@aarock1234/slopscan 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Abdel Seaf
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,143 @@
+# slopscan
+
+Scores a git diff for slop: code that is hacky, non-idiomatic, or hard to change later, whoever wrote it.
+TypeScript and Go.
+
+```
+slop score 63 (D)
+idiom 92  ·  hacky 100  ·  futureproof 0
+2 files, 14 scored lines
+
+src/users.ts:11  [critical] ts.hacky.empty-catch
+    empty catch swallows the error; handle it, rethrow with context, or let it propagate
+    > catch {}
+```
+
+## How it works
+
+Five nouns, one pipeline.
+
+| noun       | what it is                                                                   |
+| ---------- | ---------------------------------------------------------------------------- |
+| `Rule`     | one markdown file under `rules/` with a why, bad examples, and good examples |
+| `Change`   | a changed file at head with the set of lines this diff touched               |
+| `Analyzer` | `(change, rules) => findings`; two of them, syntax and judge                 |
+| `Finding`  | a rule, a location, a verbatim quote, a confidence                           |
+| `Report`   | the score, its axes, and the ranked findings                                 |
+
+`scan` reads what changed, runs every analyzer over it, confirms the findings that need a repo-wide check, and
+scores what survives. The syntax analyzer parses each file once with tree-sitter and runs every `ast` rule against
+the tree. The judge analyzer makes one model call per changed file with the `judge` rules as its rubric, and drops
+any finding whose quote is not in the file, is not on a changed line, or is under the confidence floor.
+
+## Rules
+
+A rule's identity is its path: `rules/ts/hacky/type-safety/no-explicit-any.md` is `ts.hacky.no-explicit-any`.
+The frontmatter carries only what the path cannot:
+
+```yaml
+severity: major # info | minor | major | critical
+detect: ast # ast | judge
+ast:
+    rule:
+        kind: predefined_type
+        regex: ^any$
+```
+
+Then `## Why`, `## Message`, `## Bad`, and `## Good`. The examples are the tests: `rules.test.ts` runs every `ast`
+rule's bad blocks (must match) and good blocks (must not). A `// BAD:` marker line above the offending code records
+which line the match has to land on.
+
+Judge rules may name a `confirm` predicate (`callCount`, `implCount`, `refCount`). The judge nominates a `symbol`
+and the finding only counts if the repo-wide count agrees.
+
+Three axes, weighted into one score:
+
+- **idiom**: does it read like the language.
+- **hacky**: shortcuts that work today and bite later.
+- **futureproof**: how many places have to move for the next plausible change.
+
+## Scoring
+
+Points per finding by severity (1 / 3 / 8 / 20), damped geometrically within one rule so a hundred `any` casts
+score about twice one. Points per hundred changed lines feed `100 * (1 - e^(-density / 12))` per axis, and the
+axes combine `0.25 idiom + 0.40 hacky + 0.35 futureproof`. Grades A through F, exit code 1 above the fail
+threshold. Every constant lives in `.slopscan.yml`.
+
+## GitHub Action
+
+```yaml
+name: slopscan
+on:
+    pull_request:
+
+permissions:
+    contents: read
+    pull-requests: write
+
+jobs:
+    slop:
+        runs-on: ubuntu-latest
+        steps:
+            - uses: actions/checkout@v5
+              with:
+                  fetch-depth: 0
+            - uses: aarock1234/slopscan@v1
+              with:
+                  openrouter-api-key: ${{ secrets.OPENROUTER_API_KEY }}
+```
+
+The Action writes the report to the job summary, uploads the full JSON as an artifact, keeps one sticky comment on
+the pull request up to date, and fails the check when the score is over `failThreshold`. Without a key it runs the
+syntax rules only. Inputs: `base`, `judge`, `openrouter-api-key`, `openai-api-key`, `comment`, `fail-on-threshold`,
+`version`. Outputs: `score`, `grade`.
+
+To run it on demand, comment `@slopscan` or `/slopscan` on a pull request. That needs an `issue_comment` trigger next to
+`pull_request` and a guard so only people with write access can start a run that uses the repository's secrets:
+
+```yaml
+on:
+    pull_request:
+    issue_comment:
+        types: [created]
+
+jobs:
+    slop:
+        if: >-
+            github.event_name == 'pull_request' ||
+            (github.event.issue.pull_request &&
+             (contains(github.event.comment.body, '@slopscan') || contains(github.event.comment.body, '/slopscan')) &&
+             contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association))
+```
+
+The Action reacts to the comment with eyes, checks out that pull request's head, and posts the report as usual.
+`@slopscan` also notifies whoever owns that GitHub handle; `/slopscan` does not.
+
+Judge results are cached by content under `.slopscan-cache`, so re-running the same commit costs nothing.
+
+## What leaves your machine
+
+The syntax rules run locally. The judge sends each changed file's changed regions, with fifteen lines of context
+and the file's imports, to the model provider named in `judge.model`. Nothing else is sent. If that is not
+acceptable for a repository, run with `--no-judge` or leave the key out of the Action.
+
+## Usage
+
+```bash
+pnpm install
+pnpm dev scan --base main                 # judge on; needs OPENAI_API_KEY in .env
+pnpm dev scan --base main --no-judge      # syntax rules only, no key needed
+pnpm dev scan --base main --format json   # or markdown
+pnpm dev rules                            # list rules
+pnpm dev scan --rules ./my-rules          # bring your own rule directory
+```
+
+Authoring:
+
+```bash
+pnpm script scripts/check-rule.ts rules/ts/hacky/type-safety/no-explicit-any.md   # one rule, fast
+pnpm test                                                                          # everything
+pnpm script scripts/eval-judge.ts                                                  # judge precision/recall, costs calls
+pnpm script scripts/write-skill.ts                                                 # regenerate SKILL.md
+pnpm script scripts/import-guide.ts --lang ts --guide path/to/STYLE.md             # drafts from a prose guide
+```

