@codacy/analysis-runner 0.17.0 → 0.19.0

package/dist/index.js

@@ -38,7 +38,7 @@ __export(index_exports, {
   clearAdapters: () => clearAdapters,
   computePatternSummary: () => computePatternSummary,
   configureApiToken: () => configureApiToken,
-  configureProxy: () => import_tooling6.configureProxy,
+  configureProxy: () => import_tooling8.configureProxy,
   createCodacyConfig: () => createCodacyConfig,
   createLogger: () => createLogger,
   createNullLogger: () => createNullLogger,
@@ -76,9 +76,11 @@ __export(index_exports, {
   resolveApiToken: () => resolveApiToken,
   resolveBaselinePath: () => resolveBaselinePath,
   resolveConfigPath: () => resolveConfigPath,
+  resolveDiscoveryExcludes: () => resolveDiscoveryExcludes,
   resolveEngineToAdapter: () => resolveEngineToAdapter,
   resolveHeadCommit: () => resolveHeadCommit,
-  resolveProxyConfig: () => import_tooling6.resolveProxyConfig,
+  resolveProxyConfig: () => import_tooling8.resolveProxyConfig,
+  resolveRemoteAuth: () => resolveRemoteAuth,
   resolveRepositoryRoot: () => resolveRepositoryRoot,
   resolveResultsApiBaseUrl: () => resolveResultsApiBaseUrl,
   rotateLogFiles: () => rotateLogFiles,
@@ -515,7 +517,7 @@ function isDependencyManifest(relativePath) {
   if (DEPENDENCY_MANIFEST_FILES.has(base)) return true;
   return DEPENDENCY_MANIFEST_SUFFIXES.some((suffix) => base.endsWith(suffix));
 }
-function listRepoFiles(repositoryRoot) {
+function listRepoFiles(repositoryRoot, exclude) {
   try {
     const tracked = (0, import_child_process2.execSync)("git ls-files", {
       cwd: repositoryRoot,
@@ -534,7 +536,8 @@ function listRepoFiles(repositoryRoot) {
     for (const f of untracked.split("\n")) {
       if (f) files.add(f);
     }
-    return Array.from(files).sort();
+    const all = Array.from(files).sort();
+    return exclude && exclude.length > 0 ? applyExclusions(all, [...exclude], []) : all;
   } catch {
     return [];
   }
@@ -1652,6 +1655,11 @@ function formatSarif(result) {
       ruleIndex: ruleIndex.get(issue.patternId) ?? 0,
       level: mapSeverityToSarif(issue.severity),
       message: { text: issue.message },
+      // SARIF has no first-class field for a tool's own finding id, so it rides in
+      // the result property bag. `upload` reads it back from here — without it the
+      // SARIF path would silently drop `sourceId` and produce different Codacy
+      // result UUIDs than the JSON path for the same analysis.
+      ...issue.sourceId ? { properties: { sourceId: issue.sourceId } } : {},
       locations: [
         {
           physicalLocation: {
@@ -1716,7 +1724,8 @@ function formatContainer(result) {
       patternId: issue.patternId,
       line: issue.line,
       message: issue.message,
-      suggestion: issue.suggestion
+      suggestion: issue.suggestion,
+      sourceId: issue.sourceId
     })
   ).join("\n");
 }
@@ -2323,642 +2332,16 @@ var import_promises4 = __toESM(require("fs/promises"));
 var import_os3 = __toESM(require("os"));
 var import_path8 = __toESM(require("path"));
 var import_child_process4 = require("child_process");
-var import_tooling5 = require("@codacy/tooling");
+var import_tooling7 = require("@codacy/tooling");
 
-// src/discover.ts
+// src/discover/index.ts
 var import_promises2 = __toESM(require("fs/promises"));
 var import_path6 = __toESM(require("path"));
 
-// src/discover-catalog.ts
-var DEPENDENCY_CATALOG = /* @__PURE__ */ new Map([
-  // --- JavaScript / TypeScript — Frameworks ---
-  ["react", { displayName: "React", kind: "framework" }],
-  ["react-dom", { displayName: "React DOM", kind: "framework" }],
-  ["react-native", { displayName: "React Native", kind: "framework" }],
-  ["vue", { displayName: "Vue.js", kind: "framework" }],
-  ["nuxt", { displayName: "Nuxt", kind: "framework" }],
-  ["@angular/core", { displayName: "Angular", kind: "framework" }],
-  ["svelte", { displayName: "Svelte", kind: "framework" }],
-  ["@sveltejs/kit", { displayName: "SvelteKit", kind: "framework" }],
-  ["next", { displayName: "Next.js", kind: "framework" }],
-  ["ember-source", { displayName: "Ember.js", kind: "framework" }],
-  ["lit", { displayName: "Lit", kind: "framework" }],
-  ["solid-js", { displayName: "Solid", kind: "framework" }],
-  ["astro", { displayName: "Astro", kind: "framework" }],
-  ["@builder.io/qwik", { displayName: "Qwik", kind: "framework" }],
-  ["@builder.io/qwik-city", { displayName: "Qwik", kind: "framework" }],
-  ["@remix-run/react", { displayName: "Remix", kind: "framework" }],
-  ["gatsby", { displayName: "Gatsby", kind: "framework" }],
-  ["preact", { displayName: "Preact", kind: "framework" }],
-  ["express", { displayName: "Express", kind: "framework" }],
-  ["@nestjs/core", { displayName: "NestJS", kind: "framework" }],
-  ["fastify", { displayName: "Fastify", kind: "framework" }],
-  ["koa", { displayName: "Koa", kind: "framework" }],
-  ["@hapi/hapi", { displayName: "Hapi", kind: "framework" }],
-  ["hono", { displayName: "Hono", kind: "framework" }],
-  ["electron", { displayName: "Electron", kind: "framework" }],
-  // AWS CDK — the v2 umbrella package `aws-cdk-lib`, the CLI package `aws-cdk`,
-  // and the v1 `@aws-cdk/*` construct packages (prefix rule below).
-  ["aws-cdk-lib", { displayName: "AWS CDK", kind: "framework" }],
-  ["aws-cdk", { displayName: "AWS CDK", kind: "framework" }],
-  // --- JavaScript / TypeScript — Libraries ---
-  ["lodash", { displayName: "Lodash", kind: "library" }],
-  ["underscore", { displayName: "Underscore.js", kind: "library" }],
-  ["ramda", { displayName: "Ramda", kind: "library" }],
-  ["jest", { displayName: "Jest", kind: "library" }],
-  ["vitest", { displayName: "Vitest", kind: "library" }],
-  ["@playwright/test", { displayName: "Playwright", kind: "library" }],
-  ["playwright", { displayName: "Playwright", kind: "library" }],
-  ["cypress", { displayName: "Cypress", kind: "library" }],
-  ["mocha", { displayName: "Mocha", kind: "library" }],
-  ["ava", { displayName: "AVA", kind: "library" }],
-  ["jasmine", { displayName: "Jasmine", kind: "library" }],
-  ["jasmine-core", { displayName: "Jasmine", kind: "library" }],
-  ["@testing-library/react", { displayName: "Testing Library", kind: "library" }],
-  ["@testing-library/vue", { displayName: "Testing Library", kind: "library" }],
-  ["@testing-library/dom", { displayName: "Testing Library", kind: "library" }],
-  ["tailwindcss", { displayName: "Tailwind CSS", kind: "library" }],
-  ["@storybook/react", { displayName: "Storybook", kind: "library" }],
-  ["@storybook/vue3", { displayName: "Storybook", kind: "library" }],
-  ["@storybook/svelte", { displayName: "Storybook", kind: "library" }],
-  ["redux", { displayName: "Redux", kind: "library" }],
-  ["@reduxjs/toolkit", { displayName: "Redux Toolkit", kind: "library" }],
-  ["mobx", { displayName: "MobX", kind: "library" }],
-  ["zustand", { displayName: "Zustand", kind: "library" }],
-  ["axios", { displayName: "Axios", kind: "library" }],
-  ["date-fns", { displayName: "date-fns", kind: "library" }],
-  ["dayjs", { displayName: "Day.js", kind: "library" }],
-  ["moment", { displayName: "Moment.js", kind: "library" }],
-  ["rxjs", { displayName: "RxJS", kind: "library" }],
-  ["zod", { displayName: "Zod", kind: "library" }],
-  ["joi", { displayName: "Joi", kind: "library" }],
-  ["yup", { displayName: "Yup", kind: "library" }],
-  ["prisma", { displayName: "Prisma", kind: "library" }],
-  ["@prisma/client", { displayName: "Prisma", kind: "library" }],
-  ["typeorm", { displayName: "TypeORM", kind: "library" }],
-  ["sequelize", { displayName: "Sequelize", kind: "library" }],
-  ["drizzle-orm", { displayName: "Drizzle ORM", kind: "library" }],
-  ["mongoose", { displayName: "Mongoose", kind: "library" }],
-  ["graphql", { displayName: "GraphQL", kind: "library" }],
-  ["@apollo/client", { displayName: "Apollo Client", kind: "library" }],
-  ["socket.io", { displayName: "Socket.IO", kind: "library" }],
-  ["three", { displayName: "Three.js", kind: "library" }],
-  ["d3", { displayName: "D3.js", kind: "library" }],
-  ["chart.js", { displayName: "Chart.js", kind: "library" }],
-  ["sass", { displayName: "Sass", kind: "library" }],
-  ["node-sass", { displayName: "Sass", kind: "library" }],
-  ["less", { displayName: "Less", kind: "library" }],
-  ["styled-components", { displayName: "styled-components", kind: "library" }],
-  ["@emotion/react", { displayName: "Emotion", kind: "library" }],
-  ["pino", { displayName: "Pino", kind: "library" }],
-  ["winston", { displayName: "Winston", kind: "library" }],
-  ["i18next", { displayName: "i18next", kind: "library" }],
-  // react-intl is the React binding of the FormatJS ecosystem; eslint-plugin-formatjs
-  // lints both, so we report the umbrella name "formatjs" (matches the mapping key).
-  ["react-intl", { displayName: "formatjs", kind: "library" }],
-  ["vue-i18n", { displayName: "vue-i18n", kind: "library" }],
-  ["next-intl", { displayName: "next-intl", kind: "library" }],
-  // Type checker (eslint-plugin-flowtype). Also detected via a `.flowconfig` file.
-  ["flow-bin", { displayName: "Flow", kind: "library" }],
-  // Legacy JS libraries with dedicated ESLint plugins.
-  ["backbone", { displayName: "Backbone.js", kind: "library" }],
-  ["chai", { displayName: "Chai", kind: "library" }],
-  ["codeceptjs", { displayName: "CodeceptJS", kind: "library" }],
-  ["webdriverio", { displayName: "WebdriverIO", kind: "library" }],
-  ["react-relay", { displayName: "Relay", kind: "library" }],
-  ["relay-runtime", { displayName: "Relay", kind: "library" }],
-  // --- JavaScript / TypeScript — Tools ---
-  ["typescript", { displayName: "TypeScript", kind: "tool" }],
-  ["eslint", { displayName: "ESLint", kind: "tool" }],
-  ["prettier", { displayName: "Prettier", kind: "tool" }],
-  ["webpack", { displayName: "Webpack", kind: "tool" }],
-  ["vite", { displayName: "Vite", kind: "tool" }],
-  ["esbuild", { displayName: "esbuild", kind: "tool" }],
-  ["rollup", { displayName: "Rollup", kind: "tool" }],
-  ["turbo", { displayName: "Turborepo", kind: "tool" }],
-  ["tsup", { displayName: "tsup", kind: "tool" }],
-  ["@biomejs/biome", { displayName: "Biome", kind: "tool" }],
-  ["stylelint", { displayName: "Stylelint", kind: "tool" }],
-  // --- JavaScript / TypeScript — Platforms ---
-  ["@lwc/engine-dom", { displayName: "Lightning Web Components", kind: "platform" }],
-  ["@salesforce/core", { displayName: "Salesforce", kind: "platform" }],
-  ["@shopify/polaris", { displayName: "Shopify Polaris", kind: "platform" }],
-  // --- Python — Frameworks ---
-  ["django", { displayName: "Django", kind: "framework" }],
-  ["flask", { displayName: "Flask", kind: "framework" }],
-  ["fastapi", { displayName: "FastAPI", kind: "framework" }],
-  ["tornado", { displayName: "Tornado", kind: "framework" }],
-  ["pyramid", { displayName: "Pyramid", kind: "framework" }],
-  ["starlette", { displayName: "Starlette", kind: "framework" }],
-  ["sanic", { displayName: "Sanic", kind: "framework" }],
-  ["bottle", { displayName: "Bottle", kind: "framework" }],
-  ["streamlit", { displayName: "Streamlit", kind: "framework" }],
-  ["gradio", { displayName: "Gradio", kind: "framework" }],
-  ["apache-airflow", { displayName: "Airflow", kind: "framework" }],
-  // --- Python — Libraries ---
-  ["flask-babel", { displayName: "Flask-Babel", kind: "library" }],
-  ["pytest", { displayName: "pytest", kind: "library" }],
-  ["numpy", { displayName: "NumPy", kind: "library" }],
-  ["pandas", { displayName: "pandas", kind: "library" }],
-  ["requests", { displayName: "Requests", kind: "library" }],
-  ["sqlalchemy", { displayName: "SQLAlchemy", kind: "library" }],
-  ["celery", { displayName: "Celery", kind: "library" }],
-  ["pydantic", { displayName: "Pydantic", kind: "library" }],
-  ["boto3", { displayName: "Boto3 (AWS SDK)", kind: "library" }],
-  ["scipy", { displayName: "SciPy", kind: "library" }],
-  ["scikit-learn", { displayName: "scikit-learn", kind: "library" }],
-  ["tensorflow", { displayName: "TensorFlow", kind: "library" }],
-  ["torch", { displayName: "PyTorch", kind: "library" }],
-  ["httpx", { displayName: "HTTPX", kind: "library" }],
-  ["aiohttp", { displayName: "aiohttp", kind: "library" }],
-  ["pillow", { displayName: "Pillow", kind: "library" }],
-  ["beautifulsoup4", { displayName: "Beautiful Soup", kind: "library" }],
-  ["scrapy", { displayName: "Scrapy", kind: "library" }],
-  ["alembic", { displayName: "Alembic", kind: "library" }],
-  ["marshmallow", { displayName: "Marshmallow", kind: "library" }],
-  ["click", { displayName: "Click", kind: "library" }],
-  ["typer", { displayName: "Typer", kind: "library" }],
-  ["rich", { displayName: "Rich", kind: "library" }],
-  ["polars", { displayName: "Polars", kind: "library" }],
-  ["dask", { displayName: "Dask", kind: "library" }],
-  ["matplotlib", { displayName: "Matplotlib", kind: "library" }],
-  ["seaborn", { displayName: "Seaborn", kind: "library" }],
-  ["plotly", { displayName: "Plotly", kind: "library" }],
-  // --- Python — Tools ---
-  ["black", { displayName: "Black", kind: "tool" }],
-  ["ruff", { displayName: "Ruff", kind: "tool" }],
-  ["mypy", { displayName: "mypy", kind: "tool" }],
-  ["pylint", { displayName: "Pylint", kind: "tool" }],
-  ["flake8", { displayName: "Flake8", kind: "tool" }],
-  ["bandit", { displayName: "Bandit", kind: "tool" }],
-  ["isort", { displayName: "isort", kind: "tool" }],
-  // --- Ruby — Frameworks ---
-  ["rails", { displayName: "Ruby on Rails", kind: "framework" }],
-  ["sinatra", { displayName: "Sinatra", kind: "framework" }],
-  ["hanami", { displayName: "Hanami", kind: "framework" }],
-  ["grape", { displayName: "Grape", kind: "framework" }],
-  ["padrino", { displayName: "Padrino", kind: "framework" }],
-  // --- Ruby — Libraries ---
-  ["rspec", { displayName: "RSpec", kind: "library" }],
-  ["rspec-core", { displayName: "RSpec", kind: "library" }],
-  ["rspec-rails", { displayName: "RSpec Rails", kind: "library" }],
-  ["capybara", { displayName: "Capybara", kind: "library" }],
-  ["sidekiq", { displayName: "Sidekiq", kind: "library" }],
-  ["devise", { displayName: "Devise", kind: "library" }],
-  ["pundit", { displayName: "Pundit", kind: "library" }],
-  ["activeadmin", { displayName: "ActiveAdmin", kind: "library" }],
-  ["puma", { displayName: "Puma", kind: "library" }],
-  ["nokogiri", { displayName: "Nokogiri", kind: "library" }],
-  ["faraday", { displayName: "Faraday", kind: "library" }],
-  ["httparty", { displayName: "HTTParty", kind: "library" }],
-  ["minitest", { displayName: "Minitest", kind: "library" }],
-  ["factory_bot", { displayName: "FactoryBot", kind: "library" }],
-  ["dry-validation", { displayName: "dry-validation", kind: "library" }],
-  // --- Ruby — Tools ---
-  ["rubocop", { displayName: "RuboCop", kind: "tool" }],
-  ["bundler", { displayName: "Bundler", kind: "tool" }],
-  ["solargraph", { displayName: "Solargraph", kind: "tool" }],
-  // --- Java / Kotlin — Frameworks ---
-  ["spring-boot-starter", { displayName: "Spring Boot", kind: "framework" }],
-  ["spring-boot-starter-web", { displayName: "Spring Boot", kind: "framework" }],
-  ["spring-core", { displayName: "Spring Framework", kind: "framework" }],
-  ["quarkus-core", { displayName: "Quarkus", kind: "framework" }],
-  ["micronaut-core", { displayName: "Micronaut", kind: "framework" }],
-  ["ktor-server-core", { displayName: "Ktor", kind: "framework" }],
-  ["android", { displayName: "Android SDK", kind: "framework" }],
-  // --- Java / Kotlin — Libraries ---
-  ["junit-jupiter", { displayName: "JUnit 5", kind: "library" }],
-  ["junit", { displayName: "JUnit", kind: "library" }],
-  ["junit-jupiter-api", { displayName: "JUnit 5", kind: "library" }],
-  ["mockito-core", { displayName: "Mockito", kind: "library" }],
-  ["lombok", { displayName: "Lombok", kind: "library" }],
-  ["jackson-databind", { displayName: "Jackson", kind: "library" }],
-  ["jackson-core", { displayName: "Jackson", kind: "library" }],
-  ["hibernate-core", { displayName: "Hibernate", kind: "library" }],
-  ["guava", { displayName: "Guava", kind: "library" }],
-  ["commons-lang3", { displayName: "Apache Commons Lang", kind: "library" }],
-  ["commons-io", { displayName: "Apache Commons IO", kind: "library" }],
-  ["slf4j-api", { displayName: "SLF4J", kind: "library" }],
-  ["log4j-core", { displayName: "Log4j", kind: "library" }],
-  ["logback-classic", { displayName: "Logback", kind: "library" }],
-  ["testng", { displayName: "TestNG", kind: "library" }],
-  ["assertj-core", { displayName: "AssertJ", kind: "library" }],
-  ["gson", { displayName: "Gson", kind: "library" }],
-  ["okhttp", { displayName: "OkHttp", kind: "library" }],
-  ["retrofit", { displayName: "Retrofit", kind: "library" }],
-  ["spock-core", { displayName: "Spock", kind: "library" }],
-  // --- Groovy — Frameworks ---
-  // Grails/GORM artifact IDs vary (grails-core, grails-web, gorm-hibernate5, …);
-  // the `grails-`/`gorm-` prefix rules below catch the rest.
