import { createHash } from 'node:crypto';
import { existsSync, readdirSync, readFileSync, realpathSync, statSync } from 'node:fs';
import { readFile } from 'node:fs/promises';
import { basename, dirname, extname, isAbsolute, join, relative, resolve } from 'node:path';
import type { ReviewExecutionPack } from '@decantr/core';
import type { EssenceFile, EssenceV4, GuardViolation } from '@decantr/essence-spec';
import { evaluateGuard, isV4, validateEssence } from '@decantr/essence-spec';
import * as ts from 'typescript';
import { auditBuiltDist, emptyRuntimeAudit, type RuntimeAudit } from './runtime.js';

export type {
  InteractionMissingFinding,
  InteractionRequirement,
  InteractionSignal,
} from './interactions.js';
// V4 C4 — experiential interaction verifier.
export {
  INTERACTION_SIGNALS,
  listKnownInteractions,
  verifyInteractionsInSource,
} from './interactions.js';
export type { BuiltDistAuditOptions, RuntimeAudit } from './runtime.js';
export { auditBuiltDist, emptyRuntimeAudit } from './runtime.js';
export type {
  GitHubScanInputResolution,
  PublishedSiteProbeV1,
  ScanApplicabilityStatus,
  ScanConfidence,
  ScanFindingSeverity,
  ScanFindingV1,
  ScanInputKind,
  ScanInputV1,
  ScanProjectOptions,
  ScanReportV1,
  ScanRepositoryV1,
  ScanRouteV1,
} from './scan.js';
export {
  SCAN_REPORT_SCHEMA_URL,
  createUnavailableScanReport,
  probePublishedSite,
  resolveGitHubScanInput,
  scanProject,
} from './scan.js';

export const VERIFICATION_SCHEMA_URLS = {
  common: 'https://decantr.ai/schemas/verification-report.common.v1.json',
  projectAudit: 'https://decantr.ai/schemas/project-audit-report.v1.json',
  projectHealth: 'https://decantr.ai/schemas/project-health-report.v1.json',
  decantrCi: 'https://decantr.ai/schemas/decantr-ci-report.v1.json',
  evidenceBundle: 'https://decantr.ai/schemas/evidence-bundle.v1.json',
  scanReport: 'https://decantr.ai/schemas/scan-report.v1.json',
  workspaceHealth: 'https://decantr.ai/schemas/workspace-health-report.v1.json',
  fileCritique: 'https://decantr.ai/schemas/file-critique-report.v1.json',
  showcaseShortlist: 'https://decantr.ai/schemas/showcase-shortlist-report.v1.json',
} as const;

export type VerificationSeverity = 'error' | 'warn' | 'info';
export type ProjectHealthStatus = 'healthy' | 'warning' | 'error';
export type ProjectHealthFindingSource =
  | 'audit'
  | 'assertion'
  | 'browser'
  | 'check'
  | 'brownfield'
  | 'design-token'
  | 'runtime'
  | 'pack'
  | 'interaction';

export interface VerificationFinding {
  id: string;
  category: string;
  severity: VerificationSeverity;
  message: string;
  evidence: string[];
  target?: string;
  file?: string;
  rule?: string;
  suggestedFix?: string;
}

export interface VerificationScore {
  category: string;
  focusArea: string;
  score: number;
  details: string;
  suggestions: string[];
}

interface PackManifestEntry {
  id: string;
  markdown: string;
  json: string;
}

export interface PackManifest {
  $schema?: string;
  version: string;
  generatedAt: string;
  scaffold: PackManifestEntry | null;
  review?: PackManifestEntry | null;
  sections: Array<PackManifestEntry & { pageIds: string[] }>;
  pages: Array<PackManifestEntry & { sectionId: string | null; sectionRole: string | null }>;
  mutations?: Array<PackManifestEntry & { mutationType: string }>;
}

export interface MissingPackManifestFile {
  entryId: string;
  kind: 'scaffold' | 'review' | 'section' | 'page' | 'mutation';
  field: 'markdown' | 'json';
  relativePath: string;
  absolutePath: string;
}

export interface ProjectAuditReport {
  $schema: string;
  projectRoot: string;
  valid: boolean;
  essence: EssenceFile | null;
  reviewPack: ReviewExecutionPack | null;
  packManifest: PackManifest | null;
  runtimeAudit: RuntimeAudit;
  findings: VerificationFinding[];
  summary: {
    errorCount: number;
    warnCount: number;
    infoCount: number;
    essenceVersion: string | null;
    reviewPackPresent: boolean;
    packManifestPresent: boolean;
    runtimeAuditChecked: boolean;
    runtimePassed: boolean | null;
    pageCount: number;
  };
}

export interface ProjectHealthRemediation {
  summary: string;
  prompt: string;
  commands: string[];
}

export interface ProjectHealthFinding {
  id: string;
  source: ProjectHealthFindingSource;
  category: string;
  severity: VerificationSeverity;
  message: string;
  evidence: string[];
  target?: string;
  file?: string;
  rule?: string;
  suggestedFix?: string;
  remediation: ProjectHealthRemediation;
}

export interface ProjectHealthRouteSummary {
  declared: string[];
  runtimeChecked: string[];
  runtimeMatched: number;
  runtimeCoverageOk: boolean | null;
  issues: string[];
}

export interface ProjectHealthPackSummary {
  manifestPresent: boolean;
  reviewPackPresent: boolean;
  scaffoldPackPresent: boolean;
  sectionPackCount: number;
  pagePackCount: number;
  mutationPackCount: number;
  generatedAt: string | null;
}

export interface ProjectHealthReport {
  $schema: string;
  generatedAt: string;
  projectRoot: string;
  status: ProjectHealthStatus;
  score: number;
  summary: {
    errorCount: number;
    warnCount: number;
    infoCount: number;
    findingCount: number;
    workflowMode: string | null;
    adoptionMode: string | null;
    essenceVersion: string | null;
    pageCount: number;
    runtimeAuditChecked: boolean;
    runtimePassed: boolean | null;
    packManifestPresent: boolean;
    reviewPackPresent: boolean;
  };
  routes: ProjectHealthRouteSummary;
  packs: ProjectHealthPackSummary;
  ci: {
    recommendedCommand: string;
    failOn: 'error' | 'warn' | 'none';
  };
  findings: ProjectHealthFinding[];
}

export type ContractAssertionCategory =
  | 'route'
  | 'shell'
  | 'region'
  | 'interaction'
  | 'accessibility'
  | 'design-token'
  | 'context'
  | 'policy';

export interface ContractAssertion {
  id: string;
  category: ContractAssertionCategory;
  status: 'passed' | 'failed' | 'not_applicable';
  severity: VerificationSeverity;
  message: string;
  evidence: string[];
  target?: string;
  rule: string;
  suggestedFix?: string;
}

export interface EvidenceProvenanceEntry {
  path: string;
  present: boolean;
  hash: string | null;
  generatedAt: string | null;
}

export interface EvidenceBundle {
  $schema: string;
  generatedAt: string;
  project: {
    id: string;
    rootLabel: string;
  };
  toolchain: {
    verifierVersion: string | null;
  };
  privacy: {
    localOnly: boolean;
    redactedFields: string[];
    screenshotsLocalOnly: boolean;
  };
  health: {
    status: ProjectHealthStatus;
    score: number;
    errorCount: number;
    warnCount: number;
    infoCount: number;
    findingCount: number;
  };
  provenance: {
    essence: EvidenceProvenanceEntry;
    packManifest: EvidenceProvenanceEntry;
    reviewPack: EvidenceProvenanceEntry;
    workspaceConfig?: EvidenceProvenanceEntry;
    designTokens?: EvidenceProvenanceEntry;
  };
  assertions: ContractAssertion[];
  findings: Array<{
    id: string;
    source: ProjectHealthFindingSource;
    category: string;
    severity: VerificationSeverity;
    message: string;
    evidence: string[];
    target?: string;
    rule?: string;
    suggestedFix?: string;
    remediationSummary: string;
    commands: string[];
    promptCommand: string;
  }>;
  browser?: {
    enabled: boolean;
    status: 'not_requested' | 'unavailable' | 'passed' | 'failed';
    baseUrl: string | null;
    screenshots: string[];
    findings: string[];
  };
  designTokens?: {
    source: string;
    status: 'not_requested' | 'passed' | 'warning' | 'error';
    compared: number;
    matched: number;
    missing: string[];
  };
}

export interface EvidenceBundleInput {
  projectRoot: string;
  report: ProjectHealthReport;
  audit?: ProjectAuditReport | null;
  assertions?: ContractAssertion[];
  verifierVersion?: string | null;
  workspaceConfigPath?: string | null;
  designTokensPath?: string | null;
  browser?: EvidenceBundle['browser'];
  designTokens?: EvidenceBundle['designTokens'];
}

export const EVIDENCE_BUNDLE_SCHEMA_URL = 'https://decantr.ai/schemas/evidence-bundle.v1.json';

function hashString(value: string): string {
  return createHash('sha256').update(value).digest('hex').slice(0, 16);
}

function hashFile(path: string): string | null {
  if (!existsSync(path)) return null;
  try {
    return createHash('sha256').update(readFileSync(path)).digest('hex');
  } catch {
    return null;
  }
}

function provenanceEntry(projectRoot: string, relativePath: string): EvidenceProvenanceEntry {
  const path = join(projectRoot, relativePath);
  if (!existsSync(path)) {
    return {
      path: relativePath,
      present: false,
      hash: null,
      generatedAt: null,
    };
  }

  let generatedAt: string | null = null;
  try {
    generatedAt = statSync(path).mtime.toISOString();
  } catch {
    generatedAt = null;
  }

  return {
    path: relativePath,
    present: true,
    hash: hashFile(path),
    generatedAt,
  };
}

function provenanceForPath(projectRoot: string, path: string): EvidenceProvenanceEntry {
  const rel = isAbsolute(path) ? relative(projectRoot, path).replace(/\\/g, '/') : path;
  return provenanceEntry(projectRoot, rel && !rel.startsWith('..') ? rel : basename(path));
}

function redactEvidenceText(projectRoot: string, value: string): string {
  const normalizedRoot = projectRoot.replace(/\\/g, '/');
  const normalized = value.replace(/\\/g, '/');
  if (normalized.includes(normalizedRoot)) {
    return normalized.split(normalizedRoot).join('<project>');
  }
  return normalized.replace(/\/Users\/[^/\s]+/g, '~').replace(/\/home\/[^/\s]+/g, '~');
}

function redactEvidenceList(projectRoot: string, evidence: string[]): string[] {
  return evidence.map((entry) => redactEvidenceText(projectRoot, entry));
}

function assertion(
  input: Omit<ContractAssertion, 'status'> & { status?: ContractAssertion['status'] },
): ContractAssertion {
  return {
    status: 'passed',
    ...input,
  };
}

export function createContractAssertions(
  projectRoot: string,
  audit?: ProjectAuditReport | null,
): ContractAssertion[] {
  const assertions: ContractAssertion[] = [];
  const essence = audit?.essence;
  const v4 = essence && isV4(essence) ? essence : null;
  const contextDir = join(projectRoot, '.decantr', 'context');
  const packManifest = audit?.packManifest ?? null;

  assertions.push(
    assertion({
      id: 'contract.essence.present',
      category: 'context',
      severity: 'error',
      rule: 'essence-present',
      status: essence ? 'passed' : 'failed',
      message: essence
        ? 'Decantr Essence contract is present.'
        : 'No Decantr Essence contract was found.',
      evidence: [redactEvidenceText(projectRoot, join(projectRoot, 'decantr.essence.json'))],
      suggestedFix: essence ? undefined : 'Run `decantr init` or restore decantr.essence.json.',
    }),
  );

  assertions.push(
    assertion({
      id: 'contract.essence.v4',
      category: 'context',
      severity: 'error',
      rule: 'essence-v4',
      status: v4 ? 'passed' : essence ? 'failed' : 'not_applicable',
      message: v4
        ? 'Essence uses the active v4.0.0 contract.'
        : essence
          ? 'Essence is not the active v4.0.0 contract.'
          : 'Essence version could not be checked.',
      evidence: [essence ? `version=${String(essence.version)}` : 'essence missing'],
      suggestedFix: v4 ? undefined : 'Run `decantr migrate --to v4` before reliability checks.',
    }),
  );

  if (v4) {
    const declaredRoutes = Object.keys(v4.blueprint.routes ?? {}).sort();
    for (const route of declaredRoutes) {
      const routeTarget = (v4.blueprint.routes ?? {})[route];
      const section = v4.blueprint.sections.find((entry) => entry.id === routeTarget.section);
      const page = section?.pages.find((entry) => entry.id === routeTarget.page);
      assertions.push(
        assertion({
          id: `contract.route.${hashString(route)}`,
          category: 'route',
          severity: page ? 'info' : 'warn',
          rule: 'declared-route-resolves',
          status: page ? 'passed' : 'failed',
          target: route,
          message: page
            ? `Declared route ${route} resolves to a section page.`
            : `Declared route ${route} does not resolve to an existing section page.`,
          evidence: [`section=${routeTarget.section}`, `page=${routeTarget.page}`],
          suggestedFix: page
            ? undefined
            : 'Update blueprint.routes or add the missing section/page before running AI repair.',
        }),
      );
    }

    for (const section of v4.blueprint.sections) {
      assertions.push(
        assertion({
          id: `contract.shell.${section.id}`,
          category: 'shell',
          severity: section.shell && section.shell !== 'inherit' ? 'info' : 'warn',
          rule: 'section-shell-concrete',
          status: section.shell && section.shell !== 'inherit' ? 'passed' : 'failed',
          target: section.id,
          message:
            section.shell && section.shell !== 'inherit'
              ? `Section ${section.id} uses concrete shell ${section.shell}.`
              : `Section ${section.id} does not declare a concrete shell.`,
          evidence: [`shell=${section.shell || 'missing'}`],
          suggestedFix:
            section.shell && section.shell !== 'inherit'
              ? undefined
              : 'Resolve inherited shells during composition so AI agents get concrete layout intent.',
        }),
      );
    }

    assertions.push(
      assertion({
        id: 'contract.accessibility.focus-visible',
        category: 'accessibility',
        severity: v4.dna.accessibility.focus_visible ? 'info' : 'warn',
        rule: 'focus-visible-enabled',
        status: v4.dna.accessibility.focus_visible ? 'passed' : 'failed',
        message: v4.dna.accessibility.focus_visible
          ? 'DNA requires visible focus states.'
          : 'DNA does not require visible focus states.',
        evidence: [`focus_visible=${String(v4.dna.accessibility.focus_visible)}`],
        suggestedFix: v4.dna.accessibility.focus_visible
          ? undefined
          : 'Set dna.accessibility.focus_visible=true for stronger UI reliability gates.',
      }),
    );
  }

  assertions.push(
    assertion({
      id: 'contract.context.pack-manifest',
      category: 'context',
      severity: packManifest ? 'info' : 'warn',
      rule: 'pack-manifest-present',
      status: packManifest ? 'passed' : 'failed',
      message: packManifest
        ? 'Compiled execution pack manifest is present.'
        : 'Compiled execution pack manifest is missing.',
      evidence: [redactEvidenceText(projectRoot, join(contextDir, 'pack-manifest.json'))],
      suggestedFix: packManifest
        ? undefined
        : 'Run `decantr registry compile-packs decantr.essence.json --write-context` to hydrate the full context pack bundle.',
    }),
  );

  assertions.push(
    assertion({
      id: 'contract.context.review-pack',
      category: 'context',
      severity: audit?.reviewPack ? 'info' : 'warn',
      rule: 'review-pack-present',
      status: audit?.reviewPack ? 'passed' : 'failed',
      message: audit?.reviewPack
        ? 'Compiled review pack is present.'
        : 'Compiled review pack is missing.',
      evidence: [redactEvidenceText(projectRoot, join(contextDir, 'review-pack.json'))],
      suggestedFix: audit?.reviewPack
        ? undefined
        : 'Run `decantr registry compile-packs decantr.essence.json --write-context` so critique has the compiled review contract.',
    }),
  );

  const tokensPath = join(projectRoot, 'src', 'styles', 'tokens.css');
  assertions.push(
    assertion({
      id: 'contract.design-token.tokens-file',
      category: 'design-token',
      severity: existsSync(tokensPath) ? 'info' : 'warn',
      rule: 'tokens-file-present',
      status: existsSync(tokensPath) ? 'passed' : 'failed',
      message: existsSync(tokensPath)
        ? 'Decantr token CSS file is present.'
        : 'Decantr token CSS file was not found.',
      evidence: [redactEvidenceText(projectRoot, tokensPath)],
      suggestedFix: existsSync(tokensPath)
        ? undefined
        : 'Run `decantr refresh` or map Decantr tokens into the existing styling system.',
    }),
  );

  return assertions;
}

export function createEvidenceBundle(input: EvidenceBundleInput): EvidenceBundle {
  const assertions = input.assertions ?? createContractAssertions(input.projectRoot, input.audit);
  let resolvedProjectRoot = input.projectRoot;
  try {
    resolvedProjectRoot = realpathSync(input.projectRoot);
  } catch {
    resolvedProjectRoot = resolve(input.projectRoot);
  }
  const projectId = `project_${hashString(resolvedProjectRoot)}`;

  return {
    $schema: EVIDENCE_BUNDLE_SCHEMA_URL,
    generatedAt: new Date().toISOString(),
    project: {
      id: projectId,
      rootLabel: basename(input.projectRoot) || 'project',
    },
    toolchain: {
      verifierVersion: input.verifierVersion ?? null,
    },
    privacy: {
      localOnly: true,
      redactedFields: [
        'source',
        'prompt',
        'secret',
        'environment',
        'absolute_path',
        'repository_name',
      ],
      screenshotsLocalOnly: true,
    },
    health: {
      status: input.report.status,
      score: input.report.score,
      errorCount: input.report.summary.errorCount,
      warnCount: input.report.summary.warnCount,
      infoCount: input.report.summary.infoCount,
      findingCount: input.report.summary.findingCount,
    },
    provenance: {
      essence: provenanceEntry(input.projectRoot, 'decantr.essence.json'),
      packManifest: provenanceEntry(input.projectRoot, '.decantr/context/pack-manifest.json'),
      reviewPack: provenanceEntry(input.projectRoot, '.decantr/context/review-pack.json'),
      ...(input.workspaceConfigPath
        ? { workspaceConfig: provenanceForPath(input.projectRoot, input.workspaceConfigPath) }
        : {}),
      ...(input.designTokensPath
        ? { designTokens: provenanceForPath(input.projectRoot, input.designTokensPath) }
        : {}),
    },
    assertions,
    findings: input.report.findings.map((finding) => ({
      id: finding.id,
      source: finding.source,
      category: finding.category,
      severity: finding.severity,
      message: redactEvidenceText(input.projectRoot, finding.message),
      evidence: redactEvidenceList(input.projectRoot, finding.evidence),
      target: finding.target ? redactEvidenceText(input.projectRoot, finding.target) : undefined,
      rule: finding.rule,
      suggestedFix: finding.suggestedFix,
      remediationSummary: finding.remediation.summary,
      commands: finding.remediation.commands,
      promptCommand: `decantr health --prompt ${finding.id}`,
    })),
    ...(input.browser ? { browser: input.browser } : {}),
    ...(input.designTokens ? { designTokens: input.designTokens } : {}),
  };
}

export interface FileCritiqueReport {
  $schema: string;
  file: string;
  overall: number;
  scores: VerificationScore[];
  findings: VerificationFinding[];
  focusAreas: string[];
  reviewPack: ReviewExecutionPack | null;
}

export interface CritiqueSourceInput {
  filePath: string;
  code: string;
  reviewPack?: ReviewExecutionPack | null;
  packManifest?: PackManifest | null;
  treatmentsCss?: string;
  adoptionMode?: string | null;
}

export interface ShowcaseShortlistVerificationEntry {
  slug: string;
  target: string | null;
  classification: 'pending' | 'A' | 'B' | 'C' | 'D';
  verificationStatus: 'pending' | 'build-green' | 'build-red' | 'smoke-green' | 'smoke-red';
  build: {
    passed: boolean | null;
    durationMs: number;
  };
  smoke: {
    passed: boolean | null;
    durationMs: number;
    rootDocumentOk: boolean;
    titleOk: boolean;
    langOk: boolean;
    viewportOk: boolean;
    charsetOk: boolean;
    cspSignalOk: boolean;
    inlineScriptCount: number;
    inlineEventHandlerCount: number;
    externalScriptsWithoutIntegrityCount: number;
    externalScriptsWithIntegrityMissingCrossoriginCount: number;
    externalStylesheetsWithoutIntegrityCount: number;
    externalStylesheetsWithIntegrityMissingCrossoriginCount: number;
    externalScriptsWithInsecureTransportCount: number;
    externalStylesheetsWithInsecureTransportCount: number;
    externalMediaSourcesWithInsecureTransportCount: number;
    externalBlankLinksWithoutRelCount: number;
    externalIframesWithoutSandboxCount: number;
    externalIframesWithInsecureTransportCount: number;
    jsEvalSignalCount: number;
    jsHtmlInjectionSignalCount: number;
    jsInsecureTransportSignalCount: number;
    jsSecretSignalCount: number;
    assetCount: number;
    assetsPassed: number;
    routeHintsChecked: string[];
    routeHintsMatched: number;
    routeHintsCoverageOk: boolean;
    routeDocumentsChecked: number;
    routeDocumentsPassed: number;
    routeDocumentsCoverageOk: boolean;
    fullRouteCoverageOk: boolean;
    totalAssetBytes: number;
    jsAssetBytes: number;
    cssAssetBytes: number;
    largestAssetPath: string | null;
    largestAssetBytes: number;
    failures: string[];
  };
  drift: {
    signal: 'lower' | 'moderate' | 'elevated';
    penalty: number;
    inlineStyleCount: number;
    hardcodedColorCount: number;
    utilityLeakageCount: number;
    decantrTreatmentCount: number;
    hasPackManifest: boolean;
    hasDist: boolean;
  };
}

export interface ShowcaseShortlistVerificationReport {
  $schema: string;
  generatedAt: string;
  dryRun: boolean;
  summary: {
    appCount: number;
    passedBuilds: number;
    failedBuilds: number;
    averageDurationMs: number;
    passedSmokes: number;
    failedSmokes: number;
    averageSmokeDurationMs: number;
    appsWithTitleOkCount: number;
    appsWithLangOkCount: number;
    appsWithViewportOkCount: number;
    appsWithCharsetOkCount: number;
    appsWithoutInlineScriptsCount: number;
    appsWithCspSignalCount: number;
    appsWithExternalScriptIntegrityCount: number;
    appsWithoutInsecureRemoteAssetTransportCount: number;
    appsWithRouteCoverageCount: number;
    appsWithFullRouteCoverageCount: number;
    averageTotalAssetBytes: number;
    averageJsAssetBytes: number;
    averageCssAssetBytes: number;
    lowerDriftCount: number;
    moderateDriftCount: number;
    elevatedDriftCount: number;
    withPackManifestCount: number;
  };
  results: ShowcaseShortlistVerificationEntry[];
}

const DEFAULT_FOCUS_AREAS = [
  'route-topology',
  'theme-consistency',
  'treatment-usage',
  'accessibility',
  'responsive-design',
];

const TREATMENT_CLASSES = [
  'd-interactive',
  'd-surface',
  'd-data',
  'd-control',
  'd-section',
  'd-annotation',
  'd-label',
];
const PERSONALITY_UTILS = [
  'neon-glow',
  'neon-text-glow',
  'neon-border-glow',
  'mono-data',
  'status-ring',
  'entrance-fade',
];
const PERFORMANCE_BUDGETS = {
  largestJsAssetWarnBytes: 350_000,
  totalJsWarnBytes: 700_000,
  totalCssWarnBytes: 150_000,
  totalAssetsWarnBytes: 1_500_000,
} as const;

function scoreRatio(numerator: number, denominator: number): number {
  if (denominator <= 0) return 3;
  return Math.min(5, Math.max(1, Math.round((numerator / denominator) * 5)));
}

function readJsonIfExists<T>(path: string): T | null {
  if (!existsSync(path)) return null;
  try {
    return JSON.parse(readFileSync(path, 'utf-8')) as T;
  } catch {
    return null;
  }
}

function loadReviewPack(projectRoot: string): ReviewExecutionPack | null {
  return readJsonIfExists<ReviewExecutionPack>(
    join(projectRoot, '.decantr', 'context', 'review-pack.json'),
  );
}

function loadPackManifest(projectRoot: string): PackManifest | null {
  return readJsonIfExists<PackManifest>(
    join(projectRoot, '.decantr', 'context', 'pack-manifest.json'),
  );
}

function collectPackManifestReferences(packManifest: PackManifest): Array<{
  entryId: string;
  kind: MissingPackManifestFile['kind'];
  markdown?: string;
  json?: string;
}> {
  const references: Array<{
    entryId: string;
    kind: MissingPackManifestFile['kind'];
    markdown?: string;
    json?: string;
  }> = [];

  if (packManifest.scaffold) {
    references.push({
      entryId: packManifest.scaffold.id || 'scaffold',
      kind: 'scaffold',
      markdown: packManifest.scaffold.markdown,
      json: packManifest.scaffold.json,
    });
  }
  if (packManifest.review) {
    references.push({
      entryId: packManifest.review.id || 'review',
      kind: 'review',
      markdown: packManifest.review.markdown,
      json: packManifest.review.json,
    });
  }
  for (const section of packManifest.sections ?? []) {
    references.push({
      entryId: section.id,
      kind: 'section',
      markdown: section.markdown,
      json: section.json,
    });
  }
  for (const page of packManifest.pages ?? []) {
    references.push({
      entryId: page.id,
      kind: 'page',
      markdown: page.markdown,
      json: page.json,
    });
  }
  for (const mutation of packManifest.mutations ?? []) {
    references.push({
      entryId: mutation.id,
      kind: 'mutation',
      markdown: mutation.markdown,
      json: mutation.json,
    });
  }

  return references;
}

export function collectMissingPackManifestFiles(
  projectRoot: string,
  packManifest: PackManifest | null = loadPackManifest(projectRoot),
): MissingPackManifestFile[] {
  if (!packManifest) return [];

  const contextDir = join(projectRoot, '.decantr', 'context');
  const missing: MissingPackManifestFile[] = [];
  for (const reference of collectPackManifestReferences(packManifest)) {
    for (const field of ['markdown', 'json'] as const) {
      const fileName = reference[field];
      if (!fileName) continue;
      const absolutePath = join(contextDir, fileName);
      if (existsSync(absolutePath)) continue;
      missing.push({
        entryId: reference.entryId,
        kind: reference.kind,
        field,
        relativePath: `.decantr/context/${fileName}`,
        absolutePath,
      });
    }
  }

  return missing;
}

function readTextIfExists(path: string): string {
  try {
    return existsSync(path) ? readFileSync(path, 'utf-8') : '';
  } catch {
    return '';
  }
}

function readProjectAdoptionMode(projectRoot: string): string | null {
  const projectJson = readJsonIfExists<{
    initialized?: { adoptionMode?: unknown };
  }>(join(projectRoot, '.decantr', 'project.json'));
  const adoptionMode = projectJson?.initialized?.adoptionMode;
  return typeof adoptionMode === 'string' ? adoptionMode : null;
}

function createSourceAuditBucket(): SourceAuditBucket {
  return { count: 0, files: [] };
}

function recordSourceAudit(bucket: SourceAuditBucket, filePath: string, count: number): void {
  if (count <= 0) return;
  bucket.count += count;
  if (!bucket.files.includes(filePath) && bucket.files.length < 4) {
    bucket.files.push(filePath);
  }
}

function sourceAuditBucketsOverlap(a: SourceAuditBucket, b: SourceAuditBucket): boolean {
  return a.files.some((file) => b.files.includes(file));
}

function normalizeSourceAuditPath(filePath: string): string {
  return filePath.replace(/\\/g, '/');
}

function getNextAppLayoutGuardRoot(filePath: string): string | null {
  const normalized = normalizeSourceAuditPath(filePath);
  const match = normalized.match(
    /^(?:src\/)?app\/(?:\([^/]+\)\/)*([^/.()[\]]+)\/layout\.[cm]?[jt]sx?$/i,
  );
  return match?.[1] ?? null;
}

function getNextAppRouteRoot(filePath: string): string | null {
  const normalized = normalizeSourceAuditPath(filePath);
  const match = normalized.match(/^(?:src\/)?app\/(?:\([^/]+\)\/)*([^/.()[\]]+)(?:\/|$)/i);
  return match?.[1] ?? null;
}

function getRouteRoot(route: string): string | null {
  const firstSegment = route.replace(/^\/+/, '').split('/')[0];
  if (!firstSegment || firstSegment.startsWith(':') || firstSegment.startsWith('[')) {
    return null;
  }
  return firstSegment;
}

function isNextAppPublicChromeFile(filePath: string): boolean {
  const normalized = normalizeSourceAuditPath(filePath);
  return /^(?:src\/)?app\/(?:\([^/]+\)\/)*(?:layout|nav|nav-header|navigation|header|footer|sidebar)\.[cm]?[jt]sx?$/i.test(
    normalized,
  );
}

function sourceAuditProtectedSurfacesCoveredByGuardedNextLayouts(
  protectedSurfaces: SourceAuditBucket,
  authGuards: SourceAuditBucket,
  topology: TopologySummary,
): boolean {
  const guardedRoots = new Set<string>();
  for (const file of authGuards.files) {
    const root = getNextAppLayoutGuardRoot(file);
    if (root) {
      guardedRoots.add(root);
    }
  }

  if (guardedRoots.size === 0 || protectedSurfaces.files.length === 0) {
    return false;
  }

  const guardedPrimaryRouteRoots = topology.primaryRoutes
    .map(getRouteRoot)
    .filter((root): root is string => Boolean(root))
    .filter((root) => guardedRoots.has(root));

  return protectedSurfaces.files.every((file) => {
    const appRoot = getNextAppRouteRoot(file);
    if (appRoot && guardedRoots.has(appRoot)) {
      return true;
    }
    return isNextAppPublicChromeFile(file) && guardedPrimaryRouteRoots.length > 0;
  });
}

function isAuditableSourceFile(filePath: string): boolean {
  if (/\.d\.ts$/i.test(filePath)) return false;
  return /\.(?:[cm]?[jt]sx?)$/i.test(filePath);
}

function isNonProductionSourceAuditFile(filePath: string): boolean {
  const normalized = normalizeSourceAuditPath(filePath);
  return (
    /(?:^|\/)(?:__tests__|__mocks__|tests?|specs?|fixtures?|mocks?|stories?)(?:\/|$)/i.test(
      normalized,
    ) || /\.(?:test|spec|stories|story|fixture|mock)\.[cm]?[jt]sx?$/i.test(normalized)
  );
}

function collectProjectSourceFiles(projectRoot: string): string[] {
  const candidates = [
    'src',
    'app',
    'pages',
    'components',
    'lib',
    'utils',
    'hooks',
    'providers',
    'server',
  ]
    .map((dir) => join(projectRoot, dir))
    .filter((dir) => existsSync(dir));
  const rootFileCandidates = [
    'middleware.ts',
    'middleware.tsx',
    'middleware.js',
    'middleware.jsx',
    'middleware.mts',
    'middleware.cts',
    'proxy.ts',
    'proxy.tsx',
    'proxy.js',
    'proxy.jsx',
    'proxy.mts',
    'proxy.cts',
  ]
    .map((file) => join(projectRoot, file))
    .filter((file) => existsSync(file));
  const files = new Set<string>();
  const ignoredDirNames = new Set([
    'node_modules',
    '.git',
    '.decantr',
    'dist',
    'build',
    'coverage',
  ]);

  const walk = (dir: string) => {
    for (const entry of readdirSync(dir, { withFileTypes: true })) {
      if (ignoredDirNames.has(entry.name)) continue;
      const absolutePath = join(dir, entry.name);
      if (entry.isDirectory()) {
        walk(absolutePath);
        continue;
      }
      if (!entry.isFile()) continue;
      if (!isAuditableSourceFile(absolutePath)) continue;
      files.add(absolutePath);
    }
  };

  for (const candidate of candidates) {
    walk(candidate);
  }

  for (const file of rootFileCandidates) {
    if (isAuditableSourceFile(file)) {
      files.add(file);
    }
  }

  return [...files].sort();
}

function buildSourceAuditEvidence(
  summary: SourceAuditSummary,
  bucket: SourceAuditBucket,
  label: string,
): string[] {
  return [
    `Source files checked: ${summary.filesChecked}`,
    `${label}: ${bucket.count}`,
    `Affected files: ${bucket.files.join(', ')}`,
  ];
}

function isAuditableStyleFile(filePath: string): boolean {
  return /\.css$/i.test(filePath);
}

function collectProjectStyleFiles(projectRoot: string): string[] {
  const candidates = ['src', 'app', 'styles']
    .map((dir) => join(projectRoot, dir))
    .filter((dir) => existsSync(dir));
  const files = new Set<string>();
  const ignoredDirNames = new Set([
    'node_modules',
    '.git',
    '.decantr',
    'dist',
    'build',
    'coverage',
  ]);

  const walk = (dir: string) => {
    for (const entry of readdirSync(dir, { withFileTypes: true })) {
      if (ignoredDirNames.has(entry.name)) continue;
      const absolutePath = join(dir, entry.name);
      if (entry.isDirectory()) {
        walk(absolutePath);
        continue;
      }
      if (!entry.isFile()) continue;
      if (!isAuditableStyleFile(absolutePath)) continue;
      files.add(absolutePath);
    }
  };

  for (const candidate of candidates) {
    walk(candidate);
  }

  return [...files].sort();
}

function countFocusVisibleSignals(code: string): number {
  const patterns = [/:focus-visible\b/i, /\.focus-visible\b/i, /\[data-focus-visible-added\]/i];

  return patterns.reduce((count, pattern) => count + (pattern.test(code) ? 1 : 0), 0);
}

function countReducedMotionSignals(code: string): number {
  const patterns = [
    /@media\s*\(\s*prefers-reduced-motion\s*:\s*reduce\s*\)/i,
    /\[data-reduce-motion(?:=[^\]]+)?\]/i,
    /\[data-motion(?:=[^\]]*reduce[^\]]*)\]/i,
  ];

  return patterns.reduce((count, pattern) => count + (pattern.test(code) ? 1 : 0), 0);
}

interface SourceAuditEntry {
  absolutePath: string;
  relativePath: string;
  code: string;
}

function hasModuleDirective(
  filePath: string,
  code: string,
  directive: 'use client' | 'use server',
): boolean {
  const sourceFile = ts.createSourceFile(
    filePath,
    code,
    ts.ScriptTarget.Latest,
    true,
    getScriptKind(filePath),
  );

  for (const statement of sourceFile.statements) {
    if (ts.isExpressionStatement(statement) && ts.isStringLiteralLike(statement.expression)) {
      if (statement.expression.text === directive) {
        return true;
      }
      continue;
    }
    break;
  }

  return false;
}

function importDeclarationHasRuntimeBinding(statement: ts.ImportDeclaration): boolean {
  const clause = statement.importClause;
  if (!clause) return true;
  if (clause.isTypeOnly) return false;
  if (clause.name) return true;
  if (!clause.namedBindings) return true;
  if (ts.isNamespaceImport(clause.namedBindings)) return true;
  return clause.namedBindings.elements.some((element) => !element.isTypeOnly);
}

function collectRuntimeImportSpecifiers(entry: SourceAuditEntry): string[] {
  const sourceFile = ts.createSourceFile(
    entry.relativePath,
    entry.code,
    ts.ScriptTarget.Latest,
    true,
    getScriptKind(entry.relativePath),
  );
  const specifiers: string[] = [];

  for (const statement of sourceFile.statements) {
    if (
      ts.isImportDeclaration(statement) &&
      ts.isStringLiteralLike(statement.moduleSpecifier) &&
      importDeclarationHasRuntimeBinding(statement)
    ) {
      specifiers.push(statement.moduleSpecifier.text);
    }
  }

  return specifiers;
}

function resolveSourceImportTarget(
  projectRoot: string,
  sourceAbsolutePath: string,
  specifier: string,
): string | null {
  let basePath: string | null = null;
  if (specifier.startsWith('@/')) {
    basePath = join(projectRoot, 'src', specifier.slice(2));
  } else if (specifier.startsWith('./') || specifier.startsWith('../')) {
    basePath = resolve(dirname(sourceAbsolutePath), specifier);
  }

  if (!basePath) return null;

  const candidates = [
    basePath,
    `${basePath}.ts`,
    `${basePath}.tsx`,
    `${basePath}.js`,
    `${basePath}.jsx`,
    `${basePath}.mts`,
    `${basePath}.cts`,
    join(basePath, 'index.ts'),
    join(basePath, 'index.tsx'),
    join(basePath, 'index.js'),
    join(basePath, 'index.jsx'),
  ];

  for (const candidate of candidates) {
    if (existsSync(candidate) && isAuditableSourceFile(candidate)) {
      return relative(projectRoot, candidate) || candidate;
    }
  }

  return null;
}

function collectClientReachableSourceFiles(
  projectRoot: string,
  entries: SourceAuditEntry[],
): Set<string> {
  const entriesByRelativePath = new Map(entries.map((entry) => [entry.relativePath, entry]));
  const runtimeImportGraph = new Map<string, string[]>();

  for (const entry of entries) {
    const targets = collectRuntimeImportSpecifiers(entry)
      .map((specifier) => resolveSourceImportTarget(projectRoot, entry.absolutePath, specifier))
      .filter((target): target is string => Boolean(target));
    runtimeImportGraph.set(entry.relativePath, targets);
  }

  const reachable = new Set<string>();
  const queue = entries
    .filter((entry) => hasModuleDirective(entry.relativePath, entry.code, 'use client'))
    .map((entry) => entry.relativePath);

  for (const root of queue) {
    reachable.add(root);
  }

  while (queue.length > 0) {
    const current = queue.shift()!;
    for (const target of runtimeImportGraph.get(current) ?? []) {
      const targetEntry = entriesByRelativePath.get(target);
      if (targetEntry && hasModuleDirective(target, targetEntry.code, 'use server')) {
        continue;
      }
      if (!reachable.has(target)) {
        reachable.add(target);
        queue.push(target);
      }
    }
  }

  return reachable;
}

function isClientAuthHeaderSource(
  relativePath: string,
  code: string,
  clientReachableFiles: Set<string>,
): boolean {
  if (hasModuleDirective(relativePath, code, 'use server')) {
    return false;
  }
  if (clientReachableFiles.has(relativePath)) {
    return true;
  }

  const normalized = normalizeSourceAuditPath(relativePath);
  if (/^(?:src\/)?app\//i.test(normalized)) {
    return false;
  }

  return /(?:^|\/)(?:components|routes|pages|hooks|providers)\//i.test(normalized);
}

function auditProjectSourceTree(projectRoot: string): SourceAuditSummary {
  const sourceFiles = collectProjectSourceFiles(projectRoot);
  const sourceEntries = sourceFiles
    .map((sourceFile) => ({
      absolutePath: sourceFile,
      relativePath: relative(projectRoot, sourceFile) || sourceFile,
      code: readFileSync(sourceFile, 'utf-8'),
    }))
    .filter((entry) => !isNonProductionSourceAuditFile(entry.relativePath));
  const clientReachableFiles = collectClientReachableSourceFiles(projectRoot, sourceEntries);
  const summary: SourceAuditSummary = {
    filesChecked: sourceEntries.length,
    inlineStyles: createSourceAuditBucket(),
    componentStyleTags: createSourceAuditBucket(),
    localCssRuntimeSignals: createSourceAuditBucket(),
    securityRiskPatterns: createSourceAuditBucket(),
    localhostEndpointSignals: createSourceAuditBucket(),
    placeholderRoutes: createSourceAuditBucket(),
    commandPaletteSignals: createSourceAuditBucket(),
    keyboardShortcutSignals: createSourceAuditBucket(),
    protectedSurfaceSignals: createSourceAuditBucket(),
    authProtectedRedirectSignals: createSourceAuditBucket(),
    authAnonymousRedirectSignals: createSourceAuditBucket(),
    authOpenRedirectSignals: createSourceAuditBucket(),
    authExternalRedirectSignals: createSourceAuditBucket(),
    authProviderStateSignals: createSourceAuditBucket(),
    authProviderPkceSignals: createSourceAuditBucket(),
    authProviderNonceSignals: createSourceAuditBucket(),
    skipNavSignals: createSourceAuditBucket(),
    skipNavTargetIds: [],
    mainLandmarkSignals: createSourceAuditBucket(),
    mainLandmarkIds: [],
    authEntrySignals: createSourceAuditBucket(),
    signInFlowSignals: createSourceAuditBucket(),
    signUpFlowSignals: createSourceAuditBucket(),
    recoveryFlowSignals: createSourceAuditBucket(),
    authSessionSignals: createSourceAuditBucket(),
    authUnauthenticatedBranchSignals: createSourceAuditBucket(),
    authLoadingSignals: createSourceAuditBucket(),
    authProtectedLoadingRenderSignals: createSourceAuditBucket(),
    authBlankLoadingRenderSignals: createSourceAuditBucket(),
    authAnonymousLoadingRedirectSignals: createSourceAuditBucket(),
    authProtectedUnauthenticatedRenderSignals: createSourceAuditBucket(),
    authErrorSignals: createSourceAuditBucket(),
    authSuccessSignals: createSourceAuditBucket(),
    authCallbackTokenSignals: createSourceAuditBucket(),
    authCallbackExchangeSignals: createSourceAuditBucket(),
    authCallbackExchangeErrorSignals: createSourceAuditBucket(),
    authCallbackErrorSignals: createSourceAuditBucket(),
    authCallbackStateSignals: createSourceAuditBucket(),
    authCallbackStateValidationSignals: createSourceAuditBucket(),
    authCallbackStateStorageSignals: createSourceAuditBucket(),
    authCallbackStateStorageClearSignals: createSourceAuditBucket(),
    authCallbackUrlScrubSignals: createSourceAuditBucket(),
    authStorageWrites: createSourceAuditBucket(),
    authStorageClears: createSourceAuditBucket(),
    authCookieWrites: createSourceAuditBucket(),
    authCookieClears: createSourceAuditBucket(),
    authHeaderWrites: createSourceAuditBucket(),
    authHeaderClears: createSourceAuditBucket(),
    authCacheClients: createSourceAuditBucket(),
    authCacheClears: createSourceAuditBucket(),
    authRefreshSignals: createSourceAuditBucket(),
    authRefreshClears: createSourceAuditBucket(),
    authRealtimeSignals: createSourceAuditBucket(),
    authRealtimeClears: createSourceAuditBucket(),
    authCoordinationSignals: createSourceAuditBucket(),
    authCoordinationClears: createSourceAuditBucket(),
    authGuardSignals: createSourceAuditBucket(),
    authExitSignals: createSourceAuditBucket(),
    authSessionTeardownSignals: createSourceAuditBucket(),
    signInRouteSignals: createSourceAuditBucket(),
    registrationRouteSignals: createSourceAuditBucket(),
    recoveryRouteSignals: createSourceAuditBucket(),
    accessibilityIssues: createSourceAuditBucket(),
    interactionSafetyIssues: createSourceAuditBucket(),
    authInputHintIssues: createSourceAuditBucket(),
  };

  for (const { relativePath, code } of sourceEntries) {
    const signals = analyzeAstSignals(relativePath, code);
    const isClientAuthHeaderSourceFile = isClientAuthHeaderSource(
      relativePath,
      code,
      clientReachableFiles,
    );
    const accessibilityIssueCount =
      signals.iconOnlyButtonWithoutLabelCount +
      signals.iconOnlyLinkWithoutLabelCount +
      signals.clickableNonSemanticCount +
      signals.unlabeledNavigationLandmarkCount +
      signals.imageWithoutAltCount +
      signals.iframeWithoutTitleCount +
      signals.dialogWithoutLabelCount +
      signals.dialogWithoutModalHintCount +
      signals.tableWithoutHeaderCount +
      signals.tableWithoutCaptionCount +
      signals.formControlWithoutLabelCount;
    const securityRiskPatternCount =
      signals.dangerousHtmlCount +
      signals.rawHtmlInjectionCount +
      signals.dynamicEvalCount +
      signals.hardcodedSecretSignalCount +
      signals.clientSecretEnvReferenceCount +
      signals.localhostEndpointCount +
      signals.wildcardPostMessageCount +
      signals.windowOpenWithoutNoopenerCount +
      signals.externalIframeWithoutSandboxCount +
      signals.insecureExternalIframeCount +
      signals.insecureFormActionCount +
      signals.insecureAuthFormMethodCount +
      signals.insecureTransportEndpointCount +
      signals.insecureExternalImageCount +
      signals.authCookieMissingHardeningCount +
      signals.authOpenRedirectSignalCount +
      signals.authExternalRedirectSignalCount +
      signals.authProviderStateMissingCount +
      signals.authProviderPkceMissingCount +
      signals.authProviderNonceMissingCount +
      signals.externalBlankLinkWithoutRelCount;
    const authInputHintIssueCount =
      signals.emailAutocompleteMissingCount +
      signals.passwordAutocompleteMissingCount +
      signals.otpAutocompleteMissingCount +
      signals.authAutocompleteDisabledCount +
      signals.authAutocompleteSemanticMismatchCount +
      signals.authInputTypeMismatchCount;
    const localCssRuntimeCount =
      /(?:^|\/)(?:lib|utils)\/css\.(?:[cm]?[jt]sx?)$/i.test(relativePath) ||
      /(?:^|\/)styles\/atoms\.css$/i.test(relativePath) ||
      /Lightweight @decantr\/css atom runtime/i.test(code)
        ? 1
        : 0;
    const componentStyleTagCount = countComponentStyleTagSignals(code);
    const commandPaletteSignalCount = countCommandPaletteSignals(code);
    const keyboardShortcutSignalCount = countKeyboardShortcutSignals(code);

    recordSourceAudit(summary.inlineStyles, relativePath, signals.inlineStyleAttributeCount);
    recordSourceAudit(summary.componentStyleTags, relativePath, componentStyleTagCount);
    recordSourceAudit(summary.localCssRuntimeSignals, relativePath, localCssRuntimeCount);
    recordSourceAudit(summary.securityRiskPatterns, relativePath, securityRiskPatternCount);
    recordSourceAudit(
      summary.localhostEndpointSignals,
      relativePath,
      signals.localhostEndpointCount,
    );
    recordSourceAudit(
      summary.placeholderRoutes,
      relativePath,
      signals.placeholderNavigationTargetCount,
    );
    recordSourceAudit(summary.commandPaletteSignals, relativePath, commandPaletteSignalCount);
    recordSourceAudit(summary.keyboardShortcutSignals, relativePath, keyboardShortcutSignalCount);
    recordSourceAudit(
      summary.protectedSurfaceSignals,
      relativePath,
      signals.protectedSurfaceSignalCount,
    );
    recordSourceAudit(
      summary.authProtectedRedirectSignals,
      relativePath,
      signals.authProtectedRedirectSignalCount,
    );
    recordSourceAudit(
      summary.authAnonymousRedirectSignals,
      relativePath,
      signals.authAnonymousRedirectSignalCount,
    );
    recordSourceAudit(
      summary.authOpenRedirectSignals,
      relativePath,
      signals.authOpenRedirectSignalCount,
    );
    recordSourceAudit(
      summary.authExternalRedirectSignals,
      relativePath,
      signals.authExternalRedirectSignalCount,
    );
    recordSourceAudit(
      summary.authProviderStateSignals,
      relativePath,
      signals.authProviderStateMissingCount,
    );
    recordSourceAudit(
      summary.authProviderPkceSignals,
      relativePath,
      signals.authProviderPkceMissingCount,
    );
    recordSourceAudit(
      summary.authProviderNonceSignals,
      relativePath,
      signals.authProviderNonceMissingCount,
    );
    recordSourceAudit(summary.skipNavSignals, relativePath, signals.skipNavSignalCount);
    recordSourceAudit(summary.mainLandmarkSignals, relativePath, signals.mainLandmarkCount);
    for (const targetId of signals.skipNavTargetIds) {
      if (!summary.skipNavTargetIds.includes(targetId)) {
        summary.skipNavTargetIds.push(targetId);
      }
    }
    for (const landmarkId of signals.mainLandmarkIds) {
      if (!summary.mainLandmarkIds.includes(landmarkId)) {
        summary.mainLandmarkIds.push(landmarkId);
      }
    }
    recordSourceAudit(summary.authEntrySignals, relativePath, signals.authEntrySignalCount);
    recordSourceAudit(
      summary.signInFlowSignals,
      relativePath,
      countSignInFlowSignals(code, relativePath),
    );
    recordSourceAudit(
      summary.signUpFlowSignals,
      relativePath,
      countSignUpFlowSignals(code, relativePath),
    );
    recordSourceAudit(
      summary.recoveryFlowSignals,
      relativePath,
      countRecoveryFlowSignals(code, relativePath),
    );
    recordSourceAudit(summary.authSessionSignals, relativePath, signals.authSessionSignalCount);
    recordSourceAudit(
      summary.authUnauthenticatedBranchSignals,
      relativePath,
      countAuthUnauthenticatedBranchSignals(code),
    );
    recordSourceAudit(summary.authLoadingSignals, relativePath, signals.authLoadingSignalCount);
    recordSourceAudit(
      summary.authProtectedLoadingRenderSignals,
      relativePath,
      signals.authProtectedLoadingRenderCount,
    );
    recordSourceAudit(
      summary.authBlankLoadingRenderSignals,
      relativePath,
      signals.authBlankLoadingRenderCount,
    );
    recordSourceAudit(
      summary.authAnonymousLoadingRedirectSignals,
      relativePath,
      signals.authAnonymousLoadingRedirectCount,
    );
    recordSourceAudit(
      summary.authProtectedUnauthenticatedRenderSignals,
      relativePath,
      signals.authProtectedUnauthenticatedRenderCount,
    );
    recordSourceAudit(summary.authErrorSignals, relativePath, countAuthErrorSignals(code));
    recordSourceAudit(summary.authSuccessSignals, relativePath, countAuthSuccessSignals(code));
    recordSourceAudit(
      summary.authCallbackTokenSignals,
      relativePath,
      countAuthCallbackTokenSignals(code, relativePath),
    );
    recordSourceAudit(
      summary.authCallbackExchangeSignals,
      relativePath,
      countAuthCallbackExchangeSignals(code),
    );
    recordSourceAudit(
      summary.authCallbackExchangeErrorSignals,
      relativePath,
      countAuthCallbackExchangeErrorSignals(code),
    );
    recordSourceAudit(
      summary.authCallbackErrorSignals,
      relativePath,
      countAuthCallbackErrorSignals(code, relativePath),
    );
    recordSourceAudit(
      summary.authCallbackStateSignals,
      relativePath,
      countAuthCallbackStateSignals(code),
    );
    recordSourceAudit(
      summary.authCallbackStateValidationSignals,
      relativePath,
      countAuthCallbackStateValidationSignals(code),
    );
    recordSourceAudit(
      summary.authCallbackStateStorageSignals,
      relativePath,
      countAuthCallbackStateStorageSignals(code),
    );
    recordSourceAudit(
      summary.authCallbackStateStorageClearSignals,
      relativePath,
      countAuthCallbackStateStorageClearSignals(code),
    );
    recordSourceAudit(
      summary.authCallbackUrlScrubSignals,
      relativePath,
      countAuthCallbackUrlScrubSignals(code),
    );
    recordSourceAudit(summary.authStorageWrites, relativePath, signals.authStorageWriteCount);
    recordSourceAudit(summary.authStorageClears, relativePath, signals.authStorageClearCount);
    recordSourceAudit(summary.authCookieWrites, relativePath, signals.authCookieWriteCount);
    recordSourceAudit(summary.authCookieClears, relativePath, signals.authCookieClearCount);
    recordSourceAudit(
      summary.authHeaderWrites,
      relativePath,
      isClientAuthHeaderSourceFile ? signals.authHeaderWriteCount : 0,
    );
    recordSourceAudit(
      summary.authHeaderClears,
      relativePath,
      isClientAuthHeaderSourceFile ? signals.authHeaderClearCount : 0,
    );
    recordSourceAudit(summary.authCacheClients, relativePath, signals.authCacheClientCount);
    recordSourceAudit(summary.authCacheClears, relativePath, signals.authCacheClearCount);
    recordSourceAudit(summary.authRefreshSignals, relativePath, signals.authRefreshSignalCount);
    recordSourceAudit(summary.authRefreshClears, relativePath, signals.authRefreshClearCount);
    recordSourceAudit(summary.authRealtimeSignals, relativePath, countAuthRealtimeSignals(code));
    recordSourceAudit(
      summary.authRealtimeClears,
      relativePath,
      countAuthRealtimeClearSignals(code),
    );
    recordSourceAudit(
      summary.authCoordinationSignals,
      relativePath,
      countAuthCoordinationSignals(code),
    );
    recordSourceAudit(
      summary.authCoordinationClears,
      relativePath,
      countAuthCoordinationClearSignals(code),
    );
    recordSourceAudit(summary.authGuardSignals, relativePath, signals.authGuardSignalCount);
    recordSourceAudit(summary.authExitSignals, relativePath, signals.authExitSignalCount);
    recordSourceAudit(
      summary.authSessionTeardownSignals,
      relativePath,
      signals.authSessionTeardownSignalCount,
    );
    recordSourceAudit(summary.signInRouteSignals, relativePath, countSignInRouteSignals(code));
    recordSourceAudit(
      summary.registrationRouteSignals,
      relativePath,
      countRegistrationRouteSignals(code),
    );
    recordSourceAudit(
      summary.recoveryRouteSignals,
      relativePath,
      countAuthRecoveryRouteSignals(code),
    );
    recordSourceAudit(summary.accessibilityIssues, relativePath, accessibilityIssueCount);
    recordSourceAudit(
      summary.interactionSafetyIssues,
      relativePath,
      signals.buttonInFormWithoutTypeCount +
        signals.authFormWithoutSubmitCount +
        signals.authInputWithoutNameCount,
    );
    recordSourceAudit(summary.authInputHintIssues, relativePath, authInputHintIssueCount);
  }

  return summary;
}

function auditProjectStyleContracts(projectRoot: string): StyleAuditSummary {
  const styleFiles = collectProjectStyleFiles(projectRoot);
  const summary: StyleAuditSummary = {
    filesChecked: styleFiles.length,
    focusVisibleSignals: createSourceAuditBucket(),
    reducedMotionSignals: createSourceAuditBucket(),
  };

  for (const styleFile of styleFiles) {
    const relativePath = relative(projectRoot, styleFile) || styleFile;
    const css = readFileSync(styleFile, 'utf-8');
    recordSourceAudit(summary.focusVisibleSignals, relativePath, countFocusVisibleSignals(css));
    recordSourceAudit(summary.reducedMotionSignals, relativePath, countReducedMotionSignals(css));
  }

  return summary;
}

function buildRegistryContext(projectRoot: string): {
  themeRegistry: Map<string, { modes: string[] }>;
  patternRegistry: Map<string, unknown>;
} {
  const themeRegistry = new Map<string, { modes: string[] }>();
  const patternRegistry = new Map<string, unknown>();
  const cacheDir = join(projectRoot, '.decantr', 'cache');
  const customDir = join(projectRoot, '.decantr', 'custom');

  const cachedThemesDir = join(cacheDir, '@official', 'themes');
  try {
    if (existsSync(cachedThemesDir)) {
      for (const file of readdirSync(cachedThemesDir).filter(
        (name) => name.endsWith('.json') && name !== 'index.json',
      )) {
        const data = JSON.parse(readFileSync(join(cachedThemesDir, file), 'utf-8')) as {
          id?: string;
          modes?: string[];
        };
        if (data.id && !themeRegistry.has(data.id)) {
          themeRegistry.set(data.id, { modes: data.modes || ['light', 'dark'] });
        }
      }
    }
  } catch {
    /* best effort */
  }

  const customThemesDir = join(customDir, 'themes');
  try {
    if (existsSync(customThemesDir)) {
      for (const file of readdirSync(customThemesDir).filter((name) => name.endsWith('.json'))) {
        const data = JSON.parse(readFileSync(join(customThemesDir, file), 'utf-8')) as {
          id?: string;
          modes?: string[];
        };
        if (data.id) {
          themeRegistry.set(`custom:${data.id}`, { modes: data.modes || ['light', 'dark'] });
        }
      }
    }
  } catch {
    /* best effort */
  }