package/SKILL.md

@@ -0,0 +1,149 @@
+---
+name: slop-rules
+description: Coding rules for TypeScript and Go that slopscan enforces. Use when writing, editing, or reviewing .ts, .tsx, or .go code. Each rule links to its full explanation with good and bad examples.
+---
+
+# Slop rules
+
+Code is slop when it is hacky, non-idiomatic, or hard to change later, regardless of who wrote it. Each rule below
+names a one-line message; the linked file holds the reasoning and examples. Read a rule file when a message is not
+self-explanatory.
+
+## Idiom: write the language the way it is written
+
+| rule                                                                                                          | lang | severity | check    | message                                                                                           |
+| ------------------------------------------------------------------------------------------------------------- | ---- | -------- | -------- | ------------------------------------------------------------------------------------------------- |
+| [any.idiom.no-section-banners](rules/any/idiom/comments/no-section-banners.md)                                | any  | minor    | syntax   | banner comments signal a file doing too much; split it instead of decorating it                   |
+| [go.idiom.accept-interfaces-return-concrete](rules/go/idiom/interfaces/accept-interfaces-return-concrete.md)  | go   | minor    | judgment | accept interfaces and return concrete types                                                       |
+| [go.idiom.acronyms-consistent-case](rules/go/idiom/naming/acronyms-consistent-case.md)                        | go   | minor    | syntax   | acronyms keep one case in identifiers: userID, HTTPClient, parseURL                               |
+| [go.idiom.blank-line-before-return](rules/go/idiom/formatting/blank-line-before-return.md)                    | go   | info     | judgment | return has a blank line before it unless it is the only statement in the block                    |
+| [go.idiom.capitalized-error-message](rules/go/idiom/errors/capitalized-error-message.md)                      | go   | minor    | syntax   | error strings are lowercase fragments so they read well when wrapped                              |
+| [go.idiom.check-error-immediately](rules/go/idiom/errors/check-error-immediately.md)                          | go   | minor    | judgment | check the error on the line after the call that returned it                                       |
+| [go.idiom.consistent-receiver-kind-per-type](rules/go/idiom/receivers/consistent-receiver-kind-per-type.md)   | go   | minor    | judgment | type mixes pointer and value receivers; use one kind for every method                             |
+| [go.idiom.constructor-named-new](rules/go/idiom/constructors/constructor-named-new.md)                        | go   | minor    | judgment | constructor for the package's primary type is named New, not NewX                                 |
+| [go.idiom.context-is-first-param](rules/go/idiom/context/context-is-first-param.md)                           | go   | minor    | syntax   | context.Context is the first parameter                                                            |
+| [go.idiom.defer-close-explicit-discard](rules/go/idiom/errors/defer-close-explicit-discard.md)                | go   | minor    | syntax   | bare defer Close ignores its error silently; discard it with _ = or check it                      |
+| [go.idiom.doc-comment-on-exported](rules/go/idiom/comments/doc-comment-on-exported.md)                        | go   | minor    | syntax   | exported declaration has no doc comment                                                           |
+| [go.idiom.doc-comment-starts-with-name](rules/go/idiom/comments/doc-comment-starts-with-name.md)              | go   | info     | judgment | doc comment does not start with the name it documents                                             |
+| [go.idiom.error-is-last-return-value](rules/go/idiom/errors/error-is-last-return-value.md)                    | go   | minor    | syntax   | error is the last return value                                                                    |
+| [go.idiom.import-order-groups](rules/go/idiom/imports/import-order-groups.md)                                 | go   | minor    | judgment | imports are grouped stdlib, external, internal, side-effect with a blank line between groups      |
+| [go.idiom.interface-er-suffix](rules/go/idiom/naming/interface-er-suffix.md)                                  | go   | info     | judgment | single-method interface is named for its action with an er suffix                                 |
+| [go.idiom.io-takes-context](rules/go/idiom/context/io-takes-context.md)                                       | go   | minor    | judgment | function does I/O without a context; take ctx and pass it to the call                             |
+| [go.idiom.lowercase-log-messages](rules/go/idiom/logging/lowercase-log-messages.md)                           | go   | minor    | syntax   | log messages are lowercase fragments                                                              |
+| [go.idiom.main-delegates-to-run](rules/go/idiom/structure/main-delegates-to-run.md)                           | go   | minor    | judgment | main does the wiring itself; move it into run() error so defers run on every exit                 |
+| [go.idiom.multiline-struct-literals](rules/go/idiom/formatting/multiline-struct-literals.md)                  | go   | info     | syntax   | struct literal with several fields goes one field per line                                        |
+| [go.idiom.mutex-over-channels-for-state](rules/go/idiom/concurrency/mutex-over-channels-for-state.md)         | go   | minor    | judgment | channel used as a lock around plain state; use a sync.Mutex next to the field                     |
+| [go.idiom.new-expr-for-pointer-fields](rules/go/idiom/structs/new-expr-for-pointer-fields.md)                 | go   | info     | judgment | temporary declared only to take its address; use new(expr)                                        |
+| [go.idiom.no-log-and-return](rules/go/idiom/errors/no-log-and-return.md)                                      | go   | minor    | judgment | error is logged and returned; handle it or propagate it, not both                                 |
+| [go.idiom.no-package-name-stutter](rules/go/idiom/naming/no-package-name-stutter.md)                          | go   | minor    | judgment | exported name repeats the package name; let the package carry the context                         |
+| [go.idiom.no-this-receiver](rules/go/idiom/receivers/no-this-receiver.md)                                     | go   | minor    | syntax   | receiver named this/self; use a short abbreviation of the type                                    |
+| [go.idiom.package-name-single-lowercase-word](rules/go/idiom/naming/package-name-single-lowercase-word.md)    | go   | minor    | syntax   | package names are one short lowercase word                                                        |
+| [go.idiom.pointer-vs-value-receiver-choice](rules/go/idiom/receivers/pointer-vs-value-receiver-choice.md)     | go   | minor    | judgment | receiver kind does not fit the method: mutation or a large struct needs a pointer receiver        |
+| [go.idiom.prefer-iter-seq](rules/go/idiom/iterators/prefer-iter-seq.md)                                       | go   | minor    | judgment | channel or callback generator; return an iter.Seq so callers can range and break                  |
+| [go.idiom.short-receiver-names](rules/go/idiom/receivers/short-receiver-names.md)                             | go   | minor    | syntax   | receiver name longer than two letters; use a short abbreviation of the type                       |
+| [go.idiom.side-effect-imports-own-group](rules/go/idiom/imports/side-effect-imports-own-group.md)             | go   | minor    | syntax   | side-effect imports go in their own group after the internal imports                              |
