@codacy/analysis-runner 0.18.0 → 0.20.0

package/dist/index.js

@@ -38,7 +38,7 @@ __export(index_exports, {
   clearAdapters: () => clearAdapters,
   computePatternSummary: () => computePatternSummary,
   configureApiToken: () => configureApiToken,
-  configureProxy: () => import_tooling6.configureProxy,
+  configureProxy: () => import_tooling8.configureProxy,
   createCodacyConfig: () => createCodacyConfig,
   createLogger: () => createLogger,
   createNullLogger: () => createNullLogger,
@@ -73,13 +73,16 @@ __export(index_exports, {
   registerAdapter: () => registerAdapter,
   registerLazyAdapter: () => registerLazyAdapter,
   registerUnsupportedTool: () => registerUnsupportedTool,
+  relativizeLocalConfigPaths: () => relativizeLocalConfigPaths,
   resolveApiToken: () => resolveApiToken,
   resolveBaselinePath: () => resolveBaselinePath,
   resolveConfigPath: () => resolveConfigPath,
   resolveDiscoveryExcludes: () => resolveDiscoveryExcludes,
   resolveEngineToAdapter: () => resolveEngineToAdapter,
   resolveHeadCommit: () => resolveHeadCommit,
-  resolveProxyConfig: () => import_tooling6.resolveProxyConfig,
+  resolveLocalConfigPaths: () => resolveLocalConfigPaths,
+  resolveProxyConfig: () => import_tooling8.resolveProxyConfig,
+  resolveRemoteAuth: () => resolveRemoteAuth,
   resolveRepositoryRoot: () => resolveRepositoryRoot,
   resolveResultsApiBaseUrl: () => resolveResultsApiBaseUrl,
   rotateLogFiles: () => rotateLogFiles,
@@ -176,7 +179,7 @@ function resolveBaselinePath(repositoryRoot, configFile) {
   const stem = import_path.default.basename(configPath, ext);
   return import_path.default.join(dir, `${stem}.baseline${ext}`);
 }
-async function readConfigAtPath(configPath) {
+async function readConfigAtPath(configPath, repositoryRoot) {
   let raw;
   try {
     raw = await import_promises.default.readFile(configPath, "utf-8");
@@ -191,21 +194,91 @@ async function readConfigAtPath(configPath) {
     throw new Error(`Invalid config at ${configPath}: expected a JSON object`);
   }
   const config = parsed;
+  assertConfigShape(config, configPath);
   coerceParameterValues(config);
+  resolveLocalConfigPaths(config, repositoryRoot);
   return config;
 }
+function assertConfigShape(config, configPath) {
+  const fail = (detail) => {
+    throw new Error(`Invalid config at ${configPath}: ${detail}`);
+  };
+  const isStringArray = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string");
+  if (config.exclude !== void 0 && !isStringArray(config.exclude))
+    fail(`"exclude" must be an array of strings`);
+  if (config.includeFiles !== void 0 && !isStringArray(config.includeFiles))
+    fail(`"includeFiles" must be an array of strings`);
+  if (!Array.isArray(config.tools)) fail(`"tools" must be an array`);
+  config.tools.forEach((tool, i) => {
+    const at = `tools[${i}]`;
+    if (typeof tool !== "object" || tool === null || Array.isArray(tool))
+      fail(`${at} must be an object`);
+    if (typeof tool.toolId !== "string" || tool.toolId === "")
+      fail(`${at}.toolId must be a non-empty string`);
+    if (tool.localConfigurationFile !== void 0 && typeof tool.localConfigurationFile !== "string")
+      fail(`${at}.localConfigurationFile must be a string ("${tool.toolId}")`);
+    if (tool.exclude !== void 0 && !isStringArray(tool.exclude))
+      fail(`${at}.exclude must be an array of strings ("${tool.toolId}")`);
+    if (tool.extraFilePatterns !== void 0 && !isStringArray(tool.extraFilePatterns))
+      fail(`${at}.extraFilePatterns must be an array of strings ("${tool.toolId}")`);
+    if (!Array.isArray(tool.patterns)) fail(`${at}.patterns must be an array ("${tool.toolId}")`);
+    tool.patterns.forEach((pattern, j) => {
+      const patternAt = `${at}.patterns[${j}]`;
+      if (typeof pattern !== "object" || pattern === null || Array.isArray(pattern))
+        fail(`${patternAt} must be an object`);
+      if (typeof pattern.patternId !== "string" || pattern.patternId === "")
+        fail(`${patternAt}.patternId must be a non-empty string`);
+      if (pattern.parameters === void 0) return;
+      if (typeof pattern.parameters !== "object" || pattern.parameters === null || Array.isArray(pattern.parameters))
+        fail(`${patternAt}.parameters must be an object ("${pattern.patternId}")`);
+      for (const [name, value] of Object.entries(pattern.parameters)) {
+        const isPrimitive = typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+        if (!isPrimitive)
+          fail(
+            `${patternAt}.parameters.${name} must be a string, number, or boolean ("${pattern.patternId}")`
+          );
+      }
+    });
+  });
+}
 async function readCodacyConfig(repositoryRoot, configFile) {
-  return readConfigAtPath(resolveConfigPath(repositoryRoot, configFile));
+  return readConfigAtPath(resolveConfigPath(repositoryRoot, configFile), repositoryRoot);
 }
 async function readBaselineConfig(repositoryRoot, configFile) {
-  return readConfigAtPath(resolveBaselinePath(repositoryRoot, configFile));
+  return readConfigAtPath(resolveBaselinePath(repositoryRoot, configFile), repositoryRoot);
 }
 async function writeBaselineConfig(repositoryRoot, config, configFile) {
   const baselinePath = resolveBaselinePath(repositoryRoot, configFile);
+  const serializable = relativizeLocalConfigPaths(config, repositoryRoot);
   await import_promises.default.mkdir(import_path.default.dirname(baselinePath), { recursive: true });
-  await import_promises.default.writeFile(baselinePath, JSON.stringify(config, null, 2) + "\n");
+  await import_promises.default.writeFile(baselinePath, JSON.stringify(serializable, null, 2) + "\n");
   return baselinePath;
 }
+function toRepoRelativeConfigPath(configFilePath, repositoryRoot) {