-  ["grails-core", { displayName: "Grails", kind: "framework" }],
-  ["gorm-core", { displayName: "GORM", kind: "library" }],
-  // --- Go — Frameworks ---
-  ["github.com/gin-gonic/gin", { displayName: "Gin", kind: "framework" }],
-  ["github.com/labstack/echo", { displayName: "Echo", kind: "framework" }],
-  ["github.com/gofiber/fiber", { displayName: "Fiber", kind: "framework" }],
-  ["github.com/go-chi/chi", { displayName: "Chi", kind: "framework" }],
-  ["github.com/gorilla/mux", { displayName: "Gorilla Mux", kind: "framework" }],
-  ["github.com/beego/beego", { displayName: "Beego", kind: "framework" }],
-  // --- Go — Libraries ---
-  ["github.com/stretchr/testify", { displayName: "Testify", kind: "library" }],
-  ["github.com/spf13/cobra", { displayName: "Cobra", kind: "library" }],
-  ["github.com/spf13/viper", { displayName: "Viper", kind: "library" }],
-  ["go.uber.org/zap", { displayName: "Zap", kind: "library" }],
-  ["github.com/sirupsen/logrus", { displayName: "Logrus", kind: "library" }],
-  ["gorm.io/gorm", { displayName: "GORM", kind: "library" }],
-  ["github.com/go-kit/kit", { displayName: "Go Kit", kind: "library" }],
-  ["google.golang.org/protobuf", { displayName: "Protocol Buffers", kind: "library" }],
-  ["google.golang.org/grpc", { displayName: "gRPC", kind: "library" }],
-  ["github.com/jackc/pgx", { displayName: "pgx", kind: "library" }],
-  ["github.com/redis/go-redis", { displayName: "go-redis", kind: "library" }],
-  ["github.com/aws/aws-sdk-go-v2", { displayName: "AWS SDK for Go", kind: "library" }],
-  ["github.com/prometheus/client_golang", { displayName: "Prometheus Client", kind: "library" }],
-  // --- Rust — Frameworks ---
-  ["actix-web", { displayName: "Actix Web", kind: "framework" }],
-  ["axum", { displayName: "Axum", kind: "framework" }],
-  ["rocket", { displayName: "Rocket", kind: "framework" }],
-  ["warp", { displayName: "Warp", kind: "framework" }],
-  ["tauri", { displayName: "Tauri", kind: "framework" }],
-  // --- Rust — Libraries ---
-  ["tokio", { displayName: "Tokio", kind: "library" }],
-  ["serde", { displayName: "Serde", kind: "library" }],
-  ["clap", { displayName: "clap", kind: "library" }],
-  ["reqwest", { displayName: "reqwest", kind: "library" }],
-  ["diesel", { displayName: "Diesel", kind: "library" }],
-  ["sqlx", { displayName: "SQLx", kind: "library" }],
-  ["tracing", { displayName: "Tracing", kind: "library" }],
-  ["anyhow", { displayName: "anyhow", kind: "library" }],
-  ["thiserror", { displayName: "thiserror", kind: "library" }],
-  ["rayon", { displayName: "Rayon", kind: "library" }],
-  // --- PHP — Frameworks ---
-  ["laravel/framework", { displayName: "Laravel", kind: "framework" }],
-  ["symfony/framework-bundle", { displayName: "Symfony", kind: "framework" }],
-  ["symfony/symfony", { displayName: "Symfony", kind: "framework" }],
-  ["codeigniter4/framework", { displayName: "CodeIgniter", kind: "framework" }],
-  ["slim/slim", { displayName: "Slim", kind: "framework" }],
-  ["cakephp/cakephp", { displayName: "CakePHP", kind: "framework" }],
-  // WordPress is rarely a real Composer dependency; these are the common
-  // "WordPress as a dependency" packages used by Bedrock/Composer-based sites.
-  ["johnpbloch/wordpress-core", { displayName: "WordPress", kind: "framework" }],
-  ["johnpbloch/wordpress", { displayName: "WordPress", kind: "framework" }],
-  ["roots/wordpress", { displayName: "WordPress", kind: "framework" }],
-  ["drupal/core", { displayName: "Drupal", kind: "framework" }],
-  ["drupal/core-recommended", { displayName: "Drupal", kind: "framework" }],
-  ["magento/product-community-edition", { displayName: "Magento", kind: "framework" }],
-  ["magento/product-enterprise-edition", { displayName: "Magento", kind: "framework" }],
-  ["magento/framework", { displayName: "Magento", kind: "framework" }],
-  // --- PHP — Libraries ---
-  ["phpunit/phpunit", { displayName: "PHPUnit", kind: "library" }],
-  ["guzzlehttp/guzzle", { displayName: "Guzzle", kind: "library" }],
-  ["monolog/monolog", { displayName: "Monolog", kind: "library" }],
-  ["nesbot/carbon", { displayName: "Carbon", kind: "library" }],
-  ["doctrine/orm", { displayName: "Doctrine ORM", kind: "library" }],
-  ["doctrine/dbal", { displayName: "Doctrine DBAL", kind: "library" }],
-  ["league/flysystem", { displayName: "Flysystem", kind: "library" }],
-  ["php-amqplib/php-amqplib", { displayName: "php-amqplib", kind: "library" }],
-  ["predis/predis", { displayName: "Predis", kind: "library" }],
-  // --- PHP — Tools ---
-  ["phpstan/phpstan", { displayName: "PHPStan", kind: "tool" }],
-  ["squizlabs/php_codesniffer", { displayName: "PHP_CodeSniffer", kind: "tool" }],
-  // --- Swift — Frameworks ---
-  ["vapor", { displayName: "Vapor", kind: "framework" }],
-  // --- Swift — Libraries ---
-  ["Alamofire", { displayName: "Alamofire", kind: "library" }],
-  ["SnapKit", { displayName: "SnapKit", kind: "library" }],
-  ["Kingfisher", { displayName: "Kingfisher", kind: "library" }],
-  ["Moya", { displayName: "Moya", kind: "library" }],
-  ["RxSwift", { displayName: "RxSwift", kind: "library" }],
-  ["RealmSwift", { displayName: "Realm", kind: "library" }],
-  // --- Scala — Frameworks ---
-  ["play-server", { displayName: "Play Framework", kind: "framework" }],
-  ["akka-actor", { displayName: "Akka", kind: "framework" }],
-  ["spray-can", { displayName: "Spray", kind: "framework" }],
-  // --- Scala — Libraries ---
-  ["scalatest", { displayName: "ScalaTest", kind: "library" }],
-  ["specs2-core", { displayName: "Specs2", kind: "library" }],
-  ["cats-core", { displayName: "Cats", kind: "library" }],
-  ["circe-core", { displayName: "Circe", kind: "library" }],
-  // --- Elixir — Frameworks ---
-  ["phoenix", { displayName: "Phoenix", kind: "framework" }],
-  ["plug", { displayName: "Plug", kind: "framework" }],
-  ["plug_cowboy", { displayName: "Plug", kind: "framework" }],
-  // --- Elixir — Libraries ---
-  ["ecto", { displayName: "Ecto", kind: "library" }],
-  ["ecto_sql", { displayName: "Ecto", kind: "library" }],
-  ["phoenix_ecto", { displayName: "Ecto", kind: "library" }],
-  // --- Crystal — Frameworks ---
-  ["amber", { displayName: "Amber", kind: "framework" }],
-  ["lucky", { displayName: "Lucky", kind: "framework" }],
-  ["kemal", { displayName: "Kemal", kind: "framework" }],
-  // --- Dart — Frameworks ---
-  // `flutter` and `angular` appear as plain keys in pubspec.yaml. NOTE: `angular`
-  // here is Dart's AngularDart. The npm package `angular` is AngularJS (1.x) — a
-  // different framework — so package.json overrides this via MANIFEST_SCOPED_CATALOG.
-  ["flutter", { displayName: "Flutter", kind: "framework" }],
-  ["flutter_test", { displayName: "Flutter", kind: "framework" }],
-  ["angular", { displayName: "Angular", kind: "framework" }],
-  // --- Dart — Libraries ---
-  // Kept to Dart-specific names with negligible cross-ecosystem collision risk
-  // (generic names like "get"/"provider" are intentionally omitted).
-  ["riverpod", { displayName: "Riverpod", kind: "library" }],
-  ["flutter_bloc", { displayName: "Bloc", kind: "library" }],
-  ["dio", { displayName: "Dio", kind: "library" }],
-  // --- .NET (C# / VB) — Libraries ---
-  // NuGet package IDs. Microsoft.* families are also covered by prefix rules below.
-  ["EntityFramework", { displayName: "Entity Framework", kind: "library" }],
-  ["NUnit", { displayName: "NUnit", kind: "library" }],
-  ["Moq", { displayName: "Moq", kind: "library" }],
-  ["NSubstitute", { displayName: "NSubstitute", kind: "library" }],
-  ["FluentAssertions", { displayName: "FluentAssertions", kind: "library" }],
-  ["Shouldly", { displayName: "Shouldly", kind: "library" }],
-  ["NLog", { displayName: "NLog", kind: "library" }],
-  ["log4net", { displayName: "log4net", kind: "library" }],
-  ["Newtonsoft.Json", { displayName: "Json.NET", kind: "library" }],
-  ["AutoMapper", { displayName: "AutoMapper", kind: "library" }],
-  ["Dapper", { displayName: "Dapper", kind: "library" }],
-  ["MediatR", { displayName: "MediatR", kind: "library" }]
-]);
-var DEPENDENCY_PREFIX_RULES = [
-  { prefix: "@angular/", classification: { displayName: "Angular", kind: "framework" } },
-  { prefix: "@nestjs/", classification: { displayName: "NestJS", kind: "framework" } },
-  { prefix: "@remix-run/", classification: { displayName: "Remix", kind: "framework" } },
-  { prefix: "@sveltejs/", classification: { displayName: "SvelteKit", kind: "framework" } },
-  { prefix: "@nuxt/", classification: { displayName: "Nuxt", kind: "framework" } },
-  { prefix: "@storybook/", classification: { displayName: "Storybook", kind: "library" } },
-  {
-    prefix: "@testing-library/",
-    classification: { displayName: "Testing Library", kind: "library" }
-  },
-  { prefix: "@tanstack/", classification: { displayName: "TanStack", kind: "library" } },
-  { prefix: "@wdio/", classification: { displayName: "WebdriverIO", kind: "library" } },
-  // AWS CDK v1 construct libraries are published under the @aws-cdk/ scope.
-  { prefix: "@aws-cdk/", classification: { displayName: "AWS CDK", kind: "framework" } },
-  { prefix: "@reduxjs/", classification: { displayName: "Redux", kind: "library" } },
-  { prefix: "@prisma/", classification: { displayName: "Prisma", kind: "library" } },
-  { prefix: "@apollo/", classification: { displayName: "Apollo", kind: "library" } },
-  { prefix: "@formatjs/", classification: { displayName: "formatjs", kind: "library" } },
-  { prefix: "@lingui/", classification: { displayName: "Lingui", kind: "library" } },
-  { prefix: "@emotion/", classification: { displayName: "Emotion", kind: "library" } },
-  { prefix: "@mui/", classification: { displayName: "Material UI", kind: "library" } },
-  { prefix: "@chakra-ui/", classification: { displayName: "Chakra UI", kind: "library" } },
-  {
-    prefix: "@lwc/",
-    classification: { displayName: "Lightning Web Components", kind: "platform" }
-  },
-  { prefix: "@salesforce/", classification: { displayName: "Salesforce", kind: "platform" } },
-  { prefix: "@shopify/", classification: { displayName: "Shopify", kind: "platform" } },
-  { prefix: "@aws-sdk/", classification: { displayName: "AWS SDK", kind: "library" } },
-  { prefix: "@google-cloud/", classification: { displayName: "Google Cloud", kind: "library" } },
-  { prefix: "@azure/", classification: { displayName: "Azure SDK", kind: "library" } },
-  // Groovy — Grails/GORM artifact families (build.gradle artifactIds).
-  { prefix: "grails-", classification: { displayName: "Grails", kind: "framework" } },
-  { prefix: "gorm-", classification: { displayName: "GORM", kind: "library" } },
-  // .NET — Microsoft package families and common test/logging libraries. More
-  // specific prefixes (Blazor) must precede broader ones (ASP.NET Core).