+| [go.idiom.use-slog](rules/go/idiom/logging/use-slog.md)                                                       | go   | minor    | syntax   | unstructured log call; use log/slog with a level and key-value attributes                         |
+| [ts.idiom.always-brace-if](rules/ts/idiom/control-flow/always-brace-if.md)                                    | ts   | minor    | syntax   | braceless `if` body; wrap it in a block                                                           |
+| [ts.idiom.arrow-for-callbacks](rules/ts/idiom/functions/arrow-for-callbacks.md)                               | ts   | minor    | syntax   | `function` expression as a callback; use an arrow function                                        |
+| [ts.idiom.as-const-for-literal-config](rules/ts/idiom/constants/as-const-for-literal-config.md)               | ts   | minor    | syntax   | literal const object without `as const`; its values widen to `string`                             |
+| [ts.idiom.boolean-name-question-prefix](rules/ts/idiom/naming/boolean-name-question-prefix.md)                | ts   | minor    | judgment | boolean name does not read as a question; prefix with is, has, should, or can                     |
+| [ts.idiom.const-by-default](rules/ts/idiom/variables/const-by-default.md)                                     | ts   | minor    | judgment | `let` is never reassigned; declare it with `const`                                                |
+| [ts.idiom.descriptive-identifier-quality](rules/ts/idiom/naming/descriptive-identifier-quality.md)            | ts   | minor    | judgment | identifier does not describe what it holds or does; use a descriptive name                        |
+| [ts.idiom.doc-comment-above-declaration](rules/ts/idiom/comments/doc-comment-above-declaration.md)            | ts   | info     | judgment | declaration documented in a trailing comment; put the comment on the line above                   |
+| [ts.idiom.error-message-lowercase](rules/ts/idiom/errors/error-message-lowercase.md)                          | ts   | minor    | syntax   | error message starts with a capital letter; write it as a lowercase fragment                      |
+| [ts.idiom.export-type-for-types](rules/ts/idiom/imports/export-type-for-types.md)                             | ts   | minor    | judgment | re-export is a type; use `export type`                                                            |
+| [ts.idiom.function-declaration-for-top-level](rules/ts/idiom/functions/function-declaration-for-top-level.md) | ts   | minor    | syntax   | top-level arrow function; use a `function` declaration                                            |
+| [ts.idiom.guard-clauses-early-return](rules/ts/idiom/control-flow/guard-clauses-early-return.md)              | ts   | minor    | judgment | nested conditionals wrap the happy path; check preconditions first and return early               |
+| [ts.idiom.import-order](rules/ts/idiom/imports/import-order.md)                                               | ts   | minor    | syntax   | imports out of order; external packages, then `@/` modules, then relative paths                   |
+| [ts.idiom.import-type-for-types](rules/ts/idiom/imports/import-type-for-types.md)                             | ts   | minor    | judgment | import is only used as a type; use `import type`                                                  |
+| [ts.idiom.inline-export-at-declaration](rules/ts/idiom/exports/inline-export-at-declaration.md)               | ts   | minor    | syntax   | export list detached from its declarations; export at the declaration site                        |
+| [ts.idiom.interface-extends-over-intersection](rules/ts/idiom/types/interface-extends-over-intersection.md)   | ts   | info     | judgment | object shape extended with an intersection; use `interface extends`                               |
+| [ts.idiom.log-at-boundary-not-every-layer](rules/ts/idiom/errors/log-at-boundary-not-every-layer.md)          | ts   | minor    | judgment | catch logs and rethrows in an inner layer; let it propagate and log once at the boundary          |
+| [ts.idiom.multiline-object-literals](rules/ts/idiom/formatting/multiline-object-literals.md)                  | ts   | info     | syntax   | object with several properties on one line; put one property per line                             |
+| [ts.idiom.no-default-export](rules/ts/idiom/exports/no-default-export.md)                                     | ts   | minor    | syntax   | default export has no name of its own; use a named export                                         |
+| [ts.idiom.no-enum](rules/ts/idiom/constants/no-enum.md)                                                       | ts   | minor    | syntax   | enum is a runtime construct; use a const object with `as const` and a derived union               |
+| [ts.idiom.no-nested-ternary](rules/ts/idiom/control-flow/no-nested-ternary.md)                                | ts   | minor    | syntax   | nested ternary; use an if chain, a switch, or a lookup                                            |
+| [ts.idiom.no-promise-chains](rules/ts/idiom/async/no-promise-chains.md)                                       | ts   | minor    | syntax   | promise chain; use async/await                                                                    |
+| [ts.idiom.no-var](rules/ts/idiom/variables/no-var.md)                                                         | ts   | minor    | syntax   | `var` is function-scoped and hoisted; use `const` or `let`                                        |
+| [ts.idiom.null-vs-undefined-convention](rules/ts/idiom/types/null-vs-undefined-convention.md)                 | ts   | info     | judgment | null and undefined used interchangeably; undefined for absence, null for a deliberate empty value |
+| [ts.idiom.parallelize-independent-awaits](rules/ts/idiom/async/parallelize-independent-awaits.md)             | ts   | minor    | judgment | independent awaits run one after another; run them together with `Promise.all`                    |
+| [ts.idiom.prefer-type-over-interface](rules/ts/idiom/types/prefer-type-over-interface.md)                     | ts   | minor    | syntax   | plain data shape declared as `interface`; use `type`                                              |
+| [ts.idiom.satisfies-over-annotation](rules/ts/idiom/types/satisfies-over-annotation.md)                       | ts   | minor    | syntax   | object literal annotated with `Record` loses its keys; use `satisfies`                            |
+| [ts.idiom.screaming-snake-module-constants](rules/ts/idiom/naming/screaming-snake-module-constants.md)        | ts   | minor    | syntax   | module-level literal constant is camelCase; use SCREAMING_SNAKE_CASE                              |
+| [ts.idiom.side-effect-imports-last](rules/ts/idiom/imports/side-effect-imports-last.md)                       | ts   | minor    | syntax   | side-effect import belongs after all named imports                                                |
+| [ts.idiom.structured-logging-lowercase](rules/ts/idiom/logging/structured-logging-lowercase.md)               | ts   | minor    | syntax   | log message starts with a capital letter; write it as a lowercase fragment                        |
+| [ts.idiom.template-literals-over-concat](rules/ts/idiom/strings/template-literals-over-concat.md)             | ts   | minor    | syntax   | string built with `+`; use a template literal                                                     |
+| [ts.idiom.type-predicates-for-narrowing](rules/ts/idiom/types/type-predicates-for-narrowing.md)               | ts   | minor    | judgment | type check returns a plain boolean; declare a type predicate so callers narrow without casting    |
+
+## Hacky: shortcuts that work today and bite later
+
+| rule                                                                                               | lang | severity | check    | message                                                                                            |
