@archpilotlabs/archpilot 0.2.3 → 0.2.4

package/dist/archpilot-cli.js

@@ -13660,11 +13660,11 @@ ${lanes.join("\n")}
           return toComponents;
         }
         const components = toComponents.slice(start);
-        const relative17 = [];
+        const relative18 = [];
         for (; start < fromComponents.length; start++) {
-          relative17.push("..");
+          relative18.push("..");
         }
-        return ["", ...relative17, ...components];
+        return ["", ...relative18, ...components];
       }
       function getRelativePathFromDirectory(fromDirectory, to, getCanonicalFileNameOrIgnoreCase) {
         Debug.assert(getRootLength(fromDirectory) > 0 === getRootLength(to) > 0, "Paths must either both be absolute or both be relative");
@@ -52233,11 +52233,11 @@ ${lanes.join("\n")}
             if (i < rootLength) {
               return void 0;
             }
-            const sep = directory.lastIndexOf(directorySeparator, i - 1);
-            if (sep === -1) {
+            const sep2 = directory.lastIndexOf(directorySeparator, i - 1);
+            if (sep2 === -1) {
               return void 0;
             }
-            return directory.substr(0, Math.max(sep, rootLength));
+            return directory.substr(0, Math.max(sep2, rootLength));
           }
         }
       }
@@ -58143,9 +58143,9 @@ ${lanes.join("\n")}
               if (!startsWithDirectory(target, realPathDirectory, getCanonicalFileName)) {
                 return;
               }
-              const relative17 = getRelativePathFromDirectory(realPathDirectory, target, getCanonicalFileName);
+              const relative18 = getRelativePathFromDirectory(realPathDirectory, target, getCanonicalFileName);
               for (const symlinkDirectory of symlinkDirectories) {
-                const option = resolvePath(symlinkDirectory, relative17);
+                const option = resolvePath(symlinkDirectory, relative18);
                 const result2 = cb(option, target === referenceRedirect);
                 shouldFilterIgnoredPaths = true;
                 if (result2) return result2;
@@ -127982,7 +127982,7 @@ ${lanes.join("\n")}
           }
         }
         function createImportCallExpressionAMD(arg, containsLexicalThis) {
-          const resolve9 = factory2.createUniqueName("resolve");
+          const resolve10 = factory2.createUniqueName("resolve");
           const reject = factory2.createUniqueName("reject");
           const parameters = [
             factory2.createParameterDeclaration(
@@ -127991,7 +127991,7 @@ ${lanes.join("\n")}
               /*dotDotDotToken*/
               void 0,
               /*name*/
-              resolve9
+              resolve10
             ),
             factory2.createParameterDeclaration(
               /*modifiers*/
@@ -128008,7 +128008,7 @@ ${lanes.join("\n")}
                 factory2.createIdentifier("require"),
                 /*typeArguments*/
                 void 0,
-                [factory2.createArrayLiteralExpression([arg || factory2.createOmittedExpression()]), resolve9, reject]
+                [factory2.createArrayLiteralExpression([arg || factory2.createOmittedExpression()]), resolve10, reject]
               )
             )
           ]);
@@ -214726,8 +214726,8 @@ Additional information: BADCLIENT: Bad error code, ${badCode} not found in range
         installPackage(options) {
           this.packageInstallId++;
           const request3 = { kind: "installPackage", ...options, id: this.packageInstallId };
-          const promise = new Promise((resolve9, reject) => {
-            (this.packageInstalledPromise ?? (this.packageInstalledPromise = /* @__PURE__ */ new Map())).set(this.packageInstallId, { resolve: resolve9, reject });
+          const promise = new Promise((resolve10, reject) => {
+            (this.packageInstalledPromise ?? (this.packageInstalledPromise = /* @__PURE__ */ new Map())).set(this.packageInstallId, { resolve: resolve10, reject });
           });
           this.installer.send(request3);
           return promise;
@@ -215444,6 +215444,8 @@ function classifyValidationSourceScope(relativePath) {
   const isFixture = hasPathSegment(normalized, /^(?:fixtures?|__fixtures__)$/u);
   const isTestPlugin = hasPathSegment(normalized, /^(?:test-plugins?|testing-plugins?)$/u);
   const isExamplePlugin = hasPathSegment(normalized, /^example-plugins?$/u) || hasTopLevelPathSegment(normalized, /^examples?$/u);
+  const isMavenIntegrationTestModule = hasTopLevelPathSegment(normalized, /^[a-z0-9_.-]+-integration-tests?$/u) || hasTopLevelPathSegment(normalized, /^[a-z0-9_.-]+-it$/u);
+  const isMavenExampleModule = hasTopLevelPathSegment(normalized, /^[a-z0-9_.-]+-examples?$/u);
   const isGenerated = hasPathSegment(normalized, /^(?:generated|__generated__|gen|templates?)$/u) || /\.(?:generated|gen|g)\.(?:ts|tsx|js|jsx|java|cs|py|php|go)$/u.test(fileName) || /\.d\.ts$/u.test(fileName);
   const isMigration = hasPathSegment(normalized, /^(?:migrations?|schema-migrations?|data-migrations|migration-utils?)$/u);
   const isCliTooling = hasPathSegment(normalized, /^(?:cli|bin|scripts?|tools?|scaffold|scaffolding|generators?)$/u) || /(?:^|[./_-])(?:cli|script|tool|generator|scaffold)(?:[./_-]|$)/u.test(fileName);
@@ -215454,11 +215456,11 @@ function classifyValidationSourceScope(relativePath) {
     category = "generated";
   } else if (isE2e) {
     category = "e2e";
-  } else if (isTestFile || hasPathSegment(normalized, /^(?:test|tests|__tests__|spec|specs|__mocks__|cypress|cypress-tests)$/u)) {
+  } else if (isTestFile || isMavenIntegrationTestModule || hasPathSegment(normalized, /^(?:test|tests|__tests__|spec|specs|__mocks__|cypress|cypress-tests)$/u)) {
     category = "test";
   } else if (isTestPlugin) {
     category = "test-plugin";
-  } else if (isExamplePlugin) {
