@archpilotlabs/archpilot 0.2.3 → 0.2.5

package/dist/archpilot-cli.js

@@ -13660,11 +13660,11 @@ ${lanes.join("\n")}
           return toComponents;
         }
         const components = toComponents.slice(start);
-        const relative17 = [];
+        const relative18 = [];
         for (; start < fromComponents.length; start++) {
-          relative17.push("..");
+          relative18.push("..");
         }
-        return ["", ...relative17, ...components];
+        return ["", ...relative18, ...components];
       }
       function getRelativePathFromDirectory(fromDirectory, to, getCanonicalFileNameOrIgnoreCase) {
         Debug.assert(getRootLength(fromDirectory) > 0 === getRootLength(to) > 0, "Paths must either both be absolute or both be relative");
@@ -52233,11 +52233,11 @@ ${lanes.join("\n")}
             if (i < rootLength) {
               return void 0;
             }
-            const sep = directory.lastIndexOf(directorySeparator, i - 1);
-            if (sep === -1) {
+            const sep2 = directory.lastIndexOf(directorySeparator, i - 1);
+            if (sep2 === -1) {
               return void 0;
             }
-            return directory.substr(0, Math.max(sep, rootLength));
+            return directory.substr(0, Math.max(sep2, rootLength));
           }
         }
       }
@@ -58143,9 +58143,9 @@ ${lanes.join("\n")}
               if (!startsWithDirectory(target, realPathDirectory, getCanonicalFileName)) {
                 return;
               }
-              const relative17 = getRelativePathFromDirectory(realPathDirectory, target, getCanonicalFileName);
+              const relative18 = getRelativePathFromDirectory(realPathDirectory, target, getCanonicalFileName);
               for (const symlinkDirectory of symlinkDirectories) {
-                const option = resolvePath(symlinkDirectory, relative17);
+                const option = resolvePath(symlinkDirectory, relative18);
                 const result2 = cb(option, target === referenceRedirect);
                 shouldFilterIgnoredPaths = true;
                 if (result2) return result2;
@@ -127982,7 +127982,7 @@ ${lanes.join("\n")}
           }
         }
         function createImportCallExpressionAMD(arg, containsLexicalThis) {
-          const resolve9 = factory2.createUniqueName("resolve");
+          const resolve10 = factory2.createUniqueName("resolve");
           const reject = factory2.createUniqueName("reject");
           const parameters = [
             factory2.createParameterDeclaration(
@@ -127991,7 +127991,7 @@ ${lanes.join("\n")}
               /*dotDotDotToken*/
               void 0,
               /*name*/
-              resolve9
+              resolve10
             ),
             factory2.createParameterDeclaration(
               /*modifiers*/
@@ -128008,7 +128008,7 @@ ${lanes.join("\n")}
                 factory2.createIdentifier("require"),
                 /*typeArguments*/
                 void 0,
-                [factory2.createArrayLiteralExpression([arg || factory2.createOmittedExpression()]), resolve9, reject]
+                [factory2.createArrayLiteralExpression([arg || factory2.createOmittedExpression()]), resolve10, reject]
               )
             )
           ]);
@@ -214726,8 +214726,8 @@ Additional information: BADCLIENT: Bad error code, ${badCode} not found in range
         installPackage(options) {
           this.packageInstallId++;
           const request3 = { kind: "installPackage", ...options, id: this.packageInstallId };
-          const promise = new Promise((resolve9, reject) => {
-            (this.packageInstalledPromise ?? (this.packageInstalledPromise = /* @__PURE__ */ new Map())).set(this.packageInstallId, { resolve: resolve9, reject });
+          const promise = new Promise((resolve10, reject) => {
+            (this.packageInstalledPromise ?? (this.packageInstalledPromise = /* @__PURE__ */ new Map())).set(this.packageInstallId, { resolve: resolve10, reject });
           });
           this.installer.send(request3);
           return promise;
@@ -215444,6 +215444,8 @@ function classifyValidationSourceScope(relativePath) {
   const isFixture = hasPathSegment(normalized, /^(?:fixtures?|__fixtures__)$/u);
   const isTestPlugin = hasPathSegment(normalized, /^(?:test-plugins?|testing-plugins?)$/u);
   const isExamplePlugin = hasPathSegment(normalized, /^example-plugins?$/u) || hasTopLevelPathSegment(normalized, /^examples?$/u);
+  const isMavenIntegrationTestModule = hasTopLevelPathSegment(normalized, /^[a-z0-9_.-]+-integration-tests?$/u) || hasTopLevelPathSegment(normalized, /^[a-z0-9_.-]+-it$/u);
+  const isMavenExampleModule = hasTopLevelPathSegment(normalized, /^[a-z0-9_.-]+-examples?$/u);
   const isGenerated = hasPathSegment(normalized, /^(?:generated|__generated__|gen|templates?)$/u) || /\.(?:generated|gen|g)\.(?:ts|tsx|js|jsx|java|cs|py|php|go)$/u.test(fileName) || /\.d\.ts$/u.test(fileName);
   const isMigration = hasPathSegment(normalized, /^(?:migrations?|schema-migrations?|data-migrations|migration-utils?)$/u);
   const isCliTooling = hasPathSegment(normalized, /^(?:cli|bin|scripts?|tools?|scaffold|scaffolding|generators?)$/u) || /(?:^|[./_-])(?:cli|script|tool|generator|scaffold)(?:[./_-]|$)/u.test(fileName);
@@ -215454,11 +215456,11 @@ function classifyValidationSourceScope(relativePath) {
     category = "generated";
   } else if (isE2e) {
     category = "e2e";
-  } else if (isTestFile || hasPathSegment(normalized, /^(?:test|tests|__tests__|spec|specs|__mocks__|cypress|cypress-tests)$/u)) {
+  } else if (isTestFile || isMavenIntegrationTestModule || hasPathSegment(normalized, /^(?:test|tests|__tests__|spec|specs|__mocks__|cypress|cypress-tests)$/u)) {
     category = "test";
   } else if (isTestPlugin) {
     category = "test-plugin";
-  } else if (isExamplePlugin) {
+  } else if (isExamplePlugin || isMavenExampleModule) {
     category = "example-plugin";
   } else if (isFixture) {
     category = "fixture";
@@ -215970,6 +215972,41 @@ async function buildExplicitStandaloneModulePathMap(workspaceRoot, architectureC
 function isTestSourcePath(relativePath) {
   return classifyValidationSourceScope(relativePath).isTestLike;
 }
+function hasStandardTestSourceRoot(relativePath) {
+  const normalized = normalizePath4(relativePath);
+  return /(?:^|\/)src\/(?:test|it|integration-test|integration-tests)\//u.test(normalized) || /(?:^|\/)(?:test|tests|__tests__|spec|specs|e2e|cypress)\//u.test(normalized) || /\.(?:spec|test|e2e-spec|integration-test)\.(?:ts|tsx|js|jsx|mjs|cjs|java|cs|py|php|go)$/u.test(
+    normalized.split("/").at(-1) ?? normalized
+  );
+}
+function shouldSkipDependencySource(relativePath, moduleRoot, workspaceRoot, includeTestFiles, includeConfiguredNonProductionModuleSources) {
+  if (includeTestFiles) {
+    return false;
+  }
+  const moduleRootRelativePath = normalizePath4(path7.relative(workspaceRoot, moduleRoot));
+  const moduleRootScope = classifyValidationSourceScope(moduleRootRelativePath);
+  if (hasStandardTestSourceRoot(relativePath)) {
+    return !includeConfiguredNonProductionModuleSources || moduleRootScope.isProduction || moduleRootScope.isTestLike;
+  }
+  if (!isTestSourcePath(relativePath)) {
+    return false;
+  }
+  return !includeConfiguredNonProductionModuleSources || !moduleRootScope.isTestLike;
+}
+function filterImportsForBoundaryChecks(imports, moduleRoots, workspaceRoot) {
+  return imports.filter((dependencyImport) => {
+    const moduleRoot = moduleRoots.get(dependencyImport.sourceModule);
+    if (!moduleRoot) {
+      return true;
+    }
+    return !shouldSkipDependencySource(
+      dependencyImport.sourceFileRelativePath,
+      moduleRoot,
+      workspaceRoot,
+      false,
+      false
+    );
+  });