+| -------------------------------------------------------------------------------------------------- | ---- | -------- | -------- | -------------------------------------------------------------------------------------------------- |
+| [any.hacky.comment-restates-code](rules/any/hacky/comments/comment-restates-code.md)               | any  | minor    | judgment | comment restates the code; say why or delete it                                                    |
+| [any.hacky.copy-paste-block](rules/any/hacky/duplication/copy-paste-block.md)                      | any  | minor    | judgment | copy-pasted block differs in one identifier; extract a function or loop over the values            |
+| [any.hacky.debug-print](rules/any/hacky/debugging/debug-print.md)                                  | any  | minor    | syntax   | debug print in library code; use the structured logger or remove it                                |
+| [any.hacky.hardcoded-url](rules/any/hacky/config/hardcoded-url.md)                                 | any  | minor    | syntax   | hardcoded url in logic; read the base url from config and build the path on it                     |
+| [any.hacky.magic-number](rules/any/hacky/constants/magic-number.md)                                | any  | minor    | judgment | magic number in logic; name it as a constant that says what it means                               |
+| [any.hacky.shipped-todo-comment](rules/any/hacky/comments/shipped-todo-comment.md)                 | any  | minor    | syntax   | todo marker shipped in code; do the work or link the tracking issue                                |
+| [any.hacky.sleep-based-sync](rules/any/hacky/concurrency/sleep-based-sync.md)                      | any  | major    | syntax   | fixed sleep used as synchronization; wait on a promise, channel, or readiness signal instead       |
+| [any.hacky.stringly-typed-enum](rules/any/hacky/types/stringly-typed-enum.md)                      | any  | minor    | judgment | string literals used as an enum; declare the set once as typed constants                           |
+| [go.hacky.check-close-error-on-writable](rules/go/hacky/errors/check-close-error-on-writable.md)   | go   | critical | judgment | close error on a written resource is discarded; a failed close can mean lost data                  |
+| [go.hacky.custom-error-type-errors-as](rules/go/hacky/errors/custom-error-type-errors-as.md)       | go   | minor    | syntax   | type assertion on err misses wrapped errors; use errors.AsType or errors.As                        |
+| [go.hacky.ignored-error-blank](rules/go/hacky/errors/ignored-error-blank.md)                       | go   | major    | syntax   | returned error discarded with the blank identifier; check it or comment why it cannot matter       |
+| [go.hacky.json-into-struct-not-map](rules/go/hacky/types/json-into-struct-not-map.md)              | go   | major    | judgment | json decoded into a map; declare a struct with tags so fields are checked at compile time          |
+| [go.hacky.never-pass-nil-context](rules/go/hacky/context/never-pass-nil-context.md)                | go   | major    | syntax   | nil passed as a context; use context.Background() or context.TODO()                                |
+| [go.hacky.no-any](rules/go/hacky/types/no-any.md)                                                  | go   | major    | syntax   | any erases the type; use a concrete type, a type parameter, or a small interface                   |
+| [go.hacky.no-context-in-struct](rules/go/hacky/context/no-context-in-struct.md)                    | go   | major    | syntax   | context stored in a struct outlives the request it belongs to; pass ctx per call                   |
+| [go.hacky.no-goroutine-without-wait](rules/go/hacky/concurrency/no-goroutine-without-wait.md)      | go   | major    | judgment | goroutine started with nothing waiting for it or collecting its error                              |
+| [go.hacky.no-map-any-any](rules/go/hacky/types/no-map-any-any.md)                                  | go   | major    | syntax   | map[any]any is fully untyped; give the map concrete key and value types                            |
+| [go.hacky.no-map-string-any](rules/go/hacky/type-safety/no-map-string-any.md)                      | go   | major    | syntax   | map[string]any defers every field to runtime; decode into a struct                                 |
+| [go.hacky.os-exit-only-in-main](rules/go/hacky/structure/os-exit-only-in-main.md)                  | go   | major    | syntax   | os.Exit outside main skips every defer; return an error and exit from main                         |
+| [go.hacky.package-level-mutable-var](rules/go/hacky/state/package-level-mutable-var.md)            | go   | minor    | syntax   | package-level mutable collection is shared global state; own it in a struct and pass it in         |
+| [go.hacky.panic-only-unrecoverable](rules/go/hacky/errors/panic-only-unrecoverable.md)             | go   | major    | syntax   | panic in library code; return an error and let the caller decide                                   |
+| [go.hacky.sentinel-errors-with-errors-is](rules/go/hacky/errors/sentinel-errors-with-errors-is.md) | go   | minor    | syntax   | error compared with == misses wrapped errors; use errors.Is                                        |
+| [go.hacky.wrap-errors-with-w](rules/go/hacky/errors/wrap-errors-with-w.md)                         | go   | major    | syntax   | fmt.Errorf with %v drops the error chain; wrap with %w                                             |
+| [ts.hacky.catch-param-typed-unknown](rules/ts/hacky/errors/catch-param-typed-unknown.md)           | ts   | major    | syntax   | catch parameter treated as `Error` without a check; keep it `unknown` and narrow with `instanceof` |
+| [ts.hacky.custom-error-class-instanceof](rules/ts/hacky/errors/custom-error-class-instanceof.md)   | ts   | minor    | syntax   | branching on error message text; throw a custom error class and check `instanceof`                 |
+| [ts.hacky.empty-catch](rules/ts/hacky/errors/empty-catch.md)                                       | ts   | critical | syntax   | empty catch swallows the error; handle it, rethrow with context, or let it propagate               |
+| [ts.hacky.env-read-outside-config](rules/ts/hacky/config/env-read-outside-config.md)               | ts   | minor    | syntax   | environment read outside the config module; validate env once and pass typed config                |
+| [ts.hacky.exported-let](rules/ts/hacky/state/exported-let.md)                                      | ts   | minor    | syntax   | exported let is global mutable state; expose functions over the state or export a const            |
+| [ts.hacky.log-and-swallow](rules/ts/hacky/errors/log-and-swallow.md)                               | ts   | major    | syntax   | catch only logs and continues; rethrow with context or return an explicit failure                  |
+| [ts.hacky.no-double-assertion](rules/ts/hacky/type-safety/no-double-assertion.md)                  | ts   | major    | syntax   | double assertion through `unknown` bypasses all checking; validate or narrow instead               |
+| [ts.hacky.no-explicit-any](rules/ts/hacky/type-safety/no-explicit-any.md)                          | ts   | major    | syntax   | `any` disables type checking; use a real type, a generic, or `unknown`                             |
+| [ts.hacky.no-floating-promises](rules/ts/hacky/async/no-floating-promises.md)                      | ts   | major    | judgment | promise is neither awaited nor returned; its rejection is lost                                     |
+| [ts.hacky.no-non-null-assertion](rules/ts/hacky/type-safety/no-non-null-assertion.md)              | ts   | major    | syntax   | non-null assertion trades a compile-time check for a runtime crash; narrow or throw                |
+| [ts.hacky.no-unchecked-type-assertion](rules/ts/hacky/type-safety/no-unchecked-type-assertion.md)  | ts   | major    | judgment | type assertion on unvalidated data; validate with a schema or a type guard instead                 |
