosition.column);
         if (!isPromise)
           return null;
@@ -93645,25 +93983,26 @@ var init_unbound_method = __esm({
         let classBody = node2.parent;
         while (classBody && classBody.type !== "class_body")
           classBody = classBody.parent;
-        if (classBody) {
-          for (const member of classBody.namedChildren) {
-            if (member.type === "public_field_definition" || member.type === "field_definition") {
-              const nameNode = member.children.find((c) => c.type === "property_identifier" || c.type === "private_property_identifier");
-              if (nameNode?.text !== methodName3)
-                continue;
-              const value = member.childForFieldName("value");
-              if (value?.type === "arrow_function" || value?.type === "function_expression")
-                return null;
-              if (value)
-                return null;
-              const typeAnnot = member.namedChildren.find((c) => c.type === "type_annotation");
-              const typeChild = typeAnnot?.namedChildren[0];
-              if (typeChild && typeChild.type !== "function_type" && typeChild.type !== "constructor_type") {
-                return null;
-              }
-            }
+        if (!classBody)
+          return null;
+        let resolvesToMethod = false;
+        for (const member of classBody.namedChildren) {
+          if (member.type === "method_definition") {
+            const nameNode = member.childForFieldName("name");
+            if (nameNode?.text !== methodName3)
+              continue;
+            const isAccessor = member.children.some((c) => (c.text === "get" || c.text === "set") && c.type !== "property_identifier");
+            resolvesToMethod = !isAccessor;
+            break;
+          }
+          if (member.type === "public_field_definition" || member.type === "field_definition") {
+            const nameNode = member.children.find((c) => c.type === "property_identifier" || c.type === "private_property_identifier");
+            if (nameNode?.text === methodName3)
+              return null;
           }
         }
+        if (!resolvesToMethod)
+          return null;
         return makeViolation(this.ruleKey, node2, filePath, "high", "Unbound method reference", `\`this.${methodName3}\` is used as a value without binding \u2014 \`this\` will be lost when called as a callback.`, sourceCode, "Use `this.method.bind(this)`, an arrow wrapper `() => this.method()`, or declare as an arrow function property.");
       }
     };
@@ -93766,7 +94105,7 @@ var init_missing_error_boundary = __esm({
       visit(node2, filePath, sourceCode) {
         if (!sourceCode.includes("React") && !sourceCode.includes("react") && !sourceCode.includes("jsx"))
           return null;
-        const hasAsyncData = /(?<![.\w])useQuery\b/.test(sourceCode) || /(?<![.\w])useSWR\b/.test(sourceCode) || /\buseSuspenseQuery\b/.test(sourceCode) || /\buseSuspenseInfiniteQuery\b/.test(sourceCode) || /\bSuspense\b/.test(sourceCode);
+        const hasAsyncData = /(?<![.\w])useQuery\b/.test(sourceCode) || /(?<![.\w])useSWR\b/.test(sourceCode) || /\buseSuspenseQuery\b/.test(sourceCode) || /\buseSuspenseInfiniteQuery\b/.test(sourceCode);
         if (!hasAsyncData)
           return null;
         if (/\bErrorBoundary\b/.test(sourceCode))
@@ -106591,6 +106930,9 @@ var init_star_import = __esm({
           if (sourceText === "zod" || sourceText.startsWith("@react-email/") || sourceText.startsWith("fumadocs-ui/") || sourceText.startsWith("fumadocs-core/")) {
             return null;
           }
+          if (sourceText === "semver" || sourceText.startsWith("@sentry/")) {
+            return null;
+          }
           if (sourceText.startsWith("./") || sourceText.startsWith("../"))
             return null;
           const nsImport = node2.namedChildren.find((c) => c.type === "import_clause")?.namedChildren.find((cc) => cc.type === "namespace_import");
@@ -108159,14 +108501,20 @@ var init_expression_complexity = __esm({
         if (!expr)
           return null;
         let target = expr;
-        while (target.type === "parenthesized_expression" && target.namedChildren[0]) {
+        while ((target.type === "parenthesized_expression" || target.type === "as_expression" || target.type === "satisfies_expression" || target.type === "non_null_expression") && target.namedChildren[0]) {
           target = target.namedChildren[0];
         }
+        if (target.type === "object" || target.type === "array")
+          return null;
         if (target.type === "arrow_function" || target.type === "function_expression" || target.type === "function_declaration" || target.type === "generator_function" || target.type === "generator_function_declaration")
           return null;
         if (target.type === "jsx_element" || target.type === "jsx_fragment" || target.type === "jsx_self_closing_element")
           return null;
         let operatorCount = 0;
+        let hasLogical = false;
+        let hasArithmetic = false;
+        const LOGICAL_OPS = /* @__PURE__ */ new Set(["&&", "||", "??"]);
+        const ARITHMETIC_OPS3 = /* @__PURE__ */ new Set(["+", "-", "*", "/", "%", "**", "&", "|", "^", "<<", ">>", ">>>"]);
         const BINARY_TYPES = /* @__PURE__ */ new Set(["binary_expression", "logical_expression"]);
         const FUNCTION_BOUNDARY_TYPES3 = /* @__PURE__ */ new Set([
           "function_declaration",
@@ -108179,6 +108527,13 @@ var init_expression_complexity = __esm({
         function countOps(n) {
           if (BINARY_TYPES.has(n.type)) {
             operatorCount++;
+            const op = n.childForFieldName("operator")?.text;
+            if (op) {
+              if (LOGICAL_OPS.has(op))
+                hasLogical = true;
+              else if (ARITHMETIC_OPS3.has(op))
+                hasArithmetic = true;
+            }
           }
           for (let i = 0; i < n.childCount; i++) {
             const child = n.child(i);
@@ -108191,6 +108546,8 @@ var init_expression_complexity = __esm({
         }
         countOps(expr);
         if (operatorCount > 5) {
+          if (hasLogical && !hasArithmetic)
+            return null;
           return makeViolation(this.ruleKey, node2, filePath, "medium", "Complex expression", `Expression has ${operatorCount} binary/logical operators (max 5). Break it into named variables for readability.`, sourceCode, "Split the expression into smaller, named intermediate variables.");
         }
         return null;
@@ -109015,12 +109372,73 @@ var init_strict_equality = __esm({
   }
 });
 
-// packages/analyzer/dist/rules/code-quality/visitors/javascript/commented-out-code.js
-var commentedOutCodeVisitor;
+// packages/analyzer/dist/rules/code-quality/visitors/_shared/commented-out-code.js
+function stripLineMarker(line) {
+  return line.replace(/^\s*(?:\/\/+|#+)\s?/, "").replace(/^\s*\*\/?\s?/, "").replace(/\*\/\s*$/, "").trim();
+}
+function looksLikeProse(line) {
+  const words = line.match(/[A-Za-z][A-Za-z'-]+/g) ?? [];
+  const codePunct = (line.match(/[;{}()=<>[\]]/g) ?? []).length;
+  return words.length >= 4 && codePunct <= 1;
+}
+function looksLikeCode(line, opts) {
+  if (/[;{}]\s*$/.test(line))
+    return true;
+  if (opts.colonTerminates && /:\s*$/.test(line))
+    return true;
+  if (/=>/.test(line))
+    return true;
+  if (/^[\w.]+\s*\([^)]*\)\s*;?\s*$/.test(line))
+    return true;
+  if (/^[\w.[\]]+\s*=\s*[^=].*$/.test(line) && !/==/.test(line))
+    return true;
+  return false;
+}
+function isCommentedOutCode(inner, opts) {
+  let code = 0;
+  let prose = 0;
+  for (const raw of inner.split("\n")) {
+    const line = stripLineMarker(raw);
+    if (line.length === 0)
+      continue;
+    if (looksLikeProse(line))
+      prose++;
+    else if (looksLikeCode(line, opts))
+      code++;
+  }
+  return code > 0 && code >= prose;
+}
+function lineCommentRunInner(node2, opts) {
+  const isRunLine = (n) => n != null && n.type === "comment" && opts.isLineComment(n.text);
+  if (!isRunLine(node2))
+    return null;
+  const prev = node2.previousSibling;
+  if (isRunLine(prev) && prev.startPosition.row === node2.startPosition.row - 1)
+    return null;
+  const lines = [opts.strip(node2.text)];
+  let cur = node2.nextSibling;
+  let lastRow = node2.startPosition.row;
+  while (isRunLine(cur) && cur.startPosition.row === lastRow + 1) {
+    lines.push(opts.strip(cur.text));
+    lastRow = cur.startPosition.row;
+    cur = cur.nextSibling;
+  }
+  return lines.join("\n");
+}
 var init_commented_out_code = __esm({
+  "packages/analyzer/dist/rules/code-quality/visitors/_shared/commented-out-code.js"() {
+    "use strict";
+  }
+});
+
+// packages/analyzer/dist/rules/code-quality/visitors/javascript/commented-out-code.js
+var isLineComment, commentedOutCodeVisitor;
+var init_commented_out_code2 = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/javascript/commented-out-code.js"() {
     "use strict";
     init_types3();
+    init_commented_out_code();
+    isLineComment = (t) => t.startsWith("//");
     commentedOutCodeVisitor = {
       ruleKey: "code-quality/deterministic/commented-out-code",
       languages: ["typescript", "tsx", "javascript"],
@@ -109029,21 +109447,19 @@ var init_commented_out_code = __esm({
         const text4 = node2.text;
         if (text4.startsWith("/**"))
           return null;
-        let inner = text4;
-        if (inner.startsWith("//"))
-          inner = inner.slice(2).trim();
-        else if (inner.startsWith("/*"))
-          inner = inner.slice(2, -2).trim();
-        if (inner.length < 10)
-          return null;
-        const codePatterns = [
-          /^\s*(const|let|var|function|return|if|for|while|import|export|class|throw|try|catch)\s/,
-          /[;{}]\s*$/,
-          /=>/,
-          /\w+\(.*\)\s*[;{]?\s*$/
-        ];
-        const matchCount = codePatterns.filter((p) => p.test(inner)).length;
-        if (matchCount >= 2) {
+        let inner;
+        if (isLineComment(text4)) {
+          inner = lineCommentRunInner(node2, { isLineComment, strip: (t) => t.replace(/^\/\/+/, "") });
+          if (inner === null)
+            return null;
+        } else if (text4.startsWith("/*")) {
+          inner = text4.slice(2, -2);
+        } else {
+          return null;
+        }
+        if (inner.trim().length < 10)
+          return null;
+        if (isCommentedOutCode(inner, {})) {
           return makeViolation(this.ruleKey, node2, filePath, "low", "Commented-out code", "This comment appears to contain commented-out code. Remove it or track it in version control.", sourceCode, "Delete the commented-out code. If needed, it can be recovered from version control.");
         }
         return null;
@@ -109824,6 +110240,11 @@ var init_for_in_without_filter = __esm({
                 return true;
             }
           }
+          if (n.type === "member_expression") {
+            const prop = n.childForFieldName("property");
+            if (prop?.text === "hasOwnProperty" || prop?.text === "hasOwn")
+              return true;
+          }
           if (n.type === "string" && (n.text.includes("hasOwnProperty") || n.text.includes("hasOwn")))
             return true;
           for (let i = 0; i < n.childCount; i++) {
@@ -111191,6 +111612,10 @@ var init_selector_parameter = __esm({
       languages: ["typescript", "tsx", "javascript"],
       nodeTypes: JS_FUNCTION_TYPES,
       visit(node2, filePath, sourceCode) {
+        const fnParent = node2.parent;
+        if ((node2.type === "arrow_function" || node2.type === "function_expression") && (fnParent?.type === "arguments" || fnParent?.type === "jsx_expression")) {
+          return null;
+        }
         const params = node2.childForFieldName("parameters");
         if (!params)
           return null;
@@ -113273,6 +113698,15 @@ var init_meaningless_void_operator = __esm({
 });
 
 // packages/analyzer/dist/rules/code-quality/visitors/javascript/test-with-hardcoded-timeout.js
+function isTestFile(filePath) {
+  const norm = filePath.replace(/\\/g, "/");
+  const base = norm.slice(norm.lastIndexOf("/") + 1);
+  if (/\.(test|spec)\.[cm]?[jt]sx?$/i.test(base))
+    return true;
+  if (/(^|\/)__tests?__\//.test(norm))
+    return true;
+  return false;
+}
 var testWithHardcodedTimeoutVisitor;
 var init_test_with_hardcoded_timeout = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/javascript/test-with-hardcoded-timeout.js"() {
@@ -113283,7 +113717,7 @@ var init_test_with_hardcoded_timeout = __esm({
       languages: ["typescript", "tsx", "javascript"],
       nodeTypes: ["call_expression"],
       visit(node2, filePath, sourceCode) {
-        if (!filePath.includes("test") && !filePath.includes("spec") && !filePath.includes(".test.") && !filePath.includes(".spec."))
+        if (!isTestFile(filePath))
           return null;
         const fn = node2.childForFieldName("function");
         if (!fn)
@@ -114643,8 +115077,8 @@ var init_test_empty_file = __esm({
       nodeTypes: ["program"],
       visit(node2, filePath, sourceCode) {
         const lowerPath = filePath.toLowerCase();
-        const isTestFile5 = lowerPath.includes(".test.") || lowerPath.includes(".spec.") || lowerPath.includes("__tests__");
-        if (!isTestFile5)
+        const isTestFile6 = lowerPath.includes(".test.") || lowerPath.includes(".spec.") || lowerPath.includes("__tests__");
+        if (!isTestFile6)
           return null;
         if (hasTestFunction(node2))
           return null;
@@ -118350,7 +118784,7 @@ var init_javascript5 = __esm({
     init_useless_computed_key();
     init_useless_concat();
     init_strict_equality();
-    init_commented_out_code();
+    init_commented_out_code2();
     init_inverted_boolean();
     init_prefer_single_boolean_return();
     init_prefer_immediate_return();
@@ -119517,30 +119951,27 @@ var init_unused_variable2 = __esm({
 });
 