  const cachedPatternsDir = join(cacheDir, '@official', 'patterns');
  try {
    if (existsSync(cachedPatternsDir)) {
      for (const file of readdirSync(cachedPatternsDir).filter(
        (name) => name.endsWith('.json') && name !== 'index.json',
      )) {
        const data = JSON.parse(readFileSync(join(cachedPatternsDir, file), 'utf-8')) as {
          id?: string;
        };
        if (data.id && !patternRegistry.has(data.id)) {
          patternRegistry.set(data.id, data);
        }
      }
    }
  } catch {
    /* best effort */
  }

  for (const id of ['content-section', 'footer', 'form-basic', 'hero', 'nav-header']) {
    if (!patternRegistry.has(id)) {
      patternRegistry.set(id, { id, source: 'bundled' });
    }
  }

  return { themeRegistry, patternRegistry };
}

function guardViolationToFinding(violation: GuardViolation): VerificationFinding {
  return {
    id: `guard-${violation.rule}`,
    category: violation.layer === 'dna' ? 'DNA Guard' : 'Blueprint Guard',
    severity: violation.severity === 'error' ? 'error' : 'warn',
    message: violation.message,
    evidence: [`Rule: ${violation.rule}`],
    rule: violation.rule,
    suggestedFix: violation.suggestion,
  };
}

function countPages(essence: EssenceFile | null): number {
  if (!essence) return 0;
  const blueprint = essence.blueprint as {
    pages?: unknown[];
    sections?: Array<{ pages?: unknown[] }>;
  };
  const sectionPages = Array.isArray(blueprint.sections)
    ? blueprint.sections.reduce(
        (sum, section) => sum + (Array.isArray(section.pages) ? section.pages.length : 0),
        0,
      )
    : 0;
  const flatPages = Array.isArray(blueprint.pages) ? blueprint.pages.length : 0;
  return sectionPages + flatPages;
}

interface TopologySummary {
  hasAuthFeature: boolean;
  sectionRoles: string[];
  gatewayRouteCount: number;
  primaryRouteCount: number;
  hasAnonymousEntryRoute: boolean;
  gatewayRoutes: string[];
  primaryRoutes: string[];
}

interface SourceAuditBucket {
  count: number;
  files: string[];
}

interface SourceAuditSummary {
  filesChecked: number;
  inlineStyles: SourceAuditBucket;
  componentStyleTags: SourceAuditBucket;
  localCssRuntimeSignals: SourceAuditBucket;
  securityRiskPatterns: SourceAuditBucket;
  localhostEndpointSignals: SourceAuditBucket;
  placeholderRoutes: SourceAuditBucket;
  commandPaletteSignals: SourceAuditBucket;
  keyboardShortcutSignals: SourceAuditBucket;
  protectedSurfaceSignals: SourceAuditBucket;
  authProtectedRedirectSignals: SourceAuditBucket;
  authAnonymousRedirectSignals: SourceAuditBucket;
  authOpenRedirectSignals: SourceAuditBucket;
  authExternalRedirectSignals: SourceAuditBucket;
  authProviderStateSignals: SourceAuditBucket;
  authProviderPkceSignals: SourceAuditBucket;
  authProviderNonceSignals: SourceAuditBucket;
  skipNavSignals: SourceAuditBucket;
  skipNavTargetIds: string[];
  mainLandmarkSignals: SourceAuditBucket;
  mainLandmarkIds: string[];
  authEntrySignals: SourceAuditBucket;
  signInFlowSignals: SourceAuditBucket;
  signUpFlowSignals: SourceAuditBucket;
  recoveryFlowSignals: SourceAuditBucket;
  authSessionSignals: SourceAuditBucket;
  authUnauthenticatedBranchSignals: SourceAuditBucket;
  authLoadingSignals: SourceAuditBucket;
  authProtectedLoadingRenderSignals: SourceAuditBucket;
  authBlankLoadingRenderSignals: SourceAuditBucket;
  authAnonymousLoadingRedirectSignals: SourceAuditBucket;
  authProtectedUnauthenticatedRenderSignals: SourceAuditBucket;
  authErrorSignals: SourceAuditBucket;
  authSuccessSignals: SourceAuditBucket;
  authCallbackTokenSignals: SourceAuditBucket;
  authCallbackExchangeSignals: SourceAuditBucket;
  authCallbackExchangeErrorSignals: SourceAuditBucket;
  authCallbackErrorSignals: SourceAuditBucket;
  authCallbackStateSignals: SourceAuditBucket;
  authCallbackStateValidationSignals: SourceAuditBucket;
  authCallbackStateStorageSignals: SourceAuditBucket;
  authCallbackStateStorageClearSignals: SourceAuditBucket;
  authCallbackUrlScrubSignals: SourceAuditBucket;
  authStorageWrites: SourceAuditBucket;
  authStorageClears: SourceAuditBucket;
  authCookieWrites: SourceAuditBucket;
  authCookieClears: SourceAuditBucket;
  authHeaderWrites: SourceAuditBucket;
  authHeaderClears: SourceAuditBucket;
  authCacheClients: SourceAuditBucket;
  authCacheClears: SourceAuditBucket;
  authRefreshSignals: SourceAuditBucket;
  authRefreshClears: SourceAuditBucket;
  authRealtimeSignals: SourceAuditBucket;
  authRealtimeClears: SourceAuditBucket;
  authCoordinationSignals: SourceAuditBucket;
  authCoordinationClears: SourceAuditBucket;
  authGuardSignals: SourceAuditBucket;
  authExitSignals: SourceAuditBucket;
  authSessionTeardownSignals: SourceAuditBucket;
  signInRouteSignals: SourceAuditBucket;
  registrationRouteSignals: SourceAuditBucket;
  recoveryRouteSignals: SourceAuditBucket;
  accessibilityIssues: SourceAuditBucket;
  interactionSafetyIssues: SourceAuditBucket;
  authInputHintIssues: SourceAuditBucket;
}

interface StyleAuditSummary {
  filesChecked: number;
  focusVisibleSignals: SourceAuditBucket;
  reducedMotionSignals: SourceAuditBucket;
}

function makeFinding(input: VerificationFinding): VerificationFinding {
  return input;
}

function formatBytes(bytes: number): string {
  if (bytes >= 1_000_000) {
    return `${(bytes / 1_000_000).toFixed(2)} MB`;
  }
  if (bytes >= 1_000) {
    return `${Math.round(bytes / 1_000)} KB`;
  }
  return `${bytes} B`;
}

function normalizeRouteHint(route: string | null | undefined): string {
  if (!route || route === '/') return '/';
  const dynamicIndex = route.indexOf('/:');
  if (dynamicIndex !== -1) {
    return route.slice(0, dynamicIndex + 1);
  }
  return route;
}

function isAuthLikeRoute(route: string): boolean {
  return /(?:^|\/)(?:auth|login|log-in|signin|sign-in|signup|sign-up|register|forgot-password|reset-password|password-reset)(?:\/|$)/i.test(
    route,
  );
}

function isRecoveryLikeRoute(route: string): boolean {
  return /(?:^|\/)(?:forgot-password|reset-password|password-reset|recover|recovery)(?:\/|$)/i.test(
    route,
  );
}

function isSignInLikeRoute(route: string): boolean {
  return /(?:^|\/)(?:auth|login|log-in|signin|sign-in)(?:\/|$)/i.test(route);
}

function isRegistrationLikeRoute(route: string): boolean {
  return /(?:^|\/)(?:signup|sign-up|register)(?:\/|$)/i.test(route);
}

function isAnonymousEntryLikeRoute(route: string): boolean {
  return (
    route === '/' ||
    /(?:^|\/)(?:auth|login|log-in|signin|sign-in|signup|sign-up|register)(?:\/|$)/i.test(route)
  );
}

function isProtectedLikeRoute(route: string): boolean {
  return /(?:^|\/)(?:app|dashboard|workspace|settings|billing|account|profile|admin|agents?|marketplace|browse|search|listings?|seller|buyer|bookings?|favorites|messages?|orders?|checkout|cart|transparency|logs?|metrics|config|console|studio|pipelines?|projects?|monitoring|overview)(?:\/|$)/i.test(
    route,
  );
}

function essenceRequiresFocusVisible(essence: EssenceFile | null): boolean {
  if (!essence || !('dna' in essence)) return false;
  const dna = (essence as { dna?: unknown }).dna;
  if (!dna || typeof dna !== 'object') return false;
  const accessibility = (dna as { accessibility?: unknown }).accessibility;
  if (!accessibility || typeof accessibility !== 'object') return false;
  return (accessibility as { focus_visible?: unknown }).focus_visible === true;
}

function essenceRequiresReducedMotion(essence: EssenceFile | null): boolean {
  if (!essence || !('dna' in essence)) return false;
  const dna = (essence as { dna?: unknown }).dna;
  if (!dna || typeof dna !== 'object') return false;
  const motion = (dna as { motion?: unknown }).motion;
  if (!motion || typeof motion !== 'object') return false;
  return (motion as { reduce_motion?: unknown }).reduce_motion === true;
}

function essenceRequiresSkipNav(essence: EssenceFile | null): boolean {
  if (!essence || !('dna' in essence)) return false;
  const dna = (essence as { dna?: unknown }).dna;
  if (!dna || typeof dna !== 'object') return false;
  const accessibility = (dna as { accessibility?: unknown }).accessibility;
  if (!accessibility || typeof accessibility !== 'object') return false;
  return (accessibility as { skip_nav?: unknown }).skip_nav === true;
}

export function extractRouteHintsFromEssence(essence: EssenceFile | null): string[] {
  if (!essence) {
    return ['/'];
  }

  const routes = new Set<string>(['/']);

  if (isV4(essence)) {
    for (const section of essence.blueprint.sections) {
      for (const page of section.pages) {
        if (typeof page.route === 'string' && page.route.length > 0) {
          routes.add(normalizeRouteHint(page.route));
        }
      }
    }

    if (essence.blueprint.routes && typeof essence.blueprint.routes === 'object') {
      for (const route of Object.keys(essence.blueprint.routes)) {
        routes.add(normalizeRouteHint(route));
      }
    }
  }

  return [...routes].filter(Boolean).slice(0, 8);
}

function summarizeTopology(
  essence: EssenceFile | null,
  reviewPack: ReviewExecutionPack | null,
): TopologySummary {
  const features = new Set<string>(reviewPack?.data?.features ?? []);
  const sectionRoles = new Set<string>();
  const gatewayRoutes = new Set<string>();
  const primaryRoutes = new Set<string>();
  let gatewayRouteCount = 0;
  let primaryRouteCount = 0;
  let hasAnonymousEntryRoute = false;

  if (essence && isV4(essence)) {
    for (const feature of essence.blueprint.features ?? []) {
      if (typeof feature === 'string' && feature.length > 0) {
        features.add(feature);
      }
    }

    for (const section of essence.blueprint.sections ?? []) {
      const role =
        typeof section.role === 'string' && section.role.length > 0 ? section.role : 'unknown';
      sectionRoles.add(role);

      for (const page of section.pages ?? []) {
        if (typeof page.route !== 'string' || page.route.length === 0) continue;
        if (page.route === '/' && (role === 'public' || role === 'gateway')) {
          hasAnonymousEntryRoute = true;
        }
        if (role === 'gateway') {
          gatewayRouteCount += 1;
          gatewayRoutes.add(normalizeRouteHint(page.route));
        }
        if (role === 'primary') {
          primaryRouteCount += 1;
          primaryRoutes.add(normalizeRouteHint(page.route));
        }
      }
    }
  }

  return {
    hasAuthFeature: features.has('auth'),
    sectionRoles: [...sectionRoles],
    gatewayRouteCount,
    primaryRouteCount,
    hasAnonymousEntryRoute,
    gatewayRoutes: [...gatewayRoutes],
    primaryRoutes: [...primaryRoutes],
  };
}

function appendTopologyFindings(
  findings: VerificationFinding[],
  essence: EssenceFile | null,
  reviewPack: ReviewExecutionPack | null,
): void {
  const topology = summarizeTopology(essence, reviewPack);
  if (!topology.hasAuthFeature) return;
  const overlappingAuthRoutes = topology.gatewayRoutes.filter((route) =>
    topology.primaryRoutes.includes(route),
  );

  if (!topology.sectionRoles.includes('gateway')) {
    findings.push(
      makeFinding({
        id: 'auth-gateway-section-missing',
        category: 'Route Topology',
        severity: 'warn',
        message:
          'Authentication is declared, but the essence topology does not define a gateway section.',
        evidence: [
          'Expected a gateway section for login, registration, or recovery flows.',
          `Observed section roles: ${topology.sectionRoles.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'Add a gateway section for authentication flows so anonymous users have a clear entry path before protected routes.',
      }),
    );
  }

  if (!topology.sectionRoles.includes('primary')) {
    findings.push(
      makeFinding({
        id: 'auth-primary-section-missing',
        category: 'Route Topology',
        severity: 'warn',
        message:
          'Authentication is declared, but no primary app section was found in the compiled topology.',
        evidence: [`Observed section roles: ${topology.sectionRoles.join(', ') || 'none'}`],
        suggestedFix:
          'Add a primary section so authenticated users have a clear post-auth destination.',
      }),
    );
  }

  if (topology.sectionRoles.includes('gateway') && topology.gatewayRouteCount === 0) {
    findings.push(
      makeFinding({
        id: 'auth-gateway-routes-missing',
        category: 'Route Topology',
        severity: 'warn',
        message: 'A gateway section exists, but none of its pages declare explicit routes.',
        evidence: ['Gateway pages should expose routable login, registration, or recovery paths.'],
        suggestedFix:
          'Give gateway pages explicit routes such as `/login`, `/register`, or `/forgot-password`.',
      }),
    );
  }

  if (topology.primaryRouteCount === 0) {
    findings.push(
      makeFinding({
        id: 'auth-primary-routes-missing',
        category: 'Route Topology',
        severity: 'warn',
        message: 'Authentication is declared, but no primary section pages expose explicit routes.',
        evidence: [
          'Protected app surfaces need explicit routes so post-auth entry points are unambiguous.',
        ],
        suggestedFix:
          'Add explicit primary routes such as `/dashboard`, `/app`, `/browse`, or `/listings` for the authenticated experience.',
      }),
    );
  }

  if (
    topology.gatewayRoutes.length > 0 &&
    topology.gatewayRoutes.some((route) => route !== '/' && isProtectedLikeRoute(route))
  ) {
    findings.push(
      makeFinding({
        id: 'auth-gateway-routes-look-protected',
        category: 'Route Topology',
        severity: 'warn',
        message: 'Gateway routes include paths that look like authenticated app destinations.',
        evidence: [`Gateway routes: ${topology.gatewayRoutes.join(', ')}`],
        suggestedFix:
          'Keep gateway routes focused on anonymous entry flows such as `/`, `/login`, `/register`, or `/forgot-password`, and move protected destinations into the primary section.',
      }),
    );
  }

  if (
    topology.gatewayRoutes.length > 0 &&
    topology.gatewayRoutes.every((route) => route !== '/' && !isAuthLikeRoute(route))
  ) {
    findings.push(
      makeFinding({
        id: 'auth-gateway-routes-not-auth-like',
        category: 'Route Topology',
        severity: 'warn',
        message:
          'Gateway routes do not appear to expose anonymous entry or authentication-focused destinations.',
        evidence: [`Gateway routes: ${topology.gatewayRoutes.join(', ')}`],
        suggestedFix:
          'Use gateway routes like `/`, `/login`, `/register`, or `/forgot-password` so the anonymous/auth entry surface is explicit.',
      }),
    );
  }

  if (
    topology.primaryRoutes.length > 0 &&
    topology.primaryRoutes.every((route) => isAuthLikeRoute(route))
  ) {
    findings.push(
      makeFinding({
        id: 'auth-primary-routes-look-auth-only',
        category: 'Route Topology',
        severity: 'warn',
        message:
          'Primary routes only expose auth-like destinations and do not appear to include a post-auth application surface.',
        evidence: [`Primary routes: ${topology.primaryRoutes.join(', ')}`],
        suggestedFix:
          'Keep login and registration routes in the gateway section, and add at least one primary app route such as `/dashboard`, `/workspace`, `/app`, `/browse`, or `/listings`.',
      }),
    );
  }

  if (
    topology.primaryRoutes.length > 0 &&
    topology.primaryRoutes.every((route) => !isProtectedLikeRoute(route))
  ) {
    findings.push(
      makeFinding({
        id: 'auth-primary-routes-not-app-like',
        category: 'Route Topology',
        severity: 'warn',
        message:
          'Primary routes do not appear to include a clear post-auth application destination.',
        evidence: [`Primary routes: ${topology.primaryRoutes.join(', ')}`],
        suggestedFix:
          'Use at least one primary route like `/dashboard`, `/workspace`, `/settings`, `/app`, `/browse`, or `/listings` so the authenticated surface is explicit.',
      }),
    );
  }

  if (overlappingAuthRoutes.length > 0) {
    findings.push(
      makeFinding({
        id: 'auth-gateway-primary-route-overlap',
        category: 'Route Topology',
        severity: 'warn',
        message:
          'Gateway and primary sections expose overlapping routes, which blurs the anonymous-to-authenticated boundary.',
        evidence: [`Overlapping routes: ${overlappingAuthRoutes.join(', ')}`],
        suggestedFix:
          'Keep gateway routes focused on anonymous entry flows and reserve primary routes for authenticated destinations so the route boundary stays explicit.',
      }),
    );
  }

  if (!topology.hasAnonymousEntryRoute) {
    findings.push(
      makeFinding({
        id: 'auth-entry-route-missing',
        category: 'Route Topology',
        severity: 'warn',
        message:
          'Authentication is declared, but no public or gateway section exposes `/` as an anonymous entry route.',
        evidence: [
          'Anonymous users should have a stable landing or auth entry route before protected navigation begins.',
        ],
        suggestedFix:
          'Route `/` to a public landing page or gateway entry so the initial user journey is explicit.',
      }),
    );
  }
}

async function runRuntimeAudit(
  projectRoot: string,
  essence: EssenceFile | null,
): Promise<RuntimeAudit> {
  return auditBuiltDist(projectRoot, {
    routeHints: extractRouteHintsFromEssence(essence),
  });
}

function extractFailedRouteDocuments(runtimeAudit: RuntimeAudit): string[] {
  return runtimeAudit.failures
    .filter((failure) => failure.startsWith('route-document-failed:'))
    .map((failure) => normalizeRouteHint(failure.slice('route-document-failed:'.length)))
    .filter(Boolean);
}

function extractFailedRouteDocumentHardening(runtimeAudit: RuntimeAudit): string[] {
  return runtimeAudit.failures
    .filter((failure) => failure.startsWith('route-document-hardening-failed:'))
    .map((failure) => normalizeRouteHint(failure.slice('route-document-hardening-failed:'.length)))
    .filter(Boolean);
}

function appendRuntimeAuditFindings(
  findings: VerificationFinding[],
  runtimeAudit: RuntimeAudit,
  projectRoot: string,
  topology?: TopologySummary,
  sourceAudit?: SourceAuditSummary,
): void {
  const distPath = join(projectRoot, 'dist');
  const indexPath = join(distPath, 'index.html');
  const isFrameworkBuildOutput = runtimeAudit.failures.includes('next-build-output');

  if (!runtimeAudit.distPresent) {
    findings.push(
      makeFinding({
        id: 'runtime-dist-missing',
        category: 'Runtime Verification',
        severity: 'info',
        message: 'No dist output was found, so runtime smoke verification was skipped.',
        evidence: [distPath],
        suggestedFix:
          'Build the project before auditing if you want Decantr to verify root, asset, title, and route behavior.',
      }),
    );
    return;
  }

  if (!runtimeAudit.indexPresent) {
    findings.push(
      makeFinding({
        id: 'runtime-index-missing',
        category: 'Runtime Verification',
        severity: 'warn',
        message:
          'dist exists but index.html is missing, so runtime smoke verification could not run.',
        evidence: [indexPath],
        suggestedFix: 'Ensure the current build emits an index.html entry document.',
      }),
    );
    return;
  }

  if (runtimeAudit.rootDocumentOk === false && !isFrameworkBuildOutput) {
    findings.push(
      makeFinding({
        id: 'runtime-root-document-invalid',
        category: 'Runtime Verification',
        severity: 'error',
        message: 'The built root document did not expose the expected application mount point.',
        evidence: [indexPath, 'Expected to find an element with id="root" in the served document.'],
        suggestedFix:
          'Restore the framework mount element and confirm the built entry HTML matches the chosen runtime adapter.',
      }),
    );
  }

  if (runtimeAudit.titleOk === false) {
    findings.push(
      makeFinding({
        id: 'runtime-title-missing',
        category: 'Runtime Verification',
        severity: 'warn',
        message: 'The built root document is missing a non-empty <title>.',
        evidence: [indexPath],
        suggestedFix:
          'Emit a meaningful document title from the entry HTML or framework metadata layer.',
      }),
    );
  }

  if (runtimeAudit.langOk === false) {
    findings.push(
      makeFinding({
        id: 'runtime-lang-missing',
        category: 'Runtime Verification',
        severity: 'warn',
        message: 'The built root document is missing an explicit `lang` attribute on `<html>`.',
        evidence: [indexPath],
        suggestedFix:
          'Set `<html lang="en">` or the appropriate locale in the framework document shell so accessibility tooling and crawlers get the right language hint.',
      }),
    );
  }

  if (runtimeAudit.viewportOk === false) {
    findings.push(
      makeFinding({
        id: 'runtime-viewport-missing',
        category: 'Runtime Verification',
        severity: 'warn',
        message: 'The built root document is missing a viewport meta tag.',
        evidence: [indexPath],
        suggestedFix:
          'Emit `<meta name="viewport" content="width=device-width, initial-scale=1">` from the entry document or metadata layer.',
      }),
    );
  }

  if (runtimeAudit.charsetOk === false) {
    findings.push(
      makeFinding({
        id: 'runtime-charset-missing',
        category: 'Document Hardening',
        severity: 'info',
        message: 'The built root document is missing an explicit charset declaration.',
        evidence: [indexPath],
        suggestedFix:
          'Emit `<meta charset="utf-8">` from the entry document so encoding expectations stay explicit across hosts.',
      }),
    );
  }

  if (runtimeAudit.inlineScriptCount > 0) {
    findings.push(
      makeFinding({
        id: 'runtime-inline-scripts-present',
        category: 'Security Hygiene',
        severity: 'warn',
        message: 'Inline `<script>` blocks were detected in the built root document.',
        evidence: [indexPath, `Inline script tags: ${runtimeAudit.inlineScriptCount}`],
        suggestedFix:
          'Prefer bundled external assets and avoid inline scripts so CSP headers or nonces remain practical.',
      }),
    );
  }

  if (runtimeAudit.inlineEventHandlerCount > 0) {
    findings.push(
      makeFinding({
        id: 'runtime-inline-event-handlers-present',
        category: 'Security Hygiene',
        severity: 'warn',
        message: 'Inline DOM event handler attributes were detected in the built root document.',
        evidence: [
          indexPath,
          `Inline event handler attributes: ${runtimeAudit.inlineEventHandlerCount}`,
        ],
        suggestedFix:
          'Remove inline `onclick`/`onload`-style handlers from built HTML and route behavior through the reviewed application bundle so CSP remains practical.',
      }),
    );
  }

  if (runtimeAudit.externalScriptsWithoutIntegrityCount > 0) {
    findings.push(
      makeFinding({
        id: 'runtime-external-scripts-without-integrity',
        category: 'Security Hygiene',
        severity: 'warn',
        message: 'Remote script tags were detected without Subresource Integrity metadata.',
        evidence: [
          indexPath,
          `Remote scripts missing integrity: ${runtimeAudit.externalScriptsWithoutIntegrityCount}`,
        ],
        suggestedFix:
          'Pin remote script tags with integrity/crossorigin metadata or serve the dependency through the trusted build pipeline.',
      }),
    );
  }

  if (runtimeAudit.externalScriptsWithIntegrityMissingCrossoriginCount > 0) {
    findings.push(
      makeFinding({
        id: 'runtime-external-scripts-crossorigin-missing',
        category: 'Security Hygiene',
        severity: 'warn',
        message:
          'Remote script tags declare Subresource Integrity without a matching `crossorigin` attribute.',
        evidence: [
          indexPath,
          `Remote scripts with integrity but missing crossorigin: ${runtimeAudit.externalScriptsWithIntegrityMissingCrossoriginCount}`,
        ],
        suggestedFix:
          'Add a reviewed `crossorigin` attribute alongside script integrity metadata so SRI works consistently for remote script fetches.',
      }),
    );
  }

  if (runtimeAudit.externalScriptsWithInsecureTransportCount > 0) {
    findings.push(
      makeFinding({
        id: 'runtime-external-scripts-insecure-transport',
        category: 'Security Hygiene',
        severity: 'warn',
        message: 'Remote script tags were detected over plain HTTP.',
        evidence: [
          indexPath,
          `Remote scripts over insecure transport: ${runtimeAudit.externalScriptsWithInsecureTransportCount}`,
        ],
        suggestedFix:
          'Serve remote scripts over HTTPS with integrity/crossorigin metadata, or move them into the trusted build pipeline.',
      }),
    );
  }

  if (runtimeAudit.externalStylesheetsWithoutIntegrityCount > 0) {
    findings.push(
      makeFinding({
        id: 'runtime-external-stylesheets-without-integrity',
        category: 'Security Hygiene',
        severity: 'info',
        message: 'Remote stylesheet links were detected without Subresource Integrity metadata.',
        evidence: [
          indexPath,
          `Remote stylesheets missing integrity: ${runtimeAudit.externalStylesheetsWithoutIntegrityCount}`,
        ],
        suggestedFix:
          'Pin remote stylesheet links with integrity/crossorigin metadata or serve the stylesheet through the trusted build pipeline.',
      }),
    );
  }

  if (runtimeAudit.externalStylesheetsWithIntegrityMissingCrossoriginCount > 0) {
    findings.push(
      makeFinding({
        id: 'runtime-external-stylesheets-crossorigin-missing',
        category: 'Security Hygiene',
        severity: 'info',
        message:
          'Remote stylesheet links declare Subresource Integrity without a matching `crossorigin` attribute.',
        evidence: [
          indexPath,
          `Remote stylesheets with integrity but missing crossorigin: ${runtimeAudit.externalStylesheetsWithIntegrityMissingCrossoriginCount}`,
        ],
        suggestedFix:
          'Add a reviewed `crossorigin` attribute alongside stylesheet integrity metadata so SRI works consistently for remote stylesheet fetches.',
      }),
    );
  }

  if (runtimeAudit.externalStylesheetsWithInsecureTransportCount > 0) {
    findings.push(
      makeFinding({
        id: 'runtime-external-stylesheets-insecure-transport',
        category: 'Security Hygiene',
        severity: 'info',
        message: 'Remote stylesheet links were detected over plain HTTP.',
        evidence: [
          indexPath,
          `Remote stylesheets over insecure transport: ${runtimeAudit.externalStylesheetsWithInsecureTransportCount}`,
        ],
        suggestedFix:
          'Serve remote stylesheets over HTTPS with integrity/crossorigin metadata, or move them into the trusted build pipeline.',
      }),
    );
  }

  if (runtimeAudit.externalMediaSourcesWithInsecureTransportCount > 0) {
    findings.push(
      makeFinding({
        id: 'runtime-external-media-insecure-transport',
        category: 'Security Hygiene',
        severity: 'info',
        message:
          'Remote image or media sources were detected over plain HTTP in the built root document.',
        evidence: [
          indexPath,
          `Remote media sources over insecure transport: ${runtimeAudit.externalMediaSourcesWithInsecureTransportCount}`,
        ],
        suggestedFix:
          'Serve remote image and media sources over HTTPS or move them behind a reviewed trusted asset boundary before shipping.',
      }),
    );
  }

  if (runtimeAudit.externalBlankLinksWithoutRelCount > 0) {
    findings.push(
      makeFinding({
        id: 'runtime-external-links-noopener-missing',
        category: 'Security Hygiene',
        severity: 'warn',
        message:
          'External links in the built root document open new tabs without `rel="noopener noreferrer"` protections.',
        evidence: [
          indexPath,
          `External target="_blank" links missing rel protections: ${runtimeAudit.externalBlankLinksWithoutRelCount}`,
        ],
        suggestedFix:
          'Add `rel="noopener noreferrer"` to built external links that open a new tab so opener access does not survive into production HTML.',
      }),
    );
  }

  if (runtimeAudit.externalIframesWithoutSandboxCount > 0) {
    findings.push(
      makeFinding({
        id: 'runtime-external-iframes-sandbox-missing',
        category: 'Security Hygiene',
        severity: 'warn',
        message:
          'External iframe embeds in the built root document are missing a `sandbox` attribute.',
        evidence: [
          indexPath,
          `External iframes without sandbox: ${runtimeAudit.externalIframesWithoutSandboxCount}`,
        ],
        suggestedFix:
          'Add the narrowest reviewed sandbox policy to external iframes before shipping built HTML.',
      }),
    );
  }

  if (runtimeAudit.externalIframesWithInsecureTransportCount > 0) {
    findings.push(
      makeFinding({
        id: 'runtime-external-iframes-insecure-transport',
        category: 'Security Hygiene',
        severity: 'warn',
        message: 'External iframe embeds in the built root document are loaded over plain HTTP.',
        evidence: [
          indexPath,
          `External iframes over insecure transport: ${runtimeAudit.externalIframesWithInsecureTransportCount}`,
        ],
        suggestedFix:
          'Serve embedded iframes over HTTPS or move the integration behind a reviewed trusted boundary before shipping built HTML.',
      }),
    );
  }

  if (runtimeAudit.jsEvalSignalCount > 0) {
    findings.push(
      makeFinding({
        id: 'runtime-js-dynamic-code-signals',
        category: 'Security Hygiene',
        severity: 'warn',
        message:
          'Built JavaScript includes dynamic code execution markers such as `eval` or `new Function`.',
        evidence: [distPath, `Dynamic code signals in built JS: ${runtimeAudit.jsEvalSignalCount}`],
        suggestedFix:
          'Remove runtime code evaluation from shipped bundles and replace it with explicit data transforms or static dispatch logic.',
      }),
    );
  }

  const hasSourceCorroboration = (sourceAudit?.filesChecked ?? 0) > 0;
  const sourceSecurityCorroborates = (sourceAudit?.securityRiskPatterns.count ?? 0) > 0;
  const sourceLocalhostCorroborates = (sourceAudit?.localhostEndpointSignals.count ?? 0) > 0;
  const htmlInjectionShouldWarn =
    runtimeAudit.jsHtmlInjectionSignalCount > 0 &&
    (!hasSourceCorroboration ||
      sourceSecurityCorroborates ||
      runtimeAudit.jsHtmlInjectionSignalCount >= 25);
  const insecureTransportShouldWarn =
    runtimeAudit.jsInsecureTransportSignalCount > 0 &&
    (!hasSourceCorroboration ||
      sourceSecurityCorroborates ||
      sourceLocalhostCorroborates ||
      runtimeAudit.jsInsecureTransportSignalCount >= 25);

  if (htmlInjectionShouldWarn) {
    findings.push(
      makeFinding({
        id: 'runtime-js-html-injection-signals',
        category: 'Security Hygiene',
        severity: 'warn',
        message:
          'Built JavaScript includes HTML-injection markers such as `innerHTML`, `insertAdjacentHTML`, or `document.write`.',
        evidence: [
          distPath,
          `HTML injection signals in built JS: ${runtimeAudit.jsHtmlInjectionSignalCount}`,
        ],
        suggestedFix:
          'Prefer explicit DOM node creation or framework-safe rendering paths instead of writing raw HTML into the document at runtime.',
      }),
    );
  }

  if (insecureTransportShouldWarn) {
    findings.push(
      makeFinding({
        id: 'runtime-js-insecure-transport-signals',
        category: 'Security Hygiene',
        severity: 'warn',
        message:
          'Built JavaScript includes insecure transport or localhost-style development endpoint markers.',
        evidence: [
          distPath,
          `Insecure or localhost transport signals in built JS: ${runtimeAudit.jsInsecureTransportSignalCount}`,
        ],
        suggestedFix:
          'Remove plain HTTP, ws://, and localhost-style endpoints from shipped bundles; prefer HTTPS/WSS and reviewed environment-backed URLs or route transport through a trusted server boundary.',
      }),
    );
  }

  if (runtimeAudit.jsSecretSignalCount > 0) {
    findings.push(
      makeFinding({
        id: 'runtime-js-secret-signals',
        category: 'Security Hygiene',
        severity: 'error',
        message:
          'Built JavaScript includes secret-like markers such as service-role keys, live secret keys, or private-key material.',
        evidence: [
          distPath,
          `Secret-like signals in built JS: ${runtimeAudit.jsSecretSignalCount}`,
        ],
        suggestedFix:
          'Remove server-only secrets from client bundles immediately, rotate any exposed credentials, and keep privileged keys behind a trusted server boundary.',
      }),
    );
  }

  if (runtimeAudit.cspSignalOk === false) {
    findings.push(
      makeFinding({
        id: 'runtime-csp-signal-missing',
        category: 'Security Hygiene',
        severity: 'info',
        message:
          'No document-level Content Security Policy signal was detected in the built root document.',
        evidence: [indexPath],
        suggestedFix:
          'Prefer a CSP response header, or emit a CSP meta policy for static hosts that cannot add security headers.',
      }),
    );
  }

  if (runtimeAudit.assetCount === 0) {
    findings.push(
      makeFinding({
        id: 'runtime-assets-missing',
        category: 'Runtime Verification',
        severity: 'warn',
        message: 'No built /assets references were detected in dist/index.html.',
        evidence: [indexPath],
        suggestedFix:
          'Confirm the production build emitted JS/CSS assets and that index.html points at them.',
      }),
    );
  } else if (runtimeAudit.assetsPassed < runtimeAudit.assetCount) {
    findings.push(
      makeFinding({
        id: 'runtime-assets-fetch-failed',
        category: 'Runtime Verification',
        severity: 'error',
        message: 'One or more built assets could not be fetched from the generated dist output.',
        evidence: [
          `${runtimeAudit.assetsPassed}/${runtimeAudit.assetCount} assets fetched successfully.`,
          ...runtimeAudit.failures.filter((failure) => failure.startsWith('asset-fetch-failed:')),
        ],
        suggestedFix:
          'Rebuild the project and verify the emitted asset paths and static hosting layout are correct.',
      }),
    );
  }

  if (
    runtimeAudit.routeHintsChecked.length > 0 &&
    runtimeAudit.routeHintsMatched < Math.min(2, runtimeAudit.routeHintsChecked.length)
  ) {
    findings.push(
      makeFinding({
        id: 'runtime-route-hints-missing',
        category: 'Runtime Verification',
        severity: 'warn',
        message:
          'Built JS did not clearly include the expected route hints from the compiled app contract.',
        evidence: [
          `Checked route hints: ${runtimeAudit.routeHintsChecked.join(', ')}`,
          `Matched ${runtimeAudit.routeHintsMatched}/${runtimeAudit.routeHintsChecked.length} route hints in built JS assets.`,
        ],
        suggestedFix:
          'Verify that route generation still covers the pages declared in the essence and compiled packs.',
      }),
    );
  } else if (
    runtimeAudit.routeHintsChecked.length > 0 &&
    runtimeAudit.routeHintsMatched < runtimeAudit.routeHintsChecked.length
  ) {
    findings.push(
      makeFinding({
        id: 'runtime-route-hints-partial',
        category: 'Runtime Verification',
        severity: 'info',
        message:
          'Built JS only reflected part of the expected route contract from the compiled app context.',
        evidence: [
          `Checked route hints: ${runtimeAudit.routeHintsChecked.join(', ')}`,
          `Matched ${runtimeAudit.routeHintsMatched}/${runtimeAudit.routeHintsChecked.length} route hints in built JS assets.`,
        ],
        suggestedFix:
          'Verify route generation for the missing pages and confirm code-split bundles still preserve the expected route contract.',
      }),
    );
  }

  if (
    runtimeAudit.routeDocumentsChecked > 0 &&
    runtimeAudit.routeDocumentsPassed < Math.min(2, runtimeAudit.routeDocumentsChecked)
  ) {
    findings.push(
      makeFinding({
        id: 'runtime-route-documents-missing',
        category: 'Runtime Verification',
        severity: 'warn',
        message:
          'One or more expected routes did not return a valid root document from the built output.',
        evidence: [
          `Passed ${runtimeAudit.routeDocumentsPassed}/${runtimeAudit.routeDocumentsChecked} route document checks.`,
          ...runtimeAudit.failures.filter((failure) =>
            failure.startsWith('route-document-failed:'),
          ),
        ],
        suggestedFix:
          'Verify route fallbacks and build output so every declared route resolves to a usable root document.',
      }),
    );
  } else if (
    runtimeAudit.routeDocumentsChecked > 0 &&
    runtimeAudit.routeDocumentsPassed < runtimeAudit.routeDocumentsChecked
  ) {
    findings.push(
      makeFinding({
        id: 'runtime-route-documents-partial',
        category: 'Runtime Verification',
        severity: 'warn',
        message:
          'Some expected routes resolved to a root document, but at least one still failed runtime verification.',
        evidence: [
          `Passed ${runtimeAudit.routeDocumentsPassed}/${runtimeAudit.routeDocumentsChecked} route document checks.`,
          ...runtimeAudit.failures.filter((failure) =>
            failure.startsWith('route-document-failed:'),
          ),
        ],
        suggestedFix:
          'Fix the failing route outputs so every declared destination resolves to the same usable root document contract.',
      }),
    );
  }

  if (
    runtimeAudit.routeDocumentsChecked > 0 &&
    runtimeAudit.routeDocumentsHardenedCount < Math.min(2, runtimeAudit.routeDocumentsChecked)
  ) {
    findings.push(
      makeFinding({
        id: 'runtime-route-document-hardening-missing',
        category: 'Document Hardening',
        severity: 'warn',
        message: 'Too few reviewed routes preserved a fully hardened document shell.',
        evidence: [
          `Hardened route documents: ${runtimeAudit.routeDocumentsHardenedCount}/${runtimeAudit.routeDocumentsChecked}`,
          ...extractFailedRouteDocumentHardening(runtimeAudit),
        ],
        suggestedFix:
          'Keep title, lang, viewport, and charset metadata intact for every reviewed route document, not just the root entry shell.',
      }),
    );
  } else if (
    runtimeAudit.routeDocumentsChecked > 0 &&
    runtimeAudit.routeDocumentsHardenedCount < runtimeAudit.routeDocumentsChecked
  ) {
    findings.push(
      makeFinding({
        id: 'runtime-route-document-hardening-partial',
        category: 'Document Hardening',
        severity: 'info',
        message:
          'Some reviewed routes preserved a hardened document shell, but at least one still dropped critical document metadata.',
        evidence: [
          `Hardened route documents: ${runtimeAudit.routeDocumentsHardenedCount}/${runtimeAudit.routeDocumentsChecked}`,
          ...extractFailedRouteDocumentHardening(runtimeAudit),
        ],
        suggestedFix:
          'Make sure every reviewed route document keeps title, lang, viewport, and charset metadata intact across route-level rendering.',
      }),
    );
  }

  if (topology?.hasAuthFeature) {
    const failedRouteDocuments = new Set(extractFailedRouteDocuments(runtimeAudit));
    const failedGatewayRoutes = topology.gatewayRoutes.filter((route) =>
      failedRouteDocuments.has(normalizeRouteHint(route)),
    );
    const failedPrimaryRoutes = topology.primaryRoutes.filter((route) =>
      failedRouteDocuments.has(normalizeRouteHint(route)),
    );

    if (failedGatewayRoutes.length > 0) {
      findings.push(
        makeFinding({
          id: 'runtime-auth-gateway-routes-failed',
          category: 'Runtime Verification',
          severity: 'warn',
          message:
            'One or more gateway auth routes did not return a valid root document from the built output.',
          evidence: [
            `Gateway routes: ${topology.gatewayRoutes.join(', ') || 'none'}`,
            `Failed gateway routes: ${failedGatewayRoutes.join(', ')}`,
          ],
          suggestedFix:
            'Ensure login, registration, and recovery routes resolve to the same usable root document contract as the rest of the app build.',
        }),
      );
    }

    if (failedPrimaryRoutes.length > 0) {
      findings.push(
        makeFinding({
          id: 'runtime-auth-primary-routes-failed',
          category: 'Runtime Verification',
          severity: 'warn',
          message:
            'One or more primary authenticated routes did not return a valid root document from the built output.',
          evidence: [
            `Primary routes: ${topology.primaryRoutes.join(', ') || 'none'}`,
            `Failed primary routes: ${failedPrimaryRoutes.join(', ')}`,
          ],
          suggestedFix:
            'Ensure authenticated app routes like `/dashboard` or `/app` survive the build output and resolve to a valid root document.',
        }),
      );
    }
  }

  const largestIsJs =
    typeof runtimeAudit.largestAssetPath === 'string' &&
    runtimeAudit.largestAssetPath.endsWith('.js');
  if (
    !isFrameworkBuildOutput &&
    ((largestIsJs &&
      runtimeAudit.largestAssetBytes > PERFORMANCE_BUDGETS.largestJsAssetWarnBytes) ||
      runtimeAudit.jsAssetBytes > PERFORMANCE_BUDGETS.totalJsWarnBytes)
  ) {
    findings.push(
      makeFinding({
        id: 'runtime-js-bundle-large',
        category: 'Performance Budget',
        severity: 'warn',
        message:
          'The built JavaScript output is larger than the current Decantr performance budget.',
        evidence: [
          `Total JS: ${formatBytes(runtimeAudit.jsAssetBytes)}`,
          `Largest asset: ${runtimeAudit.largestAssetPath ?? 'n/a'} (${formatBytes(runtimeAudit.largestAssetBytes)})`,
        ],
        suggestedFix:
          'Split large route bundles, remove unnecessary client-only code, and prefer lighter patterns or deferred data surfaces.',
      }),
    );
  }

  if (
    !isFrameworkBuildOutput &&
    runtimeAudit.cssAssetBytes > PERFORMANCE_BUDGETS.totalCssWarnBytes
  ) {
    findings.push(
      makeFinding({
        id: 'runtime-css-bundle-large',
        category: 'Performance Budget',
        severity: 'warn',
        message: 'The built CSS output is larger than the current Decantr performance budget.',
        evidence: [
          `Total CSS: ${formatBytes(runtimeAudit.cssAssetBytes)}`,
          `Total assets: ${formatBytes(runtimeAudit.totalAssetBytes)}`,
        ],
        suggestedFix:
          'Trim unused treatment layers, reduce generated CSS duplication, and prefer scoped styles over broad utility carryover.',
      }),
    );
  }

  if (
    !isFrameworkBuildOutput &&
    runtimeAudit.totalAssetBytes > PERFORMANCE_BUDGETS.totalAssetsWarnBytes
  ) {
    findings.push(
      makeFinding({
        id: 'runtime-total-assets-large',
        category: 'Performance Budget',
        severity: 'warn',
        message: 'The built asset payload is larger than the current Decantr total asset budget.',
        evidence: [
          `Total assets: ${formatBytes(runtimeAudit.totalAssetBytes)}`,
          `JS: ${formatBytes(runtimeAudit.jsAssetBytes)}`,
          `CSS: ${formatBytes(runtimeAudit.cssAssetBytes)}`,
        ],
        suggestedFix:
          'Reduce shipped assets, split infrequently used routes, and keep the showcase/app shell focused on essential interactive surfaces.',
      }),
    );
  }
}

function appendSourceAuditFindings(
  findings: VerificationFinding[],
  sourceAudit: SourceAuditSummary,
  essence: EssenceFile | null,
  reviewPack: ReviewExecutionPack | null,
  adoptionMode: string | null,
): void {
  if (sourceAudit.filesChecked === 0) {
    return;
  }

  const isProjectOwnedStyling =
    adoptionMode === 'contract-only' || adoptionMode === 'style-bridge';

  if (sourceAudit.inlineStyles.count > 0) {
    findings.push(
      makeFinding({
        id: 'source-inline-styles-present',
        category: 'Source Audit',
        severity: 'warn',
        message: isProjectOwnedStyling
          ? 'Source files contain inline style attributes; project-owned styling projects should route static visual decisions through local law or the style bridge.'
          : 'Source files still contain disallowed inline style attributes, which undermines the compiled treatment contract.',
        evidence: buildSourceAuditEvidence(
          sourceAudit,
          sourceAudit.inlineStyles,
          'Disallowed inline style attributes',
        ),
        suggestedFix: isProjectOwnedStyling
          ? 'Move static visual styling into the app design system, Tailwind/theme tokens, component variants, or accepted local rules. Keep inline style only for truly dynamic geometry.'
          : 'Move static visual styling into treatments, atoms, or design-token-backed classes. Inline style remains acceptable for Decantr CSS-variable writes and truly dynamic geometry.',
      }),
    );
  }

  if (sourceAudit.componentStyleTags.count > 0) {
    findings.push(
      makeFinding({
        id: 'source-component-style-tags-present',
        category: 'Source Audit',
        severity: 'warn',
        message: isProjectOwnedStyling
          ? 'Source files inject component-scoped style tags or dynamic style elements, which makes project-owned styling rules harder to enforce.'
          : 'Source files inject component-scoped style tags or dynamic style elements, which bypass the compiled Decantr layer contract.',
        evidence: buildSourceAuditEvidence(
          sourceAudit,
          sourceAudit.componentStyleTags,
          'Component-level style tag signals',
        ),
        suggestedFix: isProjectOwnedStyling
          ? 'Move shared keyframes, media queries, and visual rules into the project stylesheet, component library, or accepted local pattern/rule manifest.'
          : 'Move shared keyframes, media queries, and visual rules into global.css or treatments.css so styling stays inside the reviewed Decantr layer stack.',
      }),
    );
  }

  if (!isProjectOwnedStyling && sourceAudit.localCssRuntimeSignals.count > 0) {
    findings.push(
      makeFinding({
        id: 'source-local-css-runtime-stub-present',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Source files include a local css() runtime or hand-written atoms stylesheet instead of the first-party `@decantr/css` runtime path.',
        evidence: buildSourceAuditEvidence(
          sourceAudit,
          sourceAudit.localCssRuntimeSignals,
          'Local css() runtime signals',
        ),
        suggestedFix:
          'Use the real `@decantr/css` runtime for atom classes and remove local `css()` stubs or hand-written `atoms.css` fallbacks unless the project is deliberately running in an explicit fallback mode.',
      }),
    );
  }

  if (sourceAudit.securityRiskPatterns.count > 0) {
    findings.push(
      makeFinding({
        id: 'source-security-risk-patterns-present',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Source files include security-risk rendering or link patterns before the project is even built.',
        evidence: buildSourceAuditEvidence(
          sourceAudit,
          sourceAudit.securityRiskPatterns,
          'Security-risk source patterns',
        ),
        suggestedFix:
          'Remove dangerous HTML writes, client-exposed secret references, localhost/dev endpoints, wildcard postMessage targets, dynamic code execution, and unsafe external link patterns from source before shipping.',
      }),
    );
  }

  if (sourceAudit.localhostEndpointSignals.count > 0) {
    findings.push(
      makeFinding({
        id: 'source-localhost-endpoints-present',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Source files still reference localhost-style endpoints that will not survive a real production deployment.',
        evidence: buildSourceAuditEvidence(
          sourceAudit,
          sourceAudit.localhostEndpointSignals,
          'Localhost endpoint signals',
        ),
        suggestedFix:
          'Replace localhost, 127.0.0.1, or 0.0.0.0 client endpoints with reviewed environment-backed URLs or route them behind a trusted server boundary before shipping.',
      }),
    );
  }

  if (sourceAudit.placeholderRoutes.count > 0) {
    findings.push(
      makeFinding({
        id: 'source-placeholder-route-targets-present',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Source files still include placeholder navigation targets instead of real app routes.',
        evidence: buildSourceAuditEvidence(
          sourceAudit,
          sourceAudit.placeholderRoutes,
          'Placeholder route targets',
        ),
        suggestedFix:
          'Replace placeholder href/to values with the actual routes declared in the compiled packs and essence.',
      }),
    );
  }

  const navigation = essence && isV4(essence) ? essence.meta.navigation : null;
  if (navigation?.command_palette && sourceAudit.commandPaletteSignals.count === 0) {
    findings.push(
      makeFinding({
        id: 'source-command-palette-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'The essence declares a command palette, but the source tree does not show an obvious command-palette implementation signal.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          'Command palette declared in essence navigation.',
        ],
        suggestedFix:
          'Implement a real command palette surface with its keyboard trigger instead of merely acknowledging the feature in copy or comments.',
      }),
    );
  }

  if (navigation?.hotkeys?.length && sourceAudit.keyboardShortcutSignals.count === 0) {
    findings.push(
      makeFinding({
        id: 'source-hotkeys-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'The essence declares hotkeys, but the source tree does not show obvious keyboard-shortcut handling.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Hotkeys declared: ${navigation.hotkeys.length}`,
        ],
        suggestedFix:
          'Implement the declared hotkeys with real keydown handlers or a reviewed shortcut helper rather than leaving them as documentation-only features.',
      }),
    );
  }

  if (sourceAudit.authStorageWrites.count > 0) {
    findings.push(
      makeFinding({
        id: 'source-auth-storage-writes-present',
        category: 'Source Audit',
        severity: 'warn',
        message: 'Source files write auth-like credentials into browser storage.',
        evidence: buildSourceAuditEvidence(
          sourceAudit,
          sourceAudit.authStorageWrites,
          'Auth storage writes',
        ),
        suggestedFix:
          'Avoid storing auth tokens in localStorage/sessionStorage and prefer secure server-managed session boundaries.',
      }),
    );
  }

  if (sourceAudit.authCookieWrites.count > 0) {
    findings.push(
      makeFinding({
        id: 'source-auth-cookie-writes-present',
        category: 'Source Audit',
        severity: 'warn',
        message: 'Source files write auth-like credentials into client-managed cookies.',
        evidence: buildSourceAuditEvidence(
          sourceAudit,
          sourceAudit.authCookieWrites,
          'Auth cookie writes',
        ),
        suggestedFix:
          'Avoid setting auth cookies from client-side JavaScript; prefer secure server-issued HttpOnly session cookies or other server-managed boundaries.',
      }),
    );
  }

  if (sourceAudit.authHeaderWrites.count > 0) {
    findings.push(
      makeFinding({
        id: 'source-auth-header-writes-present',
        category: 'Source Audit',
        severity: 'warn',
        message: 'Source files construct auth-like authorization headers in client-side code.',
        evidence: buildSourceAuditEvidence(
          sourceAudit,
          sourceAudit.authHeaderWrites,
          'Auth header writes',
        ),
        suggestedFix:
          'Avoid building bearer/session auth headers in client-rendered code; prefer server-managed session boundaries or a deliberate reviewed client-auth strategy.',
      }),
    );
  }

  const topology = summarizeTopology(essence, reviewPack);
  if (
    topology.hasAuthFeature &&
    sourceAudit.authStorageWrites.count > 0 &&
    sourceAudit.authExitSignals.count > 0 &&
    sourceAudit.authStorageClears.count === 0
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-storage-teardown-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Auth exit flows exist, but the source tree does not show client-managed auth storage being cleared during sign-out.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Auth storage write files: ${sourceAudit.authStorageWrites.files.join(', ') || 'none'}`,
          `Auth exit files: ${sourceAudit.authExitSignals.files.join(', ') || 'none'}`,
          'Auth storage clear files: none',
        ],
        suggestedFix:
          'If auth data is ever stored in browser storage, remove those auth/session keys during sign-out before returning users to an anonymous route.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAudit.authCookieWrites.count > 0 &&
    sourceAudit.authExitSignals.count > 0 &&
    sourceAudit.authCookieClears.count === 0
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-cookie-teardown-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Auth exit flows exist, but the source tree does not show client-managed auth cookies being cleared during sign-out.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Auth cookie write files: ${sourceAudit.authCookieWrites.files.join(', ') || 'none'}`,
          `Auth exit files: ${sourceAudit.authExitSignals.files.join(', ') || 'none'}`,
          'Auth cookie clear files: none',
        ],
        suggestedFix:
          'If auth cookies are issued from reviewed source surfaces, explicitly expire or delete them during sign-out before returning users to an anonymous route.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAudit.authHeaderWrites.count > 0 &&
    sourceAudit.authExitSignals.count > 0 &&
    sourceAudit.authHeaderClears.count === 0
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-header-teardown-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Auth exit flows exist, but the source tree does not show client-managed auth headers being cleared during sign-out.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Auth header write files: ${sourceAudit.authHeaderWrites.files.join(', ') || 'none'}`,
          `Auth exit files: ${sourceAudit.authExitSignals.files.join(', ') || 'none'}`,
          'Auth header clear files: none',
        ],
        suggestedFix:
          'If reviewed source code constructs auth-like authorization headers, explicitly delete or reset those header values during sign-out before returning users to an anonymous route.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAudit.authCacheClients.count > 0 &&
    sourceAudit.authExitSignals.count > 0 &&
    sourceAudit.authCacheClears.count === 0 &&
    (sourceAuditBucketsOverlap(sourceAudit.authCacheClients, sourceAudit.protectedSurfaceSignals) ||
      sourceAuditBucketsOverlap(sourceAudit.authCacheClients, sourceAudit.authSessionSignals))
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-cache-teardown-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Auth exit flows exist, but the source tree does not show client-side data caches being cleared during sign-out.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Auth cache client files: ${sourceAudit.authCacheClients.files.join(', ') || 'none'}`,
          `Auth exit files: ${sourceAudit.authExitSignals.files.join(', ') || 'none'}`,
          'Auth cache clear files: none',
        ],
        suggestedFix:
          'If protected data is cached in query clients or client data stores, clear or reset those caches during sign-out before redirecting users back to an anonymous route.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAudit.authRefreshSignals.count > 0 &&
    sourceAudit.authExitSignals.count > 0 &&
    !sourceAuditBucketsOverlap(sourceAudit.authRefreshSignals, sourceAudit.authRefreshClears)
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-refresh-teardown-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Auth exit flows exist, but the source tree does not show background auth refresh timers or subscriptions being torn down during sign-out.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Auth refresh files: ${sourceAudit.authRefreshSignals.files.join(', ') || 'none'}`,
          `Auth exit files: ${sourceAudit.authExitSignals.files.join(', ') || 'none'}`,
          `Auth refresh clear files: ${sourceAudit.authRefreshClears.files.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'If auth/session refresh runs on timers or subscriptions, clear those intervals, timeouts, or listeners during sign-out before returning users to an anonymous route.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAudit.authRealtimeSignals.count > 0 &&
    sourceAudit.authExitSignals.count > 0 &&
    !sourceAuditBucketsOverlap(sourceAudit.authRealtimeSignals, sourceAudit.authRealtimeClears) &&
    (sourceAuditBucketsOverlap(
      sourceAudit.authRealtimeSignals,
      sourceAudit.protectedSurfaceSignals,
    ) ||
      sourceAuditBucketsOverlap(sourceAudit.authRealtimeSignals, sourceAudit.authSessionSignals))
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-realtime-teardown-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Auth exit flows exist, but the source tree does not show realtime channels or sockets being torn down during sign-out.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Auth realtime files: ${sourceAudit.authRealtimeSignals.files.join(', ') || 'none'}`,
          `Auth exit files: ${sourceAudit.authExitSignals.files.join(', ') || 'none'}`,
          `Auth realtime clear files: ${sourceAudit.authRealtimeClears.files.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'If protected data arrives over websockets, SSE, or realtime channels, close or unsubscribe those connections during sign-out before returning users to an anonymous route.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAudit.authCoordinationSignals.count > 0 &&
    sourceAudit.authExitSignals.count > 0 &&
    !sourceAuditBucketsOverlap(
      sourceAudit.authCoordinationSignals,
      sourceAudit.authCoordinationClears,
    ) &&
    (sourceAuditBucketsOverlap(
      sourceAudit.authCoordinationSignals,
      sourceAudit.protectedSurfaceSignals,
    ) ||
      sourceAuditBucketsOverlap(
        sourceAudit.authCoordinationSignals,
        sourceAudit.authSessionSignals,
      ))
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-coordination-teardown-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Auth exit flows exist, but the source tree does not show cross-tab auth coordination channels or storage listeners being torn down during sign-out.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Auth coordination files: ${sourceAudit.authCoordinationSignals.files.join(', ') || 'none'}`,
          `Auth exit files: ${sourceAudit.authExitSignals.files.join(', ') || 'none'}`,
          `Auth coordination clear files: ${sourceAudit.authCoordinationClears.files.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'If auth state is coordinated across tabs with BroadcastChannel or storage listeners, close those channels and remove those listeners during sign-out before returning users to an anonymous route.',
      }),
    );
  }