+  } else if (isExamplePlugin || isMavenExampleModule) {
     category = "example-plugin";
   } else if (isFixture) {
     category = "fixture";
@@ -215970,6 +215972,41 @@ async function buildExplicitStandaloneModulePathMap(workspaceRoot, architectureC
 function isTestSourcePath(relativePath) {
   return classifyValidationSourceScope(relativePath).isTestLike;
 }
+function hasStandardTestSourceRoot(relativePath) {
+  const normalized = normalizePath4(relativePath);
+  return /(?:^|\/)src\/(?:test|it|integration-test|integration-tests)\//u.test(normalized) || /(?:^|\/)(?:test|tests|__tests__|spec|specs|e2e|cypress)\//u.test(normalized) || /\.(?:spec|test|e2e-spec|integration-test)\.(?:ts|tsx|js|jsx|mjs|cjs|java|cs|py|php|go)$/u.test(
+    normalized.split("/").at(-1) ?? normalized
+  );
+}
+function shouldSkipDependencySource(relativePath, moduleRoot, workspaceRoot, includeTestFiles, includeConfiguredNonProductionModuleSources) {
+  if (includeTestFiles) {
+    return false;
+  }
+  const moduleRootRelativePath = normalizePath4(path7.relative(workspaceRoot, moduleRoot));
+  const moduleRootScope = classifyValidationSourceScope(moduleRootRelativePath);
+  if (hasStandardTestSourceRoot(relativePath)) {
+    return !includeConfiguredNonProductionModuleSources || moduleRootScope.isProduction || moduleRootScope.isTestLike;
+  }
+  if (!isTestSourcePath(relativePath)) {
+    return false;
+  }
+  return !includeConfiguredNonProductionModuleSources || !moduleRootScope.isTestLike;
+}
+function filterImportsForBoundaryChecks(imports, moduleRoots, workspaceRoot) {
+  return imports.filter((dependencyImport) => {
+    const moduleRoot = moduleRoots.get(dependencyImport.sourceModule);
+    if (!moduleRoot) {
+      return true;
+    }
+    return !shouldSkipDependencySource(
+      dependencyImport.sourceFileRelativePath,
+      moduleRoot,
+      workspaceRoot,
+      false,
+      false
+    );
+  });
+}
 async function collectSourceFiles(directoryPath, adapter, scanRootPath = directoryPath, excludedDirectoryRoots = []) {
   const entries = await import_node_fs6.promises.readdir(directoryPath, { withFileTypes: true });
   entries.sort((left, right) => left.name.localeCompare(right.name));
@@ -216197,7 +216234,7 @@ function extractJavaPackageName(sourceText) {
   const match = /^\s*package\s+([a-zA-Z_][\w.]*)\s*;/mu.exec(sourceText);
   return match?.[1];
 }
-async function buildJavaImportIndex(workspaceRoot, moduleRoots, adapter) {
+async function buildJavaImportIndex(workspaceRoot, moduleRoots, adapter, options) {
   const classes = /* @__PURE__ */ new Map();
   const packageCandidates = /* @__PURE__ */ new Map();
   for (const [moduleId, moduleRoot] of [...moduleRoots.entries()].sort(
@@ -216207,7 +216244,13 @@ async function buildJavaImportIndex(workspaceRoot, moduleRoots, adapter) {
     const sourceFiles = await collectSourceFiles(moduleRoot, adapter, moduleRoot, childModuleRoots);
     for (const sourceFilePath of sourceFiles) {
       const relativePath = normalizePath4(path7.relative(workspaceRoot, sourceFilePath));
-      if (isTestSourcePath(relativePath)) {
+      if (shouldSkipDependencySource(
+        relativePath,
+        moduleRoot,
+        workspaceRoot,
+        false,
+        options?.includeConfiguredNonProductionModuleSources === true
+      )) {
         continue;
       }
       const sourceText = await readTextFileIfExists2(sourceFilePath);
@@ -216850,10 +216893,13 @@ async function resolveCrossModuleImport(workspaceRoot, modulesRootRelativePath,
 async function collectCrossModuleImports(workspaceRoot, modulesRootRelativePath, moduleRoots, explicitStandaloneModuleByPath, workspacePackageAliases, adapter, options) {
   const imports = [];
   const includeTestFiles = options?.includeTestFiles === true;
+  const includeConfiguredNonProductionModuleSources = options?.includeConfiguredNonProductionModuleSources === true;
   if (!supportsDependencyImportParsing(adapter)) {
     return imports;
   }
-  const javaImportIndex = usesJavaImportParser(adapter) ? await buildJavaImportIndex(workspaceRoot, moduleRoots, adapter) : void 0;
+  const javaImportIndex = usesJavaImportParser(adapter) ? await buildJavaImportIndex(workspaceRoot, moduleRoots, adapter, {
+    includeConfiguredNonProductionModuleSources
+  }) : void 0;
   for (const [moduleName, moduleRoot] of [...moduleRoots.entries()].sort(
     ([left], [right]) => left.localeCompare(right)
   )) {
@@ -216868,7 +216914,13 @@ async function collectCrossModuleImports(workspaceRoot, modulesRootRelativePath,
       const sourceFileRelativePath = normalizePath4(
         path7.relative(workspaceRoot, sourceFilePath)
       );
-      if (!includeTestFiles && isTestSourcePath(sourceFileRelativePath)) {
+      if (shouldSkipDependencySource(
+        sourceFileRelativePath,
+        moduleRoot,
+        workspaceRoot,
+        includeTestFiles,
+        includeConfiguredNonProductionModuleSources
+      )) {
         continue;
       }
       const sourceText = await readTextFileIfExists2(sourceFilePath);
@@ -217418,7 +217470,10 @@ async function buildDependencyGraphSummary(workspaceRoot, architectureContract,
     explicitStandaloneModuleByPath,
     workspacePackageAliases,
     adapter,
-    { resolutionContext }
+    {
+      includeConfiguredNonProductionModuleSources: true,
+      resolutionContext
+    }
   );
   options?.onCollectedImports?.(imports);
   options?.onResolutionStats?.(resolutionContext.getStats());
@@ -217522,10 +217577,11 @@ async function validateDependencyContractBoundaries(workspaceRoot, architectureC
     workspacePackageAliases,
     adapter
   );
+  const boundaryImports = filterImportsForBoundaryChecks(imports, moduleRoots, workspaceRoot);
   const dependencyContextResolver = createArchitectureDependencyContextResolver(
     architectureContract
   );
-  const peerImports = filterPeerModuleImports(imports);