 // packages/analyzer/dist/rules/code-quality/visitors/python/commented-out-code.js
-var pythonCommentedOutCodeVisitor;
-var init_commented_out_code2 = __esm({
+var isLineComment2, pythonCommentedOutCodeVisitor;
+var init_commented_out_code3 = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/python/commented-out-code.js"() {
     "use strict";
     init_types3();
+    init_commented_out_code();
+    isLineComment2 = (t) => t.startsWith("#");
     pythonCommentedOutCodeVisitor = {
       ruleKey: "code-quality/deterministic/commented-out-code",
       languages: ["python"],
       nodeTypes: ["comment"],
       visit(node2, filePath, sourceCode) {
         const text4 = node2.text;
-        if (!text4.startsWith("#"))
+        if (!isLineComment2(text4))
           return null;
-        const inner = text4.slice(1).trim();
-        if (inner.length < 10)
+        const inner = lineCommentRunInner(node2, { isLineComment: isLineComment2, strip: (t) => t.replace(/^#+/, "") });
+        if (inner === null)
           return null;
-        const codePatterns = [
-          /\b(def|class|import|from|return|if|for|while|try|except|with|raise|print)\b/,
-          /[;:]\s*$/,
-          /\w+\(.*\)/,
-          /=\s*\w/
-        ];
-        const matchCount = codePatterns.filter((p) => p.test(inner)).length;
-        if (matchCount >= 2) {
+        if (inner.trim().length < 10)
+          return null;
+        if (isCommentedOutCode(inner, { colonTerminates: true })) {
           return makeViolation(this.ruleKey, node2, filePath, "low", "Commented-out code", "This comment appears to contain commented-out code. Remove it or track it in version control.", sourceCode, "Delete the commented-out code. If needed, it can be recovered from version control.");
         }
         return null;
@@ -128533,8 +128964,8 @@ var init_test_not_discoverable = __esm({
           return null;
         const className = classNameNode.text;
         const isTestClass = className.startsWith("Test") || className.endsWith("Test") || className.endsWith("Tests");
-        const isTestFile5 = isPythonTestFile(filePath);
-        if (!isTestClass && !isTestFile5)
+        const isTestFile6 = isPythonTestFile(filePath);
+        if (!isTestClass && !isTestFile6)
           return null;
         const body = node2.childForFieldName("body");
         if (!body)
@@ -130303,7 +130734,7 @@ var init_python7 = __esm({
     init_no_debugger2();
     init_require_await2();
     init_unused_variable2();
-    init_commented_out_code2();
+    init_commented_out_code3();
     init_abstract_class_without_abstract_method();
     init_and_or_ternary();
     init_assert_in_production();
@@ -131477,7 +131908,18 @@ function withLanguageSupport(rules, visitors) {
         continue;
       }
       if (rule.engine === "roslyn-host" || rule.engine === "roslyn-workspace") {
-        support[language] = language === "csharp" ? { status: "supported" } : { status: "not-applicable", reason: "C# semantic rule (Roslyn host); no equivalent in this language" };
+        if (language === "csharp") {
+          support[language] = { status: "supported" };
+          continue;
+        }
+        const hasExplicitForLang = explicitFamilies.get(rule.key)?.has(language) ?? false;
+        const universalExcludesLang2 = universalExcludedFamilies.get(rule.key)?.has(language) ?? false;
+        const hasUniversalForLang = universalRuleKeys.has(rule.key) && UNIVERSAL_VISITOR_FAMILIES.includes(language) && !universalExcludesLang2;
+        if (hasExplicitForLang || hasUniversalForLang) {
+          support[language] = { status: "supported" };
+          continue;
+        }
+        support[language] = { status: "not-applicable", reason: "C# semantic rule (Roslyn host); no equivalent in this language" };
         continue;
       }
       const hasExplicit = explicitFamilies.get(rule.key)?.has(language) ?? false;
@@ -140236,6 +140678,12 @@ function walkCSharp(node2, visit) {
       walkCSharp(child, visit);
   }
 }
+function isCSharpTestPath(filePath) {
+  return filePath.split(/[\\/]/).some((segment) => {
+    const s = segment.toLowerCase();
+    return /\.tests?$/.test(s) || s.endsWith(".testbase") || s.endsWith("testapp");
+  });
+}
 var FUNCTION_BOUNDARY_TYPES;
 var init_csharp_helpers = __esm({
   "packages/analyzer/dist/rules/_shared/csharp-helpers.js"() {
@@ -141650,7 +142098,7 @@ function isTypeConstantAccess(node2) {
   const receiver = lastSegment(node2.childForFieldName("expression")?.text ?? "");
   return /^[A-Z]/.test(receiver);
 }
-function leafName(node2) {
+function leafName2(node2) {
   if (node2.type === "identifier")
     return node2.text;
   if (node2.type === "member_access_expression")
@@ -141686,8 +142134,8 @@ var init_timing_attack_comparison2 = __esm({
           return null;
         if (isTypeConstantAccess(left) || isTypeConstantAccess(right))
           return null;
-        const leftLeaf = leafName(left);
-        const rightLeaf = leafName(right);
+        const leftLeaf = leafName2(left);
+        const rightLeaf = leafName2(right);
         if (leftLeaf === "Length" || rightLeaf === "Length")
           return null;
         if (ENUM_CONSTANT_PATTERN2.test(leftLeaf) || ENUM_CONSTANT_PATTERN2.test(rightLeaf))
@@ -141706,7 +142154,7 @@ var init_timing_attack_comparison2 = __esm({
 });
 
 // packages/analyzer/dist/rules/security/visitors/csharp/insecure-random.js
-function isTestFile(filePath) {
+function isTestFile2(filePath) {
   const fileName = filePath.replace(/^.*[\\/]/, "");
   return /Tests?\.cs$/i.test(fileName) || /(?:TestSetup|TestFixture|Fixtures?|FunctionalTests|IntegrationTests|UnitTests|TestHelpers?)/.test(fileName);
 }
@@ -141748,7 +142196,7 @@ var init_insecure_random3 = __esm({
       languages: ["csharp"],
       nodeTypes: ["object_creation_expression", "member_access_expression"],
       visit(node2, filePath, sourceCode) {
-        if (isTestFile(filePath))
+        if (isTestFile2(filePath))
           return null;
         if (node2.type === "object_creation_expression") {
           if (getCreatedTypeName(node2) !== "Random")
@@ -144219,11 +144667,14 @@ var init_empty_catch3 = __esm({
               const stmt = tryStatements[0];
               if (/\b(Parse|TryParse|Deserialize)\s*[<(]/.test(stmt.text))
                 return null;
-              const expr = stmt.namedChildren[0];
-              if (expr?.type === "invocation_expression" && BEST_EFFORT_METHODS.has(getCSharpMethodName(expr))) {
+              let expr = stmt.namedChildren[0];
+              if (expr?.type === "await_expression")
+                expr = expr.namedChildren[0];
+              const isBestEffort = (name) => BEST_EFFORT_METHODS.has(name.replace(/Async$/, ""));
+              if (expr?.type === "invocation_expression" && isBestEffort(getCSharpMethodName(expr))) {
                 return null;
               }
-              if (expr?.type === "conditional_access_expression" && BEST_EFFORT_METHODS.has((expr.text.match(/\.(\w+)\s*\([^()]*\)\s*$/) ?? [])[1] ?? "")) {
+              if (expr?.type === "conditional_access_expression" && isBestEffort((expr.text.match(/\.(\w+)\s*\([^()]*\)\s*$/) ?? [])[1] ?? "")) {
                 return null;
               }
             }
@@ -144287,6 +144738,8 @@ var init_self_assignment3 = __esm({
       languages: ["csharp"],
       nodeTypes: ["assignment_expression"],
       visit(node2, filePath, sourceCode) {
+        if (node2.parent?.type === "initializer_expression")
+          return null;
         const left = node2.childForFieldName("left");
         const right = node2.childForFieldName("right");
         const operator = node2.childForFieldName("operator");
@@ -145294,7 +145747,7 @@ var init_infinite_recursion2 = __esm({
           return null;
         if (node2.type === "property_declaration") {
           const arrow = node2.childForFieldName("value");
-          const arrowExpr = arrow?.namedChildren[0];
+          const arrowExpr = arrow?.type === "arrow_expression_clause" ? arrow.namedChildren[0] : null;
           if (arrowExpr?.type === "identifier" && arrowExpr.text === name) {
             return makeViolation(this.ruleKey, node2, filePath, "critical", "Infinite recursion", `Property \`${name}\` returns itself \u2014 reading it recurses until StackOverflowException.`, sourceCode, "Return the backing field (or use an auto-property) instead of the property itself.");
           }
@@ -147359,8 +147812,11 @@ var init_useless_finally2 = __esm({
 });
 
 // packages/analyzer/dist/rules/bugs/visitors/csharp/fstring-missing-placeholders.js
-function hasInterpolation(node2) {
-  return node2.namedChildren.some((c) => c?.type === "interpolation");
+function hasRealHole(node2) {
+  if (node2.namedChildren.some((c) => c?.type === "interpolation"))
+    return true;
+  const stripped = node2.text.replace(/\{\{/g, "").replace(/\}\}/g, "");
+  return stripped.includes("{");
 }
 var csharpFstringMissingPlaceholdersVisitor;
 var init_fstring_missing_placeholders2 = __esm({
@@ -147372,7 +147828,7 @@ var init_fstring_missing_placeholders2 = __esm({
       languages: ["csharp"],
       nodeTypes: ["interpolated_string_expression"],
       visit(node2, filePath, sourceCode) {
-        if (hasInterpolation(node2))
+        if (hasRealHole(node2))
           return null;
         let top = node2;
         while (top.parent?.type === "binary_expression" && top.parent.childForFieldName("operator")?.text === "+") {
@@ -147383,7 +147839,7 @@ var init_fstring_missing_placeholders2 = __esm({
           const walk20 = (n) => {
             if (siblingHasHoles)
               return;
-            if (n.type === "interpolated_string_expression" && n.id !== node2.id && hasInterpolation(n)) {
+            if (n.type === "interpolated_string_expression" && n.id !== node2.id && hasRealHole(n)) {
               siblingHasHoles = true;
               return;
             }
@@ -148863,6 +149319,32 @@ var init_chained_orderby_loses_ordering = __esm({
 });
 
 // packages/analyzer/dist/rules/bugs/visitors/csharp/check-against-value-being-assigned.js
+function enclosingTypeDecl(node2) {
+  let p = node2.parent;
+  while (p) {
+    if (p.type === "class_declaration" || p.type === "struct_declaration" || p.type === "record_declaration") {
+      return p;
+    }
+    p = p.parent;
+  }
+  return null;
+}
+function selfMemberName(target) {
+  if (target.type === "identifier")
+    return target.text;
+  if (target.type === "member_access_expression") {
+    const obj = target.childForFieldName("expression");
+    if (obj?.type === "this")
+      return target.childForFieldName("name")?.text ?? null;
+  }
+  return null;
+}
+function enclosingTypeHasProperty(typeDecl, name) {
+  const body = typeDecl.childForFieldName("body") ?? typeDecl.namedChildren.find((c) => c?.type === "declaration_list");
+  if (!body)
+    return false;
+  return body.namedChildren.some((m) => m?.type === "property_declaration" && m.childForFieldName("name")?.text === name);
+}
 function singleStatement(consequence) {
   if (consequence.type === "block") {
     const stmts = consequence.namedChildren.filter((c) => c?.type !== "comment");
@@ -148910,6 +149392,12 @@ var init_check_against_value_being_assigned = __esm({
         const sameBA = condLeft.text === value.text && condRight.text === target.text;
         if (!sameAB && !sameBA)
           return null;
+        const selfName = selfMemberName(target);
+        if (selfName) {
+          const typeDecl = enclosingTypeDecl(node2);
+          if (typeDecl && enclosingTypeHasProperty(typeDecl, selfName))
+            return null;
+        }
         return makeViolation(this.ruleKey, node2, filePath, "low", "Redundant check against the value being assigned", `\`if (${condition.text}) ${assign.text};\` guards a plain assignment with a check against the same value \u2014 assigning unconditionally has the identical effect.`, sourceCode, "Remove the guard and assign unconditionally, or fix the condition if a different check was intended.");
       }
     };
@@ -149399,7 +149887,8 @@ var init_redundant_base_call = __esm({
         const receiver = node2.childForFieldName("expression");
         if (receiver?.type !== "base" && receiver?.text !== "base")
           return null;
-        const memberName3 = node2.childForFieldName("name")?.text;
+        const nameNode = node2.childForFieldName("name");
+        const memberName3 = nameNode?.type === "generic_name" ? nameNode.namedChildren.find((c) => c?.type === "identifier")?.text : nameNode?.text;
         if (!memberName3)
           return null;
         const typeDecl = enclosingType(node2);
@@ -149734,6 +150223,19 @@ function baseEntryName(entry) {
   }
   return null;
 }
+function baseEntryArity(entry) {
+  const generic = entry.type === "generic_name" ? entry : entry.type === "qualified_name" ? entry.childForFieldName("name") : null;
+  if (generic?.type !== "generic_name")
+    return 0;
+  const args = generic.namedChildren.find((c) => c?.type === "type_argument_list");
+  return args ? args.namedChildren.filter((c) => c != null).length : 0;
+}
+function declaredArity(node2) {
+  const params = node2.childForFieldName("type_parameters");
+  if (!params)
+    return 0;
+  return params.namedChildren.filter((c) => c?.type === "type_parameter").length;
+}
 var csharpRecursiveTypeInheritanceVisitor;
 var init_recursive_type_inheritance = __esm({
   "packages/analyzer/dist/rules/bugs/visitors/csharp/recursive-type-inheritance.js"() {
@@ -149755,6 +150257,8 @@ var init_recursive_type_inheritance = __esm({
           return null;
         if (baseEntryName(firstBase) !== typeName2)
           return null;
+        if (baseEntryArity(firstBase) !== declaredArity(node2))
+          return null;
         return makeViolation(this.ruleKey, firstBase, filePath, "high", "Recursive type inheritance", `\`${typeName2}\` lists itself as its own base type, producing a nonsensical recursive inheritance chain.`, sourceCode, "Remove the self reference from the base list.");
       }
     };
@@ -151982,6 +152486,20 @@ function isCSharpGeneratedSource(filePath, sourceCode) {
     return true;
   return sourceCode.slice(0, 600).includes("<auto-generated");
 }
+function isCSharpEfMigration(node2) {
+  const cls = getCSharpEnclosingClass(node2);
+  if (!cls)
+    return false;
+  const baseList = cls.namedChildren.find((c) => c?.type === "base_list");
+  if (!baseList)
+    return false;
+  return baseList.namedChildren.some((base) => {
+    if (!base)
+      return false;
+    const simple = base.text.split(".").pop() ?? base.text;
+    return simple === "Migration";
+  });
+}
 function isCSharpPrivateMember(node2) {
   const accessibility = [];
   for (const child of node2.children) {
@@ -154545,17 +155063,13 @@ var init_collapsible_if3 = __esm({
 });
 