  if (topology.hasAuthFeature && sourceAudit.authGuardSignals.count === 0) {
    findings.push(
      makeFinding({
        id: 'source-auth-guard-signals-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Authentication is declared, but the source tree does not show clear auth-guard or redirect behavior.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          'Auth guard signals: 0',
          `Gateway routes: ${topology.gatewayRoutes.join(', ') || 'none'}`,
          `Primary routes: ${topology.primaryRoutes.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'Add explicit protected-route wrappers, middleware, session checks, or redirects to login/register before authenticated surfaces render.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    topology.primaryRoutes.length > 0 &&
    sourceAudit.protectedSurfaceSignals.count > 0 &&
    sourceAudit.authGuardSignals.count > 0 &&
    !sourceAuditBucketsOverlap(sourceAudit.protectedSurfaceSignals, sourceAudit.authGuardSignals) &&
    !sourceAuditBucketsOverlap(
      sourceAudit.protectedSurfaceSignals,
      sourceAudit.authSessionSignals,
    ) &&
    !sourceAuditProtectedSurfacesCoveredByGuardedNextLayouts(
      sourceAudit.protectedSurfaceSignals,
      sourceAudit.authGuardSignals,
      topology,
    )
  ) {
    findings.push(
      makeFinding({
        id: 'source-protected-surface-auth-checks-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Files that expose protected app surfaces do not appear to co-locate session checks or guard behavior.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Protected surface files: ${sourceAudit.protectedSurfaceSignals.files.join(', ') || 'none'}`,
          `Auth guard files: ${sourceAudit.authGuardSignals.files.join(', ') || 'none'}`,
          `Auth session files: ${sourceAudit.authSessionSignals.files.join(', ') || 'none'}`,
          `Primary routes: ${topology.primaryRoutes.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'Keep protected-route components, layouts, or loaders close to the session check or guard that protects them so authenticated surfaces do not look accidentally public.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAudit.authProtectedRedirectSignals.count > 0 &&
    sourceAuditBucketsOverlap(
      sourceAudit.authProtectedRedirectSignals,
      sourceAudit.authGuardSignals,
    ) &&
    !sourceAuditBucketsOverlap(
      sourceAudit.authProtectedRedirectSignals,
      sourceAudit.authEntrySignals,
    )
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-guard-protected-redirect',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Auth guard logic appears to redirect users toward protected destinations instead of anonymous entry routes.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Protected redirect files: ${sourceAudit.authProtectedRedirectSignals.files.join(', ') || 'none'}`,
          `Auth guard files: ${sourceAudit.authGuardSignals.files.join(', ') || 'none'}`,
          `Gateway routes: ${topology.gatewayRoutes.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'Send unauthenticated guard redirects to `/`, `/login`, `/register`, or another reviewed gateway route, and keep redirects to protected destinations for post-auth success flows only.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAudit.authSessionSignals.count > 0 &&
    !sourceAuditBucketsOverlap(sourceAudit.authSessionSignals, sourceAudit.authLoadingSignals)
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-loading-signals-missing',
        category: 'Source Audit',
        severity: 'info',
        message:
          'Source files reference auth/session state but do not show a clear loading or pending state while session resolution happens.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Auth/session signals: ${sourceAudit.authSessionSignals.count}`,
          `Auth loading signals: ${sourceAudit.authLoadingSignals.count}`,
          `Session files: ${sourceAudit.authSessionSignals.files.join(', ') || 'none'}`,
          `Loading files: ${sourceAudit.authLoadingSignals.files.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'When auth or session state resolves asynchronously, render an explicit loading, skeleton, suspense fallback, or pending state before redirecting or rendering protected content.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAuditBucketsOverlap(
      sourceAudit.authSessionSignals,
      sourceAudit.protectedSurfaceSignals,
    ) &&
    sourceAuditBucketsOverlap(sourceAudit.authSessionSignals, sourceAudit.authLoadingSignals) &&
    sourceAudit.authProtectedLoadingRenderSignals.count > 0
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-loading-protected-render',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Protected source surfaces show a loading branch, but that branch still appears to render a protected destination while session resolution is pending.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Protected session files: ${sourceAudit.authSessionSignals.files.join(', ') || 'none'}`,
          `Loading files: ${sourceAudit.authLoadingSignals.files.join(', ') || 'none'}`,
          `Protected loading render files: ${sourceAudit.authProtectedLoadingRenderSignals.files.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'While auth/session state is loading, render a neutral spinner, skeleton, suspense fallback, or guard boundary instead of returning a dashboard/app shell before the session is confirmed.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAudit.authSessionSignals.count > 0 &&
    sourceAuditBucketsOverlap(sourceAudit.authSessionSignals, sourceAudit.authLoadingSignals) &&
    sourceAudit.authBlankLoadingRenderSignals.count > 0
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-loading-blank-render',
        category: 'Source Audit',
        severity: 'info',
        message:
          'Auth/session loading branches exist, but some of them return nothing instead of an explicit pending boundary.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Session files: ${sourceAudit.authSessionSignals.files.join(', ') || 'none'}`,
          `Loading files: ${sourceAudit.authLoadingSignals.files.join(', ') || 'none'}`,
          `Blank loading files: ${sourceAudit.authBlankLoadingRenderSignals.files.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'When auth/session state is loading, render a spinner, skeleton, suspense fallback, or another explicit pending UI instead of returning `null` or an empty fragment.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAudit.authSessionSignals.count > 0 &&
    sourceAuditBucketsOverlap(sourceAudit.authSessionSignals, sourceAudit.authLoadingSignals) &&
    sourceAudit.authAnonymousLoadingRedirectSignals.count > 0
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-loading-anonymous-redirect',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Auth/session loading branches redirect users to anonymous routes before session resolution finishes.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Session files: ${sourceAudit.authSessionSignals.files.join(', ') || 'none'}`,
          `Loading files: ${sourceAudit.authLoadingSignals.files.join(', ') || 'none'}`,
          `Anonymous loading redirect files: ${sourceAudit.authAnonymousLoadingRedirectSignals.files.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'Do not redirect to `/login`, `/`, or another anonymous route while session state is still loading. Render a pending boundary first, then redirect only after the session resolves as unauthenticated.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAuditBucketsOverlap(
      sourceAudit.authSessionSignals,
      sourceAudit.protectedSurfaceSignals,
    ) &&
    sourceAuditBucketsOverlap(
      sourceAudit.authSessionSignals,
      sourceAudit.authUnauthenticatedBranchSignals,
    ) &&
    sourceAudit.authProtectedUnauthenticatedRenderSignals.count > 0
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-session-loss-protected-render',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Protected source surfaces branch on auth loss but still appear to render a protected destination in the unauthenticated branch.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Protected session files: ${sourceAudit.authSessionSignals.files.join(', ') || 'none'}`,
          `Unauthenticated branch files: ${sourceAudit.authUnauthenticatedBranchSignals.files.join(', ') || 'none'}`,
          `Protected unauthenticated render files: ${sourceAudit.authProtectedUnauthenticatedRenderSignals.files.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'When a protected surface detects a null or unauthenticated session, redirect to a reviewed anonymous route or render a neutral guard boundary instead of returning a dashboard/app shell.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAuditBucketsOverlap(
      sourceAudit.authSessionSignals,
      sourceAudit.protectedSurfaceSignals,
    ) &&
    !sourceAuditBucketsOverlap(
      sourceAudit.authSessionSignals,
      sourceAudit.authUnauthenticatedBranchSignals,
    )
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-session-loss-handling-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Protected source surfaces read auth/session state but do not show an explicit unauthenticated branch when session resolution fails or the user signs out.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Protected session files: ${sourceAudit.authSessionSignals.files.join(', ') || 'none'}`,
          `Unauthenticated branch files: ${sourceAudit.authUnauthenticatedBranchSignals.files.join(', ') || 'none'}`,
          `Auth guard files: ${sourceAudit.authGuardSignals.files.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'When protected surfaces read session state directly, branch on unauthenticated/null-session cases and redirect to a reviewed anonymous route or return a guard boundary before protected content renders.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAuditBucketsOverlap(
      sourceAudit.authSessionSignals,
      sourceAudit.protectedSurfaceSignals,
    ) &&
    sourceAuditBucketsOverlap(
      sourceAudit.authSessionSignals,
      sourceAudit.authUnauthenticatedBranchSignals,
    ) &&
    !sourceAuditBucketsOverlap(
      sourceAudit.authSessionSignals,
      sourceAudit.authAnonymousRedirectSignals,
    )
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-session-loss-redirect-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Protected source surfaces branch on auth loss but do not show an obvious redirect back to an anonymous route.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Protected session files: ${sourceAudit.authSessionSignals.files.join(', ') || 'none'}`,
          `Unauthenticated branch files: ${sourceAudit.authUnauthenticatedBranchSignals.files.join(', ') || 'none'}`,
          `Anonymous redirect files: ${sourceAudit.authAnonymousRedirectSignals.files.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'When a protected surface detects a null or unauthenticated session, redirect users to `/`, `/login`, `/register`, or another reviewed anonymous route instead of returning `null` or leaving the protected shell blank.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    (sourceAudit.authSessionSignals.count > 0 || sourceAudit.authEntrySignals.count > 0) &&
    sourceAudit.authErrorSignals.count === 0
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-error-signals-missing',
        category: 'Source Audit',
        severity: 'info',
        message:
          'Authentication surfaces do not show an obvious error or failure state for rejected sign-in, session refresh, or recovery flows.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Auth/session signals: ${sourceAudit.authSessionSignals.count}`,
          `Auth entry signals: ${sourceAudit.authEntrySignals.count}`,
          'Auth error signals: 0',
          `Session files: ${sourceAudit.authSessionSignals.files.join(', ') || 'none'}`,
          `Entry files: ${sourceAudit.authEntrySignals.files.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'Expose a reviewed error state for failed sign-in, session refresh, or recovery paths with inline feedback, alert messaging, or another explicit failure affordance.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAudit.recoveryFlowSignals.count > 0 &&
    !sourceAuditBucketsOverlap(sourceAudit.recoveryFlowSignals, sourceAudit.authSuccessSignals)
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-recovery-success-missing',
        category: 'Source Audit',
        severity: 'info',
        message:
          'Recovery flows exist, but the source tree does not show an obvious success or confirmation state after a reset request completes.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Recovery flow signals: ${sourceAudit.recoveryFlowSignals.count}`,
          'Auth success signals: 0',
          `Recovery files: ${sourceAudit.recoveryFlowSignals.files.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'After password-reset or recovery submission succeeds, show a reviewed confirmation state such as "check your email", "reset link sent", or another explicit success affordance.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAudit.signUpFlowSignals.count > 0 &&
    !sourceAuditBucketsOverlap(
      sourceAudit.signUpFlowSignals,
      sourceAudit.authProtectedRedirectSignals,
    ) &&
    !sourceAuditBucketsOverlap(sourceAudit.signUpFlowSignals, sourceAudit.authSuccessSignals)
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-registration-success-missing',
        category: 'Source Audit',
        severity: 'info',
        message:
          'Registration flows exist, but the source tree does not show either a reviewed post-auth transition or an explicit success/verification state.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Registration flow signals: ${sourceAudit.signUpFlowSignals.count}`,
          `Protected auth redirects: ${sourceAudit.authProtectedRedirectSignals.count}`,
          `Auth success signals: ${sourceAudit.authSuccessSignals.count}`,
          `Registration files: ${sourceAudit.signUpFlowSignals.files.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'After registration succeeds, either navigate users into a reviewed protected route like `/dashboard` or show an explicit success state such as "account created" or "check your email" before the next auth step.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    (sourceAudit.authCallbackTokenSignals.count > 0 ||
      sourceAudit.authCallbackStateSignals.count > 0) &&
    !sourceAuditBucketsOverlap(
      sourceAudit.authCallbackTokenSignals,
      sourceAudit.authProtectedRedirectSignals,
    ) &&
    !sourceAuditBucketsOverlap(
      sourceAudit.authCallbackTokenSignals,
      sourceAudit.authSuccessSignals,
    ) &&
    !sourceAuditBucketsOverlap(
      sourceAudit.authCallbackStateSignals,
      sourceAudit.authProtectedRedirectSignals,
    ) &&
    !sourceAuditBucketsOverlap(sourceAudit.authCallbackStateSignals, sourceAudit.authSuccessSignals)
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-callback-success-missing',
        category: 'Source Audit',
        severity: 'info',
        message:
          'Auth callback handling exists, but the source tree does not show either a reviewed protected transition or an explicit success state after callback exchange completes.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Auth callback token files: ${sourceAudit.authCallbackTokenSignals.files.join(', ') || 'none'}`,
          `Auth callback state files: ${sourceAudit.authCallbackStateSignals.files.join(', ') || 'none'}`,
          `Protected auth redirects: ${sourceAudit.authProtectedRedirectSignals.count}`,
          `Auth success signals: ${sourceAudit.authSuccessSignals.count}`,
        ],
        suggestedFix:
          'After callback validation or code exchange succeeds, either navigate users into a reviewed protected route like `/dashboard` or show an explicit success/verification state before the next auth step.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAudit.authCallbackExchangeSignals.count > 0 &&
    !sourceAuditBucketsOverlap(
      sourceAudit.authCallbackExchangeSignals,
      sourceAudit.authCallbackExchangeErrorSignals,
    )
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-callback-exchange-error-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Auth callback exchange logic exists, but the source tree does not show explicit failure handling if the code/session exchange rejects.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Auth callback exchange files: ${sourceAudit.authCallbackExchangeSignals.files.join(', ') || 'none'}`,
          `Callback exchange error-handling files: ${sourceAudit.authCallbackExchangeErrorSignals.files.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'Wrap callback code/session exchange in reviewed catch handling or explicit exchange-error state so failed callback completion does not strand users on an indefinite pending path.',
      }),
    );
  }

  if (topology.hasAuthFeature && sourceAudit.authExitSignals.count === 0) {
    findings.push(
      makeFinding({
        id: 'source-auth-exit-signals-missing',
        category: 'Source Audit',
        severity: 'info',
        message:
          'Authentication is declared, but the source tree does not show an obvious sign-out or session-exit path.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          'Auth exit signals: 0',
          `Gateway routes: ${topology.gatewayRoutes.join(', ') || 'none'}`,
          `Primary routes: ${topology.primaryRoutes.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'Expose an explicit sign-out/logout flow so authenticated users can intentionally end their session.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    topology.hasAnonymousEntryRoute &&
    sourceAudit.authExitSignals.count > 0 &&
    !sourceAuditBucketsOverlap(
      sourceAudit.authExitSignals,
      sourceAudit.authAnonymousRedirectSignals,
    )
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-exit-redirect-missing',
        category: 'Source Audit',
        severity: 'info',
        message:
          'Authentication exit flows do not show an obvious redirect back to an anonymous entry route.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Auth exit files: ${sourceAudit.authExitSignals.files.join(', ') || 'none'}`,
          `Anonymous redirect files: ${sourceAudit.authAnonymousRedirectSignals.files.join(', ') || 'none'}`,
          `Gateway routes: ${topology.gatewayRoutes.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'After sign-out or session exit, redirect users back to `/`, `/login`, `/register`, or another reviewed anonymous entry route so protected shells do not linger after logout.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAudit.authExitSignals.count > 0 &&
    !sourceAuditBucketsOverlap(sourceAudit.authExitSignals, sourceAudit.authSessionTeardownSignals)
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-exit-teardown-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Authentication exit flows exist, but the source tree does not show an obvious session teardown or sign-out boundary.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Auth exit files: ${sourceAudit.authExitSignals.files.join(', ') || 'none'}`,
          `Session teardown files: ${sourceAudit.authSessionTeardownSignals.files.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'Before redirecting users out of the protected shell, explicitly sign out or invalidate the reviewed session state instead of relying on navigation alone.',
      }),
    );
  }

  if (sourceAudit.authOpenRedirectSignals.count > 0) {
    findings.push(
      makeFinding({
        id: 'source-auth-open-redirect-risk',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Source files appear to trust next/returnTo-style redirect parameters during auth or route-transition flows.',
        evidence: buildSourceAuditEvidence(
          sourceAudit,
          sourceAudit.authOpenRedirectSignals,
          'Auth/query redirect signals',
        ),
        suggestedFix:
          'Resolve post-auth or route-transition redirects through a reviewed allowlist of internal routes instead of redirecting directly from raw `next`, `returnTo`, `callbackUrl`, or similar query parameters.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAudit.authExternalRedirectSignals.count > 0 &&
    (sourceAuditBucketsOverlap(
      sourceAudit.authExternalRedirectSignals,
      sourceAudit.authEntrySignals,
    ) ||
      sourceAuditBucketsOverlap(
        sourceAudit.authExternalRedirectSignals,
        sourceAudit.signInFlowSignals,
      ) ||
      sourceAuditBucketsOverlap(
        sourceAudit.authExternalRedirectSignals,
        sourceAudit.signUpFlowSignals,
      ) ||
      sourceAuditBucketsOverlap(
        sourceAudit.authExternalRedirectSignals,
        sourceAudit.recoveryFlowSignals,
      ) ||
      sourceAuditBucketsOverlap(
        sourceAudit.authExternalRedirectSignals,
        sourceAudit.authExitSignals,
      ))
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-external-redirect-risk',
        category: 'Source Audit',
        severity: 'warn',
        message: 'Source files appear to redirect auth-related flows directly to external URLs.',
        evidence: buildSourceAuditEvidence(
          sourceAudit,
          sourceAudit.authExternalRedirectSignals,
          'Auth external redirects',
        ),
        suggestedFix:
          'Keep auth redirects on reviewed internal routes, or route external provider/logout handoffs through explicit reviewed allowlists and provider configuration instead of hardcoding off-site destinations in app code.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAudit.authProviderStateSignals.count > 0 &&
    (sourceAuditBucketsOverlap(
      sourceAudit.authProviderStateSignals,
      sourceAudit.authEntrySignals,
    ) ||
      sourceAuditBucketsOverlap(
        sourceAudit.authProviderStateSignals,
        sourceAudit.signInFlowSignals,
      ) ||
      sourceAuditBucketsOverlap(
        sourceAudit.authProviderStateSignals,
        sourceAudit.signUpFlowSignals,
      ) ||
      sourceAuditBucketsOverlap(
        sourceAudit.authProviderStateSignals,
        sourceAudit.recoveryFlowSignals,
      ) ||
      sourceAuditBucketsOverlap(sourceAudit.authProviderStateSignals, sourceAudit.authExitSignals))
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-provider-state-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Source files hardcode provider-style auth authorize URLs without a `state` parameter.',
        evidence: buildSourceAuditEvidence(
          sourceAudit,
          sourceAudit.authProviderStateSignals,
          'Auth provider URLs missing state',
        ),
        suggestedFix:
          'When auth flows hand off to an external provider authorize URL, include a reviewed `state` value and validate it on return instead of hardcoding off-site auth entry without CSRF protection.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAudit.authProviderPkceSignals.count > 0 &&
    (sourceAuditBucketsOverlap(sourceAudit.authProviderPkceSignals, sourceAudit.authEntrySignals) ||
      sourceAuditBucketsOverlap(
        sourceAudit.authProviderPkceSignals,
        sourceAudit.signInFlowSignals,
      ) ||
      sourceAuditBucketsOverlap(
        sourceAudit.authProviderPkceSignals,
        sourceAudit.signUpFlowSignals,
      ) ||
      sourceAuditBucketsOverlap(
        sourceAudit.authProviderPkceSignals,
        sourceAudit.recoveryFlowSignals,
      ) ||
      sourceAuditBucketsOverlap(sourceAudit.authProviderPkceSignals, sourceAudit.authExitSignals))
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-provider-pkce-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Source files hardcode provider-style OAuth code-flow URLs without a `code_challenge` parameter.',
        evidence: buildSourceAuditEvidence(
          sourceAudit,
          sourceAudit.authProviderPkceSignals,
          'Auth provider code flows missing PKCE',
        ),
        suggestedFix:
          'When auth flows hand off to an external provider authorize URL with `response_type=code`, include a reviewed PKCE `code_challenge` and verifier instead of hardcoding a bare code flow from client code.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAudit.authProviderNonceSignals.count > 0 &&
    (sourceAuditBucketsOverlap(
      sourceAudit.authProviderNonceSignals,
      sourceAudit.authEntrySignals,
    ) ||
      sourceAuditBucketsOverlap(
        sourceAudit.authProviderNonceSignals,
        sourceAudit.signInFlowSignals,
      ) ||
      sourceAuditBucketsOverlap(
        sourceAudit.authProviderNonceSignals,
        sourceAudit.signUpFlowSignals,
      ) ||
      sourceAuditBucketsOverlap(
        sourceAudit.authProviderNonceSignals,
        sourceAudit.recoveryFlowSignals,
      ) ||
      sourceAuditBucketsOverlap(sourceAudit.authProviderNonceSignals, sourceAudit.authExitSignals))
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-provider-nonce-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Source files hardcode provider-style OIDC id_token URLs without a `nonce` parameter.',
        evidence: buildSourceAuditEvidence(
          sourceAudit,
          sourceAudit.authProviderNonceSignals,
          'Auth provider id_token flows missing nonce',
        ),
        suggestedFix:
          'When auth flows hand off to an external provider authorize URL that requests `id_token`, include a reviewed `nonce` and validate it on return instead of hardcoding a bare OIDC implicit or hybrid flow from client code.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    topology.gatewayRoutes.length === 0 &&
    sourceAudit.authEntrySignals.count === 0
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-entry-surface-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Authentication is declared, but the source tree does not show any obvious login, registration, or credential-entry surface.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          'Auth entry signals: 0',
          'Gateway routes: none',
          `Primary routes: ${topology.primaryRoutes.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'Add an explicit login, registration, recovery, or reviewed SSO entry surface before protected routes become the primary way into the app.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    topology.gatewayRoutes.length > 0 &&
    sourceAudit.authEntrySignals.count === 0
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-entry-signals-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Authentication is declared and gateway routes exist, but the source tree does not show an obvious sign-in, registration, or credential-entry surface.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          'Auth entry signals: 0',
          `Gateway routes: ${topology.gatewayRoutes.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'Add a real login, registration, or recovery surface with credential inputs or explicit auth entry actions on the gateway routes.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    topology.gatewayRoutes.some((route) => isRecoveryLikeRoute(route)) &&
    sourceAudit.signInFlowSignals.count > 0 &&
    sourceAudit.recoveryRouteSignals.count === 0
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-recovery-route-missing',
        category: 'Source Audit',
        severity: 'info',
        message:
          'Sign-in surfaces exist and a recovery route is declared, but the source tree does not show an obvious path into that recovery flow.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Sign-in flow files: ${sourceAudit.signInFlowSignals.files.join(', ') || 'none'}`,
          'Recovery route signals: 0',
          `Gateway routes: ${topology.gatewayRoutes.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'Link sign-in users to the declared recovery route, such as `/forgot-password` or `/reset-password`, somewhere in the reviewed auth entry surfaces.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    topology.gatewayRoutes.some((route) => isRegistrationLikeRoute(route)) &&
    sourceAudit.signInFlowSignals.count > 0 &&
    sourceAudit.registrationRouteSignals.count === 0
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-registration-route-missing',
        category: 'Source Audit',
        severity: 'info',
        message:
          'Sign-in surfaces exist and a registration route is declared, but the source tree does not show an obvious path into that registration flow.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Sign-in flow files: ${sourceAudit.signInFlowSignals.files.join(', ') || 'none'}`,
          'Registration route signals: 0',
          `Gateway routes: ${topology.gatewayRoutes.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'Link sign-in users to the declared registration route, such as `/register` or `/sign-up`, somewhere in the reviewed auth entry surfaces.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    topology.gatewayRoutes.some((route) => isSignInLikeRoute(route)) &&
    (sourceAudit.signUpFlowSignals.count > 0 || sourceAudit.recoveryFlowSignals.count > 0) &&
    sourceAudit.signInRouteSignals.count === 0
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-signin-route-missing',
        category: 'Source Audit',
        severity: 'info',
        message:
          'Registration or recovery surfaces exist and a sign-in route is declared, but the source tree does not show an obvious path back into sign-in.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Sign-up flow files: ${sourceAudit.signUpFlowSignals.files.join(', ') || 'none'}`,
          `Recovery flow files: ${sourceAudit.recoveryFlowSignals.files.join(', ') || 'none'}`,
          'Sign-in route signals: 0',
          `Gateway routes: ${topology.gatewayRoutes.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'Link registration and recovery users back to the declared sign-in route, such as `/login` or `/sign-in`, somewhere in the reviewed gateway surfaces.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    topology.primaryRoutes.length > 0 &&
    (sourceAudit.signInFlowSignals.count > 0 ||
      (sourceAudit.authEntrySignals.count > 0 &&
        sourceAudit.signUpFlowSignals.count === 0 &&
        sourceAudit.recoveryFlowSignals.count === 0)) &&
    sourceAudit.authProtectedRedirectSignals.count === 0 &&
    sourceAudit.authSuccessSignals.count === 0
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-success-redirect-missing',
        category: 'Source Audit',
        severity: 'info',
        message:
          'Authentication entry surfaces exist, but the source tree does not show an obvious transition into the protected app after success.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Auth entry signals: ${sourceAudit.authEntrySignals.count}`,
          'Protected auth redirects: 0',
          `Primary routes: ${topology.primaryRoutes.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'After reviewed sign-in, registration, or recovery success, route users into a primary app surface such as `/dashboard`, `/app`, or another protected destination instead of leaving the post-auth transition implicit.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAudit.authCallbackTokenSignals.count > 0 &&
    !sourceAuditBucketsOverlap(
      sourceAudit.authCallbackTokenSignals,
      sourceAudit.authCallbackErrorSignals,
    )
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-callback-error-missing',
        category: 'Source Audit',
        severity: 'info',
        message:
          'Auth callback code appears to read provider return data without an obvious failure state for provider-denied or callback error returns.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Callback token signal files: ${sourceAudit.authCallbackTokenSignals.files.join(', ') || 'none'}`,
          `Callback error-handling signal files: ${sourceAudit.authCallbackErrorSignals.files.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'When reviewed auth callback routes can receive provider error returns, branch on `error` or related callback params and show a reviewed failure state before or alongside the post-auth redirect handling.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAudit.authCallbackStateSignals.count > 0 &&
    !sourceAuditBucketsOverlap(
      sourceAudit.authCallbackStateSignals,
      sourceAudit.authCallbackStateValidationSignals,
    )
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-callback-state-validation-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Auth callback code reads provider `state` on return but does not show an obvious validation step against a reviewed expected value.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Callback state signal files: ${sourceAudit.authCallbackStateSignals.files.join(', ') || 'none'}`,
          `Callback state-validation signal files: ${sourceAudit.authCallbackStateValidationSignals.files.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'When reviewed auth callback routes read a returned `state`, compare it against a stored or expected reviewed value before exchanging callback codes or continuing session setup.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    sourceAudit.authCallbackStateValidationSignals.count > 0 &&
    sourceAudit.authCallbackStateStorageSignals.count > 0 &&
    !sourceAuditBucketsOverlap(
      sourceAudit.authCallbackStateStorageSignals,
      sourceAudit.authCallbackStateStorageClearSignals,
    )
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-callback-state-teardown-missing',
        category: 'Source Audit',
        severity: 'info',
        message:
          'Auth callback code appears to validate stored callback `state` but does not show that the stored state key is cleared afterwards.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Callback state-storage signal files: ${sourceAudit.authCallbackStateStorageSignals.files.join(', ') || 'none'}`,
          `Callback state-clear signal files: ${sourceAudit.authCallbackStateStorageClearSignals.files.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'After validating returned callback `state`, remove the reviewed `oauth_state` or CSRF state key from browser storage or cookies so stale callback state does not linger.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    topology.gatewayRoutes.some((route) => isSignInLikeRoute(route)) &&
    (((sourceAudit.authCallbackTokenSignals.count > 0 ||
      sourceAudit.authCallbackStateSignals.count > 0) &&
      sourceAudit.authCallbackErrorSignals.count > 0 &&
      !sourceAuditBucketsOverlap(
        sourceAudit.authCallbackErrorSignals,
        sourceAudit.signInRouteSignals,
      )) ||
      (sourceAudit.authCallbackExchangeSignals.count > 0 &&
        sourceAudit.authCallbackExchangeErrorSignals.count > 0 &&
        !sourceAuditBucketsOverlap(
          sourceAudit.authCallbackExchangeErrorSignals,
          sourceAudit.signInRouteSignals,
        )))
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-callback-entry-return-missing',
        category: 'Source Audit',
        severity: 'info',
        message:
          'Auth callback failure handling exists, but the source tree does not show an obvious path back to the declared sign-in route.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Callback error-handling signal files: ${sourceAudit.authCallbackErrorSignals.files.join(', ') || 'none'}`,
          `Callback exchange error-handling files: ${sourceAudit.authCallbackExchangeErrorSignals.files.join(', ') || 'none'}`,
          `Sign-in route signal files: ${sourceAudit.signInRouteSignals.files.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'When reviewed callback handling or callback session exchange fails, link or redirect users back to the declared sign-in route, such as `/login` or `/sign-in`, instead of leaving the callback failure state isolated.',
      }),
    );
  }

  if (
    topology.hasAuthFeature &&
    (sourceAudit.authCallbackTokenSignals.count > 0 ||
      sourceAudit.authCallbackErrorSignals.count > 0) &&
    sourceAudit.authCallbackUrlScrubSignals.count === 0
  ) {
    findings.push(
      makeFinding({
        id: 'source-auth-callback-url-scrub-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Auth callback code appears to read tokens, codes, or provider error params from the URL without scrubbing them back out of browser history.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Callback token signal files: ${sourceAudit.authCallbackTokenSignals.files.join(', ') || 'none'}`,
          `Callback error signal files: ${sourceAudit.authCallbackErrorSignals.files.join(', ') || 'none'}`,
          'Callback URL scrub signals: 0',
        ],
        suggestedFix:
          'After consuming auth callback codes, tokens, or provider error params from the URL, replace the callback URL with a clean reviewed route using `history.replaceState`, router replacement, or an explicit internal redirect.',
      }),
    );
  }

  if (sourceAudit.accessibilityIssues.count > 0) {
    findings.push(
      makeFinding({
        id: 'source-accessibility-issues-present',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Source files contain unlabeled or non-semantic interactive patterns that should be fixed before runtime verification.',
        evidence: buildSourceAuditEvidence(
          sourceAudit,
          sourceAudit.accessibilityIssues,
          'Accessibility labeling issues',
        ),
        suggestedFix:
          'Add explicit labels, semantic interactive elements, and missing alt text so accessibility issues do not accumulate across generated screens.',
      }),
    );
  }

  if (essenceRequiresSkipNav(essence) && sourceAudit.skipNavSignals.count === 0) {
    findings.push(
      makeFinding({
        id: 'source-skip-nav-signals-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'The essence contract requires skip navigation, but the source tree does not show a skip-link signal.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          'Skip-nav requirement: true',
          'Skip-nav signals: 0',
        ],
        suggestedFix:
          'Add a visible-on-focus skip link such as `Skip to content` that targets the main app landmark before shipping the accessible surface.',
      }),
    );
  }

  if (essenceRequiresSkipNav(essence) && sourceAudit.mainLandmarkSignals.count === 0) {
    findings.push(
      makeFinding({
        id: 'source-main-landmark-signals-missing',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'The essence contract requires skip navigation, but the source tree does not show a main landmark for skip-link targeting.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          'Skip-nav requirement: true',
          'Main landmark signals: 0',
        ],
        suggestedFix:
          'Add a `<main>` landmark or a container with `role="main"` so skip navigation lands on a clear primary app region.',
      }),
    );
  }

  if (
    essenceRequiresSkipNav(essence) &&
    sourceAudit.skipNavTargetIds.length > 0 &&
    !sourceAudit.skipNavTargetIds.some((targetId) => sourceAudit.mainLandmarkIds.includes(targetId))
  ) {
    findings.push(
      makeFinding({
        id: 'source-skip-nav-target-mismatch',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Skip-link targets do not line up with any detected main landmark id in the source tree.',
        evidence: [
          `Source files checked: ${sourceAudit.filesChecked}`,
          `Skip-nav targets: ${sourceAudit.skipNavTargetIds.join(', ')}`,
          `Main landmark ids: ${sourceAudit.mainLandmarkIds.join(', ') || 'none'}`,
        ],
        suggestedFix:
          'Point skip-link href values at the id of the primary `<main>` landmark, or add a matching id to the existing main region.',
      }),
    );
  }

  if (sourceAudit.interactionSafetyIssues.count > 0) {
    findings.push(
      makeFinding({
        id: 'source-interaction-safety-issues-present',
        category: 'Source Audit',
        severity: 'warn',
        message:
          'Source files contain interaction patterns that can trigger accidental submissions or unsafe form behavior.',
        evidence: buildSourceAuditEvidence(
          sourceAudit,
          sourceAudit.interactionSafetyIssues,
          'Interaction safety issues',
        ),
        suggestedFix:
          'Give form buttons explicit types so interactive controls do exactly what the compiled task contract intends.',
      }),
    );
  }

  if (sourceAudit.authInputHintIssues.count > 0) {
    findings.push(
      makeFinding({
        id: 'source-auth-input-hints-missing',
        category: 'Source Audit',
        severity: 'info',
        message: 'Source auth flows are missing explicit autocomplete hints on credential inputs.',
        evidence: buildSourceAuditEvidence(
          sourceAudit,
          sourceAudit.authInputHintIssues,
          'Missing auth autocomplete hints',
        ),
        suggestedFix:
          'Add explicit autocomplete values such as `email`, `username`, `current-password`, or `new-password` before auth flows ship.',
      }),
    );
  }
}

function appendStyleContractFindings(
  findings: VerificationFinding[],
  styleAudit: StyleAuditSummary,
  essence: EssenceFile | null,
): void {
  if (essenceRequiresFocusVisible(essence) && styleAudit.focusVisibleSignals.count === 0) {
    findings.push(
      makeFinding({
        id: 'style-focus-visible-signals-missing',
        category: 'Style Contract',
        severity: 'warn',
        message:
          'The essence contract requires visible focus treatment, but the project styles do not show a focus-visible signal.',
        evidence: [
          `Style files checked: ${styleAudit.filesChecked}`,
          'Focus-visible requirement: true',
          'Focus-visible signals: 0',
        ],
        suggestedFix:
          'Add a clear `:focus-visible` treatment in the project CSS so keyboard focus remains visible across interactive surfaces.',
      }),
    );
  }

  if (essenceRequiresReducedMotion(essence) && styleAudit.reducedMotionSignals.count === 0) {
    findings.push(
      makeFinding({
        id: 'style-reduced-motion-signals-missing',
        category: 'Style Contract',
        severity: 'info',
        message:
          'The essence contract requires reduced-motion support, but the project styles do not show a reduced-motion signal.',
        evidence: [
          `Style files checked: ${styleAudit.filesChecked}`,
          'Reduced-motion requirement: true',
          'Reduced-motion signals: 0',
        ],
        suggestedFix:
          'Add a `prefers-reduced-motion: reduce` style path or an equivalent reviewed reduce-motion contract so motion-heavy surfaces can soften or disable non-essential animation.',
      }),
    );
  }
}

export async function auditProject(projectRoot: string): Promise<ProjectAuditReport> {
  const essencePath = join(projectRoot, 'decantr.essence.json');
  const findings: VerificationFinding[] = [];
  const reviewPack = loadReviewPack(projectRoot);
  const packManifest = loadPackManifest(projectRoot);
  const adoptionMode = readProjectAdoptionMode(projectRoot);
  const packHydrationOptional =
    adoptionMode === 'contract-only' || adoptionMode === 'style-bridge';
  const packHydrationSeverity: VerificationSeverity = packHydrationOptional ? 'info' : 'warn';
  const runtimeAudit = emptyRuntimeAudit();

  if (!existsSync(essencePath)) {
    findings.push(
      makeFinding({
        id: 'essence-missing',
        category: 'Project Contract',
        severity: 'error',
        message: 'No decantr.essence.json file was found.',
        evidence: [essencePath],
        suggestedFix: 'Run `decantr init` or scaffold the project again so the essence exists.',
      }),
    );

    return {
      $schema: VERIFICATION_SCHEMA_URLS.projectAudit,
      projectRoot,
      valid: false,
      essence: null,
      reviewPack,
      packManifest,
      runtimeAudit,
      findings,
      summary: {
        errorCount: 1,
        warnCount: 0,
        infoCount: 0,
        essenceVersion: null,
        reviewPackPresent: Boolean(reviewPack),
        packManifestPresent: Boolean(packManifest),
        runtimeAuditChecked: false,
        runtimePassed: null,
        pageCount: 0,
      },
    };
  }

  let essence: EssenceFile | null = null;
  try {
    essence = JSON.parse(readFileSync(essencePath, 'utf-8')) as EssenceFile;
  } catch (error) {
    findings.push(
      makeFinding({
        id: 'essence-parse-error',
        category: 'Project Contract',
        severity: 'error',
        message: `Failed to parse decantr.essence.json: ${(error as Error).message}`,
        evidence: [essencePath],
        suggestedFix: 'Repair the essence JSON before auditing the project.',
      }),
    );
  }

  if (essence) {
    const validation = validateEssence(essence);
    if (!validation.valid) {
      for (const issue of validation.errors) {
        findings.push(
          makeFinding({
            id: 'essence-validation',
            category: 'Schema Validation',
            severity: 'error',
            message: issue,
            evidence: [essencePath],
            suggestedFix: 'Resolve the schema violation and rerun `decantr validate`.',
          }),
        );
      }
    } else {
      const { themeRegistry, patternRegistry } = buildRegistryContext(projectRoot);
      for (const violation of evaluateGuard(essence, { themeRegistry, patternRegistry })) {
        findings.push(guardViolationToFinding(violation));
      }
    }
  }

  appendTopologyFindings(findings, essence, reviewPack);

  if (!packManifest) {
    findings.push(
      makeFinding({
        id: 'pack-manifest-missing',
        category: 'Execution Packs',
        severity: packHydrationSeverity,
        message: packHydrationOptional
          ? 'Compiled execution pack manifest is not hydrated yet; this is optional for contract-only/style-bridge Brownfield adoption.'
          : 'Compiled execution pack manifest is missing.',
        evidence: [join(projectRoot, '.decantr', 'context', 'pack-manifest.json')],
        suggestedFix: packHydrationOptional
          ? 'Optional: run `decantr registry compile-packs decantr.essence.json --write-context` when you want hosted page packs and review packs for richer assistant context.'
          : 'Run `decantr registry compile-packs decantr.essence.json --write-context` to hydrate scaffold, review, mutation, section, and page packs.',
      }),
    );
  } else {
    const missingPackFiles = collectMissingPackManifestFiles(projectRoot, packManifest);
    if (missingPackFiles.length > 0) {
      findings.push(
        makeFinding({
          id: 'pack-manifest-referenced-files-missing',
          category: 'Execution Packs',
          severity: 'warn',
          message: 'The compiled execution pack manifest references files that are missing.',
          evidence: missingPackFiles
            .slice(0, 12)
            .map(
              (missing) =>
                `${missing.kind}:${missing.entryId}:${missing.field} -> ${missing.relativePath}`,
            ),
          suggestedFix:
            'Regenerate or hydrate the full execution pack bundle so every file named by pack-manifest.json exists beside it.',
        }),
      );
    }
    if (!packManifest.scaffold) {
      findings.push(
        makeFinding({
          id: 'scaffold-pack-missing',
          category: 'Execution Packs',
          severity: 'warn',
          message: 'Compiled scaffold pack is missing from the manifest.',
          evidence: ['pack-manifest.json'],
          suggestedFix: 'Regenerate the context bundle with `decantr refresh`.',
        }),
      );
    }
    if (!packManifest.review) {
      findings.push(
        makeFinding({
          id: 'review-pack-missing',
          category: 'Execution Packs',
          severity: 'warn',
          message: 'Compiled review pack is missing from the manifest.',
          evidence: ['pack-manifest.json'],
          suggestedFix:
            'Regenerate the context bundle so critique tasks have a compiled review contract.',
        }),
      );
    }
    if ((packManifest.mutations ?? []).length === 0) {
      findings.push(
        makeFinding({
          id: 'mutation-packs-missing',
          category: 'Execution Packs',
          severity: 'info',
          message: 'No mutation packs were found in the manifest.',
          evidence: ['pack-manifest.json'],
          suggestedFix:
            'Run `decantr registry compile-packs decantr.essence.json --write-context` to hydrate mutation task packs.',
        }),
      );
    }
  }

  if (!reviewPack) {
    findings.push(
      makeFinding({
        id: 'review-pack-file-missing',
        category: 'Review Contract',
        severity: packHydrationSeverity,
        message: packHydrationOptional
          ? 'The compiled review pack file is not hydrated yet; contract-only/style-bridge Brownfield projects can continue without it.'
          : 'The compiled review pack file is missing.',
        evidence: [join(projectRoot, '.decantr', 'context', 'review-pack.json')],
        suggestedFix: packHydrationOptional
          ? 'Optional: hydrate hosted packs later if you want critique consumers to anchor findings to the compiled review contract.'
          : 'Hydrate the full hosted context bundle with `decantr registry compile-packs decantr.essence.json --write-context` so critique consumers can anchor findings to the compiled review contract.',
      }),
    );
  }

  const sourceAudit = auditProjectSourceTree(projectRoot);
  const styleAudit = auditProjectStyleContracts(projectRoot);
  const checkedRuntimeAudit = await runRuntimeAudit(projectRoot, essence);
  appendRuntimeAuditFindings(
    findings,
    checkedRuntimeAudit,
    projectRoot,
    summarizeTopology(essence, reviewPack),
    sourceAudit,
  );
  appendSourceAuditFindings(findings, sourceAudit, essence, reviewPack, adoptionMode);
  appendStyleContractFindings(findings, styleAudit, essence);

  const summary = {
    errorCount: findings.filter((finding) => finding.severity === 'error').length,
    warnCount: findings.filter((finding) => finding.severity === 'warn').length,
    infoCount: findings.filter((finding) => finding.severity === 'info').length,
    essenceVersion: essence ? String(essence.version) : null,
    reviewPackPresent: Boolean(reviewPack),
    packManifestPresent: Boolean(packManifest),
    runtimeAuditChecked: checkedRuntimeAudit.checked,
    runtimePassed: checkedRuntimeAudit.passed,
    pageCount: countPages(essence),
  };

  return {
    $schema: VERIFICATION_SCHEMA_URLS.projectAudit,
    projectRoot,
    valid: summary.errorCount === 0,
    essence,
    reviewPack,
    packManifest,
    runtimeAudit: checkedRuntimeAudit,
    findings,
    summary,
  };
}

function buildDecoratorInventory(treatmentsCss: string): string[] {
  const decoratorNames = new Set<string>();

  for (
    let index = treatmentsCss.indexOf('.');
    index !== -1;
    index = treatmentsCss.indexOf('.', index + 1)
  ) {
    let cursor = index + 1;
    while (cursor < treatmentsCss.length && isCssClassNameChar(treatmentsCss[cursor]!)) {
      cursor += 1;
    }
    if (cursor === index + 1) continue;

    const name = treatmentsCss.slice(index + 1, cursor);
    let whitespaceCursor = cursor;
    while (
      whitespaceCursor < treatmentsCss.length &&
      whitespaceCursor - cursor <= 64 &&
      isCssWhitespace(treatmentsCss[whitespaceCursor]!)
    ) {
      whitespaceCursor += 1;
    }

    if (treatmentsCss[whitespaceCursor] === '{') {
      decoratorNames.add(name);
    }
  }

  return [...decoratorNames].filter(
    (name) => !name.startsWith('d-') && !PERSONALITY_UTILS.includes(name),
  );
}

function isCssClassNameChar(char: string): boolean {
  const codePoint = char.charCodeAt(0);
  return (
    char === '_' ||
    char === '-' ||
    (codePoint >= 48 && codePoint <= 57) ||
    (codePoint >= 65 && codePoint <= 90) ||
    (codePoint >= 97 && codePoint <= 122)
  );
}

function isCssWhitespace(char: string): boolean {
  return char === ' ' || char === '\t' || char === '\n' || char === '\r' || char === '\f';
}

function resolveFocusAreas(reviewPack: ReviewExecutionPack | null): string[] {
  return reviewPack?.data?.focusAreas?.length ? reviewPack.data.focusAreas : DEFAULT_FOCUS_AREAS;
}

function resolveSeverityFromChecks(
  reviewPack: ReviewExecutionPack | null,
  fallback: VerificationSeverity,
  checkIds: string[],
): VerificationSeverity {
  const match = reviewPack?.successChecks?.find((check) => checkIds.includes(check.id));
  return match?.severity ?? fallback;
}

function findHardcodedColors(code: string): string[] {
  const matches = [
    ...findHexColors(code),
    ...findColorFunctionCalls(code, 'rgb('),
    ...findColorFunctionCalls(code, 'rgba('),
    ...findColorFunctionCalls(code, 'hsl('),
    ...findColorFunctionCalls(code, 'hsla('),
  ];
  return [...new Set(matches)];
}

function findHexColors(code: string): string[] {
  const matches: string[] = [];

  for (let index = 0; index < code.length; index += 1) {
    if (code[index] !== '#') continue;

    let cursor = index + 1;
    while (cursor < code.length && cursor - index <= 8 && isHexDigit(code[cursor]!)) {
      cursor += 1;
    }

    const length = cursor - index - 1;
    if (length >= 3 && length <= 8 && !isHexDigit(code[cursor] ?? '')) {
      matches.push(code.slice(index, cursor));
    }
  }

  return matches;
}

function findColorFunctionCalls(code: string, functionName: string): string[] {
  const matches: string[] = [];
  const lowerCode = code.toLowerCase();

  for (
    let index = lowerCode.indexOf(functionName);
    index !== -1;
    index = lowerCode.indexOf(functionName, index + functionName.length)
  ) {
    let cursor = index + functionName.length;
    const maxCursor = Math.min(code.length, cursor + 256);
    while (
      cursor < maxCursor &&
      code[cursor] !== ')' &&
      code[cursor] !== '\n' &&
      code[cursor] !== '\r'
    ) {
      cursor += 1;
    }
    if (code[cursor] === ')') {
      matches.push(code.slice(index, cursor + 1));
    }
  }

  return matches;
}

function isHexDigit(char: string): boolean {
  const codePoint = char.charCodeAt(0);
  return (
    (codePoint >= 48 && codePoint <= 57) ||
    (codePoint >= 65 && codePoint <= 70) ||
    (codePoint >= 97 && codePoint <= 102)
  );
}

function findUtilityFrameworkSignals(code: string): string[] {
  const matches =
    code.match(
      /\b(?:bg|text|border|shadow|rounded|px|py|mx|my|gap|grid-cols|col-span|row-span|sm|md|lg|xl|hover):[-\w/.[\]]+/g,
    ) ?? [];
  return [...new Set(matches)];
}

function countComponentStyleTagSignals(code: string): number {
  const jsxStyleTags = code.match(/<style(?:\s|>)/gi)?.length ?? 0;
  const dynamicStyleElements = code.match(/document\.createElement\((['"])style\1\)/g)?.length ?? 0;
  return jsxStyleTags + dynamicStyleElements;
}

function countCommandPaletteSignals(code: string): number {
  const matches =
    code.match(
      /\b(?:commandpalette|command palette|cmd\+k|⌘k|openCommandPalette|setCommandPaletteOpen|paletteOpen|paletteTrigger)\b/gi,
    ) ?? [];
  return matches.length;
}

function countKeyboardShortcutSignals(code: string): number {
  const matches =
    code.match(/\b(?:keydown|keyup|metaKey|ctrlKey|altKey|shiftKey|hotkey|shortcut)\b/gi) ?? [];
  return matches.length;
}

interface AstCritiqueSignals {
  inlineStyleAttributeCount: number;
  dangerousHtmlCount: number;
  rawHtmlInjectionCount: number;
  dynamicEvalCount: number;
  hardcodedSecretSignalCount: number;
  clientSecretEnvReferenceCount: number;
  localhostEndpointCount: number;
  wildcardPostMessageCount: number;
  windowOpenWithoutNoopenerCount: number;
  messageListenerWithoutOriginCheckCount: number;
  externalIframeWithoutSandboxCount: number;
  insecureExternalIframeCount: number;
  insecureFormActionCount: number;
  insecureAuthFormMethodCount: number;
  insecureTransportEndpointCount: number;
  iconOnlyButtonWithoutLabelCount: number;
  iconOnlyLinkWithoutLabelCount: number;
  clickableNonSemanticCount: number;
  imageWithoutAltCount: number;
  insecureExternalImageCount: number;
  iframeWithoutTitleCount: number;
  dialogWithoutLabelCount: number;
  dialogWithoutModalHintCount: number;
  tableWithoutHeaderCount: number;
  tableWithoutCaptionCount: number;
  unlabeledNavigationLandmarkCount: number;
  multipleMainLandmarkCount: number;
  externalBlankLinkWithoutRelCount: number;
  formControlWithoutLabelCount: number;
  placeholderNavigationTargetCount: number;
  protectedSurfaceSignalCount: number;
  skipNavSignalCount: number;
  skipNavTargetIds: string[];
  mainLandmarkCount: number;
  mainLandmarkIds: string[];
  emailAutocompleteMissingCount: number;
  passwordAutocompleteMissingCount: number;
  otpAutocompleteMissingCount: number;
  authAutocompleteDisabledCount: number;
  authAutocompleteSemanticMismatchCount: number;
  authInputTypeMismatchCount: number;
  authInputWithoutNameCount: number;
  buttonInFormWithoutTypeCount: number;
  authFormWithoutSubmitCount: number;
  authEntrySignalCount: number;
  authSessionSignalCount: number;
  authLoadingSignalCount: number;
  authProtectedLoadingRenderCount: number;
  authBlankLoadingRenderCount: number;
  authAnonymousLoadingRedirectCount: number;
  authProtectedUnauthenticatedRenderCount: number;
  authProtectedRedirectSignalCount: number;
  authAnonymousRedirectSignalCount: number;
  authOpenRedirectSignalCount: number;
  authExternalRedirectSignalCount: number;
  authProviderStateMissingCount: number;
  authProviderPkceMissingCount: number;
  authProviderNonceMissingCount: number;
  authStorageWriteCount: number;
  authStorageClearCount: number;
  authCookieWriteCount: number;
  authCookieClearCount: number;
  authCookieMissingHardeningCount: number;
  authHeaderWriteCount: number;
  authHeaderClearCount: number;
  authCacheClientCount: number;
  authCacheClearCount: number;
  authRefreshSignalCount: number;
  authRefreshClearCount: number;
  authGuardSignalCount: number;
  authExitSignalCount: number;
  authSessionTeardownSignalCount: number;
}

function getScriptKind(filePath: string): ts.ScriptKind {
  switch (extname(filePath).toLowerCase()) {
    case '.tsx':
      return ts.ScriptKind.TSX;
    case '.jsx':
      return ts.ScriptKind.JSX;
    case '.ts':
      return ts.ScriptKind.TS;
    case '.js':
      return ts.ScriptKind.JS;
    default:
      return ts.ScriptKind.TSX;
  }
}

function isPropertyNamed(node: ts.Node | undefined, ...names: string[]): boolean {
  if (!node) return false;
  if (ts.isIdentifier(node)) {
    return names.includes(node.text);
  }
  if (ts.isPrivateIdentifier(node)) {
    return names.includes(node.text);
  }
  if (ts.isStringLiteral(node)) {
    return names.includes(node.text);
  }
  return false;
}

function getJsxAttribute(
  attributes: ts.JsxAttributes,
  ...names: string[]
): ts.JsxAttribute | undefined {
  return attributes.properties.find(
    (property): property is ts.JsxAttribute =>
      ts.isJsxAttribute(property) && isPropertyNamed(property.name, ...names),
  );
}

function getJsxTagName(node: ts.JsxOpeningLikeElement): string | null {
  if (ts.isIdentifier(node.tagName)) {
    return node.tagName.text;
  }
  if (ts.isPropertyAccessExpression(node.tagName)) {
    return node.tagName.name.text;
  }
  return null;
}

function getJsxAttributeLiteralValue(attribute: ts.JsxAttribute | undefined): string | null {
  if (!attribute?.initializer) return null;
  if (ts.isStringLiteral(attribute.initializer)) {
    return attribute.initializer.text;
  }
  if (ts.isJsxExpression(attribute.initializer)) {
    const expression = attribute.initializer.expression;
    if (!expression) return '';
    if (ts.isStringLiteral(expression) || ts.isNoSubstitutionTemplateLiteral(expression)) {
      return expression.text;
    }
  }
  return null;
}

function getJsxTextContent(node: ts.Node): string {
  if (ts.isJsxText(node)) {
    return node.getText();
  }
  if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) {
    return node.text;
  }
  if (ts.isJsxExpression(node)) {
    return node.expression ? getJsxTextContent(node.expression) : '';
  }
  if (ts.isJsxSelfClosingElement(node) || ts.isJsxOpeningElement(node)) {
    return '';
  }
  if (ts.isJsxElement(node) || ts.isJsxFragment(node)) {
    return node.children.map((child) => getJsxTextContent(child)).join('');
  }

  let text = '';
  node.forEachChild((child) => {
    text += getJsxTextContent(child);
  });
  return text;
}

function hasAccessibleLabel(attributes: ts.JsxAttributes, textContent: string): boolean {
  return Boolean(
    getJsxAttribute(attributes, 'aria-label', 'aria-labelledby', 'title') ||
      textContent.trim().length > 0,
  );
}

function isNonSemanticInteractiveTag(tagName: string | null): boolean {
  return ['div', 'span', 'section', 'article', 'li'].includes(tagName ?? '');
}

function collectLabelForIds(root: ts.Node): Set<string> {
  const ids = new Set<string>();

  const walk = (node: ts.Node) => {
    if (ts.isJsxSelfClosingElement(node) || ts.isJsxOpeningElement(node)) {
      const tagName = getJsxTagName(node);
      if (tagName === 'label') {
        const htmlForValue = getJsxAttributeLiteralValue(
          getJsxAttribute(node.attributes, 'htmlFor', 'for'),
        );
        if (htmlForValue) {
          ids.add(htmlForValue);
        }
      }
    }

    ts.forEachChild(node, walk);
  };

  walk(root);
  return ids;
}

function isWrappedInJsxLabel(node: ts.Node): boolean {
  let current: ts.Node | undefined = node.parent;
  while (current) {
    if (ts.isJsxElement(current) && getJsxTagName(current.openingElement) === 'label') {
      return true;
    }
    current = current.parent;
  }
  return false;
}

function hasAncestorJsxTag(node: ts.Node, tagName: string): boolean {
  let current: ts.Node | undefined = node.parent;
  while (current) {
    if (ts.isJsxElement(current) && getJsxTagName(current.openingElement) === tagName) {
      return true;
    }
    current = current.parent;
  }
  return false;
}

function isLabelableFormControl(tagName: string | null, attributes: ts.JsxAttributes): boolean {
  if (!tagName) return false;
  if (tagName === 'select' || tagName === 'textarea') return true;
  if (tagName !== 'input') return false;

  const inputType = (
    getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'type')) ?? 'text'
  ).toLowerCase();
  return !['hidden', 'submit', 'reset', 'button'].includes(inputType);
}

function getNormalizedInputType(attributes: ts.JsxAttributes): string {
  return (getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'type')) ?? 'text')
    .trim()
    .toLowerCase();
}

function hasFormControlLabel(
  node: ts.Node,
  tagName: string | null,
  attributes: ts.JsxAttributes,
  labelForIds: Set<string>,
  textContent: string,
): boolean {
  if (!isLabelableFormControl(tagName, attributes)) return true;
  if (hasAccessibleLabel(attributes, textContent)) return true;
  if (isWrappedInJsxLabel(node)) return true;