+  const peerImports = filterPeerModuleImports(boundaryImports);
   const moduleScopedPeerImports = peerImports.filter(
     (dependencyImport) => isModuleScopedDependencyImport(
       architectureContract,
@@ -217836,7 +217892,8 @@ async function validateDependencyContractBoundaries(workspaceRoot, architectureC
         workspaceRoot,
         canonicalModuleRoots
       ),
-      adapter
+      adapter,
+      { includeConfiguredNonProductionModuleSources: true }
     );
     const canonicalPeerImports = filterPeerModuleImports(canonicalImports).filter(
       (dependencyImport) => isModuleScopedDependencyImport(architectureContract, dependencyImport)
@@ -217934,8 +217991,9 @@ async function validateDependencyBoundaries(workspaceRoot, options) {
     workspacePackageAliases,
     adapter
   );
+  const boundaryImports = filterImportsForBoundaryChecks(imports, moduleRoots, workspaceRoot);
   const dependencyContextResolver = parsedArchitectureContract ? createArchitectureDependencyContextResolver(parsedArchitectureContract) : void 0;
-  const peerImports = filterPeerModuleImports(imports);
+  const peerImports = filterPeerModuleImports(boundaryImports);
   const moduleScopedPeerImports = peerImports.filter(
     (dependencyImport) => isModuleScopedDependencyImport(
       parsedArchitectureContract,
@@ -218191,7 +218249,8 @@ async function buildModuleDependencyGraphSnapshot(workspaceRoot, options) {
     moduleRoots,
     explicitStandaloneModuleByPath,
     workspacePackageAliases,
-    adapter
+    adapter,
+    { includeConfiguredNonProductionModuleSources: true }
   );
   const imports = filterPeerModuleImports(allImports).filter(
     (dependencyImport) => moduleSet.has(dependencyImport.sourceModule) && moduleSet.has(dependencyImport.targetModule)
@@ -222217,7 +222276,7 @@ async function validateModuleContractIntegrity(workspaceRoot, contract, options)
           "AP-ARCH-005",
           "error",
           true,
-          "No modules are registered in architecture.json. Module registry path checks are not applicable."
+          "No explicit root modules are registered in architecture.json. Root module registry path checks are not applicable; component-backed contracts are validated by dependency checks."
         )
       });
     }
@@ -222227,7 +222286,7 @@ async function validateModuleContractIntegrity(workspaceRoot, contract, options)
           "AP-ARCH-006",
           "error",
           true,
-          "No modules are registered in architecture.json. Module contract file checks are not applicable."
+          "No explicit root modules are registered in architecture.json. Root module contract file checks are not applicable; component-backed contracts are validated by dependency checks."
         )
       });
     }
@@ -222237,7 +222296,7 @@ async function validateModuleContractIntegrity(workspaceRoot, contract, options)
           "AP-ARCH-007",
           "error",
           true,
-          "No modules are registered in architecture.json. Module contract identity checks are not applicable."
+          "No explicit root modules are registered in architecture.json. Root module contract identity checks are not applicable; component-backed contracts are validated by dependency checks."
         )
       });
     }
@@ -222247,7 +222306,7 @@ async function validateModuleContractIntegrity(workspaceRoot, contract, options)
           "AP-ARCH-008",
           "error",
           true,
-          "No modules are registered in architecture.json. Module public entrypoint alignment checks are not applicable."
+          "No explicit root modules are registered in architecture.json. Root module public entrypoint alignment checks are not applicable; component-backed contracts are validated by dependency checks."
         )
       });
     }
@@ -223196,7 +223255,7 @@ async function loadRemotePolicyWithStatus(policySourceUrl, options) {
     "info",
     `Remote policy configured. Loading policy from ${policySourceUrl}.`
   );
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const request3 = https.request(
       {
         protocol: validated.url.protocol,
@@ -223223,7 +223282,7 @@ async function loadRemotePolicyWithStatus(policySourceUrl, options) {
               "warn",
               `Remote policy request failed with HTTP ${statusCode}. Using local policy only.`
             );
-            resolve9({
+            resolve10({
               message: `Remote policy request failed with HTTP ${statusCode}. Using local policy only.`
             });
             return;
@@ -223237,7 +223296,7 @@ async function loadRemotePolicyWithStatus(policySourceUrl, options) {
               "warn",
               "Remote policy payload is invalid JSON. Using local policy only."
             );
-            resolve9({
+            resolve10({
               message: "Remote policy payload is invalid JSON. Using local policy only."
             });
             return;
@@ -223249,7 +223308,7 @@ async function loadRemotePolicyWithStatus(policySourceUrl, options) {
               "warn",
               "Remote policy payload has an invalid structure. Using local policy only."
             );
-            resolve9({
+            resolve10({
               message: "Remote policy payload has an invalid structure. Using local policy only."
             });
             return;
@@ -223259,7 +223318,7 @@ async function loadRemotePolicyWithStatus(policySourceUrl, options) {
             "info",
             "Remote policy loaded successfully."
           );
-          resolve9({
+          resolve10({
             policy: normalized,
             message: "Remote policy loaded successfully."
           });
@@ -223275,7 +223334,7 @@ async function loadRemotePolicyWithStatus(policySourceUrl, options) {
         "warn",
         "Remote policy unavailable. Using local policy only."