+  const normalized = configFilePath.replace(/\\/g, "/");
+  if (!import_path.default.isAbsolute(configFilePath)) return normalized;
+  const relative = import_path.default.relative(repositoryRoot, configFilePath);
+  const escapesRoot = relative === ".." || relative.startsWith(`..${import_path.default.sep}`);
+  if (!relative || escapesRoot || import_path.default.isAbsolute(relative)) return normalized;
+  return relative.replace(/\\/g, "/");
+}
+function relativizeLocalConfigPaths(config, repositoryRoot) {
+  const root = import_path.default.resolve(repositoryRoot);
+  return {
+    ...config,
+    tools: config.tools.map((tool) => {
+      if (!tool.localConfigurationFile) return tool;
+      const relative = toRepoRelativeConfigPath(tool.localConfigurationFile, root);
+      return relative === tool.localConfigurationFile ? tool : { ...tool, localConfigurationFile: relative };
+    })
+  };
+}
+function resolveLocalConfigPaths(config, repositoryRoot) {
+  for (const tool of config.tools) {
+    if (!tool.localConfigurationFile) continue;
+    tool.localConfigurationFile = import_path.default.resolve(repositoryRoot, tool.localConfigurationFile);
+  }
+}
 function coerceParameterValues(config) {
   for (const tool of config.tools) {
     for (const pattern of tool.patterns) {
@@ -220,8 +293,9 @@ function coerceParameterValues(config) {
 }
 async function writeCodacyConfigFile(repositoryRoot, config, configFile) {
   const configPath = resolveConfigPath(repositoryRoot, configFile);
+  const serializable = relativizeLocalConfigPaths(config, repositoryRoot);
   await import_promises.default.mkdir(import_path.default.dirname(configPath), { recursive: true });
-  await import_promises.default.writeFile(configPath, JSON.stringify(config, null, 2) + "\n");
+  await import_promises.default.writeFile(configPath, JSON.stringify(serializable, null, 2) + "\n");
   return configPath;
 }
 async function writeCodacyConfig(repositoryRoot, config, configFile) {
@@ -2331,508 +2405,1149 @@ var import_promises4 = __toESM(require("fs/promises"));
 var import_os3 = __toESM(require("os"));
 var import_path8 = __toESM(require("path"));
 var import_child_process4 = require("child_process");
-var import_tooling5 = require("@codacy/tooling");
+var import_tooling7 = require("@codacy/tooling");
 
-// src/discover.ts
+// src/discover/index.ts
 var import_promises2 = __toESM(require("fs/promises"));
 var import_path6 = __toESM(require("path"));
 
-// src/discover-catalog.ts
-var DEPENDENCY_CATALOG = /* @__PURE__ */ new Map([
-  // --- JavaScript / TypeScript — Frameworks ---
-  ["react", { displayName: "React", kind: "framework" }],
-  ["react-dom", { displayName: "React DOM", kind: "framework" }],
-  ["react-native", { displayName: "React Native", kind: "framework" }],
-  ["vue", { displayName: "Vue.js", kind: "framework" }],
-  ["nuxt", { displayName: "Nuxt", kind: "framework" }],
-  ["@angular/core", { displayName: "Angular", kind: "framework" }],
-  ["svelte", { displayName: "Svelte", kind: "framework" }],
-  ["@sveltejs/kit", { displayName: "SvelteKit", kind: "framework" }],
-  ["next", { displayName: "Next.js", kind: "framework" }],
-  ["ember-source", { displayName: "Ember.js", kind: "framework" }],
-  ["lit", { displayName: "Lit", kind: "framework" }],
-  ["solid-js", { displayName: "Solid", kind: "framework" }],
-  ["astro", { displayName: "Astro", kind: "framework" }],
-  ["@builder.io/qwik", { displayName: "Qwik", kind: "framework" }],
-  ["@builder.io/qwik-city", { displayName: "Qwik", kind: "framework" }],
-  ["@remix-run/react", { displayName: "Remix", kind: "framework" }],
-  ["gatsby", { displayName: "Gatsby", kind: "framework" }],
-  ["preact", { displayName: "Preact", kind: "framework" }],
-  ["express", { displayName: "Express", kind: "framework" }],
-  ["@nestjs/core", { displayName: "NestJS", kind: "framework" }],
-  ["fastify", { displayName: "Fastify", kind: "framework" }],
-  ["koa", { displayName: "Koa", kind: "framework" }],
-  ["@hapi/hapi", { displayName: "Hapi", kind: "framework" }],
-  ["hono", { displayName: "Hono", kind: "framework" }],
-  ["electron", { displayName: "Electron", kind: "framework" }],
+// src/discover/classify.ts
+var import_tooling6 = require("@codacy/tooling");
+
+// src/discover/ecosystems/npm.ts
+function parsePackageJson(content) {
+  try {
+    const pkg = JSON.parse(content);
+    const deps = [];
+    for (const section of ["dependencies", "devDependencies", "peerDependencies"]) {
+      const entries2 = pkg[section];
+      if (entries2 && typeof entries2 === "object") {
+        for (const [name, version] of Object.entries(entries2)) {
+          deps.push({ name, version: typeof version === "string" ? version : void 0 });
+        }
+      }
+    }
+    return deps;
+  } catch {
+    return [];
+  }
+}
+var TELLTALES = [
+  // --- Frameworks ---
+  ["react", "react"],
+  ["react-dom", "react-dom"],
+  ["react-native", "react-native"],
+  ["vue", "vue"],
+  ["nuxt", "nuxt"],
+  ["@angular/core", "angular"],
+  ["svelte", "svelte"],
+  ["@sveltejs/kit", "sveltekit"],
+  ["next", "next"],
+  ["ember-source", "ember"],
+  ["lit", "lit"],
+  ["solid-js", "solid"],
+  ["astro", "astro"],
+  ["@builder.io/qwik", "qwik"],
+  ["@builder.io/qwik-city", "qwik"],
+  ["@remix-run/react", "remix"],
+  ["gatsby", "gatsby"],
+  ["preact", "preact"],
+  ["express", "express"],
+  ["@nestjs/core", "nestjs"],
+  ["fastify", "fastify"],
+  ["koa", "koa"],
+  ["@hapi/hapi", "hapi"],
+  ["hono", "hono"],
+  ["electron", "electron"],
   // AWS CDK — the v2 umbrella package `aws-cdk-lib`, the CLI package `aws-cdk`,
-  // and the v1 `@aws-cdk/*` construct packages (prefix rule below).