  const idValue = getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'id'));
  return Boolean(idValue && labelForIds.has(idValue));
}

function isExternalLinkTargetBlankWithoutRel(attributes: ts.JsxAttributes): boolean {
  const targetValue = getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'target'));
  if (targetValue !== '_blank') return false;

  const hrefValue = getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'href', 'to'));
  if (!hrefValue || !/^(?:https?:)?\/\//i.test(hrefValue)) return false;

  const relValue = getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'rel')) ?? '';
  return !/\bnoopener\b/i.test(relValue) || !/\bnoreferrer\b/i.test(relValue);
}

function isLinkLikeTag(tagName: string | null): boolean {
  return tagName === 'a' || tagName === 'Link' || tagName === 'NavLink';
}

function valueContainsInsecureRemoteAsset(value: string | null): boolean {
  if (!value) return false;
  return value
    .split(',')
    .map((candidate) => candidate.trim().split(/\s+/)[0] ?? '')
    .some((candidate) => /^http:\/\//i.test(candidate));
}

function isInsecureExternalImage(attributes: ts.JsxAttributes): boolean {
  const srcValue = getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'src'));
  const srcSetValue = getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'srcSet', 'srcset'));
  return (
    valueContainsInsecureRemoteAsset(srcValue) || valueContainsInsecureRemoteAsset(srcSetValue)
  );
}

function isInsecureExternalUrl(value: string | null): boolean {
  return /^http:\/\//i.test(value?.trim() ?? '');
}

function isImageLikeTag(tagName: string | null): boolean {
  return tagName === 'img' || tagName === 'Image';
}

function isImageSourceLikeTag(tagName: string | null): boolean {
  return isImageLikeTag(tagName) || tagName === 'source';
}

function isDialogLikeElement(attributes: ts.JsxAttributes, tagName: string | null): boolean {
  if (tagName === 'dialog') return true;
  const roleValue = getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'role'))
    ?.trim()
    .toLowerCase();
  return roleValue === 'dialog' || roleValue === 'alertdialog';
}

function hasDialogLabel(attributes: ts.JsxAttributes): boolean {
  return Boolean(getJsxAttribute(attributes, 'aria-label', 'aria-labelledby', 'title'));
}

function hasDialogModalHint(attributes: ts.JsxAttributes, tagName: string | null): boolean {
  if (tagName === 'dialog' && getJsxAttribute(attributes, 'open')) {
    return true;
  }
  const modalValue = getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'aria-modal'))
    ?.trim()
    .toLowerCase();
  return modalValue === 'true';
}

function isNavigationLandmark(tagName: string | null, attributes: ts.JsxAttributes): boolean {
  if (tagName === 'nav') return true;
  const roleValue = getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'role'))
    ?.trim()
    .toLowerCase();
  return roleValue === 'navigation';
}

function hasNavigationLabel(attributes: ts.JsxAttributes): boolean {
  return Boolean(getJsxAttribute(attributes, 'aria-label', 'aria-labelledby', 'title'));
}

function getJsxAttributeOwner(
  attribute: ts.JsxAttribute,
): ts.JsxOpeningElement | ts.JsxSelfClosingElement | null {
  const attributes = attribute.parent;
  if (!attributes || !ts.isJsxAttributes(attributes)) return null;
  const owner = attributes.parent;
  if (ts.isJsxOpeningElement(owner) || ts.isJsxSelfClosingElement(owner)) {
    return owner;
  }
  return null;
}

function isSafeJsonLdDangerouslySetInnerHtml(attribute: ts.JsxAttribute): boolean {
  const owner = getJsxAttributeOwner(attribute);
  if (!owner || getJsxTagName(owner) !== 'script') return false;

  const typeValue = getJsxAttributeLiteralValue(getJsxAttribute(owner.attributes, 'type'))
    ?.trim()
    .toLowerCase();
  if (typeValue !== 'application/ld+json') return false;

  const sourceText = attribute.getText();
  return /\bJSON\.stringify\s*\(/.test(sourceText) && /\\u003c/i.test(sourceText);
}

function hasInsecureFormAction(attributes: ts.JsxAttributes): boolean {
  const actionValue = getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'action'));
  const normalized = actionValue?.trim().toLowerCase() ?? '';
  return (
    /^http:\/\//i.test(normalized) ||
    /^javascript:/i.test(normalized) ||
    /^mailto:/i.test(normalized) ||
    /^data:/i.test(normalized)
  );
}

function isAuthLikeInputAttributes(attributes: ts.JsxAttributes): boolean {
  const inputType = getNormalizedInputType(attributes);
  if (inputType === 'email' || inputType === 'password') {
    return true;
  }

  const autocompleteValue = getJsxAttributeLiteralValue(
    getJsxAttribute(attributes, 'autocomplete', 'autoComplete'),
  )
    ?.trim()
    .toLowerCase();
  return (
    ['email', 'username', 'current-password', 'new-password', 'one-time-code'].includes(
      autocompleteValue ?? '',
    ) || isOtpLikeInputAttributes(attributes)
  );
}

function getInputIdentityText(attributes: ts.JsxAttributes): string {
  return [
    getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'name')),
    getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'id')),
    getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'placeholder')),
    getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'aria-label')),
    getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'autocomplete', 'autoComplete')),
  ]
    .filter((value): value is string => Boolean(value))
    .join(' ')
    .toLowerCase();
}

function isOtpLikeInputAttributes(attributes: ts.JsxAttributes): boolean {
  const identityText = getInputIdentityText(attributes);
  if (!identityText) return false;
  return /(?:one[- ]time|otp|verification(?:[-_ ]?code)?|authenticator|2fa|mfa|totp|passcode)/i.test(
    identityText,
  );
}

function hasOtpAutocompleteIssue(attributes: ts.JsxAttributes): boolean {
  if (!isOtpLikeInputAttributes(attributes)) return false;
  const autocompleteValue = getJsxAttributeLiteralValue(
    getJsxAttribute(attributes, 'autocomplete', 'autoComplete'),
  )
    ?.trim()
    .toLowerCase();
  return autocompleteValue !== 'one-time-code';
}

function hasAuthInputTypeMismatch(attributes: ts.JsxAttributes): boolean {
  const inputType = getNormalizedInputType(attributes);
  const autocompleteValue = getJsxAttributeLiteralValue(
    getJsxAttribute(attributes, 'autocomplete', 'autoComplete'),
  )
    ?.trim()
    .toLowerCase();
  const nameValue = getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'name'))
    ?.trim()
    .toLowerCase();

  const looksLikePasswordField =
    autocompleteValue === 'current-password' ||
    autocompleteValue === 'new-password' ||
    /password|passcode|pin/.test(nameValue ?? '');
  if (looksLikePasswordField && inputType !== 'password') {
    return true;
  }

  const looksLikeEmailField =
    autocompleteValue === 'email' || /(?:^|[-_])(email|e-mail)(?:$|[-_])/.test(nameValue ?? '');
  if (looksLikeEmailField && inputType !== 'email') {
    return true;
  }

  return false;
}

function hasAuthAutocompleteSemanticMismatch(attributes: ts.JsxAttributes): boolean {
  const inputType = getNormalizedInputType(attributes);
  const autocompleteValue = getJsxAttributeLiteralValue(
    getJsxAttribute(attributes, 'autocomplete', 'autoComplete'),
  )
    ?.trim()
    .toLowerCase();

  if (!autocompleteValue) return false;

  if (inputType === 'password') {
    return !['current-password', 'new-password'].includes(autocompleteValue);
  }

  if (inputType === 'email') {
    return !['email', 'username'].includes(autocompleteValue);
  }

  return false;
}

function jsxTreeContainsAuthInput(node: ts.Node): boolean {
  let found = false;

  const visit = (current: ts.Node): void => {
    if (found) return;

    if (ts.isJsxSelfClosingElement(current)) {
      const tagName = getJsxTagName(current);
      if (tagName === 'input' && isAuthLikeInputAttributes(current.attributes)) {
        found = true;
      }
      return;
    }

    if (ts.isJsxElement(current)) {
      const tagName = getJsxTagName(current.openingElement);
      if (tagName === 'input' && isAuthLikeInputAttributes(current.openingElement.attributes)) {
        found = true;
        return;
      }
      for (const child of current.children) {
        visit(child);
        if (found) return;
      }
      return;
    }

    if (ts.isJsxFragment(current)) {
      for (const child of current.children) {
        visit(child);
        if (found) return;
      }
      return;
    }

    current.forEachChild(visit);
  };

  visit(node);
  return found;
}

function hasInsecureAuthFormMethod(node: ts.JsxElement): boolean {
  if (!jsxTreeContainsAuthInput(node)) return false;
  const methodValue = getJsxAttributeLiteralValue(
    getJsxAttribute(node.openingElement.attributes, 'method'),
  );
  if (!methodValue) return true;
  return methodValue.trim().toLowerCase() === 'get';
}

function jsxTreeHasSubmitControl(node: ts.Node): boolean {
  let found = false;

  const visit = (current: ts.Node): void => {
    if (found) return;

    if (ts.isJsxSelfClosingElement(current)) {
      const tagName = getJsxTagName(current);
      if (tagName === 'button') {
        const typeValue = getJsxAttributeLiteralValue(getJsxAttribute(current.attributes, 'type'))
          ?.trim()
          .toLowerCase();
        if (!typeValue || typeValue === 'submit') {
          found = true;
        }
      }
      if (tagName === 'input') {
        const inputType = getNormalizedInputType(current.attributes);
        if (inputType === 'submit') {
          found = true;
        }
      }
      return;
    }

    if (ts.isJsxElement(current)) {
      const tagName = getJsxTagName(current.openingElement);
      if (tagName === 'button') {
        const typeValue = getJsxAttributeLiteralValue(
          getJsxAttribute(current.openingElement.attributes, 'type'),
        )
          ?.trim()
          .toLowerCase();
        if (!typeValue || typeValue === 'submit') {
          found = true;
          return;
        }
      }
      if (tagName === 'input') {
        const inputType = getNormalizedInputType(current.openingElement.attributes);
        if (inputType === 'submit') {
          found = true;
          return;
        }
      }
      for (const child of current.children) {
        visit(child);
        if (found) return;
      }
      return;
    }

    if (ts.isJsxFragment(current)) {
      for (const child of current.children) {
        visit(child);
        if (found) return;
      }
      return;
    }

    current.forEachChild(visit);
  };

  visit(node);
  return found;
}

function jsxTreeHasTag(node: ts.Node, tagNames: string[]): boolean {
  let found = false;
  const wanted = new Set(tagNames);

  const visit = (current: ts.Node): void => {
    if (found) return;

    if (ts.isJsxSelfClosingElement(current)) {
      const tagName = getJsxTagName(current);
      if (tagName && wanted.has(tagName)) {
        found = true;
      }
      return;
    }

    if (ts.isJsxElement(current)) {
      const tagName = getJsxTagName(current.openingElement);
      if (tagName && wanted.has(tagName)) {
        found = true;
        return;
      }
      for (const child of current.children) {
        visit(child);
        if (found) return;
      }
      return;
    }

    if (ts.isJsxFragment(current)) {
      for (const child of current.children) {
        visit(child);
        if (found) return;
      }
      return;
    }

    current.forEachChild(visit);
  };

  visit(node);
  return found;
}

function hasAuthFormWithoutSubmitControl(node: ts.JsxElement): boolean {
  return jsxTreeContainsAuthInput(node) && !jsxTreeHasSubmitControl(node);
}

function getExpressionLiteralValue(expression: ts.Expression | undefined): string | null {
  if (!expression) return null;
  if (ts.isStringLiteral(expression) || ts.isNoSubstitutionTemplateLiteral(expression)) {
    return expression.text;
  }
  if (ts.isParenthesizedExpression(expression)) {
    return getExpressionLiteralValue(expression.expression);
  }
  if (ts.isAsExpression(expression) || ts.isTypeAssertionExpression(expression)) {
    return getExpressionLiteralValue(expression.expression);
  }
  return null;
}

function getObjectLiteralStringPropertyValue(
  expression: ts.Expression | undefined,
  ...propertyNames: string[]
): string | null {
  if (!expression || !ts.isObjectLiteralExpression(expression)) return null;
  for (const property of expression.properties) {
    if (!ts.isPropertyAssignment(property)) continue;
    const propertyName = ts.isIdentifier(property.name)
      ? property.name.text
      : ts.isStringLiteral(property.name)
        ? property.name.text
        : null;
    if (!propertyName || !propertyNames.includes(propertyName)) continue;
    const value = getExpressionLiteralValue(property.initializer);
    if (value) return value;
  }
  return null;
}

function getObjectLiteralBooleanPropertyValue(
  expression: ts.Expression | undefined,
  ...propertyNames: string[]
): boolean | null {
  if (!expression || !ts.isObjectLiteralExpression(expression)) return null;
  for (const property of expression.properties) {
    if (!ts.isPropertyAssignment(property)) continue;
    const propertyName = ts.isIdentifier(property.name)
      ? property.name.text
      : ts.isStringLiteral(property.name)
        ? property.name.text
        : null;
    if (!propertyName || !propertyNames.includes(propertyName)) continue;
    if (property.initializer.kind === ts.SyntaxKind.TrueKeyword) return true;
    if (property.initializer.kind === ts.SyntaxKind.FalseKeyword) return false;
  }
  return null;
}

function collectNamedFunctionLikeDeclarations(
  root: ts.Node,
): Map<string, ts.FunctionLikeDeclarationBase> {
  const declarations = new Map<string, ts.FunctionLikeDeclarationBase>();

  const visit = (node: ts.Node): void => {
    if (ts.isFunctionDeclaration(node) && node.name && ts.isIdentifier(node.name)) {
      declarations.set(node.name.text, node);
    }

    if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer) {
      if (ts.isArrowFunction(node.initializer) || ts.isFunctionExpression(node.initializer)) {
        declarations.set(node.name.text, node.initializer);
      }
    }

    node.forEachChild(visit);
  };

  visit(root);
  return declarations;
}

const namedFunctionLikeDeclarationCache = new WeakMap<
  ts.SourceFile,
  Map<string, ts.FunctionLikeDeclarationBase>
>();

function getCachedNamedFunctionLikeDeclarations(
  sourceFile: ts.SourceFile,
): Map<string, ts.FunctionLikeDeclarationBase> {
  const cached = namedFunctionLikeDeclarationCache.get(sourceFile);
  if (cached) return cached;
  const declarations = collectNamedFunctionLikeDeclarations(sourceFile);
  namedFunctionLikeDeclarationCache.set(sourceFile, declarations);
  return declarations;
}

function collectNamedExpressionInitializers(root: ts.Node): Map<string, ts.Expression> {
  const initializers = new Map<string, ts.Expression>();

  const visit = (node: ts.Node): void => {
    if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer) {
      initializers.set(node.name.text, node.initializer);
    }

    if (ts.isVariableDeclaration(node) && ts.isArrayBindingPattern(node.name) && node.initializer) {
      const firstElement = node.name.elements[0];
      if (
        firstElement &&
        !ts.isOmittedExpression(firstElement) &&
        ts.isBindingElement(firstElement) &&
        ts.isIdentifier(firstElement.name)
      ) {
        initializers.set(firstElement.name.text, node.initializer);
      }
    }

    node.forEachChild(visit);
  };

  visit(root);
  return initializers;
}

interface NamedPropertyAlias {
  initializer?: ts.Expression;
  propertyName: string;
  propertyPath: string[];
}

function getPropertyNameText(name: ts.PropertyName | ts.BindingName | undefined): string | null {
  if (!name) return null;
  if (ts.isIdentifier(name) || ts.isStringLiteral(name) || ts.isNumericLiteral(name)) {
    return name.text;
  }
  return null;
}

function collectNamedPropertyAliases(root: ts.Node): Map<string, NamedPropertyAlias> {
  const aliases = new Map<string, NamedPropertyAlias>();

  const collectFromBindingPattern = (
    pattern: ts.ObjectBindingPattern,
    initializer: ts.Expression | undefined,
    propertyPath: string[],
  ): void => {
    for (const element of pattern.elements) {
      if (element.dotDotDotToken) continue;
      const propertyName =
        getPropertyNameText(element.propertyName) ?? getPropertyNameText(element.name);
      if (!propertyName) continue;
      const nextPath = [...propertyPath, propertyName];
      if (ts.isIdentifier(element.name)) {
        aliases.set(element.name.text, { initializer, propertyName, propertyPath: nextPath });
        continue;
      }
      if (ts.isObjectBindingPattern(element.name)) {
        collectFromBindingPattern(element.name, initializer, nextPath);
      }
    }
  };

  const visit = (node: ts.Node): void => {
    if (
      ts.isVariableDeclaration(node) &&
      ts.isObjectBindingPattern(node.name) &&
      node.initializer
    ) {
      collectFromBindingPattern(node.name, node.initializer, []);
    }

    if (ts.isParameter(node) && ts.isObjectBindingPattern(node.name)) {
      collectFromBindingPattern(node.name, undefined, []);
    }

    node.forEachChild(visit);
  };

  visit(root);
  return aliases;
}

function resolveFunctionLikeHandler(
  expression: ts.Expression | undefined,
  namedFunctions: Map<string, ts.FunctionLikeDeclarationBase>,
): ts.FunctionLikeDeclarationBase | null {
  if (!expression) return null;
  if (ts.isArrowFunction(expression) || ts.isFunctionExpression(expression)) {
    return expression;
  }
  if (ts.isIdentifier(expression)) {
    return namedFunctions.get(expression.text) ?? null;
  }
  return null;
}

function getFunctionLikeReturnExpressions(node: ts.FunctionLikeDeclarationBase): ts.Expression[] {
  if (ts.isArrowFunction(node) && !ts.isBlock(node.body)) {
    return [node.body];
  }

  const body = node.body;
  if (!body || !ts.isBlock(body)) {
    return [];
  }

  const expressions: ts.Expression[] = [];
  const visit = (current: ts.Node): void => {
    if (
      current !== body &&
      (ts.isFunctionDeclaration(current) ||
        ts.isFunctionExpression(current) ||
        ts.isArrowFunction(current) ||
        ts.isMethodDeclaration(current) ||
        ts.isGetAccessorDeclaration(current) ||
        ts.isSetAccessorDeclaration(current) ||
        ts.isConstructorDeclaration(current))
    ) {
      return;
    }

    if (ts.isReturnStatement(current) && current.expression) {
      expressions.push(current.expression);
      return;
    }

    current.forEachChild(visit);
  };

  visit(body);
  return expressions;
}

function getFunctionLikeCacheKey(node: ts.FunctionLikeDeclarationBase): string {
  return `${node.pos}:${node.end}`;
}

function bindFunctionLikeArguments(
  functionLike: ts.FunctionLikeDeclarationBase,
  args: readonly ts.Expression[],
  namedExpressions: Map<string, ts.Expression>,
): Map<string, ts.Expression> {
  const boundExpressions = new Map(namedExpressions);

  functionLike.parameters.forEach((parameter, index) => {
    const argument = args[index];
    if (!argument || !ts.isIdentifier(parameter.name)) return;
    boundExpressions.set(parameter.name.text, argument);
  });

  return boundExpressions;
}

function getMemberAccessPropertyName(expression: ts.Expression | undefined): string | null {
  if (!expression || !isMemberAccessExpression(expression)) return null;
  if (isPropertyLikeAccessExpression(expression)) {
    return expression.name.text;
  }
  return getExpressionLiteralValue(expression.argumentExpression);
}

interface ResolvedObjectLiteralExpression {
  namedExpressions: Map<string, ts.Expression>;
  objectLiteral: ts.ObjectLiteralExpression;
}

interface ResolvedTrackedFunctionLike {
  functionLike: ts.FunctionLikeDeclarationBase;
  namedExpressions: Map<string, ts.Expression>;
}

function getObjectLiteralPropertyExpression(
  objectLiteral: ts.ObjectLiteralExpression,
  propertyName: string,
  namedExpressions: Map<string, ts.Expression>,
): ts.Expression | null {
  for (const property of objectLiteral.properties) {
    if (ts.isPropertyAssignment(property) && getPropertyNameText(property.name) === propertyName) {
      return property.initializer;
    }

    if (ts.isShorthandPropertyAssignment(property) && property.name.text === propertyName) {
      return namedExpressions.get(property.name.text) ?? null;
    }
  }

  return null;
}

const MAX_OPEN_REDIRECT_RESOLUTION_DEPTH = 40;

function resolveObjectLiteralExpressionAtPropertyPath(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  propertyPath: string[],
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
  seenFunctions: Set<string>,
  depth = 0,
): ResolvedObjectLiteralExpression | null {
  if (depth > MAX_OPEN_REDIRECT_RESOLUTION_DEPTH) return null;
  let resolvedObjectLiteral = resolveObjectLiteralExpression(
    expression,
    sourceFile,
    namedExpressions,
    namedPropertyAliases,
    seenIdentifiers,
    seenFunctions,
    depth + 1,
  );
  if (!resolvedObjectLiteral) return null;

  for (const propertyName of propertyPath) {
    const propertyExpression = getObjectLiteralPropertyExpression(
      resolvedObjectLiteral.objectLiteral,
      propertyName,
      resolvedObjectLiteral.namedExpressions,
    );
    if (!propertyExpression) return null;
    resolvedObjectLiteral = resolveObjectLiteralExpression(
      propertyExpression,
      sourceFile,
      resolvedObjectLiteral.namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
      depth + 1,
    );
    if (!resolvedObjectLiteral) return null;
  }

  return resolvedObjectLiteral;
}

function resolveReturnedObjectLiteralExpression(
  functionLike: ts.FunctionLikeDeclarationBase,
  args: readonly ts.Expression[],
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
  seenFunctions: Set<string>,
  depth = 0,
): ResolvedObjectLiteralExpression | null {
  if (depth > MAX_OPEN_REDIRECT_RESOLUTION_DEPTH) return null;
  const functionKey = getFunctionLikeCacheKey(functionLike);
  if (seenFunctions.has(functionKey)) return null;

  seenFunctions.add(functionKey);
  const boundExpressions = bindFunctionLikeArguments(functionLike, args, namedExpressions);
  for (const returnExpression of getFunctionLikeReturnExpressions(functionLike)) {
    const objectLiteral = resolveObjectLiteralExpression(
      returnExpression,
      sourceFile,
      boundExpressions,
      namedPropertyAliases,
      new Set(seenIdentifiers),
      seenFunctions,
      depth + 1,
    );
    if (objectLiteral) {
      seenFunctions.delete(functionKey);
      return objectLiteral;
    }
  }

  seenFunctions.delete(functionKey);
  return null;
}

function resolveObjectLiteralExpression(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
  seenFunctions: Set<string> = new Set(),
  depth = 0,
): ResolvedObjectLiteralExpression | null {
  if (!expression) return null;
  if (depth > MAX_OPEN_REDIRECT_RESOLUTION_DEPTH) return null;

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return resolveObjectLiteralExpression(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
      depth + 1,
    );
  }

  if (ts.isObjectLiteralExpression(expression)) {
    return { objectLiteral: expression, namedExpressions };
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return null;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = resolveObjectLiteralExpression(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
        seenFunctions,
        depth + 1,
      );
      seenIdentifiers.delete(expression.text);
      return result;
    }

    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (!propertyAlias) return null;

    seenIdentifiers.add(expression.text);
    const result = resolveObjectLiteralExpressionAtPropertyPath(
      propertyAlias.initializer,
      sourceFile,
      propertyAlias.propertyPath,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
      depth + 1,
    );
    seenIdentifiers.delete(expression.text);
    return result;
  }

  if (isCallLikeExpression(expression)) {
    const functionResolution = resolveTrackedOpenRedirectFunctionLike(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      new Set(seenIdentifiers),
      seenFunctions,
      depth + 1,
    );
    if (!functionResolution) return null;
    return resolveReturnedObjectLiteralExpression(
      functionResolution.functionLike,
      expression.arguments,
      sourceFile,
      functionResolution.namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
      depth + 1,
    );
  }

  if (isMemberAccessExpression(expression)) {
    const propertyName = getMemberAccessPropertyName(expression);
    if (!propertyName) return null;
    return resolveObjectLiteralExpressionAtPropertyPath(
      expression.expression,
      sourceFile,
      [propertyName],
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
      depth + 1,
    );
  }

  return null;
}

function findFunctionLikeOnObjectLiteral(
  objectLiteral: ts.ObjectLiteralExpression,
  propertyName: string,
  namedFunctions: Map<string, ts.FunctionLikeDeclarationBase>,
): ts.FunctionLikeDeclarationBase | null {
  for (const property of objectLiteral.properties) {
    if (ts.isMethodDeclaration(property) && getPropertyNameText(property.name) === propertyName) {
      return property;
    }

    if (ts.isPropertyAssignment(property) && getPropertyNameText(property.name) === propertyName) {
      return resolveFunctionLikeHandler(property.initializer, namedFunctions);
    }

    if (ts.isShorthandPropertyAssignment(property) && property.name.text === propertyName) {
      return namedFunctions.get(property.name.text) ?? null;
    }
  }

  return null;
}

function resolveReturnedTrackedFunctionLike(
  functionLike: ts.FunctionLikeDeclarationBase,
  args: readonly ts.Expression[],
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
  seenFunctions: Set<string>,
  depth = 0,
): ResolvedTrackedFunctionLike | null {
  if (depth > MAX_OPEN_REDIRECT_RESOLUTION_DEPTH) return null;
  const functionKey = getFunctionLikeCacheKey(functionLike);
  if (seenFunctions.has(functionKey)) return null;

  const nextSeenFunctions = new Set(seenFunctions);
  nextSeenFunctions.add(functionKey);
  const boundExpressions = bindFunctionLikeArguments(functionLike, args, namedExpressions);
  for (const returnExpression of getFunctionLikeReturnExpressions(functionLike)) {
    const result = resolveTrackedOpenRedirectFunctionLike(
      returnExpression,
      sourceFile,
      boundExpressions,
      namedPropertyAliases,
      new Set(seenIdentifiers),
      nextSeenFunctions,
      depth + 1,
    );
    if (result) return result;
  }

  return null;
}

function resolveTrackedOpenRedirectFunctionLike(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
  seenFunctions: Set<string> = new Set(),
  depth = 0,
): ResolvedTrackedFunctionLike | null {
  if (!expression) return null;
  if (depth > MAX_OPEN_REDIRECT_RESOLUTION_DEPTH) return null;

  const namedFunctions = getCachedNamedFunctionLikeDeclarations(sourceFile);
  const directFunctionLike = resolveFunctionLikeHandler(expression, namedFunctions);
  if (directFunctionLike) {
    return { functionLike: directFunctionLike, namedExpressions };
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return resolveTrackedOpenRedirectFunctionLike(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
      depth + 1,
    );
  }

  if (isCallLikeExpression(expression)) {
    const functionResolution = resolveTrackedOpenRedirectFunctionLike(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      new Set(seenIdentifiers),
      seenFunctions,
      depth + 1,
    );
    if (!functionResolution) return null;
    return resolveReturnedTrackedFunctionLike(
      functionResolution.functionLike,
      expression.arguments,
      sourceFile,
      functionResolution.namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
      depth + 1,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return null;

    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = resolveTrackedOpenRedirectFunctionLike(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
        seenFunctions,
        depth + 1,
      );
      seenIdentifiers.delete(expression.text);
      if (result) return result;
    }

    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (!propertyAlias) return null;

    const resolvedObjectLiteral = resolveObjectLiteralExpressionAtPropertyPath(
      propertyAlias.initializer,
      sourceFile,
      propertyAlias.propertyPath.slice(0, -1),
      namedExpressions,
      namedPropertyAliases,
      new Set(seenIdentifiers),
      seenFunctions,
      depth + 1,
    );
    if (!resolvedObjectLiteral) return null;
    const functionLike = findFunctionLikeOnObjectLiteral(
      resolvedObjectLiteral.objectLiteral,
      propertyAlias.propertyName,
      namedFunctions,
    );
    return functionLike
      ? { functionLike, namedExpressions: resolvedObjectLiteral.namedExpressions }
      : null;
  }

  if (!isMemberAccessExpression(expression)) {
    return null;
  }

  const propertyName = getMemberAccessPropertyName(expression);
  if (!propertyName) return null;
  const resolvedObjectLiteral = resolveObjectLiteralExpression(
    expression.expression,
    sourceFile,
    namedExpressions,
    namedPropertyAliases,
    new Set(seenIdentifiers),
    seenFunctions,
    depth + 1,
  );
  if (!resolvedObjectLiteral) return null;
  const functionLike = findFunctionLikeOnObjectLiteral(
    resolvedObjectLiteral.objectLiteral,
    propertyName,
    namedFunctions,
  );
  return functionLike
    ? { functionLike, namedExpressions: resolvedObjectLiteral.namedExpressions }
    : null;
}

function functionLikeReferencesOrigin(node: ts.FunctionLikeDeclarationBase): boolean {
  let found = false;

  const visit = (current: ts.Node): void => {
    if (found) return;

    if (ts.isPropertyAccessExpression(current) && isPropertyNamed(current.name, 'origin')) {
      found = true;
      return;
    }

    if (ts.isIdentifier(current) && current.text === 'origin') {
      found = true;
      return;
    }

    if (ts.isBindingElement(current)) {
      if (ts.isIdentifier(current.name) && current.name.text === 'origin') {
        found = true;
        return;
      }
      if (current.propertyName && isPropertyNamed(current.propertyName, 'origin')) {
        found = true;
        return;
      }
    }

    current.forEachChild(visit);
  };

  node.forEachChild(visit);
  return found;
}

function isAddEventListenerCall(node: CallLikeExpression): boolean {
  return (
    (ts.isIdentifier(node.expression) && node.expression.text === 'addEventListener') ||
    (ts.isPropertyAccessExpression(node.expression) &&
      isPropertyNamed(node.expression.name, 'addEventListener'))
  );
}

function isCookieMutationSetCall(node: CallLikeExpression): boolean {
  if (
    !ts.isPropertyAccessExpression(node.expression) ||
    !isPropertyNamed(node.expression.name, 'set')
  ) {
    return false;
  }

  return (
    (ts.isIdentifier(node.expression.expression) &&
      ['Cookies', 'cookieStore', 'cookies'].includes(node.expression.expression.text)) ||
    (ts.isPropertyAccessExpression(node.expression.expression) &&
      isPropertyNamed(node.expression.expression.name, 'cookies', 'cookieStore'))
  );
}

function expressionLooksLikeAuthCookieName(
  node: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
): boolean {
  if (!node) return false;
  if (isAuthStorageKeyLiteral(node)) return true;
  return hasAuthCredentialText(node, sourceFile);
}

function objectLiteralLooksLikeAuthCookieConfig(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
): boolean {
  if (!expression || !ts.isObjectLiteralExpression(expression)) return false;
  for (const property of expression.properties) {
    if (!ts.isPropertyAssignment(property)) continue;
    const propertyName = ts.isIdentifier(property.name)
      ? property.name.text
      : ts.isStringLiteral(property.name)
        ? property.name.text
        : null;
    if (!propertyName || !['name', 'key', 'cookie'].includes(propertyName)) continue;
    return expressionLooksLikeAuthCookieName(property.initializer, sourceFile);
  }
  return false;
}

function hasExplicitAuthCookieHardening(expression: ts.Expression | undefined): boolean {
  if (!expression || !ts.isObjectLiteralExpression(expression)) return false;

  const httpOnly = getObjectLiteralBooleanPropertyValue(expression, 'httpOnly', 'http_only');
  const secure = getObjectLiteralBooleanPropertyValue(expression, 'secure');
  const sameSite = getObjectLiteralStringPropertyValue(expression, 'sameSite', 'same_site');

  return httpOnly === true && secure === true && Boolean(sameSite?.trim());
}

function isSetCookieHeaderName(node: ts.Expression | undefined): boolean {
  const literal = getExpressionLiteralValue(node)?.trim().toLowerCase();
  return literal === 'set-cookie';
}

function cookieHeaderStringLooksAuthLike(value: string): boolean {
  return /\b(?:auth|session|token|jwt|refresh_token|access_token)[^=]*=/i.test(value);
}

function cookieHeaderStringHasHardening(value: string): boolean {
  return (
    /;\s*httponly\b/i.test(value) && /;\s*secure\b/i.test(value) && /;\s*samesite=/i.test(value)
  );
}

function collectCookieHeaderStrings(expression: ts.Expression | undefined): string[] {
  if (!expression) return [];
  const literal = getExpressionLiteralValue(expression);
  if (literal !== null) return [literal];
  if (ts.isArrayLiteralExpression(expression)) {
    return expression.elements
      .map((element) => (ts.isExpression(element) ? getExpressionLiteralValue(element) : null))
      .filter((value): value is string => value !== null);
  }
  return [];
}

function isInsecureTransportUrl(value: string | null): boolean {
  return typeof value === 'string' && /^(?:http|ws):\/\//i.test(value.trim());
}

function isPropertyLikeAccessExpression(
  node: ts.Node | undefined,
): node is ts.PropertyAccessExpression | ts.PropertyAccessChain {
  return Boolean(node && (ts.isPropertyAccessExpression(node) || ts.isPropertyAccessChain(node)));
}

function isElementLikeAccessExpression(
  node: ts.Node | undefined,
): node is ts.ElementAccessExpression | ts.ElementAccessChain {
  return Boolean(node && (ts.isElementAccessExpression(node) || ts.isElementAccessChain(node)));
}

type CallLikeExpression = ts.CallExpression | ts.CallChain;

function isMemberAccessExpression(
  node: ts.Node | undefined,
): node is
  | ts.PropertyAccessExpression
  | ts.PropertyAccessChain
  | ts.ElementAccessExpression
  | ts.ElementAccessChain {
  return isPropertyLikeAccessExpression(node) || isElementLikeAccessExpression(node);
}

function isCallLikeExpression(node: ts.Node | undefined): node is CallLikeExpression {
  return Boolean(node && (ts.isCallExpression(node) || ts.isCallChain(node)));
}

function isMemberAccessNamed(node: ts.Node | undefined, ...names: string[]): boolean {
  if (!node) return false;
  if (isPropertyLikeAccessExpression(node)) {
    return isPropertyNamed(node.name, ...names);
  }
  if (isElementLikeAccessExpression(node)) {
    return isPropertyNamed(node.argumentExpression, ...names);
  }
  return false;
}

function isLocationObjectExpression(expression: ts.Expression): boolean {
  return (
    (ts.isIdentifier(expression) && expression.text === 'location') ||
    ((ts.isPropertyAccessExpression(expression) || ts.isElementAccessExpression(expression)) &&
      ts.isIdentifier(expression.expression) &&
      ['window', 'globalThis', 'document', 'self', 'parent', 'top'].includes(
        expression.expression.text,
      ) &&
      isMemberAccessNamed(expression, 'location'))
  );
}

function isLocationAssignmentTarget(expression: ts.Expression): boolean {
  return (
    isLocationObjectExpression(expression) ||
    ((ts.isPropertyAccessExpression(expression) || ts.isElementAccessExpression(expression)) &&
      isLocationObjectExpression(expression.expression) &&
      isMemberAccessNamed(expression, 'href'))
  );
}

function isFetchLikeCall(node: CallLikeExpression): boolean {
  return (
    (ts.isIdentifier(node.expression) && node.expression.text === 'fetch') ||
    (ts.isPropertyAccessExpression(node.expression) &&
      isPropertyNamed(node.expression.name, 'fetch'))
  );
}

function isAxiosLikeCall(node: CallLikeExpression): boolean {
  if (!ts.isPropertyAccessExpression(node.expression)) return false;
  return (
    ts.isIdentifier(node.expression.expression) &&
    node.expression.expression.text === 'axios' &&
    isPropertyNamed(
      node.expression.name,
      'get',
      'post',
      'put',
      'patch',
      'delete',
      'head',
      'options',
      'request',
    )
  );
}

function isAxiosConfigCall(node: CallLikeExpression): boolean {
  return ts.isIdentifier(node.expression) && node.expression.text === 'axios';
}

function isRealtimeTransportConstructor(node: ts.NewExpression): boolean {
  return (
    ts.isIdentifier(node.expression) &&
    (node.expression.text === 'WebSocket' || node.expression.text === 'EventSource')
  );
}

function hasPlaceholderNavigationTarget(attributes: ts.JsxAttributes): boolean {
  const targetValue = getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'href', 'to'));
  if (!targetValue) return false;

  const normalized = targetValue.trim().toLowerCase();
  return (
    normalized === '#' ||
    normalized === '/#' ||
    normalized === 'javascript:' ||
    normalized === 'javascript:void(0)' ||
    normalized === 'javascript:void(0);'
  );
}

function isExternalUrl(value: string | null): boolean {
  return typeof value === 'string' && /^(?:https?:)?\/\//i.test(value.trim());
}

function parseExternalUrl(value: string | null): URL | null {
  if (!isExternalUrl(value)) return null;

  const normalized = value?.trim() ?? '';
  const input = normalized.startsWith('//') ? `https:${normalized}` : normalized;
  try {
    return new URL(input);
  } catch {
    return null;
  }
}

function isProviderAuthorizeUrl(url: URL): boolean {
  const hostAndPath = `${url.hostname}${url.pathname}`.toLowerCase();
  const hasAuthorizeLikePath = /(?:oauth|authorize|openid|sso|login\/oauth)/i.test(hostAndPath);
  const hasProviderQuery = ['client_id', 'redirect_uri', 'response_type', 'scope'].some((param) =>
    url.searchParams.has(param),
  );
  return (
    (hasAuthorizeLikePath && hasProviderQuery) ||
    (url.searchParams.has('client_id') && url.searchParams.has('redirect_uri'))
  );
}

function isAuthProviderUrlMissingState(value: string | null): boolean {
  const url = parseExternalUrl(value);
  if (!url || !isProviderAuthorizeUrl(url)) return false;
  return !url.searchParams.has('state');
}

function isAuthProviderCodeFlowMissingPkce(value: string | null): boolean {
  const url = parseExternalUrl(value);
  if (!url || !isProviderAuthorizeUrl(url)) return false;

  const responseType = url.searchParams.get('response_type')?.toLowerCase() ?? '';
  if (!responseType.includes('code')) return false;
  return !url.searchParams.has('code_challenge');
}

function isAuthProviderIdTokenFlowMissingNonce(value: string | null): boolean {
  const url = parseExternalUrl(value);
  if (!url || !isProviderAuthorizeUrl(url)) return false;

  const responseType = url.searchParams.get('response_type')?.toLowerCase() ?? '';
  if (!responseType.includes('id_token')) return false;
  return !url.searchParams.has('nonce');
}

function hasMainLandmarkSignal(attributes: ts.JsxAttributes, tagName: string | null): boolean {
  if (tagName === 'main') return true;

  const roleValue = getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'role'));
  return roleValue?.trim().toLowerCase() === 'main';
}

function getMainLandmarkId(attributes: ts.JsxAttributes, tagName: string | null): string | null {
  if (!hasMainLandmarkSignal(attributes, tagName)) return null;

  const idValue = getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'id'));
  return idValue?.trim() ? idValue.trim() : null;
}

function getSkipNavTargetId(attributes: ts.JsxAttributes, tagName: string | null): string | null {
  if (tagName !== 'a') return null;

  const hrefValue = getJsxAttributeLiteralValue(getJsxAttribute(attributes, 'href', 'to'));
  if (!hrefValue?.startsWith('#')) return null;

  const targetId = hrefValue.slice(1).trim();
  return targetId.length > 0 ? targetId : null;
}

function isAuthStorageKeyLiteral(node: ts.Expression | undefined): boolean {
  if (!node) return false;
  if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) {
    if (node.text === 'decantr_authenticated') return false;
    return /(?:token|auth|jwt|session|access_token|refresh_token)/i.test(node.text);
  }
  return false;
}

function isBrowserStorageObject(node: ts.Expression): boolean {
  return ts.isIdentifier(node) && (node.text === 'localStorage' || node.text === 'sessionStorage');
}

function isDocumentObject(node: ts.Expression): boolean {
  return ts.isIdentifier(node) && node.text === 'document';
}

function isCookiePropertyAccess(node: ts.Expression): boolean {
  return (
    ts.isPropertyAccessExpression(node) &&
    isDocumentObject(node.expression) &&
    isPropertyNamed(node.name, 'cookie')
  );
}

function hasAuthCredentialText(node: ts.Node, sourceFile: ts.SourceFile): boolean {
  return /(?:token|auth|jwt|session|access_token|refresh_token)/i.test(node.getText(sourceFile));
}

function isAuthorizationHeaderName(node: ts.Node | undefined): boolean {
  if (!node) return false;
  if (ts.isIdentifier(node)) {
    return /^authorization$/i.test(node.text);
  }
  if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) {
    return /^authorization$/i.test(node.text);
  }
  if (ts.isComputedPropertyName(node)) {
    return isAuthorizationHeaderName(node.expression);
  }
  return false;
}

function isAuthorizationHeaderAccess(node: ts.Expression | undefined): boolean {
  if (!node) return false;
  return (
    (ts.isPropertyAccessExpression(node) && isAuthorizationHeaderName(node.name)) ||
    (ts.isElementAccessExpression(node) && isAuthorizationHeaderName(node.argumentExpression))
  );
}

function isHeaderClearValue(node: ts.Expression | undefined): boolean {
  if (!node) return false;
  const literal = getExpressionLiteralValue(node);
  if (literal !== null) {
    return literal.trim().length === 0;
  }
  return (
    node.kind === ts.SyntaxKind.NullKeyword ||
    node.kind === ts.SyntaxKind.UndefinedKeyword ||
    (ts.isIdentifier(node) && node.text === 'undefined')
  );
}

function countAuthGuardSignals(code: string): number {
  const patterns = [
    /\b(?:ProtectedRoute|AuthGuard|RequireAuth|withAuth|requireAuth|requireAdmin|ensureAuth|ensureAdmin|useRequireAuth)\b/,
    /\b(?:useAuth|useSession|getServerSession|authGuard|isAuthenticated|isSignedIn)\b/,
    /\b(?:redirect|navigate|push|replace)\s*\(\s*['"`]\/(?:auth|login|log-?in|sign-?in|sign-?up|register|forgot-password|reset-password)[^'"`]*['"`]/i,
    /\bNextResponse\.redirect\s*\(/,
    /\bbeforeEnter\b/,
    /\bmiddleware\b/,
  ];

  return patterns.reduce((count, pattern) => count + (pattern.test(code) ? 1 : 0), 0);
}

function countSkipNavSignals(code: string): number {
  const patterns = [
    /\bskip(?:-| )?nav(?:igation)?\b/i,
    /\bskip to (?:content|main|navigation)\b/i,
    /href\s*=\s*["']#(?:main|content|main-content|app-main)["']/i,
  ];

  return patterns.reduce((count, pattern) => count + (pattern.test(code) ? 1 : 0), 0);
}

function countAuthSessionSignals(code: string): number {
  const patterns = [
    /\b(?:useAuth|useSession|getSession|getServerSession|sessionState|authState)\b/,
    /\b(?:supabase\.auth\.getSession|auth\.getSession|session\.(?:user|token|status)|auth\.(?:user|session|status))\b/,
    /\bstatus\s*===?\s*['"`](?:authenticated|unauthenticated|loading)['"`]/,
  ];

  return patterns.reduce((count, pattern) => count + (pattern.test(code) ? 1 : 0), 0);
}

function countAuthUnauthenticatedBranchSignals(code: string): number {
  const patterns = [
    /\bif\s*\(\s*!\s*(?:session|user|currentUser|currentSession|authUser)\b/i,
    /\bif\s*\(\s*(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)\s*\)/i,
    /\bstatus\s*===?\s*['"`]unauthenticated['"`]/i,
    /\bstatus\s*!==?\s*['"`]authenticated['"`]/i,
  ];

  return patterns.reduce((count, pattern) => count + (pattern.test(code) ? 1 : 0), 0);
}

function countAuthLoadingSignals(code: string): number {
  const patterns = [
    /\b(?:isLoading|loading|isPending|pending|authLoading|sessionLoading)\b/,
    /\bstatus\s*===?\s*['"`]loading['"`]/,
    /\b(?:Suspense|fallback|Skeleton|Spinner)\b/,
    />\s*(?:signing you in|redirecting|authenticating|verifying your session|checking your session|loading your workspace|finishing sign in)(?:[.!…]+)?\s*</i,
  ];

  return patterns.reduce((count, pattern) => count + (pattern.test(code) ? 1 : 0), 0);
}

function countAuthProtectedLoadingRenderSignals(code: string): number {
  const patterns = [
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*(?:path|href|to)\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*(?:path|href|to)\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*(?:path|href|to)\s*=\s*{\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*(?:path|href|to)\s*=\s*{\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*(?:path|href|to)\s*=\s*{\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*(?:path|href|to)\s*=\s*{\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*(?:path|href|to)\s*=\s*{\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*(?:path|href|to)\s*=\s*{\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?(?:path|href|to)\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?(?:path|href|to)\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?(?:path|href|to)\s*=\s*{\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`]\s*}[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?(?:path|href|to)\s*=\s*{\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`]\s*}[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*{\s*[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*{\s*[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*{\s*[^}]*\bpathname\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[^}]*}\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*{\s*[^}]*\bpathname\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[^}]*}\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*{\s*[^}]*\bpathname\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[^}]*}\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*{\s*[^}]*\bpathname\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[^}]*}\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*{\s*[^}]*\bpathname\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[^}]*}\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*{\s*[^}]*\bpathname\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[^}]*}\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*{\s*[^}]*\bpathname\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[^}]*}\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*{\s*[^}]*\bpathname\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[^}]*}\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:window\.)?location\.(?:assign|replace)\s*\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:window\.)?location\.(?:assign|replace)\s*\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?(?:window\.)?location\.href\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?(?:window\.)?location\.href\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?<input\b(?=[^>]*\btype\s*=\s*['"`]hidden['"`])(?=[^>]*\b(?:value|defaultValue)\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`])[^>]*>[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?<input\b(?=[^>]*\btype\s*=\s*['"`]hidden['"`])(?=[^>]*\b(?:value|defaultValue)\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`])[^>]*>[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*\bdata-(?:redirect|redirect-to|next|next-path|destination|return|return-to|to|path)\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^>]*>[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*\bdata-(?:redirect|redirect-to|next|next-path|destination|return|return-to|to|path)\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^>]*>[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*=\s*{\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*=\s*{\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*=\s*{\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*=\s*{\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*=\s*{\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*=\s*{\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\b(?:to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\b(?:to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:to|path|href|action|route|pathname)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:to|path|href|action|route|pathname)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:state|options|config)\s*:\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route|pathname)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:state|options|config)\s*:\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route|pathname)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\bpayload\s*:\s*JSON\.stringify\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\bpayload\s*:\s*JSON\.stringify\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\bpayload\s*:\s*JSON\.stringify\(\s*{[^}]*\b(?:label|title|subtitle|description|value|content|name|email|avatar|src)\s*:\s*[^,\]}]*\b(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\b[^,\]}]*[^}]*}\s*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\bpayload\s*:\s*JSON\.stringify\(\s*{[^}]*\b(?:label|title|subtitle|description|value|content|name|email|avatar|src)\s*:\s*[^,\]}]*\b(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\b[^,\]}]*[^}]*}\s*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\bpayload\s*:\s*(?:new\s+)?URLSearchParams\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)(?:\.toString\(\s*\))?[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\bpayload\s*:\s*(?:new\s+)?URLSearchParams\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)(?:\.toString\(\s*\))?[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\bpayload\s*:\s*(?:new\s+)?URLSearchParams\(\s*{[^}]*\b(?:label|title|subtitle|description|value|content|name|email|avatar|src)\s*:\s*[^,\]}]*\b(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\b[^,\]}]*[^}]*}\s*\)(?:\.toString\(\s*\))?[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\bpayload\s*:\s*(?:new\s+)?URLSearchParams\(\s*{[^}]*\b(?:label|title|subtitle|description|value|content|name|email|avatar|src)\s*:\s*[^,\]}]*\b(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\b[^,\]}]*[^}]*}\s*\)(?:\.toString\(\s*\))?[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\bpayload\s*:\s*createSearchParams\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)(?:\.toString\(\s*\))?[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\bpayload\s*:\s*createSearchParams\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)(?:\.toString\(\s*\))?[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\bpayload\s*:\s*createSearchParams\(\s*{[^}]*\b(?:label|title|subtitle|description|value|content|name|email|avatar|src)\s*:\s*[^,\]}]*\b(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\b[^,\]}]*[^}]*}\s*\)(?:\.toString\(\s*\))?[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\bpayload\s*:\s*createSearchParams\(\s*{[^}]*\b(?:label|title|subtitle|description|value|content|name|email|avatar|src)\s*:\s*[^,\]}]*\b(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\b[^,\]}]*[^}]*}\s*\)(?:\.toString\(\s*\))?[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:label|title|subtitle|description|value|content|name|email|avatar|src)\s*:\s*[^,\]}]*\b(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\b[^,\]}]*[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:label|title|subtitle|description|value|content|name|email|avatar|src)\s*:\s*[^,\]}]*\b(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\b[^,\]}]*[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:state|options|config|meta|details|data)\s*:\s*{[^}]*\b(?:label|title|subtitle|description|value|content|name|email|avatar|src)\s*:\s*[^,\]}]*\b(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\b[^,\]}]*[^}]*}[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:state|options|config|meta|details|data)\s*:\s*{[^}]*\b(?:label|title|subtitle|description|value|content|name|email|avatar|src)\s*:\s*[^,\]}]*\b(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\b[^,\]}]*[^}]*}[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:to|path|href|action|route|pathname)\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:to|path|href|action|route|pathname)\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:to|path|href|action|route|pathname)\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:to|path|href|action|route|pathname)\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\bpathname\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\bpathname\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\bpathname\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\bpathname\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\bpathname\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\bpathname\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\bpathname\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\bpathname\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*JSON\.stringify\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*JSON\.stringify\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*(?:new\s+)?URLSearchParams\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)(?:\.toString\(\s*\))?\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*(?:new\s+)?URLSearchParams\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)(?:\.toString\(\s*\))?\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*createSearchParams\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)(?:\.toString\(\s*\))?\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*createSearchParams\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)(?:\.toString\(\s*\))?\s*}[^>]*>/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\baction\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\baction\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<(?:Dashboard|Workspace|Admin|Billing|Account|Profile|Protected)(?:Shell|Layout|Panel|Page|View|Route|Gate|Guard|Screen|Portal)\b[^>]*>/g,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<App(?:Shell|Layout|Panel|Page|View|Route|Gate|Guard|Screen|Portal)\b[^>]*>/g,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<(?:Dashboard|Workspace|Admin|Billing|Account|Profile|Protected)(?:Shell|Layout|Panel|Page|View|Route|Gate|Guard|Screen|Portal)\b[^>]*>/g,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<App(?:Shell|Layout|Panel|Page|View|Route|Gate|Guard|Screen|Portal)\b[^>]*>/g,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<(?:Dashboard|Workspace|Admin|Billing|Account|Profile|Protected)[A-Z][A-Za-z0-9]*\b[^>]*>/g,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<App[A-Z][A-Za-z0-9]*\b[^>]*>/g,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<(?:Dashboard|Workspace|Admin|Billing|Account|Profile|Protected)[A-Z][A-Za-z0-9]*\b[^>]*>/g,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<App[A-Z][A-Za-z0-9]*\b[^>]*>/g,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\s*=\s*{[^}]+}[^>]*>/g,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{[^}]*\b(?:session|user|currentUser|currentSession|authUser)\b[^}]*}[^>]*>/g,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\s*=\s*{[^}]+}[^>]*>/g,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*=\s*{[^}]*\b(?:session|user|currentUser|currentSession|authUser)\b[^}]*}[^>]*>/g,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\{[^}]*\b(?:session|user|currentUser|currentSession|authUser)\b[^}]*\}[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/g,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\{[^}]*\b(?:session|user|currentUser|currentSession|authUser)\b[^}]*\}[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/g,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,220}?return\s*<>\s*{[^}]*\b(?:session|user|currentUser|currentSession|authUser)\b[^}]*}\s*<\/>\s*;?/g,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<>\s*{[^}]*\b(?:session|user|currentUser|currentSession|authUser)\b[^}]*}\s*<\/>\s*;?/g,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,220}?return\s*(?:children|props\.children|<>\s*{?\s*(?:children|props\.children)\s*}?\s*<\/>)\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*(?:children|props\.children|<>\s*{?\s*(?:children|props\.children)\s*}?\s*<\/>)\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,220}?return\s*<(?:Outlet|Routes|RouterProvider)\b[^>]*>/g,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*<(?:Outlet|Routes|RouterProvider)\b[^>]*>/g,
  ];

  return patterns.reduce((total, pattern) => total + (code.match(pattern)?.length ?? 0), 0);
}

function countAuthBlankLoadingRenderSignals(code: string): number {
  const patterns = [
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,220}?return\s*(?:null|<>\s*<\/>)\s*;?/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*(?:null|<>\s*<\/>)\s*;?/gi,
  ];

  return patterns.reduce((total, pattern) => total + (code.match(pattern)?.length ?? 0), 0);
}

function countAuthAnonymousLoadingRedirectSignals(code: string): number {
  const patterns = [
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*{[\s\S]{0,260}?\b(?:redirect|navigate|push|replace)\s*\(\s*['"`]\/(?:auth|login|log-?in|sign-?in|sign-?up|register|forgot-password|reset-password)?(?:[/?#][^'"`]*)?['"`]/gi,
    /\bif\s*\(\s*[^)]*(?:status\s*===?\s*['"`]loading['"`]|isLoading|loading|isPending|pending|sessionLoading|authLoading)[^)]*\)\s*return\s*\b(?:redirect|navigate|push|replace)\s*\(\s*['"`]\/(?:auth|login|log-?in|sign-?in|sign-?up|register|forgot-password|reset-password)?(?:[/?#][^'"`]*)?['"`]/gi,
  ];

  return patterns.reduce((total, pattern) => total + (code.match(pattern)?.length ?? 0), 0);
}