-  {
-    prefix: "Microsoft.AspNetCore.Components.WebAssembly",
-    classification: { displayName: "Blazor", kind: "framework" }
-  },
-  {
-    prefix: "Microsoft.AspNetCore.",
-    classification: { displayName: "ASP.NET Core", kind: "framework" }
-  },
-  {
-    prefix: "Microsoft.EntityFrameworkCore",
-    classification: { displayName: "Entity Framework", kind: "library" }
-  },
-  {
-    prefix: "Microsoft.Azure.Functions",
-    classification: { displayName: "Azure Functions", kind: "framework" }
-  },
-  {
-    prefix: "Microsoft.Azure.WebJobs",
-    classification: { displayName: "Azure Functions", kind: "framework" }
-  },
-  { prefix: "xunit", classification: { displayName: "xUnit", kind: "library" } },
-  { prefix: "MSTest.", classification: { displayName: "MSTest", kind: "library" } },
-  { prefix: "Serilog", classification: { displayName: "Serilog", kind: "library" } }
-];
-var MANIFEST_SCOPED_CATALOG = /* @__PURE__ */ new Map([
-  ["package.json", /* @__PURE__ */ new Map([["angular", { displayName: "AngularJS", kind: "framework" }]])]
-]);
-function classifyDependency(name, manifestBasename) {
-  if (manifestBasename) {
-    const scoped = MANIFEST_SCOPED_CATALOG.get(manifestBasename)?.get(name);
-    if (scoped) return scoped;
-  }
-  const exact = DEPENDENCY_CATALOG.get(name);
-  if (exact) return exact;
-  for (const rule of DEPENDENCY_PREFIX_RULES) {
-    if (name.startsWith(rule.prefix)) return rule.classification;
-  }
-  return void 0;
-}
-function pathBasename(filePath) {
-  return filePath.split("/").pop() ?? filePath;
-}
-var FILE_SIGNAL_RULES = [
-  {
-    name: ".flowconfig",
-    matches: (f) => pathBasename(f) === ".flowconfig",
-    classification: { displayName: "Flow", kind: "library" }
-  },
-  {
-    name: "cdk.json",
-    matches: (f) => pathBasename(f) === "cdk.json",
-    classification: { displayName: "AWS CDK", kind: "framework" }
-  },
-  {
-    name: ".meteor/release",
-    matches: (f) => f === ".meteor/release" || f.endsWith("/.meteor/release"),
-    classification: { displayName: "Meteor", kind: "framework" }
-  },
-  {
-    name: "sfdx-project.json",
-    matches: (f) => pathBasename(f) === "sfdx-project.json",
-    classification: { displayName: "Salesforce", kind: "platform" }
-  },
-  {
-    name: "lwc.config.json",
-    matches: (f) => pathBasename(f) === "lwc.config.json",
-    classification: { displayName: "Lightning Web Components", kind: "platform" }
-  },
-  {
-    name: "suitecloud.config.js",
-    matches: (f) => pathBasename(f) === "suitecloud.config.js",
-    classification: { displayName: "SuiteScript", kind: "platform" }
-  },
-  {
-    name: ".github/workflows",
-    matches: (f) => f.startsWith(".github/workflows/"),
-    classification: { displayName: "GitHub Actions", kind: "framework" }
-  },
-  {
-    name: ".circleci",
-    matches: (f) => f.startsWith(".circleci/"),
-    classification: { displayName: "CircleCI", kind: "framework" }
-  },
-  {
-    name: ".gitlab-ci.yml",
-    matches: (f) => f === ".gitlab-ci.yml" || f.startsWith(".gitlab/"),
-    classification: { displayName: "GitLab CI", kind: "framework" }
-  },
-  {
-    name: "bitbucket-pipelines.yml",
-    matches: (f) => f === "bitbucket-pipelines.yml",
-    classification: { displayName: "Bitbucket Pipelines", kind: "framework" }
-  },
-  {
-    name: "azure-pipelines.yml",
-    matches: (f) => f === "azure-pipelines.yml" || f === "azure-pipelines.yaml",
-    classification: { displayName: "Azure Pipelines", kind: "framework" }
-  }
-];
-function detectFileSignals(files) {
-  const result = [];
-  for (const rule of FILE_SIGNAL_RULES) {
-    const hit = files.find((f) => rule.matches(f));
-    if (!hit) continue;
-    result.push({
-      name: rule.name,
-      displayName: rule.classification.displayName,
-      kind: rule.classification.kind,
-      source: "file",
-      manifestFile: hit
-    });
-  }
-  return result;
-}
-var PACKAGE_JSON_SIGNAL_DISPLAY_NAMES = ["ESLint Plugin"];
-function isEslintPluginName(name) {
-  return /^eslint-plugin-/.test(name) || /^@[^/]+\/eslint-plugin(-.*)?$/.test(name);
-}
-function detectPackageJsonSignals(content) {
-  let pkg;
-  try {
-    pkg = JSON.parse(content);
-  } catch {
-    return [];
-  }
-  const name = pkg && typeof pkg.name === "string" ? pkg.name : "";
-  if (name && isEslintPluginName(name)) {
-    return [
-      {
-        name,
-        displayName: "ESLint Plugin",
-        kind: "tool",
-        source: "manifest",
-        manifestFile: "package.json"
-      }
-    ];
-  }
-  return [];
-}
-function getKnownDisplayNames() {
-  const names = /* @__PURE__ */ new Set();
-  for (const { displayName } of DEPENDENCY_CATALOG.values()) names.add(displayName);
-  for (const scoped of MANIFEST_SCOPED_CATALOG.values())
-    for (const { displayName } of scoped.values()) names.add(displayName);
-  for (const rule of DEPENDENCY_PREFIX_RULES) names.add(rule.classification.displayName);
-  for (const rule of FILE_SIGNAL_RULES) names.add(rule.classification.displayName);
-  for (const name of PACKAGE_JSON_SIGNAL_DISPLAY_NAMES) names.add(name);
-  return names;
-}
-var NOTABLE_ANY_DEPTH = /* @__PURE__ */ new Set([
-  "Dockerfile",
-  "docker-compose.yml",
-  "docker-compose.yaml",
-  "compose.yml",
-  "compose.yaml",
-  "Makefile",
-  "Justfile",
-  "pom.xml",
-  "build.gradle",
-  "build.gradle.kts",
-  "build.sbt",
-  "go.mod",
-  "Cargo.toml",
-  "Gemfile",
-  "Podfile",
-  "Package.swift",
-  "Jenkinsfile",
-  "Vagrantfile",
-  "Procfile",
-  "pubspec.yaml",
-  "mix.exs",
-  "shard.yml",
-  "packages.config",
-  "Directory.Packages.props"
-]);
-var NOTABLE_ROOT_ONLY = /* @__PURE__ */ new Set([
-  ".dockerignore",
-  "Taskfile.yml",
-  "Rakefile",
-  "Gruntfile.js",
-  "Gulpfile.js",
-  "settings.gradle",
-  "settings.gradle.kts",
-  "go.sum",
-  "Cargo.lock",
-  "CLAUDE.md",
-  "AGENTS.md",
-  "agents.md",
-  ".cursorrules",
-  "copilot-instructions.md",
-  ".travis.yml",
-  ".gitlab-ci.yml",
-  "azure-pipelines.yml",
-  "bitbucket-pipelines.yml",
-  "appveyor.yml",
-  "package.json",
-  "requirements.txt",
-  "pyproject.toml",
-  "Pipfile",
-  "composer.json",
-  "tsconfig.json",
-  "jsconfig.json",
-  "serverless.yml",
-  "serverless.yaml",
-  "cdk.json",
-  "pulumi.yaml",
-  "README.md",
-  "CHANGELOG.md",
-  "CONTRIBUTING.md",
-  "LICENSE",
-  "renovate.json",
-  ".nvmrc",
-  ".node-version",
-  ".python-version",
-  ".ruby-version",
-  ".tool-versions"
-]);
-var NOTABLE_PATH_PREFIXES = [".github/workflows/", ".circleci/", ".gitlab/"];
-var CONFIG_HEURISTIC_PATTERNS = [
-  /^\..*rc$/,
-  // .eslintrc, .prettierrc, etc.
-  /^\..*rc\.(json|js|cjs|mjs|yml|yaml|ts)$/,
-  // .eslintrc.json, etc.
-  /^.*\.config\.(js|ts|mjs|cjs)$/,
-  // vite.config.ts, jest.config.js, etc.
-  /^\.env(\..+)?$/
-  // .env, .env.local, .env.production
-];
-function isNotableFile(filePath) {
-  const basename = filePath.split("/").pop() ?? filePath;
-  const isRoot = !filePath.includes("/");
-  if (NOTABLE_ANY_DEPTH.has(basename)) return true;
-  if (isRoot && NOTABLE_ROOT_ONLY.has(basename)) return true;
-  if (/\.(csproj|vbproj|fsproj|sln)$/i.test(basename)) return true;
-  for (const prefix of NOTABLE_PATH_PREFIXES) {
-    if (filePath.startsWith(prefix)) return true;
-  }
-  if (!filePath.includes("/")) {
-    for (const pattern of CONFIG_HEURISTIC_PATTERNS) {
-      if (pattern.test(basename)) return true;
-    }
-  }
-  return false;
-}
+// src/discover/classify.ts
+var import_tooling6 = require("@codacy/tooling");
+
+// src/discover/ecosystems/npm.ts
 function parsePackageJson(content) {
   try {
     const pkg = JSON.parse(content);
@@ -2976,18 +2359,236 @@ function parsePackageJson(content) {
     return [];
   }
 }
+var TELLTALES = [
+  // --- Frameworks ---
+  ["react", "react"],
+  ["react-dom", "react-dom"],
+  ["react-native", "react-native"],
+  ["vue", "vue"],
+  ["nuxt", "nuxt"],
+  ["@angular/core", "angular"],
+  ["svelte", "svelte"],
+  ["@sveltejs/kit", "sveltekit"],
+  ["next", "next"],
+  ["ember-source", "ember"],
+  ["lit", "lit"],
+  ["solid-js", "solid"],
+  ["astro", "astro"],
+  ["@builder.io/qwik", "qwik"],
+  ["@builder.io/qwik-city", "qwik"],
+  ["@remix-run/react", "remix"],
+  ["gatsby", "gatsby"],
+  ["preact", "preact"],
+  ["express", "express"],
+  ["@nestjs/core", "nestjs"],
+  ["fastify", "fastify"],
+  ["koa", "koa"],
+  ["@hapi/hapi", "hapi"],
+  ["hono", "hono"],
+  ["electron", "electron"],
+  // AWS CDK — the v2 umbrella package `aws-cdk-lib`, the CLI package `aws-cdk`,
+  // and the v1 `@aws-cdk/*` construct packages (a prefix rule).
+  ["aws-cdk-lib", "aws-cdk"],
+  ["aws-cdk", "aws-cdk"],
+  // The v2 SDK is one flat package; v3 is the scoped `@aws-sdk/*` family, which a
+  // prefix rule below covers. Both mean "this code calls AWS".
+  ["aws-sdk", "aws-sdk"],
+  // --- Libraries ---
+  ["lodash", "lodash"],
+  ["underscore", "underscore"],
+  ["ramda", "ramda"],
+  ["jest", "jest"],
+  ["vitest", "vitest"],
+  ["@playwright/test", "playwright"],
+  ["playwright", "playwright"],
+  ["puppeteer", "puppeteer"],
+  ["puppeteer-core", "puppeteer"],
+  ["cypress", "cypress"],
+  ["mocha", "mocha"],
+  ["ava", "ava"],
+  ["jasmine", "jasmine"],
+  ["jasmine-core", "jasmine"],
+  ["@testing-library/react", "testing-library"],
+  ["@testing-library/vue", "testing-library"],
+  ["@testing-library/dom", "testing-library"],
+  ["tailwindcss", "tailwind-css"],
+  ["@storybook/react", "storybook"],
+  ["@storybook/vue3", "storybook"],
+  ["@storybook/svelte", "storybook"],
+  ["redux", "redux"],
+  ["@reduxjs/toolkit", "redux-toolkit"],
+  ["mobx", "mobx"],
+  ["zustand", "zustand"],
+  ["axios", "axios"],
+  ["date-fns", "date-fns"],
+  ["dayjs", "dayjs"],
+  ["moment", "moment"],
+  ["rxjs", "rxjs"],
+  ["zod", "zod"],
+  ["joi", "joi"],
+  ["yup", "yup"],
+  ["prisma", "prisma"],
+  ["@prisma/client", "prisma"],
+  ["typeorm", "typeorm"],
+  ["sequelize", "sequelize"],
+  ["drizzle-orm", "drizzle-orm"],
+  ["mongoose", "mongoose"],
+  ["graphql", "graphql"],
+  ["@apollo/client", "apollo-client"],
+  ["socket.io", "socketio"],
+  ["jquery", "jquery"],
+  ["mongodb", "mongodb"],
+  ["three", "threejs"],
+  ["d3", "d3"],
+  ["chart.js", "chartjs"],
+  ["sass", "sass"],
+  ["node-sass", "sass"],
+  ["less", "less"],
+  ["styled-components", "styled-components"],
+  ["@emotion/react", "emotion"],
+  ["pino", "pino"],
+  ["winston", "winston"],
+  ["i18next", "i18next"],
+  // react-intl is the React binding of the FormatJS ecosystem; eslint-plugin-formatjs
+  // lints both, so we report the umbrella name "formatjs" (matches the mapping key).
+  ["react-intl", "formatjs"],
+  ["vue-i18n", "vue-i18n"],
+  ["next-intl", "next-intl"],
+  // Type checker (eslint-plugin-flowtype). Also detected via a `.flowconfig` file.
+  ["flow-bin", "flow"],
+  // Legacy JS libraries with dedicated ESLint plugins.
+  ["backbone", "backbone"],
+  ["chai", "chai"],
+  ["codeceptjs", "codeceptjs"],
+  ["webdriverio", "webdriverio"],
+  ["react-relay", "relay"],
+  ["relay-runtime", "relay"],
+  // --- Tools ---
+  ["typescript", "typescript"],
+  ["eslint", "eslint"],
+  ["prettier", "prettier"],
+  ["webpack", "webpack"],
+  ["vite", "vite"],
+  ["esbuild", "esbuild"],
+  ["rollup", "rollup"],
+  ["turbo", "turborepo"],
+  ["tsup", "tsup"],
+  ["@biomejs/biome", "biome"],
+  ["stylelint", "stylelint"],
+  // --- Platforms ---
+  ["@lwc/engine-dom", "lightning-web-components"],
+  ["@salesforce/core", "salesforce"],
+  ["@shopify/polaris", "shopify-polaris"],
+  // The npm `angular` package is AngularJS 1.x — a different framework from both
+  // modern Angular (the `@angular/*` scope) and pub's AngularDart. One global
+  // name-keyed catalog could not hold all three; three entities can.
+  ["angular", "angular-js"]
+];
+var PREFIXES = [
+  ["@angular/", "angular"],
+  ["@nestjs/", "nestjs"],
+  ["@remix-run/", "remix"],
+  ["@sveltejs/", "sveltekit"],
+  ["@nuxt/", "nuxt"],
+  ["@storybook/", "storybook"],
+  ["@testing-library/", "testing-library"],
+  ["@tanstack/", "tanstack"],
+  ["@wdio/", "webdriverio"],
+  // AWS CDK v1 construct libraries are published under the @aws-cdk/ scope.