 // packages/analyzer/dist/rules/code-quality/visitors/csharp/commented-out-code.js
-var CODE_PATTERNS, csharpCommentedOutCodeVisitor;
-var init_commented_out_code3 = __esm({
+var isLineComment3, csharpCommentedOutCodeVisitor;
+var init_commented_out_code4 = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/csharp/commented-out-code.js"() {
     "use strict";
     init_types3();
-    CODE_PATTERNS = [
-      /^\s*(var|int|string|bool|double|decimal|long|float|return|if|for|foreach|while|using|throw|try|catch|switch|await|new|public|private|protected|internal|static)\s/,
-      /[;{}]\s*$/,
-      /=>/,
-      /\w+\(.*\)\s*[;{]?\s*$/
-    ];
+    init_commented_out_code();
+    isLineComment3 = (t) => t.startsWith("//") && !t.startsWith("///");
     csharpCommentedOutCodeVisitor = {
       ruleKey: "code-quality/deterministic/commented-out-code",
       languages: ["csharp"],
@@ -154564,15 +155078,19 @@ var init_commented_out_code3 = __esm({
         const text4 = node2.text;
         if (text4.startsWith("///") || text4.startsWith("/**"))
           return null;
-        let inner = text4;
-        if (inner.startsWith("//"))
-          inner = inner.slice(2).trim();
-        else if (inner.startsWith("/*"))
-          inner = inner.slice(2, -2).trim();
-        if (inner.length < 10)
+        let inner;
+        if (isLineComment3(text4)) {
+          inner = lineCommentRunInner(node2, { isLineComment: isLineComment3, strip: (t) => t.replace(/^\/\/+/, "") });
+          if (inner === null)
+            return null;
+        } else if (text4.startsWith("/*")) {
+          inner = text4.slice(2, -2);
+        } else {
+          return null;
+        }
+        if (inner.trim().length < 10)
           return null;
-        const matchCount = CODE_PATTERNS.filter((p) => p.test(inner)).length;
-        if (matchCount >= 2) {
+        if (isCommentedOutCode(inner, {})) {
           return makeViolation(this.ruleKey, node2, filePath, "low", "Commented-out code", "This comment appears to contain commented-out code. Remove it or track it in version control.", sourceCode, "Delete the commented-out code. If needed, it can be recovered from version control.");
         }
         return null;
@@ -155280,6 +155798,13 @@ function csharpEmptyBodyIsIntentional(node2, body) {
   }
   if (isCSharpNoOpCallbackPosition(node2))
     return true;
+  let enclosingType3 = node2.parent;
+  while (enclosingType3 && enclosingType3.type !== "class_declaration" && enclosingType3.type !== "struct_declaration" && enclosingType3.type !== "record_declaration" && enclosingType3.type !== "record_struct_declaration") {
+    enclosingType3 = enclosingType3.parent;
+  }
+  const typeName2 = enclosingType3?.childForFieldName("name")?.text;
+  if (typeName2 && /^(Null|Noop|NoOp|Empty)[A-Z0-9]/.test(typeName2))
+    return true;
   if (node2.type === "method_declaration") {
     if (hasCSharpModifier(node2, "virtual") || hasCSharpModifier(node2, "override") || hasCSharpModifier(node2, "partial"))
       return true;
@@ -155557,6 +156082,7 @@ var init_hardcoded_url2 = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/csharp/hardcoded-url.js"() {
     "use strict";
     init_types3();
+    init_csharp_helpers();
     NAMESPACE_URI_HOSTS = /w3\.org|schema\.org|xmlns|openxmlformats|xmlsoap|purl\.org|tempuri\.org|schemas\.microsoft\.com|tools\.ietf\.org|datatracker\.ietf\.org|rfc-editor\.org/;
     STABLE_API_HOSTS = /googleapis\.com|maps\.google|api\.stripe\.com|api\.twilio\.com|api\.sendgrid\.com|api\.github\.com|cdn\.|fonts\.googleapis|cloudflare|unpkg\.com|cdnjs\.cloudflare|jsdelivr\.net|nuget\.org/;
     PLACEHOLDER_NAME = /default|placeholder|example|sample|template|fallback|demo|test|mock|stub|dummy/;
@@ -155568,6 +156094,8 @@ var init_hardcoded_url2 = __esm({
         const text4 = node2.text;
         if (!/https?:\/\/[a-zA-Z0-9]/.test(text4))
           return null;
+        if (isCSharpTestPath(filePath))
+          return null;
         if (text4.includes("example.com") || text4.includes("localhost") || text4.includes("127.0.0.1") || text4.includes("placeholder"))
           return null;
         if (NAMESPACE_URI_HOSTS.test(text4))
@@ -155588,6 +156116,42 @@ var init_hardcoded_url2 = __esm({
 });
 
 // packages/analyzer/dist/rules/code-quality/visitors/csharp/identical-functions.js
+function isTrivialExpr(e) {
+  switch (e.type) {
+    case "integer_literal":
+    case "real_literal":
+    case "boolean_literal":
+    case "string_literal":
+    case "verbatim_string_literal":
+    case "null_literal":
+    case "character_literal":
+    case "identifier":
+    case "this_expression":
+    case "default_expression":
+    case "member_access_expression":
+      return true;
+    case "invocation_expression": {
+      const args = e.childForFieldName("arguments");
+      if (!args)
+        return true;
+      return args.namedChildren.every((a) => {
+        if (a?.type !== "argument")
+          return true;
+        const value = a.namedChildren.find((c) => c && c.type !== "name_colon");
+        return !value || isTrivialExpr(value);
+      });
+    }
+    default:
+      return false;
+  }
+}
+function isTrivialReturnBody(body) {
+  const stmts = body.namedChildren.filter((c) => c && c.type !== "comment");
+  if (stmts.length !== 1 || stmts[0]?.type !== "return_statement")
+    return false;
+  const expr = stmts[0].namedChildren.find((c) => c && c.type !== "comment");
+  return !expr || isTrivialExpr(expr);
+}
 var COMPARED_TYPES, csharpIdenticalFunctionsVisitor;
 var init_identical_functions2 = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/csharp/identical-functions.js"() {
@@ -155606,7 +156170,7 @@ var init_identical_functions2 = __esm({
             const body = n.childForFieldName("body");
             if (body && body.type === "block" && body.namedChildCount > 0) {
               const onlyThrow = body.namedChildCount === 1 && body.namedChildren[0]?.type === "throw_statement";
-              if (!onlyThrow) {
+              if (!onlyThrow && !isTrivialReturnBody(body)) {
                 const normalized = body.text.replace(/\s+/g, " ").trim();
                 bodies.push({ body: normalized, fnNode: n });
               }
@@ -155796,6 +156360,8 @@ var init_magic_number2 = __esm({
           return null;
         if (parentType === "argument" && parent.parent?.type === "bracketed_argument_list")
           return null;
+        if (parentType === "argument" && parent.childForFieldName("name"))
+          return null;
         if (parentType === "binary_expression" && TIME_FACTORS2.has(val)) {
           const op = parent.childForFieldName("operator");
           if (op?.text === "*") {
@@ -156117,6 +156683,8 @@ var init_no_extraneous_class2 = __esm({
           return null;
         if (node2.namedChildren.some((c) => c?.type === "base_list"))
           return null;
+        if (node2.namedChildren.some((c) => c?.type === "attribute_list"))
+          return null;
         const body = node2.childForFieldName("body");
         if (!body)
           return null;
@@ -156375,7 +156943,8 @@ var init_redundant_jump3 = __esm({
         if (!grandparent)
           return null;
         if (node2.type === "return_statement") {
-          if (node2.namedChildren.length > 0)
+          const hasExpression = node2.children.some((c) => c != null && c.type !== "return" && c.type !== ";");
+          if (hasExpression)
             return null;
           if (!isCSharpFunctionBoundary(grandparent.type))
             return null;
@@ -157740,6 +158309,8 @@ var init_too_many_lines3 = __esm({
         const bodyNode = getCSharpFunctionBody(node2);
         if (!bodyNode)
           return null;
+        if (isCSharpGeneratedSource(filePath, sourceCode) || isCSharpEfMigration(node2))
+          return null;
         const lineCount = bodyNode.endPosition.row - bodyNode.startPosition.row + 1;
         if (lineCount > 50) {
           const name = getCSharpFunctionName(node2);
@@ -158387,93 +158958,6 @@ var init_unused_collection2 = __esm({
   }
 });
 
-// packages/analyzer/dist/rules/code-quality/visitors/csharp/unused-function-parameter.js
-var csharpUnusedFunctionParameterVisitor;
-var init_unused_function_parameter2 = __esm({
-  "packages/analyzer/dist/rules/code-quality/visitors/csharp/unused-function-parameter.js"() {
-    "use strict";
-    init_types3();
-    init_csharp_helpers();
-    csharpUnusedFunctionParameterVisitor = {
-      ruleKey: "code-quality/deterministic/unused-function-parameter",
-      languages: ["csharp"],
-      nodeTypes: ["method_declaration", "constructor_declaration", "local_function_statement"],
-      visit(node2, filePath, sourceCode) {
-        const params = node2.childForFieldName("parameters");
-        if (!params || params.namedChildCount === 0)
-          return null;
-        const body = node2.childForFieldName("body");
-        if (!body)
-          return null;
-        if (body.type === "block" && body.namedChildCount === 0)
-          return null;
-        if (/NotImplementedException|NotSupportedException/.test(body.text))
-          return null;
-        if (body.type === "block" && body.namedChildCount === 1 && body.namedChildren[0]?.type === "return_statement" && /Task\.CompletedTask|Task\.FromResult|ValueTask\.CompletedTask/.test(body.namedChildren[0].text)) {
-          return null;
-        }
-        if (node2.type === "method_declaration") {
-          for (const mod of ["override", "virtual", "abstract", "partial", "extern"]) {
-            if (hasCSharpModifier(node2, mod))
-              return null;
-          }
-          if (node2.namedChildren.some((c) => c?.type === "explicit_interface_specifier"))
-            return null;
-          if (node2.childForFieldName("name")?.text === "Main")
-            return null;
-        }
-        const paramList = [];
-        for (const param of params.namedChildren) {
-          if (!param || param.type !== "parameter")
-            continue;
-          if (param.children.some((c) => c?.type === "this" || c?.type === "modifier" && c.text === "this"))
-            continue;
-          if (param.childForFieldName("type")?.text === "CancellationToken")
-            continue;
-          const nameNode = param.childForFieldName("name");
-          if (nameNode?.type === "identifier")
-            paramList.push({ name: nameNode.text, node: param });
-        }
-        if (paramList.length === 0)
-          return null;
-        if (paramList.length === 2) {
-          const first2 = params.namedChildren.find((c) => c?.type === "parameter");
-          const firstType = first2?.childForFieldName("type")?.text;
-          const secondType = paramList[1] ? paramList[1].node.childForFieldName("type")?.text : void 0;
-          if ((firstType === "object" || firstType === "object?") && secondType?.endsWith("EventArgs"))
-            return null;
-        }
-        const used = /* @__PURE__ */ new Set();
-        function collectReads(n) {
-          if (n.type === "identifier") {
-            const parent = n.parent;
-            const isMemberName = parent && (parent.type === "member_access_expression" || parent.type === "qualified_name" || parent.type === "member_binding_expression") && parent.childForFieldName("name")?.id === n.id;
-            if (!isMemberName)
-              used.add(n.text);
-          }
-          for (let i = 0; i < n.namedChildCount; i++) {
-            const child = n.namedChild(i);
-            if (child)
-              collectReads(child);
-          }
-        }
-        collectReads(body);
-        const initializer = node2.namedChildren.find((c) => c?.type === "constructor_initializer");
-        if (initializer)
-          collectReads(initializer);
-        for (const { name, node: paramNode } of paramList) {
-          if (name.startsWith("_"))
-            continue;
-          if (!used.has(name)) {
-            return makeViolation(this.ruleKey, paramNode, filePath, "low", `Unused parameter \`${name}\``, `Parameter \`${name}\` is never used in the method body. Remove it or rename it to \`_\` if the signature is fixed.`, sourceCode, `Remove unused parameter \`${name}\` or rename it to \`_${name}\`.`);
-          }
-        }
-        return null;
-      }
-    };
-  }
-});
-
 // packages/analyzer/dist/rules/code-quality/visitors/csharp/unused-private-member.js
 var csharpUnusedPrivateMemberVisitor;
 var init_unused_private_member2 = __esm({
@@ -158498,6 +158982,8 @@ var init_unused_private_member2 = __esm({
         for (const member of body.namedChildren) {
           if (!member)
             continue;
+          if (member.namedChildren.some((c) => c?.type === "explicit_interface_specifier"))
+            continue;
           if (!isCSharpPrivateMember(member))
             continue;
           if (getCSharpDeclAttributeNames(member).length > 0)
@@ -158895,8 +159381,17 @@ var init_abstract_class_public_constructor = __esm({
 });
 