+| [ts.hacky.nullish-coalescing-over-or](rules/ts/hacky/operators/nullish-coalescing-over-or.md)      | ts   | minor    | syntax   | `                                                                                                  |     | `with a default replaces 0, empty string, and false; use`??` |
+| [ts.hacky.throw-typed-error-with-context](rules/ts/hacky/errors/throw-typed-error-with-context.md) | ts   | minor    | syntax   | bare `Error` with a fixed message; throw a typed error that carries context                        |
+| [ts.hacky.validate-parsed-json](rules/ts/hacky/type-safety/validate-parsed-json.md)                | ts   | major    | syntax   | `JSON.parse` result cast to a type without validation; parse it through a schema                   |
+
+## Future-proof: keep the next change small
+
+| rule                                                                                                                | lang | severity | check    | message                                                                                                          |
+| ------------------------------------------------------------------------------------------------------------------- | ---- | -------- | -------- | ---------------------------------------------------------------------------------------------------------------- |
+| [any.futureproof.boolean-positional-param](rules/any/futureproof/params/boolean-positional-param.md)                | any  | minor    | syntax   | boolean positional parameter; use an options object or two functions                                             |
+| [any.futureproof.dead-export](rules/any/futureproof/exports/dead-export.md)                                         | any  | minor    | judgment | exported symbol is referenced nowhere; delete it or make it private                                              |
+| [any.futureproof.framework-type-in-domain](rules/any/futureproof/layering/framework-type-in-domain.md)              | any  | major    | judgment | http framework type in a domain signature; take plain input and return a plain result                            |
+| [any.futureproof.logic-in-handler](rules/any/futureproof/layering/logic-in-handler.md)                              | any  | major    | judgment | business logic inside an http handler; move it to a service the handler calls                                    |
+| [any.futureproof.pass-through-wrapper](rules/any/futureproof/abstraction/pass-through-wrapper.md)                   | any  | minor    | judgment | pass-through wrapper forwards its arguments unchanged; call the target directly                                  |
+| [any.futureproof.positional-config-args](rules/any/futureproof/params/positional-config-args.md)                    | any  | minor    | syntax   | constructor takes 4+ positional arguments; take an options object or config struct                               |
+| [any.futureproof.single-caller-helper](rules/any/futureproof/abstraction/single-caller-helper.md)                   | any  | minor    | judgment | single-use helper adds indirection without removing duplication                                                  |
+| [any.futureproof.single-impl-interface](rules/any/futureproof/abstraction/single-impl-interface.md)                 | any  | minor    | judgment | interface has a single implementation and no test double; use the concrete type until a second one exists        |
+| [any.futureproof.test-asserts-implementation](rules/any/futureproof/testing/test-asserts-implementation.md)         | any  | minor    | judgment | test asserts on internals; assert on observable behavior instead                                                 |
+| [any.futureproof.wide-function](rules/any/futureproof/structure/wide-function.md)                                   | any  | minor    | syntax   | function is too wide: more than 5 parameters or over 60 lines; group parameters into a struct and split the body |
+| [go.futureproof.compile-time-impl-assertion](rules/go/futureproof/interfaces/compile-time-impl-assertion.md)        | go   | info     | judgment | type meant to satisfy an interface is not checked; add var _ Iface = (*T)(nil)                                   |
+| [go.futureproof.define-interfaces-at-consumer](rules/go/futureproof/interfaces/define-interfaces-at-consumer.md)    | go   | minor    | judgment | interface declared beside its implementation; define it where it is consumed                                     |
+| [go.futureproof.generics-over-any](rules/go/futureproof/types/generics-over-any.md)                                 | go   | minor    | judgment | interface plus assertions where a type parameter would keep the caller's type                                    |
+| [go.futureproof.keep-interfaces-small](rules/go/futureproof/interfaces/keep-interfaces-small.md)                    | go   | minor    | syntax   | interface with five or more methods; split it and compose smaller interfaces                                     |
+| [go.futureproof.no-utils-helpers-common-package](rules/go/futureproof/naming/no-utils-helpers-common-package.md)    | go   | minor    | syntax   | package named as a grab-bag; name it after the concept it owns                                                   |
+| [go.futureproof.string-enums-when-serialized](rules/go/futureproof/constants/string-enums-when-serialized.md)       | go   | minor    | judgment | iota enum is serialized as a bare integer; back it with a string                                                 |
+| [go.futureproof.typed-constants-for-enums](rules/go/futureproof/constants/typed-constants-for-enums.md)             | go   | minor    | judgment | related constants form an enum but have no named type; declare one                                               |
+| [go.futureproof.zero-value-usable](rules/go/futureproof/structs/zero-value-usable.md)                               | go   | minor    | judgment | zero value panics on first use; make the type usable without a constructor                                       |
+| [ts.futureproof.colocate-zod-schemas](rules/ts/futureproof/structure/colocate-zod-schemas.md)                       | ts   | info     | judgment | schema lives away from the code that uses it; colocate it with its consumer                                      |
+| [ts.futureproof.composition-over-abstract-base](rules/ts/futureproof/classes/composition-over-abstract-base.md)     | ts   | minor    | judgment | abstract base class used for code sharing; prefer a shared function or injected dependency                       |
+| [ts.futureproof.enum-values-from-const-object](rules/ts/futureproof/zod/enum-values-from-const-object.md)           | ts   | minor    | syntax   | `z.enum` with inline string literals; derive the values from a const object                                      |
+| [ts.futureproof.exhaustive-switch-never-check](rules/ts/futureproof/types/exhaustive-switch-never-check.md)         | ts   | minor    | judgment | switch over a union without a `never` check; new variants will fall through silently                             |
+| [ts.futureproof.explicit-return-type-on-exports](rules/ts/futureproof/functions/explicit-return-type-on-exports.md) | ts   | minor    | syntax   | exported function has no return type; declare it so the contract cannot drift                                    |
+| [ts.futureproof.no-z-native-enum](rules/ts/futureproof/zod/no-z-native-enum.md)                                     | ts   | minor    | syntax   | `z.nativeEnum` is deprecated; use `z.enum` over the values of a const object                                     |
+| [ts.futureproof.readonly-for-immutable-data](rules/ts/futureproof/types/readonly-for-immutable-data.md)             | ts   | info     | judgment | data that is never mutated is typed as mutable; mark it `readonly`                                               |
+| [ts.futureproof.schema-first-infer-type](rules/ts/futureproof/zod/schema-first-infer-type.md)                       | ts   | minor    | judgment | hand-written type duplicates a schema; derive it with `z.infer`                                                  |