function countAuthProtectedUnauthenticatedRenderSignals(code: string): number {
  const patterns = [
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*(?:path|href|to)\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*(?:path|href|to)\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*(?:path|href|to)\s*=\s*{\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*(?:path|href|to)\s*=\s*{\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*(?:path|href|to)\s*=\s*{\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*(?:path|href|to)\s*=\s*{\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*(?:path|href|to)\s*=\s*{\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*(?:path|href|to)\s*=\s*{\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?(?:path|href|to)\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?(?:path|href|to)\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?(?:path|href|to)\s*=\s*{\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`]\s*}[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?(?:path|href|to)\s*=\s*{\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`]\s*}[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*{\s*[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*{\s*[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*{\s*[^}]*\bpathname\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[^}]*}\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*{\s*[^}]*\bpathname\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[^}]*}\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*{\s*[^}]*\bpathname\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[^}]*}\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*{\s*[^}]*\bpathname\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[^}]*}\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*{\s*[^}]*\bpathname\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[^}]*}\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*{\s*[^}]*\bpathname\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[^}]*}\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*{\s*[^}]*\bpathname\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[^}]*}\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*{\s*[^}]*\bpathname\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[^}]*}\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:redirect|navigate|push|replace)\s*\(\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)\s*\)[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:window\.)?location\.(?:assign|replace)\s*\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\b(?:window\.)?location\.(?:assign|replace)\s*\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?(?:window\.)?location\.href\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?(?:window\.)?location\.href\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?<input\b(?=[^>]*\btype\s*=\s*['"`]hidden['"`])(?=[^>]*\b(?:value|defaultValue)\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`])[^>]*>[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?<input\b(?=[^>]*\btype\s*=\s*['"`]hidden['"`])(?=[^>]*\b(?:value|defaultValue)\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`])[^>]*>[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*\bdata-(?:redirect|redirect-to|next|next-path|destination|return|return-to|to|path)\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^>]*>[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*\bdata-(?:redirect|redirect-to|next|next-path|destination|return|return-to|to|path)\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^>]*>[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*=\s*{\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*=\s*{\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*=\s*{\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*=\s*{\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*=\s*{\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*=\s*{\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\b(?:to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\b(?:to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:to|path|href|action|route|pathname)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:to|path|href|action|route|pathname)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:state|options|config)\s*:\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route|pathname)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:state|options|config)\s*:\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route|pathname)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\bpayload\s*:\s*JSON\.stringify\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\bpayload\s*:\s*JSON\.stringify\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\bpayload\s*:\s*(?:new\s+)?URLSearchParams\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)(?:\.toString\(\s*\))?[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\bpayload\s*:\s*(?:new\s+)?URLSearchParams\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)(?:\.toString\(\s*\))?[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\bpayload\s*:\s*createSearchParams\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)(?:\.toString\(\s*\))?[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\bpayload\s*:\s*createSearchParams\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)(?:\.toString\(\s*\))?[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:to|path|href|action|route|pathname)\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:to|path|href|action|route|pathname)\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:to|path|href|action|route|pathname)\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:to|path|href|action|route|pathname)\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:redirectTo|returnTo|next|nextPath|destination|toPath)\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\bpathname\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\bpathname\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\bpathname\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\bpathname\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\bpathname\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\bpathname\s*:\s*generatePath\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^)]*\)[^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\bpathname\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{{[^}]*\bpathname\s*:\s*createPath\(\s*{[^}]*\bpathname\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)[^}]*}}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*JSON\.stringify\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*JSON\.stringify\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*JSON\.stringify\(\s*{[^}]*\b(?:label|title|subtitle|description|value|content|name|email|avatar|src)\s*:\s*[^,\]}]*\b(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\b[^,\]}]*[^}]*}\s*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*JSON\.stringify\(\s*{[^}]*\b(?:label|title|subtitle|description|value|content|name|email|avatar|src)\s*:\s*[^,\]}]*\b(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\b[^,\]}]*[^}]*}\s*\)\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*(?:new\s+)?URLSearchParams\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)(?:\.toString\(\s*\))?\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*(?:new\s+)?URLSearchParams\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)(?:\.toString\(\s*\))?\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*(?:new\s+)?URLSearchParams\(\s*{[^}]*\b(?:label|title|subtitle|description|value|content|name|email|avatar|src)\s*:\s*[^,\]}]*\b(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\b[^,\]}]*[^}]*}\s*\)(?:\.toString\(\s*\))?\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*(?:new\s+)?URLSearchParams\(\s*{[^}]*\b(?:label|title|subtitle|description|value|content|name|email|avatar|src)\s*:\s*[^,\]}]*\b(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\b[^,\]}]*[^}]*}\s*\)(?:\.toString\(\s*\))?\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*createSearchParams\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)(?:\.toString\(\s*\))?\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*createSearchParams\(\s*{[^}]*\b(?:redirectTo|returnTo|next|nextPath|destination|toPath|to|path|href|action|route)\s*:\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][^}]*}\s*\)(?:\.toString\(\s*\))?\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*createSearchParams\(\s*{[^}]*\b(?:label|title|subtitle|description|value|content|name|email|avatar|src)\s*:\s*[^,\]}]*\b(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\b[^,\]}]*[^}]*}\s*\)(?:\.toString\(\s*\))?\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*createSearchParams\(\s*{[^}]*\b(?:label|title|subtitle|description|value|content|name|email|avatar|src)\s*:\s*[^,\]}]*\b(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\b[^,\]}]*[^}]*}\s*\)(?:\.toString\(\s*\))?\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:label|title|subtitle|description|value|content|name|email|avatar|src)\s*:\s*[^,\]}]*\b(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\b[^,\]}]*[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:label|title|subtitle|description|value|content|name|email|avatar|src)\s*:\s*[^,\]}]*\b(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\b[^,\]}]*[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:state|options|config|meta|details|data)\s*:\s*{[^}]*\b(?:label|title|subtitle|description|value|content|name|email|avatar|src)\s*:\s*[^,\]}]*\b(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\b[^,\]}]*[^}]*}[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{\s*\[[\s\S]{0,220}?\b(?:state|options|config|meta|details|data)\s*:\s*{[^}]*\b(?:label|title|subtitle|description|value|content|name|email|avatar|src)\s*:\s*[^,\]}]*\b(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\b[^,\]}]*[^}]*}[\s\S]{0,220}?\]\s*}[^>]*>/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\baction\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\baction\s*=\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`][\s\S]{0,220}?<\/[\w.:-]+>\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<(?:Dashboard|Workspace|Admin|Billing|Account|Profile|Protected)(?:Shell|Layout|Panel|Page|View|Route|Gate|Guard|Screen|Portal)\b[^>]*>/g,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<App(?:Shell|Layout|Panel|Page|View|Route|Gate|Guard|Screen|Portal)\b[^>]*>/g,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<(?:Dashboard|Workspace|Admin|Billing|Account|Profile|Protected)(?:Shell|Layout|Panel|Page|View|Route|Gate|Guard|Screen|Portal)\b[^>]*>/g,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<App(?:Shell|Layout|Panel|Page|View|Route|Gate|Guard|Screen|Portal)\b[^>]*>/g,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<(?:Dashboard|Workspace|Admin|Billing|Account|Profile|Protected)[A-Z][A-Za-z0-9]*\b[^>]*>/g,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<App[A-Z][A-Za-z0-9]*\b[^>]*>/g,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<(?:Dashboard|Workspace|Admin|Billing|Account|Profile|Protected)[A-Z][A-Za-z0-9]*\b[^>]*>/g,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<App[A-Z][A-Za-z0-9]*\b[^>]*>/g,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\s*=\s*{[^}]+}[^>]*>/g,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*=\s*{[^}]*\b(?:session|user|currentUser|currentSession|authUser)\b[^}]*}[^>]*>/g,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*(?:session|user|currentUser|currentSession|authUser|viewer|profile|account|member)\s*=\s*{[^}]+}[^>]*>/g,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*=\s*{[^}]*\b(?:session|user|currentUser|currentSession|authUser)\b[^}]*}[^>]*>/g,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,320}?return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\{[^}]*\b(?:session|user|currentUser|currentSession|authUser)\b[^}]*\}[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/g,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<[\w.:-]+[^>]*>[\s\S]{0,220}?\{[^}]*\b(?:session|user|currentUser|currentSession|authUser)\b[^}]*\}[\s\S]{0,220}?<\/[\w.:-]+>\s*;?/g,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,220}?return\s*<>\s*{[^}]*\b(?:session|user|currentUser|currentSession|authUser)\b[^}]*}\s*<\/>\s*;?/g,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<>\s*{[^}]*\b(?:session|user|currentUser|currentSession|authUser)\b[^}]*}\s*<\/>\s*;?/g,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,220}?return\s*(?:children|props\.children|<>\s*{?\s*(?:children|props\.children)\s*}?\s*<\/>)\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*(?:children|props\.children|<>\s*{?\s*(?:children|props\.children)\s*}?\s*<\/>)\s*;?/gi,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*{[\s\S]{0,220}?return\s*<(?:Outlet|Routes|RouterProvider)\b[^>]*>/g,
    /\bif\s*\(\s*(?:!\s*(?:session|user|currentUser|currentSession|authUser)|(?:session|user|currentUser|currentSession|authUser)\s*(?:==|===)\s*(?:null|undefined)|status\s*===?\s*['"`]unauthenticated['"`]|status\s*!==?\s*['"`]authenticated['"`])\s*\)\s*return\s*<(?:Outlet|Routes|RouterProvider)\b[^>]*>/g,
  ];

  return patterns.reduce((total, pattern) => total + (code.match(pattern)?.length ?? 0), 0);
}

function countAuthErrorSignals(code: string): number {
  const patterns = [
    /\bstatus\s*===?\s*['"`]error['"`]/,
    /\b(?:authError|sessionError|loginError|signInError|signUpError|formError|errorMessage|setError)\b/,
    /\bcatch\s*\(/,
    /\b(?:toast|notify|notification|Alert|alert|ErrorBoundary)\b/,
  ];

  return patterns.reduce((count, pattern) => count + (pattern.test(code) ? 1 : 0), 0);
}

function countAuthSuccessSignals(code: string): number {
  const patterns = [
    /\bstatus\s*===?\s*['"`]success['"`]/,
    /\b(?:authSuccess|recoverySuccess|resetSuccess|passwordResetSent|resetEmailSent|verificationSent|emailSent|successMessage|setSuccess)\b/i,
    /\b(?:toast|notify|notification)\.success\b/i,
    />\s*(?:check your email|email sent|reset link sent|password reset email sent|verification email sent|password updated|account created)\s*</i,
  ];

  return patterns.reduce((count, pattern) => count + (pattern.test(code) ? 1 : 0), 0);
}

function countAuthCallbackTokenSignals(code: string, filePath: string): number {
  const patterns = [
    /\b(?:searchParams|request\.nextUrl\.searchParams|url\.searchParams)\.get\s*\(\s*['"`](?:code|access_token|id_token|refresh_token)['"`]\s*\)/gi,
    /\b(?:router\.query|route\.query|query)\.(?:code|access_token|id_token|refresh_token)\b/gi,
    /\bnew URLSearchParams\s*\(\s*(?:window\.)?location\.hash(?:\.slice\(\s*1\s*\)|\.replace\([^)]*\))?\s*\)/gi,
    /\b(?:window\.)?location\.hash\b/gi,
    /\b(?:exchangeCodeForSession|handleAuthCallback|authCallback|oauthCallback)\b/gi,
  ];

  const count = patterns.reduce((total, pattern) => total + (code.match(pattern)?.length ?? 0), 0);
  return count + (/callback/i.test(filePath) ? 1 : 0);
}

function countAuthCallbackExchangeSignals(code: string): number {
  const patterns = [
    /\b(?:exchangeCodeForSession|exchangeTokenForSession|completeAuthCallback|finalizeAuthCallback|handleAuthCallback)\b/gi,
    /\b(?:auth|supabase\.auth)\.[A-Za-z0-9_]*exchange[A-Za-z0-9_]*\s*\(/gi,
  ];

  return patterns.reduce((total, pattern) => total + (code.match(pattern)?.length ?? 0), 0);
}

function countAuthCallbackExchangeErrorSignals(code: string): number {
  const patterns = [
    /\b(?:exchangeCodeForSession|exchangeTokenForSession|completeAuthCallback|finalizeAuthCallback|handleAuthCallback)\b[\s\S]{0,240}\.catch\s*\(/gi,
    /try\s*{[\s\S]{0,240}\b(?:exchangeCodeForSession|exchangeTokenForSession|completeAuthCallback|finalizeAuthCallback|handleAuthCallback)\b[\s\S]{0,240}catch\s*\(/gi,
    /\b(?:exchangeError|callbackExchangeError|tokenExchangeError|sessionExchangeError)\b/gi,
  ];

  return patterns.reduce((total, pattern) => total + (code.match(pattern)?.length ?? 0), 0);
}

function countAuthCallbackErrorSignals(code: string, filePath: string): number {
  const patterns = [
    /\b(?:searchParams|request\.nextUrl\.searchParams|url\.searchParams)\.get\s*\(\s*['"`](?:error|error_description|error_code|error_uri)['"`]\s*\)/gi,
    /\b(?:router\.query|route\.query|query)\.(?:error|error_description|error_code|error_uri)\b/gi,
    /\b(?:callbackError|oauthError|providerError|authCallbackError)\b/gi,
    /\b(?:toast|notify|notification)\.error\b/gi,
    />\s*(?:authentication failed|sign in failed|login failed|oauth error|provider error|unable to sign you in)\s*</gi,
  ];

  const count = patterns.reduce((total, pattern) => total + (code.match(pattern)?.length ?? 0), 0);
  return count + (/callback/i.test(filePath) && /\b(?:error|failed|failure)\b/i.test(code) ? 1 : 0);
}

function countAuthCallbackStateSignals(code: string): number {
  const patterns = [
    /\b(?:searchParams|request\.nextUrl\.searchParams|url\.searchParams)\.get\s*\(\s*['"`]state['"`]\s*\)/gi,
    /\b(?:router\.query|route\.query|query)\.state\b/gi,
    /\bnew URLSearchParams\s*\(\s*(?:window\.)?location\.hash(?:\.slice\(\s*1\s*\)|\.replace\([^)]*\))?\s*\)\.get\s*\(\s*['"`]state['"`]\s*\)/gi,
  ];

  return patterns.reduce((total, pattern) => total + (code.match(pattern)?.length ?? 0), 0);
}

function countAuthCallbackStateValidationSignals(code: string): number {
  let count = 0;

  if (/\b(?:validateState|verifyState|assertState|compareState|checkState)\s*\(/i.test(code)) {
    count += 1;
  }

  if (
    countStateLikeMemberCalls(code, ['sessionStorage', 'localStorage'], ['getItem']) > 0 &&
    hasStateComparison(code)
  ) {
    count += 1;
  }

  if (
    countStateLikeMemberCalls(code, ['cookies', 'cookie', 'cookieStore'], ['get', 'getAll']) > 0 &&
    hasStateComparison(code)
  ) {
    count += 1;
  }

  if (
    /\b(?:state|providerState|callbackState|returnedState)\b\s*(?:===|==|!==|!=)\s*\b(?:expectedState|storedState|sessionState|oauthState|csrfState)\b/i.test(
      code,
    ) ||
    /\b(?:expectedState|storedState|sessionState|oauthState|csrfState)\b\s*(?:===|==|!==|!=)\s*\b(?:state|providerState|callbackState|returnedState)\b/i.test(
      code,
    )
  ) {
    count += 1;
  }

  return count;
}

function hasStateComparison(code: string): boolean {
  return /(?:state|providerState|callbackState|returnedState|expectedState|storedState|sessionState|oauthState|csrfState)\s*(?:===|==|!==|!=)/i.test(
    code,
  );
}

function countStateLikeMemberCalls(code: string, receivers: string[], methods: string[]): number {
  const lowerCode = code.toLowerCase();
  let count = 0;

  for (const receiver of receivers) {
    const receiverLower = receiver.toLowerCase();
    for (
      let index = lowerCode.indexOf(receiverLower);
      index !== -1;
      index = lowerCode.indexOf(receiverLower, index + receiverLower.length)
    ) {
      let cursor = index + receiverLower.length;
      cursor = skipInlineWhitespace(lowerCode, cursor);
      if (lowerCode[cursor] !== '.') continue;
      cursor = skipInlineWhitespace(lowerCode, cursor + 1);

      for (const method of methods) {
        const methodLower = method.toLowerCase();
        if (!lowerCode.startsWith(methodLower, cursor)) continue;
        const afterMethod = skipInlineWhitespace(lowerCode, cursor + methodLower.length);
        if (lowerCode[afterMethod] !== '(') continue;
        if (callHasStateLikeStringArgument(code, afterMethod)) {
          count += 1;
        }
      }
    }
  }

  return count;
}

function countStateLikeFunctionCalls(code: string, names: string[]): number {
  const lowerCode = code.toLowerCase();
  let count = 0;

  for (const name of names) {
    const nameLower = name.toLowerCase();
    for (
      let index = lowerCode.indexOf(nameLower);
      index !== -1;
      index = lowerCode.indexOf(nameLower, index + nameLower.length)
    ) {
      const afterName = skipInlineWhitespace(lowerCode, index + nameLower.length);
      if (lowerCode[afterName] === '(' && callHasStateLikeStringArgument(code, afterName)) {
        count += 1;
      }
    }
  }

  return count;
}

function skipInlineWhitespace(value: string, index: number): number {
  let cursor = index;
  while (cursor < value.length) {
    const char = value[cursor];
    if (char !== ' ' && char !== '\t' && char !== '\n' && char !== '\r') break;
    cursor += 1;
  }
  return cursor;
}

function callHasStateLikeStringArgument(code: string, openParenIndex: number): boolean {
  const closeParenIndex = findCallCloseParen(code, openParenIndex, 240);
  if (closeParenIndex === -1) return false;
  return containsStateLikeStringLiteral(code.slice(openParenIndex + 1, closeParenIndex));
}

function findCallCloseParen(code: string, openParenIndex: number, maxLength: number): number {
  const maxIndex = Math.min(code.length, openParenIndex + maxLength);
  let quote: string | null = null;
  let escaped = false;

  for (let index = openParenIndex + 1; index < maxIndex; index += 1) {
    const char = code[index]!;
    if (quote) {
      if (escaped) {
        escaped = false;
      } else if (char === '\\') {
        escaped = true;
      } else if (char === quote) {
        quote = null;
      }
      continue;
    }

    if (char === "'" || char === '"' || char === '`') {
      quote = char;
    } else if (char === ')') {
      return index;
    }
  }

  return -1;
}

function containsStateLikeStringLiteral(value: string): boolean {
  let quote: string | null = null;
  let literal = '';
  let escaped = false;

  for (const char of value) {
    if (!quote) {
      if (char === "'" || char === '"' || char === '`') {
        quote = char;
        literal = '';
      }
      continue;
    }

    if (escaped) {
      literal += char;
      escaped = false;
    } else if (char === '\\') {
      escaped = true;
    } else if (char === quote) {
      const lowerLiteral = literal.toLowerCase();
      if (lowerLiteral.includes('state') || lowerLiteral.includes('csrf')) return true;
      quote = null;
    } else {
      literal += char;
    }
  }

  return false;
}

function countAuthCallbackStateStorageSignals(code: string): number {
  return (
    countStateLikeMemberCalls(code, ['sessionStorage', 'localStorage'], ['getItem']) +
    countStateLikeMemberCalls(code, ['cookies', 'cookie', 'cookieStore'], ['get', 'getAll'])
  );
}

function countAuthCallbackStateStorageClearSignals(code: string): number {
  return (
    countStateLikeMemberCalls(code, ['sessionStorage', 'localStorage'], ['removeItem']) +
    countStateLikeFunctionCalls(code, ['deleteCookie', 'clearCookie', 'removeCookie']) +
    countStateLikeMemberCalls(code, ['cookies', 'cookie', 'cookieStore'], ['delete', 'remove']) +
    countDocumentCookieStateClears(code)
  );
}

function countDocumentCookieStateClears(code: string): number {
  const lowerCode = code.toLowerCase();
  let count = 0;

  for (
    let index = lowerCode.indexOf('document.cookie');
    index !== -1;
    index = lowerCode.indexOf('document.cookie', index + 'document.cookie'.length)
  ) {
    const assignmentIndex = lowerCode.indexOf('=', index + 'document.cookie'.length);
    if (assignmentIndex === -1 || assignmentIndex - index > 48) continue;

    const endIndex = findCookieAssignmentEnd(lowerCode, assignmentIndex + 1);
    const assignment = lowerCode.slice(assignmentIndex + 1, endIndex);
    const mentionsStateToken = assignment.includes('state') || assignment.includes('csrf');
    const expiresImmediately =
      assignment.includes('max-age=0') ||
      assignment.includes('max-age = 0') ||
      assignment.includes('thu, 01 jan 1970');

    if (mentionsStateToken && expiresImmediately) {
      count += 1;
    }
  }

  return count;
}

function findCookieAssignmentEnd(code: string, startIndex: number): number {
  const maxIndex = Math.min(code.length, startIndex + 320);
  for (let index = startIndex; index < maxIndex; index += 1) {
    const char = code[index];
    if (char === '\n' || char === '\r') return index;
  }
  return maxIndex;
}

function countAuthCallbackUrlScrubSignals(code: string): number {
  const patterns = [
    /\bhistory\.replaceState\s*\(/gi,
    /\brouter\.replace\s*\(/gi,
    /\bwindow\.history\.replaceState\s*\(/gi,
    /\b(?:redirect|navigate|push|replace)\s*\(\s*['"`]\/(?!\/)[^'"`]*['"`]/gi,
    /\bwindow\.location\.replace\s*\(\s*['"`]\/(?!\/)[^'"`]*['"`]/gi,
    /\b(?:window\.)?location\.hash\s*=\s*['"`]\s*['"`]/gi,
  ];

  return patterns.reduce((total, pattern) => total + (code.match(pattern)?.length ?? 0), 0);
}

function countAuthExitSignals(code: string): number {
  const patterns = [
    /\b(?:log\s*out|logout|sign\s*out|signout|sign-out)\b/i,
    /\b(?:supabase\.auth\.signOut|auth\.signOut|session\.signOut)\s*\(/,
    /\/(?:logout|signout|sign-out)\b/i,
  ];

  return patterns.reduce((count, pattern) => count + (pattern.test(code) ? 1 : 0), 0);
}

function countAuthSessionTeardownSignals(code: string): number {
  const patterns = [
    /\b(?:supabase\.auth\.signOut|auth\.signOut|session\.signOut)\s*\(/,
    /\b(?:clearSession|resetSession|destroySession|invalidateSession|revokeSession|endSession|terminateSession|removeSession)\s*\(/,
    /\b(?:deleteCookie|clearCookie|removeCookie)\s*\(\s*['"`]?(?:auth|session|token|accessToken|refreshToken|user)[^'"`)]*['"`]?\s*\)/i,
    /\b(?:cookies?|cookieStore)\.(?:delete|remove)\s*\(\s*['"`]?(?:auth|session|token|accessToken|refreshToken|user)[^'"`)]*['"`]?\s*\)/i,
    /\b(?:localStorage|sessionStorage)\.removeItem\s*\(\s*['"`]?(?:auth|session|token|accessToken|refreshToken|user)[^'"`)]*['"`]?\s*\)/i,
  ];

  return patterns.reduce((count, pattern) => count + (pattern.test(code) ? 1 : 0), 0);
}

function countAuthStorageClearSignals(code: string): number {
  const patterns = [
    /\b(?:localStorage|sessionStorage)\.removeItem\s*\(\s*['"`]?(?:auth|session|token|accessToken|refreshToken|user)[^'"`)]*['"`]?\s*\)/i,
    /\b(?:localStorage|sessionStorage)\.clear\s*\(/,
  ];

  return patterns.reduce((count, pattern) => count + (pattern.test(code) ? 1 : 0), 0);
}

function countAuthCookieClearSignals(code: string): number {
  const patterns = [
    /\b(?:deleteCookie|clearCookie|removeCookie)\s*\(\s*['"`]?(?:auth|session|token|accessToken|refreshToken|user)[^'"`)]*['"`]?\s*\)/i,
    /\b(?:cookies?|cookieStore)\.(?:delete|remove)\s*\(\s*['"`]?(?:auth|session|token|accessToken|refreshToken|user)[^'"`)]*['"`]?\s*\)/i,
    /\bdocument\.cookie\s*=\s*[^;\n]*(?:auth|session|token|accessToken|refreshToken|user)[^;\n]*(?:expires\s*=\s*Thu,\s*01 Jan 1970|max-age\s*=\s*0)/i,
  ];

  return patterns.reduce((count, pattern) => count + (pattern.test(code) ? 1 : 0), 0);
}

function countAuthCacheClientSignals(code: string): number {
  const patterns = [
    /from\s+['"`](?:@tanstack\/react-query|react-query)['"`]/gi,
    /\b(?:useQueryClient|queryClient|QueryClient)\b/g,
    /from\s+['"`]@apollo\/client['"`]/gi,
    /\b(?:useApolloClient|apolloClient|ApolloClient|InMemoryCache)\b/g,
    /from\s+['"`](?:urql|@urql\/core)['"`]/gi,
    /\b(?:urqlClient|cacheExchange)\b/g,
    /from\s+['"`]swr['"`]/gi,
    /\buseSWRConfig\b/g,
    /\bapi\.util\.resetApiState\b/g,
  ];

  return patterns.reduce((count, pattern) => count + (code.match(pattern)?.length ?? 0), 0);
}

function countAuthCacheClearSignals(code: string): number {
  const patterns = [
    /\b(?:queryClient|useQueryClient\s*\(\s*\))\.(?:clear|removeQueries|resetQueries|invalidateQueries|cancelQueries)\s*\(/gi,
    /\b(?:apolloClient|client)\.(?:resetStore|clearStore|stop)\s*\(/gi,
    /\b(?:cache|apolloClient\.cache)\.(?:evict|gc|modify)\s*\(/gi,
    /\b(?:mutate|useSWRConfig\s*\(\s*\)\.mutate)\s*\([^,\n]+,\s*(?:undefined|null|false)\b/gi,
    /\b(?:dispatch|store\.dispatch)\s*\(\s*api\.util\.resetApiState\s*\(\s*\)\s*\)/gi,
  ];

  return patterns.reduce((count, pattern) => count + (code.match(pattern)?.length ?? 0), 0);
}

function countAuthRefreshSignals(code: string): number {
  let count = 0;

  if (
    /\b(?:setInterval|setTimeout)\s*\(/i.test(code) &&
    /\b(?:refreshSession|refreshToken|renewSession|getSession|startAutoRefresh)\b/i.test(code)
  ) {
    count += 1;
  }

  if (/\b(?:supabase\.auth|auth)\.onAuthStateChange\s*\(/i.test(code)) {
    count += 1;
  }

  if (/\bstartAutoRefresh\s*\(/i.test(code)) {
    count += 1;
  }

  return count;
}

function countAuthRefreshClearSignals(code: string): number {
  const patterns = [
    /\bclearInterval\s*\(/gi,
    /\bclearTimeout\s*\(/gi,
    /\b(?:subscription|authSubscription|authListener)\.unsubscribe\s*\(/gi,
    /\bstopAutoRefresh\s*\(/gi,
  ];

  return patterns.reduce((count, pattern) => count + (code.match(pattern)?.length ?? 0), 0);
}

function countAuthRealtimeSignals(code: string): number {
  const patterns = [
    /\bnew\s+WebSocket\s*\(/gi,
    /\bnew\s+EventSource\s*\(/gi,
    /\bsupabase\.channel\s*\(/gi,
    /\bpusher\.subscribe\s*\(/gi,
    /\becho\.(?:private|channel|join)\s*\(/gi,
  ];

  return patterns.reduce((count, pattern) => count + (code.match(pattern)?.length ?? 0), 0);
}

function countAuthRealtimeClearSignals(code: string): number {
  const patterns = [
    /\b(?:socket|ws|channel|subscription|realtime|eventSource)\.(?:close|disconnect|unsubscribe|remove|stop)\s*\(/gi,
    /\bsupabase\.removeChannel\s*\(/gi,
    /\bpusher\.unsubscribe\s*\(/gi,
    /\becho\.(?:leave|leaveChannel|disconnect)\s*\(/gi,
  ];

  return patterns.reduce((count, pattern) => count + (code.match(pattern)?.length ?? 0), 0);
}

function countAuthCoordinationSignals(code: string): number {
  const patterns = [
    /\bnew\s+BroadcastChannel\s*\(/gi,
    /\b(?:window\.)?addEventListener\s*\(\s*['"`]storage['"`]/gi,
    /\b(?:window\.)?onstorage\s*=/gi,
  ];

  return patterns.reduce((count, pattern) => count + (code.match(pattern)?.length ?? 0), 0);
}

function countAuthCoordinationClearSignals(code: string): number {
  const patterns = [
    /\b(?:auth|session|sync|broadcast)[A-Za-z0-9_$]*\.close\s*\(/gi,
    /\b(?:window\.)?removeEventListener\s*\(\s*['"`]storage['"`]/gi,
    /\b(?:window\.)?onstorage\s*=\s*null\b/gi,
  ];

  return patterns.reduce((count, pattern) => count + (code.match(pattern)?.length ?? 0), 0);
}

function countAuthEntrySignals(code: string): number {
  const patterns = [
    /\b(?:signIn|signin|logIn|login|register|signUp|signup|createAccount|forgotPassword|resetPassword)\s*\(/i,
    />\s*(?:sign in|log in|register|sign up|create account|forgot password|reset password)\s*</i,
    /\b(?:type|autoComplete|autocomplete)\s*=\s*["'{](?:email|username|current-password|new-password|password)/i,
    /<form\b/i,
  ];

  return patterns.reduce((count, pattern) => count + (pattern.test(code) ? 1 : 0), 0);
}

function countSignInFlowSignals(code: string, filePath: string): number {
  const patterns = [
    /\b(?:signIn|signin|logIn|login)\s*\(/i,
    />\s*(?:sign in|log in)\s*</i,
    /\bcurrent-password\b/i,
    /(?:^|\/)(?:login|log-?in|sign-?in)(?:\/|\.|$)/i,
  ];

  return patterns.reduce(
    (count, pattern) => count + (pattern.test(code) || pattern.test(filePath) ? 1 : 0),
    0,
  );
}

function countRecoveryFlowSignals(code: string, filePath: string): number {
  const patterns = [
    /\b(?:forgotPassword|resetPassword|sendPasswordReset|requestPasswordReset|recoverAccount|recoverPassword)\s*\(/i,
    />\s*(?:forgot password|reset password|recover account)\s*</i,
    /\bnew-password\b/i,
    /(?:^|\/)(?:forgot-password|reset-password|password-reset|recover|recovery)(?:\/|\.|$)/i,
  ];

  return patterns.reduce(
    (count, pattern) => count + (pattern.test(code) || pattern.test(filePath) ? 1 : 0),
    0,
  );
}

function countSignUpFlowSignals(code: string, filePath: string): number {
  const patterns = [
    /\b(?:signUp|signup|register|createAccount)\s*\(/i,
    />\s*(?:sign up|register|create account)\s*</i,
    /(?:^|\/)(?:signup|sign-up|register)(?:\/|\.|$)/i,
  ];

  return patterns.reduce(
    (count, pattern) => count + (pattern.test(code) || pattern.test(filePath) ? 1 : 0),
    0,
  );
}

function countProtectedSurfaceSignals(code: string): number {
  const patterns = [
    /['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`]/i,
    /\b(?:href|to|route|path)\s*[:=]\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`]/i,
    /\b(?:navigate|redirect|push|replace)\s*\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`]/i,
  ];

  return patterns.reduce((count, pattern) => count + (pattern.test(code) ? 1 : 0), 0);
}

function countAuthProtectedRedirectSignals(code: string): number {
  const patterns = [
    /\b(?:redirect|navigate|push|replace)\s*\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`]/i,
    /\bNextResponse\.redirect\s*\(\s*['"`]\/(?:app|dashboard|workspace|settings|billing|account|profile|admin)(?:\/[^'"`]*)?['"`]/i,
  ];

  return patterns.reduce((count, pattern) => count + (pattern.test(code) ? 1 : 0), 0);
}

function countAuthAnonymousRedirectSignals(code: string): number {
  const patterns = [
    /\b(?:redirect|navigate|push|replace)\s*\(\s*['"`]\/(?:auth|login|log-?in|sign-?in|sign-?up|register|forgot-password|reset-password)?(?:[/?#][^'"`]*)?['"`]/i,
    /\bNextResponse\.redirect\s*\(\s*['"`]\/(?:auth|login|log-?in|sign-?in|sign-?up|register|forgot-password|reset-password)?(?:[/?#][^'"`]*)?['"`]/i,
  ];

  return patterns.reduce((count, pattern) => count + (pattern.test(code) ? 1 : 0), 0);
}

const OPEN_REDIRECT_QUERY_KEY_PATTERN = String.raw`next|redirect(?:To|[_-]to)?|return(?:To|[_-]to)?|callback(?:Url|[_-]url)?|continue(?:Url|[_-]url)?|from`;
const OPEN_REDIRECT_SOURCE_PATTERN = String.raw`\b(?:searchParams|(?:request|req)\.nextUrl\.searchParams|url\.searchParams)\.get\s*\(\s*['"\`](?:${OPEN_REDIRECT_QUERY_KEY_PATTERN})['"\`]\s*\)|\b(?:router\.query|route\.query|query)\.(?:${OPEN_REDIRECT_QUERY_KEY_PATTERN})\b|\b(?:new\s+)?URLSearchParams\s*\(\s*(?:(?:window|globalThis|document|self|parent|top)\.)?location\.(?:search|hash)(?:\.slice\(\s*1\s*\)|\.replace\([^)]*\))?\s*\)\.get\s*\(\s*['"\`](?:${OPEN_REDIRECT_QUERY_KEY_PATTERN})['"\`]\s*\)|\bnew\s+URL\(\s*(?:request|req)\.url\s*\)\.searchParams\.get\s*\(\s*['"\`](?:${OPEN_REDIRECT_QUERY_KEY_PATTERN})['"\`]\s*\)`;
const OPEN_REDIRECT_SOURCE_REGEX = new RegExp(OPEN_REDIRECT_SOURCE_PATTERN, 'i');
const OPEN_REDIRECT_QUERY_KEY_REGEX = new RegExp(`^(?:${OPEN_REDIRECT_QUERY_KEY_PATTERN})$`, 'i');
const OPEN_REDIRECT_QUERY_CARRIER_REGEX = /\b(?:searchParams|router\.query|route\.query|query)\b/i;
const OPEN_REDIRECT_QUERY_CONTAINER_BASE_REGEX = /\b(?:router|route)\b/i;
const LOCATION_QUERY_SOURCE_REGEX =
  /\b(?:(?:window|globalThis|document|self|parent|top)\.)?location\.(?:search|hash)(?:\.slice\(\s*1\s*\)|\.replace\([^)]*\))?\b/i;
const LOCATION_URL_INPUT_REGEX =
  /\b(?:(?:(?:window|globalThis|document|self|parent|top)\.)?location\.(?:href|search|hash)|(?:request|req)\.url)\b/i;
const LOCATION_URL_SOURCE_REGEX =
  /\bnew\s+URL\(\s*(?:(?:(?:window|globalThis|document|self|parent|top)\.)?location\.(?:href|search|hash)|(?:request|req)\.url)\s*\)/i;
const NEXT_URL_SOURCE_REGEX = /\b(?:request|req)\.nextUrl\b/i;
const REQUEST_OBJECT_SOURCE_REGEX = /\b(?:request|req)\b/i;

function countAuthOpenRedirectSignals(code: string): number {
  const patterns = [
    new RegExp(
      String.raw`\b(?:redirect|navigate|push|replace)\s*\(\s*[^)]*(?:${OPEN_REDIRECT_SOURCE_PATTERN})[^)]*\)`,
      'gi',
    ),
    new RegExp(
      String.raw`\b(?:window|globalThis|document|self|parent|top)\.location(?:\.href)?\s*=\s*[^;\n]*(?:${OPEN_REDIRECT_SOURCE_PATTERN})`,
      'gi',
    ),
  ];

  return patterns.reduce((count, pattern) => count + (code.match(pattern)?.length ?? 0), 0);
}

function propertyPathLooksLikeOpenRedirectQueryCarrier(propertyPath: string[]): boolean {
  return propertyPath.length > 0 && OPEN_REDIRECT_QUERY_CARRIER_REGEX.test(propertyPath.join('.'));
}

function propertyPathLooksLikeOpenRedirectSearchParamsCarrier(propertyPath: string[]): boolean {
  return propertyPath.length > 0 && propertyPath[propertyPath.length - 1] === 'searchParams';
}

function propertyPathLooksLikeOpenRedirectQueryContainerBase(propertyPath: string[]): boolean {
  return (
    propertyPath.length > 0 && OPEN_REDIRECT_QUERY_CONTAINER_BASE_REGEX.test(propertyPath.join('.'))
  );
}

function expressionLooksLikeOpenRedirectQueryGetterFunction(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression> = new Map(),
  namedPropertyAliases: Map<string, NamedPropertyAlias> = new Map(),
  seenIdentifiers: Set<string> = new Set(),
  seenFunctions: Set<string> = new Set(),
): boolean {
  if (!expression) return false;

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    );
  }

  const namedFunctions = getCachedNamedFunctionLikeDeclarations(sourceFile);
  const directFunctionLike = resolveFunctionLikeHandler(expression, namedFunctions);
  const directFunctionKey = directFunctionLike ? getFunctionLikeCacheKey(directFunctionLike) : null;
  if (directFunctionLike && directFunctionKey && !seenFunctions.has(directFunctionKey)) {
    const nextSeenFunctions = new Set(seenFunctions);
    nextSeenFunctions.add(directFunctionKey);
    return getFunctionLikeReturnExpressions(directFunctionLike).some((returnedExpression) =>
      expressionLooksLikeOpenRedirectQueryGetterFunction(
        returnedExpression,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
        nextSeenFunctions,
      ),
    );
  }

  if (
    ts.isBinaryExpression(expression) &&
    (expression.operatorToken.kind === ts.SyntaxKind.QuestionQuestionToken ||
      expression.operatorToken.kind === ts.SyntaxKind.BarBarToken)
  ) {
    return (
      expressionLooksLikeOpenRedirectQueryGetterFunction(
        expression.left,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
        seenFunctions,
      ) ||
      expressionLooksLikeOpenRedirectQueryGetterFunction(
        expression.right,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
        seenFunctions,
      )
    );
  }

  if (ts.isConditionalExpression(expression)) {
    return (
      expressionLooksLikeOpenRedirectQueryGetterFunction(
        expression.whenTrue,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
        seenFunctions,
      ) ||
      expressionLooksLikeOpenRedirectQueryGetterFunction(
        expression.whenFalse,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
        seenFunctions,
      )
    );
  }

  if (ts.isTemplateExpression(expression)) {
    return expression.templateSpans.some((span) =>
      expressionLooksLikeOpenRedirectQueryGetterFunction(
        span.expression,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
        seenFunctions,
      ),
    );
  }

  if (ts.isTaggedTemplateExpression(expression)) {
    return expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.template,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    );
  }

  if (
    ts.isNewExpression(expression) &&
    expression.arguments &&
    expression.arguments.length > 0 &&
    expressionLooksLikeBrowserGlobalBooleanHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    ts.isNewExpression(expression) &&
    expression.arguments &&
    expression.arguments.length > 0 &&
    expressionLooksLikeBrowserGlobalNumberHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    ts.isNewExpression(expression) &&
    expression.arguments &&
    expression.arguments.length > 0 &&
    expressionLooksLikeBrowserGlobalObjectHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    ts.isNewExpression(expression) &&
    expression.arguments &&
    expression.arguments.length > 0 &&
    expressionLooksLikeBrowserGlobalStringHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    expression.arguments.length > 0 &&
    expressionLooksLikeBrowserGlobalSymbolHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    ts.isIdentifier(expression.expression.expression) &&
    expression.expression.expression.text === 'Reflect' &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expression.arguments.length > 2 &&
    expressionLooksLikeBrowserGlobalSymbolHelper(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[2], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'call') &&
    expression.arguments.length > 1 &&
    expressionLooksLikeBrowserGlobalSymbolHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[1],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expressionLooksLikeBrowserGlobalSymbolHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[1], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    expression.arguments.length > 0 &&
    expressionLooksLikeBrowserGlobalBigIntHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    ts.isIdentifier(expression.expression.expression) &&
    expression.expression.expression.text === 'Reflect' &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expression.arguments.length > 2 &&
    expressionLooksLikeBrowserGlobalBigIntHelper(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[2], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'call') &&
    expression.arguments.length > 1 &&
    expressionLooksLikeBrowserGlobalBigIntHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[1],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expressionLooksLikeBrowserGlobalBigIntHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[1], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    expression.arguments.length > 0 &&
    expressionLooksLikeBrowserGlobalBooleanHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    ts.isIdentifier(expression.expression.expression) &&
    expression.expression.expression.text === 'Reflect' &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expression.arguments.length > 2 &&
    expressionLooksLikeBrowserGlobalBooleanHelper(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[2], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'call') &&
    expression.arguments.length > 1 &&
    expressionLooksLikeBrowserGlobalBooleanHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[1],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expressionLooksLikeBrowserGlobalBooleanHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[1], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    expression.arguments.length > 0 &&
    expressionLooksLikeBrowserGlobalNumberHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    ts.isIdentifier(expression.expression.expression) &&
    expression.expression.expression.text === 'Reflect' &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expression.arguments.length > 2 &&
    expressionLooksLikeBrowserGlobalNumberHelper(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[2], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'call') &&
    expression.arguments.length > 1 &&
    expressionLooksLikeBrowserGlobalNumberHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[1],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expressionLooksLikeBrowserGlobalNumberHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[1], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    expression.arguments.length > 0 &&
    expressionLooksLikeBrowserGlobalObjectHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    ts.isIdentifier(expression.expression.expression) &&
    expression.expression.expression.text === 'Reflect' &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expression.arguments.length > 2 &&
    expressionLooksLikeBrowserGlobalObjectHelper(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[2], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'call') &&
    expression.arguments.length > 1 &&
    expressionLooksLikeBrowserGlobalObjectHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[1],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expressionLooksLikeBrowserGlobalObjectHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[1], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    ts.isIdentifier(expression.expression) &&
    [
      'String',
      'atob',
      'btoa',
      'decodeURI',
      'decodeURIComponent',
      'encodeURI',
      'encodeURIComponent',
      'escape',
      'unescape',
    ].includes(expression.expression.text) &&
    expression.arguments.length > 0 &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    expression.arguments.length > 0 &&
    expressionLooksLikeJsonStringifyHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    ts.isIdentifier(expression.expression.expression) &&
    expression.expression.expression.text === 'Reflect' &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expression.arguments.length > 2 &&
    expressionLooksLikeJsonStringifyHelper(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[2], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'call') &&
    expression.arguments.length > 1 &&
    expressionLooksLikeJsonStringifyHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[1],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expressionLooksLikeJsonStringifyHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[1], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    expression.arguments.length > 0 &&
    expressionLooksLikeJsonParseHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    ts.isIdentifier(expression.expression.expression) &&
    expression.expression.expression.text === 'Reflect' &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expression.arguments.length > 2 &&
    expressionLooksLikeJsonParseHelper(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[2], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'call') &&
    expression.arguments.length > 1 &&
    expressionLooksLikeJsonParseHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[1],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expressionLooksLikeJsonParseHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[1], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    expression.arguments.length > 0 &&
    expressionLooksLikeStructuredCloneHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    ts.isIdentifier(expression.expression.expression) &&
    expression.expression.expression.text === 'Reflect' &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expression.arguments.length > 2 &&
    expressionLooksLikeStructuredCloneHelper(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[2], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'call') &&
    expression.arguments.length > 1 &&
    expressionLooksLikeStructuredCloneHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[1],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expressionLooksLikeStructuredCloneHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[1], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    expression.arguments.length > 0 &&
    expressionLooksLikeBrowserGlobalStringHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    ts.isIdentifier(expression.expression.expression) &&
    expression.expression.expression.text === 'Reflect' &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expression.arguments.length > 2 &&
    expressionLooksLikeBrowserGlobalStringHelper(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[2], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'call') &&
    expression.arguments.length > 1 &&
    expressionLooksLikeBrowserGlobalStringHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[1],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expressionLooksLikeBrowserGlobalStringHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[1], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    expression.arguments.length > 0 &&
    expressionLooksLikeBrowserGlobalBase64Helper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    expression.arguments.length > 0 &&
    expressionLooksLikeBrowserGlobalUriCodecHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    ts.isIdentifier(expression.expression.expression) &&
    expression.expression.expression.text === 'Reflect' &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expression.arguments.length > 2 &&
    expressionLooksLikeBrowserGlobalUriCodecHelper(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[2], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'call') &&
    expression.arguments.length > 1 &&
    expressionLooksLikeBrowserGlobalUriCodecHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[1],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expressionLooksLikeBrowserGlobalUriCodecHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[1], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    ts.isIdentifier(expression.expression.expression) &&
    expression.expression.expression.text === 'Reflect' &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expression.arguments.length > 2 &&
    expressionLooksLikeBrowserGlobalBase64Helper(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[2], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'call') &&
    expression.arguments.length > 1 &&
    expressionLooksLikeBrowserGlobalBase64Helper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[1],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expressionLooksLikeBrowserGlobalBase64Helper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[1], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    (ts.isIdentifier(expression.expression) || isMemberAccessExpression(expression.expression)) &&
    expression.arguments.length > 0 &&
    expressionLooksLikeBufferFromHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(
      expression.expression,
      'String',
      'atob',
      'btoa',
      'decodeURI',
      'decodeURIComponent',
      'encodeURI',
      'encodeURIComponent',
      'escape',
      'unescape',
    ) &&
    expression.arguments.length > 0 &&
    expressionLooksLikeWindowObjectSource(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'exec') &&
    expression.arguments.length > 0 &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    ts.isIdentifier(expression.expression.expression) &&
    expression.expression.expression.text === 'Reflect' &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expression.arguments.length > 2 &&
    expressionLooksLikeBufferFromHelper(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[2], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'call') &&
    expression.arguments.length > 1 &&
    expressionLooksLikeBufferFromHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[1],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    expressionLooksLikeBufferFromHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      getAliasedApplyArgumentExpression(expression.arguments[1], 0, namedExpressions, new Set()),
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'from') &&
    ts.isIdentifier(expression.expression.expression) &&
    expression.expression.expression.text === 'Buffer' &&
    expression.arguments.length > 0 &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'at') &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'shift') &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'pop') &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'find', 'findLast') &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'filter') &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'slice') &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(
      expression.expression,
      'reverse',
      'toReversed',
      'sort',
      'toSorted',
      'concat',
      'flat',
      'join',
      'map',
      'flatMap',
      'splice',
      'toSpliced',
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'reduce', 'reduceRight') &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'trim') &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(
      expression.expression,
      'trim',
      'trimStart',
      'trimLeft',
      'trimEnd',
      'trimRight',
      'padStart',
      'padEnd',
      'repeat',
      'replace',
      'replaceAll',
      'slice',
      'split',
      'substr',
      'substring',
      'toLowerCase',
      'toUpperCase',
      'toLocaleLowerCase',
      'toLocaleUpperCase',
      'toLocaleString',
      'toString',
      'toWellFormed',
      'valueOf',
      'normalize',
      'match',
      'matchAll',
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'values', 'next') &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'bind') &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'get', 'getAll') &&
    expressionLooksLikeOpenRedirectSearchParamsCarrier(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isElementLikeAccessExpression(expression) &&
    ts.isNumericLiteral(expression.argumentExpression) &&
    expression.argumentExpression.text === '1' &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'value') &&
    isCallLikeExpression(expression.expression.expression) &&
    isMemberAccessExpression(expression.expression.expression.expression) &&
    isMemberAccessNamed(expression.expression.expression.expression, 'next') &&
    isCallLikeExpression(expression.expression.expression.expression.expression) &&
    isMemberAccessExpression(expression.expression.expression.expression.expression.expression) &&
    isMemberAccessNamed(
      expression.expression.expression.expression.expression.expression,
      'entries',
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.expression.expression.expression.expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isElementLikeAccessExpression(expression) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(expression, 'value') &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isPropertyLikeAccessExpression(expression.expression) &&
    ts.isIdentifier(expression.expression.expression) &&
    expression.expression.expression.text === 'Array' &&
    isPropertyNamed(expression.expression.name, 'from') &&
    expression.arguments.length > 0 &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (
    ts.isArrayLiteralExpression(expression) &&
    expression.elements.some(
      (element) =>
        ts.isSpreadElement(element) &&
        expressionLooksLikeOpenRedirectQueryGetterFunction(
          element.expression,
          sourceFile,
          namedExpressions,
          namedPropertyAliases,
          seenIdentifiers,
          seenFunctions,
        ),
    )
  ) {
    return true;
  }

  if (isCallLikeExpression(expression)) {
    const functionResolution = resolveTrackedOpenRedirectFunctionLike(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      new Set(),
      seenFunctions,
    );
    const functionLike = functionResolution?.functionLike ?? null;
    const functionKey = functionLike ? getFunctionLikeCacheKey(functionLike) : null;
    if (functionLike && functionKey && functionResolution && !seenFunctions.has(functionKey)) {
      const boundExpressions = bindFunctionLikeArguments(
        functionLike,
        expression.arguments,
        functionResolution.namedExpressions,
      );
      const nextSeenFunctions = new Set(seenFunctions);
      nextSeenFunctions.add(functionKey);
      return getFunctionLikeReturnExpressions(functionLike).some((returnedExpression) =>
        expressionLooksLikeOpenRedirectQueryGetterFunction(
          returnedExpression,
          sourceFile,
          boundExpressions,
          namedPropertyAliases,
          seenIdentifiers,
          nextSeenFunctions,
        ),
      );
    }
  }

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(expression, 'get', 'getAll') &&
    expressionLooksLikeOpenRedirectSearchParamsCarrier(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;

    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeOpenRedirectQueryGetterFunction(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
        seenFunctions,
      );
      seenIdentifiers.delete(expression.text);
      return result;
    }

    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      ['get', 'getAll'].includes(propertyAlias.propertyName) &&
      expressionLooksLikeOpenRedirectSearchParamsCarrier(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      )
    ) {
      return true;
    }
  }

  return false;
}

function expressionContainsOpenRedirectSource(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression> = new Map(),
  namedPropertyAliases: Map<string, NamedPropertyAlias> = new Map(),
  seenIdentifiers: Set<string> = new Set(),
  seenFunctions: Set<string> = new Set(),
): boolean {
  if (!expression) return false;
  if (OPEN_REDIRECT_SOURCE_REGEX.test(expression.getText(sourceFile))) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionContainsOpenRedirectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    );
  }

  if (ts.isBinaryExpression(expression)) {
    return (
      expressionContainsOpenRedirectSource(
        expression.left,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
        seenFunctions,
      ) ||
      expressionContainsOpenRedirectSource(
        expression.right,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
        seenFunctions,
      )
    );
  }

  if (ts.isConditionalExpression(expression)) {
    return (
      expressionContainsOpenRedirectSource(
        expression.condition,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
        seenFunctions,
      ) ||
      expressionContainsOpenRedirectSource(
        expression.whenTrue,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
        seenFunctions,
      ) ||
      expressionContainsOpenRedirectSource(
        expression.whenFalse,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
        seenFunctions,
      )
    );
  }

  if (ts.isTemplateExpression(expression)) {
    return expression.templateSpans.some((span) =>
      expressionContainsOpenRedirectSource(
        span.expression,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
        seenFunctions,
      ),
    );
  }

  if (ts.isTaggedTemplateExpression(expression)) {
    return expressionContainsOpenRedirectSource(
      expression.template,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    );
  }

  if (ts.isNewExpression(expression)) {
    return (expression.arguments ?? []).some((argument) =>
      expressionContainsOpenRedirectSource(
        argument,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
        seenFunctions,
      ),
    );
  }

  if (ts.isArrayLiteralExpression(expression)) {
    return expression.elements.some((element) => {
      if (ts.isSpreadElement(element)) {
        return expressionContainsOpenRedirectSource(
          element.expression,
          sourceFile,
          namedExpressions,
          namedPropertyAliases,
          seenIdentifiers,
          seenFunctions,
        );
      }
      return (
        ts.isExpression(element) &&
        expressionContainsOpenRedirectSource(
          element,
          sourceFile,
          namedExpressions,
          namedPropertyAliases,
          seenIdentifiers,
          seenFunctions,
        )
      );
    });
  }

  if (ts.isObjectLiteralExpression(expression)) {
    return expression.properties.some((property) => {
      if (ts.isPropertyAssignment(property)) {
        return expressionContainsOpenRedirectSource(
          property.initializer,
          sourceFile,
          namedExpressions,
          namedPropertyAliases,
          seenIdentifiers,
          seenFunctions,
        );
      }
      if (ts.isShorthandPropertyAssignment(property)) {
        return expressionContainsOpenRedirectSource(
          property.name,
          sourceFile,
          namedExpressions,
          namedPropertyAliases,
          seenIdentifiers,
          seenFunctions,
        );
      }
      if (ts.isSpreadAssignment(property)) {
        return expressionContainsOpenRedirectSource(
          property.expression,
          sourceFile,
          namedExpressions,
          namedPropertyAliases,
          seenIdentifiers,
          seenFunctions,
        );
      }
      return false;
    });
  }

  if (
    isPropertyLikeAccessExpression(expression) &&
    expressionContainsOpenRedirectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (isCallLikeExpression(expression)) {
    const functionResolution = resolveTrackedOpenRedirectFunctionLike(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      new Set(),
    );
    const functionLike = functionResolution?.functionLike ?? null;
    const functionKey = functionLike ? getFunctionLikeCacheKey(functionLike) : null;
    if (functionLike && functionKey && functionResolution && !seenFunctions.has(functionKey)) {
      const boundExpressions = bindFunctionLikeArguments(
        functionLike,
        expression.arguments,
        functionResolution.namedExpressions,
      );
      const nextSeenFunctions = new Set(seenFunctions);
      nextSeenFunctions.add(functionKey);
      if (
        getFunctionLikeReturnExpressions(functionLike).some((returnedExpression) =>
          expressionContainsOpenRedirectSource(
            returnedExpression,
            sourceFile,
            boundExpressions,
            namedPropertyAliases,
            seenIdentifiers,
            nextSeenFunctions,
          ),
        )
      ) {
        return true;
      }
    }
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    ts.isIdentifier(expression.expression.expression) &&
    expression.expression.expression.text === 'Reflect' &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    isOpenRedirectQueryKeyExpression(
      getAliasedApplyArgumentExpression(expression.arguments[2], 0, namedExpressions, new Set()),
      namedExpressions,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'call') &&
    expression.arguments.length > 1 &&
    isOpenRedirectQueryKeyExpression(expression.arguments[1], namedExpressions, seenIdentifiers) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'apply') &&
    isOpenRedirectQueryKeyExpression(
      getAliasedApplyArgumentExpression(expression.arguments[1], 0, namedExpressions, new Set()),
      namedExpressions,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    expression.arguments.length > 0 &&
    isOpenRedirectQueryKeyExpression(expression.arguments[0], namedExpressions, seenIdentifiers) &&
    expressionLooksLikeOpenRedirectQueryGetterFunction(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'get') &&
    expression.arguments.length > 0 &&
    isOpenRedirectQueryKeyExpression(expression.arguments[0], namedExpressions, seenIdentifiers) &&
    expressionLooksLikeOpenRedirectSearchParamsCarrier(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'getAll') &&
    expression.arguments.length > 0 &&
    isOpenRedirectQueryKeyExpression(expression.arguments[0], namedExpressions, seenIdentifiers) &&
    expressionLooksLikeOpenRedirectSearchParamsCarrier(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    expressionContainsOpenRedirectSource(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (isCallLikeExpression(expression)) {
    return expression.arguments.some((argument) =>
      expressionContainsOpenRedirectSource(
        argument,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
        seenFunctions,
      ),
    );
  }

  if (
    isPropertyLikeAccessExpression(expression) &&
    OPEN_REDIRECT_QUERY_KEY_REGEX.test(expression.name.text) &&
    expressionLooksLikeOpenRedirectQueryCarrier(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isElementLikeAccessExpression(expression) &&
    isOpenRedirectQueryKeyExpression(
      expression.argumentExpression,
      namedExpressions,
      seenIdentifiers,
    ) &&
    expressionLooksLikeOpenRedirectQueryCarrier(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isElementLikeAccessExpression(expression) &&
    expressionContainsOpenRedirectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
      seenFunctions,
    )
  ) {
    return true;
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) {
      return false;
    }
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionContainsOpenRedirectSource(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
        seenFunctions,
      );
      seenIdentifiers.delete(expression.text);
      return result;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      OPEN_REDIRECT_QUERY_KEY_REGEX.test(propertyAlias.propertyName) &&
      (expressionLooksLikeOpenRedirectQueryCarrier(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      ) ||
        propertyPathLooksLikeOpenRedirectQueryCarrier(propertyAlias.propertyPath.slice(0, -1)))
    ) {
      return true;
    }
    return false;
  }

  return false;
}

function isOpenRedirectQueryKeyExpression(
  expression: ts.Expression | undefined,
  namedExpressions: Map<string, ts.Expression> = new Map(),
  seenIdentifiers: Set<string> = new Set(),
): boolean {
  const value = getExpressionLiteralValue(expression);
  if (typeof value === 'string' && OPEN_REDIRECT_QUERY_KEY_REGEX.test(value)) {
    return true;
  }

  if (!expression) return false;
  if (
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression) ||
    ts.isParenthesizedExpression(expression)
  ) {
    return isOpenRedirectQueryKeyExpression(
      expression.expression,
      namedExpressions,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (!initializer) return false;
    seenIdentifiers.add(expression.text);
    const result = isOpenRedirectQueryKeyExpression(initializer, namedExpressions, seenIdentifiers);
    seenIdentifiers.delete(expression.text);
    return result;
  }

  return false;
}

function expressionLooksLikeOpenRedirectQueryCarrier(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;
  if (OPEN_REDIRECT_QUERY_CARRIER_REGEX.test(expression.getText(sourceFile))) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeOpenRedirectQueryCarrier(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (
    isCallLikeExpression(expression) &&
    isPropertyLikeAccessExpression(expression.expression) &&
    ts.isIdentifier(expression.expression.expression) &&
    expression.expression.expression.text === 'Object' &&
    isPropertyNamed(expression.expression.name, 'fromEntries') &&
    expression.arguments.length > 0
  ) {
    const entriesExpression = expression.arguments[0];
    if (
      expressionLooksLikeOpenRedirectSearchParamsCarrier(
        entriesExpression,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      )
    ) {
      return true;
    }
    if (
      expressionLooksLikeOpenRedirectEntriesCarrier(
        entriesExpression,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      )
    ) {
      return true;
    }
  }

  if (isPropertyLikeAccessExpression(expression) && isPropertyNamed(expression.name, 'query')) {
    return expressionLooksLikeOpenRedirectQueryContainerBase(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeOpenRedirectQueryCarrier(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      return result;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      (propertyPathLooksLikeOpenRedirectQueryCarrier(propertyAlias.propertyPath) ||
        (propertyAlias.propertyName === 'query' &&
          (expressionLooksLikeOpenRedirectQueryContainerBase(
            propertyAlias.initializer,
            sourceFile,
            namedExpressions,
            namedPropertyAliases,
            seenIdentifiers,
          ) ||
            propertyPathLooksLikeOpenRedirectQueryContainerBase(
              propertyAlias.propertyPath.slice(0, -1),
            ))))
    ) {
      return true;
    }
    return false;
  }

  return false;
}

function expressionLooksLikeOpenRedirectEntriesCarrier(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeOpenRedirectEntriesCarrier(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (
    isCallLikeExpression(expression) &&
    isPropertyLikeAccessExpression(expression.expression) &&
    ts.isIdentifier(expression.expression.expression) &&
    expression.expression.expression.text === 'Array' &&
    isPropertyNamed(expression.expression.name, 'from') &&
    expression.arguments.length > 0 &&
    (expressionLooksLikeOpenRedirectEntriesCarrier(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) ||
      expressionLooksLikeOpenRedirectSearchParamsCarrier(
        expression.arguments[0],
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      ))
  ) {
    return true;
  }

  if (
    ts.isArrayLiteralExpression(expression) &&
    expression.elements.some(
      (element) =>
        ts.isSpreadElement(element) &&
        (expressionLooksLikeOpenRedirectEntriesCarrier(
          element.expression,
          sourceFile,
          namedExpressions,
          namedPropertyAliases,
          seenIdentifiers,
        ) ||
          expressionLooksLikeOpenRedirectSearchParamsCarrier(
            element.expression,
            sourceFile,
            namedExpressions,
            namedPropertyAliases,
            seenIdentifiers,
          )),
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'entries') &&
    expressionLooksLikeOpenRedirectSearchParamsCarrier(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (!initializer) return false;
    seenIdentifiers.add(expression.text);
    const result = expressionLooksLikeOpenRedirectEntriesCarrier(
      initializer,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
    seenIdentifiers.delete(expression.text);
    return result;
  }

  return false;
}

function expressionLooksLikeOpenRedirectQueryContainerBase(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;
  if (OPEN_REDIRECT_QUERY_CONTAINER_BASE_REGEX.test(expression.getText(sourceFile))) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeOpenRedirectQueryContainerBase(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (
    isCallLikeExpression(expression) &&
    ((ts.isIdentifier(expression.expression) && expression.expression.text === 'useRouter') ||
      (isMemberAccessExpression(expression.expression) &&
        isMemberAccessNamed(expression.expression, 'useRouter')))
  ) {
    return true;
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeOpenRedirectQueryContainerBase(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      return result;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (!propertyAlias) return false;
    if (propertyPathLooksLikeOpenRedirectQueryContainerBase(propertyAlias.propertyPath)) {
      return true;
    }
    seenIdentifiers.add(expression.text);
    const result = expressionLooksLikeOpenRedirectQueryContainerBase(
      propertyAlias.initializer,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
    seenIdentifiers.delete(expression.text);
    return result;
  }

  return false;
}

function expressionLooksLikeLocationQuerySource(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;
  if (LOCATION_QUERY_SOURCE_REGEX.test(expression.getText(sourceFile))) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeLocationQuerySource(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'slice', 'substring', 'replace', 'trim') &&
    expressionLooksLikeLocationQuerySource(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(expression, 'search', 'hash') &&
    (expressionLooksLikeLocationObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) ||
      expressionLooksLikeNextUrlSource(
        expression.expression,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      ))
  ) {
    return true;
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeLocationQuerySource(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      return result;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      ['search', 'hash'].includes(propertyAlias.propertyName) &&
      (expressionLooksLikeLocationObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      ) ||
        expressionLooksLikeNextUrlSource(
          propertyAlias.initializer,
          sourceFile,
          namedExpressions,
          namedPropertyAliases,
          seenIdentifiers,
        ))
    ) {
      return true;
    }
  }

  return false;
}

function expressionLooksLikeWindowObjectSource(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (
    ts.isIdentifier(expression) &&
    ['window', 'globalThis', 'document', 'self', 'parent', 'top'].includes(expression.text)
  ) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeWindowObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (!initializer) return false;
    seenIdentifiers.add(expression.text);
    const result = expressionLooksLikeWindowObjectSource(
      initializer,
      sourceFile,
      namedExpressions,
      seenIdentifiers,
    );
    seenIdentifiers.delete(expression.text);
    return result;
  }

  return false;
}

function expressionLooksLikeLocationObjectSource(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (isLocationObjectExpression(expression)) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeLocationObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (
    isCallLikeExpression(expression) &&
    ((ts.isIdentifier(expression.expression) && expression.expression.text === 'useLocation') ||
      (isMemberAccessExpression(expression.expression) &&
        isMemberAccessNamed(expression.expression, 'useLocation')))
  ) {
    return true;
  }