-  ["aws-cdk-lib", { displayName: "AWS CDK", kind: "framework" }],
-  ["aws-cdk", { displayName: "AWS CDK", kind: "framework" }],
-  // --- JavaScript / TypeScript — Libraries ---
-  ["lodash", { displayName: "Lodash", kind: "library" }],
-  ["underscore", { displayName: "Underscore.js", kind: "library" }],
-  ["ramda", { displayName: "Ramda", kind: "library" }],
-  ["jest", { displayName: "Jest", kind: "library" }],
-  ["vitest", { displayName: "Vitest", kind: "library" }],
-  ["@playwright/test", { displayName: "Playwright", kind: "library" }],
-  ["playwright", { displayName: "Playwright", kind: "library" }],
-  ["cypress", { displayName: "Cypress", kind: "library" }],
-  ["mocha", { displayName: "Mocha", kind: "library" }],
-  ["ava", { displayName: "AVA", kind: "library" }],
-  ["jasmine", { displayName: "Jasmine", kind: "library" }],
-  ["jasmine-core", { displayName: "Jasmine", kind: "library" }],
-  ["@testing-library/react", { displayName: "Testing Library", kind: "library" }],
-  ["@testing-library/vue", { displayName: "Testing Library", kind: "library" }],
-  ["@testing-library/dom", { displayName: "Testing Library", kind: "library" }],
-  ["tailwindcss", { displayName: "Tailwind CSS", kind: "library" }],
-  ["@storybook/react", { displayName: "Storybook", kind: "library" }],
-  ["@storybook/vue3", { displayName: "Storybook", kind: "library" }],
-  ["@storybook/svelte", { displayName: "Storybook", kind: "library" }],
-  ["redux", { displayName: "Redux", kind: "library" }],
-  ["@reduxjs/toolkit", { displayName: "Redux Toolkit", kind: "library" }],
-  ["mobx", { displayName: "MobX", kind: "library" }],
-  ["zustand", { displayName: "Zustand", kind: "library" }],
-  ["axios", { displayName: "Axios", kind: "library" }],
-  ["date-fns", { displayName: "date-fns", kind: "library" }],
-  ["dayjs", { displayName: "Day.js", kind: "library" }],
-  ["moment", { displayName: "Moment.js", kind: "library" }],
-  ["rxjs", { displayName: "RxJS", kind: "library" }],
-  ["zod", { displayName: "Zod", kind: "library" }],
-  ["joi", { displayName: "Joi", kind: "library" }],
-  ["yup", { displayName: "Yup", kind: "library" }],
-  ["prisma", { displayName: "Prisma", kind: "library" }],
-  ["@prisma/client", { displayName: "Prisma", kind: "library" }],
-  ["typeorm", { displayName: "TypeORM", kind: "library" }],
-  ["sequelize", { displayName: "Sequelize", kind: "library" }],
-  ["drizzle-orm", { displayName: "Drizzle ORM", kind: "library" }],
-  ["mongoose", { displayName: "Mongoose", kind: "library" }],
-  ["graphql", { displayName: "GraphQL", kind: "library" }],
-  ["@apollo/client", { displayName: "Apollo Client", kind: "library" }],
-  ["socket.io", { displayName: "Socket.IO", kind: "library" }],
-  ["jquery", { displayName: "jQuery", kind: "library" }],
-  ["mongodb", { displayName: "MongoDB", kind: "library" }],
-  ["three", { displayName: "Three.js", kind: "library" }],
-  ["d3", { displayName: "D3.js", kind: "library" }],
-  ["chart.js", { displayName: "Chart.js", kind: "library" }],
-  ["sass", { displayName: "Sass", kind: "library" }],
-  ["node-sass", { displayName: "Sass", kind: "library" }],
-  ["less", { displayName: "Less", kind: "library" }],
-  ["styled-components", { displayName: "styled-components", kind: "library" }],
-  ["@emotion/react", { displayName: "Emotion", kind: "library" }],
-  ["pino", { displayName: "Pino", kind: "library" }],
-  ["winston", { displayName: "Winston", kind: "library" }],
-  ["i18next", { displayName: "i18next", kind: "library" }],
+  // and the v1 `@aws-cdk/*` construct packages (a prefix rule).
+  ["aws-cdk-lib", "aws-cdk"],
+  ["aws-cdk", "aws-cdk"],
+  // The v2 SDK is one flat package; v3 is the scoped `@aws-sdk/*` family, which a
+  // prefix rule below covers. Both mean "this code calls AWS".
+  ["aws-sdk", "aws-sdk"],
+  // --- Libraries ---
+  ["lodash", "lodash"],
+  ["underscore", "underscore"],
+  ["ramda", "ramda"],
+  ["jest", "jest"],
+  ["vitest", "vitest"],
+  ["@playwright/test", "playwright"],
+  ["playwright", "playwright"],
+  ["puppeteer", "puppeteer"],
+  ["puppeteer-core", "puppeteer"],
+  ["cypress", "cypress"],
+  ["mocha", "mocha"],
+  ["ava", "ava"],
+  ["jasmine", "jasmine"],
+  ["jasmine-core", "jasmine"],
+  ["@testing-library/react", "testing-library"],
+  ["@testing-library/vue", "testing-library"],
+  ["@testing-library/dom", "testing-library"],
+  ["tailwindcss", "tailwind-css"],
+  ["@storybook/react", "storybook"],
+  ["@storybook/vue3", "storybook"],
+  ["@storybook/svelte", "storybook"],
+  ["redux", "redux"],
+  ["@reduxjs/toolkit", "redux-toolkit"],
+  ["mobx", "mobx"],
+  ["zustand", "zustand"],
+  ["axios", "axios"],
+  ["date-fns", "date-fns"],
+  ["dayjs", "dayjs"],
+  ["moment", "moment"],
+  ["rxjs", "rxjs"],
+  ["zod", "zod"],
+  ["joi", "joi"],
+  ["yup", "yup"],
+  ["prisma", "prisma"],
+  ["@prisma/client", "prisma"],
+  ["typeorm", "typeorm"],
+  ["sequelize", "sequelize"],
+  ["drizzle-orm", "drizzle-orm"],
+  ["mongoose", "mongoose"],
+  ["graphql", "graphql"],
+  ["@apollo/client", "apollo-client"],
+  ["socket.io", "socketio"],
+  ["jquery", "jquery"],
+  ["mongodb", "mongodb"],
+  ["three", "threejs"],
+  ["d3", "d3"],
+  ["chart.js", "chartjs"],
+  ["sass", "sass"],
+  ["node-sass", "sass"],
+  ["less", "less"],
+  ["styled-components", "styled-components"],
+  ["@emotion/react", "emotion"],
+  ["pino", "pino"],
+  ["winston", "winston"],
+  ["i18next", "i18next"],
   // react-intl is the React binding of the FormatJS ecosystem; eslint-plugin-formatjs
   // lints both, so we report the umbrella name "formatjs" (matches the mapping key).
-  ["react-intl", { displayName: "formatjs", kind: "library" }],
-  ["vue-i18n", { displayName: "vue-i18n", kind: "library" }],
-  ["next-intl", { displayName: "next-intl", kind: "library" }],
+  ["react-intl", "formatjs"],
+  ["vue-i18n", "vue-i18n"],
+  ["next-intl", "next-intl"],
   // Type checker (eslint-plugin-flowtype). Also detected via a `.flowconfig` file.
-  ["flow-bin", { displayName: "Flow", kind: "library" }],
+  ["flow-bin", "flow"],
   // Legacy JS libraries with dedicated ESLint plugins.