+}
 async function collectSourceFiles(directoryPath, adapter, scanRootPath = directoryPath, excludedDirectoryRoots = []) {
   const entries = await import_node_fs6.promises.readdir(directoryPath, { withFileTypes: true });
   entries.sort((left, right) => left.name.localeCompare(right.name));
@@ -216197,7 +216234,7 @@ function extractJavaPackageName(sourceText) {
   const match = /^\s*package\s+([a-zA-Z_][\w.]*)\s*;/mu.exec(sourceText);
   return match?.[1];
 }
-async function buildJavaImportIndex(workspaceRoot, moduleRoots, adapter) {
+async function buildJavaImportIndex(workspaceRoot, moduleRoots, adapter, options) {
   const classes = /* @__PURE__ */ new Map();
   const packageCandidates = /* @__PURE__ */ new Map();
   for (const [moduleId, moduleRoot] of [...moduleRoots.entries()].sort(
@@ -216207,7 +216244,13 @@ async function buildJavaImportIndex(workspaceRoot, moduleRoots, adapter) {
     const sourceFiles = await collectSourceFiles(moduleRoot, adapter, moduleRoot, childModuleRoots);
     for (const sourceFilePath of sourceFiles) {
       const relativePath = normalizePath4(path7.relative(workspaceRoot, sourceFilePath));
-      if (isTestSourcePath(relativePath)) {
+      if (shouldSkipDependencySource(
+        relativePath,
+        moduleRoot,
+        workspaceRoot,
+        false,
+        options?.includeConfiguredNonProductionModuleSources === true
+      )) {
         continue;
       }
       const sourceText = await readTextFileIfExists2(sourceFilePath);
@@ -216850,10 +216893,13 @@ async function resolveCrossModuleImport(workspaceRoot, modulesRootRelativePath,
 async function collectCrossModuleImports(workspaceRoot, modulesRootRelativePath, moduleRoots, explicitStandaloneModuleByPath, workspacePackageAliases, adapter, options) {
   const imports = [];
   const includeTestFiles = options?.includeTestFiles === true;
+  const includeConfiguredNonProductionModuleSources = options?.includeConfiguredNonProductionModuleSources === true;
   if (!supportsDependencyImportParsing(adapter)) {
     return imports;
   }
-  const javaImportIndex = usesJavaImportParser(adapter) ? await buildJavaImportIndex(workspaceRoot, moduleRoots, adapter) : void 0;
+  const javaImportIndex = usesJavaImportParser(adapter) ? await buildJavaImportIndex(workspaceRoot, moduleRoots, adapter, {
+    includeConfiguredNonProductionModuleSources
+  }) : void 0;
   for (const [moduleName, moduleRoot] of [...moduleRoots.entries()].sort(
     ([left], [right]) => left.localeCompare(right)
   )) {
@@ -216868,7 +216914,13 @@ async function collectCrossModuleImports(workspaceRoot, modulesRootRelativePath,
       const sourceFileRelativePath = normalizePath4(
         path7.relative(workspaceRoot, sourceFilePath)
       );
-      if (!includeTestFiles && isTestSourcePath(sourceFileRelativePath)) {
+      if (shouldSkipDependencySource(
+        sourceFileRelativePath,
+        moduleRoot,
+        workspaceRoot,
+        includeTestFiles,
+        includeConfiguredNonProductionModuleSources
+      )) {
         continue;
       }
       const sourceText = await readTextFileIfExists2(sourceFilePath);
@@ -217418,7 +217470,10 @@ async function buildDependencyGraphSummary(workspaceRoot, architectureContract,
     explicitStandaloneModuleByPath,
     workspacePackageAliases,
     adapter,
-    { resolutionContext }
+    {
+      includeConfiguredNonProductionModuleSources: true,
+      resolutionContext
+    }
   );
   options?.onCollectedImports?.(imports);
   options?.onResolutionStats?.(resolutionContext.getStats());
@@ -217522,10 +217577,11 @@ async function validateDependencyContractBoundaries(workspaceRoot, architectureC
     workspacePackageAliases,
     adapter
   );
+  const boundaryImports = filterImportsForBoundaryChecks(imports, moduleRoots, workspaceRoot);
   const dependencyContextResolver = createArchitectureDependencyContextResolver(
     architectureContract
   );
-  const peerImports = filterPeerModuleImports(imports);
+  const peerImports = filterPeerModuleImports(boundaryImports);
   const moduleScopedPeerImports = peerImports.filter(
     (dependencyImport) => isModuleScopedDependencyImport(
       architectureContract,
@@ -217836,7 +217892,8 @@ async function validateDependencyContractBoundaries(workspaceRoot, architectureC
         workspaceRoot,
         canonicalModuleRoots
       ),
-      adapter
+      adapter,
+      { includeConfiguredNonProductionModuleSources: true }
     );
     const canonicalPeerImports = filterPeerModuleImports(canonicalImports).filter(
       (dependencyImport) => isModuleScopedDependencyImport(architectureContract, dependencyImport)
@@ -217934,8 +217991,9 @@ async function validateDependencyBoundaries(workspaceRoot, options) {
     workspacePackageAliases,
     adapter
   );
+  const boundaryImports = filterImportsForBoundaryChecks(imports, moduleRoots, workspaceRoot);
   const dependencyContextResolver = parsedArchitectureContract ? createArchitectureDependencyContextResolver(parsedArchitectureContract) : void 0;
-  const peerImports = filterPeerModuleImports(imports);
+  const peerImports = filterPeerModuleImports(boundaryImports);
   const moduleScopedPeerImports = peerImports.filter(
     (dependencyImport) => isModuleScopedDependencyImport(
       parsedArchitectureContract,
@@ -218191,7 +218249,8 @@ async function buildModuleDependencyGraphSnapshot(workspaceRoot, options) {
     moduleRoots,
     explicitStandaloneModuleByPath,
     workspacePackageAliases,
-    adapter
+    adapter,
+    { includeConfiguredNonProductionModuleSources: true }
   );
   const imports = filterPeerModuleImports(allImports).filter(
     (dependencyImport) => moduleSet.has(dependencyImport.sourceModule) && moduleSet.has(dependencyImport.targetModule)
@@ -222217,7 +222276,7 @@ async function validateModuleContractIntegrity(workspaceRoot, contract, options)
           "AP-ARCH-005",
           "error",
           true,
-          "No modules are registered in architecture.json. Module registry path checks are not applicable."
+          "No explicit root modules are registered in architecture.json. Root module registry path checks are not applicable; component-backed contracts are validated by dependency checks."
         )
       });
     }
@@ -222227,7 +222286,7 @@ async function validateModuleContractIntegrity(workspaceRoot, contract, options)
           "AP-ARCH-006",
           "error",
           true,
-          "No modules are registered in architecture.json. Module contract file checks are not applicable."
+          "No explicit root modules are registered in architecture.json. Root module contract file checks are not applicable; component-backed contracts are validated by dependency checks."
         )
       });
     }
@@ -222237,7 +222296,7 @@ async function validateModuleContractIntegrity(workspaceRoot, contract, options)
           "AP-ARCH-007",
           "error",
           true,
-          "No modules are registered in architecture.json. Module contract identity checks are not applicable."
+          "No explicit root modules are registered in architecture.json. Root module contract identity checks are not applicable; component-backed contracts are validated by dependency checks."
         )
       });
     }
@@ -222247,7 +222306,7 @@ async function validateModuleContractIntegrity(workspaceRoot, contract, options)
           "AP-ARCH-008",
           "error",
           true,
-          "No modules are registered in architecture.json. Module public entrypoint alignment checks are not applicable."
+          "No explicit root modules are registered in architecture.json. Root module public entrypoint alignment checks are not applicable; component-backed contracts are validated by dependency checks."