       );
-      resolve9({
+      resolve10({
         message: "Remote policy unavailable. Using local policy only."
       });
     });
@@ -225601,6 +225660,15 @@ function hasPaginationEvidence(statement) {
     statement
   );
 }
+function hasEqualityPredicate(statement, columnPattern) {
+  return new RegExp(
+    `\\bwhere\\b[\\s\\S]*\\b(?:${columnPattern})\\b\\s*=\\s*(?:[\\w$:@?]+|'[^']+'|"[^"]+"|\\d+)`,
+    "iu"
+  ).test(statement);
+}
+function isCatalogIdentifierPointLookup(statement) {
+  return /\bfrom\s+information_schema\.schemata\b/iu.test(statement) && hasEqualityPredicate(statement, "schema_name");
+}
 function isObviousPointLookup(statement) {
   const normalized = statement.toLowerCase();
   if (!normalized.includes("where")) {
@@ -225609,7 +225677,7 @@ function isObviousPointLookup(statement) {
   if (normalized.includes(" or ")) {
     return false;
   }
-  return /\bwhere\b[\s\S]*\b([a-z_]*id)\b\s*=\s*([\w$:@?]+|'[^']+'|\d+)/i.test(normalized);
+  return hasEqualityPredicate(normalized, "id|uuid|slug|email|identifier") || isCatalogIdentifierPointLookup(normalized);
 }
 function listModulePathEntries(contract) {
   return Object.entries(contract.modules ?? {}).map(([moduleName, reference]) => {
@@ -226190,13 +226258,14 @@ function detectRepeatedQueryPattern(method) {
 }
 function extractSqlQueryLiterals(content) {
   const queries = [];
+  const searchableContent = maskSourceComments(content);
   const patterns = [
     /(?:\b(?:[\w$]+\.)?(?:query|execute|executeQuery|createNativeQuery|createQuery|FromSqlRaw|FromSqlInterpolated|Query|QueryContext|QueryRow|QueryRowContext|Exec|ExecContext|Raw|text)|\$queryRaw|\$executeRaw)\s*\([^'"`)]{0,180}?(['"`])([\s\S]{0,900}?)\1/giu,
     /\b(?:DB::select|DB::statement|DB::raw|DB::table)\s*\([^'"`)]{0,180}?(['"`])([\s\S]{0,900}?)\1/gu,
     /@Query\s*\(\s*(['"`])([\s\S]{0,900}?)\1/gu
   ];
   for (const pattern of patterns) {
-    for (const match of content.matchAll(pattern)) {
+    for (const match of searchableContent.matchAll(pattern)) {
       const sql = match[2];
       if (!sql || !/\b(?:select|update|delete|insert)\b/iu.test(sql)) {
         continue;
@@ -226209,6 +226278,71 @@ function extractSqlQueryLiterals(content) {
   }
   return queries;
 }
+function maskSourceComments(content) {
+  let masked = "";
+  let index = 0;
+  let state = "code";
+  let escaped = false;
+  while (index < content.length) {
+    const current = content[index] ?? "";
+    const next = content[index + 1] ?? "";
+    if (state === "line-comment") {
+      if (current === "\r" || current === "\n") {
+        masked += current;
+        state = "code";
+      } else {
+        masked += " ";
+      }
+      index += 1;
+      continue;
+    }
+    if (state === "block-comment") {
+      if (current === "*" && next === "/") {
+        masked += "  ";
+        index += 2;
+        state = "code";
+        continue;
+      }
+      masked += current === "\r" || current === "\n" ? current : " ";
+      index += 1;
+      continue;
+    }
+    if (state === "single" || state === "double" || state === "template") {
+      masked += current;
+      if (escaped) {
+        escaped = false;
+      } else if (current === "\\") {
+        escaped = true;
+      } else if (state === "single" && current === "'" || state === "double" && current === '"' || state === "template" && current === "`") {
+        state = "code";
+      }
+      index += 1;
+      continue;
+    }
+    if (current === "/" && next === "/") {
+      masked += "  ";
+      index += 2;
+      state = "line-comment";
+      continue;
+    }
+    if (current === "/" && next === "*") {
+      masked += "  ";
+      index += 2;
+      state = "block-comment";
+      continue;
+    }
+    if (current === "'") {
+      state = "single";
+    } else if (current === '"') {
+      state = "double";
+    } else if (current === "`") {
+      state = "template";
+    }
+    masked += current;
+    index += 1;
+  }
+  return masked;
+}
 function detectCodeSqlQueryShapeFindings(file, config) {
   const findings = [];
   for (const query of extractSqlQueryLiterals(file.content)) {
@@ -226298,12 +226432,18 @@ function hasAssignedBuilderBoundedTerminal(methodBody, snippet) {
   }
   return new RegExp(`\\b${variableName}\\s*\\.\\s*(?:getOne|getRawOne|loadOne|getCount|getExists)\\s*\\(`, "iu").test(methodBody);
 }
+function hasIdentifierPredicateEvidence(snippet) {
+  return /\.(?:where|andWhere|orWhere)\s*\(\s*['"`][^'"`]{0,240}\b(?:\w*id|uuid|slug|email|identifier)\b[^'"`]{0,120}(?:=| in\b|IN\b)/iu.test(snippet) || /\bwhere\s*:\s*\{[\s\S]{0,420}\b(?:id|uuid|slug|email|identifier|channelId|orderId|customerId|userId|productId|variantId)\b\s*[:=]/iu.test(snippet);
+}
+function hasQueryBuilderTerminalEvidence(snippet, methodBody) {
+  return /\.(?:getMany|getRawMany|loadMany|getOne|getRawOne|loadOne|getCount|getExists|execute)\s*\(/iu.test(snippet) || hasAssignedBuilderBoundedTerminal(methodBody, snippet);
+}
 function isNonCollectionOrmRead(label, snippet, methodBody = snippet) {
   const terminal = getOrmTerminalOperation(snippet);