+  ["@aws-cdk/", "aws-cdk"],
+  ["@reduxjs/", "redux"],
+  ["@prisma/", "prisma"],
+  ["@apollo/", "apollo"],
+  ["@formatjs/", "formatjs"],
+  ["@lingui/", "lingui"],
+  ["@emotion/", "emotion"],
+  ["@mui/", "material-ui"],
+  ["@chakra-ui/", "chakra-ui"],
+  ["@lwc/", "lightning-web-components"],
+  ["@salesforce/", "salesforce"],
+  ["@shopify/", "shopify"],
+  ["@aws-sdk/", "aws-sdk"],
+  ["@google-cloud/", "google-cloud"],
+  ["@azure/", "azure-sdk"]
+];
+var npm = {
+  id: "npm",
+  manifests: [{ basename: "package.json", parser: parsePackageJson }],
+  telltales: TELLTALES,
+  prefixes: PREFIXES
+};
+
+// src/discover/ecosystems/pypi.ts
+function parseRequirementLine(rawLine) {
+  const line = rawLine.trim();
+  if (!line || line.startsWith("#") || line.startsWith("-")) return void 0;
+  const noComment = line.split("#")[0].trim();
+  if (!noComment) return void 0;
+  const match = noComment.match(/^([a-zA-Z0-9_.-]+(?:\[[^\]]*\])?)\s*([<>=!~@;].*)?$/);
+  if (!match) return void 0;
+  const rawName = match[1].replace(/\[.*\]$/, "");
+  return { name: rawName.toLowerCase().replace(/_/g, "-"), version: match[2]?.trim() };
+}
 function parseRequirementsTxt(content) {
   const deps = [];
   for (const rawLine of content.split("\n")) {
-    const line = rawLine.trim();
-    if (!line || line.startsWith("#") || line.startsWith("-")) continue;
-    const noComment = line.split("#")[0].trim();
-    if (!noComment) continue;
-    const match = noComment.match(/^([a-zA-Z0-9_.-]+(?:\[[^\]]*\])?)\s*([<>=!~@;].*)?$/);
-    if (match) {
-      const rawName = match[1].replace(/\[.*\]$/, "");
-      const normalized = rawName.toLowerCase().replace(/_/g, "-");
-      deps.push({ name: normalized, version: match[2]?.trim() });
+    const dep = parseRequirementLine(rawLine);
+    if (dep) deps.push(dep);
+  }
+  return deps;
+}
+function sliceBalanced(content, fromIndex, open, close) {
+  const start = content.indexOf(open, fromIndex);
+  if (start === -1) return void 0;
+  let depth = 0;
+  let quote;
+  for (let i = start; i < content.length; i++) {
+    const ch = content[i];
+    if (quote) {
+      if (ch === "\\") i++;
+      else if (ch === quote) quote = void 0;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    if (ch === open) depth++;
+    else if (ch === close && --depth === 0) {
+      return { body: content.slice(start + 1, i), endIndex: i };
+    }
+  }
+  return void 0;
+}
+function parseSetupPy(content) {
+  const deps = [];
+  const collectQuoted = (block) => {
+    for (const quoted of block.matchAll(/["']([^"']+)["']/g)) {
+      const dep = parseRequirementLine(quoted[1]);
+      if (dep) deps.push(dep);
+    }
+  };
+  const valueStartOf = (key) => {
+    const match = new RegExp(`\\b${key}\\s*=\\s*`).exec(content);
+    return match ? match.index + match[0].length : -1;
+  };
+  for (const key of ["install_requires", "tests_require", "setup_requires"]) {
+    const start = valueStartOf(key);
+    if (start === -1 || content[start] !== "[") continue;
+    const list = sliceBalanced(content, start, "[", "]");
+    if (list) collectQuoted(list.body);
+  }
+  const extrasStart = valueStartOf("extras_require");
+  if (extrasStart !== -1 && content[extrasStart] === "{") {
+    const dict = sliceBalanced(content, extrasStart, "{", "}");
+    if (dict) {
+      let cursor = 0;
+      while (cursor < dict.body.length) {
+        const list = sliceBalanced(dict.body, cursor, "[", "]");
+        if (!list) break;
+        collectQuoted(list.body);
+        cursor = list.endIndex + 1;
+      }
     }
   }
   return deps;
@@ -3048,6 +2649,107 @@ function parsePipfile(content) {
   }
   return deps;
 }
+var TELLTALES2 = [
+  // --- Frameworks ---
+  ["django", "django"],
+  ["flask", "flask"],
+  ["fastapi", "fastapi"],
+  ["tornado", "tornado"],
+  ["pyramid", "pyramid"],
+  ["starlette", "starlette"],
+  ["sanic", "sanic"],
+  ["bottle", "bottle"],
+  ["streamlit", "streamlit"],
+  ["gradio", "gradio"],
+  ["apache-airflow", "airflow"],
+  // --- Libraries ---
+  ["flask-babel", "flask-babel"],
+  ["pytest", "pytest"],
+  ["numpy", "numpy"],
+  ["pandas", "pandas"],
+  ["requests", "requests"],
+  ["sqlalchemy", "sqlalchemy"],
+  ["celery", "celery"],
+  ["pydantic", "pydantic"],
+  ["boto3", "boto3"],
+  // `botocore` is boto3's transport layer and `aws-lambda-powertools` depends on
+  // it; either declared alone still means "this is AWS code". Lambda runtimes
+  // preinstall boto3, so it is routinely absent from requirements.txt.
+  ["botocore", "boto3"],
+  ["aws-lambda-powertools", "boto3"],
+  ["scipy", "scipy"],
+  ["scikit-learn", "scikit-learn"],
+  ["tensorflow", "tensorflow"],
+  ["torch", "pytorch"],
+  ["httpx", "httpx"],
+  ["aiohttp", "aiohttp"],
+  ["pillow", "pillow"],
+  ["beautifulsoup4", "beautiful-soup"],
+  ["scrapy", "scrapy"],
+  ["alembic", "alembic"],
+  ["marshmallow", "marshmallow"],
+  ["click", "click"],
+  ["typer", "typer"],
+  ["rich", "rich"],
+  ["polars", "polars"],
+  ["dask", "dask"],
+  ["matplotlib", "matplotlib"],
+  ["seaborn", "seaborn"],
+  ["plotly", "plotly"],
+  ["jinja2", "jinja2"],
+  ["mako", "mako"],
+  ["lxml", "lxml"],
+  ["pyyaml", "pyyaml"],
+  ["paramiko", "paramiko"],
+  ["twilio", "twilio"],
+  // Structured-concurrency libraries. Ruff's `ASYNC1xx` rules are written against
+  // trio's checkpoint model and anyio implements the same one, so either gates them.
+  ["trio", "trio"],
+  ["anyio", "anyio"],
+  // The two crypto packages are distinct projects with distinct Bandit checks
+  // (`B413` imports PyCrypto, `B414` PyCryptodome), so they must not be merged.
+  // `pycryptodomex` is the same project published under its `Cryptodome` namespace.
+  ["pycrypto", "pycrypto"],
+  ["pycryptodome", "pycryptodome"],
+  ["pycryptodomex", "pycryptodome"],
+  // `pysnmp` was renamed to `pysnmplib` for part of its history; both are the
+  // library Bandit's `B508`/`B509` weak-SNMP checks apply to.
+  ["pysnmp", "pysnmp"],
+  ["pysnmplib", "pysnmp"],
+  // MongoDB drivers, one entry per ecosystem — they all gate the same
+  // MongoDB-specific patterns (Opengrep's `java.mongodb.`/`python.pymongo.`).
+  ["pymongo", "mongodb"],
+  ["motor", "mongodb"],
+  // --- Tools ---
+  ["black", "black"],
+  ["ruff", "ruff"],
+  ["mypy", "mypy"],
+  ["pylint", "pylint"],
+  ["flake8", "flake8"],
+  ["bandit", "bandit"],
+  ["isort", "isort"]
+];
+var pypi = {
+  id: "pypi",
+  manifests: [
+    { basename: "requirements.txt", parser: parseRequirementsTxt },
+    { basename: "pyproject.toml", parser: parsePyprojectToml },
+    { basename: "Pipfile", parser: parsePipfile },
+    { basename: "setup.py", parser: parseSetupPy },
+    {
+      // The requirements family, by path: real projects split it by environment
+      // (`requirements-dev.txt`, `requirements/base.txt`, `requirements.in` for
+      // pip-tools). Matching only the exact name made every dependency of a split
+      // layout invisible, and with it the gating for Django, Flask, FastAPI,
+      // pytest, pandas and NumPy patterns.
+      matches: (filePath, basename) => /^requirements[a-zA-Z0-9_.-]*\.(txt|in)$/i.test(basename) || /(^|\/)requirements\/[^/]+\.(txt|in)$/i.test(filePath),
+      parser: parseRequirementsTxt
+    }
+  ],
+  telltales: TELLTALES2
+};
+
+// src/discover/ecosystems/gem.ts
 function parseGemfile(content) {
   const deps = [];
   const gemRegex = /^\s*gem\s+["']([^"']+)["'](?:\s*,\s*["']([^"']+)["'])?/gm;
@@ -3057,63 +2759,339 @@ function parseGemfile(content) {
   }
   return deps;
 }
-function parseMixExs(content) {
+var TELLTALES3 = [
+  // --- Frameworks ---
+  ["rails", "ruby-on-rails"],
+  ["sinatra", "sinatra"],
+  ["hanami", "hanami"],
+  ["grape", "grape"],
+  ["padrino", "padrino"],
+  // --- Libraries ---
+  ["rspec", "rspec"],
+  ["rspec-core", "rspec"],
+  ["rspec-rails", "rspec-rails"],
+  ["capybara", "capybara"],
+  ["sidekiq", "sidekiq"],
+  ["devise", "devise"],
+  ["pundit", "pundit"],
+  ["activeadmin", "activeadmin"],
+  ["puma", "puma"],
+  ["nokogiri", "nokogiri"],
+  ["faraday", "faraday"],
+  ["httparty", "httparty"],
+  ["minitest", "minitest"],
+  ["factory_bot", "factorybot"],
+  ["dry-validation", "dry-validation"],
+  // --- Tools ---
+  ["rubocop", "rubocop"],
+  ["bundler", "bundler"],
+  // Sorbet ships as several gems; any of them means the project is Sorbet-typed.
+  ["sorbet", "sorbet"],
+  ["sorbet-runtime", "sorbet"],
+  ["sorbet-static", "sorbet"],
+  ["sorbet-static-and-runtime", "sorbet"],
+  ["solargraph", "solargraph"],
+  // GetText, under both the plain gem and its Rails integration. RuboCop's
+  // `I18n_GetText_*` cops rewrite `_()`-decorated strings, so they only apply to a
+  // project that actually uses GetText rather than Rails' own I18n.
+  ["gettext", "gettext"],
+  ["gettext_i18n_rails", "gettext"],
+  ["rubocop-i18n", "gettext"],
+  // --- Names other registries also publish ---
+  // `faker`, `rake` and `graphql` all exist on npm and PyPI too, and all three
+  // gate RuboCop cops. Reaching them only from a Gemfile is the whole point of
+  // scoping by ecosystem — a JS dependency must not enable Ruby cops.
+  ["faker", "faker"],
+  ["rake", "rake"],
+  ["graphql", "graphql"]
+];
+var gem = {
+  id: "gem",
+  manifests: [{ basename: "Gemfile", parser: parseGemfile }],
+  telltales: TELLTALES3
+};
+
+// src/discover/ecosystems/maven.ts
+function parsePomXml(content) {
   const deps = [];
-  const depRegex = /\{:([a-zA-Z_][a-zA-Z0-9_]*)\s*,\s*"([^"]*)"/g;
+  const depRegex = /<dependency>[\s\S]*?<artifactId>([^<]+)<\/artifactId>[\s\S]*?<\/dependency>/g;
   let match;
   while ((match = depRegex.exec(content)) !== null) {
-    deps.push({ name: match[1], version: match[2] || void 0 });
+    deps.push({ name: match[1].trim() });
   }
   return deps;
 }
-function parseGoMod(content) {
+function parseBuildGradle(content) {
   const deps = [];
-  const singleRegex = /^require\s+(\S+)\s+(\S+)/gm;
+  const depRegex = /(?:implementation|testImplementation|testCompileOnly|testRuntimeOnly|api|compileOnly|runtimeOnly|kapt|annotationProcessor)\s*(?:\(\s*)?["']([^"':]+):([^"':]+)(?::([^"']+))?["']/g;
   let match;
-  while ((match = singleRegex.exec(content)) !== null) {
-    if (!match[1].startsWith("(")) {
-      deps.push({ name: match[1], version: match[2] });
-    }
+  while ((match = depRegex.exec(content)) !== null) {
+    deps.push({ name: match[2].trim(), version: match[3]?.trim() });
   }
-  const blockRegex = /require\s*\(([\s\S]*?)\)/g;
-  while ((match = blockRegex.exec(content)) !== null) {
-    const lines = match[1].split("\n");
-    for (const line of lines) {
-      const m = line.trim().match(/^(\S+)\s+(\S+)/);
-      if (m && !m[1].startsWith("//")) {
-        deps.push({ name: m[1], version: m[2] });
-      }
+  return deps;
+}
+function parseVersionCatalogToml(content) {
+  const deps = [];
+  let inLibraries = false;
+  for (const rawLine of content.split("\n")) {
+    const line = rawLine.trim();
+    if (line === "" || line.startsWith("#")) continue;
+    if (line.startsWith("[")) {
+      inLibraries = /^\[\s*libraries\s*\]/.test(line);
+      continue;
+    }
+    if (!inLibraries) continue;
+    const moduleMatch = line.match(/\bmodule\s*=\s*["'][^"':]+:([^"']+)["']/);
+    const nameMatch = line.match(/\bname\s*=\s*["']([^"']+)["']/);
+    const versionMatch = line.match(/\bversion\s*=\s*["']([^"']+)["']/);
+    if (moduleMatch || nameMatch) {
+      deps.push({
+        name: (moduleMatch?.[1] ?? nameMatch?.[1] ?? "").trim(),
+        version: versionMatch?.[1]?.trim()
+      });
+      continue;
+    }
+    const shorthand = line.match(/^[A-Za-z0-9_.-]+\s*=\s*["'][^"':]+:([^"':]+)(?::([^"']+))?["']/);
+    if (shorthand) {
+      deps.push({ name: shorthand[1].trim(), version: shorthand[2]?.trim() });
     }
   }
   return deps;
 }
-function parsePomXml(content) {
+function parseBuildSbt(content) {
   const deps = [];
-  const depRegex = /<dependency>[\s\S]*?<artifactId>([^<]+)<\/artifactId>[\s\S]*?<\/dependency>/g;
+  const depRegex = /"([^"]+)"\s*%%?\s*"([^"]+)"\s*%(?!%)\s*(?:"([^"]+)")?/g;
   let match;
   while ((match = depRegex.exec(content)) !== null) {
-    deps.push({ name: match[1].trim() });
+    deps.push({ name: match[2], version: match[3] });
   }
   return deps;
 }
-function parseBuildGradle(content) {
-  const deps = [];
-  const depRegex = /(?:implementation|testImplementation|api|compileOnly|runtimeOnly|kapt|annotationProcessor)\s*(?:\(\s*)?["']([^"':]+):([^"':]+)(?::([^"']+))?["']/g;
+function parseSbtBuildDefinition(content) {
+  const deps = parseBuildSbt(content);
+  const pluginRegex = /addSbtPlugin\s*\(\s*"([^"]+)"\s*%%?\s*"([^"]+)"/g;
   let match;
-  while ((match = depRegex.exec(content)) !== null) {
-    deps.push({ name: match[2].trim(), version: match[3]?.trim() });
+  while ((match = pluginRegex.exec(content)) !== null) {
+    deps.push({ name: `${match[1]}:${match[2]}` });
   }
   return deps;
 }
-function parseBuildSbt(content) {
+var TELLTALES4 = [
+  // --- Java / Kotlin — Frameworks ---
+  ["spring-boot-starter", "spring-boot"],
+  ["spring-boot-starter-web", "spring-boot"],
+  ["spring-core", "spring-framework"],
+  ["quarkus-core", "quarkus"],
+  ["micronaut-core", "micronaut"],
+  ["ktor-server-core", "ktor"],
+  ["android", "android-sdk"],
+  // --- Java / Kotlin — Libraries ---
+  ["junit-jupiter", "junit-5"],
+  ["junit", "junit"],
+  ["junit-jupiter-api", "junit-5"],
+  // Spring Boot's test starter is the single most common Java test declaration and
+  // pulls JUnit 5 transitively; without it PMD's JUnit rules are unreachable for
+  // most Spring projects. The `junit-jupiter-`/`junit-platform-` prefixes below
+  // cover `-engine`/`-params`/`-launcher`, which Gradle declares separately.
+  ["spring-boot-starter-test", "junit-5"],
+  ["mockito-core", "mockito"],
+  ["lombok", "lombok"],
+  ["jackson-databind", "jackson"],
+  ["jackson-core", "jackson"],
+  ["hibernate-core", "hibernate"],
+  ["guava", "guava"],
+  ["commons-lang3", "apache-commons-lang"],
+  ["commons-io", "apache-commons-io"],
+  ["commons-logging", "apache-commons-logging"],
+  ["commons-fileupload", "apache-commons-fileupload"],
+  ["commons-fileupload2-core", "apache-commons-fileupload"],
+  // The EJB/Jakarta EE API jars, under every name they have shipped as. PMD's
+  // session-bean naming and static-field rules only mean anything with these on
+  // the classpath.
+  ["jakarta.ejb-api", "jakarta-ee"],
+  ["javax.ejb-api", "jakarta-ee"],
+  ["jakarta.jakartaee-api", "jakarta-ee"],
+  ["jakarta.jakartaee-web-api", "jakarta-ee"],
+  ["javaee-api", "jakarta-ee"],
+  ["javaee-web-api", "jakarta-ee"],
+  ["slf4j-api", "slf4j"],
+  ["log4j-core", "log4j"],
+  ["logback-classic", "logback"],
+  ["testng", "testng"],
+  ["assertj-core", "assertj"],
+  ["gson", "gson"],
+  ["okhttp", "okhttp"],
+  ["retrofit", "retrofit"],
+  ["spock-core", "spock"],
+  ["mongodb-driver-sync", "mongodb"],
+  ["mongodb-driver-core", "mongodb"],
+  ["mongodb-driver-reactivestreams", "mongodb"],
+  ["mongo-java-driver", "mongodb"],
+  // --- Groovy — Frameworks ---
+  // Grails/GORM artifact IDs vary (grails-core, grails-web, gorm-hibernate5, …);
+  // the `grails-`/`gorm-` prefix rules catch the rest.