-  ["backbone", { displayName: "Backbone.js", kind: "library" }],
-  ["chai", { displayName: "Chai", kind: "library" }],
-  ["codeceptjs", { displayName: "CodeceptJS", kind: "library" }],
-  ["webdriverio", { displayName: "WebdriverIO", kind: "library" }],
-  ["react-relay", { displayName: "Relay", kind: "library" }],
-  ["relay-runtime", { displayName: "Relay", kind: "library" }],
-  // --- JavaScript / TypeScript — Tools ---
-  ["typescript", { displayName: "TypeScript", kind: "tool" }],
-  ["eslint", { displayName: "ESLint", kind: "tool" }],
-  ["prettier", { displayName: "Prettier", kind: "tool" }],
-  ["webpack", { displayName: "Webpack", kind: "tool" }],
-  ["vite", { displayName: "Vite", kind: "tool" }],
-  ["esbuild", { displayName: "esbuild", kind: "tool" }],
-  ["rollup", { displayName: "Rollup", kind: "tool" }],
-  ["turbo", { displayName: "Turborepo", kind: "tool" }],
-  ["tsup", { displayName: "tsup", kind: "tool" }],
-  ["@biomejs/biome", { displayName: "Biome", kind: "tool" }],
-  ["stylelint", { displayName: "Stylelint", kind: "tool" }],
-  // --- JavaScript / TypeScript — Platforms ---
-  ["@lwc/engine-dom", { displayName: "Lightning Web Components", kind: "platform" }],
-  ["@salesforce/core", { displayName: "Salesforce", kind: "platform" }],
-  ["@shopify/polaris", { displayName: "Shopify Polaris", kind: "platform" }],
-  // --- Python — Frameworks ---
-  ["django", { displayName: "Django", kind: "framework" }],
-  ["flask", { displayName: "Flask", kind: "framework" }],
-  ["fastapi", { displayName: "FastAPI", kind: "framework" }],
-  ["tornado", { displayName: "Tornado", kind: "framework" }],
-  ["pyramid", { displayName: "Pyramid", kind: "framework" }],
-  ["starlette", { displayName: "Starlette", kind: "framework" }],
-  ["sanic", { displayName: "Sanic", kind: "framework" }],
-  ["bottle", { displayName: "Bottle", kind: "framework" }],
-  ["streamlit", { displayName: "Streamlit", kind: "framework" }],
-  ["gradio", { displayName: "Gradio", kind: "framework" }],
-  ["apache-airflow", { displayName: "Airflow", kind: "framework" }],
-  // --- Python — Libraries ---
-  ["flask-babel", { displayName: "Flask-Babel", kind: "library" }],
-  ["pytest", { displayName: "pytest", kind: "library" }],
-  ["numpy", { displayName: "NumPy", kind: "library" }],
-  ["pandas", { displayName: "pandas", kind: "library" }],
-  ["requests", { displayName: "Requests", kind: "library" }],
-  ["sqlalchemy", { displayName: "SQLAlchemy", kind: "library" }],
-  ["celery", { displayName: "Celery", kind: "library" }],
-  ["pydantic", { displayName: "Pydantic", kind: "library" }],
-  ["boto3", { displayName: "Boto3 (AWS SDK)", kind: "library" }],
-  ["scipy", { displayName: "SciPy", kind: "library" }],
-  ["scikit-learn", { displayName: "scikit-learn", kind: "library" }],
-  ["tensorflow", { displayName: "TensorFlow", kind: "library" }],
-  ["torch", { displayName: "PyTorch", kind: "library" }],
-  ["httpx", { displayName: "HTTPX", kind: "library" }],
-  ["aiohttp", { displayName: "aiohttp", kind: "library" }],
-  ["pillow", { displayName: "Pillow", kind: "library" }],
-  ["beautifulsoup4", { displayName: "Beautiful Soup", kind: "library" }],
-  ["scrapy", { displayName: "Scrapy", kind: "library" }],
-  ["alembic", { displayName: "Alembic", kind: "library" }],
-  ["marshmallow", { displayName: "Marshmallow", kind: "library" }],
-  ["click", { displayName: "Click", kind: "library" }],
-  ["typer", { displayName: "Typer", kind: "library" }],
-  ["rich", { displayName: "Rich", kind: "library" }],
-  ["polars", { displayName: "Polars", kind: "library" }],
-  ["dask", { displayName: "Dask", kind: "library" }],
-  ["matplotlib", { displayName: "Matplotlib", kind: "library" }],
-  ["seaborn", { displayName: "Seaborn", kind: "library" }],
-  ["plotly", { displayName: "Plotly", kind: "library" }],
+  ["backbone", "backbone"],
+  ["chai", "chai"],
+  ["codeceptjs", "codeceptjs"],
+  ["webdriverio", "webdriverio"],
+  ["react-relay", "relay"],
+  ["relay-runtime", "relay"],
+  // --- Tools ---
+  ["typescript", "typescript"],
+  ["eslint", "eslint"],
+  ["prettier", "prettier"],
+  ["webpack", "webpack"],
+  ["vite", "vite"],
+  ["esbuild", "esbuild"],
+  ["rollup", "rollup"],
+  ["turbo", "turborepo"],
+  ["tsup", "tsup"],
+  ["@biomejs/biome", "biome"],
+  ["stylelint", "stylelint"],
+  // --- Platforms ---
+  ["@lwc/engine-dom", "lightning-web-components"],
+  ["@salesforce/core", "salesforce"],
+  ["@shopify/polaris", "shopify-polaris"],
+  // The npm `angular` package is AngularJS 1.x — a different framework from both
+  // modern Angular (the `@angular/*` scope) and pub's AngularDart. One global
+  // name-keyed catalog could not hold all three; three entities can.
+  ["angular", "angular-js"]
+];
+var PREFIXES = [
+  ["@angular/", "angular"],
+  ["@nestjs/", "nestjs"],
+  ["@remix-run/", "remix"],
+  ["@sveltejs/", "sveltekit"],
+  ["@nuxt/", "nuxt"],
+  ["@storybook/", "storybook"],
+  ["@testing-library/", "testing-library"],
+  ["@tanstack/", "tanstack"],
+  ["@wdio/", "webdriverio"],
+  // AWS CDK v1 construct libraries are published under the @aws-cdk/ scope.