package/dist/analyzer.d.ts

@@ -0,0 +1,5 @@
+import type { Change } from './change.js';
+import type { Finding } from './finding.js';
+import type { Rule } from './rule.js';
+export type Analyzer = (change: Change, rules: readonly Rule[]) => Promise<Finding[]>;
+export declare function collectFindings(changes: readonly Change[], rules: readonly Rule[], analyzers: readonly Analyzer[]): Promise<Finding[]>;

package/dist/analyzer.js

@@ -0,0 +1,13 @@
+import { isIgnored } from './change.js';
+import { compareFindings } from './finding.js';
+import { ruleAppliesTo } from './lang.js';
+import { mapConcurrent } from './shared/concurrency.js';
+export async function collectFindings(changes, rules, analyzers) {
+    const perChange = await mapConcurrent(changes, async (change) => {
+        const applicable = rules.filter(rule => ruleAppliesTo(rule.lang, change.lang) && !isIgnored(change.path, rule.ignore));
+        const results = await Promise.all(analyzers.map(analyzer => analyzer(change, applicable)));
+        return results.flat();
+    });
+    return perChange.flat().sort(compareFindings);
+}
+//# sourceMappingURL=analyzer.js.map

package/dist/analyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyzer.js","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAMxD,MAAM,CAAC,KAAK,UAAU,eAAe,CACpC,OAA0B,EAC1B,KAAsB,EACtB,SAA8B;IAE9B,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,KAAK,EAAC,MAAM,EAAC,EAAE;QAC7D,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAC9B,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CACrF,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAE3F,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;AAC/C,CAAC"}