+  ["grails-core", "grails"],
+  ["gorm-core", "grails-gorm"],
+  // --- Scala — Frameworks ---
+  // Play is declared as an sbt *plugin*, so `group:artifact` (from
+  // `addSbtPlugin`) is the reliable signal; the library artifacts that follow only
+  // appear in some builds. `play-json` is deliberately absent — it is a
+  // standalone JSON library used widely outside Play.
+  ["com.typesafe.play:sbt-plugin", "play-framework"],
+  ["org.playframework:sbt-plugin", "play-framework"],
+  ["play", "play-framework"],
+  ["play-server", "play-framework"],
+  ["play-ws", "play-framework"],
+  ["play-test", "play-framework"],
+  ["play-slick", "play-framework"],
+  ["twirl-api", "play-framework"],
+  ["scalatestplus-play", "play-framework"],
+  ["akka-actor", "akka"],
+  ["spray-can", "spray"],
+  // --- Scala — Libraries ---
+  ["scalatest", "scalatest"],
+  ["specs2-core", "specs2"],
+  ["cats-core", "cats"],
+  ["circe-core", "circe"],
+  // Slick gates Opengrep's `scala.slick.` SQL-injection patterns.
+  ["slick", "slick"],
+  ["slick-hikaricp", "slick"],
+  // jwt-scala publishes one artifact per JSON backend; all gate the same
+  // hardcoded-secret patterns.
+  ["jwt-core", "jwt-scala"],
+  ["jwt-circe", "jwt-scala"],
+  ["jwt-play-json", "jwt-scala"],
+  ["jwt-json4s", "jwt-scala"],
+  ["jwt-spray-json", "jwt-scala"],
+  ["jwt-upickle", "jwt-scala"],
+  ["jwt-argonaut", "jwt-scala"],
+  ["munit", "munit"],
+  ["scalacheck", "scalacheck"],
+  ["scala-logging", "scala-logging"],
+  ["chimney", "chimney"],
+  // --- WebJars — front-end libraries republished to Maven Central ---
+  // A JVM web app serves its JavaScript from a WebJar instead of from npm, so
+  // `"org.webjars" % "jquery"` is real evidence of jQuery in the repo — and jQuery
+  // gates Opengrep's `javascript.jquery.` rules. This is the one place where an
+  // entity legitimately belongs to two registries, and dropping it was the only
+  // recall loss the before/after sweep over local repos turned up (codacy-website).
+  // The parsers emit bare artifact ids, so the `org.webjars` group is not visible
+  // here; nothing else on Maven Central is named after a front-end library, so
+  // matching the artifact alone is safe.
+  ["jquery", "jquery"]
+];
+var PREFIXES2 = [
+  // Kotlin — coroutines ships one artifact per target (`-core`, `-android`,
+  // `-test`, `-jdk8`, `-reactive`, …) and any of them means the project uses
+  // coroutines, which is what detekt's `coroutines` rules gate on.
+  ["kotlinx-coroutines-", "kotlinx-coroutines"],
+  // JUnit 5 ships one artifact per role (`-engine`, `-params`, `-launcher`), and
+  // Gradle builds declare them separately from `junit-jupiter` itself.
+  ["junit-jupiter-", "junit-5"],
+  ["junit-platform-", "junit-5"],
+  // A modern Android project declares `androidx.*`, never the deprecated
+  // `com.google.android:android` jar the exact telltale matches.
+  ["androidx-", "android-sdk"],
+  ["androidx.", "android-sdk"],
+  // Groovy — Grails/GORM artifact families (build.gradle artifactIds).
+  ["grails-", "grails"],
+  ["gorm-", "grails-gorm"],
+  // Scala — artifact families published one module per feature (sbt artifactIds).
+  // Enumerating members would go stale on every release; the prefixes are
+  // distinctive enough not to collide with other ecosystems.
+  ["http4s-", "http4s"],
+  ["akka-", "akka"],
+  ["pekko-", "pekko"],
+  ["zio-", "zio"],
+  // Must precede any broader `cats-` rule: cats-effect is its own project.
+  ["cats-effect", "cats-effect"],
+  ["doobie-", "doobie"],
+  ["fs2-", "fs2"],
+  ["circe-", "circe"],
+  ["pureconfig", "pureconfig"],
+  ["kamon-", "kamon"],
+  ["flyway-", "flyway"],
+  ["testcontainers-scala", "testcontainers"]
+];
+var maven = {
+  id: "maven",
+  manifests: [
+    { basename: "pom.xml", parser: parsePomXml },
+    { basename: "build.gradle", parser: parseBuildGradle },
+    { basename: "build.gradle.kts", parser: parseBuildGradle },
+    { basename: "libs.versions.toml", parser: parseVersionCatalogToml },
+    { basename: "build.sbt", parser: parseBuildSbt },
+    {
+      // sbt build definition: `project/Dependencies.scala`, `project/plugins.sbt`
+      // and the meta-build's own `project/project/*`. Matching by directory rather
+      // than basename is what this rule exists for — the Scala file can be called
+      // anything, and `*.scala` on its own is source code, not a manifest.
+      //
+      // Case-sensitive deliberately: sbt's directory is always lowercase `project`,
+      // while `Project` is an ordinary domain-package name, and reading
+      // `…/domain/Project/Project.scala` as a manifest would be wrong.
+      matches: (filePath) => /(^|\/)project\/[^/]+\.(scala|sbt)$/.test(filePath),
+      parser: parseSbtBuildDefinition
+    }
+  ],
+  telltales: TELLTALES4,
+  prefixes: PREFIXES2
+};
+
+// src/discover/ecosystems/golang.ts
+function parseGoMod(content) {
   const deps = [];
-  const depRegex = /"([^"]+)"\s*%%?\s*"([^"]+)"\s*%\s*"([^"]+)"/g;
+  const singleRegex = /^require\s+(\S+)\s+(\S+)/gm;
   let match;
-  while ((match = depRegex.exec(content)) !== null) {
-    deps.push({ name: match[2], version: match[3] });
+  while ((match = singleRegex.exec(content)) !== null) {
+    if (!match[1].startsWith("(")) {
+      deps.push({ name: match[1], version: match[2] });
+    }
+  }
+  const blockRegex = /require\s*\(([\s\S]*?)\)/g;
+  while ((match = blockRegex.exec(content)) !== null) {
+    const lines = match[1].split("\n");
+    for (const line of lines) {
+      const m = line.trim().match(/^(\S+)\s+(\S+)/);
+      if (m && !m[1].startsWith("//")) {
+        deps.push({ name: m[1], version: m[2] });
+      }
+    }
   }
   return deps;
 }
+var TELLTALES5 = [
+  // --- Frameworks ---
+  ["github.com/gin-gonic/gin", "gin"],
+  ["github.com/labstack/echo", "echo"],
+  ["github.com/gofiber/fiber", "fiber"],
+  ["github.com/go-chi/chi", "chi"],
+  ["github.com/gorilla/mux", "gorilla-mux"],
+  ["github.com/beego/beego", "beego"],
+  // --- Libraries ---
+  ["github.com/stretchr/testify", "testify"],
+  ["github.com/spf13/cobra", "cobra"],
+  ["github.com/spf13/viper", "viper"],
+  ["go.uber.org/zap", "zap"],
+  ["github.com/sirupsen/logrus", "logrus"],
+  ["gorm.io/gorm", "go-gorm"],
+  ["github.com/go-kit/kit", "go-kit"],
+  ["google.golang.org/protobuf", "protocol-buffers"],
+  ["google.golang.org/grpc", "grpc"],
+  ["github.com/jackc/pgx", "pgx"],
+  ["github.com/redis/go-redis", "go-redis"],
+  // v1 is still widely deployed; both gate Opengrep's AWS Lambda packs.
+  ["github.com/aws/aws-sdk-go", "aws-sdk-go"],
+  ["github.com/aws/aws-sdk-go-v2", "aws-sdk-go"],
+  ["github.com/prometheus/client_golang", "prometheus-client"]
+];
+var golang = {
+  id: "golang",
+  manifests: [{ basename: "go.mod", parser: parseGoMod }],
+  telltales: TELLTALES5
+};
+
+// src/discover/ecosystems/cargo.ts
 function parseCargoToml(content) {
   const deps = [];
   let inDepsSection = false;
@@ -3137,6 +3115,32 @@ function parseCargoToml(content) {
   }
   return deps;
 }
+var TELLTALES6 = [
+  // --- Frameworks ---
+  ["actix-web", "actix-web"],
+  ["axum", "axum"],
+  ["rocket", "rocket"],
+  ["warp", "warp"],
+  ["tauri", "tauri"],
+  // --- Libraries ---
+  ["tokio", "tokio"],
+  ["serde", "serde"],
+  ["clap", "clap"],
+  ["reqwest", "reqwest"],
+  ["diesel", "diesel"],
+  ["sqlx", "sqlx"],
+  ["tracing", "tracing"],
+  ["anyhow", "anyhow"],
+  ["thiserror", "thiserror"],
+  ["rayon", "rayon"]
+];
+var cargo = {
+  id: "cargo",
+  manifests: [{ basename: "Cargo.toml", parser: parseCargoToml }],
+  telltales: TELLTALES6
+};
+
+// src/discover/ecosystems/composer.ts
 function parseComposerJson(content) {
   try {
     const pkg = JSON.parse(content);
@@ -3155,6 +3159,182 @@ function parseComposerJson(content) {
     return [];
   }
 }
+var TELLTALES7 = [
+  // --- Frameworks ---
+  ["laravel/framework", "laravel"],
+  ["symfony/framework-bundle", "symfony"],
+  ["symfony/symfony", "symfony"],
+  ["codeigniter4/framework", "codeigniter"],
+  ["slim/slim", "slim"],
+  ["cakephp/cakephp", "cakephp"],
+  // WordPress is rarely a real Composer dependency; these are the common
+  // "WordPress as a dependency" packages used by Bedrock/Composer-based sites.
+  ["johnpbloch/wordpress-core", "wordpress"],
+  ["johnpbloch/wordpress", "wordpress"],
+  ["roots/wordpress", "wordpress"],
+  ["drupal/core", "drupal"],
+  ["drupal/core-recommended", "drupal"],
+  ["magento/product-community-edition", "magento"],
+  ["magento/product-enterprise-edition", "magento"],
+  ["magento/framework", "magento"],
+  // --- Libraries ---
+  ["phpunit/phpunit", "phpunit"],
+  ["guzzlehttp/guzzle", "guzzle"],
+  ["monolog/monolog", "monolog"],
+  ["nesbot/carbon", "carbon"],
+  ["doctrine/orm", "doctrine-orm"],
+  ["doctrine/dbal", "doctrine-dbal"],
+  ["league/flysystem", "flysystem"],
+  ["php-amqplib/php-amqplib", "php-amqplib"],
+  ["predis/predis", "predis"],
+  // --- Tools ---
+  ["phpstan/phpstan", "phpstan"],
+  ["squizlabs/php_codesniffer", "php-codesniffer"]
+];
+var composer = {
+  id: "composer",
+  manifests: [{ basename: "composer.json", parser: parseComposerJson }],
+  telltales: TELLTALES7
+};
+
+// src/discover/ecosystems/nuget.ts
+function parseXmlDependencyElements(content, elementRegex, nameAttr) {
+  const deps = [];
+  const nameRegex = new RegExp(`\\b${nameAttr}\\s*=\\s*["']([^"']+)["']`, "i");
+  const versionRegex = /\bversion\s*=\s*["']([^"']+)["']/i;
+  let match;
+  while ((match = elementRegex.exec(content)) !== null) {
+    const attrs = match[1];
+    const nameMatch = attrs.match(nameRegex);
+    if (!nameMatch) continue;
+    const versionMatch = attrs.match(versionRegex);
+    deps.push({ name: nameMatch[1].trim(), version: versionMatch?.[1]?.trim() });
+  }
+  return deps;
+}
+function parseCsproj(content) {
+  return parseXmlDependencyElements(
+    content,
+    /<Package(?:Reference|Version)\s+([^>]+?)\/?>/gi,
+    "Include"
+  );
+}
+function parsePackagesConfig(content) {
+  return parseXmlDependencyElements(content, /<package\s+([^>]+?)\/?>/gi, "id");
+}
+var TELLTALES8 = [
+  // --- Libraries ---
+  // NuGet package IDs. Microsoft.* families are covered by the prefix rules.
+  ["EntityFramework", "entity-framework"],
+  ["NUnit", "nunit"],
+  ["Moq", "moq"],
+  ["NSubstitute", "nsubstitute"],
+  ["FluentAssertions", "fluentassertions"],
+  ["Shouldly", "shouldly"],
+  ["NLog", "nlog"],
+  ["log4net", "log4net"],
+  ["Newtonsoft.Json", "json-net"],
+  ["AutoMapper", "automapper"],
+  ["Dapper", "dapper"],
+  ["MediatR", "mediatr"]
+];
+var PREFIXES3 = [
+  // .NET — Microsoft package families and common test/logging libraries. More
+  // specific prefixes (Blazor) must precede broader ones (ASP.NET Core).
+  ["Microsoft.AspNetCore.Components.WebAssembly", "blazor"],
+  ["Microsoft.AspNetCore.", "aspnet-core"],
+  ["Microsoft.EntityFrameworkCore", "entity-framework"],
+  ["Microsoft.Azure.Functions", "azure-functions"],
+  ["Microsoft.Azure.WebJobs", "azure-functions"],
+  ["xunit", "xunit"],
+  ["MSTest.", "mstest"],
+  ["Serilog", "serilog"]
+];
+var nuget = {
+  id: "nuget",
+  manifests: [
+    { basename: "packages.config", parser: parsePackagesConfig },
+    { basename: "Directory.Packages.props", parser: parseCsproj },
+    // Project files carry an arbitrary basename, so they match by suffix. Matched
+    // case-insensitively — .NET project extensions may be upper-cased.
+    { suffix: ".csproj", parser: parseCsproj },
+    { suffix: ".vbproj", parser: parseCsproj },
+    { suffix: ".fsproj", parser: parseCsproj }
+  ],
+  telltales: TELLTALES8,
+  prefixes: PREFIXES3
+};
+
+// src/discover/ecosystems/pub.ts
+function parsePubspecYaml(content) {
+  const deps = [];
+  let inSection = false;
+  let childIndent = -1;
+  for (const rawLine of content.split("\n")) {
+    const trimmed = rawLine.trim();
+    if (trimmed === "" || trimmed.startsWith("#")) continue;
+    const indent = rawLine.length - rawLine.trimStart().length;
+    if (indent === 0) {
+      inSection = /^(dependencies|dev_dependencies|dependency_overrides):/.test(trimmed);
+      childIndent = -1;
+      continue;
+    }
+    if (!inSection) continue;
+    if (childIndent === -1) childIndent = indent;
+    if (indent !== childIndent) continue;
+    const m = trimmed.match(/^([a-zA-Z0-9_.]+)\s*:(?:\s*["']?\^?([0-9][^"'#\s]*))?/);
+    if (m) deps.push({ name: m[1], version: m[2] });
+  }
+  return deps;
+}
+var TELLTALES9 = [
+  // --- Frameworks ---
+  // `flutter` and `angular` appear as plain keys in pubspec.yaml. `angular` here is
+  // AngularDart — a different framework from npm's `angular` (AngularJS 1.x) and
+  // from modern Angular — hence the distinct `angular-dart` entity.
+  ["flutter", "flutter"],
+  ["flutter_test", "flutter"],
+  ["angular", "angular-dart"],
+  // --- Libraries ---
+  // Kept to Dart-specific names with negligible cross-ecosystem collision risk
+  // (generic names like "get"/"provider" are intentionally omitted).