         )
       });
     }
@@ -223196,7 +223255,7 @@ async function loadRemotePolicyWithStatus(policySourceUrl, options) {
     "info",
     `Remote policy configured. Loading policy from ${policySourceUrl}.`
   );
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const request3 = https.request(
       {
         protocol: validated.url.protocol,
@@ -223223,7 +223282,7 @@ async function loadRemotePolicyWithStatus(policySourceUrl, options) {
               "warn",
               `Remote policy request failed with HTTP ${statusCode}. Using local policy only.`
             );
-            resolve9({
+            resolve10({
               message: `Remote policy request failed with HTTP ${statusCode}. Using local policy only.`
             });
             return;
@@ -223237,7 +223296,7 @@ async function loadRemotePolicyWithStatus(policySourceUrl, options) {
               "warn",
               "Remote policy payload is invalid JSON. Using local policy only."
             );
-            resolve9({
+            resolve10({
               message: "Remote policy payload is invalid JSON. Using local policy only."
             });
             return;
@@ -223249,7 +223308,7 @@ async function loadRemotePolicyWithStatus(policySourceUrl, options) {
               "warn",
               "Remote policy payload has an invalid structure. Using local policy only."
             );
-            resolve9({
+            resolve10({
               message: "Remote policy payload has an invalid structure. Using local policy only."
             });
             return;
@@ -223259,7 +223318,7 @@ async function loadRemotePolicyWithStatus(policySourceUrl, options) {
             "info",
             "Remote policy loaded successfully."
           );
-          resolve9({
+          resolve10({
             policy: normalized,
             message: "Remote policy loaded successfully."
           });
@@ -223275,7 +223334,7 @@ async function loadRemotePolicyWithStatus(policySourceUrl, options) {
         "warn",
         "Remote policy unavailable. Using local policy only."
       );
-      resolve9({
+      resolve10({
         message: "Remote policy unavailable. Using local policy only."
       });
     });
@@ -225597,19 +225656,40 @@ function hasSelectStar(statement) {
   return /\bselect\s+(distinct\s+)?\*/i.test(statement);
 }
 function hasPaginationEvidence(statement) {
-  return /\blimit\s+\d+\b|\boffset\s+\d+\b|\bfetch\s+(first|next)\b|\btop\s+\d+\b/i.test(
+  const boundValuePattern = "(?:\\d+|\\$\\d+|\\?|:[A-Za-z_]\\w*|@[A-Za-z_]\\w*|\\$\\{[^}]{1,120}\\}|[A-Za-z_]\\w*)";
+  const valueTerminatorPattern = "(?=\\s|,|;|\\)|$)";
+  return new RegExp(
+    `\\blimit\\s+${boundValuePattern}${valueTerminatorPattern}|\\boffset\\s+${boundValuePattern}${valueTerminatorPattern}|\\bfetch\\s+(first|next)\\b|\\btop\\s+${boundValuePattern}${valueTerminatorPattern}`,
+    "i"
+  ).test(
     statement
   );
 }
+function hasEqualityPredicate(statement, columnPattern) {
+  return new RegExp(
+    `\\bwhere\\b[\\s\\S]*\\b(?:${columnPattern})\\b\\s*=\\s*(?:[\\w$:@?]+|'[^']+'|"[^"]+"|\\d+)`,
+    "iu"
+  ).test(statement);
+}
+function isCatalogIdentifierPointLookup(statement) {
+  const metadataSourcePattern = /\bfrom\s+(?:information_schema\.(?:schemata|tables|columns|key_column_usage|table_constraints)|pg_catalog\.(?:pg_class|pg_namespace|pg_attribute|pg_constraint|pg_type|pg_enum|pg_tables|pg_indexes)|pg_(?:class|namespace|attribute|constraint|type|enum|tables|indexes))\b/iu;
+  if (!metadataSourcePattern.test(statement)) {
+    return false;
+  }
+  return hasEqualityPredicate(statement, "schema_name|table_schema|table_name|column_name|constraint_name") || hasEqualityPredicate(statement, "schemaname|tablename|relname|nspname|attname|conname|typname|enumlabel|indexname");
+}
 function isObviousPointLookup(statement) {
   const normalized = statement.toLowerCase();
+  if (/\bselect\s+exists\s*\(/i.test(normalized)) {
+    return true;
+  }
   if (!normalized.includes("where")) {
     return false;
   }
   if (normalized.includes(" or ")) {
     return false;
   }
-  return /\bwhere\b[\s\S]*\b([a-z_]*id)\b\s*=\s*([\w$:@?]+|'[^']+'|\d+)/i.test(normalized);
+  return hasEqualityPredicate(normalized, "id|uuid|slug|email|identifier") || isCatalogIdentifierPointLookup(normalized);
 }
 function listModulePathEntries(contract) {
   return Object.entries(contract.modules ?? {}).map(([moduleName, reference]) => {
@@ -226190,13 +226270,14 @@ function detectRepeatedQueryPattern(method) {
 }
 function extractSqlQueryLiterals(content) {
   const queries = [];
+  const searchableContent = maskSourceComments(content);
   const patterns = [
     /(?:\b(?:[\w$]+\.)?(?:query|execute|executeQuery|createNativeQuery|createQuery|FromSqlRaw|FromSqlInterpolated|Query|QueryContext|QueryRow|QueryRowContext|Exec|ExecContext|Raw|text)|\$queryRaw|\$executeRaw)\s*\([^'"`)]{0,180}?(['"`])([\s\S]{0,900}?)\1/giu,
     /\b(?:DB::select|DB::statement|DB::raw|DB::table)\s*\([^'"`)]{0,180}?(['"`])([\s\S]{0,900}?)\1/gu,
     /@Query\s*\(\s*(['"`])([\s\S]{0,900}?)\1/gu
   ];
   for (const pattern of patterns) {
-    for (const match of content.matchAll(pattern)) {
+    for (const match of searchableContent.matchAll(pattern)) {
       const sql = match[2];
       if (!sql || !/\b(?:select|update|delete|insert)\b/iu.test(sql)) {
         continue;
@@ -226209,6 +226290,71 @@ function extractSqlQueryLiterals(content) {
   }
   return queries;
 }
+function maskSourceComments(content) {
+  let masked = "";
+  let index = 0;
+  let state = "code";
+  let escaped = false;
+  while (index < content.length) {
+    const current = content[index] ?? "";
+    const next = content[index + 1] ?? "";
+    if (state === "line-comment") {
+      if (current === "\r" || current === "\n") {
+        masked += current;
+        state = "code";
+      } else {
+        masked += " ";
+      }
+      index += 1;
+      continue;
+    }
+    if (state === "block-comment") {
+      if (current === "*" && next === "/") {
+        masked += "  ";
+        index += 2;
+        state = "code";
+        continue;
+      }
+      masked += current === "\r" || current === "\n" ? current : " ";
+      index += 1;
+      continue;
+    }
+    if (state === "single" || state === "double" || state === "template") {
+      masked += current;
+      if (escaped) {
+        escaped = false;
+      } else if (current === "\\") {
+        escaped = true;
+      } else if (state === "single" && current === "'" || state === "double" && current === '"' || state === "template" && current === "`") {
+        state = "code";
+      }
+      index += 1;
+      continue;
+    }
+    if (current === "/" && next === "/") {
+      masked += "  ";
+      index += 2;
+      state = "line-comment";
+      continue;
+    }
+    if (current === "/" && next === "*") {
+      masked += "  ";
+      index += 2;
+      state = "block-comment";
+      continue;
+    }
+    if (current === "'") {
+      state = "single";
+    } else if (current === '"') {
+      state = "double";