   return /\b(?:findOne|findOneOrFail|findOneBy|findOneByOrFail|findUnique|findFirst|count|exists|aggregate)\b/iu.test(label) || !!terminal && /^(?:getOne|getRawOne|loadOne|getCount|getExists|findOne|findOneOrFail|findOneBy|findOneByOrFail|findUnique|findFirst|count|exists|update|delete|remove|save|insert|execute)$/iu.test(terminal) || isScopedRelationLoad(snippet) || hasAssignedBuilderBoundedTerminal(methodBody, snippet);
 }
 function hasOrmBoundEvidence(snippet) {
-  return codePaginationEvidencePattern.test(snippet) || /\.(?:take|limit|offset|skip)\s*\(/iu.test(snippet) || /\b(?:maxResults|setMaxResults|firstResult|setFirstResult)\s*\(/iu.test(snippet) || /\b(?:pageSize|perPage|limit|take)\s*[:=]\s*\d+\b/iu.test(snippet);
+  return codePaginationEvidencePattern.test(snippet) || /\.(?:take|limit|offset|skip)\s*\(/iu.test(snippet) || /\b(?:maxResults|setMaxResults|firstResult|setFirstResult)\s*\(/iu.test(snippet) || /\b(?:pageSize|perPage|limit|take)\s*[:=]\s*\d+\b/iu.test(snippet) || hasIdentifierPredicateEvidence(snippet);
 }
 function getOrmQueryTarget(method, label, snippet) {
   const terminal = getOrmTerminalOperation(snippet);
@@ -226326,6 +226466,9 @@ function getOrmQueryLabel(method, label, snippet) {
 function detectOrmQueryShapeFindings(method, config) {
   const findings = [];
   for (const evidence of collectOrmReadEvidence(method)) {
+    if (evidence.label === "node.query" && !hasQueryBuilderTerminalEvidence(evidence.snippet, method.body)) {
+      continue;
+    }
     if (config.tenantModel === "same_db_same_schema" && !tenantPredicatePattern.test(evidence.snippet)) {
       findings.push(createCodeFinding({
         id: "AP-DQR-001",
@@ -227034,7 +227177,7 @@ function detectControllerBusinessLogic(entry, classification, moduleName, contex
   });
 }
 function detectRepositoryBusinessLogic(entry, classification, moduleName) {
-  if (!classification.isRepository) {
+  if (!classification.isRepository || !isProductionBackendGovernanceScope(classification.scope)) {
     return void 0;
   }
   if (entry.extension === ".java" && isPureSpringDataRepositoryInterface(entry.content)) {
@@ -227362,7 +227505,7 @@ var publicEvidencePattern = /@Public\b|@PermitAll\b|\[AllowAnonymous\b[^\]]*\]|p
 var roleEvidencePattern = /@(?:Roles|Permissions|RequirePermission|PreAuthorize|Secured|RolesAllowed)\s*(?:\(|\b)([^)\n]*)|\[Authorize\s*\([^)\]]*(?:Roles|Policy)\s*=|(?:requireRole\w*|RequireRole\w*|require_role|RoleChecker|adminMiddleware|can:|permission:|scopes?\s*=|Security\s*\([^)]*scopes)\b/u;
 var tenantSignalPattern = /\b(?:tenantId|tenant_id|organizationId|organization_id|orgId|org_id|workspaceId|workspace_id|accountId|account_id|companyId|company_id|customerId|customer_id|TenantContext|CurrentTenant|TenantResolver|TenantProvider|request\.tenant|req\.tenant|user\.tenantId|user\.tenant_id|user\.organizationId|user\.organization_id|user\.orgId|user\.accountId|user\.workspaceId|user\.companyId|user\.customerId|HibernateFilter|CurrentTenant)\b/u;
 var tenantPredicateEvidencePattern = /\b(?:tenantId|tenant_id|organizationId|organization_id|orgId|org_id|workspaceId|workspace_id|accountId|account_id|companyId|company_id|customerId|customer_id|TenantContext|CurrentTenant|TenantResolver|TenantProvider|request\.tenant|req\.tenant|user\.tenantId|user\.tenant_id|user\.organizationId|user\.organization_id|user\.orgId|user\.accountId|user\.workspaceId|user\.companyId|user\.customerId|HibernateFilter|CurrentTenant)\b/u;
-var repositoryRolePattern = /\b(?:role|roles|permission|permissions|isAdmin|hasRole|hasPermission|SecurityContextHolder|Authentication|Principal)\b/u;
+var executableAuthorizationDecisionPattern = /@(?:PreAuthorize|PostAuthorize|Secured|RolesAllowed)\b|\[(?:Authorize)\b[^\]]*(?:Roles|Policy)\s*=|\b(?:hasRole|hasAuthority|hasPermission|isUserInRole|checkPermission|requireRole\w*|RequireRole\w*|require_role|canActivate|authorize|assertAuthorized|PermissionChecker|AccessDecisionManager|SecurityContextHolder\.getContext\(\)\.getAuthentication)\s*\(|\b(?:user|principal|currentUser|account)\.(?:role|roles|permission|permissions|isAdmin)\b\s*(?:[=!]==?|\.includes\s*\(|\.contains\s*\()/u;
 function normalizePath12(value) {
   return value.replace(/\\/g, "/");
 }
@@ -227790,7 +227933,7 @@ function detectAuthorizationFindings(files, contract, astCache) {
     }
   }
   for (const file of files.filter((candidate) => isRepositoryFile(candidate, astCache))) {
-    const roleMatch = repositoryRolePattern.exec(file.content);
+    const roleMatch = executableAuthorizationDecisionPattern.exec(file.content);
     if (!roleMatch) {
       continue;
     }
@@ -230589,8 +230732,9 @@ function extractJavaSignals(file) {
       publishes: []
     });
   }
-  for (const match of file.content.matchAll(/(?:await\s+)?(?:\w+\.)?(?:publishEvent|publish|emit)\s*\(\s*(?:new\s+)?(["']?)([A-Za-z][\w.]*Event?|[a-z][\w.]+)\1/gu)) {
-    const eventName = match[2];
+  for (const match of file.content.matchAll(/(?:await\s+)?(?:\w+\.)?(?:publishEvent|publish|emit)\s*\(\s*(?:(new)\s+([A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*)\s*\(|(["'])([A-Za-z][\w.]*Event?|[a-z][\w.]+)\3|([A-Z][A-Za-z0-9_]*Event)\b)/gu)) {
+    const constructedType = match[2]?.split(".").at(-1);
+    const eventName = constructedType ?? match[4] ?? match[5];
     if (!eventName) {
       continue;
     }