+  ["riverpod", "riverpod"],
+  ["flutter_bloc", "bloc"],
+  ["dio", "dio"]
+];
+var pub = {
+  id: "pub",
+  manifests: [{ basename: "pubspec.yaml", parser: parsePubspecYaml }],
+  telltales: TELLTALES9
+};
+
+// src/discover/ecosystems/hex.ts
+function parseMixExs(content) {
+  const deps = [];
+  const depRegex = /\{:([a-zA-Z_][a-zA-Z0-9_]*)\s*,\s*"([^"]*)"/g;
+  let match;
+  while ((match = depRegex.exec(content)) !== null) {
+    deps.push({ name: match[1], version: match[2] || void 0 });
+  }
+  return deps;
+}
+var TELLTALES10 = [
+  // --- Frameworks ---
+  ["phoenix", "phoenix"],
+  ["plug", "plug"],
+  ["plug_cowboy", "plug"],
+  // --- Libraries ---
+  ["ecto", "ecto"],
+  ["ecto_sql", "ecto"],
+  ["phoenix_ecto", "ecto"]
+];
+var hex = {
+  id: "hex",
+  manifests: [{ basename: "mix.exs", parser: parseMixExs }],
+  telltales: TELLTALES10
+};
+
+// src/discover/ecosystems/swift.ts
 function parsePodfile(content) {
   const deps = [];
   const podRegex = /^\s*pod\s+["']([^"']+)["'](?:\s*,\s*["']([^"']+)["'])?/gm;
@@ -3162,127 +3342,503 @@ function parsePodfile(content) {
   while ((match = podRegex.exec(content)) !== null) {
     deps.push({ name: match[1], version: match[2] });
   }
-  return deps;
+  return deps;
+}
+function parsePackageSwift(content) {
+  const deps = [];
+  const pkgRegex = /\.package\s*\(\s*url:\s*["'](?:https?:\/\/[^/]+\/[^/]+\/|git@[^:]+:[^/]+\/)([^"'/.]+)/g;
+  let match;
+  while ((match = pkgRegex.exec(content)) !== null) {
+    deps.push({ name: match[1] });
+  }
+  return deps;
+}
+var TELLTALES11 = [
+  // --- Frameworks ---
+  ["vapor", "vapor"],
+  // --- Libraries ---
+  ["Alamofire", "alamofire"],
+  ["SnapKit", "snapkit"],
+  ["Kingfisher", "kingfisher"],
+  ["Moya", "moya"],
+  ["RxSwift", "rxswift"],
+  ["RealmSwift", "realm"],
+  // Quick and Nimble ship from separate repos and are declared independently —
+  // Nimble is usable on its own with XCTest — so they are two entities, gating
+  // SwiftLint's `quick_discouraged_*` and `prefer_nimble` rules respectively.
+  // Ids are matched exactly and case-sensitively: `parsePackageSwift` yields the
+  // GitHub repo name and `parsePodfile` the pod name, and both are `Quick`/`Nimble`.
+  ["Quick", "quick"],
+  ["Nimble", "nimble"]
+];
+var swift = {
+  id: "swift",
+  manifests: [
+    { basename: "Package.swift", parser: parsePackageSwift },
+    { basename: "Podfile", parser: parsePodfile }
+  ],
+  telltales: TELLTALES11
+};
+
+// src/discover/ecosystems/shards.ts
+function parseShardYml(content) {
+  const deps = [];
+  let inSection = false;
+  let depIndent = -1;
+  let current;
+  const flush = () => {
+    if (current) deps.push(current);
+    current = void 0;
+  };
+  for (const rawLine of content.split("\n")) {
+    const trimmed = rawLine.trim();
+    if (trimmed === "" || trimmed.startsWith("#")) continue;
+    const indent = rawLine.length - rawLine.trimStart().length;
+    if (indent === 0) {
+      flush();
+      inSection = /^(dependencies|development_dependencies):/.test(trimmed);
+      depIndent = -1;
+      continue;
+    }
+    if (!inSection) continue;
+    if (depIndent === -1) depIndent = indent;
+    if (indent === depIndent) {
+      flush();
+      const m = trimmed.match(/^([a-zA-Z0-9_-]+)\s*:/);
+      current = m ? { name: m[1] } : void 0;
+      continue;
+    }
+    if (indent > depIndent && current) {
+      const v = trimmed.match(/^version\s*:\s*["']?(?:~>|[~^])?\s*([0-9][^"'\s]*)/);
+      if (v) current.version = v[1];
+    }
+  }
+  flush();
+  return deps;
+}
+var TELLTALES12 = [
+  // --- Frameworks ---
+  ["amber", "amber"],
+  ["lucky", "lucky"],
+  ["kemal", "kemal"]
+];
+var shards = {
+  id: "shards",
+  manifests: [{ basename: "shard.yml", parser: parseShardYml }],
+  telltales: TELLTALES12
+};
+
+// src/discover/ecosystems/index.ts
+var ECOSYSTEMS = [
+  npm,
+  pypi,
+  gem,
+  maven,
+  golang,
+  cargo,
+  composer,
+  nuget,
+  pub,
+  hex,
+  swift,
+  shards
+];
+var BY_BASENAME = /* @__PURE__ */ new Map();
+var BY_SUFFIX = [];
+var BY_PATH = [];
+for (const ecosystem of ECOSYSTEMS) {
+  for (const rule of ecosystem.manifests) {
+    const resolved = { ecosystem: ecosystem.id, parser: rule.parser };
+    if ("basename" in rule) BY_BASENAME.set(rule.basename, resolved);
+    else if ("suffix" in rule) BY_SUFFIX.push({ suffix: rule.suffix, resolved });
+    else BY_PATH.push({ matches: rule.matches, resolved });
+  }
+}
+function getEcosystem(id) {
+  const found = ECOSYSTEMS.find((e) => e.id === id);
+  if (!found) throw new Error(`Unknown dependency ecosystem: ${id}`);
+  return found;
+}
+function resolveManifest(filePath) {
+  const basename = filePath.split("/").pop() ?? filePath;
+  const byName = BY_BASENAME.get(basename);
+  if (byName) return byName;
+  const lowerBasename = basename.toLowerCase();
+  for (const { suffix, resolved } of BY_SUFFIX) {
+    if (lowerBasename.endsWith(suffix)) return resolved;
+  }
+  for (const { matches, resolved } of BY_PATH) {
+    if (matches(filePath, basename)) return resolved;
+  }
+  return void 0;
+}
+
+// src/discover/signals.ts
+var import_tooling5 = require("@codacy/tooling");
+function pathBasename(filePath) {
+  return filePath.split("/").pop() ?? filePath;
+}
+var FILE_SIGNAL_RULES = [
+  {
+    name: ".flowconfig",
+    matches: (f) => pathBasename(f) === ".flowconfig",
+    entity: "flow"
+  },
+  {
+    name: "cdk.json",
+    matches: (f) => pathBasename(f) === "cdk.json",
+    entity: "aws-cdk"
+  },
+  {
+    name: ".meteor/release",
+    matches: (f) => f === ".meteor/release" || f.endsWith("/.meteor/release"),
+    entity: "meteor"
+  },
+  {
+    name: "sfdx-project.json",
+    matches: (f) => pathBasename(f) === "sfdx-project.json",
+    entity: "salesforce"
+  },
+  {
+    name: "lwc.config.json",
+    matches: (f) => pathBasename(f) === "lwc.config.json",
+    entity: "lightning-web-components"
+  },
+  {
+    name: "suitecloud.config.js",
+    matches: (f) => pathBasename(f) === "suitecloud.config.js",
+    entity: "suitescript"
+  },
+  {
+    name: ".github/workflows",
+    matches: (f) => f.startsWith(".github/workflows/"),
+    entity: "github-actions"
+  },
+  {
+    name: ".circleci",
+    matches: (f) => f.startsWith(".circleci/"),
+    entity: "circleci"
+  },
+  {
+    name: ".gitlab-ci.yml",
+    matches: (f) => f === ".gitlab-ci.yml" || f.startsWith(".gitlab/"),
+    entity: "gitlab-ci"
+  },
+  {
+    name: "bitbucket-pipelines.yml",
+    matches: (f) => f === "bitbucket-pipelines.yml",
+    entity: "bitbucket-pipelines"
+  },
+  {
+    name: "azure-pipelines.yml",
+    matches: (f) => f === "azure-pipelines.yml" || f === "azure-pipelines.yaml",
+    entity: "azure-pipelines"
+  },
+  {
+    // Jenkins pipelines are Groovy scripts with no manifest at all — the
+    // Jenkinsfile *is* the declaration. Gates CodeNarc's `jenkins`/
+    // `jenkinspipeline` tagged patterns.
+    name: "Jenkinsfile",
+    matches: (f) => {
+      const base = pathBasename(f);
+      return base === "Jenkinsfile" || base.startsWith("Jenkinsfile.");
+    },
+    entity: "jenkins"
+  },
+  {
+    // A `sorbet/` directory (typically `sorbet/config` + RBI files) marks a
+    // Sorbet-typed Ruby project even when the gem is pulled in transitively.
+    name: "sorbet/config",
+    matches: (f) => f === "sorbet/config" || f.endsWith("/sorbet/config"),
+    entity: "sorbet"
+  },
+  {
+    name: "Rakefile",
+    matches: (f) => {
+      const base = pathBasename(f);
+      return base === "Rakefile" || base === "rakefile" || base.endsWith(".rake");
+    },
+    entity: "rake"
+  },
+  {
+    // XCTest ships with Xcode, so no manifest ever declares it and a file signal
+    // is the only producer available. `FooTests.swift` / `FooTest.swift` is the
+    // naming Xcode's templates and SwiftPM's `Tests/` layout both generate, and it
+    // is what SwiftLint's own test rules key on. Matching the file name rather than
+    // a `Tests/` directory also covers CocoaPods/Xcode projects, which have no
+    // fixed directory convention.
+    name: "*Tests.swift",
+    matches: (f) => /Tests?\.swift$/.test(pathBasename(f)),
+    entity: "xctest"
+  },
+  // ── Infrastructure-as-Code ─────────────────────────────────────────────────
+  //
+  // These gate Checkov, whose ~1,300 cloud-security checks are otherwise
+  // universal: they are all default-on and the only other filter is the language
+  // one, which passes on any repo containing a `.json` or `.yaml` file. Terraform
+  // needs no rule here — `.tf` is the `Terraform` language, so `lang:Terraform`
+  // already means "this repo has Terraform". What the language axis cannot
+  // express is which IaC *framework* a YAML/JSON file belongs to, since
+  // Kubernetes manifests, Helm charts, Ansible playbooks, CloudFormation
+  // templates and ARM templates are all YAML or JSON.
+  //
+  // Bias these rules **permissive**, the opposite of the rules above. A Checkov
+  // check declares the resource types it applies to, so a check enabled in a repo
+  // that has none of them is inert — it produces no findings and costs only a line
+  // of config. A false negative is what's expensive: it silently drops hundreds of
+  // checks from a repo that needed them. Where a signal is ambiguous, prefer
+  // matching.
+  {
+    // A Helm chart's templates render to Kubernetes manifests, so a chart is
+    // evidence of Kubernetes as much as of Helm. `Chart.yaml` is the chart
+    // manifest and carries no other meaning at a chart root.
+    name: "Chart.yaml",
+    matches: (f) => {
+      const base = pathBasename(f);
+      return base === "Chart.yaml" || base === "Chart.yml";
+    },
+    entity: "helm"
+  },
+  {
+    // Kustomize is the one Kubernetes layout with a distinctive filename. Bare
+    // manifests declare themselves only in their content (`apiVersion:`/`kind:`),
+    // which a path-only rule cannot see. `kustomization.yaml` is exact; the
+    // directory rule covers the far more common layout — loose manifests under
+    // `k8s/`, `kubernetes/` or `manifests/`, applied with `kubectl apply -f`.
+    //
+    // Gating on `kustomization.yaml` alone dropped 14 default-on Opengrep rules
+    // (privileged-container, secrets-in-config-file, skip-tls-verify-*, …) from
+    // exactly that layout. Per the bias above, a directory name matched wrongly
+    // only enables inert checks, while missing it loses real coverage.
+    name: "k8s manifests",
+    matches: (f) => {
+      const base = pathBasename(f);
+      if (base === "kustomization.yaml" || base === "kustomization.yml") return true;
+      return /(^|\/)(k8s|kubernetes|manifests)\/.+\.ya?ml$/.test(f);
+    },
+    entity: "kubernetes"
+  },
+  {
+    // `ansible.cfg` is unambiguous; the `roles/<name>/tasks/main.yml` layout is
+    // Ansible's own role convention and is the only marker in a playbook repo
+    // that ships no config file.
+    name: "ansible.cfg",
+    matches: (f) => pathBasename(f) === "ansible.cfg" || /(^|\/)roles\/[^/]+\/tasks\/main\.ya?ml$/.test(f),
+    entity: "ansible"
+  },
+  {
+    name: "serverless.yml",
+    matches: (f) => /(^|\/)serverless\.(ya?ml|json|ts|js)$/.test(f),
+    entity: "serverless-framework"
+  },
+  {
+    // Bicep compiles to ARM, so `.bicep` is Azure IaC. Plain ARM templates are
+    // JSON identified by their `$schema`, which needs a content probe.
+    name: "*.bicep",
+    matches: (f) => {
+      const base = pathBasename(f);
+      return base.endsWith(".bicep") || base.endsWith(".bicepparam");
+    },
+    entity: "bicep"
+  },
+  {
+    // A CloudFormation template is identified by `AWSTemplateFormatVersion` in its
+    // body, not by its name, so this covers only the conventional shells: the SAM
+    // CLI's config file, SAM's root `template.yaml`, and a `cloudformation/`
+    // directory. Deliberately loose per the note above — over-matching enables AWS
+    // checks that then find nothing, under-matching drops 456 of them.
+    name: "cloudformation template",
+    matches: (f) => {
+      const base = pathBasename(f);
+      if (base === "samconfig.toml" || base === "samconfig.yaml" || base === "samconfig.yml") {
+        return true;
+      }
+      if (f === "template.yaml" || f === "template.yml") return true;
+      return /(^|\/)cloudformation\//.test(f);
+    },
+    entity: "cloudformation"
+  },
+  {
+    // Play's routes file — `conf/routes`, plus the `conf/*.routes` sub-files a
+    // multi-module app includes from it (Codacy's own website uses
+    // `app/conf/website.routes`, `modules/legacy-api/conf/api.routes`). Nothing
+    // but Play uses this layout, and it is version-independent, unlike the
+    // artifact names. Note `conf/application.conf` is NOT a signal: plain
+    // Typesafe Config uses the same filename without any Play involvement.