 // packages/analyzer/dist/rules/code-quality/visitors/csharp/abstract-class-without-abstract-members.js
-function hasAbstractMember(body) {
-  return body.namedChildren.some((c) => c && MEMBER_TYPES2.has(c.type) && hasCSharpModifier(c, "abstract"));
+function hasMemberWithModifier(body, modifier) {
+  return body.namedChildren.some((c) => c != null && MEMBER_TYPES2.has(c.type) && hasCSharpModifier(c, modifier));
+}
+function hasProtectedConstructor(body) {
+  return body.namedChildren.some((c) => c?.type === "constructor_declaration" && hasCSharpModifier(c, "protected"));
+}
+function hasBaseList(classDecl) {
+  return classDecl.namedChildren.some((c) => c?.type === "base_list");
+}
+function hasExtensionSignal(classDecl, body) {
+  return hasMemberWithModifier(body, "abstract") || hasMemberWithModifier(body, "virtual") || hasMemberWithModifier(body, "override") || hasProtectedConstructor(body) || hasBaseList(classDecl);
 }
 var MEMBER_TYPES2, csharpAbstractClassWithoutAbstractMembersVisitor;
 var init_abstract_class_without_abstract_members = __esm({
@@ -158908,6 +159403,7 @@ var init_abstract_class_without_abstract_members = __esm({
       "method_declaration",
       "property_declaration",
       "event_declaration",
+      "event_field_declaration",
       "indexer_declaration"
     ]);
     csharpAbstractClassWithoutAbstractMembersVisitor = {
@@ -158922,10 +159418,10 @@ var init_abstract_class_without_abstract_members = __esm({
         const body = node2.childForFieldName("body");
         if (!body)
           return null;
-        if (hasAbstractMember(body))
+        if (hasExtensionSignal(node2, body))
           return null;
         const name = node2.childForFieldName("name")?.text ?? "class";
-        return makeViolation(this.ruleKey, node2, filePath, "low", "Abstract class without abstract members", `Abstract class \`${name}\` declares no abstract members, so it should be a concrete base class or an interface instead.`, sourceCode, "Add abstract members, drop the `abstract` modifier, or convert the type to an interface.");
+        return makeViolation(this.ruleKey, node2, filePath, "low", "Abstract class without abstract members", `Abstract class \`${name}\` declares no abstract members and no other reason to be abstract (no virtual/override member, no protected constructor, no base type), so it should be a concrete class or a static holder instead.`, sourceCode, "Add abstract members, drop the `abstract` modifier, or convert the type to an interface.");
       }
     };
   }
@@ -159843,6 +160339,8 @@ var init_static_holder_type_has_constructor = __esm({
           return null;
         if (hasCSharpModifier(node2, "abstract"))
           return null;
+        if (node2.namedChildren.some((c) => c?.type === "base_list"))
+          return null;
         const body = node2.namedChildren.find((c) => c?.type === "declaration_list");
         if (!body)
           return null;
@@ -161726,6 +162224,15 @@ var init_extension_method_on_object = __esm({
 });
 
 // packages/analyzer/dist/rules/code-quality/visitors/csharp/generic-parameter-not-inferable.js
+function isInterfaceMember(method) {
+  let current = method.parent;
+  while (current) {
+    if (TYPE_DECL_TYPES2.has(current.type))
+      return current.type === "interface_declaration";
+    current = current.parent;
+  }
+  return false;
+}
 function identifiersIn2(node2) {
   const used = /* @__PURE__ */ new Set();
   if (!node2)
@@ -161747,14 +162254,23 @@ function parameterTypeIdentifiers(method) {
     for (const id of identifiersIn2(param.childForFieldName("type")))
       used.add(id);
   }
+  for (const id of identifiersIn2(params.childForFieldName("type")))
+    used.add(id);
   return used;
 }
-var csharpGenericParameterNotInferableVisitor;
+var TYPE_DECL_TYPES2, csharpGenericParameterNotInferableVisitor;
 var init_generic_parameter_not_inferable = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/csharp/generic-parameter-not-inferable.js"() {
     "use strict";
     init_types3();
     init_csharp_helpers();
+    TYPE_DECL_TYPES2 = /* @__PURE__ */ new Set([
+      "interface_declaration",
+      "class_declaration",
+      "struct_declaration",
+      "record_declaration",
+      "record_struct_declaration"
+    ]);
     csharpGenericParameterNotInferableVisitor = {
       ruleKey: "code-quality/deterministic/generic-parameter-not-inferable",
       languages: ["csharp"],
@@ -161763,6 +162279,8 @@ var init_generic_parameter_not_inferable = __esm({
         const typeParams = node2.namedChildren.find((c) => c?.type === "type_parameter_list");
         if (!typeParams)
           return null;
+        if (isInterfaceMember(node2))
+          return null;
         const usedInParams = parameterTypeIdentifiers(node2);
         const nameNode = node2.childForFieldName("name");
         const usedInReturn = /* @__PURE__ */ new Set();
@@ -161774,15 +162292,13 @@ var init_generic_parameter_not_inferable = __esm({
           for (const id of identifiersIn2(child))
             usedInReturn.add(id);
         }
-        const usedInBody = identifiersIn2(node2.childForFieldName("body"));
         for (const tp of typeParams.namedChildren) {
           if (tp?.type !== "type_parameter")
             continue;
           const name = tp.namedChildren.find((c) => c?.type === "identifier")?.text;
           if (!name)
             continue;
-          const usedElsewhere = usedInReturn.has(name) || usedInBody.has(name);
-          if (!usedInParams.has(name) && usedElsewhere) {
+          if (!usedInParams.has(name) && usedInReturn.has(name)) {
             return makeViolation(this.ruleKey, tp, filePath, "low", "Type parameter not inferable", `Type parameter \`${name}\` appears in no method parameter, so callers must always specify it explicitly.`, sourceCode, `Use \`${name}\` in a parameter type, or accept that callers must specify it and consider a non-generic design.`);
           }
         }
@@ -161895,6 +162411,9 @@ var init_native_method_not_wrapped = __esm({
 });
 
 // packages/analyzer/dist/rules/code-quality/visitors/csharp/nested-generic-parameter.js
+function genericBaseName2(generic) {
+  return generic.namedChildren.find((c) => c?.type === "identifier")?.text ?? "";
+}
 function asGenericName(typeNode) {
   if (!typeNode)
     return null;
@@ -161910,16 +162429,19 @@ function hasNestedGeneric(typeNode) {
   const generic = asGenericName(typeNode);
   if (!generic)
     return false;
+  if (DELEGATE_OR_EXPRESSION_GENERICS.has(genericBaseName2(generic)))
+    return false;
   const args = generic.namedChildren.find((c) => c?.type === "type_argument_list");
   if (!args)
     return false;
   return args.namedChildren.some((arg) => asGenericName(arg) !== null);
 }
-var csharpNestedGenericParameterVisitor;
+var DELEGATE_OR_EXPRESSION_GENERICS, csharpNestedGenericParameterVisitor;
 var init_nested_generic_parameter = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/csharp/nested-generic-parameter.js"() {
     "use strict";
     init_types3();
+    DELEGATE_OR_EXPRESSION_GENERICS = /* @__PURE__ */ new Set(["Func", "Action", "Predicate", "Expression"]);
     csharpNestedGenericParameterVisitor = {
       ruleKey: "code-quality/deterministic/nested-generic-parameter",
       languages: ["csharp"],
@@ -162039,6 +162561,39 @@ function enclosingTypeBody(node2) {
   const body = node2.parent;
   return body?.type === "declaration_list" ? body : null;
 }
+function isZeroArgCallTo(expr, getName) {
+  if (expr?.type !== "invocation_expression")
+    return false;
+  const fn = expr.childForFieldName("function") ?? expr.namedChildren[0];
+  const fnText = fn?.text;
+  if (fnText !== getName && fnText !== `this.${getName}`)
+    return false;
+  const args = expr.childForFieldName("arguments") ?? expr.namedChildren.find((c) => c?.type === "argument_list");
+  const argCount = args?.namedChildren.filter((c) => c?.type === "argument").length ?? 0;
+  return argCount === 0;
+}
+function getterDelegatesTo(prop, getName) {
+  const propArrow = prop.namedChildren.find((c) => c?.type === "arrow_expression_clause");
+  if (propArrow)
+    return isZeroArgCallTo(propArrow.namedChildren.find(Boolean), getName);
+  const accessorList = prop.namedChildren.find((c) => c?.type === "accessor_list");
+  if (!accessorList)
+    return false;
+  const getter = accessorList.namedChildren.find((a) => a?.type === "accessor_declaration" && a.children.some((c) => c?.text === "get"));
+  if (!getter)
+    return false;
+  const getArrow = getter.namedChildren.find((c) => c?.type === "arrow_expression_clause");
+  if (getArrow)
+    return isZeroArgCallTo(getArrow.namedChildren.find(Boolean), getName);
+  const block = getter.namedChildren.find((c) => c?.type === "block");
+  if (block) {
+    const stmts = block.namedChildren.filter((c) => c?.type !== "comment");
+    if (stmts.length === 1 && stmts[0]?.type === "return_statement") {
+      return isZeroArgCallTo(stmts[0].namedChildren.find(Boolean), getName);
+    }
+  }
+  return false;
+}
 var csharpPropertyNameMatchesGetMethodVisitor;
 var init_property_name_matches_get_method = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/csharp/property-name-matches-get-method.js"() {
@@ -162066,6 +162621,8 @@ var init_property_name_matches_get_method = __esm({
         });
         if (!hasGetMethod)
           return null;
+        if (getterDelegatesTo(node2, target))
+          return null;
         return makeViolation(this.ruleKey, node2, filePath, "low", "Property name matches a Get method", `Property \`${propName}\` coexists with a parameterless \`${target}()\` method \u2014 a confusing duplication of how the value is exposed.`, sourceCode, `Keep one accessor: either the property \`${propName}\` or the method \`${target}\`, not both.`);
       }
     };
@@ -162073,6 +162630,50 @@ var init_property_name_matches_get_method = __esm({
 });
 