+    } else if (current === "`") {
+      state = "template";
+    }
+    masked += current;
+    index += 1;
+  }
+  return masked;
+}
 function detectCodeSqlQueryShapeFindings(file, config) {
   const findings = [];
   for (const query of extractSqlQueryLiterals(file.content)) {
@@ -226298,12 +226444,18 @@ function hasAssignedBuilderBoundedTerminal(methodBody, snippet) {
   }
   return new RegExp(`\\b${variableName}\\s*\\.\\s*(?:getOne|getRawOne|loadOne|getCount|getExists)\\s*\\(`, "iu").test(methodBody);
 }
+function hasIdentifierPredicateEvidence(snippet) {
+  return /\.(?:where|andWhere|orWhere)\s*\(\s*['"`][^'"`]{0,240}\b(?:\w*id|uuid|slug|email|identifier)\b[^'"`]{0,120}(?:=| in\b|IN\b)/iu.test(snippet) || /\bwhere\s*:\s*\{[\s\S]{0,420}\b(?:id|uuid|slug|email|identifier|channelId|orderId|customerId|userId|productId|variantId)\b\s*[:=]/iu.test(snippet);
+}
+function hasQueryBuilderTerminalEvidence(snippet, methodBody) {
+  return /\.(?:getMany|getRawMany|loadMany|getOne|getRawOne|loadOne|getCount|getExists|execute)\s*\(/iu.test(snippet) || hasAssignedBuilderBoundedTerminal(methodBody, snippet);
+}
 function isNonCollectionOrmRead(label, snippet, methodBody = snippet) {
   const terminal = getOrmTerminalOperation(snippet);
   return /\b(?:findOne|findOneOrFail|findOneBy|findOneByOrFail|findUnique|findFirst|count|exists|aggregate)\b/iu.test(label) || !!terminal && /^(?:getOne|getRawOne|loadOne|getCount|getExists|findOne|findOneOrFail|findOneBy|findOneByOrFail|findUnique|findFirst|count|exists|update|delete|remove|save|insert|execute)$/iu.test(terminal) || isScopedRelationLoad(snippet) || hasAssignedBuilderBoundedTerminal(methodBody, snippet);
 }
 function hasOrmBoundEvidence(snippet) {
-  return codePaginationEvidencePattern.test(snippet) || /\.(?:take|limit|offset|skip)\s*\(/iu.test(snippet) || /\b(?:maxResults|setMaxResults|firstResult|setFirstResult)\s*\(/iu.test(snippet) || /\b(?:pageSize|perPage|limit|take)\s*[:=]\s*\d+\b/iu.test(snippet);
+  return codePaginationEvidencePattern.test(snippet) || /\.(?:take|limit|offset|skip)\s*\(/iu.test(snippet) || /\b(?:maxResults|setMaxResults|firstResult|setFirstResult)\s*\(/iu.test(snippet) || /\b(?:pageSize|perPage|limit|take)\s*[:=]\s*\d+\b/iu.test(snippet) || hasIdentifierPredicateEvidence(snippet);
 }
 function getOrmQueryTarget(method, label, snippet) {
   const terminal = getOrmTerminalOperation(snippet);
@@ -226326,6 +226478,9 @@ function getOrmQueryLabel(method, label, snippet) {
 function detectOrmQueryShapeFindings(method, config) {
   const findings = [];
   for (const evidence of collectOrmReadEvidence(method)) {
+    if (evidence.label === "node.query" && !hasQueryBuilderTerminalEvidence(evidence.snippet, method.body)) {
+      continue;
+    }
     if (config.tenantModel === "same_db_same_schema" && !tenantPredicatePattern.test(evidence.snippet)) {
       findings.push(createCodeFinding({
         id: "AP-DQR-001",
@@ -227034,7 +227189,7 @@ function detectControllerBusinessLogic(entry, classification, moduleName, contex
   });
 }
 function detectRepositoryBusinessLogic(entry, classification, moduleName) {
-  if (!classification.isRepository) {
+  if (!classification.isRepository || !isProductionBackendGovernanceScope(classification.scope)) {
     return void 0;
   }
   if (entry.extension === ".java" && isPureSpringDataRepositoryInterface(entry.content)) {
@@ -227324,6 +227479,7 @@ var import_node_fs26 = require("node:fs");
 var ts4 = __toESM(require_typescript());
 init_moduleDiscovery();
 init_archpilotIgnore();
+init_sourceScopeClassification();
 var RuleIds = {
   AUTH_MISSING_ENFORCEMENT: "AP-AUTH-001",
   AUTH_INCONSISTENT_ENFORCEMENT: "AP-AUTH-002",
@@ -227362,7 +227518,7 @@ var publicEvidencePattern = /@Public\b|@PermitAll\b|\[AllowAnonymous\b[^\]]*\]|p
 var roleEvidencePattern = /@(?:Roles|Permissions|RequirePermission|PreAuthorize|Secured|RolesAllowed)\s*(?:\(|\b)([^)\n]*)|\[Authorize\s*\([^)\]]*(?:Roles|Policy)\s*=|(?:requireRole\w*|RequireRole\w*|require_role|RoleChecker|adminMiddleware|can:|permission:|scopes?\s*=|Security\s*\([^)]*scopes)\b/u;
 var tenantSignalPattern = /\b(?:tenantId|tenant_id|organizationId|organization_id|orgId|org_id|workspaceId|workspace_id|accountId|account_id|companyId|company_id|customerId|customer_id|TenantContext|CurrentTenant|TenantResolver|TenantProvider|request\.tenant|req\.tenant|user\.tenantId|user\.tenant_id|user\.organizationId|user\.organization_id|user\.orgId|user\.accountId|user\.workspaceId|user\.companyId|user\.customerId|HibernateFilter|CurrentTenant)\b/u;
 var tenantPredicateEvidencePattern = /\b(?:tenantId|tenant_id|organizationId|organization_id|orgId|org_id|workspaceId|workspace_id|accountId|account_id|companyId|company_id|customerId|customer_id|TenantContext|CurrentTenant|TenantResolver|TenantProvider|request\.tenant|req\.tenant|user\.tenantId|user\.tenant_id|user\.organizationId|user\.organization_id|user\.orgId|user\.accountId|user\.workspaceId|user\.companyId|user\.customerId|HibernateFilter|CurrentTenant)\b/u;
-var repositoryRolePattern = /\b(?:role|roles|permission|permissions|isAdmin|hasRole|hasPermission|SecurityContextHolder|Authentication|Principal)\b/u;
+var executableAuthorizationDecisionPattern = /@(?:PreAuthorize|PostAuthorize|Secured|RolesAllowed)\b|\[(?:Authorize)\b[^\]]*(?:Roles|Policy)\s*=|\b(?:hasRole|hasAuthority|hasPermission|isUserInRole|checkPermission|requireRole\w*|RequireRole\w*|require_role|canActivate|authorize|assertAuthorized|PermissionChecker|AccessDecisionManager|SecurityContextHolder\.getContext\(\)\.getAuthentication)\s*\(|\b(?:user|principal|currentUser|account)\.(?:role|roles|permission|permissions|isAdmin)\b\s*(?:[=!]==?|\.includes\s*\(|\.contains\s*\()/u;
 function normalizePath12(value) {
   return value.replace(/\\/g, "/");
 }
@@ -227754,7 +227910,10 @@ function isProtectedLooking(endpoint) {
 }
 function detectAuthorizationFindings(files, contract, astCache) {
   const findings = [];
-  for (const file of files) {
+  const productionFiles = files.filter(
+    (file) => isProductionBackendGovernanceScope(classifyValidationSourceScope(file.relativePath))
+  );
+  for (const file of productionFiles) {
     const moduleName = inferModuleForPath3(contract, file.relativePath);
     const endpoints = extractEndpoints(file, moduleName);
     if (endpoints.length === 0 && !isControllerFile(file, astCache)) {
@@ -227789,8 +227948,8 @@ function detectAuthorizationFindings(files, contract, astCache) {
       }
     }
   }
-  for (const file of files.filter((candidate) => isRepositoryFile(candidate, astCache))) {
-    const roleMatch = repositoryRolePattern.exec(file.content);
+  for (const file of productionFiles.filter((candidate) => isRepositoryFile(candidate, astCache))) {
+    const roleMatch = executableAuthorizationDecisionPattern.exec(file.content);
     if (!roleMatch) {
       continue;
     }
@@ -228272,7 +228431,7 @@ function classifySourceFile2(file, contract, astCache) {
   const scope = classifyValidationSourceScope(file.relativePath);
   const roles = new Set(getDeclaredRoles2(file, astCache));
   const lowerPath = file.relativePath.toLowerCase();