package/dist/analyzers/ast.d.ts

@@ -0,0 +1,12 @@
+import type { SgNode } from '@ast-grep/napi';
+import type { Analyzer } from '../analyzer.js';
+import { Lang } from '../lang.js';
+import type { AstMatcher } from '../rule.js';
+export type AstMatch = {
+    line: number;
+    endLine: number;
+    text: string;
+};
+export declare const astAnalyzer: Analyzer;
+export declare function parseSource(lang: Lang, source: string, path?: string): SgNode;
+export declare function matchAst(root: SgNode, matcher: AstMatcher): AstMatch[];

package/dist/analyzers/ast.js

@@ -0,0 +1,73 @@
+import goLang from '@ast-grep/lang-go';
+import { Lang as Parser, parse, registerDynamicLanguage } from '@ast-grep/napi';
+import { Lang } from '../lang.js';
+import { Detect } from '../rule.js';
+const GO_PARSER = 'go';
+const TSX_EXTENSION = '.tsx';
+// tree-sitter grammars: TypeScript ships with the bindings, Go is loaded from its prebuilt library.
+// registration must happen exactly once per process.
+registerDynamicLanguage({ [GO_PARSER]: goLang });
+const PARSERS = {
+    [Lang.TS]: Parser.TypeScript,
+    [Lang.GO]: GO_PARSER,
+};
+// runs every ast rule for the file's language against one parsed tree and keeps the matches that start on
+// a changed line. a match that begins on an untouched line belongs to whoever wrote it, not to this diff.
+export const astAnalyzer = (change, rules) => {
+    const matchers = rules.flatMap(rule => {
+        if (rule.detect !== Detect.AST) {
+            return [];
+        }
+        const matcher = rule.ast[change.lang];
+        return matcher === undefined ? [] : [{ rule, matcher }];
+    });
+    if (matchers.length === 0) {
+        return Promise.resolve([]);
+    }
+    const root = parseSource(change.lang, change.source, change.path);
+    const findings = matchers.flatMap(({ rule, matcher }) => onePerLine(matchAst(root, matcher).filter(match => change.changedLines.has(match.line))).map(match => toFinding(rule, change.path, match)));
+    return Promise.resolve(findings);
+};
+// a chain like `p.then().catch().finally()` is three matches starting on one line; the reader wants one finding
+function onePerLine(matches) {
+    const seen = new Set();
+    return matches.filter(match => {
+        if (seen.has(match.line)) {
+            return false;
+        }
+        seen.add(match.line);
+        return true;
+    });
+}
+// parses once so every rule can run against the same tree. tsx has its own grammar.
+export function parseSource(lang, source, path = '') {
+    const parser = lang === Lang.TS && path.endsWith(TSX_EXTENSION) ? Parser.Tsx : PARSERS[lang];
+    return parse(parser, source).root();
+}
+// the matcher is authored as free-form YAML and validated by ast-grep when it compiles it,
+// which is why the envelope type is loose and the bindings accept it as-is.
+export function matchAst(root, matcher) {
+    return root.findAll(matcher).map(node => {
+        const { start, end } = node.range();
+        return {
+            line: start.line + 1,
+            endLine: end.line + 1,
+            text: node.text(),
+        };
+    });
+}
+function toFinding(rule, path, match) {
+    return {
+        ruleId: rule.id,
+        path,
+        line: match.line,
+        endLine: match.endLine,
+        quote: firstLine(match.text),
+        message: rule.message,
+        confidence: 1,
+    };
+}
+function firstLine(text) {
+    return text.split('\n', 1)[0]?.trim() ?? '';
+}
+//# sourceMappingURL=ast.js.map

package/dist/analyzers/ast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast.js","sourceRoot":"","sources":["../../src/analyzers/ast.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,mBAAmB,CAAC;AACvC,OAAO,EAAE,IAAI,IAAI,MAAM,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAKhF,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAGpC,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B,oGAAoG;AACpG,qDAAqD;AACrD,uBAAuB,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AAEjD,MAAM,OAAO,GAAmC;IAC/C,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,UAAU;IAC5B,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,SAAS;CACpB,CAAC;AASF,0GAA0G;AAC1G,0GAA0G;AAC1G,MAAM,CAAC,MAAM,WAAW,GAAa,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;IACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QACrC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC;QACX,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEtC,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAElE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CACvD,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CACpG,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CACnC,CACD,CAAC;IAEF,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC,CAAC;AAEF,gHAAgH;AAChH,SAAS,UAAU,CAAC,OAA4B;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACd,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAErB,OAAO,IAAI,CAAC;IACb,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,WAAW,CAAC,IAAU,EAAE,MAAc,EAAE,IAAI,GAAG,EAAE;IAChE,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7F,OAAO,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AACrC,CAAC;AAED,2FAA2F;AAC3F,4EAA4E;AAC5E,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,OAAmB;IACzD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QACvC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAEpC,OAAO;YACN,IAAI,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC;YACpB,OAAO,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;SACjB,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,IAAa,EAAE,IAAY,EAAE,KAAe;IAC9D,OAAO;QACN,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,IAAI;QACJ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,CAAC;KACb,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC7C,CAAC"}

package/dist/analyzers/judge-chunks.d.ts

@@ -0,0 +1,13 @@
+import type { Change } from '../change.js';
+export type Region = {
+    start: number;
+    end: number;
+};
+export type Chunk = {
+    path: string;
+    regions: readonly Region[];
+    text: string;
+    estimatedTokens: number;
+};
+export declare function chunkChange(change: Change, budgetTokens: number): Chunk[];
+export declare function estimateTokens(text: string): number;