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(expression, 'location') &&
    expressionLooksLikeWindowObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeLocationObjectSource(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      return result;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      propertyAlias.propertyName === 'location' &&
      expressionLooksLikeWindowObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        seenIdentifiers,
      )
    ) {
      return true;
    }
  }

  return false;
}

function expressionLooksLikeHistoryObjectSource(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (ts.isIdentifier(expression) && expression.text === 'history') {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeHistoryObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(expression, 'history') &&
    expressionLooksLikeWindowObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeHistoryObjectSource(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      return result;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      propertyAlias.propertyName === 'history' &&
      expressionLooksLikeWindowObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        seenIdentifiers,
      )
    ) {
      return true;
    }
  }

  return false;
}

function expressionLooksLikeBufferObjectSource(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (ts.isIdentifier(expression) && expression.text === 'Buffer') {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeBufferObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(expression, 'Buffer') &&
    expressionLooksLikeWindowObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeBufferObjectSource(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      if (result) return true;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      propertyAlias.propertyName === 'Buffer' &&
      expressionLooksLikeWindowObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        seenIdentifiers,
      )
    ) {
      return true;
    }
  }

  return false;
}

function expressionLooksLikeBufferFromHelper(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(expression, 'from') &&
    expressionLooksLikeBufferObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'bind') &&
    expressionLooksLikeBufferFromHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeBufferFromHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeBufferFromHelper(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      if (result) return true;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      propertyAlias.propertyName === 'from' &&
      expressionLooksLikeBufferObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      )
    ) {
      return true;
    }
  }

  return false;
}

function expressionLooksLikeJsonObjectSource(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (ts.isIdentifier(expression) && expression.text === 'JSON') {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeJsonObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(expression, 'JSON') &&
    expressionLooksLikeWindowObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeJsonObjectSource(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      if (result) return true;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      propertyAlias.propertyName === 'JSON' &&
      expressionLooksLikeWindowObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        seenIdentifiers,
      )
    ) {
      return true;
    }
  }

  return false;
}

function expressionLooksLikeJsonStringifyHelper(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(expression, 'stringify') &&
    expressionLooksLikeJsonObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'bind') &&
    expressionLooksLikeJsonStringifyHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeJsonStringifyHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeJsonStringifyHelper(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      if (result) return true;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      propertyAlias.propertyName === 'stringify' &&
      expressionLooksLikeJsonObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      )
    ) {
      return true;
    }
  }

  return false;
}

function expressionLooksLikeJsonParseHelper(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(expression, 'parse') &&
    expressionLooksLikeJsonObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'bind') &&
    expressionLooksLikeJsonParseHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeJsonParseHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeJsonParseHelper(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      if (result) return true;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      propertyAlias.propertyName === 'parse' &&
      expressionLooksLikeJsonObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      )
    ) {
      return true;
    }
  }

  return false;
}

function expressionLooksLikeStructuredCloneHelper(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (ts.isIdentifier(expression) && expression.text === 'structuredClone') {
    return true;
  }

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(expression, 'structuredClone') &&
    expressionLooksLikeWindowObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'bind') &&
    expressionLooksLikeStructuredCloneHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeStructuredCloneHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeStructuredCloneHelper(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      if (result) return true;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      propertyAlias.propertyName === 'structuredClone' &&
      expressionLooksLikeWindowObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        seenIdentifiers,
      )
    ) {
      return true;
    }
  }

  return false;
}

function expressionLooksLikeBrowserGlobalSymbolHelper(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (ts.isIdentifier(expression) && expression.text === 'Symbol') {
    return true;
  }

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(expression, 'Symbol') &&
    expressionLooksLikeWindowObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'bind') &&
    expressionLooksLikeBrowserGlobalSymbolHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeBrowserGlobalSymbolHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeBrowserGlobalSymbolHelper(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      if (result) return true;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      propertyAlias.propertyName === 'Symbol' &&
      expressionLooksLikeWindowObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        seenIdentifiers,
      )
    ) {
      return true;
    }
  }

  return false;
}

function expressionLooksLikeBrowserGlobalBigIntHelper(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (ts.isIdentifier(expression) && expression.text === 'BigInt') {
    return true;
  }

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(expression, 'BigInt') &&
    expressionLooksLikeWindowObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'bind') &&
    expressionLooksLikeBrowserGlobalBigIntHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeBrowserGlobalBigIntHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeBrowserGlobalBigIntHelper(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      if (result) return true;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      propertyAlias.propertyName === 'BigInt' &&
      expressionLooksLikeWindowObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        seenIdentifiers,
      )
    ) {
      return true;
    }
  }

  return false;
}

function expressionLooksLikeBrowserGlobalBooleanHelper(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (ts.isIdentifier(expression) && expression.text === 'Boolean') {
    return true;
  }

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(expression, 'Boolean') &&
    expressionLooksLikeWindowObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'bind') &&
    expressionLooksLikeBrowserGlobalBooleanHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeBrowserGlobalBooleanHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeBrowserGlobalBooleanHelper(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      if (result) return true;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      propertyAlias.propertyName === 'Boolean' &&
      expressionLooksLikeWindowObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        seenIdentifiers,
      )
    ) {
      return true;
    }
  }

  return false;
}

function expressionLooksLikeBrowserGlobalNumberHelper(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (ts.isIdentifier(expression) && expression.text === 'Number') {
    return true;
  }

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(expression, 'Number') &&
    expressionLooksLikeWindowObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'bind') &&
    expressionLooksLikeBrowserGlobalNumberHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeBrowserGlobalNumberHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeBrowserGlobalNumberHelper(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      if (result) return true;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      propertyAlias.propertyName === 'Number' &&
      expressionLooksLikeWindowObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        seenIdentifiers,
      )
    ) {
      return true;
    }
  }

  return false;
}

function expressionLooksLikeBrowserGlobalObjectHelper(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (ts.isIdentifier(expression) && expression.text === 'Object') {
    return true;
  }

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(expression, 'Object') &&
    expressionLooksLikeWindowObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'bind') &&
    expressionLooksLikeBrowserGlobalObjectHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeBrowserGlobalObjectHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeBrowserGlobalObjectHelper(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      if (result) return true;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      propertyAlias.propertyName === 'Object' &&
      expressionLooksLikeWindowObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        seenIdentifiers,
      )
    ) {
      return true;
    }
  }

  return false;
}

function expressionLooksLikeBrowserGlobalStringHelper(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (ts.isIdentifier(expression) && expression.text === 'String') {
    return true;
  }

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(expression, 'String') &&
    expressionLooksLikeWindowObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'bind') &&
    expressionLooksLikeBrowserGlobalStringHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeBrowserGlobalStringHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeBrowserGlobalStringHelper(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      if (result) return true;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      propertyAlias.propertyName === 'String' &&
      expressionLooksLikeWindowObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        seenIdentifiers,
      )
    ) {
      return true;
    }
  }

  return false;
}

function expressionLooksLikeBrowserGlobalBase64Helper(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (ts.isIdentifier(expression) && ['atob', 'btoa'].includes(expression.text)) {
    return true;
  }

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(expression, 'atob', 'btoa') &&
    expressionLooksLikeWindowObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'bind') &&
    expressionLooksLikeBrowserGlobalBase64Helper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeBrowserGlobalBase64Helper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeBrowserGlobalBase64Helper(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      if (result) return true;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      ['atob', 'btoa'].includes(propertyAlias.propertyName) &&
      expressionLooksLikeWindowObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        seenIdentifiers,
      )
    ) {
      return true;
    }
  }

  return false;
}

function expressionLooksLikeBrowserGlobalUriCodecHelper(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (
    ts.isIdentifier(expression) &&
    [
      'decodeURI',
      'decodeURIComponent',
      'encodeURI',
      'encodeURIComponent',
      'escape',
      'unescape',
    ].includes(expression.text)
  ) {
    return true;
  }

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(
      expression,
      'decodeURI',
      'decodeURIComponent',
      'encodeURI',
      'encodeURIComponent',
      'escape',
      'unescape',
    ) &&
    expressionLooksLikeWindowObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'bind') &&
    expressionLooksLikeBrowserGlobalUriCodecHelper(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeBrowserGlobalUriCodecHelper(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeBrowserGlobalUriCodecHelper(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      if (result) return true;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      [
        'decodeURI',
        'decodeURIComponent',
        'encodeURI',
        'encodeURIComponent',
        'escape',
        'unescape',
      ].includes(propertyAlias.propertyName) &&
      expressionLooksLikeWindowObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        seenIdentifiers,
      )
    ) {
      return true;
    }
  }

  return false;
}

function expressionLooksLikeLocationUrlSource(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;
  if (LOCATION_URL_SOURCE_REGEX.test(expression.getText(sourceFile))) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeLocationUrlSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (
    ts.isNewExpression(expression) &&
    ts.isIdentifier(expression.expression) &&
    expression.expression.text === 'URL'
  ) {
    return expressionLooksLikeLocationUrlInput(
      expression.arguments?.[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (!initializer) return false;
    seenIdentifiers.add(expression.text);
    const result = expressionLooksLikeLocationUrlSource(
      initializer,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
    seenIdentifiers.delete(expression.text);
    return result;
  }

  return false;
}

function expressionLooksLikeLocationUrlInput(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;
  if (LOCATION_URL_INPUT_REGEX.test(expression.getText(sourceFile))) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeLocationUrlInput(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (
    expressionLooksLikeNextUrlSource(
      expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    ts.isIdentifier(expression.expression) &&
    expression.expression.text === 'String' &&
    expression.arguments.length > 0 &&
    (expressionLooksLikeLocationObjectSource(
      expression.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) ||
      expressionLooksLikeNextUrlSource(
        expression.arguments[0],
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      ))
  ) {
    return true;
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'toString', 'toJSON') &&
    (expressionLooksLikeLocationObjectSource(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) ||
      expressionLooksLikeNextUrlSource(
        expression.expression.expression,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      ))
  ) {
    return true;
  }

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(expression, 'href', 'search', 'hash') &&
    (expressionLooksLikeLocationObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    ) ||
      expressionLooksLikeNextUrlSource(
        expression.expression,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      ))
  ) {
    return true;
  }

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(expression, 'url') &&
    expressionLooksLikeRequestObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeLocationUrlInput(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      return result;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      ['href', 'search', 'hash'].includes(propertyAlias.propertyName) &&
      (expressionLooksLikeLocationObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      ) ||
        expressionLooksLikeNextUrlSource(
          propertyAlias.initializer,
          sourceFile,
          namedExpressions,
          namedPropertyAliases,
          seenIdentifiers,
        ))
    ) {
      return true;
    }
    if (
      propertyAlias &&
      propertyAlias.propertyName === 'url' &&
      expressionLooksLikeRequestObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        seenIdentifiers,
      )
    ) {
      return true;
    }
  }

  return false;
}

function expressionLooksLikeRequestObjectSource(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;
  if (REQUEST_OBJECT_SOURCE_REGEX.test(expression.getText(sourceFile))) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeRequestObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (!initializer) return false;
    seenIdentifiers.add(expression.text);
    const result = expressionLooksLikeRequestObjectSource(
      initializer,
      sourceFile,
      namedExpressions,
      seenIdentifiers,
    );
    seenIdentifiers.delete(expression.text);
    return result;
  }

  return false;
}

function expressionLooksLikeNextUrlSource(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;
  if (NEXT_URL_SOURCE_REGEX.test(expression.getText(sourceFile))) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeNextUrlSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'clone') &&
    expressionLooksLikeNextUrlSource(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  if (isPropertyLikeAccessExpression(expression) && isPropertyNamed(expression.name, 'nextUrl')) {
    return expressionLooksLikeRequestObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeNextUrlSource(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      return result;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      propertyAlias.propertyName === 'nextUrl' &&
      expressionLooksLikeRequestObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        seenIdentifiers,
      )
    ) {
      return true;
    }
    return false;
  }

  return false;
}

function expressionLooksLikeOpenRedirectSearchParamsCarrier(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  const text = expression.getText(sourceFile);
  if (/\b(?:searchParams|(?:request|req)\.nextUrl\.searchParams|url\.searchParams)\b/i.test(text)) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeOpenRedirectSearchParamsCarrier(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (
    ts.isNewExpression(expression) &&
    ts.isIdentifier(expression.expression) &&
    expression.expression.text === 'URLSearchParams'
  ) {
    return expressionLooksLikeLocationQuerySource(
      expression.arguments?.[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (
    isCallLikeExpression(expression) &&
    ((ts.isIdentifier(expression.expression) && expression.expression.text === 'useSearchParams') ||
      (isMemberAccessExpression(expression.expression) &&
        isMemberAccessNamed(expression.expression, 'useSearchParams')))
  ) {
    return true;
  }

  if (
    isPropertyLikeAccessExpression(expression) &&
    isPropertyNamed(expression.name, 'searchParams')
  ) {
    return (
      expressionLooksLikeLocationUrlSource(
        expression.expression,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      ) ||
      expressionLooksLikeNextUrlSource(
        expression.expression,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      )
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeOpenRedirectSearchParamsCarrier(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      return result;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      propertyAlias.propertyName === 'searchParams' &&
      (expressionLooksLikeLocationUrlSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      ) ||
        expressionLooksLikeNextUrlSource(
          propertyAlias.initializer,
          sourceFile,
          namedExpressions,
          namedPropertyAliases,
          seenIdentifiers,
        ) ||
        propertyPathLooksLikeOpenRedirectSearchParamsCarrier(propertyAlias.propertyPath))
    ) {
      return true;
    }
    return false;
  }

  return false;
}

function expressionLooksLikeLocationAssignmentTarget(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;
  if (isLocationAssignmentTarget(expression)) {
    return true;
  }

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeLocationAssignmentTarget(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (
    isMemberAccessExpression(expression) &&
    isMemberAccessNamed(expression, 'href') &&
    expressionLooksLikeLocationObjectSource(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    )
  ) {
    return true;
  }

  return false;
}

function expressionLooksLikeLocationMutationCall(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeLocationMutationCall(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (isMemberAccessExpression(expression) && isMemberAccessNamed(expression, 'call', 'apply')) {
    return expressionLooksLikeLocationMutationCall(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'bind')
  ) {
    return expressionLooksLikeLocationMutationCall(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeLocationMutationCall(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      return result;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      ['assign', 'replace'].includes(propertyAlias.propertyName) &&
      expressionLooksLikeLocationObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        new Set(),
      )
    ) {
      return true;
    }
    return false;
  }

  return Boolean(
    expression &&
      isMemberAccessExpression(expression) &&
      isMemberAccessNamed(expression, 'assign', 'replace') &&
      expressionLooksLikeLocationObjectSource(
        expression.expression,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        new Set(),
      ),
  );
}

function expressionLooksLikeWindowOpenCall(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeWindowOpenCall(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (isMemberAccessExpression(expression) && isMemberAccessNamed(expression, 'call', 'apply')) {
    return expressionLooksLikeWindowOpenCall(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression) && expression.text === 'open') {
    return true;
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeWindowOpenCall(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      return result;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      propertyAlias.propertyName === 'open' &&
      expressionLooksLikeWindowObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        new Set(),
      )
    ) {
      return true;
    }
  }

  return Boolean(
    isMemberAccessExpression(expression) &&
      isMemberAccessNamed(expression, 'open') &&
      expressionLooksLikeWindowObjectSource(
        expression.expression,
        sourceFile,
        namedExpressions,
        new Set(),
      ),
  );
}

function expressionLooksLikeHistoryMutationCall(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeHistoryMutationCall(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (isMemberAccessExpression(expression) && isMemberAccessNamed(expression, 'call', 'apply')) {
    return expressionLooksLikeHistoryMutationCall(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'bind')
  ) {
    return expressionLooksLikeHistoryMutationCall(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeHistoryMutationCall(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      return result;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (
      propertyAlias &&
      ['pushState', 'replaceState'].includes(propertyAlias.propertyName) &&
      expressionLooksLikeHistoryObjectSource(
        propertyAlias.initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        new Set(),
      )
    ) {
      return true;
    }
    return false;
  }

  return Boolean(
    isMemberAccessExpression(expression) &&
      isMemberAccessNamed(expression, 'pushState', 'replaceState') &&
      expressionLooksLikeHistoryObjectSource(
        expression.expression,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        new Set(),
      ),
  );
}

function expressionLooksLikeRouteTransitionCall(
  expression: ts.Expression | undefined,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
  seenIdentifiers: Set<string>,
): boolean {
  if (!expression) return false;

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return expressionLooksLikeRouteTransitionCall(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (isMemberAccessExpression(expression) && isMemberAccessNamed(expression, 'call', 'apply')) {
    return expressionLooksLikeRouteTransitionCall(
      expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (
    isCallLikeExpression(expression) &&
    isMemberAccessExpression(expression.expression) &&
    isMemberAccessNamed(expression.expression, 'bind')
  ) {
    return expressionLooksLikeRouteTransitionCall(
      expression.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (['redirect', 'navigate'].includes(expression.text)) {
      return true;
    }
    if (seenIdentifiers.has(expression.text)) return false;
    const initializer = namedExpressions.get(expression.text);
    if (initializer) {
      seenIdentifiers.add(expression.text);
      const result = expressionLooksLikeRouteTransitionCall(
        initializer,
        sourceFile,
        namedExpressions,
        namedPropertyAliases,
        seenIdentifiers,
      );
      seenIdentifiers.delete(expression.text);
      return result;
    }
    const propertyAlias = namedPropertyAliases.get(expression.text);
    if (propertyAlias && ['redirect', 'navigate'].includes(propertyAlias.propertyName)) {
      return true;
    }
    if (
      propertyAlias &&
      ['push', 'replace'].includes(propertyAlias.propertyName) &&
      (propertyPathLooksLikeOpenRedirectQueryContainerBase(
        propertyAlias.propertyPath.slice(0, -1),
      ) ||
        expressionLooksLikeOpenRedirectQueryContainerBase(
          propertyAlias.initializer,
          sourceFile,
          namedExpressions,
          namedPropertyAliases,
          new Set(),
        ))
    ) {
      return true;
    }
    return false;
  }

  return Boolean(
    isMemberAccessExpression(expression) &&
      (isMemberAccessNamed(expression, 'redirect', 'navigate') ||
        (isMemberAccessNamed(expression, 'push', 'replace') &&
          expressionLooksLikeOpenRedirectQueryContainerBase(
            expression.expression,
            sourceFile,
            namedExpressions,
            namedPropertyAliases,
            new Set(),
          ))),
  );
}

function getRouteTransitionTargetExpression(
  node: CallLikeExpression,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
): ts.Expression | undefined {
  if (
    isMemberAccessExpression(node.expression) &&
    ts.isIdentifier(node.expression.expression) &&
    node.expression.expression.text === 'Reflect' &&
    isMemberAccessNamed(node.expression, 'apply') &&
    expressionLooksLikeRouteTransitionCall(
      node.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      new Set(),
    )
  ) {
    return getAliasedApplyArgumentExpression(node.arguments[2], 0, namedExpressions, new Set());
  }

  if (
    isMemberAccessExpression(node.expression) &&
    isMemberAccessNamed(node.expression, 'call') &&
    expressionLooksLikeRouteTransitionCall(
      node.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      new Set(),
    )
  ) {
    return node.arguments[1];
  }

  if (
    isMemberAccessExpression(node.expression) &&
    isMemberAccessNamed(node.expression, 'apply') &&
    expressionLooksLikeRouteTransitionCall(
      node.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      new Set(),
    )
  ) {
    return getAliasedApplyArgumentExpression(node.arguments[1], 0, namedExpressions, new Set());
  }

  if (
    isMemberAccessExpression(node.expression) &&
    isMemberAccessNamed(node.expression, 'call') &&
    expressionLooksLikeHistoryMutationCall(
      node.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      new Set(),
    )
  ) {
    return node.arguments[3];
  }

  if (
    isMemberAccessExpression(node.expression) &&
    isMemberAccessNamed(node.expression, 'apply') &&
    expressionLooksLikeHistoryMutationCall(
      node.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      new Set(),
    )
  ) {
    return getAliasedApplyArgumentExpression(node.arguments[1], 2, namedExpressions, new Set());
  }

  if (
    isMemberAccessExpression(node.expression) &&
    ts.isIdentifier(node.expression.expression) &&
    node.expression.expression.text === 'Reflect' &&
    isMemberAccessNamed(node.expression, 'apply') &&
    expressionLooksLikeHistoryMutationCall(
      node.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      new Set(),
    )
  ) {
    return getAliasedApplyArgumentExpression(node.arguments[2], 2, namedExpressions, new Set());
  }

  if (
    expressionLooksLikeRouteTransitionCall(
      node.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      new Set(),
    )
  ) {
    return node.arguments[0];
  }

  if (
    expressionLooksLikeHistoryMutationCall(
      node.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      new Set(),
    )
  ) {
    return node.arguments[2];
  }

  return undefined;
}

function getAliasedApplyArgumentExpression(
  expression: ts.Expression | undefined,
  index: number,
  namedExpressions: Map<string, ts.Expression>,
  seenIdentifiers: Set<string>,
): ts.Expression | undefined {
  if (!expression) return undefined;

  if (
    ts.isParenthesizedExpression(expression) ||
    ts.isAsExpression(expression) ||
    ts.isTypeAssertionExpression(expression) ||
    ts.isNonNullExpression(expression)
  ) {
    return getAliasedApplyArgumentExpression(
      expression.expression,
      index,
      namedExpressions,
      seenIdentifiers,
    );
  }

  if (ts.isIdentifier(expression)) {
    if (seenIdentifiers.has(expression.text)) return undefined;
    const initializer = namedExpressions.get(expression.text);
    if (!initializer) return undefined;
    seenIdentifiers.add(expression.text);
    const result = getAliasedApplyArgumentExpression(
      initializer,
      index,
      namedExpressions,
      seenIdentifiers,
    );
    seenIdentifiers.delete(expression.text);
    return result;
  }

  if (!ts.isArrayLiteralExpression(expression)) return undefined;
  const argument = expression.elements[index];
  return ts.isExpression(argument) ? argument : undefined;
}

function getLocationMutationTargetExpression(
  node: CallLikeExpression,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
): ts.Expression | undefined {
  if (
    isMemberAccessExpression(node.expression) &&
    ts.isIdentifier(node.expression.expression) &&
    node.expression.expression.text === 'Reflect' &&
    isMemberAccessNamed(node.expression, 'apply') &&
    expressionLooksLikeLocationMutationCall(
      node.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      new Set(),
    )
  ) {
    return getAliasedApplyArgumentExpression(node.arguments[2], 0, namedExpressions, new Set());
  }

  if (
    isMemberAccessExpression(node.expression) &&
    isMemberAccessNamed(node.expression, 'call') &&
    expressionLooksLikeLocationMutationCall(
      node.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      new Set(),
    )
  ) {
    return node.arguments[1];
  }

  if (
    isMemberAccessExpression(node.expression) &&
    isMemberAccessNamed(node.expression, 'apply') &&
    expressionLooksLikeLocationMutationCall(
      node.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      new Set(),
    )
  ) {
    return getAliasedApplyArgumentExpression(node.arguments[1], 0, namedExpressions, new Set());
  }

  if (
    expressionLooksLikeLocationMutationCall(
      node.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      new Set(),
    )
  ) {
    return node.arguments[0];
  }

  return undefined;
}

function getWindowOpenTargetExpression(
  node: CallLikeExpression,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
): ts.Expression | undefined {
  if (
    isMemberAccessExpression(node.expression) &&
    ts.isIdentifier(node.expression.expression) &&
    node.expression.expression.text === 'Reflect' &&
    isMemberAccessNamed(node.expression, 'apply') &&
    expressionLooksLikeWindowOpenCall(
      node.arguments[0],
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      new Set(),
    )
  ) {
    return getAliasedApplyArgumentExpression(node.arguments[2], 0, namedExpressions, new Set());
  }

  if (
    isMemberAccessExpression(node.expression) &&
    isMemberAccessNamed(node.expression, 'call') &&
    expressionLooksLikeWindowOpenCall(
      node.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      new Set(),
    )
  ) {
    return node.arguments[1];
  }

  if (
    isMemberAccessExpression(node.expression) &&
    isMemberAccessNamed(node.expression, 'apply') &&
    expressionLooksLikeWindowOpenCall(
      node.expression.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      new Set(),
    )
  ) {
    return getAliasedApplyArgumentExpression(node.arguments[1], 0, namedExpressions, new Set());
  }

  if (
    expressionLooksLikeWindowOpenCall(
      node.expression,
      sourceFile,
      namedExpressions,
      namedPropertyAliases,
      new Set(),
    )
  ) {
    return node.arguments[0];
  }

  return undefined;
}

function countAuthRecoveryRouteSignals(code: string): number {
  const patterns = [
    /\b(?:href|to|route|path)\s*[:=]\s*['"`]\/(?:forgot-password|reset-password|password-reset|recover)(?:[/?#][^'"`]*)?['"`]/gi,
    /\b(?:redirect|navigate|push|replace)\s*\(\s*['"`]\/(?:forgot-password|reset-password|password-reset|recover)(?:[/?#][^'"`]*)?['"`]/gi,
    /\bwindow\.location(?:\.href)?\s*=\s*['"`]\/(?:forgot-password|reset-password|password-reset|recover)(?:[/?#][^'"`]*)?['"`]/gi,
    />\s*(?:forgot password|reset password|recover account)\s*</gi,
  ];

  return patterns.reduce((count, pattern) => count + (code.match(pattern)?.length ?? 0), 0);
}

function countRegistrationRouteSignals(code: string): number {
  const patterns = [
    /\b(?:href|to|route|path)\s*[:=]\s*['"`]\/(?:signup|sign-up|register)(?:[/?#][^'"`]*)?['"`]/gi,
    /\b(?:redirect|navigate|push|replace)\s*\(\s*['"`]\/(?:signup|sign-up|register)(?:[/?#][^'"`]*)?['"`]/gi,
    /\bwindow\.location(?:\.href)?\s*=\s*['"`]\/(?:signup|sign-up|register)(?:[/?#][^'"`]*)?['"`]/gi,
    />\s*(?:sign up|register|create account)\s*</gi,
  ];

  return patterns.reduce((count, pattern) => count + (code.match(pattern)?.length ?? 0), 0);
}

function countAnonymousEntryRouteSignals(code: string): number {
  const patterns = [
    /\b(?:href|to|route|path)\s*[:=]\s*['"`]\/(?:auth|login|log-?in|sign-?in|sign-?up|register)?(?:[/?#][^'"`]*)?['"`]/gi,
    /\b(?:redirect|navigate|push|replace)\s*\(\s*['"`]\/(?:auth|login|log-?in|sign-?in|sign-?up|register)?(?:[/?#][^'"`]*)?['"`]/gi,
    /\bwindow\.location(?:\.href)?\s*=\s*['"`]\/(?:auth|login|log-?in|sign-?in|sign-?up|register)?(?:[/?#][^'"`]*)?['"`]/gi,
    />\s*(?:back to sign in|back to login|return to sign in|return to login|sign in|log in)\s*</gi,
  ];

  return patterns.reduce((count, pattern) => count + (code.match(pattern)?.length ?? 0), 0);
}

function countSignInRouteSignals(code: string): number {
  const patterns = [
    /\b(?:href|to|route|path)\s*[:=]\s*['"`]\/(?:auth|login|log-?in|sign-?in)(?:[/?#][^'"`]*)?['"`]/gi,
    /\b(?:redirect|navigate|push|replace)\s*\(\s*['"`]\/(?:auth|login|log-?in|sign-?in)(?:[/?#][^'"`]*)?['"`]/gi,
    /\bwindow\.location(?:\.href)?\s*=\s*['"`]\/(?:auth|login|log-?in|sign-?in)(?:[/?#][^'"`]*)?['"`]/gi,
    />\s*(?:back to sign in|back to login|return to sign in|return to login|sign in|log in)\s*</gi,
  ];

  return patterns.reduce((count, pattern) => count + (code.match(pattern)?.length ?? 0), 0);
}

function countHardcodedSecretSignals(code: string): number {
  const patterns = [/\bsk_live_[0-9A-Za-z]+\b/g, /-----BEGIN [A-Z ]*PRIVATE KEY-----/g];

  return patterns.reduce((count, pattern) => count + (code.match(pattern)?.length ?? 0), 0);
}

function countClientSecretEnvReferenceSignals(code: string): number {
  const useClientCount = /^\s*['"]use client['"]/m.test(code)
    ? countSensitiveEnvReferences(code, ['process.env.'])
    : 0;

  return (
    countSensitiveEnvReferences(code, ['import.meta.env.', 'process.env.NEXT_PUBLIC_']) +
    useClientCount
  );
}

function countSensitiveEnvReferences(code: string, prefixes: string[]): number {
  let count = 0;

  for (const prefix of prefixes) {
    for (
      let index = code.indexOf(prefix);
      index !== -1;
      index = code.indexOf(prefix, index + prefix.length)
    ) {
      const envName = readEnvIdentifier(code, index + prefix.length);
      if (envName && isSensitiveEnvName(envName)) {
        count += 1;
      }
    }
  }

  return count;
}

function readEnvIdentifier(code: string, startIndex: number): string {
  let cursor = startIndex;
  while (cursor < code.length && isEnvIdentifierChar(code[cursor]!)) {
    cursor += 1;
  }
  return code.slice(startIndex, cursor);
}

function isEnvIdentifierChar(char: string): boolean {
  const codePoint = char.charCodeAt(0);
  return (
    char === '_' || (codePoint >= 48 && codePoint <= 57) || (codePoint >= 65 && codePoint <= 90)
  );
}

function isSensitiveEnvName(envName: string): boolean {
  return (
    envName.includes('SERVICE_ROLE') ||
    envName.includes('SECRET') ||
    envName.includes('PRIVATE_KEY')
  );
}

function countLocalhostEndpointSignals(code: string): number {
  return (
    code.match(
      /\b(?:(?:https?|wss?):\/\/)?(?:localhost|127\.0\.0\.1|0\.0\.0\.0)(?::\d+)?(?:\/[^\s'"`]*)?/gi,
    )?.length ?? 0
  );
}

function countWildcardPostMessageSignals(code: string): number {
  return code.match(/\bpostMessage\s*\([^)]*,\s*['"`]\*['"`]/g)?.length ?? 0;
}

const DYNAMIC_GEOMETRY_STYLE_PROPS = new Set([
  'top',
  'right',
  'bottom',
  'left',
  'inset',
  'width',
  'height',
  'minWidth',
  'minHeight',
  'maxWidth',
  'maxHeight',
  'transform',
  'transformOrigin',
  'opacity',
  'offsetPath',
  'offsetDistance',
  'cx',
  'cy',
  'x',
  'y',
]);

function getJsxAttributeExpression(
  initializer: ts.JsxAttribute['initializer'],
): ts.Expression | null {
  if (!initializer || !ts.isJsxExpression(initializer)) return null;
  return initializer.expression ?? null;
}

function getStylePropertyName(name: ts.PropertyName): string | null {
  if (ts.isIdentifier(name) || ts.isStringLiteral(name) || ts.isNumericLiteral(name)) {
    return name.text;
  }
  if (ts.isComputedPropertyName(name)) {
    return getExpressionLiteralValue(name.expression);
  }
  return null;
}

function unwrapStyleExpression(expression: ts.Expression): ts.Expression {
  let current = expression;
  while (
    ts.isParenthesizedExpression(current) ||
    ts.isAsExpression(current) ||
    ts.isTypeAssertionExpression(current) ||
    ts.isNonNullExpression(current) ||
    ts.isSatisfiesExpression(current)
  ) {
    current = current.expression;
  }
  return current;
}

function isDynamicStyleValue(expression: ts.Expression): boolean {
  const unwrapped = unwrapStyleExpression(expression);
  if (
    ts.isStringLiteral(unwrapped) ||
    ts.isNoSubstitutionTemplateLiteral(unwrapped) ||
    ts.isNumericLiteral(unwrapped) ||
    unwrapped.kind === ts.SyntaxKind.TrueKeyword ||
    unwrapped.kind === ts.SyntaxKind.FalseKeyword ||
    unwrapped.kind === ts.SyntaxKind.NullKeyword
  ) {
    return false;
  }
  return true;
}

function isAllowedInlineStyleObject(objectLiteral: ts.ObjectLiteralExpression): boolean {
  let sawGeometryProperty = false;
  let sawDynamicGeometryValue = false;

  for (const property of objectLiteral.properties) {
    if (!ts.isPropertyAssignment(property)) return false;

    const propertyName = getStylePropertyName(property.name);
    if (!propertyName) return false;

    if (propertyName.startsWith('--d-')) {
      continue;
    }

    if (!DYNAMIC_GEOMETRY_STYLE_PROPS.has(propertyName)) {
      return false;
    }

    sawGeometryProperty = true;
    if (isDynamicStyleValue(property.initializer)) {
      sawDynamicGeometryValue = true;
    }
  }

  return !sawGeometryProperty || sawDynamicGeometryValue;
}

function isAllowedInlineStyleAttribute(
  attribute: ts.JsxAttribute,
  sourceFile: ts.SourceFile,
  namedExpressions: Map<string, ts.Expression>,
  namedPropertyAliases: Map<string, NamedPropertyAlias>,
): boolean {
  const expression = getJsxAttributeExpression(attribute.initializer);
  if (!expression) return false;

  const resolved = resolveObjectLiteralExpression(
    expression,
    sourceFile,
    namedExpressions,
    namedPropertyAliases,
    new Set(),
  );

  return resolved ? isAllowedInlineStyleObject(resolved.objectLiteral) : false;
}

function analyzeAstSignals(filePath: string, code: string): AstCritiqueSignals {
  const sourceFile = ts.createSourceFile(
    filePath,
    code,
    ts.ScriptTarget.Latest,
    true,
    getScriptKind(filePath),
  );
  const signals: AstCritiqueSignals = {
    inlineStyleAttributeCount: 0,
    dangerousHtmlCount: 0,
    rawHtmlInjectionCount: 0,
    dynamicEvalCount: 0,
    hardcodedSecretSignalCount: countHardcodedSecretSignals(code),
    clientSecretEnvReferenceCount: countClientSecretEnvReferenceSignals(code),
    localhostEndpointCount: countLocalhostEndpointSignals(code),
    wildcardPostMessageCount: countWildcardPostMessageSignals(code),
    windowOpenWithoutNoopenerCount: 0,
    messageListenerWithoutOriginCheckCount: 0,
    externalIframeWithoutSandboxCount: 0,
    insecureExternalIframeCount: 0,
    insecureFormActionCount: 0,
    insecureAuthFormMethodCount: 0,
    insecureTransportEndpointCount: 0,
    iconOnlyButtonWithoutLabelCount: 0,
    iconOnlyLinkWithoutLabelCount: 0,
    clickableNonSemanticCount: 0,
    imageWithoutAltCount: 0,
    insecureExternalImageCount: 0,
    iframeWithoutTitleCount: 0,
    dialogWithoutLabelCount: 0,
    dialogWithoutModalHintCount: 0,
    tableWithoutHeaderCount: 0,
    tableWithoutCaptionCount: 0,
    unlabeledNavigationLandmarkCount: 0,
    multipleMainLandmarkCount: 0,
    externalBlankLinkWithoutRelCount: 0,
    formControlWithoutLabelCount: 0,
    placeholderNavigationTargetCount: 0,
    protectedSurfaceSignalCount: countProtectedSurfaceSignals(code),
    skipNavSignalCount: countSkipNavSignals(code),
    skipNavTargetIds: [],
    mainLandmarkCount: 0,
    mainLandmarkIds: [],
    emailAutocompleteMissingCount: 0,
    passwordAutocompleteMissingCount: 0,
    otpAutocompleteMissingCount: 0,
    authAutocompleteDisabledCount: 0,
    authAutocompleteSemanticMismatchCount: 0,
    authInputTypeMismatchCount: 0,
    authInputWithoutNameCount: 0,
    buttonInFormWithoutTypeCount: 0,
    authFormWithoutSubmitCount: 0,
    authEntrySignalCount: countAuthEntrySignals(code),
    authSessionSignalCount: countAuthSessionSignals(code),
    authLoadingSignalCount: countAuthLoadingSignals(code),
    authProtectedLoadingRenderCount: countAuthProtectedLoadingRenderSignals(code),
    authBlankLoadingRenderCount: countAuthBlankLoadingRenderSignals(code),
    authAnonymousLoadingRedirectCount: countAuthAnonymousLoadingRedirectSignals(code),
    authProtectedUnauthenticatedRenderCount: countAuthProtectedUnauthenticatedRenderSignals(code),
    authProtectedRedirectSignalCount: countAuthProtectedRedirectSignals(code),
    authAnonymousRedirectSignalCount: countAuthAnonymousRedirectSignals(code),
    authOpenRedirectSignalCount: countAuthOpenRedirectSignals(code),
    authExternalRedirectSignalCount: 0,
    authProviderStateMissingCount: 0,
    authProviderPkceMissingCount: 0,
    authProviderNonceMissingCount: 0,
    authStorageWriteCount: 0,
    authStorageClearCount: countAuthStorageClearSignals(code),
    authCookieWriteCount: 0,
    authCookieClearCount: countAuthCookieClearSignals(code),
    authCookieMissingHardeningCount: 0,
    authHeaderWriteCount: 0,
    authHeaderClearCount: 0,
    authCacheClientCount: countAuthCacheClientSignals(code),
    authCacheClearCount: countAuthCacheClearSignals(code),
    authRefreshSignalCount: countAuthRefreshSignals(code),
    authRefreshClearCount: countAuthRefreshClearSignals(code),
    authGuardSignalCount: countAuthGuardSignals(code),
    authExitSignalCount: countAuthExitSignals(code),
    authSessionTeardownSignalCount: countAuthSessionTeardownSignals(code),
  };
  const namedFunctionDeclarations = collectNamedFunctionLikeDeclarations(sourceFile);
  const namedExpressionInitializers = collectNamedExpressionInitializers(sourceFile);
  const namedPropertyAliases = collectNamedPropertyAliases(sourceFile);
  const labelForIds = collectLabelForIds(sourceFile);
  let navigationLandmarkCount = 0;
  let unlabeledNavigationLandmarkCount = 0;

  const walk = (node: ts.Node) => {
    if (ts.isJsxAttribute(node)) {
      if (isPropertyNamed(node.name, 'style') && node.initializer) {
        if (
          !isAllowedInlineStyleAttribute(
            node,
            sourceFile,
            namedExpressionInitializers,
            namedPropertyAliases,
          )
        ) {
          signals.inlineStyleAttributeCount += 1;
        }
      }
      if (
        isPropertyNamed(node.name, 'dangerouslySetInnerHTML') &&
        !isSafeJsonLdDangerouslySetInnerHtml(node)
      ) {
        signals.dangerousHtmlCount += 1;
      }
      if (
        isPropertyNamed(node.name, 'href', 'to') &&
        node.initializer &&
        ts.isJsxExpression(node.initializer) &&
        expressionContainsOpenRedirectSource(
          node.initializer.expression,
          sourceFile,
          namedExpressionInitializers,
          namedPropertyAliases,
        )
      ) {
        signals.authOpenRedirectSignalCount += 1;
      }

      if (
        isPropertyNamed(node.name, 'href', 'to') &&
        isAuthProviderUrlMissingState(getJsxAttributeLiteralValue(node))
      ) {
        signals.authProviderStateMissingCount += 1;
      }

      if (
        isPropertyNamed(node.name, 'href', 'to') &&
        isAuthProviderCodeFlowMissingPkce(getJsxAttributeLiteralValue(node))
      ) {
        signals.authProviderPkceMissingCount += 1;
      }

      if (
        isPropertyNamed(node.name, 'href', 'to') &&
        isAuthProviderIdTokenFlowMissingNonce(getJsxAttributeLiteralValue(node))
      ) {
        signals.authProviderNonceMissingCount += 1;
      }
    }

    if (
      ts.isBinaryExpression(node) &&
      node.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
      ts.isPropertyAccessExpression(node.left) &&
      isPropertyNamed(node.left.name, 'innerHTML', 'outerHTML')
    ) {
      signals.rawHtmlInjectionCount += 1;
    }

    if (
      ts.isBinaryExpression(node) &&
      node.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
      expressionLooksLikeLocationAssignmentTarget(
        node.left,
        sourceFile,
        namedExpressionInitializers,
        namedPropertyAliases,
        new Set(),
      ) &&
      expressionContainsOpenRedirectSource(
        node.right,
        sourceFile,
        namedExpressionInitializers,
        namedPropertyAliases,
      )
    ) {
      signals.authOpenRedirectSignalCount += 1;
    }

    if (
      ts.isBinaryExpression(node) &&
      node.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
      expressionLooksLikeLocationAssignmentTarget(
        node.left,
        sourceFile,
        namedExpressionInitializers,
        namedPropertyAliases,
        new Set(),
      ) &&
      isInsecureTransportUrl(getExpressionLiteralValue(node.right))
    ) {
      signals.insecureTransportEndpointCount += 1;
    }

    if (
      ts.isBinaryExpression(node) &&
      node.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
      expressionLooksLikeLocationAssignmentTarget(
        node.left,
        sourceFile,
        namedExpressionInitializers,
        namedPropertyAliases,
        new Set(),
      ) &&
      isExternalUrl(getExpressionLiteralValue(node.right))
    ) {
      signals.authExternalRedirectSignalCount += 1;
      if (isAuthProviderUrlMissingState(getExpressionLiteralValue(node.right))) {
        signals.authProviderStateMissingCount += 1;
      }
      if (isAuthProviderCodeFlowMissingPkce(getExpressionLiteralValue(node.right))) {
        signals.authProviderPkceMissingCount += 1;
      }
      if (isAuthProviderIdTokenFlowMissingNonce(getExpressionLiteralValue(node.right))) {
        signals.authProviderNonceMissingCount += 1;
      }
    }

    if (
      ts.isBinaryExpression(node) &&
      node.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
      expressionLooksLikeLocationAssignmentTarget(
        node.left,
        sourceFile,
        namedExpressionInitializers,
        namedPropertyAliases,
        new Set(),
      ) &&
      expressionContainsOpenRedirectSource(
        node.right,
        sourceFile,
        namedExpressionInitializers,
        namedPropertyAliases,
      )
    ) {
      signals.authOpenRedirectSignalCount += 1;
    }

    if (
      ts.isBinaryExpression(node) &&
      node.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
      ts.isPropertyAccessExpression(node.left) &&
      isPropertyNamed(node.left.name, 'onmessage')
    ) {
      const handler = resolveFunctionLikeHandler(node.right, namedFunctionDeclarations);
      if (handler && !functionLikeReferencesOrigin(handler)) {
        signals.messageListenerWithoutOriginCheckCount += 1;
      }
    }

    if (
      ts.isBinaryExpression(node) &&
      node.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
      ts.isPropertyAccessExpression(node.left) &&
      isBrowserStorageObject(node.left.expression) &&
      /(?:token|auth|jwt|session)/i.test(node.left.name.text)
    ) {
      signals.authStorageWriteCount += 1;
    }

    if (
      ts.isBinaryExpression(node) &&
      node.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
      ts.isElementAccessExpression(node.left) &&
      isBrowserStorageObject(node.left.expression) &&
      isAuthStorageKeyLiteral(node.left.argumentExpression)
    ) {
      signals.authStorageWriteCount += 1;
    }

    if (
      ts.isBinaryExpression(node) &&
      node.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
      isCookiePropertyAccess(node.left) &&
      hasAuthCredentialText(node.right, sourceFile)
    ) {
      signals.authCookieWriteCount += 1;
    }

    if (
      ts.isBinaryExpression(node) &&
      node.operatorToken.kind === ts.SyntaxKind.EqualsToken &&
      isAuthorizationHeaderAccess(node.left)
    ) {
      if (isHeaderClearValue(node.right)) {
        signals.authHeaderClearCount += 1;
      } else {
        signals.authHeaderWriteCount += 1;
      }
    }

    if (ts.isPropertyAssignment(node) && isAuthorizationHeaderName(node.name)) {
      if (isHeaderClearValue(node.initializer)) {
        signals.authHeaderClearCount += 1;
      } else {
        signals.authHeaderWriteCount += 1;
      }
    }

    if (ts.isDeleteExpression(node) && isAuthorizationHeaderAccess(node.expression)) {
      signals.authHeaderClearCount += 1;
    }

    if (isCallLikeExpression(node)) {
      const firstArgumentLiteral = getExpressionLiteralValue(node.arguments[0]);
      const secondArgumentLiteral = getExpressionLiteralValue(node.arguments[1]);
      const routeTransitionTargetExpression = getRouteTransitionTargetExpression(
        node,
        sourceFile,
        namedExpressionInitializers,
        namedPropertyAliases,
      );
      const routeTransitionTargetLiteral = getExpressionLiteralValue(
        routeTransitionTargetExpression,
      );
      const locationMutationTargetExpression = getLocationMutationTargetExpression(
        node,
        sourceFile,
        namedExpressionInitializers,
        namedPropertyAliases,
      );
      const locationMutationTargetLiteral = getExpressionLiteralValue(
        locationMutationTargetExpression,
      );
      const windowOpenTargetExpression = getWindowOpenTargetExpression(
        node,
        sourceFile,
        namedExpressionInitializers,
        namedPropertyAliases,
      );
      const windowOpenTargetLiteral = getExpressionLiteralValue(windowOpenTargetExpression);
      if (ts.isIdentifier(node.expression) && node.expression.text === 'eval') {
        signals.dynamicEvalCount += 1;
      }

      if (
        ((ts.isIdentifier(node.expression) &&
          ['setTimeout', 'setInterval'].includes(node.expression.text)) ||
          (ts.isPropertyAccessExpression(node.expression) &&
            ts.isIdentifier(node.expression.expression) &&
            node.expression.expression.text === 'window' &&
            isPropertyNamed(node.expression.name, 'setTimeout', 'setInterval'))) &&
        typeof firstArgumentLiteral === 'string'
      ) {
        signals.dynamicEvalCount += 1;
      }

      if (
        (isFetchLikeCall(node) || isAxiosLikeCall(node)) &&
        isInsecureTransportUrl(firstArgumentLiteral)
      ) {
        signals.insecureTransportEndpointCount += 1;
      }

      if (
        routeTransitionTargetExpression &&
        expressionContainsOpenRedirectSource(
          routeTransitionTargetExpression,
          sourceFile,
          namedExpressionInitializers,
          namedPropertyAliases,
        )
      ) {
        signals.authOpenRedirectSignalCount += 1;
      }

      if (
        expressionLooksLikeRouteTransitionCall(
          node.expression,
          sourceFile,
          namedExpressionInitializers,
          namedPropertyAliases,
          new Set(),
        ) &&
        isExternalUrl(routeTransitionTargetLiteral ?? firstArgumentLiteral)
      ) {
        signals.authExternalRedirectSignalCount += 1;
        if (isAuthProviderUrlMissingState(routeTransitionTargetLiteral ?? firstArgumentLiteral)) {
          signals.authProviderStateMissingCount += 1;
        }
        if (
          isAuthProviderCodeFlowMissingPkce(routeTransitionTargetLiteral ?? firstArgumentLiteral)
        ) {
          signals.authProviderPkceMissingCount += 1;
        }
        if (
          isAuthProviderIdTokenFlowMissingNonce(
            routeTransitionTargetLiteral ?? firstArgumentLiteral,
          )
        ) {
          signals.authProviderNonceMissingCount += 1;
        }
      }

      if (
        isAxiosConfigCall(node) &&
        isInsecureTransportUrl(
          getObjectLiteralStringPropertyValue(node.arguments[0], 'url', 'baseURL', 'baseUrl'),
        )
      ) {
        signals.insecureTransportEndpointCount += 1;
      }

      if (
        locationMutationTargetExpression &&
        expressionContainsOpenRedirectSource(
          locationMutationTargetExpression,
          sourceFile,
          namedExpressionInitializers,
          namedPropertyAliases,
        )
      ) {
        signals.authOpenRedirectSignalCount += 1;
      }

      if (
        locationMutationTargetExpression &&
        isInsecureTransportUrl(locationMutationTargetLiteral)
      ) {
        signals.insecureTransportEndpointCount += 1;
      }

      if (locationMutationTargetExpression && isExternalUrl(locationMutationTargetLiteral)) {
        signals.authExternalRedirectSignalCount += 1;
        if (isAuthProviderUrlMissingState(locationMutationTargetLiteral)) {
          signals.authProviderStateMissingCount += 1;
        }
        if (isAuthProviderCodeFlowMissingPkce(locationMutationTargetLiteral)) {
          signals.authProviderPkceMissingCount += 1;
        }
        if (isAuthProviderIdTokenFlowMissingNonce(locationMutationTargetLiteral)) {
          signals.authProviderNonceMissingCount += 1;
        }
      }

      if (
        windowOpenTargetExpression &&
        expressionContainsOpenRedirectSource(
          windowOpenTargetExpression,
          sourceFile,
          namedExpressionInitializers,
          namedPropertyAliases,
        )
      ) {
        signals.authOpenRedirectSignalCount += 1;
      }

      if (windowOpenTargetExpression && isExternalUrl(windowOpenTargetLiteral)) {
        signals.authExternalRedirectSignalCount += 1;
        if (isAuthProviderUrlMissingState(windowOpenTargetLiteral)) {
          signals.authProviderStateMissingCount += 1;
        }
        if (isAuthProviderCodeFlowMissingPkce(windowOpenTargetLiteral)) {
          signals.authProviderPkceMissingCount += 1;
        }
        if (isAuthProviderIdTokenFlowMissingNonce(windowOpenTargetLiteral)) {
          signals.authProviderNonceMissingCount += 1;
        }
      }

      if (
        ts.isPropertyAccessExpression(node.expression) &&
        isPropertyNamed(node.expression.name, 'postMessage') &&
        secondArgumentLiteral === '*'
      ) {
        signals.wildcardPostMessageCount += 1;
      }

      if (isAddEventListenerCall(node) && firstArgumentLiteral === 'message') {
        const handler = resolveFunctionLikeHandler(node.arguments[1], namedFunctionDeclarations);
        if (handler && !functionLikeReferencesOrigin(handler)) {
          signals.messageListenerWithoutOriginCheckCount += 1;
        }
      }

      if (
        ts.isPropertyAccessExpression(node.expression) &&
        isPropertyNamed(node.expression.name, 'setHeader', 'append', 'set') &&
        isSetCookieHeaderName(node.arguments[0])
      ) {
        const cookieStrings = collectCookieHeaderStrings(node.arguments[1]);
        const authCookieStrings = cookieStrings.filter(cookieHeaderStringLooksAuthLike);
        if (authCookieStrings.length > 0) {
          signals.authCookieWriteCount += authCookieStrings.length;
          signals.authCookieMissingHardeningCount += authCookieStrings.filter(
            (value) => !cookieHeaderStringHasHardening(value),
          ).length;
        } else {
          const cookieHeaderSource = node.arguments[1]?.getText(sourceFile) ?? '';
          if (cookieHeaderStringLooksAuthLike(cookieHeaderSource)) {
            signals.authCookieWriteCount += 1;
            if (!cookieHeaderStringHasHardening(cookieHeaderSource)) {
              signals.authCookieMissingHardeningCount += 1;
            }
          }
        }
      }