-  if (/(^|[./_-])controller\.(ts|tsx|js|jsx|mjs|cjs|java|cs|py|php|go)$/u.test(lowerPath) || /(^|\/)(controllers?|routers?|routes?|handlers?)\//u.test(lowerPath)) {
+  if (/(^|[./_-])controller\.(ts|tsx|js|jsx|mjs|cjs|java|cs|py|php|go)$/u.test(lowerPath) || /(^|\/)(controllers?|routers?|routes?)\//u.test(lowerPath)) {
     roles.add("controller");
   }
   if (/(^|[./_-])service\.(ts|tsx|js|jsx|mjs|cjs|java|cs|py|php|go)$/u.test(lowerPath) || /(^|\/)(services?)\//u.test(lowerPath)) {
@@ -230589,8 +230748,9 @@ function extractJavaSignals(file) {
       publishes: []
     });
   }
-  for (const match of file.content.matchAll(/(?:await\s+)?(?:\w+\.)?(?:publishEvent|publish|emit)\s*\(\s*(?:new\s+)?(["']?)([A-Za-z][\w.]*Event?|[a-z][\w.]+)\1/gu)) {
-    const eventName = match[2];
+  for (const match of file.content.matchAll(/(?:await\s+)?(?:\w+\.)?(?:publishEvent|publish|emit)\s*\(\s*(?:(new)\s+([A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*)\s*\(|(["'])([A-Za-z][\w.]*Event?|[a-z][\w.]+)\3|([A-Z][A-Za-z0-9_]*Event)\b)/gu)) {
+    const constructedType = match[2]?.split(".").at(-1);
+    const eventName = constructedType ?? match[4] ?? match[5];
     if (!eventName) {
       continue;
     }
@@ -234446,7 +234606,7 @@ ${infoLines.join("\n")}
 ## Passed Checks
 ${passedLines.join("\n")}
 
-## Module Dependency Summary
+## Module / Component Contract Dependency Summary
 ${dependencyGraphLines.join("\n")}
 
 ## Disabled Rules
@@ -236682,7 +236842,7 @@ ${appliedFixesSection}
 ## Remaining Violations
 ${remainingViolationsLine}
 
-## Module Dependency Summary
+## Module / Component Contract Dependency Summary
 ${moduleCatalog.length === 0 ? "- Module details are not available in this run." : moduleCatalog.map(
     (entry) => `- ${entry.moduleName} | Role: ${entry.role} | Path: ${entry.path ?? "(not configured)"} | Contract: ${entry.hasContract ? "yes" : "no"} | Declared deps: ${entry.declaredDependencyCount} | Actual deps: ${entry.actualDependencyCount} | Used by: ${entry.inboundDependencyCount}`
   ).join("\n")}
@@ -238934,11 +239094,11 @@ function normalizeAnnotationPath(workspaceRoot, sourceFile) {
   if (!path43.isAbsolute(sourceFile)) {
     return normalized;
   }
-  const relative17 = path43.relative(workspaceRoot, sourceFile).replace(/\\/g, "/");
-  if (relative17.startsWith("..") || path43.isAbsolute(relative17)) {
+  const relative18 = path43.relative(workspaceRoot, sourceFile).replace(/\\/g, "/");
+  if (relative18.startsWith("..") || path43.isAbsolute(relative18)) {
     return void 0;
   }
-  return relative17;
+  return relative18;
 }
 function toAnnotatableFinding(workspaceRoot, finding) {
   if (typeof finding.id !== "string" || !finding.id.startsWith("AP-DEP-")) {
@@ -239122,7 +239282,7 @@ async function emitGithubInlineArchitectureAnnotations(workspaceRoot) {
 var reviewCommentMarker = "<!-- archpilot-pr-review -->";
 var legacyReviewCommentMarker = "<!-- ARCHPILOT_REVIEW_COMMENT -->";
 function requestGithubApi(options) {
-  return new Promise((resolve9, reject) => {
+  return new Promise((resolve10, reject) => {
     const payload = options.body !== void 0 ? JSON.stringify(options.body) : void 0;
     const request3 = https2.request(
       {
@@ -239143,7 +239303,7 @@ function requestGithubApi(options) {
           chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
         });
         response.on("end", () => {
-          resolve9({
+          resolve10({
             statusCode: response.statusCode ?? 0,
             body: Buffer.concat(chunks).toString("utf8")
           });
@@ -245420,6 +245580,9 @@ function addEvidence6(evidence, value) {
     evidence.push(value);
   }
 }
+function hasDeclaredMavenReactorEvidence(candidate) {
+  return candidate.evidence.some((entry) => /Declared (?:by )?Maven|nested Maven reactor/iu.test(entry));
+}
 function isIgnoredComponentCandidatePath(componentPath) {
   const normalized = normalizePath25(componentPath).replace(/^\.\//u, "");
   if (normalized === "." || normalized.length === 0) {
@@ -245459,7 +245622,9 @@ function isIgnoredComponentCandidatePath(componentPath) {
     "build",
     "coverage"
   ];
-  return ignoredRootSegments.includes(firstSegment ?? "") || segments.some((segment) => ignoredSupportingSegments.includes(segment.toLowerCase()));
+  const isExampleContainer = firstSegment === "examples" || firstSegment === "example";
+  const isIgnoredRootSegment = ignoredRootSegments.includes(firstSegment ?? "") && (!isExampleContainer || segments.length === 1);
+  return isIgnoredRootSegment || segments.some((segment) => ignoredSupportingSegments.includes(segment.toLowerCase()));
 }
 function pathExists19(pathValue) {
   try {
@@ -245502,6 +245667,14 @@ function hasObject(value) {
 function hasPackagePublishSurface(packageJson) {
   return hasObject(packageJson?.exports) || typeof packageJson?.main === "string" || typeof packageJson?.module === "string" || typeof packageJson?.types === "string" || hasObject(packageJson?.publishConfig) || Array.isArray(packageJson?.files);
 }
+function packageDependencyNames(packageJson) {
+  return [
+    ...recordKeys(packageJson?.dependencies),
+    ...recordKeys(packageJson?.devDependencies),
+    ...recordKeys(packageJson?.peerDependencies),
+    ...recordKeys(packageJson?.optionalDependencies)
+  ];
+}
 function absoluteComponentRoot(workspaceRoot, componentPath) {
   return componentPath === "." ? workspaceRoot : path64.join(workspaceRoot, ...componentPath.split("/"));
 }
@@ -245509,6 +245682,10 @@ function readPackageJson(workspaceRoot, componentPath) {
   const absoluteRoot = absoluteComponentRoot(workspaceRoot, componentPath);
   return safeReadJson(path64.join(absoluteRoot, "package.json"));
 }
+function readProjectJson(workspaceRoot, componentPath) {
+  const absoluteRoot = absoluteComponentRoot(workspaceRoot, componentPath);
+  return safeReadJson(path64.join(absoluteRoot, "project.json"));
+}
 function readTextFileSafe(filePath) {
   try {
     return fs58.readFileSync(filePath, { encoding: "utf8" });
@@ -245523,6 +245700,9 @@ function readFirstXmlTag(value, tagName) {
   const match = value.match(new RegExp(`<${tagName}(?:\\s[^>]*)?>([\\s\\S]*?)</${tagName}>`, "iu"));
   return match?.[1]?.trim().replace(/\s+/gu, " ");
 }
+function readXmlTagValues(value, tagName) {
+  return [...value.matchAll(new RegExp(`<${tagName}(?:\\s[^>]*)?>([\\s\\S]*?)</${tagName}>`, "giu"))].map((match) => match[1]?.trim().replace(/\s+/gu, " ") ?? "").filter((entry) => entry.length > 0);
+}
 function readMavenMetadata(workspaceRoot, componentPath) {
   if (isUnderJvmResourceRoot4(componentPath)) {
     return void 0;
@@ -245560,6 +245740,95 @@ function readMavenMetadata(workspaceRoot, componentPath) {
     hasTestResources: pathExists19(path64.join(absoluteRoot, "src", "test", "resources"))
   };
 }
+function workspaceRelativePath(workspaceRoot, absolutePathValue) {
+  const relative18 = path64.relative(workspaceRoot, absolutePathValue);
+  if (relative18.length === 0) {
+    return ".";
+  }
+  if (relative18.startsWith("..") || path64.isAbsolute(relative18)) {