+    name: "conf/routes",
+    matches: (f) => /(^|\/)conf\/([^/]+\.)?routes$/.test(f),
+    entity: "play-framework"
+  }
+];
+function detectFileSignals(files) {
+  const result = [];
+  for (const rule of FILE_SIGNAL_RULES) {
+    const hit = files.find((f) => rule.matches(f));
+    if (!hit) continue;
+    const entity = import_tooling5.DEPENDENCY_ENTITIES[rule.entity];
+    result.push({
+      name: rule.name,
+      key: entity.key,
+      displayName: entity.displayName,
+      kind: entity.kind,
+      source: "file",
+      manifestFile: hit
+    });
+  }
+  return result;
 }
-function parsePackageSwift(content) {
-  const deps = [];
-  const pkgRegex = /\.package\s*\(\s*url:\s*["'](?:https?:\/\/[^/]+\/[^/]+\/|git@[^:]+:[^/]+\/)([^"'/.]+)/g;
-  let match;
-  while ((match = pkgRegex.exec(content)) !== null) {
-    deps.push({ name: match[1] });
-  }
-  return deps;
+function isEslintPluginName(name) {
+  return /^eslint-plugin-/.test(name) || /^@[^/]+\/eslint-plugin(-.*)?$/.test(name);
 }
-function parsePubspecYaml(content) {
-  const deps = [];
-  let inSection = false;
-  let childIndent = -1;
-  for (const rawLine of content.split("\n")) {
-    const trimmed = rawLine.trim();
-    if (trimmed === "" || trimmed.startsWith("#")) continue;
-    const indent = rawLine.length - rawLine.trimStart().length;
-    if (indent === 0) {
-      inSection = /^(dependencies|dev_dependencies|dependency_overrides):/.test(trimmed);
-      childIndent = -1;
-      continue;
-    }
-    if (!inSection) continue;
-    if (childIndent === -1) childIndent = indent;
-    if (indent !== childIndent) continue;
-    const m = trimmed.match(/^([a-zA-Z0-9_.]+)\s*:(?:\s*["']?\^?([0-9][^"'#\s]*))?/);
-    if (m) deps.push({ name: m[1], version: m[2] });
+function detectPackageJsonSignals(content) {
+  let pkg;
+  try {
+    pkg = JSON.parse(content);
+  } catch {
+    return [];
   }
-  return deps;
-}
-function parseShardYml(content) {
-  const deps = [];
-  let inSection = false;
-  let depIndent = -1;
-  let current;
-  const flush = () => {
-    if (current) deps.push(current);
-    current = void 0;
-  };
-  for (const rawLine of content.split("\n")) {
-    const trimmed = rawLine.trim();
-    if (trimmed === "" || trimmed.startsWith("#")) continue;
-    const indent = rawLine.length - rawLine.trimStart().length;
-    if (indent === 0) {
-      flush();
-      inSection = /^(dependencies|development_dependencies):/.test(trimmed);
-      depIndent = -1;
-      continue;
-    }
-    if (!inSection) continue;
-    if (depIndent === -1) depIndent = indent;
-    if (indent === depIndent) {
-      flush();
-      const m = trimmed.match(/^([a-zA-Z0-9_-]+)\s*:/);
-      current = m ? { name: m[1] } : void 0;
-      continue;
-    }
-    if (indent > depIndent && current) {
-      const v = trimmed.match(/^version\s*:\s*["']?(?:~>|[~^])?\s*([0-9][^"'\s]*)/);
-      if (v) current.version = v[1];
-    }
+  const name = pkg && typeof pkg.name === "string" ? pkg.name : "";
+  if (name && isEslintPluginName(name)) {
+    const entity = import_tooling5.DEPENDENCY_ENTITIES["eslint-plugin"];
+    return [
+      {
+        name,
+        key: entity.key,
+        displayName: entity.displayName,
+        kind: entity.kind,
+        source: "manifest",
+        manifestFile: "package.json",
+        ecosystem: "npm"
+      }
+    ];
   }
-  flush();
-  return deps;
+  return [];
 }
-function parseXmlDependencyElements(content, elementRegex, nameAttr) {
-  const deps = [];
-  const nameRegex = new RegExp(`\\b${nameAttr}\\s*=\\s*["']([^"']+)["']`, "i");
-  const versionRegex = /\bversion\s*=\s*["']([^"']+)["']/i;
-  let match;
-  while ((match = elementRegex.exec(content)) !== null) {
-    const attrs = match[1];
-    const nameMatch = attrs.match(nameRegex);
-    if (!nameMatch) continue;
-    const versionMatch = attrs.match(versionRegex);
-    deps.push({ name: nameMatch[1].trim(), version: versionMatch?.[1]?.trim() });
+
+// src/discover/classify.ts
+var TELLTALE_INDEX = /* @__PURE__ */ new Map();
+function telltaleIndex(ecosystem) {
+  let index = TELLTALE_INDEX.get(ecosystem);
+  if (!index) {
+    index = new Map(getEcosystem(ecosystem).telltales);
+    TELLTALE_INDEX.set(ecosystem, index);
+  }
+  return index;
+}
+function classifyDependency(name, ecosystem) {
+  const exact = telltaleIndex(ecosystem).get(name);
+  if (exact) return import_tooling6.DEPENDENCY_ENTITIES[exact];
+  for (const [prefix, entity] of getEcosystem(ecosystem).prefixes ?? []) {
+    if (name.startsWith(prefix)) return import_tooling6.DEPENDENCY_ENTITIES[entity];
   }
-  return deps;
-}
-function parseCsproj(content) {
-  return parseXmlDependencyElements(
-    content,
-    /<Package(?:Reference|Version)\s+([^>]+?)\/?>/gi,
-    "Include"
-  );
+  return void 0;
 }
-function parsePackagesConfig(content) {
-  return parseXmlDependencyElements(content, /<package\s+([^>]+?)\/?>/gi, "id");
+function getKnownDisplayNames() {
+  return new Set(Object.values(import_tooling6.DEPENDENCY_ENTITIES).map((entity) => entity.displayName));
 }
-var MANIFEST_PARSERS = /* @__PURE__ */ new Map([
-  ["package.json", parsePackageJson],
-  ["requirements.txt", parseRequirementsTxt],
-  ["pyproject.toml", parsePyprojectToml],
-  ["Pipfile", parsePipfile],
-  ["Gemfile", parseGemfile],
-  ["go.mod", parseGoMod],
-  ["pom.xml", parsePomXml],
-  ["build.gradle", parseBuildGradle],
-  ["build.gradle.kts", parseBuildGradle],
-  ["build.sbt", parseBuildSbt],
-  ["Cargo.toml", parseCargoToml],
-  ["composer.json", parseComposerJson],
-  ["Podfile", parsePodfile],
-  ["Package.swift", parsePackageSwift],
-  ["pubspec.yaml", parsePubspecYaml],
-  ["mix.exs", parseMixExs],
-  ["shard.yml", parseShardYml],
-  ["packages.config", parsePackagesConfig],
-  ["Directory.Packages.props", parseCsproj]
+
+// src/discover/notable-files.ts
+var NOTABLE_ANY_DEPTH = /* @__PURE__ */ new Set([
+  "Dockerfile",
+  "docker-compose.yml",
+  "docker-compose.yaml",
+  "compose.yml",
+  "compose.yaml",
+  "Makefile",
+  "Justfile",
+  "pom.xml",
+  "build.gradle",
+  "build.gradle.kts",
+  "build.sbt",
+  "go.mod",
+  "Cargo.toml",
+  "Gemfile",
+  "Podfile",
+  "Package.swift",
+  "Jenkinsfile",
+  "Vagrantfile",
+  "Procfile",
+  "pubspec.yaml",
+  "mix.exs",
+  "shard.yml",
+  "packages.config",
+  "Directory.Packages.props"
 ]);
-var MANIFEST_SUFFIX_PARSERS = /* @__PURE__ */ new Map([
-  [".csproj", parseCsproj],
-  [".vbproj", parseCsproj],
-  [".fsproj", parseCsproj]
+var NOTABLE_ROOT_ONLY = /* @__PURE__ */ new Set([
+  ".dockerignore",
+  "Taskfile.yml",
+  "Rakefile",
+  "Gruntfile.js",
+  "Gulpfile.js",
+  "settings.gradle",
+  "settings.gradle.kts",
+  "go.sum",
+  "Cargo.lock",
+  "CLAUDE.md",
+  "AGENTS.md",
+  "agents.md",
+  ".cursorrules",
+  "copilot-instructions.md",
+  ".travis.yml",
+  ".gitlab-ci.yml",
+  "azure-pipelines.yml",
+  "bitbucket-pipelines.yml",
+  "appveyor.yml",
+  "package.json",
+  "requirements.txt",
+  "pyproject.toml",
+  "Pipfile",
+  "composer.json",
+  "tsconfig.json",
+  "jsconfig.json",
+  "serverless.yml",
+  "serverless.yaml",
+  "cdk.json",
+  "pulumi.yaml",
+  "README.md",
+  "CHANGELOG.md",
+  "CONTRIBUTING.md",
+  "LICENSE",
+  "renovate.json",
+  ".nvmrc",
+  ".node-version",
+  ".python-version",
+  ".ruby-version",
+  ".tool-versions"
 ]);
+var NOTABLE_PATH_PREFIXES = [".github/workflows/", ".circleci/", ".gitlab/"];
+var CONFIG_HEURISTIC_PATTERNS = [
+  /^\..*rc$/,
+  // .eslintrc, .prettierrc, etc.
+  /^\..*rc\.(json|js|cjs|mjs|yml|yaml|ts)$/,
+  // .eslintrc.json, etc.
+  /^.*\.config\.(js|ts|mjs|cjs)$/,
+  // vite.config.ts, jest.config.js, etc.
+  /^\.env(\..+)?$/
+  // .env, .env.local, .env.production
+];
+function isNotableFile(filePath) {
+  const basename = filePath.split("/").pop() ?? filePath;
+  const isRoot = !filePath.includes("/");
+  if (NOTABLE_ANY_DEPTH.has(basename)) return true;
+  if (isRoot && NOTABLE_ROOT_ONLY.has(basename)) return true;
+  if (/\.(csproj|vbproj|fsproj|sln)$/i.test(basename)) return true;
+  for (const prefix of NOTABLE_PATH_PREFIXES) {
+    if (filePath.startsWith(prefix)) return true;
+  }
+  if (!filePath.includes("/")) {
+    for (const pattern of CONFIG_HEURISTIC_PATTERNS) {
+      if (pattern.test(basename)) return true;
+    }
+  }
+  return false;
+}
 
-// src/discover.ts
+// src/discover/index.ts
 async function discover(repositoryRoot, options) {
-  const files = listRepoFiles(repositoryRoot);
+  const unfiltered = listRepoFiles(repositoryRoot);
+  const files = applyExclusions(unfiltered, [...options?.exclude ?? []], []);
+  const excludedFiles = unfiltered.length - files.length;
   const filePatterns = extractFilePatterns(files);
   const notableFiles = findNotableFiles(files);
   const languages = await detectLanguages(repositoryRoot, files);
@@ -3305,7 +3861,10 @@ async function discover(repositoryRoot, options) {
     metadata: {
       repositoryRoot: import_path6.default.resolve(repositoryRoot),
       totalFiles: files.length,
-      scannedAt: (/* @__PURE__ */ new Date()).toISOString()
+      scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      // Surfaced so a scan narrowed by excludes is never mistaken for a repo
+      // that genuinely lacks those languages.
+      ...excludedFiles > 0 ? { excludedFiles } : {}
     }
   };
 }
@@ -3328,43 +3887,33 @@ function findNotableFiles(files) {
   }
   return Array.from(notable).sort();
 }
-function resolveManifestParser(filePath) {
-  const basename = filePath.split("/").pop() ?? filePath;
-  const byName = MANIFEST_PARSERS.get(basename);
-  if (byName) return byName;
-  const lowerBasename = basename.toLowerCase();
-  for (const [suffix, parser] of MANIFEST_SUFFIX_PARSERS) {
-    if (lowerBasename.endsWith(suffix)) return parser;
-  }
-  return void 0;
-}
 async function extractDependencies(repositoryRoot, files) {
   const allDeps = [];
   for (const filePath of files) {
-    const parser = resolveManifestParser(filePath);
-    if (!parser) continue;
+    const manifest = resolveManifest(filePath);
+    if (!manifest) continue;
     let content;
     try {
       content = await import_promises2.default.readFile(import_path6.default.join(repositoryRoot, filePath), "utf-8");
     } catch {
       continue;
     }
-    const basename = filePath.split("/").pop() ?? filePath;
-    const rawDeps = parser(content);
-    for (const raw of rawDeps) {
-      const classification = classifyDependency(raw.name, basename);
-      if (classification) {
+    for (const raw of manifest.parser(content)) {
+      const entity = classifyDependency(raw.name, manifest.ecosystem);
+      if (entity) {
         allDeps.push({
           name: raw.name,
-          displayName: classification.displayName,
-          kind: classification.kind,
+          key: entity.key,
+          displayName: entity.displayName,
+          kind: entity.kind,
           source: "manifest",
           manifestFile: filePath,
-          version: raw.version
+          version: raw.version,
+          ecosystem: manifest.ecosystem
         });
       }
     }
-    if (basename === "package.json") {
+    if (filePath.split("/").pop() === "package.json") {
       for (const signal of detectPackageJsonSignals(content)) {
         allDeps.push({ ...signal, manifestFile: filePath });
       }
@@ -3376,8 +3925,8 @@ function deduplicateDeps(deps) {
   const seen = /* @__PURE__ */ new Set();
   const result = [];
   for (const dep of deps) {
-    if (!seen.has(dep.displayName)) {
-      seen.add(dep.displayName);
+    if (!seen.has(dep.key)) {
+      seen.add(dep.key);
       result.push(dep);
     }
   }
@@ -3469,6 +4018,28 @@ function applyCodacyYamlExcludes(config, yamlConfig, adapters, logger) {
 function deduplicateStrings(arr) {
   return [...new Set(arr)];
 }
+async function resolveDiscoveryExcludes(repositoryRoot, adapters, existingConfig) {
+  const yamlConfig = await readCodacyYaml(repositoryRoot);
+  const global = deduplicateStrings([
+    ...existingConfig?.exclude ?? [],
+    ...yamlConfig?.excludePaths ?? []
+  ]);
+  const perTool = /* @__PURE__ */ new Map();
+  const addToolExcludes = (toolId, patterns) => {
+    if (patterns.length === 0) return;
+    perTool.set(toolId, deduplicateStrings([...perTool.get(toolId) ?? [], ...patterns]));
+  };
+  for (const tool of existingConfig?.tools ?? []) {
+    addToolExcludes(tool.toolId, tool.exclude ?? []);
+  }
+  for (const [engineName, engineConfig] of yamlConfig?.engines ?? []) {
+    if (engineConfig.excludePaths.length === 0) continue;
+    const adapterId = resolveEngineToAdapter(engineName, adapters);
+    if (!adapterId) continue;
+    addToolExcludes(adapterId, engineConfig.excludePaths);
+  }
+  return { yamlConfig, global, perTool };
+}
 
 // src/api/client/core/OpenAPI.ts
 var OpenAPI = {
@@ -6908,8 +7479,14 @@ var ToolsService = class {
 
 // src/api/index.ts
 OpenAPI.BASE = (process.env.CODACY_API_BASE_URL || "https://app.codacy.com").replace(/\/$/, "") + "/api/v3";
-function configureApiToken(token) {
-  OpenAPI.HEADERS = { "api-token": token };
+function configureApiToken(auth) {
+  const resolved = typeof auth === "string" ? { kind: "account-token", token: auth } : auth;
+  if (!resolved || resolved.kind !== "account-token" && resolved.kind !== "repository-token" || !resolved.token) {
+    throw new Error(
+      'configureApiToken requires a non-empty apiToken string, or a RemoteAuth object ({ kind: "account-token" | "repository-token", token: string }).'