 // packages/analyzer/dist/rules/code-quality/visitors/csharp/public-const-versioning-hazard.js
+function constFieldNames(fieldDecl) {
+  const names = [];
+  const varDecl = fieldDecl.namedChildren.find((c) => c?.type === "variable_declaration");
+  if (!varDecl)
+    return names;
+  for (const vd of varDecl.namedChildren) {
+    if (vd?.type !== "variable_declarator")
+      continue;
+    const n = vd.childForFieldName("name")?.text ?? vd.namedChildren.find((c) => c?.type === "identifier")?.text;
+    if (n)
+      names.push(n);
+  }
+  return names;
+}
+function referencedBySiblingConst(node2, names) {
+  let root = node2;
+  while (root.parent)
+    root = root.parent;
+  let found = false;
+  const scan3 = (n) => {
+    if (found)
+      return;
+    if (n.type === "field_declaration" && n.id !== node2.id && hasCSharpModifier(n, "const")) {
+      const varDecl = n.namedChildren.find((c) => c?.type === "variable_declaration");
+      if (varDecl) {
+        for (const vd of varDecl.namedChildren) {
+          if (vd?.type !== "variable_declarator")
+            continue;
+          const declaredName = vd.childForFieldName("name");
+          walkCSharp(vd, (id) => {
+            if (id.type === "identifier" && id.id !== declaredName?.id && names.includes(id.text)) {
+              found = true;
+            }
+          });
+        }
+      }
+    }
+    for (const c of n.namedChildren)
+      if (c)
+        scan3(c);
+  };
+  scan3(root);
+  return found;
+}
 var csharpPublicConstVersioningHazardVisitor;
 var init_public_const_versioning_hazard = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/csharp/public-const-versioning-hazard.js"() {
@@ -162088,6 +162689,9 @@ var init_public_const_versioning_hazard = __esm({
           return null;
         if (!hasCSharpModifier(node2, "public") && !hasCSharpModifier(node2, "protected"))
           return null;
+        const names = constFieldNames(node2);
+        if (names.length > 0 && referencedBySiblingConst(node2, names))
+          return null;
         return makeViolation(this.ruleKey, node2, filePath, "low", "Public constant versioning hazard", "A `public const` value is inlined into consumers at compile time and will not update unless they recompile \u2014 prefer `static readonly`.", sourceCode, "Replace the `public const` with a `public static readonly` field.");
       }
     };
@@ -162763,12 +163367,12 @@ var init_missing_access_modifier = __esm({
           return null;
         if (node2.parent?.parent?.type === "interface_declaration")
           return null;
+        if (node2.namedChildren.some((c) => c?.type === "explicit_interface_specifier"))
+          return null;
         if (node2.type === "method_declaration") {
           const nm = node2.childForFieldName("name");
           if (nm?.type === "qualified_name" || (nm?.text ?? "").includes("."))
             return null;
-          if (node2.namedChildren.some((c) => c?.type === "explicit_interface_specifier"))
-            return null;
         }
         if (node2.type === "constructor_declaration" && mods.includes("static"))
           return null;
@@ -162832,7 +163436,7 @@ function topLevelTypeIdentifiers(root) {
         const body = m.namedChildren.find((c) => c?.type === "declaration_list");
         if (body)
           collectFrom(body);
-      } else if (TYPE_DECL_TYPES2.has(m.type)) {
+      } else if (TYPE_DECL_TYPES3.has(m.type)) {
         const id = m.childForFieldName("name");
         if (id)
           out.push(id);
@@ -162845,6 +163449,8 @@ function topLevelTypeIdentifiers(root) {
 function nameMatches(fileName, typeName2) {
   if (fileName === typeName2)
     return true;
+  if (typeName2 === `${fileName}Attribute`)
+    return true;
   const brace = fileName.indexOf("{");
   if (brace > 0 && fileName.slice(0, brace) === typeName2)
     return true;
@@ -162853,12 +163459,12 @@ function nameMatches(fileName, typeName2) {
     return true;
   return false;
 }
-var TYPE_DECL_TYPES2, csharpFilenameTypeMismatchVisitor;
+var TYPE_DECL_TYPES3, csharpFilenameTypeMismatchVisitor;
 var init_csharp_filename_type_mismatch = __esm({
   "packages/analyzer/dist/rules/code-quality/visitors/csharp/csharp-filename-type-mismatch.js"() {
     "use strict";
     init_types3();
-    TYPE_DECL_TYPES2 = /* @__PURE__ */ new Set([
+    TYPE_DECL_TYPES3 = /* @__PURE__ */ new Set([
       "class_declaration",
       "struct_declaration",
       "interface_declaration",
@@ -162872,13 +163478,18 @@ var init_csharp_filename_type_mismatch = __esm({
       nodeTypes: ["compilation_unit"],
       visit(node2, filePath, sourceCode) {
         const base = filePath.split("/").pop() ?? "";
-        const fileName = base.replace(/\.[^.]*$/, "");
+        const lower = base.toLowerCase();
+        const compoundExt = [".cshtml.cs", ".razor.cs"].find((ext2) => lower.endsWith(ext2));
+        const fileName = compoundExt ? base.slice(0, base.length - compoundExt.length) : base.replace(/\.[^.]*$/, "");
         if (!fileName)
           return null;
+        const migrationName = fileName.match(/^\d{14}_(.+)$/)?.[1];
+        const candidateNames2 = migrationName ? [fileName, migrationName] : [fileName];
         const identifiers = topLevelTypeIdentifiers(node2);
         if (identifiers.length === 0)
           return null;
-        if (identifiers.some((id) => nameMatches(fileName, id.text)))
+        const matches = (id) => candidateNames2.some((fn) => nameMatches(fn, id.text)) || compoundExt !== void 0 && id.text === `${fileName}Model`;
+        if (identifiers.some(matches))
           return null;
         const first2 = identifiers[0];
         return makeViolation(this.ruleKey, first2, filePath, "low", "File name does not match a contained type", `File '${fileName}' declares type '${first2.text}' but no top-level type matches the file name; name the file after a type so it is easy to locate.`, sourceCode, `Rename the file after a contained type, e.g. ${first2.text}.cs.`);
@@ -163331,7 +163942,7 @@ var init_csharp6 = __esm({
     init_cognitive_complexity3();
     init_collapsible_else_if2();
     init_collapsible_if3();
-    init_commented_out_code3();
+    init_commented_out_code4();
     init_comparison_of_constant2();
     init_console_log2();
     init_contradictory_boolean_expression2();
@@ -163414,7 +164025,6 @@ var init_csharp6 = __esm({
     init_unnecessary_namespace_qualifier2();
     init_unsafe_any_usage2();
     init_unused_collection2();
-    init_unused_function_parameter2();
     init_unused_private_member2();
     init_unused_private_method2();
     init_unused_private_nested_class2();
@@ -163673,7 +164283,6 @@ var init_csharp6 = __esm({
       csharpUnnecessaryNamespaceQualifierVisitor,
       csharpUnsafeAnyUsageVisitor,
       csharpUnusedCollectionVisitor,
-      csharpUnusedFunctionParameterVisitor,
       csharpUnusedPrivateMemberVisitor,
       csharpUnusedPrivateMethodVisitor,
       csharpUnusedPrivateNestedClassVisitor,
@@ -165855,6 +166464,11 @@ function allElementsConstant(creation) {
     return false;
   return elements.every((e) => LITERAL_TYPES6.has(e.type));
 }
+function isGeneratedOrMigrationFile(filePath) {
+  if (/(^|[\\/])Migrations[\\/]/.test(filePath))
+    return true;
+  return /\.(designer|g|g\.i|generated)\.cs$/i.test(filePath);
+}
 var LITERAL_TYPES6, csharpConstantArrayArgumentVisitor;
 var init_constant_array_argument = __esm({
   "packages/analyzer/dist/rules/performance/visitors/csharp/constant-array-argument.js"() {
@@ -165875,6 +166489,8 @@ var init_constant_array_argument = __esm({
       languages: ["csharp"],
       nodeTypes: ["array_creation_expression", "implicit_array_creation_expression"],
       visit(node2, filePath, sourceCode) {
+        if (isGeneratedOrMigrationFile(filePath))
+          return null;
         if (node2.parent?.type !== "argument")
           return null;
         if (!getCSharpEnclosingFunction(node2))
@@ -166663,7 +167279,36 @@ var init_missing_finally_cleanup2 = __esm({
 });
 
 // packages/analyzer/dist/rules/reliability/visitors/csharp/unsafe-json-parse.js
-var JSON_PARSERS, csharpUnsafeJsonParseVisitor;
+function bodyDeclaresMember(body, name) {
+  for (const member of body.namedChildren) {
+    if (!member)
+      continue;
+    if (member.type === "property_declaration") {
+      if (member.childForFieldName("name")?.text === name)
+        return true;
+    } else if (member.type === "field_declaration") {
+      const decl = member.namedChildren.find((c) => c?.type === "variable_declaration");
+      for (const d of decl?.namedChildren ?? []) {
+        if (d?.type === "variable_declarator" && d.childForFieldName("name")?.text === name)
+          return true;
+      }
+    }
+  }
+  return false;
+}
+function enclosingTypeDeclaresMember(node2, name) {
+  let current = node2.parent;
+  while (current) {
+    if (TYPE_DECLS2.has(current.type)) {
+      const body = current.childForFieldName("body");
+      if (body && bodyDeclaresMember(body, name))
+        return true;
+    }
+    current = current.parent;
+  }
+  return false;
+}
+var JSON_PARSERS, TYPE_DECLS2, csharpUnsafeJsonParseVisitor;
 var init_unsafe_json_parse3 = __esm({
   "packages/analyzer/dist/rules/reliability/visitors/csharp/unsafe-json-parse.js"() {
     "use strict";
@@ -166678,15 +167323,25 @@ var init_unsafe_json_parse3 = __esm({
       JsonDocument: /* @__PURE__ */ new Set(["Parse", "ParseAsync"]),
       JsonNode: /* @__PURE__ */ new Set(["Parse"])
     };
+    TYPE_DECLS2 = /* @__PURE__ */ new Set([
+      "class_declaration",
+      "struct_declaration",
+      "record_declaration",
+      "record_struct_declaration"
+    ]);
     csharpUnsafeJsonParseVisitor = {
       ruleKey: "reliability/deterministic/unsafe-json-parse",
       languages: ["csharp"],
       nodeTypes: ["invocation_expression"],
       visit(node2, filePath, sourceCode) {
-        const receiver = simpleTypeName5(getCSharpReceiver(node2));
+        const rawReceiver = getCSharpReceiver(node2);
+        const receiver = simpleTypeName5(rawReceiver);
         const method = getCSharpMethodName(node2);
         if (!JSON_PARSERS[receiver]?.has(method))
           return null;
+        const bareReceiver = rawReceiver.startsWith("this.") ? rawReceiver.slice(5) : rawReceiver;
+        if (!bareReceiver.includes(".") && enclosingTypeDeclaresMember(node2, bareReceiver))
+          return null;
         const firstArg = getCSharpArguments(node2)[0];
         if (firstArg?.type === "invocation_expression") {
           const innerReceiver = simpleTypeName5(getCSharpReceiver(firstArg));
@@ -168393,18 +169048,10 @@ var init_logger_field_naming = __esm({
     csharpLoggerFieldNamingVisitor = {
       ruleKey: "style/deterministic/logger-field-naming",
       languages: ["csharp"],
-      nodeTypes: ["field_declaration", "property_declaration"],
+      nodeTypes: ["field_declaration"],
       visit(node2, filePath, sourceCode) {
         if (isAutoGeneratedCSharpFile(sourceCode))
           return null;
-        if (node2.type === "property_declaration") {
-          if (!isLoggerType(node2.childForFieldName("type")))
-            return null;
-          const name = node2.childForFieldName("name");
-          if (!name || ACCEPTED.test(name.text))
-            return null;
-          return makeViolation(this.ruleKey, name, filePath, "low", "Logger does not follow the naming convention", `Logger '${name.text}' does not follow the convention for logger members (camelCase, optionally _-prefixed).`, sourceCode, `Rename the logger to a camelCase name such as '_logger'.`);
-        }
         const declaration = node2.namedChildren.find((c) => c?.type === "variable_declaration");
         if (!declaration)
           return null;
@@ -169212,15 +169859,28 @@ function isNestedInType(node2) {
   const parent = node2.parent;
   if (parent?.type !== "declaration_list")
     return false;
-  return parent.parent != null && TYPE_DECL_TYPES3.has(parent.parent.type);
+  return parent.parent != null && TYPE_DECL_TYPES4.has(parent.parent.type);
 }
-var TYPE_DECL_TYPES3, csharpNestedTypePubliclyVisibleVisitor;
+function isConstantContainer(node2) {
+  if (node2.type !== "class_declaration")
+    return false;
+  if (!hasCSharpModifier(node2, "static"))
+    return false;
+  const body = node2.childForFieldName("body");
+  if (!body)
+    return false;
+  const members = body.namedChildren.filter((c) => c && c.type !== "comment");
+  if (members.length === 0)
+    return false;
+  return members.every((m) => m?.type === "field_declaration" && (hasCSharpModifier(m, "const") || hasCSharpModifier(m, "static") && hasCSharpModifier(m, "readonly")));
+}
+var TYPE_DECL_TYPES4, csharpNestedTypePubliclyVisibleVisitor;
 var init_nested_type_publicly_visible = __esm({
   "packages/analyzer/dist/rules/architecture/visitors/csharp/nested-type-publicly-visible.js"() {
     "use strict";
     init_types3();
     init_csharp_helpers();
-    TYPE_DECL_TYPES3 = /* @__PURE__ */ new Set([
+    TYPE_DECL_TYPES4 = /* @__PURE__ */ new Set([
       "class_declaration",
       "struct_declaration",
       "interface_declaration",
@@ -169238,6 +169898,8 @@ var init_nested_type_publicly_visible = __esm({
           return null;
         if (getCSharpAttributeNames(node2).length > 0)
           return null;
+        if (isConstantContainer(node2))
+          return null;
         const name = node2.childForFieldName("name")?.text ?? "type";
         return makeViolation(this.ruleKey, node2, filePath, "low", "Publicly visible nested type", `Nested type '${name}' is publicly visible, exposing an implementation detail of its containing type.`, sourceCode, `Make '${name}' private or internal, or lift it out to its own top-level type if it is a real part of the API.`);
       }
@@ -169325,6 +169987,8 @@ var init_type_outside_namespace = __esm({
 