@@ -234446,7 +234590,7 @@ ${infoLines.join("\n")}
 ## Passed Checks
 ${passedLines.join("\n")}
 
-## Module Dependency Summary
+## Module / Component Contract Dependency Summary
 ${dependencyGraphLines.join("\n")}
 
 ## Disabled Rules
@@ -236682,7 +236826,7 @@ ${appliedFixesSection}
 ## Remaining Violations
 ${remainingViolationsLine}
 
-## Module Dependency Summary
+## Module / Component Contract Dependency Summary
 ${moduleCatalog.length === 0 ? "- Module details are not available in this run." : moduleCatalog.map(
     (entry) => `- ${entry.moduleName} | Role: ${entry.role} | Path: ${entry.path ?? "(not configured)"} | Contract: ${entry.hasContract ? "yes" : "no"} | Declared deps: ${entry.declaredDependencyCount} | Actual deps: ${entry.actualDependencyCount} | Used by: ${entry.inboundDependencyCount}`
   ).join("\n")}
@@ -238934,11 +239078,11 @@ function normalizeAnnotationPath(workspaceRoot, sourceFile) {
   if (!path43.isAbsolute(sourceFile)) {
     return normalized;
   }
-  const relative17 = path43.relative(workspaceRoot, sourceFile).replace(/\\/g, "/");
-  if (relative17.startsWith("..") || path43.isAbsolute(relative17)) {
+  const relative18 = path43.relative(workspaceRoot, sourceFile).replace(/\\/g, "/");
+  if (relative18.startsWith("..") || path43.isAbsolute(relative18)) {
     return void 0;
   }
-  return relative17;
+  return relative18;
 }
 function toAnnotatableFinding(workspaceRoot, finding) {
   if (typeof finding.id !== "string" || !finding.id.startsWith("AP-DEP-")) {
@@ -239122,7 +239266,7 @@ async function emitGithubInlineArchitectureAnnotations(workspaceRoot) {
 var reviewCommentMarker = "<!-- archpilot-pr-review -->";
 var legacyReviewCommentMarker = "<!-- ARCHPILOT_REVIEW_COMMENT -->";
 function requestGithubApi(options) {
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     const payload = options.body !== void 0 ? JSON.stringify(options.body) : void 0;
     const request3 = https2.request(
       {
@@ -239143,7 +239287,7 @@ function requestGithubApi(options) {
           chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
         });
         response.on("end", () => {
-          resolve9({
+          resolve10({
             statusCode: response.statusCode ?? 0,
             body: Buffer.concat(chunks).toString("utf8")
           });
@@ -245420,6 +245564,9 @@ function addEvidence6(evidence, value) {
     evidence.push(value);
   }
 }
+function hasDeclaredMavenReactorEvidence(candidate) {
+  return candidate.evidence.some((entry) => /Declared (?:by )?Maven|nested Maven reactor/iu.test(entry));
+}
 function isIgnoredComponentCandidatePath(componentPath) {
   const normalized = normalizePath25(componentPath).replace(/^\.\//u, "");
   if (normalized === "." || normalized.length === 0) {
@@ -245459,7 +245606,9 @@ function isIgnoredComponentCandidatePath(componentPath) {
     "build",
     "coverage"
   ];
-  return ignoredRootSegments.includes(firstSegment ?? "") || segments.some((segment) => ignoredSupportingSegments.includes(segment.toLowerCase()));
+  const isExampleContainer = firstSegment === "examples" || firstSegment === "example";
+  const isIgnoredRootSegment = ignoredRootSegments.includes(firstSegment ?? "") && (!isExampleContainer || segments.length === 1);
+  return isIgnoredRootSegment || segments.some((segment) => ignoredSupportingSegments.includes(segment.toLowerCase()));
 }
 function pathExists19(pathValue) {
   try {
@@ -245523,6 +245672,9 @@ function readFirstXmlTag(value, tagName) {
   const match = value.match(new RegExp(`<${tagName}(?:\\s[^>]*)?>([\\s\\S]*?)</${tagName}>`, "iu"));
   return match?.[1]?.trim().replace(/\s+/gu, " ");
 }
+function readXmlTagValues(value, tagName) {
+  return [...value.matchAll(new RegExp(`<${tagName}(?:\\s[^>]*)?>([\\s\\S]*?)</${tagName}>`, "giu"))].map((match) => match[1]?.trim().replace(/\s+/gu, " ") ?? "").filter((entry) => entry.length > 0);
+}
 function readMavenMetadata(workspaceRoot, componentPath) {
   if (isUnderJvmResourceRoot4(componentPath)) {
     return void 0;
@@ -245560,6 +245712,95 @@ function readMavenMetadata(workspaceRoot, componentPath) {
     hasTestResources: pathExists19(path64.join(absoluteRoot, "src", "test", "resources"))
   };
 }
+function workspaceRelativePath(workspaceRoot, absolutePathValue) {
+  const relative18 = path64.relative(workspaceRoot, absolutePathValue);
+  if (relative18.length === 0) {
+    return ".";
+  }
+  if (relative18.startsWith("..") || path64.isAbsolute(relative18)) {
+    return void 0;
+  }
+  return normalizePath25(relative18);
+}
+function canonicalRealPath(filePath) {
+  try {
+    return fs58.realpathSync.native(filePath);
+  } catch {
+    return void 0;
+  }
+}
+function readMavenDeclaredModules(pomPath) {
+  const pomXml = readTextFileSafe(pomPath);
+  if (!pomXml) {
+    return [];
+  }
+  return uniqueSorted4(
+    readXmlTagValues(stripXmlComments(pomXml), "module").filter((modulePath) => !/[${}]/u.test(modulePath))
+  );
+}
+function collectMavenReactorCandidates(workspaceRoot, rootPaths) {
+  const candidates = /* @__PURE__ */ new Map();
+  const visitedPomPaths = /* @__PURE__ */ new Set();
+  const workspaceRealPath = canonicalRealPath(workspaceRoot) ?? path64.resolve(workspaceRoot);