package/dist/analyzers/judge-chunks.js

@@ -0,0 +1,87 @@
+// how many untouched lines to show around each changed line, and how close two regions must be to merge
+const CONTEXT_LINES = 15;
+const MERGE_GAP = 40;
+const GUTTER_WIDTH = 5;
+const CHARS_PER_TOKEN = 4;
+// splits a change into chunks that each fit the token budget. regions are changed lines widened by context and
+// merged when close; the file's leading import block rides along so symbols have a home.
+export function chunkChange(change, budgetTokens) {
+    const lineCount = change.source.split('\n').length;
+    const regions = mergeRegions([...importRegion(change.source), ...changedRegions(change, lineCount)]);
+    const budgetChars = budgetTokens * CHARS_PER_TOKEN;
+    const chunks = [];
+    let pending = [];
+    let pendingChars = 0;
+    for (const region of regions) {
+        const chars = renderRegion(change, region).length;
+        if (pending.length > 0 && pendingChars + chars > budgetChars) {
+            chunks.push(toChunk(change, pending));
+            pending = [];
+            pendingChars = 0;
+        }
+        pending.push(region);
+        pendingChars += chars;
+    }
+    if (pending.length > 0) {
+        chunks.push(toChunk(change, pending));
+    }
+    return chunks;
+}
+export function estimateTokens(text) {
+    return Math.ceil(text.length / CHARS_PER_TOKEN);
+}
+function changedRegions(change, lineCount) {
+    return [...change.changedLines]
+        .sort((a, b) => a - b)
+        .map(line => ({
+        start: Math.max(1, line - CONTEXT_LINES),
+        end: Math.min(lineCount, line + CONTEXT_LINES),
+    }));
+}
+const IMPORT_LINE = /^(import\b|\)$|\t"|\s+"[^"]+"$)/;
+const IMPORT_SCAN_LIMIT = 80;
+// lines 1..N covering the file's import statements, or nothing when the file has none
+function importRegion(source) {
+    const lines = source.split('\n', IMPORT_SCAN_LIMIT);
+    let end = 0;
+    lines.forEach((line, index) => {
+        if (IMPORT_LINE.test(line)) {
+            end = index + 1;
+        }
+    });
+    return end === 0 ? [] : [{ start: 1, end }];
+}
+function mergeRegions(regions) {
+    const sorted = [...regions].sort((a, b) => a.start - b.start);
+    const merged = [];
+    for (const region of sorted) {
+        const last = merged.at(-1);
+        if (last !== undefined && region.start - last.end <= MERGE_GAP) {
+            last.end = Math.max(last.end, region.end);
+            continue;
+        }
+        merged.push({ ...region });
+    }
+    return merged;
+}
+function toChunk(change, regions) {
+    const header = `file: ${change.path} (${change.lang})\n\n`;
+    const body = regions.map(region => renderRegion(change, region)).join(`\n${' '.repeat(GUTTER_WIDTH + 1)}...\n\n`);
+    const text = `${header}${body}`;
+    return {
+        path: change.path,
+        regions,
+        text,
+        estimatedTokens: estimateTokens(text),
+    };
+}
+function renderRegion(change, region) {
+    const lines = change.source.split('\n');
+    const rendered = [];
+    for (let line = region.start; line <= region.end; line += 1) {
+        const marker = change.changedLines.has(line) ? '+' : ' ';
+        rendered.push(`${marker}${String(line).padStart(GUTTER_WIDTH)}  ${lines[line - 1] ?? ''}`);
+    }
+    return rendered.join('\n');
+}
+//# sourceMappingURL=judge-chunks.js.map

package/dist/analyzers/judge-chunks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"judge-chunks.js","sourceRoot":"","sources":["../../src/analyzers/judge-chunks.ts"],"names":[],"mappings":"AAEA,wGAAwG;AACxG,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,eAAe,GAAG,CAAC,CAAC;AAe1B,+GAA+G;AAC/G,yFAAyF;AACzF,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,YAAoB;IAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IACnD,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IACrG,MAAM,WAAW,GAAG,YAAY,GAAG,eAAe,CAAC;IAEnD,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC;QAElD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,GAAG,KAAK,GAAG,WAAW,EAAE,CAAC;YAC9D,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YACtC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,GAAG,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,YAAY,IAAI,KAAK,CAAC;IACvB,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,SAAiB;IACxD,OAAO,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC;SAC7B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;SACrB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,aAAa,CAAC;QACxC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,GAAG,aAAa,CAAC;KAC9C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,WAAW,GAAG,iCAAiC,CAAC;AACtD,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B,sFAAsF;AACtF,SAAS,YAAY,CAAC,MAAc;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACpD,IAAI,GAAG,GAAG,CAAC,CAAC;IAEZ,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC7B,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC;QACjB,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,OAA0B;IAC/C,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAE3B,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC;YAChE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YAE1C,SAAS;QACV,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,OAAiB;IACjD,MAAM,MAAM,GAAG,SAAS,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IAClH,MAAM,IAAI,GAAG,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;IAEhC,OAAO;QACN,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO;QACP,IAAI;QACJ,eAAe,EAAE,cAAc,CAAC,IAAI,CAAC;KACrC,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,MAAc;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,MAAM,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QACzD,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC"}

package/dist/analyzers/judge-validate.d.ts

@@ -0,0 +1,19 @@
+import { z } from 'zod';
+import type { Change } from '../change.js';
+import type { Finding } from '../finding.js';
+import type { JudgeRule } from '../rule.js';
+export declare function judgeOutputSchema(ruleIds: readonly [string, ...string[]]): z.ZodObject<{
+    findings: z.ZodArray<z.ZodObject<{
+        ruleId: z.ZodEnum<{
+            [x: string]: string;
+        }>;
+        line: z.ZodNumber;
+        quote: z.ZodString;
+        message: z.ZodString;
+        confidence: z.ZodNumber;
+        symbol: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type JudgeOutput = z.infer<ReturnType<typeof judgeOutputSchema>>;
+export type RawJudgeFinding = JudgeOutput['findings'][number];
+export declare function validateFindings(raw: readonly RawJudgeFinding[], change: Change, rules: ReadonlyMap<string, JudgeRule>, minConfidence: number): Finding[];