 // packages/analyzer/dist/rules/architecture/visitors/csharp/_uri-helpers.js
 function nameLooksLikeUri(name) {
+  if (PREPOSITION_BEFORE_URI.test(name))
+    return false;
   if (URI_NAME_PATTERN.test(name))
     return true;
   return /(Url|Uri|Endpoint|Webhook)$/.test(name);
@@ -169332,11 +169996,12 @@ function nameLooksLikeUri(name) {
 function isStringType(typeNode) {
   return typeNode?.type === "predefined_type" && typeNode.text === "string";
 }
-var URI_NAME_PATTERN;
+var URI_NAME_PATTERN, PREPOSITION_BEFORE_URI;
 var init_uri_helpers = __esm({
   "packages/analyzer/dist/rules/architecture/visitors/csharp/_uri-helpers.js"() {
     "use strict";
     URI_NAME_PATTERN = /(^|[^a-z])(url|uri|uris|urls|endpoint|endpoints|webhook|webhookurl|callbackurl|redirecturi|redirecturl|hreflink|baseurl|baseaddress)$/i;
+    PREPOSITION_BEFORE_URI = /(In|As|Of|At|By|Within)(Url|Uri|Uris|Urls|Endpoint|Endpoints|Webhook)$/;
   }
 });
 
@@ -169374,13 +170039,22 @@ var init_uri_parameter_as_string = __esm({
 });
 
 // packages/analyzer/dist/rules/architecture/visitors/csharp/uri-property-as-string.js
-var csharpUriPropertyAsStringVisitor;
+function initializerProvesNotUri(valueNode) {
+  if (!valueNode || !isCSharpStringNode(valueNode))
+    return false;
+  const text4 = getCSharpStringText(valueNode);
+  if (text4 == null || text4.length === 0)
+    return false;
+  return !text4.includes("://");
+}
+var BINDING_ATTRIBUTES, csharpUriPropertyAsStringVisitor;
 var init_uri_property_as_string = __esm({
   "packages/analyzer/dist/rules/architecture/visitors/csharp/uri-property-as-string.js"() {
     "use strict";
     init_types3();
     init_csharp_helpers();
     init_uri_helpers();
+    BINDING_ATTRIBUTES = /* @__PURE__ */ new Set(["BindProperty", "FromQuery", "FromRoute", "FromForm", "ModelBinder"]);
     csharpUriPropertyAsStringVisitor = {
       ruleKey: "architecture/deterministic/uri-property-as-string",
       languages: ["csharp"],
@@ -169393,6 +170067,10 @@ var init_uri_property_as_string = __esm({
         const name = node2.childForFieldName("name")?.text;
         if (!name || !nameLooksLikeUri(name))
           return null;
+        if (getCSharpAttributeNames(node2).some((a) => BINDING_ATTRIBUTES.has(a)))
+          return null;
+        if (initializerProvesNotUri(node2.childForFieldName("value")))
+          return null;
         return makeViolation(this.ruleKey, node2.childForFieldName("type"), filePath, "low", "URI property typed as string", `Property '${name}' holds a URI but is typed as string; use System.Uri to get parsing and validation.`, sourceCode, `Change the type of '${name}' from string to System.Uri.`);
       }
     };
@@ -169430,6 +170108,21 @@ function isModelType(classDecl) {
   const name = classDecl.childForFieldName("name")?.text ?? "";
   return MODEL_NAME_SUFFIX.test(name);
 }
+function isServerConstructed(classDecl, body) {
+  for (const member of body.namedChildren) {
+    if (member?.type === "constructor_declaration") {
+      const params = member.childForFieldName("parameters");
+      if (params && params.namedChildCount > 0)
+        return true;
+    }
+    if (member?.type === "method_declaration" && hasCSharpModifier(member, "static")) {
+      const mName = member.childForFieldName("name")?.text ?? "";
+      if (mName === "Create" || mName.startsWith("From"))
+        return true;
+    }
+  }
+  return false;
+}
 function flaggablePropertyType(typeNode) {
   if (typeNode?.type !== "predefined_type")
     return null;
@@ -169442,7 +170135,7 @@ var init_value_type_action_param_under_posting = __esm({
     "use strict";
     init_types3();
     init_csharp_helpers();
-    MODEL_NAME_SUFFIX = /(Request|Dto|DTO|Model|ViewModel|Input|Form|Command|Query|Payload)$/;
+    MODEL_NAME_SUFFIX = /(Request|Input|Form|Command|Query|Payload)$/;
     SCALAR_VALUE_TYPES = /* @__PURE__ */ new Set(["int", "long", "short", "byte", "uint", "ulong", "ushort", "sbyte", "decimal", "double", "float", "bool", "char"]);
     csharpValueTypeActionParamUnderPostingVisitor = {
       ruleKey: "architecture/deterministic/value-type-action-param-under-posting",
@@ -169454,6 +170147,8 @@ var init_value_type_action_param_under_posting = __esm({
         const body = node2.childForFieldName("body");
         if (!body)
           return null;
+        if (isServerConstructed(node2, body))
+          return null;
         for (const member of body.namedChildren) {
           if (member?.type !== "property_declaration")
             continue;
@@ -169481,6 +170176,22 @@ var init_value_type_action_param_under_posting = __esm({
 });
 