+  const workspaceRealPathForCompare = process.platform === "win32" ? workspaceRealPath.toLowerCase() : workspaceRealPath;
+  const maxVisitedPoms = 500;
+  const addCandidate = (candidatePath, evidence, parentPath) => {
+    const normalized = normalizePath25(candidatePath);
+    const existing = candidates.get(normalized) ?? { path: normalized, evidence: [] };
+    addEvidence6(existing.evidence, evidence);
+    if (parentPath && !existing.parentPath) {
+      existing.parentPath = parentPath;
+    }
+    candidates.set(normalized, existing);
+  };
+  const visitPom = (pomPath, parentPath) => {
+    if (visitedPomPaths.size >= maxVisitedPoms) {
+      return;
+    }
+    const realPomPath = canonicalRealPath(pomPath);
+    if (!realPomPath || visitedPomPaths.has(realPomPath)) {
+      return;
+    }
+    const realPomPathForCompare = process.platform === "win32" ? realPomPath.toLowerCase() : realPomPath;
+    if (realPomPathForCompare !== workspaceRealPathForCompare && !realPomPathForCompare.startsWith(`${workspaceRealPathForCompare}${path64.sep}`)) {
+      return;
+    }
+    visitedPomPaths.add(realPomPath);
+    const pomDirectory = path64.dirname(pomPath);
+    const relativePomDirectory = workspaceRelativePath(workspaceRoot, pomDirectory);
+    if (!relativePomDirectory) {
+      return;
+    }
+    addCandidate(
+      relativePomDirectory,
+      parentPath ? `Declared by Maven reactor parent ${parentPath}` : "Detected Maven reactor root",
+      parentPath
+    );
+    for (const declaredModule of readMavenDeclaredModules(pomPath)) {
+      const childDirectory = path64.resolve(pomDirectory, declaredModule);
+      const childRelativePath = workspaceRelativePath(workspaceRoot, childDirectory);
+      if (!childRelativePath || isUnderJvmResourceRoot4(childRelativePath)) {
+        continue;
+      }
+      const childPom = path64.join(childDirectory, "pom.xml");
+      if (!pathExists19(childPom)) {
+        addCandidate(childRelativePath, `Declared Maven module '${declaredModule}' is missing pom.xml`, relativePomDirectory);
+        continue;
+      }
+      addCandidate(childRelativePath, `Declared Maven module '${declaredModule}' from ${relativePomDirectory}`, relativePomDirectory);
+      visitPom(childPom, relativePomDirectory);
+    }
+  };
+  for (const rootPath of uniqueSorted4(rootPaths)) {
+    const normalizedRoot = normalizePath25(rootPath);
+    const absoluteRoot = normalizedRoot === "." ? workspaceRoot : path64.join(workspaceRoot, ...normalizedRoot.split("/"));
+    const pomPath = path64.join(absoluteRoot, "pom.xml");
+    if (pathExists19(pomPath)) {
+      visitPom(pomPath);
+    }
+  }
+  return [...candidates.values()].sort((left, right) => left.path.localeCompare(right.path));
+}
 function toComponentRoot(modulePath) {
   const normalized = normalizePath25(modulePath);
   const segments = normalized.split("/").filter((segment) => segment.length > 0);
@@ -245594,6 +245835,18 @@ function buildRootCandidates(input2) {
   for (const root of input2.topology.detectedRoots ?? []) {
     addCandidate(root, `Detected project root ${root}`);
   }
+  if (input2.workspaceRoot) {
+    const mavenRoots = [".", ...input2.topology.detectedRoots ?? []];
+    for (const candidate of collectMavenReactorCandidates(input2.workspaceRoot, mavenRoots)) {
+      addCandidate(
+        candidate.path,
+        candidate.parentPath ? `Detected nested Maven reactor module under ${candidate.parentPath}` : "Detected Maven reactor module"
+      );
+      for (const evidence of candidate.evidence) {
+        addCandidate(candidate.path, evidence);
+      }
+    }
+  }
   for (const moduleEntry of input2.modules?.modules ?? []) {
     const componentRoot = toComponentRoot(moduleEntry.path);
     if (componentRoot) {
@@ -246102,6 +246355,9 @@ function classifyGovernanceRole(input2) {
   const hasMavenDistributionPackagingEvidence = Boolean(
     maven?.packaging === "pom" && !hasMavenMainSource && hasAnyToken(pathText, [/(^|\/)(distribution|dist|downloads|assembl(y|ies)|feature-packs?)(\/|$)/u])
   );
+  const hasMavenStarterPackagingEvidence = Boolean(
+    maven && !hasMavenMainJvmSourceEvidence && hasAnyToken(`${pathText} ${mavenMetadataText}`, [/\bstarters?\b|\bspring-boot-starter\b|\bstarter[-\s]/u])
+  );
   if (input2.candidate.architectureRoot?.classification === "backend_app" || input2.candidate.architectureRoot?.classification === "frontend_app") {
     runtimeScore += 3;
     addEvidence6(evidence, `Runtime architecture root signal: ${input2.candidate.architectureRoot.classification}`);
@@ -246211,6 +246467,10 @@ function classifyGovernanceRole(input2) {
     supportScore += 1;
     addEvidence6(evidence, "Maven POM-only aggregator/packaging module");
   }
+  if (hasMavenStarterPackagingEvidence) {
+    supportScore += 4;
+    addEvidence6(evidence, "Maven starter/resource artifact without JVM runtime source");
+  }
   if (isPlainResourcesSurface) {
     supportScore += 4;
     addEvidence6(evidence, "Resources-only surface without runtime source or manifest evidence");
@@ -246222,6 +246482,13 @@ function classifyGovernanceRole(input2) {
       selectedByDefault: false
     };
   }
+  if (hasMavenStarterPackagingEvidence && !hasMavenMainJvmSourceEvidence) {
+    return {