+    return void 0;
+  }
+  return normalizePath25(relative18);
+}
+function canonicalRealPath(filePath) {
+  try {
+    return fs58.realpathSync.native(filePath);
+  } catch {
+    return void 0;
+  }
+}
+function readMavenDeclaredModules(pomPath) {
+  const pomXml = readTextFileSafe(pomPath);
+  if (!pomXml) {
+    return [];
+  }
+  return uniqueSorted4(
+    readXmlTagValues(stripXmlComments(pomXml), "module").filter((modulePath) => !/[${}]/u.test(modulePath))
+  );
+}
+function collectMavenReactorCandidates(workspaceRoot, rootPaths) {
+  const candidates = /* @__PURE__ */ new Map();
+  const visitedPomPaths = /* @__PURE__ */ new Set();
+  const workspaceRealPath = canonicalRealPath(workspaceRoot) ?? path64.resolve(workspaceRoot);
+  const workspaceRealPathForCompare = process.platform === "win32" ? workspaceRealPath.toLowerCase() : workspaceRealPath;
+  const maxVisitedPoms = 500;
+  const addCandidate = (candidatePath, evidence, parentPath) => {
+    const normalized = normalizePath25(candidatePath);
+    const existing = candidates.get(normalized) ?? { path: normalized, evidence: [] };
+    addEvidence6(existing.evidence, evidence);
+    if (parentPath && !existing.parentPath) {
+      existing.parentPath = parentPath;
+    }
+    candidates.set(normalized, existing);
+  };
+  const visitPom = (pomPath, parentPath) => {
+    if (visitedPomPaths.size >= maxVisitedPoms) {
+      return;
+    }
+    const realPomPath = canonicalRealPath(pomPath);
+    if (!realPomPath || visitedPomPaths.has(realPomPath)) {
+      return;
+    }
+    const realPomPathForCompare = process.platform === "win32" ? realPomPath.toLowerCase() : realPomPath;
+    if (realPomPathForCompare !== workspaceRealPathForCompare && !realPomPathForCompare.startsWith(`${workspaceRealPathForCompare}${path64.sep}`)) {
+      return;
+    }
+    visitedPomPaths.add(realPomPath);
+    const pomDirectory = path64.dirname(pomPath);
+    const relativePomDirectory = workspaceRelativePath(workspaceRoot, pomDirectory);
+    if (!relativePomDirectory) {
+      return;
+    }
+    addCandidate(
+      relativePomDirectory,
+      parentPath ? `Declared by Maven reactor parent ${parentPath}` : "Detected Maven reactor root",
+      parentPath
+    );
+    for (const declaredModule of readMavenDeclaredModules(pomPath)) {
+      const childDirectory = path64.resolve(pomDirectory, declaredModule);
+      const childRelativePath = workspaceRelativePath(workspaceRoot, childDirectory);
+      if (!childRelativePath || isUnderJvmResourceRoot4(childRelativePath)) {
+        continue;
+      }
+      const childPom = path64.join(childDirectory, "pom.xml");
+      if (!pathExists19(childPom)) {
+        addCandidate(childRelativePath, `Declared Maven module '${declaredModule}' is missing pom.xml`, relativePomDirectory);
+        continue;
+      }
+      addCandidate(childRelativePath, `Declared Maven module '${declaredModule}' from ${relativePomDirectory}`, relativePomDirectory);
+      visitPom(childPom, relativePomDirectory);
+    }
+  };
+  for (const rootPath of uniqueSorted4(rootPaths)) {
+    const normalizedRoot = normalizePath25(rootPath);
+    const absoluteRoot = normalizedRoot === "." ? workspaceRoot : path64.join(workspaceRoot, ...normalizedRoot.split("/"));
+    const pomPath = path64.join(absoluteRoot, "pom.xml");
+    if (pathExists19(pomPath)) {
+      visitPom(pomPath);
+    }
+  }
+  return [...candidates.values()].sort((left, right) => left.path.localeCompare(right.path));
+}
 function toComponentRoot(modulePath) {
   const normalized = normalizePath25(modulePath);
   const segments = normalized.split("/").filter((segment) => segment.length > 0);
@@ -245594,6 +245863,18 @@ function buildRootCandidates(input2) {
   for (const root of input2.topology.detectedRoots ?? []) {
     addCandidate(root, `Detected project root ${root}`);
   }
+  if (input2.workspaceRoot) {
+    const mavenRoots = [".", ...input2.topology.detectedRoots ?? []];
+    for (const candidate of collectMavenReactorCandidates(input2.workspaceRoot, mavenRoots)) {
+      addCandidate(
+        candidate.path,
+        candidate.parentPath ? `Detected nested Maven reactor module under ${candidate.parentPath}` : "Detected Maven reactor module"
+      );
+      for (const evidence of candidate.evidence) {
+        addCandidate(candidate.path, evidence);
+      }
+    }
+  }
   for (const moduleEntry of input2.modules?.modules ?? []) {
     const componentRoot = toComponentRoot(moduleEntry.path);
     if (componentRoot) {
@@ -245972,11 +246253,57 @@ function hasRuntimeSourceFiles(workspaceRoot, componentPath) {
   }
   return false;
 }
+function hasFileMatchingUnderRoot(root, pattern) {
+  if (!pathExists19(root)) {
+    return false;
+  }
+  const entries = fs58.readdirSync(root, { recursive: true, withFileTypes: true });
+  return entries.some((entry) => entry.isFile() && pattern.test(normalizePath25(path64.join(entry.parentPath, entry.name))));
+}
+function hasNestRuntimeApplicationEvidence(workspaceRoot, componentPath, packageJson = readPackageJson(workspaceRoot, componentPath)) {
+  const absoluteRoot = absoluteComponentRoot(workspaceRoot, componentPath);
+  const dependencies = new Set(packageDependencyNames(packageJson));
+  const scripts = recordKeys(packageJson?.scripts);
+  const hasNestCore = dependencies.has("@nestjs/core");
+  if (!hasNestCore) {
+    return false;
+  }
+  const hasRuntimePlatform = dependencies.has("@nestjs/platform-express") || dependencies.has("@nestjs/platform-fastify") || dependencies.has("@nestjs/microservices") || dependencies.has("@nestjs/graphql") || dependencies.has("@nestjs/apollo");
+  const hasRunnableScript = scripts.some((script) => /^(?:start|serve|dev|worker)(?::|$)/u.test(script));
+  const hasNestCliConfig = ["nest-cli.json", "nest.config.js", "nest.config.ts"].some(
+    (fileName) => pathExists19(path64.join(absoluteRoot, fileName))
+  );
+  const hasBootstrapEntrypoint = [
+    path64.join(absoluteRoot, "src", "main.ts"),
+    path64.join(absoluteRoot, "src", "main.js"),
+    path64.join(absoluteRoot, "main.ts"),
+    path64.join(absoluteRoot, "main.js")
+  ].some((filePath) => {
+    const contents = readTextFileSafe(filePath);
+    return Boolean(contents && /\bNestFactory\.create(?:ApplicationContext)?\s*\(/u.test(contents));
+  });
+  const srcRoot = path64.join(absoluteRoot, "src");
+  const hasRuntimeSourceShape = hasFileMatchingUnderRoot(srcRoot, /\.(?:controller|resolver|gateway|processor|module|worker|queue)\.(?:ts|js)$/iu) || hasFileMatchingUnderRoot(srcRoot, /[/\\](?:controllers?|resolvers?|queues?|workers?)[/\\][^/\\]+\.(?:ts|js)$/iu);
+  const hasDatabaseRuntimeIntegration = [...dependencies].some(
+    (dependency) => /^(?:typeorm|@nestjs\/typeorm|@prisma\/client|prisma|mongoose|@nestjs\/mongoose|sequelize|@mikro-orm\/core)$/u.test(dependency)
+  );
+  const structuralEvidenceCount = [
+    hasRuntimePlatform,
+    hasRunnableScript,
+    hasNestCliConfig,
+    hasBootstrapEntrypoint,
+    hasRuntimeSourceShape,
+    hasDatabaseRuntimeIntegration
+  ].filter(Boolean).length;