+  ["@aws-cdk/", "aws-cdk"],
+  ["@reduxjs/", "redux"],
+  ["@prisma/", "prisma"],
+  ["@apollo/", "apollo"],
+  ["@formatjs/", "formatjs"],
+  ["@lingui/", "lingui"],
+  ["@emotion/", "emotion"],
+  ["@mui/", "material-ui"],
+  ["@chakra-ui/", "chakra-ui"],
+  ["@lwc/", "lightning-web-components"],
+  ["@salesforce/", "salesforce"],
+  ["@shopify/", "shopify"],
+  ["@aws-sdk/", "aws-sdk"],
+  ["@google-cloud/", "google-cloud"],
+  ["@azure/", "azure-sdk"]
+];
+var npm = {
+  id: "npm",
+  manifests: [{ basename: "package.json", parser: parsePackageJson }],
+  telltales: TELLTALES,
+  prefixes: PREFIXES
+};
+
+// src/discover/ecosystems/pypi.ts
+function parseRequirementLine(rawLine) {
+  const line = rawLine.trim();
+  if (!line || line.startsWith("#") || line.startsWith("-")) return void 0;
+  const noComment = line.split("#")[0].trim();
+  if (!noComment) return void 0;
+  const match = noComment.match(/^([a-zA-Z0-9_.-]+(?:\[[^\]]*\])?)\s*([<>=!~@;].*)?$/);
+  if (!match) return void 0;
+  const rawName = match[1].replace(/\[.*\]$/, "");
+  return { name: rawName.toLowerCase().replace(/_/g, "-"), version: match[2]?.trim() };
+}
+function parseRequirementsTxt(content) {
+  const deps = [];
+  for (const rawLine of content.split("\n")) {
+    const dep = parseRequirementLine(rawLine);
+    if (dep) deps.push(dep);
+  }
+  return deps;
+}
+function sliceBalanced(content, fromIndex, open, close) {
+  const start = content.indexOf(open, fromIndex);
+  if (start === -1) return void 0;
+  let depth = 0;
+  let quote;
+  for (let i = start; i < content.length; i++) {
+    const ch = content[i];
+    if (quote) {
+      if (ch === "\\") i++;
+      else if (ch === quote) quote = void 0;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      continue;
+    }
+    if (ch === open) depth++;
+    else if (ch === close && --depth === 0) {
+      return { body: content.slice(start + 1, i), endIndex: i };
+    }
+  }
+  return void 0;
+}
+function parseSetupPy(content) {
+  const deps = [];
+  const collectQuoted = (block) => {
+    for (const quoted of block.matchAll(/["']([^"']+)["']/g)) {
+      const dep = parseRequirementLine(quoted[1]);
+      if (dep) deps.push(dep);
+    }
+  };
+  const valueStartOf = (key) => {
+    const match = new RegExp(`\\b${key}\\s*=\\s*`).exec(content);
+    return match ? match.index + match[0].length : -1;
+  };
+  for (const key of ["install_requires", "tests_require", "setup_requires"]) {
+    const start = valueStartOf(key);
+    if (start === -1 || content[start] !== "[") continue;
+    const list = sliceBalanced(content, start, "[", "]");
+    if (list) collectQuoted(list.body);
+  }
+  const extrasStart = valueStartOf("extras_require");
+  if (extrasStart !== -1 && content[extrasStart] === "{") {
+    const dict = sliceBalanced(content, extrasStart, "{", "}");
+    if (dict) {
+      let cursor = 0;
+      while (cursor < dict.body.length) {
+        const list = sliceBalanced(dict.body, cursor, "[", "]");
+        if (!list) break;
+        collectQuoted(list.body);
+        cursor = list.endIndex + 1;
+      }
+    }
+  }
+  return deps;
+}
+function parsePyprojectToml(content) {
+  const deps = [];
+  const projectDepsMatch = content.match(/\[project\][\s\S]*?dependencies\s*=\s*\[([\s\S]*?)\]/);
+  if (projectDepsMatch) {
+    const items = projectDepsMatch[1].match(/"([^"]+)"|'([^']+)'/g) ?? [];
+    for (const item of items) {
+      const raw = item.replace(/["']/g, "");
+      const name = raw.split(/[<>=!~;\s]/)[0].replace(/\[.*\]$/, "");
+      if (name) deps.push({ name: name.toLowerCase().replace(/_/g, "-") });
+    }
+  }
+  const poetryMatch = content.match(/\[tool\.poetry\.dependencies\]([\s\S]*?)(?:\n\[|\n$)/);
+  if (poetryMatch) {
+    const lines = poetryMatch[1].split("\n");
+    for (const line of lines) {
+      const m = line.match(/^([a-zA-Z0-9_.-]+)\s*=/);
+      if (m && m[1] !== "python") {
+        deps.push({ name: m[1].toLowerCase().replace(/_/g, "-") });
+      }
+    }
+  }
+  const poetryGroupRegex = /\[tool\.poetry\.group\.\w+\.dependencies\]([\s\S]*?)(?:\n\[|\n$)/g;
+  let groupMatch;
+  while ((groupMatch = poetryGroupRegex.exec(content)) !== null) {
+    const lines = groupMatch[1].split("\n");
+    for (const line of lines) {
+      const m = line.match(/^([a-zA-Z0-9_.-]+)\s*=/);
+      if (m) {
+        deps.push({ name: m[1].toLowerCase().replace(/_/g, "-") });
+      }
+    }
+  }
+  return deps;
+}
+function parsePipfile(content) {
+  const deps = [];
+  let inDepsSection = false;
+  for (const rawLine of content.split("\n")) {
+    const line = rawLine.trim();
+    if (/^\[(packages|dev-packages)\]/.test(line)) {
+      inDepsSection = true;
+      continue;
+    }
+    if (line.startsWith("[")) {
+      inDepsSection = false;
+      continue;
+    }
+    if (inDepsSection) {
+      const m = line.match(/^([a-zA-Z0-9_.-]+)\s*=/);
+      if (m) {
+        deps.push({ name: m[1].toLowerCase().replace(/_/g, "-") });
+      }
+    }
+  }
+  return deps;
+}
+var TELLTALES2 = [
+  // --- Frameworks ---
+  ["django", "django"],
+  ["flask", "flask"],
+  ["fastapi", "fastapi"],
+  ["tornado", "tornado"],
+  ["pyramid", "pyramid"],
+  ["starlette", "starlette"],
+  ["sanic", "sanic"],
+  ["bottle", "bottle"],
+  ["streamlit", "streamlit"],
+  ["gradio", "gradio"],
+  ["apache-airflow", "airflow"],
+  // --- Libraries ---
+  ["flask-babel", "flask-babel"],
+  ["pytest", "pytest"],
+  ["numpy", "numpy"],
+  ["pandas", "pandas"],
+  ["requests", "requests"],
+  ["sqlalchemy", "sqlalchemy"],
+  ["celery", "celery"],
+  ["pydantic", "pydantic"],
+  ["boto3", "boto3"],
+  // `botocore` is boto3's transport layer and `aws-lambda-powertools` depends on
+  // it; either declared alone still means "this is AWS code". Lambda runtimes
+  // preinstall boto3, so it is routinely absent from requirements.txt.
+  ["botocore", "boto3"],
+  ["aws-lambda-powertools", "boto3"],
+  ["scipy", "scipy"],
+  ["scikit-learn", "scikit-learn"],
+  ["tensorflow", "tensorflow"],
+  ["torch", "pytorch"],
+  ["httpx", "httpx"],
+  ["aiohttp", "aiohttp"],
+  ["pillow", "pillow"],
+  ["beautifulsoup4", "beautiful-soup"],
+  ["scrapy", "scrapy"],
+  ["alembic", "alembic"],
+  ["marshmallow", "marshmallow"],
+  ["click", "click"],
+  ["typer", "typer"],
+  ["rich", "rich"],
+  ["polars", "polars"],
+  ["dask", "dask"],
+  ["matplotlib", "matplotlib"],
+  ["seaborn", "seaborn"],
+  ["plotly", "plotly"],
+  ["jinja2", "jinja2"],
+  ["mako", "mako"],
+  ["lxml", "lxml"],
+  ["pyyaml", "pyyaml"],
+  ["paramiko", "paramiko"],
+  ["twilio", "twilio"],
+  // Structured-concurrency libraries. Ruff's `ASYNC1xx` rules are written against
+  // trio's checkpoint model and anyio implements the same one, so either gates them.