+      governanceRole: "support",
+      governanceEvidence: uniqueSorted4(evidence),
+      selectedByDefault: false
+    };
+  }
   if (hasMavenDistributionPackagingEvidence && hasAnyToken(mavenMetadataText, [/\b(docs?|documentation|metadata tests?|licenses?|maven plugins?|builds?)\b/u])) {
     supportScore += 3;
     addEvidence6(evidence, "Maven documentation/build/distribution packaging evidence without runtime source");
@@ -246281,7 +246548,7 @@ function detectComponents(input2) {
   const manifestBackedRoots = new Set(
     (input2.topology.detectedRoots ?? []).filter((root) => !isUnderJvmResourceRoot4(root))
   );
-  const rootCandidates = buildRootCandidates(input2).filter((candidate) => !ignoreMatcher.isIgnored(candidate.path)).filter((candidate) => !isIgnoredComponentCandidatePath(candidate.path)).filter((candidate) => !(isUnderJvmResourceRoot4(candidate.path) && !hasRuntimeSourceFiles(input2.workspaceRoot, candidate.path))).filter((candidate) => {
+  const rootCandidates = buildRootCandidates({ ...input2, workspaceRoot: input2.workspaceRoot }).filter((candidate) => !ignoreMatcher.isIgnored(candidate.path) || hasDeclaredMavenReactorEvidence(candidate)).filter((candidate) => !isIgnoredComponentCandidatePath(candidate.path)).filter((candidate) => !(isUnderJvmResourceRoot4(candidate.path) && !hasRuntimeSourceFiles(input2.workspaceRoot, candidate.path))).filter((candidate) => {
     if (input2.topology.topology !== "monorepo" || manifestBackedRoots.size === 0) {
       return true;
     }
@@ -246579,7 +246846,7 @@ function isCliSupportCandidate(component, allComponents) {
 }
 function hasIndependentRuntimeEvidence(component) {
   const text = componentEvidenceText(component);
-  return component.governanceRole === "runtime" && (/Maven executable application evidence/iu.test(text) || /Maven deployable WAR artifact/iu.test(text) || /Published package surface signal/iu.test(text) && !/Path contains support\/tooling role tokens/iu.test(text));
+  return component.governanceRole === "runtime" && (/Maven executable application evidence/iu.test(text) || /Maven deployable WAR artifact/iu.test(text) || /Maven library main source\/resource surface/iu.test(text) || /Maven Spring Boot auto-configuration\/starter library evidence/iu.test(text) || /Published package surface signal/iu.test(text) && !/Path contains support\/tooling role tokens/iu.test(text));
 }
 function hasSupportRoleEvidence(component) {
   const text = componentEvidenceText(component);
@@ -246789,7 +247056,20 @@ function hasAttributableBackendRoot(detection) {
   return getBackendComponents(detection).length > 0;
 }
 function isGenericLibraryStack(stack) {
-  return stack === "node_typescript" || stack === "node_javascript" || stack === "python" || stack === "go" || stack === "kotlin" || stack === "terraform" || stack === "ansible";
+  return stack === "node_typescript" || stack === "node_javascript" || stack === "library_generic" || stack === "java" || stack === "spring" || stack === "python" || stack === "go" || stack === "kotlin" || stack === "kotlin_spring" || stack === "terraform" || stack === "ansible";
+}
+function preferredLibraryStack(stacks) {
+  const uniqueStacks = uniqueInOrder2(stacks);
+  if (uniqueStacks.length <= 1) {
+    return isJvmLibraryStack(uniqueStacks[0]) ? "library_generic" : uniqueStacks[0];
+  }
+  if (uniqueStacks.some(isJvmLibraryStack) && uniqueStacks.every((candidate) => isJvmLibraryStack(candidate) || candidate === "node_typescript" || candidate === "node_javascript")) {
+    return "library_generic";
+  }
+  return void 0;
+}
+function isJvmLibraryStack(stack) {
+  return stack === "java" || stack === "spring";
 }
 function hasProjectKindEvidence(detection, patterns) {
   const evidence = detection.projectKinds?.evidence ?? [];
@@ -247211,7 +247491,7 @@ function resolveStackSelections(detection, projectKinds) {
     const libraryComponentStacks = uniqueInOrder2(
       libraryComponents.map((component) => component.stack).filter((stack) => isGenericLibraryStack(stack))
     );
-    const selectedLibrary = detection.topology.topology === "monorepo" ? libraryComponentStacks.length === 1 ? libraryComponentStacks[0] : void 0 : detection.stacks.selectedAdapterId;
+    const selectedLibrary = detection.topology.topology === "monorepo" ? preferredLibraryStack(libraryComponentStacks) : detection.stacks.selectedAdapterId;
     if (isGenericLibraryStack(selectedLibrary)) {
       selections.library = selectedLibrary;
     }
@@ -247233,7 +247513,7 @@ function resolveProjectProfiles(detection, projectKinds, stackSelections, apiSty
       selectedAdapterId: stackId,
       selectedAdapterCategory: getStackAdapterById(stackId).category,
       projectKinds: [kind],
-      apiStyleHint: kind === "backend" && apiStyle ? apiStyle : resolveRoleApiStyleHint(detection, stackId, component),
+      apiStyleHint: kind === "backend" && apiStyle ? apiStyle : stackId === "library_generic" ? void 0 : resolveRoleApiStyleHint(detection, stackId, component),
       databaseHints: detection.toolingHints?.databaseHints,
       toolingHints: detection.toolingHints?.toolingHints,
       repoTopology: detection.topology.topology === "unknown" ? "single_project" : detection.topology.topology