      if (
        ((ts.isIdentifier(node.expression) && node.expression.text === 'open') ||
          (ts.isPropertyAccessExpression(node.expression) &&
            ts.isIdentifier(node.expression.expression) &&
            node.expression.expression.text === 'window' &&
            isPropertyNamed(node.expression.name, 'open'))) &&
        secondArgumentLiteral === '_blank'
      ) {
        const featureLiteral = getExpressionLiteralValue(node.arguments[2])?.toLowerCase() ?? '';
        if (!featureLiteral.includes('noopener') || !featureLiteral.includes('noreferrer')) {
          signals.windowOpenWithoutNoopenerCount += 1;
        }
      }

      if (ts.isPropertyAccessExpression(node.expression)) {
        if (isPropertyNamed(node.expression.name, 'insertAdjacentHTML')) {
          signals.rawHtmlInjectionCount += 1;
        }
        if (
          isBrowserStorageObject(node.expression.expression) &&
          isPropertyNamed(node.expression.name, 'setItem') &&
          isAuthStorageKeyLiteral(node.arguments[0])
        ) {
          signals.authStorageWriteCount += 1;
        }
        if (isCookieMutationSetCall(node)) {
          const firstArgument = node.arguments[0];
          const isObjectConfigCall = ts.isObjectLiteralExpression(firstArgument);
          const isAuthCookieWrite = isObjectConfigCall
            ? objectLiteralLooksLikeAuthCookieConfig(firstArgument, sourceFile)
            : expressionLooksLikeAuthCookieName(firstArgument, sourceFile);
          if (isAuthCookieWrite) {
            signals.authCookieWriteCount += 1;
            const hardeningSource = isObjectConfigCall ? firstArgument : node.arguments[2];
            if (!hasExplicitAuthCookieHardening(hardeningSource)) {
              signals.authCookieMissingHardeningCount += 1;
            }
          }
        }
        if (
          isPropertyNamed(node.expression.name, 'delete') &&
          node.arguments.length > 0 &&
          isAuthorizationHeaderName(node.arguments[0])
        ) {
          signals.authHeaderClearCount += 1;
        }
        if (
          (isPropertyNamed(node.expression.name, 'set') ||
            isPropertyNamed(node.expression.name, 'append')) &&
          node.arguments.length > 0 &&
          isAuthorizationHeaderName(node.arguments[0])
        ) {
          if (isHeaderClearValue(node.arguments[1])) {
            signals.authHeaderClearCount += 1;
          } else {
            signals.authHeaderWriteCount += 1;
          }
        }
        if (
          ts.isIdentifier(node.expression.expression) &&
          node.expression.expression.text === 'document' &&
          isPropertyNamed(node.expression.name, 'write')
        ) {
          signals.rawHtmlInjectionCount += 1;
        }
        if (isPropertyNamed(node.expression.name, 'eval')) {
          signals.dynamicEvalCount += 1;
        }
      }
    }

    if (
      ts.isNewExpression(node) &&
      isRealtimeTransportConstructor(node) &&
      isInsecureTransportUrl(getExpressionLiteralValue(node.arguments?.[0]))
    ) {
      signals.insecureTransportEndpointCount += 1;
    }

    if (
      ts.isNewExpression(node) &&
      ts.isIdentifier(node.expression) &&
      node.expression.text === 'Function'
    ) {
      signals.dynamicEvalCount += 1;
    }

    if (
      ts.isNewExpression(node) &&
      ts.isIdentifier(node.expression) &&
      ['WebSocket', 'EventSource'].includes(node.expression.text) &&
      isInsecureTransportUrl(getExpressionLiteralValue(node.arguments?.[0]))
    ) {
      signals.insecureTransportEndpointCount += 1;
    }

    if (ts.isJsxSelfClosingElement(node)) {
      const tagName = getJsxTagName(node);
      if (hasMainLandmarkSignal(node.attributes, tagName)) {
        signals.mainLandmarkCount += 1;
      }
      if (isNavigationLandmark(tagName, node.attributes)) {
        navigationLandmarkCount += 1;
        if (!hasNavigationLabel(node.attributes)) {
          unlabeledNavigationLandmarkCount += 1;
        }
      }
      const mainLandmarkId = getMainLandmarkId(node.attributes, tagName);
      if (mainLandmarkId && !signals.mainLandmarkIds.includes(mainLandmarkId)) {
        signals.mainLandmarkIds.push(mainLandmarkId);
      }
      const skipNavTargetId = getSkipNavTargetId(node.attributes, tagName);
      if (skipNavTargetId && !signals.skipNavTargetIds.includes(skipNavTargetId)) {
        signals.skipNavTargetIds.push(skipNavTargetId);
      }
      if (
        tagName === 'button' &&
        hasAncestorJsxTag(node, 'form') &&
        !getJsxAttribute(node.attributes, 'type')
      ) {
        signals.buttonInFormWithoutTypeCount += 1;
      }
      if (tagName === 'button' && !hasAccessibleLabel(node.attributes, '')) {
        signals.iconOnlyButtonWithoutLabelCount += 1;
      }
      if (isLinkLikeTag(tagName) && !hasAccessibleLabel(node.attributes, '')) {
        signals.iconOnlyLinkWithoutLabelCount += 1;
      }
      if (isImageLikeTag(tagName) && !getJsxAttribute(node.attributes, 'alt')) {
        signals.imageWithoutAltCount += 1;
      }
      if (isImageSourceLikeTag(tagName) && isInsecureExternalImage(node.attributes)) {
        signals.insecureExternalImageCount += 1;
      }
      if (tagName === 'iframe' && !getJsxAttribute(node.attributes, 'title')) {
        signals.iframeWithoutTitleCount += 1;
      }
      if (isDialogLikeElement(node.attributes, tagName) && !hasDialogLabel(node.attributes)) {
        signals.dialogWithoutLabelCount += 1;
      }
      if (
        isDialogLikeElement(node.attributes, tagName) &&
        !hasDialogModalHint(node.attributes, tagName)
      ) {
        signals.dialogWithoutModalHintCount += 1;
      }
      if (
        tagName === 'iframe' &&
        isExternalUrl(getJsxAttributeLiteralValue(getJsxAttribute(node.attributes, 'src'))) &&
        !getJsxAttribute(node.attributes, 'sandbox')
      ) {
        signals.externalIframeWithoutSandboxCount += 1;
      }
      if (
        tagName === 'iframe' &&
        isInsecureExternalUrl(getJsxAttributeLiteralValue(getJsxAttribute(node.attributes, 'src')))
      ) {
        signals.insecureExternalIframeCount += 1;
      }
      if (tagName === 'form' && hasInsecureFormAction(node.attributes)) {
        signals.insecureFormActionCount += 1;
      }
      if (
        isNonSemanticInteractiveTag(tagName) &&
        getJsxAttribute(node.attributes, 'onClick') &&
        !getJsxAttribute(node.attributes, 'role') &&
        !getJsxAttribute(node.attributes, 'tabIndex')
      ) {
        signals.clickableNonSemanticCount += 1;
      }
      if (isLinkLikeTag(tagName) && isExternalLinkTargetBlankWithoutRel(node.attributes)) {
        signals.externalBlankLinkWithoutRelCount += 1;
      }
      if (hasPlaceholderNavigationTarget(node.attributes)) {
        signals.placeholderNavigationTargetCount += 1;
      }
      if (tagName === 'input') {
        const inputType = getNormalizedInputType(node.attributes);
        const autocompleteValue = getJsxAttributeLiteralValue(
          getJsxAttribute(node.attributes, 'autocomplete', 'autoComplete'),
        )
          ?.trim()
          .toLowerCase();
        const hasAutocomplete = Boolean(autocompleteValue);
        if (inputType === 'email' && !hasAutocomplete) {
          signals.emailAutocompleteMissingCount += 1;
        }
        if (inputType === 'password' && !hasAutocomplete) {
          signals.passwordAutocompleteMissingCount += 1;
        }
        if (hasOtpAutocompleteIssue(node.attributes)) {
          signals.otpAutocompleteMissingCount += 1;
        }
        if ((inputType === 'email' || inputType === 'password') && autocompleteValue === 'off') {
          signals.authAutocompleteDisabledCount += 1;
        }
        if (hasAuthAutocompleteSemanticMismatch(node.attributes)) {
          signals.authAutocompleteSemanticMismatchCount += 1;
        }
        if (hasAuthInputTypeMismatch(node.attributes)) {
          signals.authInputTypeMismatchCount += 1;
        }
        if (
          hasAncestorJsxTag(node, 'form') &&
          isAuthLikeInputAttributes(node.attributes) &&
          !getJsxAttribute(node.attributes, 'name')
        ) {
          signals.authInputWithoutNameCount += 1;
        }
      }
      if (!hasFormControlLabel(node, tagName, node.attributes, labelForIds, '')) {
        signals.formControlWithoutLabelCount += 1;
      }
    }

    if (ts.isJsxElement(node)) {
      const tagName = getJsxTagName(node.openingElement);
      const textContent = getJsxTextContent(node).replace(/\s+/g, ' ').trim();

      if (hasMainLandmarkSignal(node.openingElement.attributes, tagName)) {
        signals.mainLandmarkCount += 1;
      }
      if (isNavigationLandmark(tagName, node.openingElement.attributes)) {
        navigationLandmarkCount += 1;
        if (!hasNavigationLabel(node.openingElement.attributes)) {
          unlabeledNavigationLandmarkCount += 1;
        }
      }
      const mainLandmarkId = getMainLandmarkId(node.openingElement.attributes, tagName);
      if (mainLandmarkId && !signals.mainLandmarkIds.includes(mainLandmarkId)) {
        signals.mainLandmarkIds.push(mainLandmarkId);
      }
      const skipNavTargetId = getSkipNavTargetId(node.openingElement.attributes, tagName);
      if (skipNavTargetId && !signals.skipNavTargetIds.includes(skipNavTargetId)) {
        signals.skipNavTargetIds.push(skipNavTargetId);
      }
      if (
        tagName === 'button' &&
        hasAncestorJsxTag(node, 'form') &&
        !getJsxAttribute(node.openingElement.attributes, 'type')
      ) {
        signals.buttonInFormWithoutTypeCount += 1;
      }
      if (
        tagName === 'button' &&
        !hasAccessibleLabel(node.openingElement.attributes, textContent)
      ) {
        signals.iconOnlyButtonWithoutLabelCount += 1;
      }
      if (
        isLinkLikeTag(tagName) &&
        !hasAccessibleLabel(node.openingElement.attributes, textContent)
      ) {
        signals.iconOnlyLinkWithoutLabelCount += 1;
      }
      if (isImageLikeTag(tagName) && !getJsxAttribute(node.openingElement.attributes, 'alt')) {
        signals.imageWithoutAltCount += 1;
      }
      if (
        isImageSourceLikeTag(tagName) &&
        isInsecureExternalImage(node.openingElement.attributes)
      ) {
        signals.insecureExternalImageCount += 1;
      }
      if (tagName === 'iframe' && !getJsxAttribute(node.openingElement.attributes, 'title')) {
        signals.iframeWithoutTitleCount += 1;
      }
      if (
        isDialogLikeElement(node.openingElement.attributes, tagName) &&
        !hasDialogLabel(node.openingElement.attributes)
      ) {
        signals.dialogWithoutLabelCount += 1;
      }
      if (
        isDialogLikeElement(node.openingElement.attributes, tagName) &&
        !hasDialogModalHint(node.openingElement.attributes, tagName)
      ) {
        signals.dialogWithoutModalHintCount += 1;
      }
      if (
        tagName === 'iframe' &&
        isExternalUrl(
          getJsxAttributeLiteralValue(getJsxAttribute(node.openingElement.attributes, 'src')),
        ) &&
        !getJsxAttribute(node.openingElement.attributes, 'sandbox')
      ) {
        signals.externalIframeWithoutSandboxCount += 1;
      }
      if (
        tagName === 'iframe' &&
        isInsecureExternalUrl(
          getJsxAttributeLiteralValue(getJsxAttribute(node.openingElement.attributes, 'src')),
        )
      ) {
        signals.insecureExternalIframeCount += 1;
      }
      if (tagName === 'form' && hasInsecureFormAction(node.openingElement.attributes)) {
        signals.insecureFormActionCount += 1;
      }
      if (tagName === 'form' && hasInsecureAuthFormMethod(node)) {
        signals.insecureAuthFormMethodCount += 1;
      }
      if (tagName === 'form' && hasAuthFormWithoutSubmitControl(node)) {
        signals.authFormWithoutSubmitCount += 1;
      }
      if (tagName === 'table' && !jsxTreeHasTag(node, ['th'])) {
        signals.tableWithoutHeaderCount += 1;
      }
      if (tagName === 'table' && !jsxTreeHasTag(node, ['caption'])) {
        signals.tableWithoutCaptionCount += 1;
      }

      if (
        isNonSemanticInteractiveTag(tagName) &&
        getJsxAttribute(node.openingElement.attributes, 'onClick') &&
        !getJsxAttribute(node.openingElement.attributes, 'role') &&
        !getJsxAttribute(node.openingElement.attributes, 'tabIndex')
      ) {
        signals.clickableNonSemanticCount += 1;
      }
      if (
        isLinkLikeTag(tagName) &&
        isExternalLinkTargetBlankWithoutRel(node.openingElement.attributes)
      ) {
        signals.externalBlankLinkWithoutRelCount += 1;
      }
      if (hasPlaceholderNavigationTarget(node.openingElement.attributes)) {
        signals.placeholderNavigationTargetCount += 1;
      }
      if (tagName === 'input') {
        const inputType = getNormalizedInputType(node.openingElement.attributes);
        const autocompleteValue = getJsxAttributeLiteralValue(
          getJsxAttribute(node.openingElement.attributes, 'autocomplete', 'autoComplete'),
        )
          ?.trim()
          .toLowerCase();
        const hasAutocomplete = Boolean(autocompleteValue);
        if (inputType === 'email' && !hasAutocomplete) {
          signals.emailAutocompleteMissingCount += 1;
        }
        if (inputType === 'password' && !hasAutocomplete) {
          signals.passwordAutocompleteMissingCount += 1;
        }
        if (hasOtpAutocompleteIssue(node.openingElement.attributes)) {
          signals.otpAutocompleteMissingCount += 1;
        }
        if ((inputType === 'email' || inputType === 'password') && autocompleteValue === 'off') {
          signals.authAutocompleteDisabledCount += 1;
        }
        if (hasAuthAutocompleteSemanticMismatch(node.openingElement.attributes)) {
          signals.authAutocompleteSemanticMismatchCount += 1;
        }
        if (hasAuthInputTypeMismatch(node.openingElement.attributes)) {
          signals.authInputTypeMismatchCount += 1;
        }
        if (
          hasAncestorJsxTag(node, 'form') &&
          isAuthLikeInputAttributes(node.openingElement.attributes) &&
          !getJsxAttribute(node.openingElement.attributes, 'name')
        ) {
          signals.authInputWithoutNameCount += 1;
        }
      }
      if (
        !hasFormControlLabel(
          node,
          tagName,
          node.openingElement.attributes,
          labelForIds,
          textContent,
        )
      ) {
        signals.formControlWithoutLabelCount += 1;
      }
    }

    ts.forEachChild(node, walk);
  };

  walk(sourceFile);
  signals.unlabeledNavigationLandmarkCount =
    navigationLandmarkCount > 1 ? unlabeledNavigationLandmarkCount : 0;
  signals.multipleMainLandmarkCount = Math.max(0, signals.mainLandmarkCount - 1);
  return signals;
}

export function critiqueSource({
  filePath,
  code,
  reviewPack = null,
  packManifest = null,
  treatmentsCss = '',
  adoptionMode = null,
}: CritiqueSourceInput): FileCritiqueReport {
  const codeLower = code.toLowerCase();
  const astSignals = analyzeAstSignals(filePath, code);
  const focusAreas = resolveFocusAreas(reviewPack);
  const findings: VerificationFinding[] = [];
  const scores: VerificationScore[] = [];
  const antiPatternIds = new Set(reviewPack?.antiPatterns.map((entry) => entry.id) ?? []);
  const isProjectOwnedStyling =
    adoptionMode === 'contract-only' || adoptionMode === 'style-bridge';

  const usedTreatments = TREATMENT_CLASSES.filter((token) => code.includes(token));
  if (isProjectOwnedStyling) {
    scores.push({
      category: 'Styling Authority',
      focusArea: 'treatment-usage',
      score: 3,
      details:
        'Contract-only/style-bridge adoption does not require Decantr d-* treatment classes in source files.',
      suggestions: [
        'Codify project-owned component variants, local rules, or a style bridge when button/card/surface drift needs stronger enforcement.',
      ],
    });
  } else {
    const treatmentSuggestions = TREATMENT_CLASSES.filter((token) => !code.includes(token)).map(
      (token) => `Consider using \`${token}\` where appropriate.`,
    );
    scores.push({
      category: 'Treatment Usage',
      focusArea: 'treatment-usage',
      score: scoreRatio(usedTreatments.length, TREATMENT_CLASSES.length),
      details: `${usedTreatments.length}/${TREATMENT_CLASSES.length} base treatments used: ${usedTreatments.join(', ') || 'none'}`,
      suggestions: treatmentSuggestions,
    });
    if (focusAreas.includes('treatment-usage') && usedTreatments.length === 0) {
      findings.push(
        makeFinding({
          id: 'treatment-usage-missing',
          category: 'Treatment Usage',
          severity: resolveSeverityFromChecks(reviewPack, 'warn', [
            'page-pattern-contract',
            'section-pattern-coverage',
          ]),
          message: 'No Decantr treatment classes were detected in the reviewed file.',
          evidence: [
            filePath,
            'Expected tokens include d-interactive, d-surface, d-data, d-control, d-section, d-annotation, d-label.',
          ],
          file: filePath,
          suggestedFix:
            'Apply the compiled treatment vocabulary instead of hand-rolled utility styling.',
        }),
      );
    }
  }

  const decoratorNames = buildDecoratorInventory(treatmentsCss);
  const usedDecorators = decoratorNames.filter((name) => code.includes(name));
  const usesCssVars = code.includes('var(--');
  if (isProjectOwnedStyling) {
    scores.push({
      category: 'Theme Consistency',
      focusArea: 'theme-consistency',
      score: usesCssVars ? 4 : 3,
      details: `Contract-only/style-bridge mode: Decantr decorators are not required; CSS vars: ${usesCssVars ? 'yes' : 'no'}.`,
      suggestions: [
        'Use the app design system, Tailwind theme, Sass variables, component variants, or accepted local rules as the styling authority.',
      ],
    });
  } else {
    scores.push({
      category: 'Theme Consistency',
      focusArea: 'theme-consistency',
      score:
        decoratorNames.length > 0
          ? scoreRatio((usedDecorators.length > 0 ? 1 : 0) + (usesCssVars ? 1 : 0), 2)
          : usesCssVars
            ? 4
            : 2,
      details: `Decorators used: ${usedDecorators.join(', ') || 'none'}; CSS vars: ${usesCssVars ? 'yes' : 'no'}`,
      suggestions: [
        ...(!usesCssVars ? ['Prefer CSS variable references over hardcoded visual values.'] : []),
        ...(decoratorNames.length > 0 && usedDecorators.length === 0
          ? ['Use theme decorators from treatments.css when they fit the component intent.']
          : []),
      ],
    });
    if (focusAreas.includes('theme-consistency') && !usesCssVars && usedDecorators.length === 0) {
      findings.push(
        makeFinding({
          id: 'theme-consistency-weak',
          category: 'Theme Consistency',
          severity: resolveSeverityFromChecks(reviewPack, 'warn', [
            'theme-consistency',
            'mutation-theme-contract',
          ]),
          message:
            'The file does not appear to use theme decorators or CSS variables from the compiled contract.',
          evidence: [
            filePath,
            `Decorators available: ${decoratorNames.slice(0, 5).join(', ') || 'none'}`,
          ],
          file: filePath,
          suggestedFix:
            'Anchor styling to tokens.css and treatments.css instead of local hardcoded values.',
        }),
      );
    }
  }

  const hasAria = codeLower.includes('aria-') || codeLower.includes('role=');
  const hasFocus = codeLower.includes('focus-visible') || codeLower.includes('focusvisible');
  const hasKeyboard = codeLower.includes('onkeydown') || codeLower.includes('onkeyup');
  const iconButtonIssues = astSignals.iconOnlyButtonWithoutLabelCount;
  const iconLinkIssues = astSignals.iconOnlyLinkWithoutLabelCount;
  const clickableNonSemanticIssues = astSignals.clickableNonSemanticCount;
  const unlabeledNavigationLandmarkIssues = astSignals.unlabeledNavigationLandmarkCount;
  const multipleMainLandmarkIssues = astSignals.multipleMainLandmarkCount;
  const imageAltIssues = astSignals.imageWithoutAltCount;
  const iframeTitleIssues = astSignals.iframeWithoutTitleCount;
  const dialogLabelIssues = astSignals.dialogWithoutLabelCount;
  const dialogModalHintIssues = astSignals.dialogWithoutModalHintCount;
  const tableHeaderIssues = astSignals.tableWithoutHeaderCount;
  const tableCaptionIssues = astSignals.tableWithoutCaptionCount;
  const formControlLabelIssues = astSignals.formControlWithoutLabelCount;
  scores.push({
    category: 'Accessibility',
    focusArea: 'accessibility',
    score: Math.max(
      1,
      Math.min(
        5,
        1 +
          (hasAria ? 2 : 0) +
          (hasFocus ? 1 : 0) +
          (hasKeyboard ? 1 : 0) -
          (iconButtonIssues > 0 ? 1 : 0) -
          (iconLinkIssues > 0 ? 1 : 0) -
          (clickableNonSemanticIssues > 0 ? 1 : 0) -
          (unlabeledNavigationLandmarkIssues > 0 ? 1 : 0) -
          (multipleMainLandmarkIssues > 0 ? 1 : 0) -
          (imageAltIssues > 0 ? 1 : 0) -
          (iframeTitleIssues > 0 ? 1 : 0) -
          (dialogLabelIssues > 0 ? 1 : 0) -
          (dialogModalHintIssues > 0 ? 1 : 0) -
          (tableHeaderIssues > 0 ? 1 : 0) -
          (tableCaptionIssues > 0 ? 1 : 0) -
          (formControlLabelIssues > 0 ? 1 : 0),
      ),
    ),
    details: `ARIA: ${hasAria ? 'yes' : 'no'}, Focus: ${hasFocus ? 'yes' : 'no'}, Keyboard: ${hasKeyboard ? 'yes' : 'no'}, unlabeled icon buttons: ${iconButtonIssues}, unlabeled icon links: ${iconLinkIssues}, clickable non-semantic elements: ${clickableNonSemanticIssues}, unlabeled navigation landmarks: ${unlabeledNavigationLandmarkIssues}, extra main landmarks: ${multipleMainLandmarkIssues}, images without alt: ${imageAltIssues}, iframes without title: ${iframeTitleIssues}, dialogs without label: ${dialogLabelIssues}, dialogs without modal hint: ${dialogModalHintIssues}, tables without headers: ${tableHeaderIssues}, tables without caption: ${tableCaptionIssues}, form controls without labels: ${formControlLabelIssues}`,
    suggestions: [
      ...(!hasAria ? ['Add ARIA roles or labels to interactive regions.'] : []),
      ...(!hasFocus ? ['Add visible focus styling for keyboard navigation.'] : []),
      ...(!hasKeyboard
        ? ['Add keyboard handling where interactive behavior depends on pointer events.']
        : []),
      ...(iconButtonIssues > 0
        ? ['Add accessible labels to icon-only buttons via visible text or aria-label.']
        : []),
      ...(iconLinkIssues > 0
        ? ['Add accessible labels to icon-only links via visible text or aria-label.']
        : []),
      ...(clickableNonSemanticIssues > 0
        ? [
            'Use semantic interactive elements or add role/tabIndex and keyboard handling to clickable non-semantic containers.',
          ]
        : []),
      ...(unlabeledNavigationLandmarkIssues > 0
        ? [
            'Give multiple navigation landmarks distinct labels so assistive technologies can differentiate primary, sidebar, and utility nav regions.',
          ]
        : []),
      ...(multipleMainLandmarkIssues > 0
        ? ['Keep only one primary main landmark per rendered page or shell surface.']
        : []),
      ...(imageAltIssues > 0
        ? ['Add alt text to meaningful images and use alt="" only for decorative ones.']
        : []),
      ...(iframeTitleIssues > 0
        ? [
            'Add descriptive title attributes to embedded iframes so assistive technologies can identify their purpose.',
          ]
        : []),
      ...(dialogLabelIssues > 0
        ? ['Give dialogs an explicit accessible name via aria-label, aria-labelledby, or title.']
        : []),
      ...(dialogModalHintIssues > 0
        ? [
            'Expose modal intent on dialog surfaces with aria-modal="true" or a native open dialog contract.',
          ]
        : []),
      ...(tableHeaderIssues > 0
        ? [
            'Give tables explicit header cells so assistive technologies can map data cells to column or row labels.',
          ]
        : []),
      ...(tableCaptionIssues > 0
        ? [
            'Add a caption or equivalent programmatic summary so the table purpose is clear before users navigate its cells.',
          ]
        : []),
      ...(formControlLabelIssues > 0
        ? ['Add programmatic labels to form controls instead of relying on placeholders alone.']
        : []),
    ],
  });
  if (focusAreas.includes('accessibility')) {
    if (!hasAria) {
      findings.push(
        makeFinding({
          id: 'accessibility-aria-missing',
          category: 'Accessibility',
          severity: resolveSeverityFromChecks(reviewPack, 'warn', ['review-contract-baseline']),
          message: 'No ARIA roles or labels were detected in the reviewed file.',
          evidence: [filePath],
          file: filePath,
          suggestedFix: 'Add ARIA metadata to interactive or landmark elements.',
        }),
      );
    }
    if (!hasKeyboard) {
      findings.push(
        makeFinding({
          id: 'accessibility-keyboard-missing',
          category: 'Accessibility',
          severity: resolveSeverityFromChecks(reviewPack, 'info', ['review-remediation']),
          message: 'No keyboard interaction handlers were detected in the reviewed file.',
          evidence: [filePath],
          file: filePath,
          suggestedFix: 'Verify interactive elements remain usable from the keyboard.',
        }),
      );
    }
    if (iconButtonIssues > 0) {
      findings.push(
        makeFinding({
          id: 'accessibility-icon-button-label-missing',
          category: 'Accessibility',
          severity: resolveSeverityFromChecks(reviewPack, 'warn', ['review-contract-baseline']),
          message: 'Icon-only button elements were detected without an accessible label.',
          evidence: [filePath, `Unlabeled icon buttons: ${iconButtonIssues}`],
          file: filePath,
          suggestedFix:
            'Add visible text or an aria-label/aria-labelledby attribute to icon-only buttons.',
        }),
      );
    }
    if (iconLinkIssues > 0) {
      findings.push(
        makeFinding({
          id: 'accessibility-icon-link-label-missing',
          category: 'Accessibility',
          severity: resolveSeverityFromChecks(reviewPack, 'warn', ['review-contract-baseline']),
          message: 'Icon-only link elements were detected without an accessible label.',
          evidence: [filePath, `Unlabeled icon links: ${iconLinkIssues}`],
          file: filePath,
          suggestedFix:
            'Add visible text or an aria-label/aria-labelledby attribute to icon-only links.',
        }),
      );
    }
    if (clickableNonSemanticIssues > 0) {
      findings.push(
        makeFinding({
          id: 'accessibility-clickable-non-semantic',
          category: 'Accessibility',
          severity: resolveSeverityFromChecks(reviewPack, 'warn', [
            'review-remediation',
            'review-contract-baseline',
          ]),
          message:
            'Clickable non-semantic elements were detected without the semantic/keyboard affordances accessibility tools expect.',
          evidence: [
            filePath,
            `Clickable non-semantic elements without role/tabIndex: ${clickableNonSemanticIssues}`,
          ],
          file: filePath,
          suggestedFix:
            'Prefer semantic controls like button/link, or add role, tabIndex, and keyboard handlers to non-semantic interactive containers.',
        }),
      );
    }
    if (unlabeledNavigationLandmarkIssues > 0) {
      findings.push(
        makeFinding({
          id: 'accessibility-navigation-landmark-label-missing',
          category: 'Accessibility',
          severity: resolveSeverityFromChecks(reviewPack, 'warn', ['review-contract-baseline']),
          message:
            'Multiple navigation landmarks were detected without distinct accessible labels.',
          evidence: [
            filePath,
            `Unlabeled navigation landmarks: ${unlabeledNavigationLandmarkIssues}`,
          ],
          file: filePath,
          suggestedFix:
            'Label multiple nav regions with aria-label or aria-labelledby so assistive technologies can distinguish primary, sidebar, and utility navigation.',
        }),
      );
    }
    if (multipleMainLandmarkIssues > 0) {
      findings.push(
        makeFinding({
          id: 'accessibility-multiple-main-landmarks',
          category: 'Accessibility',
          severity: resolveSeverityFromChecks(reviewPack, 'warn', ['review-contract-baseline']),
          message: 'Multiple main landmarks were detected in the reviewed file.',
          evidence: [
            filePath,
            `Extra main landmarks beyond the first: ${multipleMainLandmarkIssues}`,
          ],
          file: filePath,
          suggestedFix:
            'Render one primary `<main>` landmark per page or shell surface and move secondary regions into section/article/div containers instead.',
        }),
      );
    }
    if (imageAltIssues > 0) {
      findings.push(
        makeFinding({
          id: 'accessibility-image-alt-missing',
          category: 'Accessibility',
          severity: resolveSeverityFromChecks(reviewPack, 'warn', ['review-contract-baseline']),
          message: 'Image elements were detected without an `alt` attribute.',
          evidence: [filePath, `Images without alt: ${imageAltIssues}`],
          file: filePath,
          suggestedFix:
            'Add meaningful alt text for informative images, or use alt="" when the image is purely decorative.',
        }),
      );
    }
    if (iframeTitleIssues > 0) {
      findings.push(
        makeFinding({
          id: 'accessibility-iframe-title-missing',
          category: 'Accessibility',
          severity: resolveSeverityFromChecks(reviewPack, 'warn', ['review-contract-baseline']),
          message: 'Iframe elements were detected without a descriptive `title` attribute.',
          evidence: [filePath, `Iframes without title: ${iframeTitleIssues}`],
          file: filePath,
          suggestedFix:
            'Add a concise title attribute to each iframe so assistive technologies can describe the embedded surface.',
        }),
      );
    }
    if (dialogLabelIssues > 0) {
      findings.push(
        makeFinding({
          id: 'accessibility-dialog-label-missing',
          category: 'Accessibility',
          severity: resolveSeverityFromChecks(reviewPack, 'warn', ['review-contract-baseline']),
          message: 'Dialog surfaces were detected without an explicit accessible name.',
          evidence: [
            filePath,
            `Dialogs without aria-label/aria-labelledby/title: ${dialogLabelIssues}`,
          ],
          file: filePath,
          suggestedFix:
            'Name dialogs with aria-label, aria-labelledby, or title so assistive technologies can announce the dialog context.',
        }),
      );
    }
    if (dialogModalHintIssues > 0) {
      findings.push(
        makeFinding({
          id: 'accessibility-dialog-modal-hint-missing',
          category: 'Accessibility',
          severity: resolveSeverityFromChecks(reviewPack, 'info', [
            'review-remediation',
            'review-contract-baseline',
          ]),
          message: 'Dialog surfaces were detected without an explicit modal hint.',
          evidence: [filePath, `Dialogs without aria-modal/open signal: ${dialogModalHintIssues}`],
          file: filePath,
          suggestedFix:
            'Expose modal intent with aria-modal="true" for custom dialogs, or rely on a reviewed native dialog/open contract.',
        }),
      );
    }
    if (tableHeaderIssues > 0) {
      findings.push(
        makeFinding({
          id: 'accessibility-table-headers-missing',
          category: 'Accessibility',
          severity: resolveSeverityFromChecks(reviewPack, 'warn', ['review-contract-baseline']),
          message: 'Table markup was detected without header cells.',
          evidence: [filePath, `Tables without <th> headers: ${tableHeaderIssues}`],
          file: filePath,
          suggestedFix:
            'Add <th> cells with appropriate scope or otherwise expose explicit table headers so assistive technologies can map the data grid correctly.',
        }),
      );
    }
    if (tableCaptionIssues > 0) {
      findings.push(
        makeFinding({
          id: 'accessibility-table-caption-missing',
          category: 'Accessibility',
          severity: resolveSeverityFromChecks(reviewPack, 'info', [
            'review-remediation',
            'review-contract-baseline',
          ]),
          message: 'Table markup was detected without a caption or programmatic summary.',
          evidence: [filePath, `Tables without caption: ${tableCaptionIssues}`],
          file: filePath,
          suggestedFix:
            'Add a <caption> or equivalent summary so users understand the table purpose before navigating its cells.',
        }),
      );
    }
    if (formControlLabelIssues > 0) {
      findings.push(
        makeFinding({
          id: 'accessibility-form-control-label-missing',
          category: 'Accessibility',
          severity: resolveSeverityFromChecks(reviewPack, 'warn', [
            'review-contract-baseline',
            'review-remediation',
          ]),
          message: 'Form controls were detected without an associated accessible label.',
          evidence: [filePath, `Form controls without labels: ${formControlLabelIssues}`],
          file: filePath,
          suggestedFix:
            'Associate inputs with visible labels or use aria-label/aria-labelledby when a visible label is not appropriate.',
        }),
      );
    }
  }

  const hasMedia =
    codeLower.includes('@media') ||
    codeLower.includes('usemediaquery') ||
    codeLower.includes('breakpoint');
  const hasResponsive =
    codeLower.includes('sm:') ||
    codeLower.includes('md:') ||
    codeLower.includes('lg:') ||
    codeLower.includes('_sm_') ||
    codeLower.includes('_md_');
  scores.push({
    category: 'Responsive Design',
    focusArea: 'responsive-design',
    score: Math.min(5, (hasMedia ? 3 : 1) + (hasResponsive ? 2 : 0)),
    details: `Media queries: ${hasMedia ? 'yes' : 'no'}, Responsive signals: ${hasResponsive ? 'yes' : 'no'}`,
    suggestions: !hasMedia && !hasResponsive ? ['Add responsive breakpoint handling.'] : [],
  });
  if (focusAreas.includes('responsive-design') && !hasMedia && !hasResponsive) {
    findings.push(
      makeFinding({
        id: 'responsive-signals-missing',
        category: 'Responsive Design',
        severity: resolveSeverityFromChecks(reviewPack, 'warn', ['page-pattern-contract']),
        message: 'No responsive breakpoint handling was detected in the reviewed file.',
        evidence: [filePath],
        file: filePath,
        suggestedFix: 'Add responsive layout behavior that matches the compiled route contract.',
      }),
    );
  }

  const hasTransition =
    codeLower.includes('transition') ||
    codeLower.includes('animate') ||
    codeLower.includes('keyframe') ||
    codeLower.includes('framer');
  const hasHover =
    codeLower.includes(':hover') ||
    codeLower.includes('onmouseenter') ||
    codeLower.includes('hover:');
  const buttonInFormWithoutTypeCount = astSignals.buttonInFormWithoutTypeCount;
  const authFormWithoutSubmitCount = astSignals.authFormWithoutSubmitCount;
  const authInputWithoutNameCount = astSignals.authInputWithoutNameCount;
  const authProtectedRedirectSignalCount = astSignals.authProtectedRedirectSignalCount;
  const authAnonymousRedirectSignalCount = astSignals.authAnonymousRedirectSignalCount;
  const authExitSignalCount = astSignals.authExitSignalCount;
  const authSessionTeardownSignalCount = astSignals.authSessionTeardownSignalCount;
  const authStorageWriteCount = astSignals.authStorageWriteCount;
  const authStorageClearCount = astSignals.authStorageClearCount;
  const authCookieWriteCount = astSignals.authCookieWriteCount;
  const authCookieClearCount = astSignals.authCookieClearCount;
  const authHeaderWriteCount = astSignals.authHeaderWriteCount;
  const authHeaderClearCount = astSignals.authHeaderClearCount;
  const authCacheClientCount = astSignals.authCacheClientCount;
  const authCacheClearCount = astSignals.authCacheClearCount;
  const authRefreshSignalCount = astSignals.authRefreshSignalCount;
  const authRefreshClearCount = astSignals.authRefreshClearCount;
  const authRealtimeSignalCount = countAuthRealtimeSignals(code);
  const authRealtimeClearCount = countAuthRealtimeClearSignals(code);
  const authCoordinationSignalCount = countAuthCoordinationSignals(code);
  const authCoordinationClearCount = countAuthCoordinationClearSignals(code);
  const authErrorSignalCount = countAuthErrorSignals(code);
  const authSuccessSignalCount = countAuthSuccessSignals(code);
  const authCallbackTokenSignalCount = countAuthCallbackTokenSignals(code, filePath);
  const authCallbackExchangeSignalCount = countAuthCallbackExchangeSignals(code);
  const authCallbackExchangeErrorSignalCount = countAuthCallbackExchangeErrorSignals(code);
  const authCallbackErrorSignalCount = countAuthCallbackErrorSignals(code, filePath);
  const authCallbackStateSignalCount = countAuthCallbackStateSignals(code);
  const authCallbackStateValidationSignalCount = countAuthCallbackStateValidationSignals(code);
  const authCallbackStateStorageSignalCount = countAuthCallbackStateStorageSignals(code);
  const authCallbackStateStorageClearSignalCount = countAuthCallbackStateStorageClearSignals(code);
  const authUnauthenticatedBranchSignalCount = countAuthUnauthenticatedBranchSignals(code);
  const hasAuthCallbackErrorGap =
    authCallbackTokenSignalCount > 0 && authCallbackErrorSignalCount === 0;
  scores.push({
    category: 'Motion & Interaction',
    focusArea: 'motion-interaction',
    score: Math.max(
      1,
      Math.min(
        5,
        (hasTransition ? 3 : 1) +
          (hasHover ? 2 : 0) -
          (buttonInFormWithoutTypeCount > 0 ? 1 : 0) -
          (authFormWithoutSubmitCount > 0 ? 1 : 0) -
          (authInputWithoutNameCount > 0 ? 1 : 0) -
          (authExitSignalCount > 0 && authSessionTeardownSignalCount === 0 ? 1 : 0),
      ),
    ),
    details: `Transitions: ${hasTransition ? 'yes' : 'no'}, Hover states: ${hasHover ? 'yes' : 'no'}, form buttons missing type: ${buttonInFormWithoutTypeCount}, auth forms without submit control: ${authFormWithoutSubmitCount}, auth inputs without name: ${authInputWithoutNameCount}, auth redirects to protected routes: ${authProtectedRedirectSignalCount}, auth exits without anonymous redirect: ${authExitSignalCount > 0 && authAnonymousRedirectSignalCount === 0 ? 1 : 0}, auth exits without teardown: ${authExitSignalCount > 0 && authSessionTeardownSignalCount === 0 ? 1 : 0}`,
    suggestions: [
      ...(!hasTransition
        ? ['Add transitions for interactive state changes where appropriate.']
        : []),
      ...(buttonInFormWithoutTypeCount > 0
        ? [
            'Add explicit button types inside forms so non-submit actions do not accidentally submit.',
          ]
        : []),
      ...(authFormWithoutSubmitCount > 0
        ? [
            'Auth-like forms should expose a clear submit control so users can actually complete the credential flow.',
          ]
        : []),
      ...(authInputWithoutNameCount > 0
        ? [
            'Give auth-related form inputs stable `name` attributes so browser form posts and FormData submissions include the credential values.',
          ]
        : []),
      ...(authProtectedRedirectSignalCount > 0
        ? [
            'Keep unauthenticated guard redirects pointed at anonymous entry routes, not protected destinations like `/dashboard` or `/app`.',
          ]
        : []),
      ...(authExitSignalCount > 0 && authAnonymousRedirectSignalCount === 0
        ? [
            'After sign-out, return users to an anonymous entry route instead of leaving the protected shell in place.',
          ]
        : []),
      ...(authExitSignalCount > 0 && authSessionTeardownSignalCount === 0
        ? [
            'Do not treat redirect-only logout as a complete sign-out. Explicitly invalidate the reviewed session before returning users to an anonymous route.',
          ]
        : []),
    ],
  });
  if (buttonInFormWithoutTypeCount > 0) {
    findings.push(
      makeFinding({
        id: 'interaction-button-type-missing',
        category: 'Interaction Safety',
        severity: 'warn',
        message: 'Buttons inside forms were detected without an explicit `type` attribute.',
        evidence: [filePath, `Buttons inside forms without type: ${buttonInFormWithoutTypeCount}`],
        file: filePath,
        suggestedFix:
          'Set `type="button"` for non-submit actions and `type="submit"` for the intended submit control.',
      }),
    );
  }

  if (authFormWithoutSubmitCount > 0) {
    findings.push(
      makeFinding({
        id: 'interaction-auth-submit-missing',
        category: 'Interaction Safety',
        severity: 'warn',
        message: 'Auth-like forms were detected without any submit control.',
        evidence: [filePath, `Auth forms without submit control: ${authFormWithoutSubmitCount}`],
        file: filePath,
        suggestedFix:
          'Add an explicit submit button or submit input so users can complete the sign-in, registration, or recovery flow.',
      }),
    );
  }

  if (authInputWithoutNameCount > 0) {
    findings.push(
      makeFinding({
        id: 'interaction-auth-input-name-missing',
        category: 'Interaction Safety',
        severity: 'warn',
        message: 'Auth-like form inputs were detected without a `name` attribute.',
        evidence: [filePath, `Auth inputs without name: ${authInputWithoutNameCount}`],
        file: filePath,
        suggestedFix:
          'Add stable name attributes such as `email`, `username`, or `password` so browser form submission and FormData handling include the credential values.',
      }),
    );
  }

  if (
    authProtectedRedirectSignalCount > 0 &&
    (astSignals.authGuardSignalCount > 0 || astSignals.authSessionSignalCount > 0) &&
    astSignals.authEntrySignalCount === 0
  ) {
    findings.push(
      makeFinding({
        id: 'route-auth-guard-protected-redirect',
        category: 'Route Topology',
        severity: 'warn',
        message:
          'Auth/session logic in the reviewed file redirects toward protected destinations instead of anonymous entry routes.',
        evidence: [filePath, `Protected auth redirects: ${authProtectedRedirectSignalCount}`],
        file: filePath,
        suggestedFix:
          'Redirect unauthenticated flows to `/`, `/login`, `/register`, or another gateway route, and reserve redirects to `/dashboard` or `/app` for reviewed post-auth success flows.',
      }),
    );
  }

  if (
    authExitSignalCount > 0 &&
    (astSignals.authSessionSignalCount > 0 || astSignals.authGuardSignalCount > 0) &&
    authAnonymousRedirectSignalCount === 0
  ) {
    findings.push(
      makeFinding({
        id: 'route-auth-exit-redirect-missing',
        category: 'Route Topology',
        severity: 'info',
        message:
          'Auth/session exit logic does not show an obvious redirect back to an anonymous entry route.',
        evidence: [
          filePath,
          `Auth exit signals: ${authExitSignalCount}`,
          `Anonymous auth redirects: ${authAnonymousRedirectSignalCount}`,
        ],
        file: filePath,
        suggestedFix:
          'After logout or session exit, navigate users to `/`, `/login`, `/register`, or another reviewed anonymous entry route so protected shells do not linger after sign-out.',
      }),
    );
  }

  if (
    authExitSignalCount > 0 &&
    (astSignals.authSessionSignalCount > 0 || astSignals.authGuardSignalCount > 0) &&
    authSessionTeardownSignalCount === 0
  ) {
    findings.push(
      makeFinding({
        id: 'state-auth-exit-teardown-missing',
        category: 'State Handling',
        severity: 'warn',
        message:
          'Auth/session exit logic redirects users away but does not show an obvious session teardown or sign-out boundary.',
        evidence: [
          filePath,
          `Auth exit signals: ${authExitSignalCount}`,
          `Session teardown signals: ${authSessionTeardownSignalCount}`,
        ],
        file: filePath,
        suggestedFix:
          'Before redirecting users to `/login` or another anonymous route, explicitly sign out or invalidate the reviewed session state.',
      }),
    );
  }

  if (authExitSignalCount > 0 && authStorageWriteCount > 0 && authStorageClearCount === 0) {
    findings.push(
      makeFinding({
        id: 'state-auth-storage-teardown-missing',
        category: 'State Handling',
        severity: 'warn',
        message:
          'The reviewed auth exit flow writes auth data into browser storage but does not show that storage being cleared during sign-out.',
        evidence: [
          filePath,
          `Auth storage writes: ${authStorageWriteCount}`,
          `Auth storage clears: ${authStorageClearCount}`,
        ],
        file: filePath,
        suggestedFix:
          'If this flow stores auth/session data in browser storage, remove those auth keys during sign-out before redirecting users back to an anonymous route.',
      }),
    );
  }

  if (authExitSignalCount > 0 && authCookieWriteCount > 0 && authCookieClearCount === 0) {
    findings.push(
      makeFinding({
        id: 'state-auth-cookie-teardown-missing',
        category: 'State Handling',
        severity: 'warn',
        message:
          'The reviewed auth exit flow issues auth-like cookies but does not show them being cleared during sign-out.',
        evidence: [
          filePath,
          `Auth cookie writes: ${authCookieWriteCount}`,
          `Auth cookie clears: ${authCookieClearCount}`,
        ],
        file: filePath,
        suggestedFix:
          'If this flow issues auth cookies from reviewed source code, explicitly expire or delete those cookies during sign-out before redirecting users back to an anonymous route.',
      }),
    );
  }

  if (authExitSignalCount > 0 && authHeaderWriteCount > 0 && authHeaderClearCount === 0) {
    findings.push(
      makeFinding({
        id: 'state-auth-header-teardown-missing',
        category: 'State Handling',
        severity: 'warn',
        message:
          'The reviewed auth exit flow constructs auth-like headers but does not show them being cleared during sign-out.',
        evidence: [
          filePath,
          `Auth header writes: ${authHeaderWriteCount}`,
          `Auth header clears: ${authHeaderClearCount}`,
        ],
        file: filePath,
        suggestedFix:
          'If this flow constructs auth/session headers in reviewed source code, explicitly delete or reset those header values during sign-out before redirecting users back to an anonymous route.',
      }),
    );
  }

  if (
    authExitSignalCount > 0 &&
    authCacheClientCount > 0 &&
    authCacheClearCount === 0 &&
    (astSignals.protectedSurfaceSignalCount > 0 || astSignals.authSessionSignalCount > 0)
  ) {
    findings.push(
      makeFinding({
        id: 'state-auth-cache-teardown-missing',
        category: 'State Handling',
        severity: 'warn',
        message:
          'The reviewed auth exit flow uses client-side data caches but does not show them being cleared during sign-out.',
        evidence: [
          filePath,
          `Auth cache clients: ${authCacheClientCount}`,
          `Auth cache clears: ${authCacheClearCount}`,
        ],
        file: filePath,
        suggestedFix:
          'If protected data is cached in query clients or client data stores, clear or reset those caches during sign-out before redirecting users back to an anonymous route.',
      }),
    );
  }

  if (authExitSignalCount > 0 && authRefreshSignalCount > 0 && authRefreshClearCount === 0) {
    findings.push(
      makeFinding({
        id: 'state-auth-refresh-teardown-missing',
        category: 'State Handling',
        severity: 'warn',
        message:
          'The reviewed auth exit flow starts background auth refresh work but does not show it being torn down during sign-out.',
        evidence: [
          filePath,
          `Auth refresh signals: ${authRefreshSignalCount}`,
          `Auth refresh clears: ${authRefreshClearCount}`,
        ],
        file: filePath,
        suggestedFix:
          'If auth/session refresh runs on timers or subscriptions, clear those intervals, timeouts, or listeners during sign-out before redirecting users back to an anonymous route.',
      }),
    );
  }

  if (
    authExitSignalCount > 0 &&
    authRealtimeSignalCount > 0 &&
    authRealtimeClearCount === 0 &&
    (astSignals.protectedSurfaceSignalCount > 0 || astSignals.authSessionSignalCount > 0)
  ) {
    findings.push(
      makeFinding({
        id: 'state-auth-realtime-teardown-missing',
        category: 'State Handling',
        severity: 'warn',
        message:
          'The reviewed auth exit flow starts realtime channels or sockets but does not show them being torn down during sign-out.',
        evidence: [
          filePath,
          `Auth realtime signals: ${authRealtimeSignalCount}`,
          `Auth realtime clears: ${authRealtimeClearCount}`,
        ],
        file: filePath,
        suggestedFix:
          'If protected data arrives over websockets, SSE, or realtime channels, close or unsubscribe those connections during sign-out before redirecting users back to an anonymous route.',
      }),
    );
  }

  if (
    authExitSignalCount > 0 &&
    authCoordinationSignalCount > 0 &&
    authCoordinationClearCount === 0 &&
    (astSignals.protectedSurfaceSignalCount > 0 || astSignals.authSessionSignalCount > 0)
  ) {
    findings.push(
      makeFinding({
        id: 'state-auth-coordination-teardown-missing',
        category: 'State Handling',
        severity: 'warn',
        message:
          'The reviewed auth exit flow coordinates auth state across tabs but does not show those channels or listeners being torn down during sign-out.',
        evidence: [
          filePath,
          `Auth coordination signals: ${authCoordinationSignalCount}`,
          `Auth coordination clears: ${authCoordinationClearCount}`,
        ],
        file: filePath,
        suggestedFix:
          'If auth state is coordinated across tabs with BroadcastChannel or storage listeners, close those channels and remove those listeners during sign-out before redirecting users back to an anonymous route.',
      }),
    );
  }

  const reviewRoutes = reviewPack?.data?.routes ?? [];
  const hasProtectedRouteInReview = reviewRoutes.some((route) => isProtectedLikeRoute(route.path));
  const hasRecoveryRouteInReview = reviewRoutes.some((route) => isRecoveryLikeRoute(route.path));
  const hasSignInRouteInReview = reviewRoutes.some((route) => isSignInLikeRoute(route.path));
  const hasRegistrationRouteInReview = reviewRoutes.some((route) =>
    isRegistrationLikeRoute(route.path),
  );
  const hasAnonymousEntryRouteInReview = reviewRoutes.some((route) =>
    isAnonymousEntryLikeRoute(route.path),
  );
  const signInFlowSignals = countSignInFlowSignals(code, filePath);
  const recoveryFlowSignals = countRecoveryFlowSignals(code, filePath);
  const signUpFlowSignals = countSignUpFlowSignals(code, filePath);
  const requiresProtectedSuccessTransition =
    signInFlowSignals > 0 ||
    (astSignals.authEntrySignalCount > 0 && signUpFlowSignals === 0 && recoveryFlowSignals === 0);
  const authRecoveryRouteSignalCount = countAuthRecoveryRouteSignals(code);
  const registrationRouteSignalCount = countRegistrationRouteSignals(code);
  const anonymousEntryRouteSignalCount = countAnonymousEntryRouteSignals(code);
  const signInRouteSignalCount = countSignInRouteSignals(code);
  if (
    requiresProtectedSuccessTransition &&
    hasProtectedRouteInReview &&
    authProtectedRedirectSignalCount === 0
  ) {
    findings.push(
      makeFinding({
        id: 'route-auth-success-redirect-missing',
        category: 'Route Topology',
        severity: 'info',
        message:
          'The reviewed auth entry flow does not show an obvious transition into the protected application surface.',
        evidence: [
          filePath,
          `Auth entry signals: ${astSignals.authEntrySignalCount}`,
          `Protected auth redirects: ${authProtectedRedirectSignalCount}`,
        ],
        file: filePath,
        suggestedFix:
          'After reviewed sign-in, registration, or recovery success, navigate users to a protected route like `/dashboard`, `/app`, or another primary destination declared in the compiled route contract.',
      }),
    );
  }

  if (signInFlowSignals > 0 && hasRecoveryRouteInReview && authRecoveryRouteSignalCount === 0) {
    findings.push(
      makeFinding({
        id: 'route-auth-recovery-link-missing',
        category: 'Route Topology',
        severity: 'info',
        message:
          'The reviewed sign-in flow does not show an obvious path into the declared account-recovery route.',
        evidence: [
          filePath,
          `Sign-in flow signals: ${signInFlowSignals}`,
          `Reviewed recovery routes: ${
            reviewRoutes
              .filter((route) => isRecoveryLikeRoute(route.path))
              .map((route) => route.path)
              .join(', ') || 'none'
          }`,
          `Recovery route signals: ${authRecoveryRouteSignalCount}`,
        ],
        file: filePath,
        suggestedFix:
          'Link sign-in users to the reviewed recovery route, such as `/forgot-password` or `/reset-password`, whenever the compiled route contract declares one.',
      }),
    );
  }

  if (signInFlowSignals > 0 && hasRegistrationRouteInReview && registrationRouteSignalCount === 0) {
    findings.push(
      makeFinding({
        id: 'route-auth-registration-link-missing',
        category: 'Route Topology',
        severity: 'info',
        message:
          'The reviewed sign-in flow does not show an obvious path into the declared registration route.',
        evidence: [
          filePath,
          `Sign-in flow signals: ${signInFlowSignals}`,
          `Reviewed registration routes: ${
            reviewRoutes
              .filter((route) => isRegistrationLikeRoute(route.path))
              .map((route) => route.path)
              .join(', ') || 'none'
          }`,
          `Registration route signals: ${registrationRouteSignalCount}`,
        ],
        file: filePath,
        suggestedFix:
          'Link sign-in users to the reviewed registration route, such as `/register` or `/sign-up`, whenever the compiled route contract declares one.',
      }),
    );
  }

  if (
    recoveryFlowSignals > 0 &&
    hasAnonymousEntryRouteInReview &&
    anonymousEntryRouteSignalCount === 0
  ) {
    findings.push(
      makeFinding({
        id: 'route-auth-entry-return-missing',
        category: 'Route Topology',
        severity: 'info',
        message:
          'The reviewed recovery flow does not show an obvious path back into the declared anonymous entry route.',
        evidence: [
          filePath,
          `Recovery flow signals: ${recoveryFlowSignals}`,
          `Reviewed anonymous entry routes: ${
            reviewRoutes
              .filter((route) => isAnonymousEntryLikeRoute(route.path))
              .map((route) => route.path)
              .join(', ') || 'none'
          }`,
          `Anonymous entry route signals: ${anonymousEntryRouteSignalCount}`,
        ],
        file: filePath,
        suggestedFix:
          'Link recovery users back to a reviewed anonymous entry route, such as `/login`, `/register`, or `/`, whenever the compiled route contract declares one.',
      }),
    );
  }

  if (signUpFlowSignals > 0 && hasSignInRouteInReview && signInRouteSignalCount === 0) {
    findings.push(
      makeFinding({
        id: 'route-auth-signin-link-missing',
        category: 'Route Topology',
        severity: 'info',
        message:
          'The reviewed registration flow does not show an obvious path back into the declared sign-in route.',
        evidence: [
          filePath,
          `Registration flow signals: ${signUpFlowSignals}`,
          `Reviewed sign-in routes: ${
            reviewRoutes
              .filter((route) => isSignInLikeRoute(route.path))
              .map((route) => route.path)
              .join(', ') || 'none'
          }`,
          `Sign-in route signals: ${signInRouteSignalCount}`,
        ],
        file: filePath,
        suggestedFix:
          'Link registration users back to the reviewed sign-in route, such as `/login` or `/sign-in`, whenever the compiled route contract declares one.',
      }),
    );
  }