+    );
+  }
+  OpenAPI.HEADERS = resolved.kind === "account-token" ? { "api-token": resolved.token } : { "project-token": resolved.token };
 }
 async function fetchAllPages(fetcher) {
   const results = [];
@@ -7002,6 +7579,10 @@ async function listIgnoredFiles(provider, org, repo) {
 }
 
 // src/init.ts
+function isAuthFailure(err) {
+  return err instanceof ApiError && (err.status === 401 || err.status === 403);
+}
+var AUTH_FAILURE_HINT = "The token was accepted for earlier reads but rejected here: if it is a repository token, check that it belongs to this repository; if it is an account token, check that the account has access to it.";
 function deriveApiToolId(tool) {
   return tool.prefix ? tool.prefix.replace(/_$/, "") : tool.shortName;
 }
@@ -7033,7 +7614,7 @@ function buildAdapterByUuid(adapters, apiTools) {
   }
   return result;
 }
-async function detectLanguages(repositoryRoot, precomputedFiles) {
+async function detectLanguages(repositoryRoot, precomputedFiles, exclude) {
   let files;
   if (precomputedFiles) {
     files = precomputedFiles;
@@ -7049,11 +7630,14 @@ async function detectLanguages(repositoryRoot, precomputedFiles) {
       return [];
     }
   }
+  if (exclude && exclude.length > 0) {
+    files = applyExclusions(files, [...exclude], []);
+  }
   const detected = /* @__PURE__ */ new Set();
   for (const file of files) {
     const basename = import_path8.default.basename(file);
     const ext = import_path8.default.extname(file).toLowerCase();
-    for (const [lang, config] of Object.entries(import_tooling5.LANGUAGE_CONFIG)) {
+    for (const [lang, config] of Object.entries(import_tooling7.LANGUAGE_CONFIG)) {
       if (config.extensions.includes(ext)) {
         detected.add(lang);
       } else if (config.files.includes(basename)) {
@@ -7087,16 +7671,18 @@ async function detectLocalConfigFiles(repositoryRoot, adapters) {
   }
   return found;
 }
-async function enrichWithCodacyYaml(config, repositoryRoot, adapters) {
-  const yamlConfig = await readCodacyYaml(repositoryRoot);
-  if (!yamlConfig) return { config, codacyYamlApplied: false };
+function enrichWithCodacyYaml(config, adapters, excludes) {
+  if (!excludes.yamlConfig) return { config, codacyYamlApplied: false };
   return {
-    config: applyCodacyYamlExcludes(config, yamlConfig, adapters),
+    config: applyCodacyYamlExcludes(config, excludes.yamlConfig, adapters),
     codacyYamlApplied: true
   };
 }
-async function initLocalConfigBase(repositoryRoot, adapters) {
-  const languages = await detectLanguages(repositoryRoot);
+async function initLocalConfigBase(repositoryRoot, adapters, excludes) {
+  const languages = await detectLanguages(
+    repositoryRoot,
+    listRepoFiles(repositoryRoot, excludes.global)
+  );
   const localConfigs = await detectLocalConfigFiles(repositoryRoot, adapters);
   const tools = [];
   for (const [toolId, configPath] of localConfigs.entries()) {
@@ -7109,17 +7695,23 @@ async function initLocalConfigBase(repositoryRoot, adapters) {
   }
   return createCodacyConfig({ source: "local", languages, tools });
 }
-async function initLocalConfig(repositoryRoot, adapters) {
-  const baseConfig = await initLocalConfigBase(repositoryRoot, adapters);
-  const { config, codacyYamlApplied } = await enrichWithCodacyYaml(
-    baseConfig,
+async function initLocalConfig(repositoryRoot, adapters, options) {
+  const excludes = await resolveDiscoveryExcludes(
     repositoryRoot,
-    adapters
+    adapters,
+    options?.existingConfig
   );
+  const baseConfig = await initLocalConfigBase(repositoryRoot, adapters, excludes);
+  const { config, codacyYamlApplied } = enrichWithCodacyYaml(baseConfig, adapters, excludes);
   return { config, stats: { codacyYamlApplied } };
 }
-async function initDefaultConfig(repositoryRoot, adapters) {
-  const base = await initLocalConfigBase(repositoryRoot, adapters);
+async function initDefaultConfig(repositoryRoot, adapters, options) {
+  const excludes = await resolveDiscoveryExcludes(
+    repositoryRoot,
+    adapters,
+    options?.existingConfig
+  );
+  const base = await initLocalConfigBase(repositoryRoot, adapters, excludes);
   const toolsWithLocalConfig = new Set(
     base.tools.filter((t) => t.useLocalConfigurationFile).map((t) => t.toolId)
   );
@@ -7157,24 +7749,27 @@ async function initDefaultConfig(repositoryRoot, adapters) {
     languages: base.metadata.languages,
     tools: updatedTools
   });
-  const { config, codacyYamlApplied } = await enrichWithCodacyYaml(
-    baseConfig,
-    repositoryRoot,
-    adapters
-  );
+  const { config, codacyYamlApplied } = enrichWithCodacyYaml(baseConfig, adapters, excludes);
   return {
     config,
     stats: { totalApiTools: apiTools.length, addedTools, addedUnsupported, codacyYamlApplied }
   };
 }
-async function initRemoteConfig(repositoryRoot, provider, organization, repositoryName, adapters, apiToken, onRemoteToolsFound, onToolProcessed, onIgnoredFilesFetched) {
-  configureApiToken(apiToken);
+async function initRemoteConfig(repositoryRoot, provider, organization, repositoryName, adapters, auth, onRemoteToolsFound, onToolProcessed, onIgnoredFilesFetched) {
+  configureApiToken(auth);
+  const repositoryLabel = `${provider}/${organization}/${repositoryName}`;
   const repoInfo = await getRepository(provider, organization, repositoryName);
   const remoteTools = await listRepositoryTools(provider, organization, repositoryName);
   let ignoredFilesResult = { files: [], totalFetched: 0, capped: false };
   try {
     ignoredFilesResult = await listIgnoredFiles(provider, organization, repositoryName);
-  } catch {
+  } catch (err) {
+    if (isAuthFailure(err)) {
+      throw new Error(
+        `Failed to fetch cloud-ignored files for ${repositoryLabel}: ${err.status} ${err.statusText}. ${AUTH_FAILURE_HINT} Aborting: continuing would silently drop this repository's cloud excludes from the generated config.`,
+        { cause: err }
+      );
+    }
   }
   onIgnoredFilesFetched?.(ignoredFilesResult.totalFetched, ignoredFilesResult.capped);
   const localConfigs = await detectLocalConfigFiles(repositoryRoot, adapters);
@@ -7183,7 +7778,7 @@ async function initRemoteConfig(repositoryRoot, provider, organization, reposito
   const apiToolByUuid = new Map(allApiTools.map((t) => [t.uuid, t]));
   const matchedAdapterCount = remoteTools.filter((t) => adapterByUuid.has(t.uuid)).length;
   onRemoteToolsFound?.(remoteTools.length, matchedAdapterCount);
-  const fetchPatterns = async (uuid) => {
+  const fetchPatterns = async (uuid, toolLabel) => {
     try {
       const configuredPatterns = await listRepositoryToolPatterns(
         provider,
@@ -7198,7 +7793,13 @@ async function initRemoteConfig(repositoryRoot, provider, organization, reposito
           ...params ? { parameters: params } : {}
         };
       });
-    } catch {
+    } catch (err) {
+      if (isAuthFailure(err)) {
+        throw new Error(
+          `Failed to fetch enabled patterns for ${toolLabel} in ${repositoryLabel}: ${err.status} ${err.statusText}. ${AUTH_FAILURE_HINT} Aborting: continuing would write a configuration with no enabled patterns.`,
+          { cause: err }
+        );
+      }
       return [];
     }
   };
@@ -7211,7 +7812,7 @@ async function initRemoteConfig(repositoryRoot, provider, organization, reposito
     if (adapter) {
       matchedAdapters++;
       const localConfigPath = localConfigs.get(adapter.id);
-      const patterns2 = usesLocalConfig ? [] : await fetchPatterns(remoteTool.uuid);
+      const patterns2 = usesLocalConfig ? [] : await fetchPatterns(remoteTool.uuid, adapter.displayName);
       onToolProcessed?.(adapter.displayName, patterns2.length, usesLocalConfig);
       tools.push({
         toolId: adapter.id,
@@ -7226,7 +7827,7 @@ async function initRemoteConfig(repositoryRoot, provider, organization, reposito
     const apiTool = apiToolByUuid.get(remoteTool.uuid);
     if (!apiTool || !isTrackableTool(apiTool)) continue;
     const toolId = deriveApiToolId(apiTool);
-    const patterns = usesLocalConfig ? [] : await fetchPatterns(remoteTool.uuid);
+    const patterns = usesLocalConfig ? [] : await fetchPatterns(remoteTool.uuid, apiTool.name ?? toolId);
     unsupportedTools++;
     onToolProcessed?.(apiTool.name ?? toolId, patterns.length, usesLocalConfig);
     tools.push({
@@ -7247,10 +7848,10 @@ async function initRemoteConfig(repositoryRoot, provider, organization, reposito
   if (ignoredFilesResult.files.length > 0) {
     baseConfig.exclude = [.../* @__PURE__ */ new Set([...baseConfig.exclude ?? [], ...ignoredFilesResult.files])];
   }
-  const { config, codacyYamlApplied } = await enrichWithCodacyYaml(
+  const { config, codacyYamlApplied } = enrichWithCodacyYaml(
     baseConfig,
-    repositoryRoot,
-    adapters
+    adapters,
+    await resolveDiscoveryExcludes(repositoryRoot, adapters)
   );
   return {
     config,
@@ -7324,24 +7925,40 @@ function hasMatchingFiles(files, filePatterns) {
   if (matcher.matchAll) return files.length > 0;
   return files.some((file) => matcher.matches(file, file.split("/").pop() ?? ""));
 }
-async function initAutoConfig(repositoryRoot, adapters, descriptors, filters, onDiscoveryComplete, rawFilterString, loadUnsupportedPatterns) {
-  const discoveryResult = await discover(repositoryRoot);
+async function initAutoConfig(repositoryRoot, adapters, descriptors, filters, onDiscoveryComplete, rawFilterString, loadUnsupportedPatterns, options) {
+  const excludes = await resolveDiscoveryExcludes(
+    repositoryRoot,
+    adapters,
+    options?.existingConfig
+  );
+  const discoveryResult = await discover(repositoryRoot, { exclude: excludes.global });
   onDiscoveryComplete?.(discoveryResult);
   const detectedKeys = /* @__PURE__ */ new Set();
-  for (const lang of discoveryResult.languages) detectedKeys.add(lang);
-  for (const fw of discoveryResult.frameworks) detectedKeys.add(fw.displayName);
-  for (const lib of discoveryResult.libraries) detectedKeys.add(lib.displayName);
+  for (const lang of discoveryResult.languages) detectedKeys.add((0, import_tooling7.languageKey)(lang));
+  for (const fw of discoveryResult.frameworks) detectedKeys.add(fw.key);
+  for (const lib of discoveryResult.libraries) detectedKeys.add(lib.key);
   const repoLanguages = new Set(discoveryResult.languages);
   const localConfigs = await detectLocalConfigFiles(repositoryRoot, adapters);
-  const repoFiles = listRepoFiles(repositoryRoot);
+  const repoFiles = listRepoFiles(repositoryRoot, excludes.global);
   const descriptorMap = new Map(descriptors.map((d) => [d.id, d]));
+  const perToolFiles = /* @__PURE__ */ new Map();
+  const filesVisibleTo = (toolId) => {
+    const toolExclude = excludes.perTool.get(toolId);
+    if (!toolExclude || toolExclude.length === 0) return repoFiles;
+    let files = perToolFiles.get(toolId);
+    if (!files) {
+      files = applyExclusions(repoFiles, [], [...toolExclude]);
+      perToolFiles.set(toolId, files);
+    }
+    return files;
+  };
   const candidates = [];
   for (const adapter of adapters) {
     if (!adapter.languages.includes("*") && adapter.languages.length > 0 && repoLanguages.size > 0) {
       const hasOverlap = adapter.languages.some((lang) => repoLanguages.has(lang));
       if (!hasOverlap) continue;
     }
-    if (!hasMatchingFiles(repoFiles, adapter.filePatterns)) continue;
+    if (!hasMatchingFiles(filesVisibleTo(adapter.id), adapter.filePatterns)) continue;
     candidates.push(adapter);
   }
   const deduped = deduplicateToolFamilies(candidates, localConfigs);
@@ -7374,7 +7991,12 @@ async function initAutoConfig(repositoryRoot, adapters, descriptors, filters, on
         patterns: selectedPatterns.map((p) => ({ patternId: p.id }))
       };
       tools.push(toolEntry);
-      await applyAdapterParameterSuggestions(adapter, toolEntry, repositoryRoot, repoFiles);
+      await applyAdapterParameterSuggestions(
+        adapter,
+        toolEntry,
+        repositoryRoot,
+        filesVisibleTo(adapter.id)
+      );
     }
   }
   let selectedUnsupported = 0;
@@ -7389,7 +8011,7 @@ async function initAutoConfig(repositoryRoot, adapters, descriptors, filters, on
     }
     const family = toolGroupKey(desc.id, desc.alternativeGroup);
     if (selectedFamilies.has(family)) continue;
-    if (!hasMatchingFiles(repoFiles, desc.filePatterns)) continue;
+    if (!hasMatchingFiles(filesVisibleTo(desc.id), desc.filePatterns)) continue;
     const patternsMetadata = loadUnsupportedPatterns(desc.id);
     if (patternsMetadata.length === 0) continue;
     const selectedPatterns = filterAutoPatterns(
@@ -7414,11 +8036,7 @@ async function initAutoConfig(repositoryRoot, adapters, descriptors, filters, on
     tools,
     autoFilters: rawFilterString || void 0
   });
-  const { config, codacyYamlApplied } = await enrichWithCodacyYaml(
-    baseConfig,
-    repositoryRoot,
-    adapters
-  );
+  const { config, codacyYamlApplied } = enrichWithCodacyYaml(baseConfig, adapters, excludes);
   return {
     config,
     stats: {
@@ -7663,7 +8281,7 @@ function parseAutoFilters(raw) {
 }
 
 // src/index.ts
-var import_tooling6 = require("@codacy/tooling");
+var import_tooling8 = require("@codacy/tooling");
 
 // src/credentials.ts
 var import_crypto = __toESM(require("crypto"));
@@ -7728,6 +8346,17 @@ async function resolveApiToken() {
   if (stored) return stored;
   throw new Error("No API token found. Set CODACY_API_TOKEN or run 'codacy-analysis login'.");
 }
+async function resolveRemoteAuth(repositoryToken) {
+  const projectToken = repositoryToken || process.env.CODACY_PROJECT_TOKEN || void 0;
+  if (projectToken) return { kind: "repository-token", token: projectToken };
+  const apiToken = process.env.CODACY_API_TOKEN || await loadCredentials() || void 0;
+  if (!apiToken) {
+    throw new Error(
+      "No API token found. Provide --repository-token, set CODACY_PROJECT_TOKEN, set CODACY_API_TOKEN, or run 'codacy-analysis login'."
+    );
+  }
+  return { kind: "account-token", token: apiToken };
+}
 
 // src/git-info.ts
 var import_child_process5 = require("child_process");
@@ -7809,11 +8438,12 @@ function parseSarif(runs) {
       if (!patternId) continue;
       const level = mapSarifLevelToCodacy(result.level);
       const message = result.message?.text ?? "";
+      const sourceId = result.properties?.sourceId;
       for (const loc of result.locations ?? []) {
         const filePath = loc.physicalLocation?.artifactLocation?.uri;
         const line = loc.physicalLocation?.region?.startLine;
         if (!filePath || !line) continue;
-        issues.push({ toolId, patternId, filePath, line, message, level });
+        issues.push({ toolId, patternId, filePath, line, message, level, sourceId });
       }
     }
   }
@@ -7827,10 +8457,11 @@ function parseAnalysisResult(result) {
     line: issue.line,
     message: issue.message,
     // JSON carries the authoritative Codacy severity; pass it through unchanged.
-    level: issue.severity
+    level: issue.severity,
+    sourceId: issue.sourceId
   }));
 }
-function buildPayloads(issues, resolveShortName) {
+function buildPayloads(issues, resolveShortName, needsSourceId = () => false) {
   const byTool = /* @__PURE__ */ new Map();
   for (const issue of issues) {
     const list = byTool.get(issue.toolId);
@@ -7839,6 +8470,7 @@ function buildPayloads(issues, resolveShortName) {
   }
   const payloads = [];
   for (const [toolId, toolIssues] of byTool) {
+    const withSourceId = needsSourceId(toolId);
     const byFile = /* @__PURE__ */ new Map();
     for (const issue of toolIssues) {
       const entry = {
@@ -7847,7 +8479,8 @@ function buildPayloads(issues, resolveShortName) {
           filename: issue.filePath,
           message: { text: issue.message },
           level: issue.level,
-          location: { LineLocation: { line: issue.line } }
+          location: { LineLocation: { line: issue.line } },
+          ...withSourceId && issue.sourceId ? { sourceId: issue.sourceId } : {}
         }
       };
       const list = byFile.get(issue.filePath);
@@ -7879,6 +8512,13 @@ async function buildShortNameResolver(onProgress) {
   }
   return (toolId) => byName.get(toolId.toLowerCase()) ?? toolId.toLowerCase();
 }
+function buildSourceIdResolver() {
+  const needsIt = /* @__PURE__ */ new Set();
+  for (const descriptor of getRegisteredDescriptors()) {
+    if (descriptor.needsSourceIdUpload) needsIt.add(descriptor.id.toLowerCase());
+  }
+  return (toolId) => needsIt.has(toolId.toLowerCase());
+}
 var COORDINATE_PATTERN = /^[A-Za-z0-9._-]+$/;
 function assertValidCoordinate(kind, value) {
   if (!COORDINATE_PATTERN.test(value)) {
@@ -7918,7 +8558,7 @@ async function uploadReport(options) {
     onProgress?.("No issues found in the report; nothing to upload.");
   }
   const resolveShortName = await buildShortNameResolver(onProgress);
-  const payloads = buildPayloads(issues, resolveShortName);
+  const payloads = buildPayloads(issues, resolveShortName, buildSourceIdResolver());
   const base = resolveResultsApiBaseUrl();
   const urls = buildUrls(base, auth, commitUuid);
   const headers = { "content-type": "application/json", ...authHeader(auth) };
@@ -8019,9 +8659,11 @@ async function safeReadBody(res) {
   resolveApiToken,
   resolveBaselinePath,
   resolveConfigPath,
+  resolveDiscoveryExcludes,
   resolveEngineToAdapter,
   resolveHeadCommit,
   resolveProxyConfig,
+  resolveRemoteAuth,
   resolveRepositoryRoot,
   resolveResultsApiBaseUrl,
   rotateLogFiles,