 // packages/analyzer/dist/rules/architecture/visitors/csharp/action-missing-producesresponsetype.js
+function excludedFromApiExplorer(node2) {
+  for (const child of node2.children) {
+    if (child?.type !== "attribute_list")
+      continue;
+    for (const attr of child.namedChildren) {
+      if (attr?.type !== "attribute")
+        continue;
+      const name = (attr.childForFieldName("name")?.text ?? "").split(".").pop();
+      if (name !== "ApiExplorerSettings")
+        continue;
+      if (/\bIgnoreApi\s*=\s*true\b/i.test(attr.text))
+        return true;
+    }
+  }
+  return false;
+}
 function attributeNames7(node2) {
   const names = [];
   for (const child of node2.children) {
@@ -169528,6 +170239,8 @@ var init_action_missing_producesresponsetype = __esm({
         const classAttrs = attributeNames7(cls);
         if (classAttrs.some((a) => a.startsWith("ProducesResponseType") || a === "ProducesDefaultResponseType"))
           return null;
+        if (excludedFromApiExplorer(node2) || excludedFromApiExplorer(cls))
+          return null;
         const name = node2.childForFieldName("name");
         return makeViolation(this.ruleKey, name ?? node2, filePath, "low", "Controller action has no [ProducesResponseType]", `Action '${name?.text ?? ""}' declares no [ProducesResponseType]; its response shapes and status codes are missing from the API description.`, sourceCode, "Annotate the action with [ProducesResponseType] for each status code it can return.");
       }
@@ -171470,52 +172183,96 @@ var init_pyproject_checker = __esm({
 // packages/analyzer/dist/roslyn-host-client.js
 import { spawn as spawn6 } from "child_process";
 import { existsSync as existsSync9 } from "fs";
+import { tmpdir } from "os";
 import { dirname as dirname8, resolve as resolve9 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function resolveRoslynHostBinary() {
   const override = process.env[HOST_BINARY_ENV];
   if (override)
     return existsSync9(override) ? override : null;
-  const here = dirname8(fileURLToPath4(import.meta.url));
-  const rel = "tools/csharp-roslyn-host/bin/Release/net8.0/csharp-roslyn-host";
-  for (const up of ["../../..", "../../../..", "../../../../.."]) {
-    const candidate = resolve9(here, up, rel);
-    if (existsSync9(candidate))
-      return candidate;
+  const rels = [
+    "roslyn-host/csharp-roslyn-host.dll",
+    "tools/csharp-roslyn-host/bin/Release/net8.0/csharp-roslyn-host"
+  ];
+  let dir = dirname8(fileURLToPath4(import.meta.url));
+  for (let i = 0; i < 12; i++) {
+    for (const rel of rels) {
+      const candidate = resolve9(dir, rel);
+      if (existsSync9(candidate))
+        return candidate;
+    }
+    const parent = dirname8(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
   }
   return null;
 }
 function invokeHost(bin, request) {
   return new Promise((resolvePromise, reject) => {
-    const child = spawn6(bin, [], { stdio: ["pipe", "pipe", "pipe"] });
+    const viaDotnet = bin.endsWith(".dll");
+    const cmd = viaDotnet ? "dotnet" : bin;
+    const args = viaDotnet ? [bin] : [];
+    const child = spawn6(cmd, args, { stdio: ["pipe", "pipe", "pipe"], cwd: tmpdir() });
     let stdout = "";
     let stderr = "";
+    let settled = false;
+    const fail = (err) => {
+      if (settled)
+        return;
+      settled = true;
+      reject(err);
+    };
+    const succeed = (violations) => {
+      if (settled)
+        return;
+      settled = true;
+      resolvePromise(violations);
+    };
     child.stdout.setEncoding("utf8");
     child.stderr.setEncoding("utf8");
     child.stdout.on("data", (d) => stdout += d);
     child.stderr.on("data", (d) => stderr += d);
-    child.on("error", (e) => reject(new RoslynHostUnavailableError(`Failed to start the Roslyn host (${bin}): ${e.message}. Is the .NET runtime installed?`)));
-    child.on("close", () => {
-      const line = stdout.split("\n").find((l) => l.trim());
-      if (!line) {
-        reject(new Error(`Roslyn host produced no output.${stderr ? ` stderr: ${stderr}` : ""}`));
+    child.on("error", (e) => fail(new RoslynHostUnavailableError(`Failed to start the Roslyn host (${viaDotnet ? `dotnet ${bin}` : bin}): ${e.message}. Is the .NET runtime installed?`)));
+    child.stdin.on("error", () => {
+    });
+    child.on("close", (code, signalName) => {
+      if (code !== 0 || signalName) {
+        const reason = stderr.trim() || stdout.trim() || "(no output)";
+        fail(new RoslynHostUnavailableError(`The Roslyn host exited ${signalName ? `via ${signalName}` : `with code ${code}`} before responding. Is a compatible .NET runtime installed? Host output: ${reason}`));
+        return;
+      }
+      const lines = stdout.split("\n").map((l) => l.trim()).filter(Boolean);
+      if (lines.length === 0) {
+        fail(new Error(`Roslyn host produced no output.${stderr ? ` stderr: ${stderr}` : ""}`));
         return;
       }
       let resp;
-      try {
-        resp = JSON.parse(line);
-      } catch {
-        reject(new Error(`Roslyn host returned invalid JSON: ${line}`));
+      for (const l of lines) {
+        try {
+          const parsed = JSON.parse(l);
+          if (parsed && typeof parsed.ok === "boolean") {
+            resp = parsed;
+            break;
+          }
+        } catch {
+        }
+      }
+      if (!resp) {
+        fail(new Error(`Roslyn host returned invalid JSON: ${lines[0]}`));
         return;
       }
       if (!resp.ok) {
-        reject(new Error(`Roslyn host error: ${resp.error ?? "unknown"}`));
+        fail(new Error(`Roslyn host error: ${resp.error ?? "unknown"}`));
         return;
       }
-      resolvePromise(resp.violations ?? []);
+      succeed(resp.violations ?? []);
     });
-    child.stdin.write(JSON.stringify(request) + "\n");
-    child.stdin.end();
+    try {
+      child.stdin.write(JSON.stringify(request) + "\n");
+      child.stdin.end();
+    } catch {
+    }
   });
 }
 function runRoslynWorkspace(projectPath, rules) {
@@ -178074,7 +178831,7 @@ var init_schemas2 = __esm({
 // packages/core/dist/services/llm/cli-provider.js
 import { mkdirSync, writeFileSync } from "node:fs";
 import { join as join10 } from "node:path";
-import { tmpdir } from "node:os";
+import { tmpdir as tmpdir2 } from "node:os";
 import { randomUUID as randomUUID23 } from "node:crypto";
 var import_cross_spawn, BaseCLIProvider, ClaudeCodeProvider;
 var init_cli_provider = __esm({
@@ -178144,7 +178901,7 @@ var init_cli_provider = __esm({
       constructor(transport) {
         this.transport = transport;
         if (process.env.TRUECOURSE_CLI_DEBUG) {
-          this.debugDir = join10(tmpdir(), "truecourse-cli-debug");
+          this.debugDir = join10(tmpdir2(), "truecourse-cli-debug");
           mkdirSync(this.debugDir, { recursive: true });
           log.info(`[CLI] Debug output: ${this.debugDir}`);
         }
@@ -178257,8 +179014,13 @@ var init_cli_provider = __esm({
               unregisterChildProcess(this._repoId, child);
             reject(new Error(`[CLI] Failed to spawn ${this.binaryName}: ${err.message}`));
           });
-          child.stdin.write(prompt);
-          child.stdin.end();
+          child.stdin.on("error", () => {
+          });
+          try {
+            child.stdin.write(prompt);
+            child.stdin.end();
+          } catch {
+          }
         });
       }
       /** Extract usage data from CLI JSON envelope if present. */
@@ -186525,7 +187287,7 @@ var DOMAIN_LABELS = {
   "database": "Database",
   "style": "Style"
 };
-function buildAnalysisSteps(enabledCategories, enableLlmRules) {
+function buildAnalysisSteps(enabledCategories, enableLlmRules, hasCSharp) {
   const steps = [
     { key: "parse", label: "Parsing repository" }
   ];
@@ -186536,6 +187298,9 @@ function buildAnalysisSteps(enabledCategories, enableLlmRules) {
   for (const domain of activeDomains) {
     steps.push({ key: domain, label: `${DOMAIN_LABELS[domain]} checks` });
   }
+  if (hasCSharp) {
+    steps.push({ key: "csharp", label: "C# semantic analysis" });
+  }
   steps.push({ key: "persist", label: "Saving results" });
   return steps;
 }
@@ -186562,6 +187327,23 @@ var StepTracker = class {
       this.emit();
     }
   }
+  /**
+   * Insert a step at runtime, just before `persist`, if it isn't already there.
+   * Used for phases we can't declare up front — e.g. the C# semantic tier only
+   * exists when the repo actually has C#, which isn't known until files are read.
+   * No-op if the key already exists.
+   */
+  ensureStep(key4, label) {
+    if (this.steps.some((s) => s.key === key4))
+      return;
+    const persistIdx = this.steps.findIndex((s) => s.key === "persist");
+    const step = { key: key4, label, status: "pending" };
+    if (persistIdx === -1)
+      this.steps.push(step);
+    else
+      this.steps.splice(persistIdx, 0, step);
+    this.emit();
+  }
   setStatus(key4, status, detail) {
     const step = this.steps.find((s) => s.key === key4);
     if (step) {
@@ -195238,7 +196020,7 @@ import path17 from "node:path";
 function writeEvidence(params) {
   const dir = evidenceScenarioDir(params.repoRoot, params.runId, params.scenarioId);
   fs18.mkdirSync(dir, { recursive: true });
-  const failing = params.steps.find((s) => s.index === params.failingStep);
+  const focus = params.failingStep != null ? params.steps.find((s) => s.index === params.failingStep) : params.steps[params.steps.length - 1];
   const invocation = {
     scenarioId: params.scenarioId,
     title: params.title,
@@ -195258,11 +196040,11 @@ function writeEvidence(params) {
     }))
   };
   writeFile(dir, "invocation.json", JSON.stringify(invocation, null, 2));
-  if (failing) {
-    writeFile(dir, "stdout.raw.txt", failing.rawStdout);
-    writeFile(dir, "stdout.txt", failing.normStdout);
-    writeFile(dir, "stderr.raw.txt", failing.rawStderr);
-    writeFile(dir, "stderr.txt", failing.normStderr);
+  if (focus) {
+    writeFile(dir, "stdout.raw.txt", focus.rawStdout);
+    writeFile(dir, "stdout.txt", focus.normStdout);
+    writeFile(dir, "stderr.raw.txt", focus.rawStderr);
+    writeFile(dir, "stderr.txt", focus.normStderr);
   }
   const diffLines = [];
   if (params.outcome === "fail" && params.mismatch) {
@@ -195270,8 +196052,10 @@ function writeEvidence(params) {
     diffLines.push(`expected: ${params.mismatch.expected}`);
     diffLines.push(`actual:   ${params.mismatch.actual}`, "");
     diffLines.push(...params.mismatch.detail);
-  } else if (params.infraMessage) {
+  } else if (params.outcome === "error" && params.infraMessage) {
     diffLines.push(`step ${params.failingStep} \u2014 infrastructure error`, "", params.infraMessage);
+  } else if (params.outcome === "pass") {
+    diffLines.push(`all ${params.steps.length} step${params.steps.length === 1 ? "" : "s"} met their expectations`);
   }
   writeFile(dir, "diff.txt", diffLines.join("\n") + "\n");
   writeFile(dir, "files.txt", listSandboxFiles(params.sandboxCwd).join("\n") + "\n");
@@ -195385,7 +196169,7 @@ async function runScenario(scenario, ctx) {
         if (capture.spawnError || capture.timedOut) {
           const infra = capture.timedOut ? `step timed out after ${ctx.stepTimeoutMs}ms` : `failed to spawn: ${capture.spawnError}`;
           records.push(toRecord(stepIndex, argv, step.stdin, repeat3, iteration, capture, normText));
-          const evidencePath = writeEvidence({
+          const evidencePath2 = writeEvidence({
             repoRoot: ctx.repoRoot,
             runId: ctx.runId,
             scenarioId: scenario.id,
@@ -195403,7 +196187,7 @@ async function runScenario(scenario, ctx) {
             outcome: "error",
             durationMs: Date.now() - start,
             failure: { step: stepIndex, expected: "the step to run", actual: infra },
-            evidencePath
+            evidencePath: evidencePath2
           };
         }
         const normStdout = normText(capture.stdout);
@@ -195418,7 +196202,7 @@ async function runScenario(scenario, ctx) {
         });
         if (mismatch) {
           records.push(toRecord(stepIndex, argv, step.stdin, repeat3, iteration, capture, normText));
-          const evidencePath = writeEvidence({
+          const evidencePath2 = writeEvidence({
             repoRoot: ctx.repoRoot,
             runId: ctx.runId,
             scenarioId: scenario.id,
@@ -195440,7 +196224,7 @@ async function runScenario(scenario, ctx) {
               expected: mismatch.expected,
               actual: mismatch.actual
             },
-            evidencePath
+            evidencePath: evidencePath2
           };
         }
       }
@@ -195448,7 +196232,18 @@ async function runScenario(scenario, ctx) {
         records.push(toRecord(stepIndex, argv, step.stdin, repeat3, repeat3, lastCapture, normText));
       }
     }
-    return { ...base, outcome: "pass", durationMs: Date.now() - start };
+    const evidencePath = ctx.capturePassEvidence ? writeEvidence({
+      repoRoot: ctx.repoRoot,
+      runId: ctx.runId,
+      scenarioId: scenario.id,
+      title: scenario.title,
+      binds: scenario.binds,
+      outcome: "pass",
+      steps: records,
+      sandboxCwd: sandbox.cwd,
+      envPins: ENV_PINS
+    }) : void 0;
+    return { ...base, outcome: "pass", durationMs: Date.now() - start, ...evidencePath ? { evidencePath } : {} };
   } finally {
     sandbox.cleanup();
   }
@@ -195741,13 +196536,15 @@ async function runGuard(opts) {
     settled += 1;
     opts.onScenarioSettled?.(settled, selected.length, result);
   }
+  const capturePassEvidence = opts.persist !== false;
   const executed = await mapWithConcurrency(executable, concurrency, async ({ scenario, resolution }) => {
     const outcome = await runScenario(scenario, {
       repoRoot,
       runId,
       resolvedEntry,
       recipeEnv: loaded.recipe.env,
-      stepTimeoutMs
+      stepTimeoutMs,
+      capturePassEvidence
     });
     const result = resolution.kind === "remap" ? { ...outcome, remappedTo: resolution.section.anchor } : outcome;
     settled += 1;
@@ -196365,7 +197162,16 @@ var OverlapSchema = external_exports.object({
   /** Short note on what may disagree ("auth0_id vs auth0_sub"). */
   note: external_exports.string().default(""),
   /** The specific conflicting sections per doc (markdown headings), when known. */
-  sections: external_exports.array(OverlapSectionSchema).default([])
+  sections: external_exports.array(OverlapSectionSchema).default([]),
+  /**
+   * The area ids this dispute spans. Detection runs per area, so one disagreement
+   * on a doc pair sharing several areas is flagged in each; the cross-area merge
+   * collapses those to this single record and lists every area it spanned here, so
+   * a resolution scoped to any of them clears the dispute everywhere. Empty for
+   * older corpora written before the merge — the read layer recomputes the span
+   * from the per-area placement of the (then-duplicated) records.
+   */
+  areas: external_exports.array(external_exports.string()).default([])
 });
 var AreaSchema = external_exports.object({
   /** Canonical area id, `product/concern`. */
@@ -197140,6 +197946,7 @@ init_zod();
 import { createHash as createHash6 } from "node:crypto";
 import fs28 from "node:fs";
 init_transport();
+init_dist();
 var DEFAULT_MAX_PAIRS_PER_AREA = 60;
 async function flagOverlaps(repoRoot, areas, docs, opts = {}) {
   const result = /* @__PURE__ */ new Map();
@@ -197211,7 +198018,7 @@ async function flagOverlaps(repoRoot, areas, docs, opts = {}) {
         examineOne(repoRoot, pair.areaId, pair.a, pair.b, runner2).then((verdict) => {
           if (verdict.overlap) {
             const list = result.get(pair.areaId) ?? [];
-            list.push({ docs: [pair.a.path, pair.b.path], note: verdict.note, sections: verdict.sections ?? [] });
+            list.push({ docs: [pair.a.path, pair.b.path], note: verdict.note, sections: verdict.sections ?? [], areas: [] });
             result.set(pair.areaId, list);
           }
         }).catch(() => {
@@ -197229,19 +198036,13 @@ async function flagOverlaps(repoRoot, areas, docs, opts = {}) {
     };
     launch();
   });
-  const seenKeys = /* @__PURE__ */ new Set();
-  for (const areaId of [...result.keys()].sort()) {
-    const kept = result.get(areaId).filter((ov) => {
-      const key4 = overlapDedupKey(ov);
-      if (seenKeys.has(key4))
-        return false;
-      seenKeys.add(key4);
-      return true;
-    });
-    if (kept.length === 0)
-      result.delete(areaId);
-    else
-      result.set(areaId, kept);
+  const entries = [...result].flatMap(([area, list]) => list.map((overlap) => ({ area, overlap })));
+  const merged = dedupeCrossAreaOverlaps(entries);
+  result.clear();
+  for (const m of merged) {
+    const list = result.get(m.area) ?? [];
+    list.push({ ...m.overlap, areas: m.areas });
+    result.set(m.area, list);
   }
   for (const [areaId, list] of result) {
     list.sort((x, y) => x.docs.join() < y.docs.join() ? -1 : 1);
@@ -197249,11 +198050,6 @@ async function flagOverlaps(repoRoot, areas, docs, opts = {}) {
   }
   return result;
 }
-function overlapDedupKey(ov) {
-  const docs = [...ov.docs].sort().join("::");
-  const secs = (ov.sections ?? []).map((s) => `${s.doc}|${s.heading}`).sort().join("::");
-  return `${docs}##${secs}`;
-}
 async function examineOne(repoRoot, areaId, a, b, runner2) {
   const cacheKey = computeCacheKey4(areaId, a, b);
   const cached = await readCache3(repoRoot, cacheKey);
@@ -205321,7 +206117,7 @@ var SKIP_DIRS2 = /* @__PURE__ */ new Set([
   "obj",
   ".vs"
 ]);
-function isTestFile2(filePath) {
+function isTestFile3(filePath) {
   const parts = filePath.replace(/\\/g, "/").split("/");
   const fileName = parts[parts.length - 1] ?? "";
   if (/\.(test|spec)\.[mc]?[jt]sx?$/.test(fileName))
@@ -205355,7 +206151,7 @@ async function eachParsedSource(rootDir, visit) {
       }
       if (!entry.isFile())
         continue;
-      if (isTestFile2(full))
+      if (isTestFile3(full))
         continue;
       const lang = EXT_TO_LANG[path33.extname(entry.name)];
       if (!lang)
@@ -205435,19 +206231,19 @@ function readCsharpString(node2, source) {
   }
   if (node2.type === "interpolated_string_expression") {
     let text4 = "";
-    let hasInterpolation2 = false;
+    let hasInterpolation = false;
     for (let i = 0; i < node2.namedChildCount; i++) {
       const c = node2.namedChild(i);
       if (!c)
         continue;
       if (c.type === "interpolation") {
         text4 += " /*INTERP*/ ";
-        hasInterpolation2 = true;
+        hasInterpolation = true;
       } else {
         text4 += source.slice(c.startIndex, c.endIndex);
       }
     }
-    return { text: text4, hasInterpolation: hasInterpolation2 };
+    return { text: text4, hasInterpolation };
   }
   if (node2.type === "binary_expression") {
     const op = node2.childForFieldName("operator");
@@ -209370,14 +210166,14 @@ function getSqlText(node2, source) {
   return { text: source.slice(node2.startIndex, node2.endIndex), hasInterpolation: false };
 }
 function extractFromSqlSource(sqlNode, filePath, source) {
-  const { text: text4, hasInterpolation: hasInterpolation2 } = getSqlText(sqlNode, source);
-  return buildQueriesFromSqlText(text4, hasInterpolation2, {
+  const { text: text4, hasInterpolation } = getSqlText(sqlNode, source);
+  return buildQueriesFromSqlText(text4, hasInterpolation, {
     filePath,
     lineStart: sqlNode.startPosition.row + 1,
     lineEnd: sqlNode.endPosition.row + 1
   });
 }
-function buildQueriesFromSqlText(text4, hasInterpolation2, loc, adapterName = "raw-sql") {
+function buildQueriesFromSqlText(text4, hasInterpolation, loc, adapterName = "raw-sql") {
   if (!text4 || !/\bSELECT\b/i.test(text4))
     return [];
   const blocks = splitSelectBlocks(text4);
@@ -209396,7 +210192,7 @@ function buildQueriesFromSqlText(text4, hasInterpolation2, loc, adapterName = "r
       else
         unparseable.push({ reason: "unrecognised SQL predicate", raw: piece });
     }
-    if (hasInterpolation2) {
+    if (hasInterpolation) {
       unparseable.push({ reason: "string-interpolation substitution skipped", raw: "${...}" });
     }
     out.push({
@@ -209761,7 +210557,7 @@ function pySqlText(node2, source) {
 function readPyStringNode(node2, source) {
   if (node2.type === "concatenated_string") {
     let text5 = "";
-    let hasInterpolation3 = false;
+    let hasInterpolation2 = false;
     for (let i = 0; i < node2.namedChildCount; i++) {
       const c = node2.namedChild(i);
       if (!c)
@@ -209769,15 +210565,15 @@ function readPyStringNode(node2, source) {
       const part = readPyStringNode(c, source);
       if (part) {
         text5 += part.text;
-        hasInterpolation3 = hasInterpolation3 || part.hasInterpolation;
+        hasInterpolation2 = hasInterpolation2 || part.hasInterpolation;
       }
     }
-    return { text: text5, hasInterpolation: hasInterpolation3 };
+    return { text: text5, hasInterpolation: hasInterpolation2 };
   }
   if (node2.type !== "string")
     return null;
   let text4 = "";
-  let hasInterpolation2 = false;
+  let hasInterpolation = false;
   for (let i = 0; i < node2.namedChildCount; i++) {
     const c = node2.namedChild(i);
     if (!c)
@@ -209786,10 +210582,10 @@ function readPyStringNode(node2, source) {
       text4 += source.slice(c.startIndex, c.endIndex);
     else if (c.type === "interpolation") {
       text4 += " /*INTERP*/ ";
-      hasInterpolation2 = true;
+      hasInterpolation = true;
     }
   }
-  return { text: text4, hasInterpolation: hasInterpolation2 };
+  return { text: text4, hasInterpolation };
 }
 