  if (
    (((authCallbackTokenSignalCount > 0 || authCallbackStateSignalCount > 0) &&
      authCallbackErrorSignalCount > 0) ||
      (authCallbackExchangeSignalCount > 0 && authCallbackExchangeErrorSignalCount > 0)) &&
    hasSignInRouteInReview &&
    signInRouteSignalCount === 0
  ) {
    findings.push(
      makeFinding({
        id: 'route-auth-callback-entry-return-missing',
        category: 'Route Topology',
        severity: 'info',
        message:
          'The reviewed auth callback failure path does not show an obvious route back to the declared sign-in surface.',
        evidence: [
          filePath,
          `Auth callback token reads: ${authCallbackTokenSignalCount}`,
          `Auth callback error signals: ${authCallbackErrorSignalCount}`,
          `Auth callback exchange signals: ${authCallbackExchangeSignalCount}`,
          `Auth callback exchange error signals: ${authCallbackExchangeErrorSignalCount}`,
          `Reviewed sign-in routes: ${
            reviewRoutes
              .filter((route) => isSignInLikeRoute(route.path))
              .map((route) => route.path)
              .join(', ') || 'none'
          }`,
          `Sign-in route signals: ${signInRouteSignalCount}`,
        ],
        file: filePath,
        suggestedFix:
          'When callback handling or callback session exchange fails, link or redirect users back to a reviewed sign-in route such as `/login` or `/sign-in` instead of leaving users on an isolated callback failure state.',
      }),
    );
  }

  if (astSignals.authSessionSignalCount > 0 && astSignals.authLoadingSignalCount === 0) {
    findings.push(
      makeFinding({
        id: 'state-auth-loading-missing',
        category: 'State Handling',
        severity: 'info',
        message:
          'The reviewed auth/session flow does not show an obvious loading or pending state while session resolution happens.',
        evidence: [
          filePath,
          `Auth/session signals: ${astSignals.authSessionSignalCount}`,
          `Auth loading signals: ${astSignals.authLoadingSignalCount}`,
        ],
        file: filePath,
        suggestedFix:
          'Render an explicit loading, pending, skeleton, or suspense fallback while auth or session state resolves so protected content does not flash or race.',
      }),
    );
  }

  if (
    astSignals.protectedSurfaceSignalCount > 0 &&
    astSignals.authSessionSignalCount > 0 &&
    astSignals.authLoadingSignalCount > 0 &&
    astSignals.authProtectedLoadingRenderCount > 0
  ) {
    findings.push(
      makeFinding({
        id: 'state-auth-loading-protected-render',
        category: 'State Handling',
        severity: 'warn',
        message:
          'The reviewed protected surface shows a loading branch, but that branch still appears to render a protected destination while session state is unresolved.',
        evidence: [
          filePath,
          `Protected surface signals: ${astSignals.protectedSurfaceSignalCount}`,
          `Auth/session signals: ${astSignals.authSessionSignalCount}`,
          `Auth loading signals: ${astSignals.authLoadingSignalCount}`,
          `Protected loading renders: ${astSignals.authProtectedLoadingRenderCount}`,
        ],
        file: filePath,
        suggestedFix:
          'While auth/session state is loading, render a neutral spinner, skeleton, suspense fallback, or guard boundary instead of returning a dashboard/app shell before the session is confirmed.',
      }),
    );
  }

  if (
    astSignals.authSessionSignalCount > 0 &&
    astSignals.authLoadingSignalCount > 0 &&
    astSignals.authBlankLoadingRenderCount > 0
  ) {
    findings.push(
      makeFinding({
        id: 'state-auth-loading-blank-render',
        category: 'State Handling',
        severity: 'info',
        message:
          'The reviewed auth/session loading branch returns nothing instead of an explicit pending boundary.',
        evidence: [
          filePath,
          `Auth/session signals: ${astSignals.authSessionSignalCount}`,
          `Auth loading signals: ${astSignals.authLoadingSignalCount}`,
          `Blank loading renders: ${astSignals.authBlankLoadingRenderCount}`,
        ],
        file: filePath,
        suggestedFix:
          'Render a spinner, skeleton, suspense fallback, or another explicit pending UI while auth/session state resolves instead of returning `null` or an empty fragment.',
      }),
    );
  }

  if (
    astSignals.authSessionSignalCount > 0 &&
    astSignals.authLoadingSignalCount > 0 &&
    astSignals.authAnonymousLoadingRedirectCount > 0
  ) {
    findings.push(
      makeFinding({
        id: 'state-auth-loading-anonymous-redirect',
        category: 'State Handling',
        severity: 'warn',
        message:
          'The reviewed auth/session loading branch redirects users to an anonymous route before session state is resolved.',
        evidence: [
          filePath,
          `Auth/session signals: ${astSignals.authSessionSignalCount}`,
          `Auth loading signals: ${astSignals.authLoadingSignalCount}`,
          `Anonymous loading redirects: ${astSignals.authAnonymousLoadingRedirectCount}`,
        ],
        file: filePath,
        suggestedFix:
          'While auth/session state is still loading, render a pending boundary instead of redirecting to `/login`, `/`, or another anonymous route. Only redirect after the session resolves as unauthenticated.',
      }),
    );
  }

  if (
    astSignals.protectedSurfaceSignalCount > 0 &&
    astSignals.authSessionSignalCount > 0 &&
    authUnauthenticatedBranchSignalCount > 0 &&
    astSignals.authProtectedUnauthenticatedRenderCount > 0
  ) {
    findings.push(
      makeFinding({
        id: 'state-auth-session-loss-protected-render',
        category: 'State Handling',
        severity: 'warn',
        message:
          'The reviewed protected surface branches on auth loss but still appears to render a protected destination in the unauthenticated branch.',
        evidence: [
          filePath,
          `Protected surface signals: ${astSignals.protectedSurfaceSignalCount}`,
          `Auth/session signals: ${astSignals.authSessionSignalCount}`,
          `Unauthenticated branch signals: ${authUnauthenticatedBranchSignalCount}`,
          `Protected unauthenticated renders: ${astSignals.authProtectedUnauthenticatedRenderCount}`,
        ],
        file: filePath,
        suggestedFix:
          'When a protected surface detects a null or unauthenticated session, redirect to a reviewed anonymous route or render a neutral guard boundary instead of returning a dashboard/app shell.',
      }),
    );
  }

  if (
    astSignals.protectedSurfaceSignalCount > 0 &&
    astSignals.authSessionSignalCount > 0 &&
    authUnauthenticatedBranchSignalCount === 0
  ) {
    findings.push(
      makeFinding({
        id: 'state-auth-session-loss-handling-missing',
        category: 'State Handling',
        severity: 'warn',
        message:
          'The reviewed protected surface reads auth/session state but does not show an explicit unauthenticated branch when session resolution fails or the user signs out.',
        evidence: [
          filePath,
          `Protected surface signals: ${astSignals.protectedSurfaceSignalCount}`,
          `Auth/session signals: ${astSignals.authSessionSignalCount}`,
          `Unauthenticated branch signals: ${authUnauthenticatedBranchSignalCount}`,
          `Auth guard signals: ${astSignals.authGuardSignalCount}`,
        ],
        file: filePath,
        suggestedFix:
          'When protected surfaces read session state directly, branch on unauthenticated/null-session cases and redirect to a reviewed anonymous route or return a guard boundary before protected content renders.',
      }),
    );
  }

  if (
    astSignals.protectedSurfaceSignalCount > 0 &&
    astSignals.authSessionSignalCount > 0 &&
    authUnauthenticatedBranchSignalCount > 0 &&
    authAnonymousRedirectSignalCount === 0
  ) {
    findings.push(
      makeFinding({
        id: 'state-auth-session-loss-redirect-missing',
        category: 'State Handling',
        severity: 'warn',
        message:
          'The reviewed protected surface branches on auth loss but does not show an obvious redirect back to an anonymous route.',
        evidence: [
          filePath,
          `Protected surface signals: ${astSignals.protectedSurfaceSignalCount}`,
          `Auth/session signals: ${astSignals.authSessionSignalCount}`,
          `Unauthenticated branch signals: ${authUnauthenticatedBranchSignalCount}`,
          `Anonymous redirect signals: ${authAnonymousRedirectSignalCount}`,
        ],
        file: filePath,
        suggestedFix:
          'When a protected surface detects a null or unauthenticated session, redirect users to `/`, `/login`, `/register`, or another reviewed anonymous route instead of returning `null` or leaving the protected shell blank.',
      }),
    );
  }

  if (hasAuthCallbackErrorGap) {
    findings.push(
      makeFinding({
        id: 'state-auth-callback-error-missing',
        category: 'State Handling',
        severity: 'info',
        message:
          'The reviewed auth callback flow does not show an obvious failure state for provider-denied or callback error returns.',
        evidence: [
          filePath,
          `Auth callback token reads: ${authCallbackTokenSignalCount}`,
          `Auth callback error signals: ${authCallbackErrorSignalCount}`,
        ],
        file: filePath,
        suggestedFix:
          'When callback routes can receive `error`, `error_description`, or related provider-return params, branch on those values and show a reviewed failure state before or alongside success redirects.',
      }),
    );
  }

  if (
    (astSignals.authSessionSignalCount > 0 || astSignals.authEntrySignalCount > 0) &&
    authErrorSignalCount === 0
  ) {
    findings.push(
      makeFinding({
        id: 'state-auth-error-missing',
        category: 'State Handling',
        severity: 'info',
        message:
          'The reviewed auth flow does not show an obvious failure state for rejected sign-in, recovery, or session refresh paths.',
        evidence: [
          filePath,
          `Auth/session signals: ${astSignals.authSessionSignalCount}`,
          `Auth entry signals: ${astSignals.authEntrySignalCount}`,
          `Auth error signals: ${authErrorSignalCount}`,
        ],
        file: filePath,
        suggestedFix:
          'Expose reviewed error handling with inline feedback, alert messaging, or another explicit failure affordance for sign-in, recovery, or session refresh failures.',
      }),
    );
  }

  if (recoveryFlowSignals > 0 && authSuccessSignalCount === 0) {
    findings.push(
      makeFinding({
        id: 'state-auth-recovery-success-missing',
        category: 'State Handling',
        severity: 'info',
        message:
          'The reviewed recovery flow does not show an obvious success or confirmation state after the reset request completes.',
        evidence: [
          filePath,
          `Recovery flow signals: ${recoveryFlowSignals}`,
          `Auth success signals: ${authSuccessSignalCount}`,
        ],
        file: filePath,
        suggestedFix:
          'After recovery or reset submission succeeds, show a reviewed confirmation state such as "check your email", "reset link sent", or another explicit success affordance.',
      }),
    );
  }

  if (
    signUpFlowSignals > 0 &&
    authProtectedRedirectSignalCount === 0 &&
    authSuccessSignalCount === 0
  ) {
    findings.push(
      makeFinding({
        id: 'state-auth-registration-success-missing',
        category: 'State Handling',
        severity: 'info',
        message:
          'The reviewed registration flow does not show either a protected post-auth transition or an explicit success/verification state.',
        evidence: [
          filePath,
          `Registration flow signals: ${signUpFlowSignals}`,
          `Protected auth redirects: ${authProtectedRedirectSignalCount}`,
          `Auth success signals: ${authSuccessSignalCount}`,
        ],
        file: filePath,
        suggestedFix:
          'After registration succeeds, either navigate users into a reviewed protected route like `/dashboard` or show an explicit success state such as "account created" or "check your email" before the next auth step.',
      }),
    );
  }

  if (
    (authCallbackTokenSignalCount > 0 || authCallbackStateSignalCount > 0) &&
    authProtectedRedirectSignalCount === 0 &&
    authSuccessSignalCount === 0
  ) {
    findings.push(
      makeFinding({
        id: 'state-auth-callback-success-missing',
        category: 'State Handling',
        severity: 'info',
        message:
          'The reviewed auth callback flow does not show either a protected post-auth transition or an explicit success/verification state.',
        evidence: [
          filePath,
          `Auth callback token reads: ${authCallbackTokenSignalCount}`,
          `Auth callback state reads: ${authCallbackStateSignalCount}`,
          `Protected auth redirects: ${authProtectedRedirectSignalCount}`,
          `Auth success signals: ${authSuccessSignalCount}`,
        ],
        file: filePath,
        suggestedFix:
          'After callback validation or code exchange succeeds, either navigate users into a reviewed protected route like `/dashboard` or show an explicit success state before the next auth step.',
      }),
    );
  }

  if (authCallbackExchangeSignalCount > 0 && authCallbackExchangeErrorSignalCount === 0) {
    findings.push(
      makeFinding({
        id: 'state-auth-callback-exchange-error-missing',
        category: 'State Handling',
        severity: 'warn',
        message:
          'The reviewed auth callback exchange does not show explicit failure handling if session completion rejects.',
        evidence: [
          filePath,
          `Auth callback exchange signals: ${authCallbackExchangeSignalCount}`,
          `Auth callback exchange error signals: ${authCallbackExchangeErrorSignalCount}`,
        ],
        file: filePath,
        suggestedFix:
          'Wrap reviewed callback code/session exchange in catch handling or explicit exchange-error state so failures do not leave users stuck on an indefinite callback surface.',
      }),
    );
  }

  const knownRoutes = reviewPack?.data?.routes?.length ?? packManifest?.pages.length ?? 0;
  const placeholderNavigationTargets = astSignals.placeholderNavigationTargetCount;
  scores.push({
    category: 'Topology Context',
    focusArea: 'route-topology',
    score: Math.max(
      1,
      (reviewPack ? 5 : packManifest ? 4 : 1) - (placeholderNavigationTargets > 0 ? 2 : 0),
    ),
    details: reviewPack
      ? `Compiled review contract covers ${knownRoutes} routes. Placeholder navigation targets: ${placeholderNavigationTargets}.`
      : packManifest
        ? `Pack manifest is available for ${knownRoutes} pages, but the review pack is missing. Placeholder navigation targets: ${placeholderNavigationTargets}.`
        : `No compiled route context was available during critique. Placeholder navigation targets: ${placeholderNavigationTargets}.`,
    suggestions: [
      ...(reviewPack
        ? []
        : [
            'Run `decantr registry compile-packs decantr.essence.json --write-context` so critique starts from a compiled review contract.',
          ]),
      ...(placeholderNavigationTargets > 0
        ? [
            'Replace placeholder href/to targets with real route destinations from the compiled contract.',
          ]
        : []),
    ],
  });
  if (focusAreas.includes('route-topology') && !reviewPack) {
    findings.push(
      makeFinding({
        id: 'review-pack-missing-for-critique',
        category: 'Route Topology',
        severity: resolveSeverityFromChecks(reviewPack, 'warn', [
          'review-contract-baseline',
          'route-topology',
          'page-route-contract',
        ]),
        message: 'Critique ran without a compiled review pack.',
        evidence: ['review-pack unavailable'],
        file: filePath,
        suggestedFix:
          'Regenerate execution packs so critique findings can anchor to the compiled route contract.',
      }),
    );
  }
  if (focusAreas.includes('route-topology') && placeholderNavigationTargets > 0) {
    findings.push(
      makeFinding({
        id: 'route-placeholder-navigation-target',
        category: 'Route Topology',
        severity: resolveSeverityFromChecks(reviewPack, 'warn', [
          'route-topology',
          'page-route-contract',
          'review-remediation',
        ]),
        message: 'Placeholder navigation targets were detected in the reviewed file.',
        evidence: [filePath, `Placeholder href/to targets: ${placeholderNavigationTargets}`],
        file: filePath,
        suggestedFix:
          'Replace placeholder route targets like `#` or `javascript:void(0)` with the actual page paths from the compiled review contract.',
      }),
    );
  }

  const hasInlineStyleLiterals =
    astSignals.inlineStyleAttributeCount > 0 || /style\s*=\s*["']/.test(code);
  if (antiPatternIds.has('inline-styles') && hasInlineStyleLiterals) {
    findings.push(
      makeFinding({
        id: 'anti-pattern-inline-styles',
        category: 'Anti-Patterns',
        severity: resolveSeverityFromChecks(reviewPack, 'warn', [
          'review-contract-baseline',
          'theme-consistency',
        ]),
        message: 'Inline style literals were detected in the reviewed file.',
        evidence: [
          filePath,
          `Disallowed inline style attributes: ${astSignals.inlineStyleAttributeCount}`,
        ],
        file: filePath,
        suggestedFix: isProjectOwnedStyling
          ? 'Replace static inline visual values with the project design system, accepted component variants, or local style rules. Keep inline style only for truly dynamic geometry.'
          : 'Replace static inline visual values with treatments, decorators, and CSS variables from the compiled contract. Keep inline style only for Decantr CSS-variable writes and truly dynamic geometry.',
      }),
    );
  }

  const componentStyleTagSignals = countComponentStyleTagSignals(code);
  if (componentStyleTagSignals > 0) {
    findings.push(
      makeFinding({
        id: 'anti-pattern-component-style-tags',
        category: 'Anti-Patterns',
        severity: resolveSeverityFromChecks(reviewPack, 'warn', [
          'review-contract-baseline',
          'theme-consistency',
        ]),
        message:
          'Component-scoped style tags or dynamic style elements were detected in the reviewed file.',
        evidence: [filePath, `Component style tag signals: ${componentStyleTagSignals}`],
        file: filePath,
        suggestedFix: isProjectOwnedStyling
          ? 'Move shared keyframes, media queries, and visual rules into the project stylesheet, component library, or accepted local pattern/rule manifest.'
          : 'Move shared keyframes, media queries, and visual rules into global.css or treatments.css so the file stays aligned with the Decantr layer contract.',
      }),
    );
  }

  const hardcodedColors = antiPatternIds.has('hardcoded-colors') ? findHardcodedColors(code) : [];
  if (hardcodedColors.length > 0) {
    findings.push(
      makeFinding({
        id: 'anti-pattern-hardcoded-colors',
        category: 'Anti-Patterns',
        severity: resolveSeverityFromChecks(reviewPack, 'warn', [
          'theme-consistency',
          'mutation-theme-contract',
        ]),
        message: 'Hardcoded color literals were detected in the reviewed file.',
        evidence: [filePath, `Color literals: ${hardcodedColors.slice(0, 5).join(', ')}`],
        file: filePath,
        suggestedFix:
          'Replace hardcoded colors with CSS variables or theme decorators from Decantr.',
      }),
    );
  }

  const utilitySignals = antiPatternIds.has('utility-framework-leakage')
    ? findUtilityFrameworkSignals(code)
    : [];
  if (utilitySignals.length > 0 && usedTreatments.length === 0) {
    findings.push(
      makeFinding({
        id: 'anti-pattern-utility-framework-leakage',
        category: 'Anti-Patterns',
        severity: 'info',
        message:
          'Utility-framework class patterns appear to be carrying the primary visual system for this file.',
        evidence: [filePath, `Utility signals: ${utilitySignals.slice(0, 6).join(', ')}`],
        file: filePath,
        suggestedFix:
          'Use Decantr treatments and decorators as the primary styling contract, with utilities only as supporting glue when necessary.',
      }),
    );
  }

  const dangerousHtmlCount = astSignals.dangerousHtmlCount;
  const rawHtmlInjectionCount = Math.max(
    astSignals.rawHtmlInjectionCount,
    /\binnerHTML\s*=|\binsertAdjacentHTML\s*\(|\bdocument\.write\s*\(/.test(code) ? 1 : 0,
  );
  const dynamicEvalCount = Math.max(
    astSignals.dynamicEvalCount,
    /\beval\s*\(|new\s+Function\s*\(/.test(code) ? 1 : 0,
  );
  const externalIframeWithoutSandboxCount = astSignals.externalIframeWithoutSandboxCount;
  const insecureFormActionCount = astSignals.insecureFormActionCount;
  const insecureAuthFormMethodCount = astSignals.insecureAuthFormMethodCount;
  const insecureTransportEndpointCount = astSignals.insecureTransportEndpointCount;
  const insecureExternalImageCount = astSignals.insecureExternalImageCount;
  const externalBlankLinkWithoutRelCount = astSignals.externalBlankLinkWithoutRelCount;
  const authOpenRedirectSignalCount = astSignals.authOpenRedirectSignalCount;
  const authExternalRedirectSignalCount = astSignals.authExternalRedirectSignalCount;
  const authProviderStateMissingCount = astSignals.authProviderStateMissingCount;
  const authProviderPkceMissingCount = astSignals.authProviderPkceMissingCount;
  const authProviderNonceMissingCount = astSignals.authProviderNonceMissingCount;
  const authCallbackUrlScrubSignalCount = countAuthCallbackUrlScrubSignals(code);
  const emailAutocompleteMissingCount = astSignals.emailAutocompleteMissingCount;
  const passwordAutocompleteMissingCount = astSignals.passwordAutocompleteMissingCount;
  const otpAutocompleteMissingCount = astSignals.otpAutocompleteMissingCount;
  const authAutocompleteDisabledCount = astSignals.authAutocompleteDisabledCount;
  const authAutocompleteSemanticMismatchCount = astSignals.authAutocompleteSemanticMismatchCount;
  const authInputTypeMismatchCount = astSignals.authInputTypeMismatchCount;
  const hardcodedSecretSignalCount = astSignals.hardcodedSecretSignalCount;
  const clientSecretEnvReferenceCount = astSignals.clientSecretEnvReferenceCount;
  const localhostEndpointCount = astSignals.localhostEndpointCount;
  const wildcardPostMessageCount = astSignals.wildcardPostMessageCount;
  const windowOpenWithoutNoopenerCount = astSignals.windowOpenWithoutNoopenerCount;
  const messageListenerWithoutOriginCheckCount = astSignals.messageListenerWithoutOriginCheckCount;
  const authCookieMissingHardeningCount = astSignals.authCookieMissingHardeningCount;
  const insecureExternalIframeCount = astSignals.insecureExternalIframeCount;
  const hasDangerousHtml = dangerousHtmlCount > 0;
  const hasRawHtmlInjection = rawHtmlInjectionCount > 0;
  const hasDynamicEval = dynamicEvalCount > 0;
  const hasExternalIframeWithoutSandbox = externalIframeWithoutSandboxCount > 0;
  const hasInsecureFormAction = insecureFormActionCount > 0;
  const hasInsecureAuthFormMethod = insecureAuthFormMethodCount > 0;
  const hasInsecureTransportEndpoint = insecureTransportEndpointCount > 0;
  const hasInsecureExternalImage = insecureExternalImageCount > 0;
  const hasExternalBlankLinkWithoutRel = externalBlankLinkWithoutRelCount > 0;
  const hasAuthOpenRedirectSignals = authOpenRedirectSignalCount > 0;
  const hasAuthExternalRedirectSignals = authExternalRedirectSignalCount > 0;
  const hasAuthProviderStateMissing = authProviderStateMissingCount > 0;
  const hasAuthProviderPkceMissing = authProviderPkceMissingCount > 0;
  const hasAuthProviderNonceMissing = authProviderNonceMissingCount > 0;
  const hasAuthCallbackStateValidationGap =
    authCallbackStateSignalCount > 0 && authCallbackStateValidationSignalCount === 0;
  const hasAuthCallbackStateTeardownGap =
    authCallbackStateValidationSignalCount > 0 &&
    authCallbackStateStorageSignalCount > 0 &&
    authCallbackStateStorageClearSignalCount === 0;
  const hasAuthCallbackUrlScrubGap =
    (authCallbackTokenSignalCount > 0 || authCallbackErrorSignalCount > 0) &&
    authCallbackUrlScrubSignalCount === 0;
  const hasAuthAutocompleteIssues =
    emailAutocompleteMissingCount > 0 ||
    passwordAutocompleteMissingCount > 0 ||
    otpAutocompleteMissingCount > 0 ||
    authAutocompleteDisabledCount > 0 ||
    authAutocompleteSemanticMismatchCount > 0 ||
    authInputTypeMismatchCount > 0;
  const hasHardcodedSecretSignals = hardcodedSecretSignalCount > 0;
  const hasClientSecretEnvReferences = clientSecretEnvReferenceCount > 0;
  const hasLocalhostEndpoints = localhostEndpointCount > 0;
  const hasWildcardPostMessage = wildcardPostMessageCount > 0;
  const hasWindowOpenWithoutNoopener = windowOpenWithoutNoopenerCount > 0;
  const hasMessageListenerWithoutOriginCheck = messageListenerWithoutOriginCheckCount > 0;
  const hasInsecureExternalIframe = insecureExternalIframeCount > 0;
  const hasAuthStorageWrites = authStorageWriteCount > 0;
  const hasAuthStorageClearGap =
    authExitSignalCount > 0 && authStorageWriteCount > 0 && authStorageClearCount === 0;
  const hasAuthCookieWrites = authCookieWriteCount > 0;
  const hasAuthCookieClearGap =
    authExitSignalCount > 0 && authCookieWriteCount > 0 && authCookieClearCount === 0;
  const hasAuthCookieMissingHardening = authCookieMissingHardeningCount > 0;
  const hasAuthHeaderWrites = authHeaderWriteCount > 0;
  const hasAuthHeaderClearGap =
    authExitSignalCount > 0 && authHeaderWriteCount > 0 && authHeaderClearCount === 0;
  const hasAuthCacheClients = authCacheClientCount > 0;
  const hasAuthCacheClearGap =
    authExitSignalCount > 0 && authCacheClientCount > 0 && authCacheClearCount === 0;
  scores.push({
    category: 'Security Hygiene',
    focusArea: 'security-hygiene',
    score: Math.max(
      1,
      5 -
        (hasDangerousHtml ? 2 : 0) -
        (hasRawHtmlInjection ? 2 : 0) -
        (hasDynamicEval ? 2 : 0) -
        (hasExternalIframeWithoutSandbox ? 1 : 0) -
        (hasInsecureFormAction ? 2 : 0) -
        (hasInsecureAuthFormMethod ? 2 : 0) -
        (hasInsecureTransportEndpoint ? 2 : 0) -
        (hasInsecureExternalImage ? 1 : 0) -
        (hasHardcodedSecretSignals ? 3 : 0) -
        (hasClientSecretEnvReferences ? 3 : 0) -
        (hasLocalhostEndpoints ? 2 : 0) -
        (hasWildcardPostMessage ? 2 : 0) -
        (hasMessageListenerWithoutOriginCheck ? 2 : 0) -
        (hasWindowOpenWithoutNoopener ? 1 : 0) -
        (hasInsecureExternalIframe ? 1 : 0) -
        (hasExternalBlankLinkWithoutRel ? 1 : 0) -
        (hasAuthOpenRedirectSignals ? 2 : 0) -
        (hasAuthExternalRedirectSignals ? 2 : 0) -
        (hasAuthProviderStateMissing ? 2 : 0) -
        (hasAuthProviderPkceMissing ? 2 : 0) -
        (hasAuthProviderNonceMissing ? 2 : 0) -
        (hasAuthCallbackStateValidationGap ? 2 : 0) -
        (hasAuthCallbackStateTeardownGap ? 1 : 0) -
        (hasAuthCallbackUrlScrubGap ? 2 : 0) -
        (hasAuthAutocompleteIssues ? 1 : 0) -
        (hasAuthStorageWrites ? 2 : 0) -
        (hasAuthCookieWrites ? 2 : 0) -
        (hasAuthCookieMissingHardening ? 2 : 0) -
        (hasAuthHeaderWrites ? 2 : 0) -
        (hasAuthCacheClearGap ? 1 : 0),
    ),
    details: `dangerouslySetInnerHTML: ${dangerousHtmlCount}, raw HTML injection: ${rawHtmlInjectionCount}, dynamic eval: ${dynamicEvalCount}, hardcoded secret literals: ${hardcodedSecretSignalCount}, client-exposed secret env references: ${clientSecretEnvReferenceCount}, localhost endpoints: ${localhostEndpointCount}, wildcard postMessage calls: ${wildcardPostMessageCount}, message listeners missing origin checks: ${messageListenerWithoutOriginCheckCount}, window.open calls missing noopener/noreferrer: ${windowOpenWithoutNoopenerCount}, external iframes without sandbox: ${externalIframeWithoutSandboxCount}, insecure external iframes: ${insecureExternalIframeCount}, insecure form actions: ${insecureFormActionCount}, auth forms with insecure method: ${insecureAuthFormMethodCount}, insecure transport endpoints: ${insecureTransportEndpointCount}, insecure remote images: ${insecureExternalImageCount}, external _blank links without rel: ${externalBlankLinkWithoutRelCount}, auth/query redirect signals: ${authOpenRedirectSignalCount}, auth external redirects: ${authExternalRedirectSignalCount}, auth provider URLs missing state: ${authProviderStateMissingCount}, auth provider code flows missing PKCE: ${authProviderPkceMissingCount}, auth provider id_token flows missing nonce: ${authProviderNonceMissingCount}, auth callback state reads: ${authCallbackStateSignalCount}, auth callback state validation signals: ${authCallbackStateValidationSignalCount}, auth callback state storage reads: ${authCallbackStateStorageSignalCount}, auth callback state storage clears: ${authCallbackStateStorageClearSignalCount}, auth callback token reads: ${authCallbackTokenSignalCount}, auth callback URL scrub signals: ${authCallbackUrlScrubSignalCount}, email inputs without autocomplete: ${emailAutocompleteMissingCount}, password inputs without autocomplete: ${passwordAutocompleteMissingCount}, OTP inputs without one-time-code autocomplete: ${otpAutocompleteMissingCount}, auth inputs with autocomplete off: ${authAutocompleteDisabledCount}, auth inputs with autocomplete semantic mismatch: ${authAutocompleteSemanticMismatchCount}, auth inputs with semantic type mismatch: ${authInputTypeMismatchCount}, auth storage writes: ${authStorageWriteCount}, auth storage clears: ${authStorageClearCount}, auth cookie writes: ${authCookieWriteCount}, auth cookie clears: ${authCookieClearCount}, auth cookies missing hardening: ${authCookieMissingHardeningCount}, auth header writes: ${authHeaderWriteCount}, auth header clears: ${authHeaderClearCount}, auth cache clients: ${authCacheClientCount}, auth cache clears: ${authCacheClearCount}`,
    suggestions: [
      ...(hasDangerousHtml || hasRawHtmlInjection
        ? ['Prefer escaped rendering paths and sanitize any unavoidable HTML before rendering it.']
        : []),
      ...(hasDynamicEval
        ? [
            'Remove eval/new Function usage and replace it with explicit logic or data-driven dispatch.',
          ]
        : []),
      ...(hasHardcodedSecretSignals
        ? [
            'Remove hardcoded secret literals from source immediately and rotate any exposed credentials.',
          ]
        : []),
      ...(hasClientSecretEnvReferences
        ? [
            'Do not reference service-role, secret, or private-key env vars from client-exposed code paths.',
          ]
        : []),
      ...(hasLocalhostEndpoints
        ? [
            'Replace localhost-style client endpoints with reviewed environment-backed URLs or move those calls behind a trusted server boundary before shipping.',
          ]
        : []),
      ...(hasWildcardPostMessage
        ? [
            'Avoid `postMessage(..., "*")`; target a reviewed explicit origin instead of broadcasting to any window origin.',
          ]
        : []),
      ...(hasMessageListenerWithoutOriginCheck
        ? [
            'Validate `event.origin` inside `message` event handlers before trusting or acting on cross-window data.',
          ]
        : []),
      ...(hasWindowOpenWithoutNoopener
        ? [
            'When opening a new tab imperatively, include `noopener,noreferrer` features so the new page cannot retain opener access.',
          ]
        : []),
      ...(hasExternalIframeWithoutSandbox
        ? [
            'Sandbox external iframes unless a reviewed embed contract explicitly requires broader privileges.',
          ]
        : []),
      ...(hasInsecureExternalIframe
        ? [
            'Avoid embedding remote iframes over plain HTTP; use HTTPS or move the integration behind a reviewed trusted boundary.',
          ]
        : []),
      ...(hasInsecureFormAction
        ? [
            'Avoid posting forms to plain HTTP endpoints; use HTTPS or move the action behind a trusted server boundary.',
          ]
        : []),
      ...(hasInsecureAuthFormMethod
        ? [
            'Auth forms should submit with `method="post"` or an explicit server action boundary instead of defaulting to GET semantics.',
          ]
        : []),
      ...(hasInsecureTransportEndpoint
        ? [
            'Avoid plain HTTP or ws:// client endpoints; use HTTPS/WSS transport or route the request behind a trusted server boundary.',
          ]
        : []),
      ...(hasInsecureExternalImage
        ? [
            'Avoid loading remote images over plain HTTP; use HTTPS or move the image behind a reviewed trusted asset boundary.',
          ]
        : []),
      ...(hasExternalBlankLinkWithoutRel
        ? ['Add rel="noopener noreferrer" to external links that open in a new tab.']
        : []),
      ...(hasAuthOpenRedirectSignals
        ? [
            'Resolve auth or route-transition redirects through a reviewed allowlist of internal routes instead of trusting raw `next`, `returnTo`, `callbackUrl`, or similar query params.',
          ]
        : []),
      ...(hasAuthExternalRedirectSignals
        ? [
            'Avoid hard-redirecting auth flows to external URLs from app code. Keep auth redirects on reviewed internal routes, or route external provider/logout handoffs through explicit reviewed allowlists and provider configuration.',
          ]
        : []),
      ...(hasAuthProviderStateMissing
        ? [
            'When auth flows hand off to a provider authorize URL, include a reviewed `state` value and validate it on return instead of hardcoding off-site auth entry without CSRF protection.',
          ]
        : []),
      ...(hasAuthProviderPkceMissing
        ? [
            'When client-managed auth flows hand off to a provider code-flow authorize URL, include a reviewed PKCE `code_challenge` and verifier instead of hardcoding a bare authorization-code redirect from client code.',
          ]
        : []),
      ...(hasAuthProviderNonceMissing
        ? [
            'When auth flows hand off to a provider authorize URL that requests `id_token`, include a reviewed `nonce` and validate it on return instead of hardcoding a bare OIDC implicit or hybrid flow from client code.',
          ]
        : []),
      ...(hasAuthCallbackStateValidationGap
        ? [
            'When callback routes read a returned provider `state`, validate it against a stored or expected reviewed value before exchanging callback codes or continuing auth setup.',
          ]
        : []),
      ...(hasAuthCallbackStateTeardownGap
        ? [
            'After validating callback `state`, clear the reviewed `oauth_state` or CSRF state key from browser storage or cookies so stale callback state does not linger beyond the auth exchange.',
          ]
        : []),
      ...(hasAuthCallbackUrlScrubGap
        ? [
            'After consuming auth callback codes, tokens, or provider error params from the URL, replace the callback URL with a clean reviewed route using `history.replaceState`, router replacement, or an explicit internal redirect.',
          ]
        : []),
      ...(hasAuthAutocompleteIssues
        ? [
            'Add explicit autocomplete hints such as `email`, `username`, `current-password`, `new-password`, or `one-time-code` on auth-related inputs, keep those hints semantically aligned with the field purpose, avoid disabling autocomplete for credential fields, and keep credential field types semantically correct (`email`/`password`).',
          ]
        : []),
      ...(hasAuthStorageWrites
        ? [
            'Avoid persisting auth tokens in browser storage; prefer secure, server-managed session boundaries or hardened cookie-based flows.',
          ]
        : []),
      ...(hasAuthStorageClearGap
        ? [
            'If auth data is stored in browser storage, explicitly remove those auth/session keys during sign-out instead of relying on redirects or generic sign-out helpers alone.',
          ]
        : []),
      ...(hasAuthCookieWrites
        ? [
            'Avoid setting auth cookies from client-side JavaScript; prefer server-issued HttpOnly cookies or other server-managed session boundaries.',
          ]
        : []),
      ...(hasAuthCookieClearGap
        ? [
            'If reviewed source surfaces issue auth cookies, explicitly expire or delete them during sign-out instead of assuming redirects or generic sign-out helpers will clear them.',
          ]
        : []),
      ...(hasAuthCookieMissingHardening
        ? [
            'When issuing auth cookies, set explicit `httpOnly`, `secure`, and `sameSite` options instead of relying on framework defaults or partial options.',
          ]
        : []),
      ...(hasAuthHeaderWrites
        ? [
            'Avoid constructing bearer/session authorization headers in client-rendered code unless the auth model is explicitly reviewed and intended.',
          ]
        : []),
      ...(hasAuthHeaderClearGap
        ? [
            'If reviewed source code constructs auth-like authorization headers, explicitly delete or reset those header values during sign-out instead of assuming redirects or generic sign-out helpers will clear them.',
          ]
        : []),
      ...(hasAuthCacheClients && hasAuthCacheClearGap
        ? [
            'If protected data is cached in query clients or client stores, clear or reset those caches during sign-out so privileged data does not linger after logout.',
          ]
        : []),
    ],
  });

  if (hasDangerousHtml) {
    findings.push(
      makeFinding({
        id: 'security-dangerously-set-html',
        category: 'Security Hygiene',
        severity: 'error',
        message: 'The reviewed file uses `dangerouslySetInnerHTML`.',
        evidence: [filePath, `Occurrences: ${dangerousHtmlCount}`],
        file: filePath,
        suggestedFix:
          'Render structured data through components instead of injecting raw HTML, or sanitize the content before it reaches the view layer.',
      }),
    );
  }

  if (hasRawHtmlInjection) {
    findings.push(
      makeFinding({
        id: 'security-raw-html-injection',
        category: 'Security Hygiene',
        severity: 'error',
        message: 'The reviewed file writes raw HTML into the DOM.',
        evidence: [filePath, `Occurrences: ${rawHtmlInjectionCount}`],
        file: filePath,
        suggestedFix:
          'Avoid `innerHTML` and `insertAdjacentHTML`; render trusted structured nodes instead.',
      }),
    );
  }

  if (hasDynamicEval) {
    findings.push(
      makeFinding({
        id: 'security-dynamic-code-eval',
        category: 'Security Hygiene',
        severity: 'error',
        message:
          'The reviewed file uses dynamic code execution patterns such as `eval`, `new Function`, or string-based timers.',
        evidence: [filePath, `Occurrences: ${dynamicEvalCount}`],
        file: filePath,
        suggestedFix:
          'Replace dynamic code execution with explicit functions, lookup tables, or validated configuration data; avoid passing strings into timers.',
      }),
    );
  }

  if (hasHardcodedSecretSignals) {
    findings.push(
      makeFinding({
        id: 'security-hardcoded-secret-literal',
        category: 'Security Hygiene',
        severity: 'error',
        message: 'Hardcoded secret-like literals were detected in the reviewed file.',
        evidence: [filePath, `Hardcoded secret-like literals: ${hardcodedSecretSignalCount}`],
        file: filePath,
        suggestedFix:
          'Remove hardcoded secrets from source immediately, rotate any exposed credentials, and load sensitive values only through reviewed server-side boundaries.',
      }),
    );
  }

  if (hasClientSecretEnvReferences) {
    findings.push(
      makeFinding({
        id: 'security-client-secret-env-reference',
        category: 'Security Hygiene',
        severity: 'error',
        message: 'Client-exposed code references env vars that look server-only or secret-bearing.',
        evidence: [
          filePath,
          `Client-exposed secret env references: ${clientSecretEnvReferenceCount}`,
        ],
        file: filePath,
        suggestedFix:
          'Remove secret-bearing env references from client code and move privileged access behind a reviewed server boundary or server-only module.',
      }),
    );
  }

  if (hasLocalhostEndpoints) {
    findings.push(
      makeFinding({
        id: 'security-localhost-endpoint-present',
        category: 'Security Hygiene',
        severity: 'warn',
        message: 'The reviewed file still references localhost-style endpoints.',
        evidence: [filePath, `Localhost endpoint signals: ${localhostEndpointCount}`],
        file: filePath,
        suggestedFix:
          'Replace localhost, 127.0.0.1, or 0.0.0.0 endpoints with reviewed environment-backed URLs or move the client call behind a trusted server boundary.',
      }),
    );
  }

  if (hasInsecureExternalImage) {
    findings.push(
      makeFinding({
        id: 'security-image-transport-insecure',
        category: 'Security Hygiene',
        severity: 'warn',
        message: 'The reviewed file loads one or more remote images over plain HTTP.',
        evidence: [filePath, `Insecure remote images: ${insecureExternalImageCount}`],
        file: filePath,
        suggestedFix:
          'Serve remote images over HTTPS or move them behind a reviewed trusted asset boundary before shipping.',
      }),
    );
  }

  if (hasWildcardPostMessage) {
    findings.push(
      makeFinding({
        id: 'security-postmessage-wildcard-origin',
        category: 'Security Hygiene',
        severity: 'error',
        message: 'Cross-window messaging uses `postMessage` with a wildcard target origin.',
        evidence: [filePath, `Wildcard postMessage calls: ${wildcardPostMessageCount}`],
        file: filePath,
        suggestedFix:
          'Replace `postMessage(..., "*")` with an explicit reviewed origin so messages only cross the intended trust boundary.',
      }),
    );
  }

  if (hasMessageListenerWithoutOriginCheck) {
    findings.push(
      makeFinding({
        id: 'security-message-listener-origin-check-missing',
        category: 'Security Hygiene',
        severity: 'warn',
        message:
          'Cross-window message handlers do not appear to validate `event.origin` before trusting inbound messages.',
        evidence: [
          filePath,
          `Message listeners missing origin checks: ${messageListenerWithoutOriginCheckCount}`,
        ],
        file: filePath,
        suggestedFix:
          'Check `event.origin` against an explicit reviewed allowlist or expected origin before acting on `message` event payloads.',
      }),
    );
  }

  if (hasWindowOpenWithoutNoopener) {
    findings.push(
      makeFinding({
        id: 'security-window-open-noopener-missing',
        category: 'Security Hygiene',
        severity: 'warn',
        message:
          'Imperative `window.open` usage targets a new tab without `noopener,noreferrer` protections.',
        evidence: [
          filePath,
          `window.open calls missing noopener/noreferrer: ${windowOpenWithoutNoopenerCount}`,
        ],
        file: filePath,
        suggestedFix:
          'Use `window.open(url, "_blank", "noopener,noreferrer")` or equivalent reviewed features so the opened page cannot retain opener access.',
      }),
    );
  }

  if (hasExternalBlankLinkWithoutRel) {
    findings.push(
      makeFinding({
        id: 'security-target-blank-rel-missing',
        category: 'Security Hygiene',
        severity: 'warn',
        message: 'External links open in a new tab without `rel="noopener noreferrer"`.',
        evidence: [filePath, `Occurrences: ${externalBlankLinkWithoutRelCount}`],
        file: filePath,
        suggestedFix:
          'Add rel="noopener noreferrer" to external target="_blank" links to prevent tab-nabbing and preserve opener isolation.',
      }),
    );
  }

  if (hasExternalIframeWithoutSandbox) {
    findings.push(
      makeFinding({
        id: 'security-iframe-sandbox-missing',
        category: 'Security Hygiene',
        severity: 'warn',
        message: 'External iframe embeds were detected without a `sandbox` attribute.',
        evidence: [
          filePath,
          `External iframes without sandbox: ${externalIframeWithoutSandboxCount}`,
        ],
        file: filePath,
        suggestedFix:
          'Add the narrowest practical sandbox policy to external iframes, and only loosen capabilities when the embed contract explicitly requires it.',
      }),
    );
  }

  if (hasInsecureExternalIframe) {
    findings.push(
      makeFinding({
        id: 'security-iframe-transport-insecure',
        category: 'Security Hygiene',
        severity: 'warn',
        message: 'The reviewed file embeds one or more remote iframes over plain HTTP.',
        evidence: [filePath, `Insecure external iframes: ${insecureExternalIframeCount}`],
        file: filePath,
        suggestedFix:
          'Serve embedded iframes over HTTPS or move the integration behind a reviewed trusted boundary before shipping.',
      }),
    );
  }

  if (hasInsecureFormAction) {
    findings.push(
      makeFinding({
        id: 'security-form-action-insecure',
        category: 'Security Hygiene',
        severity: 'error',
        message: 'Forms were detected using insecure or unsafe action targets.',
        evidence: [
          filePath,
          `Forms with insecure or unsafe action target: ${insecureFormActionCount}`,
        ],
        file: filePath,
        suggestedFix:
          'Use HTTPS form endpoints or route submissions through a trusted server action/API boundary; do not use javascript:, mailto:, data:, or plain HTTP form actions for production flows.',
      }),
    );
  }

  if (hasInsecureAuthFormMethod) {
    findings.push(
      makeFinding({
        id: 'security-auth-form-method-insecure',
        category: 'Security Hygiene',
        severity: 'warn',
        message: 'Auth-like forms were detected without an explicit POST-style submission method.',
        evidence: [filePath, `Auth forms with insecure method: ${insecureAuthFormMethodCount}`],
        file: filePath,
        suggestedFix:
          'Add `method="post"` or move the submission behind an explicit server action boundary so credential flows do not default to GET semantics.',
      }),
    );
  }

  if (hasInsecureTransportEndpoint) {
    findings.push(
      makeFinding({
        id: 'security-transport-endpoint-insecure',
        category: 'Security Hygiene',
        severity: 'error',
        message:
          'Client code was detected calling or navigating to plain HTTP or insecure websocket endpoints.',
        evidence: [filePath, `Insecure transport endpoints: ${insecureTransportEndpointCount}`],
        file: filePath,
        suggestedFix:
          'Use HTTPS/WSS endpoints and reviewed secure redirects, or move the transport boundary behind a trusted server action or API layer.',
      }),
    );
  }

  if (hasAuthOpenRedirectSignals) {
    findings.push(
      makeFinding({
        id: 'security-auth-open-redirect-risk',
        category: 'Security Hygiene',
        severity: 'warn',
        message:
          'Redirect logic appears to trust next/returnTo-style query parameters without an obvious reviewed allowlist.',
        evidence: [filePath, `Auth/query redirect signals: ${authOpenRedirectSignalCount}`],
        file: filePath,
        suggestedFix:
          'Resolve post-auth and route-transition redirects through a reviewed internal allowlist instead of redirecting directly from raw `next`, `returnTo`, `callbackUrl`, or similar query parameters.',
      }),
    );
  }

  if (
    hasAuthExternalRedirectSignals &&
    (signInFlowSignals > 0 ||
      signUpFlowSignals > 0 ||
      recoveryFlowSignals > 0 ||
      authExitSignalCount > 0)
  ) {
    findings.push(
      makeFinding({
        id: 'security-auth-external-redirect-risk',
        category: 'Security Hygiene',
        severity: 'warn',
        message: 'The reviewed auth flow redirects users directly to an external URL.',
        evidence: [filePath, `Auth external redirects: ${authExternalRedirectSignalCount}`],
        file: filePath,
        suggestedFix:
          'Keep auth redirects on reviewed internal routes, or route external provider/logout handoffs through explicit reviewed allowlists and provider configuration instead of hardcoding off-site destinations in app code.',
      }),
    );
  }

  if (
    hasAuthProviderStateMissing &&
    (signInFlowSignals > 0 ||
      signUpFlowSignals > 0 ||
      recoveryFlowSignals > 0 ||
      authExitSignalCount > 0)
  ) {
    findings.push(
      makeFinding({
        id: 'security-auth-provider-state-missing',
        category: 'Security Hygiene',
        severity: 'warn',
        message:
          'The reviewed auth flow hardcodes a provider-style authorize URL without a `state` parameter.',
        evidence: [filePath, `Auth provider URLs missing state: ${authProviderStateMissingCount}`],
        file: filePath,
        suggestedFix:
          'Add a reviewed `state` value to external provider authorize URLs and validate it on return instead of hardcoding off-site auth entry without CSRF protection.',
      }),
    );
  }

  if (
    hasAuthProviderPkceMissing &&
    (signInFlowSignals > 0 ||
      signUpFlowSignals > 0 ||
      recoveryFlowSignals > 0 ||
      authExitSignalCount > 0)
  ) {
    findings.push(
      makeFinding({
        id: 'security-auth-provider-pkce-missing',
        category: 'Security Hygiene',
        severity: 'warn',
        message:
          'The reviewed auth flow hardcodes a provider-style OAuth code-flow URL without a `code_challenge`.',
        evidence: [
          filePath,
          `Auth provider code flows missing PKCE: ${authProviderPkceMissingCount}`,
        ],
        file: filePath,
        suggestedFix:
          'Add a reviewed PKCE `code_challenge` and verifier to external provider code flows instead of hardcoding a bare authorization-code redirect from client code.',
      }),
    );
  }

  if (
    hasAuthProviderNonceMissing &&
    (signInFlowSignals > 0 ||
      signUpFlowSignals > 0 ||
      recoveryFlowSignals > 0 ||
      authExitSignalCount > 0)
  ) {
    findings.push(
      makeFinding({
        id: 'security-auth-provider-nonce-missing',
        category: 'Security Hygiene',
        severity: 'warn',
        message:
          'The reviewed auth flow hardcodes a provider-style OIDC id_token URL without a `nonce` parameter.',
        evidence: [
          filePath,
          `Auth provider id_token flows missing nonce: ${authProviderNonceMissingCount}`,
        ],
        file: filePath,
        suggestedFix:
          'Add a reviewed `nonce` value to external provider authorize URLs that request `id_token`, and validate it on return instead of hardcoding a bare OIDC implicit or hybrid flow from client code.',
      }),
    );
  }

  if (hasAuthCallbackStateValidationGap) {
    findings.push(
      makeFinding({
        id: 'security-auth-callback-state-validation-missing',
        category: 'Security Hygiene',
        severity: 'warn',
        message:
          'The reviewed auth callback flow reads a returned provider `state` value but does not show an obvious validation step against a reviewed expected value.',
        evidence: [
          filePath,
          `Auth callback state reads: ${authCallbackStateSignalCount}`,
          `Auth callback state validation signals: ${authCallbackStateValidationSignalCount}`,
        ],
        file: filePath,
        suggestedFix:
          'When callback routes read `state`, compare it against a stored or expected reviewed value before exchanging callback codes or continuing auth/session setup.',
      }),
    );
  }

  if (hasAuthCallbackStateTeardownGap) {
    findings.push(
      makeFinding({
        id: 'security-auth-callback-state-teardown-missing',
        category: 'Security Hygiene',
        severity: 'info',
        message:
          'The reviewed auth callback flow validates stored callback `state` but does not show that the stored state key is cleared afterwards.',
        evidence: [
          filePath,
          `Auth callback state storage reads: ${authCallbackStateStorageSignalCount}`,
          `Auth callback state storage clears: ${authCallbackStateStorageClearSignalCount}`,
        ],
        file: filePath,
        suggestedFix:
          'After validating callback `state`, remove the reviewed `oauth_state` or CSRF state key from browser storage or cookies so stale callback state does not linger.',
      }),
    );
  }

  if (hasAuthCallbackUrlScrubGap) {
    findings.push(
      makeFinding({
        id: 'security-auth-callback-url-scrub-missing',
        category: 'Security Hygiene',
        severity: 'warn',
        message:
          'The reviewed auth callback flow appears to read codes, tokens, or provider error params from the URL without scrubbing them back out of browser history.',
        evidence: [
          filePath,
          `Auth callback token reads: ${authCallbackTokenSignalCount}`,
          `Auth callback error signals: ${authCallbackErrorSignalCount}`,
          `Auth callback URL scrub signals: ${authCallbackUrlScrubSignalCount}`,
        ],
        file: filePath,
        suggestedFix:
          'After consuming callback codes, tokens, or provider error params from the URL, replace the callback URL with a clean reviewed route using `history.replaceState`, router replacement, or an explicit internal redirect.',
      }),
    );
  }

  if (hasAuthAutocompleteIssues) {
    findings.push(
      makeFinding({
        id: 'security-auth-autocomplete-missing',
        category: 'Security Hygiene',
        severity: 'info',
        message:
          'Auth-related inputs were detected with missing or incorrect `autocomplete` hints.',
        evidence: [
          filePath,
          `Email inputs without autocomplete: ${emailAutocompleteMissingCount}`,
          `Password inputs without autocomplete: ${passwordAutocompleteMissingCount}`,
          `OTP inputs without one-time-code autocomplete: ${otpAutocompleteMissingCount}`,
          `Auth inputs with autocomplete off: ${authAutocompleteDisabledCount}`,
          `Auth inputs with autocomplete semantic mismatch: ${authAutocompleteSemanticMismatchCount}`,
          `Auth inputs with semantic type mismatch: ${authInputTypeMismatchCount}`,
        ],
        file: filePath,
        suggestedFix:
          'Add `autocomplete="email"` or `autocomplete="username"` to identity fields, `autocomplete="current-password"` or `autocomplete="new-password"` to password fields, `autocomplete="one-time-code"` to OTP and verification-code inputs, keep those autocomplete values aligned with the field purpose, do not disable autocomplete on credential inputs, and keep credential field types semantically correct.',
      }),
    );
  }

  if (hasAuthStorageWrites) {
    findings.push(
      makeFinding({
        id: 'security-auth-storage-write',
        category: 'Security Hygiene',
        severity: 'warn',
        message: 'Potential auth credentials were written into browser storage.',
        evidence: [filePath, `Auth-like local/session storage writes: ${authStorageWriteCount}`],
        file: filePath,
        suggestedFix:
          'Avoid writing tokens or sessions to localStorage/sessionStorage; prefer secure server-managed sessions or hardened cookie flows.',
      }),
    );
  }

  if (hasAuthCookieWrites) {
    findings.push(
      makeFinding({
        id: 'security-auth-cookie-write',
        category: 'Security Hygiene',
        severity: 'warn',
        message: 'Potential auth credentials were written into client-managed cookies.',
        evidence: [filePath, `Auth-like cookie writes: ${authCookieWriteCount}`],
        file: filePath,
        suggestedFix:
          'Avoid setting auth cookies from client-side code; prefer server-issued HttpOnly cookies or other server-managed session mechanisms.',
      }),
    );
  }

  if (hasAuthCookieMissingHardening) {
    findings.push(
      makeFinding({
        id: 'security-auth-cookie-hardening-missing',
        category: 'Security Hygiene',
        severity: 'warn',
        message:
          'Auth cookies are being issued without explicit `httpOnly`, `secure`, and `sameSite` hardening.',
        evidence: [filePath, `Auth cookies missing hardening: ${authCookieMissingHardeningCount}`],
        file: filePath,
        suggestedFix:
          'Set auth cookies with explicit `httpOnly: true`, `secure: true`, and a reviewed `sameSite` value so session boundaries do not rely on ambient defaults.',
      }),
    );
  }

  if (hasAuthHeaderWrites) {
    findings.push(
      makeFinding({
        id: 'security-auth-header-write',
        category: 'Security Hygiene',
        severity: 'warn',
        message: 'Auth-like authorization headers were constructed in client-side code.',
        evidence: [filePath, `Auth-like header writes: ${authHeaderWriteCount}`],
        file: filePath,
        suggestedFix:
          'Prefer server-managed sessions or a deliberately reviewed client-auth strategy instead of assembling bearer/session headers ad hoc in client-rendered code.',
      }),
    );
  }

  const overall =
    Math.round((scores.reduce((sum, score) => sum + score.score, 0) / scores.length) * 10) / 10;
  return {
    $schema: VERIFICATION_SCHEMA_URLS.fileCritique,
    file: filePath,
    overall,
    scores,
    findings,
    focusAreas,
    reviewPack,
  };
}

function resolveProjectFilePath(projectRoot: string, filePath: string): string {
  const root = existsSync(projectRoot) ? realpathSync.native(projectRoot) : resolve(projectRoot);
  const candidatePath = isAbsolute(filePath) ? resolve(filePath) : resolve(root, filePath);
  const resolvedPath = existsSync(candidatePath)
    ? realpathSync.native(candidatePath)
    : candidatePath;
  const relativePath = relative(root, resolvedPath);

  if (relativePath.startsWith('..') || isAbsolute(relativePath)) {
    throw new Error(`Path escapes the project root: ${filePath}`);
  }

  return resolvedPath;
}

export async function critiqueFile(
  filePath: string,
  projectRoot: string,
): Promise<FileCritiqueReport> {
  const resolvedPath = resolveProjectFilePath(projectRoot, filePath);
  const code = await readFile(resolvedPath, 'utf-8');
  const treatmentsCss = readTextIfExists(join(projectRoot, 'src', 'styles', 'treatments.css'));
  const reviewPack = loadReviewPack(projectRoot);
  const packManifest = loadPackManifest(projectRoot);
  const adoptionMode = readProjectAdoptionMode(projectRoot);

  return critiqueSource({
    filePath: resolvedPath,
    code,
    reviewPack,
    packManifest,
    treatmentsCss,
    adoptionMode,
  });
}