+  ["trio", "trio"],
+  ["anyio", "anyio"],
+  // The two crypto packages are distinct projects with distinct Bandit checks
+  // (`B413` imports PyCrypto, `B414` PyCryptodome), so they must not be merged.
+  // `pycryptodomex` is the same project published under its `Cryptodome` namespace.
+  ["pycrypto", "pycrypto"],
+  ["pycryptodome", "pycryptodome"],
+  ["pycryptodomex", "pycryptodome"],
+  // `pysnmp` was renamed to `pysnmplib` for part of its history; both are the
+  // library Bandit's `B508`/`B509` weak-SNMP checks apply to.
+  ["pysnmp", "pysnmp"],
+  ["pysnmplib", "pysnmp"],
   // MongoDB drivers, one entry per ecosystem — they all gate the same
   // MongoDB-specific patterns (Opengrep's `java.mongodb.`/`python.pymongo.`).
-  ["pymongo", { displayName: "MongoDB", kind: "library" }],
-  ["motor", { displayName: "MongoDB", kind: "library" }],
-  // --- Python — Tools ---
-  ["black", { displayName: "Black", kind: "tool" }],
-  ["ruff", { displayName: "Ruff", kind: "tool" }],
-  ["mypy", { displayName: "mypy", kind: "tool" }],
-  ["pylint", { displayName: "Pylint", kind: "tool" }],
-  ["flake8", { displayName: "Flake8", kind: "tool" }],
-  ["bandit", { displayName: "Bandit", kind: "tool" }],
-  ["isort", { displayName: "isort", kind: "tool" }],
-  // --- Ruby — Frameworks ---
-  ["rails", { displayName: "Ruby on Rails", kind: "framework" }],
-  ["sinatra", { displayName: "Sinatra", kind: "framework" }],
-  ["hanami", { displayName: "Hanami", kind: "framework" }],
-  ["grape", { displayName: "Grape", kind: "framework" }],
-  ["padrino", { displayName: "Padrino", kind: "framework" }],
-  // --- Ruby — Libraries ---
-  ["rspec", { displayName: "RSpec", kind: "library" }],
-  ["rspec-core", { displayName: "RSpec", kind: "library" }],
-  ["rspec-rails", { displayName: "RSpec Rails", kind: "library" }],
-  ["capybara", { displayName: "Capybara", kind: "library" }],
-  ["sidekiq", { displayName: "Sidekiq", kind: "library" }],
-  ["devise", { displayName: "Devise", kind: "library" }],
-  ["pundit", { displayName: "Pundit", kind: "library" }],
-  ["activeadmin", { displayName: "ActiveAdmin", kind: "library" }],
-  ["puma", { displayName: "Puma", kind: "library" }],
-  ["nokogiri", { displayName: "Nokogiri", kind: "library" }],
-  ["faraday", { displayName: "Faraday", kind: "library" }],
-  ["httparty", { displayName: "HTTParty", kind: "library" }],
-  ["minitest", { displayName: "Minitest", kind: "library" }],
-  ["factory_bot", { displayName: "FactoryBot", kind: "library" }],
-  ["dry-validation", { displayName: "dry-validation", kind: "library" }],
-  // NOTE: `faker` and `rake` are Gemfile-scoped (MANIFEST_SCOPED_CATALOG), not
-  // global — they are bare words that also name npm/PyPI packages.
-  // --- Ruby — Tools ---
-  ["rubocop", { displayName: "RuboCop", kind: "tool" }],
-  ["bundler", { displayName: "Bundler", kind: "tool" }],
+  ["pymongo", "mongodb"],
+  ["motor", "mongodb"],
+  // --- Tools ---
+  ["black", "black"],
+  ["ruff", "ruff"],
+  ["mypy", "mypy"],
+  ["pylint", "pylint"],
+  ["flake8", "flake8"],
+  ["bandit", "bandit"],
+  ["isort", "isort"]
+];
+var pypi = {
+  id: "pypi",
+  manifests: [
+    { basename: "requirements.txt", parser: parseRequirementsTxt },
+    { basename: "pyproject.toml", parser: parsePyprojectToml },
+    { basename: "Pipfile", parser: parsePipfile },
+    { basename: "setup.py", parser: parseSetupPy },
+    {
+      // The requirements family, by path: real projects split it by environment
+      // (`requirements-dev.txt`, `requirements/base.txt`, `requirements.in` for
+      // pip-tools). Matching only the exact name made every dependency of a split
+      // layout invisible, and with it the gating for Django, Flask, FastAPI,
+      // pytest, pandas and NumPy patterns.
+      matches: (filePath, basename) => /^requirements[a-zA-Z0-9_.-]*\.(txt|in)$/i.test(basename) || /(^|\/)requirements\/[^/]+\.(txt|in)$/i.test(filePath),
+      parser: parseRequirementsTxt
+    }
+  ],
+  telltales: TELLTALES2
+};
+
+// src/discover/ecosystems/gem.ts
+function parseGemfile(content) {
+  const deps = [];
+  const gemRegex = /^\s*gem\s+["']([^"']+)["'](?:\s*,\s*["']([^"']+)["'])?/gm;
+  let match;
+  while ((match = gemRegex.exec(content)) !== null) {
+    deps.push({ name: match[1], version: match[2] });
+  }
+  return deps;
+}
+var TELLTALES3 = [
+  // --- Frameworks ---
+  ["rails", "ruby-on-rails"],
+  ["sinatra", "sinatra"],
+  ["hanami", "hanami"],
+  ["grape", "grape"],
+  ["padrino", "padrino"],
+  // --- Libraries ---
+  ["rspec", "rspec"],
+  ["rspec-core", "rspec"],
+  ["rspec-rails", "rspec-rails"],
+  ["capybara", "capybara"],
+  ["sidekiq", "sidekiq"],
+  ["devise", "devise"],
+  ["pundit", "pundit"],
+  ["activeadmin", "activeadmin"],
+  ["puma", "puma"],
+  ["nokogiri", "nokogiri"],
+  ["faraday", "faraday"],
+  ["httparty", "httparty"],
+  ["minitest", "minitest"],
+  ["factory_bot", "factorybot"],
+  ["dry-validation", "dry-validation"],
+  // --- Tools ---
+  ["rubocop", "rubocop"],
+  ["bundler", "bundler"],
   // Sorbet ships as several gems; any of them means the project is Sorbet-typed.
-  ["sorbet", { displayName: "Sorbet", kind: "tool" }],
-  ["sorbet-runtime", { displayName: "Sorbet", kind: "tool" }],
-  ["sorbet-static", { displayName: "Sorbet", kind: "tool" }],
-  ["sorbet-static-and-runtime", { displayName: "Sorbet", kind: "tool" }],
-  ["solargraph", { displayName: "Solargraph", kind: "tool" }],
+  ["sorbet", "sorbet"],
+  ["sorbet-runtime", "sorbet"],
+  ["sorbet-static", "sorbet"],
+  ["sorbet-static-and-runtime", "sorbet"],
+  ["solargraph", "solargraph"],
+  // GetText, under both the plain gem and its Rails integration. RuboCop's
+  // `I18n_GetText_*` cops rewrite `_()`-decorated strings, so they only apply to a
+  // project that actually uses GetText rather than Rails' own I18n.