 // packages/contract-verifier/dist/extractor/query/shared/python-orm.js
@@ -216899,7 +217695,7 @@ async function buildCodebaseScan(codeDir) {
 
 // packages/contract-verifier/dist/extractor/index.js
 var TS_EXT4 = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
-function isTestFile3(filePath) {
+function isTestFile4(filePath) {
   const parts = filePath.replace(/\\/g, "/").split("/");
   const fileName = parts[parts.length - 1];
   if (/\.(test|spec)\.(t|j)sx?$/.test(fileName))
@@ -216929,7 +217725,7 @@ async function extractOperationsFromDir(rootDir) {
       const ext2 = path44.extname(entry.name);
       if (!TS_EXT4.has(ext2))
         continue;
-      if (isTestFile3(full))
+      if (isTestFile4(full))
         continue;
       const source = fs43.readFileSync(full, "utf-8");
       const lang = ext2 === ".ts" || ext2 === ".tsx" ? ext2 === ".tsx" ? "tsx" : "typescript" : "javascript";
@@ -226618,7 +227414,7 @@ var PROMPT_OVERHEAD_TOKENS = 500;
 var TOKENS_PER_RULE = 50;
 var TOKENS_PER_FILE_PATH = 25;
 var MAX_CHARS_PER_BATCH = 1e5;
-function isTestFile4(filePath) {
+function isTestFile5(filePath) {
   return TEST_PATTERNS.some((p) => filePath.includes(p));
 }
 function matchesFileFilter(fa, filter2, fileContent) {
@@ -226653,7 +227449,7 @@ function matchesFileFilter(fa, filter2, fileContent) {
       return false;
   }
   if (filter2.isTestFile !== void 0) {
-    if (filter2.isTestFile !== isTestFile4(fa.filePath))
+    if (filter2.isTestFile !== isTestFile5(fa.filePath))
       return false;
   }
   if (filter2.languages) {
@@ -231405,21 +232201,21 @@ function node(getModule) {
     if (lineMatch) {
       let object;
       let method;
-      let functionName;
+      let functionName2;
       let typeName2;
       let methodName3;
       if (lineMatch[1]) {
-        functionName = lineMatch[1];
-        let methodStart = functionName.lastIndexOf(".");
-        if (functionName[methodStart - 1] === ".") {
+        functionName2 = lineMatch[1];
+        let methodStart = functionName2.lastIndexOf(".");
+        if (functionName2[methodStart - 1] === ".") {
           methodStart--;
         }
         if (methodStart > 0) {
-          object = functionName.slice(0, methodStart);
-          method = functionName.slice(methodStart + 1);
+          object = functionName2.slice(0, methodStart);
+          method = functionName2.slice(methodStart + 1);
           const objectEnd = object.indexOf(".Module");
           if (objectEnd > 0) {
-            functionName = functionName.slice(objectEnd + 1);
+            functionName2 = functionName2.slice(objectEnd + 1);
             object = object.slice(0, objectEnd);
           }
         }
@@ -231431,11 +232227,11 @@ function node(getModule) {
       }
       if (method === "<anonymous>") {
         methodName3 = void 0;
-        functionName = void 0;
+        functionName2 = void 0;
       }
-      if (functionName === void 0) {
+      if (functionName2 === void 0) {
         methodName3 = methodName3 || UNKNOWN_FUNCTION;
-        functionName = typeName2 ? `${typeName2}.${methodName3}` : methodName3;
+        functionName2 = typeName2 ? `${typeName2}.${methodName3}` : methodName3;
       }
       let filename = lineMatch[2]?.startsWith("file://") ? lineMatch[2].slice(7) : lineMatch[2];
       const isNative = lineMatch[5] === "native";
@@ -231448,7 +232244,7 @@ function node(getModule) {
       return {
         filename: filename ? decodeURI(filename) : void 0,
         module: getModule ? getModule(filename) : void 0,
-        function: functionName,
+        function: functionName2,
         lineno: _parseIntOrUndefined(lineMatch[3]),
         colno: _parseIntOrUndefined(lineMatch[4]),
         in_app: filenameIsInApp(filename || "", isNative),
@@ -231645,7 +232441,7 @@ function readToolVersion() {
   if (cachedVersion)
     return cachedVersion;
   if (true) {
-    cachedVersion = "0.7.0-next.4";
+    cachedVersion = "0.7.0-next.6";
     return cachedVersion;
   }
   try {
@@ -234043,7 +234839,7 @@ function findCSharpProjectFiles(repoPath) {
           continue;
         walk20(path63.join(dir, e.name), depth + 1);
       } else if (e.isFile()) {
-        if (e.name.endsWith(".sln"))
+        if (e.name.endsWith(".sln") || e.name.endsWith(".slnx"))
           solutions.push(path63.join(dir, e.name));
         else if (e.name.endsWith(".csproj"))
           projects.push(path63.join(dir, e.name));
@@ -234306,6 +235102,29 @@ async function runViolationPipeline(input) {
       }
     }
   }
+  {
+    const detByDomain = /* @__PURE__ */ new Map();
+    for (const v of allCodeViolations) {
+      const d = v.ruleKey.split("/")[0];
+      detByDomain.set(d, (detByDomain.get(d) ?? 0) + 1);
+    }
+    const archDet = serviceViolationResults.length + moduleViolationResults.length + methodViolationResults.length;
+    if (archDet > 0)
+      detByDomain.set("architecture", (detByDomain.get("architecture") ?? 0) + archDet);
+    for (const domain of DOMAIN_ORDER) {
+      const count = detByDomain.get(domain) ?? 0;
+      tracker?.done(domain, count > 0 ? `${count} violations` : "Clean");
+    }
+  }
+  const detViolationCount = allCodeViolations.length;
+  let csharpStepActive = false;
+  const startCsharpStep = (detail) => {
+    if (!csharpStepActive) {
+      tracker?.ensureStep("csharp", "C# semantic analysis");
+      csharpStepActive = true;
+    }
+    tracker?.start("csharp", detail);
+  };
   const enabledHostRules = enabledCodeRules.filter((r) => r.engine === "roslyn-host");
   if (enabledHostRules.length > 0) {
     const csharpFiles = [];
@@ -234319,6 +235138,7 @@ async function runViolationPipeline(input) {
         csharpFiles.push({ path: key4, text: fc.content });
     }
     if (csharpFiles.length > 0) {
+      startCsharpStep(`Analyzing ${csharpFiles.length} C# files\u2026`);
       const ruleByKey = new Map(enabledHostRules.map((r) => [r.key, r]));
       const hostViolations = await runRoslynHost(csharpFiles, enabledHostRules.map((r) => r.key));
       for (const v of hostViolations) {
@@ -234345,19 +235165,20 @@ async function runViolationPipeline(input) {
   if (enabledWorkspaceRules.length > 0 && filesToScan.some((f2) => detectLanguage(f2.filePath) === "csharp")) {
     const projectFiles = findCSharpProjectFiles(repoPath);
     if (projectFiles.length === 0) {
-      log.info("[Pipeline] C# present but no .csproj/.sln found \u2014 project-aware C# rules skipped");
+      log.info("[Pipeline] C# present but no .csproj/.sln/.slnx found \u2014 project-aware C# rules skipped");
     } else {
       const ruleByKey = new Map(enabledWorkspaceRules.map((r) => [r.key, r]));
       const ruleKeys = enabledWorkspaceRules.map((r) => r.key);
-      for (const projectFile of projectFiles) {
+      for (const [pi, projectFile] of projectFiles.entries()) {
+        startCsharpStep(projectFiles.length > 1 ? `Loading project ${pi + 1}/${projectFiles.length}: ${path63.basename(projectFile)}\u2026` : `Loading project ${path63.basename(projectFile)}\u2026`);
         let wsViolations;
         try {
           wsViolations = await runRoslynWorkspace(projectFile, ruleKeys);
         } catch (err) {
+          tracker?.error("csharp", `Project load failed: ${path63.basename(projectFile)}`);
           if (err instanceof RoslynHostUnavailableError)
             throw err;
-          log.warn(`[Pipeline] Project-aware C# rules skipped for ${path63.basename(projectFile)}: ${err.message}. Restore the project (\`dotnet restore\`) for full C# coverage.`);
-          continue;
+          throw new Error(`Project-aware C# analysis failed for ${path63.basename(projectFile)}: ${err.message}. Restore the project (\`dotnet restore\`) and ensure its pinned .NET SDK is installed.`);
         }
         for (const v of wsViolations) {
           const rule = ruleByKey.get(v.ruleKey);
@@ -234389,6 +235210,10 @@ async function runViolationPipeline(input) {
       }
     }
   }
+  if (csharpStepActive) {
+    const csharpFindings = allCodeViolations.length - detViolationCount;
+    tracker?.done("csharp", csharpFindings > 0 ? `${csharpFindings} violations` : "Clean");
+  }
   log.info(`[Pipeline] Code scan: ${allCodeViolations.length} violations from ${filesToScan.length} files (${enabledCodeRules.length} det rules, ${enabledLlmCodeRules.length} LLM rules)`);
   if (enabledCodeRules.some((r) => r.key === "bugs/deterministic/invalid-pyproject-toml")) {
     const pyprojectPath = path63.join(repoPath, "pyproject.toml");
@@ -234434,10 +235259,6 @@ async function runViolationPipeline(input) {
   }
   const totalDet = [...violationsByDomain.values()].reduce((a, b) => a + b, 0);
   log.info(`[Pipeline] Totals: ${DOMAIN_ORDER.filter((d) => violationsByDomain.has(d)).map((d) => `${d}=${violationsByDomain.get(d)}`).join(", ")} (${totalDet})`);
-  for (const domain of DOMAIN_ORDER) {
-    const count = violationsByDomain.get(domain) ?? 0;
-    tracker?.done(domain, count > 0 ? `${count} violations` : "Clean");
-  }
   onProgress?.({ step: "analyzing", percent: 84, detail: "Code checks done" });
   const prevLlmCodeByFile = /* @__PURE__ */ new Map();
   for (const cv of previousActiveCodeViolations) {
@@ -239312,7 +240133,41 @@ var guard_default = router13;
 var import_express14 = __toESM(require_express2(), 1);
 
 // packages/core/dist/commands/guard-in-process.js
+init_dist();
 init_transport();
+var OpenConflictsError = class extends Error {
+  conflicts;
+  constructor(conflicts2) {
+    super(formatOpenConflictsMessage(conflicts2));
+    this.conflicts = conflicts2;
+    this.name = "OpenConflictsError";
+  }
+};
+function formatOpenConflictsMessage(conflicts2) {
+  const lines = [
+    `${conflicts2.length} open spec conflict${conflicts2.length === 1 ? "" : "s"} must be resolved before guard generate.`,
+    "Extracting both sides of an unresolved overlap births a red finding that is really the dispute.",
+    ""
+  ];
+  for (const c of conflicts2) {
+    lines.push(`  ${c.area}`);
+    lines.push(`    ${c.a}  \u2194  ${c.b}`);
+    if (c.note)
+      lines.push(`    ${c.note}`);
+  }
+  lines.push("");
+  lines.push("Resolve them with `truecourse spec conflicts list` (or the dashboard Conflicts group), then re-run `truecourse guard generate`.");
+  return lines.join("\n");
+}
+async function assertNoOpenConflicts(repoRoot) {
+  const corpus = await getCorpus(repoRoot);
+  if (!corpus)
+    return;
+  const decisions = await getDecisions(repoRoot);
+  const open = openConflicts(corpus, decisions);
+  if (open.length > 0)
+    throw new OpenConflictsError(open);
+}
 var GUARD_GENERATE_STEPS = [
   { key: "index", label: "Indexing sections" },
   { key: "extract", label: "Extracting claims" },
@@ -239348,6 +240203,7 @@ function resolveTransport2(options) {
 }
 async function guardGenerateInProcess(repoRoot, options = {}) {
   const { tracker } = options;
+  await assertNoOpenConflicts(repoRoot);
   if (options.onLlmEstimate) {
     const prices = await getModelPrices();
     const estimate = await estimateGuardTokens(repoRoot, prices);
@@ -239596,6 +240452,10 @@ router14.post("/:id/guard/generate", async (req, res, next) => {
       res.json({ cancelled: true });
       return;
     }
+    if (e instanceof OpenConflictsError) {
+      res.status(422).json({ error: e.message });
+      return;
+    }
     emitSpecProgress(repoId, { step: "error", percent: 100, detail: e.message });
     next(e);
   } finally {