+  return hasBootstrapEntrypoint || hasRuntimePlatform && structuralEvidenceCount >= 2 || hasRunnableScript && hasRuntimeSourceShape && structuralEvidenceCount >= 3;
+}
 function resolveKind(workspaceRoot, candidate, localProjectKinds) {
   const lowerPath = candidate.path.toLowerCase();
   const packageJson = readPackageJson(workspaceRoot, candidate.path);
   const maven = readMavenMetadata(workspaceRoot, candidate.path);
+  const dependencies = new Set(packageDependencyNames(packageJson));
   const hasRunnableFrontendEvidence = hasRunnableFrontendComponentEvidence(workspaceRoot, candidate.path);
+  const hasNestRuntimeEvidence = hasNestRuntimeApplicationEvidence(workspaceRoot, candidate.path, packageJson);
   const hasPublishSurface = hasPackagePublishSurface(packageJson);
   const hasMavenRunnableEvidence = Boolean(
     maven && (hasMavenMainEntrypoint(workspaceRoot, candidate.path) || hasMavenConfiguredMainClassEntrypoint(workspaceRoot, candidate.path, maven.configuredMainClass) || maven.hasSpringBootPlugin && maven.hasSpringBootRepackageGoal && hasMavenMainEntrypoint(workspaceRoot, candidate.path) || maven.packaging === "war" && hasMavenMainEntrypoint(workspaceRoot, candidate.path))
@@ -245998,6 +246325,12 @@ function resolveKind(workspaceRoot, candidate, localProjectKinds) {
     return hasPublishSurface && !hasRunnableFrontendEvidence ? "library" : "frontend";
   }
   if (classification === "backend_app") {
+    if (hasPublishSurface && dependencies.has("@nestjs/core") && !hasNestRuntimeEvidence) {
+      return "library";
+    }
+    return "backend";
+  }
+  if (hasNestRuntimeEvidence) {
     return "backend";
   }
   if (hasRunnableFrontendEvidence && localProjectKinds.primaryKind !== "backend" && localProjectKinds.primaryKind !== "service" && localProjectKinds.primaryKind !== "cli") {
@@ -246061,6 +246394,7 @@ function hasAnyToken(value, patterns) {
 }
 function classifyGovernanceRole(input2) {
   const packageJson = readPackageJson(input2.workspaceRoot, input2.candidate.path);
+  const projectJson = readProjectJson(input2.workspaceRoot, input2.candidate.path);
   const maven = readMavenMetadata(input2.workspaceRoot, input2.candidate.path);
   const evidence = [];
   let supportScore = 0;
@@ -246074,11 +246408,15 @@ function classifyGovernanceRole(input2) {
   const scripts = recordKeys(packageJson?.scripts);
   const dependencies = recordKeys(packageJson?.dependencies);
   const devDependencies = recordKeys(packageJson?.devDependencies);
+  const projectTags = toStringArray(projectJson?.tags);
+  const projectTargets = recordKeys(projectJson?.targets);
   const scriptText = scripts.join(" ").toLowerCase();
+  const projectMetadataText = `${projectTags.join(" ")} ${projectTargets.join(" ")}`.toLowerCase();
   const dependencyText = [...dependencies, ...devDependencies].join(" ").toLowerCase();
+  const hasNestRuntimeEvidence = hasNestRuntimeApplicationEvidence(input2.workspaceRoot, input2.candidate.path, packageJson);
   const hasStrongSupportPath = hasAnyToken(pathText, [
-    /(^|\/)(testing|test-plugins|cypress-tests|fixtures?|examples?|benchmarks?|smoke)(\/|$)/u,
-    /(^|\/)(dev-server|scaffold|scaffolding|generators?|devkit|tooling|tools)(\/|$)/u
+    /(^|\/)(testing|e2e-testing|test-plugins|cypress-tests|fixtures?|benchmarks?|smoke)(\/|$)/u,
+    /(^|\/)(dev-server|scaffold|scaffolding|generators?|devkit|tooling|tools|templates?)(\/|$)/u
   ]);
   const isPlainResourcesSurface = isUnderJvmResourceRoot4(pathText) && !hasRuntimeSourceFiles(input2.workspaceRoot, input2.candidate.path) && !packageJson && !maven;
   const hasPublishSurface = hasPackagePublishSurface(packageJson);
@@ -246102,6 +246440,9 @@ function classifyGovernanceRole(input2) {
   const hasMavenDistributionPackagingEvidence = Boolean(
     maven?.packaging === "pom" && !hasMavenMainSource && hasAnyToken(pathText, [/(^|\/)(distribution|dist|downloads|assembl(y|ies)|feature-packs?)(\/|$)/u])
   );
+  const hasMavenStarterPackagingEvidence = Boolean(
+    maven && !hasMavenMainJvmSourceEvidence && hasAnyToken(`${pathText} ${mavenMetadataText}`, [/\bstarters?\b|\bspring-boot-starter\b|\bstarter[-\s]/u])
+  );
   if (input2.candidate.architectureRoot?.classification === "backend_app" || input2.candidate.architectureRoot?.classification === "frontend_app") {
     runtimeScore += 3;
     addEvidence6(evidence, `Runtime architecture root signal: ${input2.candidate.architectureRoot.classification}`);
@@ -246120,6 +246461,10 @@ function classifyGovernanceRole(input2) {
     runtimeScore += 1;
     addEvidence6(evidence, `Runtime framework stack signal: ${input2.stack}`);
   }
+  if (hasNestRuntimeEvidence) {
+    runtimeScore += 3;
+    addEvidence6(evidence, "NestJS runtime application evidence");
+  }
   if (hasPublishSurface && !isPrivate) {
     runtimeScore += 1;
     addEvidence6(evidence, "Published package surface signal");
@@ -246144,25 +246489,37 @@ function classifyGovernanceRole(input2) {
   if (hasMavenAutoConfigurationEvidence && !hasMavenRunnableApplicationEvidence) {
     addEvidence6(evidence, "Maven Spring Boot auto-configuration/starter library evidence");
   }
-  if (hasAnyToken(descriptiveManifestText, [/\b(e2e|end-to-end|testing|test helper|test utilities|fixtures?)\b/u])) {
+  if (hasAnyToken(descriptiveManifestText, [/\b(e2e|end-to-end|testing|test helper|test utilities|fixtures?|test harness)\b/u])) {
     supportScore += 3;
     addEvidence6(evidence, "Package metadata describes test/support usage");
   }
+  if (hasAnyToken(`${packageName.toLowerCase()} ${projectMetadataText}`, [/\b(e2e|end-to-end|testing|test harness|scope:testing|test:ui|test:debug|test:report)\b/u]) && hasAnyToken(dependencyText, [/\b(?:playwright|@playwright\/test|cypress|vitest|jest|mocha)\b/u])) {
+    supportScore += 4;
+    addEvidence6(evidence, "Project metadata and dependencies indicate test-only workspace");
+  }
   if (hasAnyToken(descriptiveManifestText, [/\b(scaffold|scaffolding|generator|codegen|template|starter|create)\b/u])) {
     supportScore += 3;
     addEvidence6(evidence, "Package metadata describes scaffolding/generation usage");
   }
-  if (hasAnyToken(descriptiveManifestText, [/\b(dev server|development server|development tooling|tooling|devkit)\b/u])) {
+  if (hasAnyToken(descriptiveManifestText, [/\b(dev server|development server|development tooling|tooling|devkit|lint rules?|linter|build tooling|repository tooling)\b/u])) {
     supportScore += 2;
     addEvidence6(evidence, "Package metadata describes development/tooling usage");
   }
   if (hasAnyToken(pathText, [
-    /(^|\/)(test|tests|testing|__tests__|cypress|cypress-tests|fixtures?|examples?|benchmarks?|smoke)(\/|$)/u,
-    /(^|\/)(dev-server|test-plugins|scaffold|scaffolding|generators?|devkit|tooling|tools)(\/|$)/u
+    /(^|\/)(test|tests|testing|e2e-testing|__tests__|cypress|cypress-tests|fixtures?|benchmarks?|smoke)(\/|$)/u,
+    /(^|\/)(dev-server|test-plugins|scaffold|scaffolding|generators?|devkit|tooling|tools|templates?)(\/|$)/u
   ])) {
     supportScore += 1;