+  ["gettext", "gettext"],
+  ["gettext_i18n_rails", "gettext"],
+  ["rubocop-i18n", "gettext"],
+  // --- Names other registries also publish ---
+  // `faker`, `rake` and `graphql` all exist on npm and PyPI too, and all three
+  // gate RuboCop cops. Reaching them only from a Gemfile is the whole point of
+  // scoping by ecosystem — a JS dependency must not enable Ruby cops.
+  ["faker", "faker"],
+  ["rake", "rake"],
+  ["graphql", "graphql"]
+];
+var gem = {
+  id: "gem",
+  manifests: [{ basename: "Gemfile", parser: parseGemfile }],
+  telltales: TELLTALES3
+};
+
+// src/discover/ecosystems/maven.ts
+function parsePomXml(content) {
+  const deps = [];
+  const depRegex = /<dependency>[\s\S]*?<artifactId>([^<]+)<\/artifactId>[\s\S]*?<\/dependency>/g;
+  let match;
+  while ((match = depRegex.exec(content)) !== null) {
+    deps.push({ name: match[1].trim() });
+  }
+  return deps;
+}
+function parseBuildGradle(content) {
+  const deps = [];
+  const depRegex = /(?:implementation|testImplementation|testCompileOnly|testRuntimeOnly|api|compileOnly|runtimeOnly|kapt|annotationProcessor)\s*(?:\(\s*)?["']([^"':]+):([^"':]+)(?::([^"']+))?["']/g;
+  let match;
+  while ((match = depRegex.exec(content)) !== null) {
+    deps.push({ name: match[2].trim(), version: match[3]?.trim() });
+  }
+  return deps;
+}
+function parseVersionCatalogToml(content) {
+  const deps = [];
+  let inLibraries = false;
+  for (const rawLine of content.split("\n")) {
+    const line = rawLine.trim();
+    if (line === "" || line.startsWith("#")) continue;
+    if (line.startsWith("[")) {
+      inLibraries = /^\[\s*libraries\s*\]/.test(line);
+      continue;
+    }
+    if (!inLibraries) continue;
+    const moduleMatch = line.match(/\bmodule\s*=\s*["'][^"':]+:([^"']+)["']/);
+    const nameMatch = line.match(/\bname\s*=\s*["']([^"']+)["']/);
+    const versionMatch = line.match(/\bversion\s*=\s*["']([^"']+)["']/);
+    if (moduleMatch || nameMatch) {
+      deps.push({
+        name: (moduleMatch?.[1] ?? nameMatch?.[1] ?? "").trim(),
+        version: versionMatch?.[1]?.trim()
+      });
+      continue;
+    }
+    const shorthand = line.match(/^[A-Za-z0-9_.-]+\s*=\s*["'][^"':]+:([^"':]+)(?::([^"']+))?["']/);
+    if (shorthand) {
+      deps.push({ name: shorthand[1].trim(), version: shorthand[2]?.trim() });
+    }
+  }
+  return deps;
+}
+function parseBuildSbt(content) {
+  const deps = [];
+  const depRegex = /"([^"]+)"\s*%%?\s*"([^"]+)"\s*%(?!%)\s*(?:"([^"]+)")?/g;
+  let match;
+  while ((match = depRegex.exec(content)) !== null) {
+    deps.push({ name: match[2], version: match[3] });
+  }
+  return deps;
+}
+function parseSbtBuildDefinition(content) {
+  const deps = parseBuildSbt(content);
+  const pluginRegex = /addSbtPlugin\s*\(\s*"([^"]+)"\s*%%?\s*"([^"]+)"/g;
+  let match;
+  while ((match = pluginRegex.exec(content)) !== null) {
+    deps.push({ name: `${match[1]}:${match[2]}` });
+  }
+  return deps;
+}
+var TELLTALES4 = [
   // --- Java / Kotlin — Frameworks ---
-  ["spring-boot-starter", { displayName: "Spring Boot", kind: "framework" }],
-  ["spring-boot-starter-web", { displayName: "Spring Boot", kind: "framework" }],
-  ["spring-core", { displayName: "Spring Framework", kind: "framework" }],
-  ["quarkus-core", { displayName: "Quarkus", kind: "framework" }],
-  ["micronaut-core", { displayName: "Micronaut", kind: "framework" }],
-  ["ktor-server-core", { displayName: "Ktor", kind: "framework" }],
-  ["android", { displayName: "Android SDK", kind: "framework" }],
+  ["spring-boot-starter", "spring-boot"],
+  ["spring-boot-starter-web", "spring-boot"],
+  ["spring-core", "spring-framework"],
+  ["quarkus-core", "quarkus"],
+  ["micronaut-core", "micronaut"],
+  ["ktor-server-core", "ktor"],
+  ["android", "android-sdk"],
   // --- Java / Kotlin — Libraries ---
-  ["junit-jupiter", { displayName: "JUnit 5", kind: "library" }],
-  ["junit", { displayName: "JUnit", kind: "library" }],
-  ["junit-jupiter-api", { displayName: "JUnit 5", kind: "library" }],
-  ["mockito-core", { displayName: "Mockito", kind: "library" }],
-  ["lombok", { displayName: "Lombok", kind: "library" }],
-  ["jackson-databind", { displayName: "Jackson", kind: "library" }],
-  ["jackson-core", { displayName: "Jackson", kind: "library" }],
-  ["hibernate-core", { displayName: "Hibernate", kind: "library" }],
-  ["guava", { displayName: "Guava", kind: "library" }],
-  ["commons-lang3", { displayName: "Apache Commons Lang", kind: "library" }],
-  ["commons-io", { displayName: "Apache Commons IO", kind: "library" }],
-  ["slf4j-api", { displayName: "SLF4J", kind: "library" }],
-  ["log4j-core", { displayName: "Log4j", kind: "library" }],
-  ["logback-classic", { displayName: "Logback", kind: "library" }],
-  ["testng", { displayName: "TestNG", kind: "library" }],
-  ["assertj-core", { displayName: "AssertJ", kind: "library" }],
-  ["gson", { displayName: "Gson", kind: "library" }],
-  ["okhttp", { displayName: "OkHttp", kind: "library" }],
-  ["retrofit", { displayName: "Retrofit", kind: "library" }],
-  ["spock-core", { displayName: "Spock", kind: "library" }],
-  ["mongodb-driver-sync", { displayName: "MongoDB", kind: "library" }],
-  ["mongodb-driver-core", { displayName: "MongoDB", kind: "library" }],
-  ["mongodb-driver-reactivestreams", { displayName: "MongoDB", kind: "library" }],
-  ["mongo-java-driver", { displayName: "MongoDB", kind: "library" }],
+  ["junit-jupiter", "junit-5"],
+  ["junit", "junit"],
+  ["junit-jupiter-api", "junit-5"],
+  // Spring Boot's test starter is the single most common Java test declaration and
+  // pulls JUnit 5 transitively; without it PMD's JUnit rules are unreachable for
+  // most Spring projects. The `junit-jupiter-`/`junit-platform-` prefixes below
+  // cover `-engine`/`-params`/`-launcher`, which Gradle declares separately.