     addEvidence6(evidence, "Path contains support/tooling role tokens");
   }
+  if (hasAnyToken(pathText, [/(^|\/)(?:src\/constants\/)?templates?(\/|$)/u])) {
+    supportScore += 4;
+    addEvidence6(evidence, "Nested scaffold/template source surface");
+  }
+  if (hasAnyToken(dependencyText, [/\b(?:eslint|oxlint|prettier|typescript-eslint|ts-morph|jscodeshift|schematics|yeoman)\b/u])) {
+    supportScore += 2;
+    addEvidence6(evidence, "Package dependencies indicate lint/build/generation tooling");
+  }
   if (scripts.length > 0 && scripts.every((script) => /^(test|e2e|smoke|bench|benchmark|lint|typecheck|dev|dev:|load-test|generate|scaffold)/u.test(script))) {
     supportScore += 1;
     addEvidence6(evidence, "Package scripts are dominated by development/test workflows");
@@ -246211,6 +246568,10 @@ function classifyGovernanceRole(input2) {
     supportScore += 1;
     addEvidence6(evidence, "Maven POM-only aggregator/packaging module");
   }
+  if (hasMavenStarterPackagingEvidence) {
+    supportScore += 4;
+    addEvidence6(evidence, "Maven starter/resource artifact without JVM runtime source");
+  }
   if (isPlainResourcesSurface) {
     supportScore += 4;
     addEvidence6(evidence, "Resources-only surface without runtime source or manifest evidence");
@@ -246222,6 +246583,13 @@ function classifyGovernanceRole(input2) {
       selectedByDefault: false
     };
   }
+  if (hasMavenStarterPackagingEvidence && !hasMavenMainJvmSourceEvidence) {
+    return {
+      governanceRole: "support",
+      governanceEvidence: uniqueSorted4(evidence),
+      selectedByDefault: false
+    };
+  }
   if (hasMavenDistributionPackagingEvidence && hasAnyToken(mavenMetadataText, [/\b(docs?|documentation|metadata tests?|licenses?|maven plugins?|builds?)\b/u])) {
     supportScore += 3;
     addEvidence6(evidence, "Maven documentation/build/distribution packaging evidence without runtime source");
@@ -246281,7 +246649,7 @@ function detectComponents(input2) {
   const manifestBackedRoots = new Set(
     (input2.topology.detectedRoots ?? []).filter((root) => !isUnderJvmResourceRoot4(root))
   );
-  const rootCandidates = buildRootCandidates(input2).filter((candidate) => !ignoreMatcher.isIgnored(candidate.path)).filter((candidate) => !isIgnoredComponentCandidatePath(candidate.path)).filter((candidate) => !(isUnderJvmResourceRoot4(candidate.path) && !hasRuntimeSourceFiles(input2.workspaceRoot, candidate.path))).filter((candidate) => {
+  const rootCandidates = buildRootCandidates({ ...input2, workspaceRoot: input2.workspaceRoot }).filter((candidate) => !ignoreMatcher.isIgnored(candidate.path) || hasDeclaredMavenReactorEvidence(candidate)).filter((candidate) => !isIgnoredComponentCandidatePath(candidate.path)).filter((candidate) => !(isUnderJvmResourceRoot4(candidate.path) && !hasRuntimeSourceFiles(input2.workspaceRoot, candidate.path))).filter((candidate) => {
     if (input2.topology.topology !== "monorepo" || manifestBackedRoots.size === 0) {
       return true;
     }
@@ -246579,7 +246947,7 @@ function isCliSupportCandidate(component, allComponents) {
 }
 function hasIndependentRuntimeEvidence(component) {
   const text = componentEvidenceText(component);
-  return component.governanceRole === "runtime" && (/Maven executable application evidence/iu.test(text) || /Maven deployable WAR artifact/iu.test(text) || /Published package surface signal/iu.test(text) && !/Path contains support\/tooling role tokens/iu.test(text));
+  return component.governanceRole === "runtime" && (/Maven executable application evidence/iu.test(text) || /Maven deployable WAR artifact/iu.test(text) || /Maven library main source\/resource surface/iu.test(text) || /Maven Spring Boot auto-configuration\/starter library evidence/iu.test(text) || /Published package surface signal/iu.test(text) && !/Path contains support\/tooling role tokens/iu.test(text));
 }
 function hasSupportRoleEvidence(component) {
   const text = componentEvidenceText(component);
@@ -246789,7 +247157,20 @@ function hasAttributableBackendRoot(detection) {
   return getBackendComponents(detection).length > 0;
 }
 function isGenericLibraryStack(stack) {
-  return stack === "node_typescript" || stack === "node_javascript" || stack === "python" || stack === "go" || stack === "kotlin" || stack === "terraform" || stack === "ansible";
+  return stack === "node_typescript" || stack === "node_javascript" || stack === "library_generic" || stack === "java" || stack === "spring" || stack === "python" || stack === "go" || stack === "kotlin" || stack === "kotlin_spring" || stack === "terraform" || stack === "ansible";
+}
+function preferredLibraryStack(stacks) {
+  const uniqueStacks = uniqueInOrder2(stacks);
+  if (uniqueStacks.length <= 1) {
+    return isJvmLibraryStack(uniqueStacks[0]) ? "library_generic" : uniqueStacks[0];
+  }
+  if (uniqueStacks.some(isJvmLibraryStack) && uniqueStacks.every((candidate) => isJvmLibraryStack(candidate) || candidate === "node_typescript" || candidate === "node_javascript")) {
+    return "library_generic";
+  }
+  return void 0;
+}
+function isJvmLibraryStack(stack) {
+  return stack === "java" || stack === "spring";
 }
 function hasProjectKindEvidence(detection, patterns) {
   const evidence = detection.projectKinds?.evidence ?? [];
@@ -247211,7 +247592,7 @@ function resolveStackSelections(detection, projectKinds) {
     const libraryComponentStacks = uniqueInOrder2(
       libraryComponents.map((component) => component.stack).filter((stack) => isGenericLibraryStack(stack))
     );
-    const selectedLibrary = detection.topology.topology === "monorepo" ? libraryComponentStacks.length === 1 ? libraryComponentStacks[0] : void 0 : detection.stacks.selectedAdapterId;
+    const selectedLibrary = detection.topology.topology === "monorepo" ? preferredLibraryStack(libraryComponentStacks) : detection.stacks.selectedAdapterId;
     if (isGenericLibraryStack(selectedLibrary)) {
       selections.library = selectedLibrary;
     }
@@ -247233,7 +247614,7 @@ function resolveProjectProfiles(detection, projectKinds, stackSelections, apiSty
       selectedAdapterId: stackId,
       selectedAdapterCategory: getStackAdapterById(stackId).category,
       projectKinds: [kind],
-      apiStyleHint: kind === "backend" && apiStyle ? apiStyle : resolveRoleApiStyleHint(detection, stackId, component),
+      apiStyleHint: kind === "backend" && apiStyle ? apiStyle : stackId === "library_generic" ? void 0 : resolveRoleApiStyleHint(detection, stackId, component),
       databaseHints: detection.toolingHints?.databaseHints,
       toolingHints: detection.toolingHints?.toolingHints,
       repoTopology: detection.topology.topology === "unknown" ? "single_project" : detection.topology.topology
@@ -249874,6 +250255,9 @@ function readFlagValue(args, flag) {
   return value && value.length > 0 ? value : void 0;
 }
 async function readCliPackageVersion() {
+  if ("0.2.5".trim().length > 0) {
+    return "0.2.5".trim();
+  }
   const candidatePackageJsonPaths = [
     path73.join(__dirname, "..", "package.json"),
     path73.join(__dirname, "..", "..", "..", "..", "cli", "package.json")