+  ["spring-boot-starter-test", "junit-5"],
+  ["mockito-core", "mockito"],
+  ["lombok", "lombok"],
+  ["jackson-databind", "jackson"],
+  ["jackson-core", "jackson"],
+  ["hibernate-core", "hibernate"],
+  ["guava", "guava"],
+  ["commons-lang3", "apache-commons-lang"],
+  ["commons-io", "apache-commons-io"],
+  ["commons-logging", "apache-commons-logging"],
+  ["commons-fileupload", "apache-commons-fileupload"],
+  ["commons-fileupload2-core", "apache-commons-fileupload"],
+  // The EJB/Jakarta EE API jars, under every name they have shipped as. PMD's
+  // session-bean naming and static-field rules only mean anything with these on
+  // the classpath.
+  ["jakarta.ejb-api", "jakarta-ee"],
+  ["javax.ejb-api", "jakarta-ee"],
+  ["jakarta.jakartaee-api", "jakarta-ee"],
+  ["jakarta.jakartaee-web-api", "jakarta-ee"],
+  ["javaee-api", "jakarta-ee"],
+  ["javaee-web-api", "jakarta-ee"],
+  ["slf4j-api", "slf4j"],
+  ["log4j-core", "log4j"],
+  ["logback-classic", "logback"],
+  ["testng", "testng"],
+  ["assertj-core", "assertj"],
+  ["gson", "gson"],
+  ["okhttp", "okhttp"],
+  ["retrofit", "retrofit"],
+  ["spock-core", "spock"],
+  ["mongodb-driver-sync", "mongodb"],
+  ["mongodb-driver-core", "mongodb"],
+  ["mongodb-driver-reactivestreams", "mongodb"],
+  ["mongo-java-driver", "mongodb"],
   // --- Groovy — Frameworks ---
   // Grails/GORM artifact IDs vary (grails-core, grails-web, gorm-hibernate5, …);
-  // the `grails-`/`gorm-` prefix rules below catch the rest.
-  ["grails-core", { displayName: "Grails", kind: "framework" }],
-  ["gorm-core", { displayName: "GORM", kind: "library" }],
-  // --- Go — Frameworks ---
-  ["github.com/gin-gonic/gin", { displayName: "Gin", kind: "framework" }],
-  ["github.com/labstack/echo", { displayName: "Echo", kind: "framework" }],
-  ["github.com/gofiber/fiber", { displayName: "Fiber", kind: "framework" }],
-  ["github.com/go-chi/chi", { displayName: "Chi", kind: "framework" }],
-  ["github.com/gorilla/mux", { displayName: "Gorilla Mux", kind: "framework" }],
-  ["github.com/beego/beego", { displayName: "Beego", kind: "framework" }],
-  // --- Go — Libraries ---
-  ["github.com/stretchr/testify", { displayName: "Testify", kind: "library" }],
-  ["github.com/spf13/cobra", { displayName: "Cobra", kind: "library" }],
-  ["github.com/spf13/viper", { displayName: "Viper", kind: "library" }],
-  ["go.uber.org/zap", { displayName: "Zap", kind: "library" }],
-  ["github.com/sirupsen/logrus", { displayName: "Logrus", kind: "library" }],
-  ["gorm.io/gorm", { displayName: "GORM", kind: "library" }],
-  ["github.com/go-kit/kit", { displayName: "Go Kit", kind: "library" }],
-  ["google.golang.org/protobuf", { displayName: "Protocol Buffers", kind: "library" }],
-  ["google.golang.org/grpc", { displayName: "gRPC", kind: "library" }],
-  ["github.com/jackc/pgx", { displayName: "pgx", kind: "library" }],
-  ["github.com/redis/go-redis", { displayName: "go-redis", kind: "library" }],
-  ["github.com/aws/aws-sdk-go-v2", { displayName: "AWS SDK for Go", kind: "library" }],
-  ["github.com/prometheus/client_golang", { displayName: "Prometheus Client", kind: "library" }],
-  // --- Rust — Frameworks ---
-  ["actix-web", { displayName: "Actix Web", kind: "framework" }],
-  ["axum", { displayName: "Axum", kind: "framework" }],
-  ["rocket", { displayName: "Rocket", kind: "framework" }],
-  ["warp", { displayName: "Warp", kind: "framework" }],
-  ["tauri", { displayName: "Tauri", kind: "framework" }],
-  // --- Rust — Libraries ---
-  ["tokio", { displayName: "Tokio", kind: "library" }],
-  ["serde", { displayName: "Serde", kind: "library" }],
-  ["clap", { displayName: "clap", kind: "library" }],
-  ["reqwest", { displayName: "reqwest", kind: "library" }],
-  ["diesel", { displayName: "Diesel", kind: "library" }],
-  ["sqlx", { displayName: "SQLx", kind: "library" }],
-  ["tracing", { displayName: "Tracing", kind: "library" }],
-  ["anyhow", { displayName: "anyhow", kind: "library" }],
-  ["thiserror", { displayName: "thiserror", kind: "library" }],
-  ["rayon", { displayName: "Rayon", kind: "library" }],
-  // --- PHP — Frameworks ---
-  ["laravel/framework", { displayName: "Laravel", kind: "framework" }],
-  ["symfony/framework-bundle", { displayName: "Symfony", kind: "framework" }],
-  ["symfony/symfony", { displayName: "Symfony", kind: "framework" }],
-  ["codeigniter4/framework", { displayName: "CodeIgniter", kind: "framework" }],
-  ["slim/slim", { displayName: "Slim", kind: "framework" }],
-  ["cakephp/cakephp", { displayName: "CakePHP", kind: "framework" }],
-  // WordPress is rarely a real Composer dependency; these are the common
-  // "WordPress as a dependency" packages used by Bedrock/Composer-based sites.
-  ["johnpbloch/wordpress-core", { displayName: "WordPress", kind: "framework" }],
-  ["johnpbloch/wordpress", { displayName: "WordPress", kind: "framework" }],
-  ["roots/wordpress", { displayName: "WordPress", kind: "framework" }],
-  ["drupal/core", { displayName: "Drupal", kind: "framework" }],
-  ["drupal/core-recommended", { displayName: "Drupal", kind: "framework" }],
-  ["magento/product-community-edition", { displayName: "Magento", kind: "framework" }],
-  ["magento/product-enterprise-edition", { displayName: "Magento", kind: "framework" }],
-  ["magento/framework", { displayName: "Magento", kind: "framework" }],
-  // --- PHP — Libraries ---
-  ["phpunit/phpunit", { displayName: "PHPUnit", kind: "library" }],
-  ["guzzlehttp/guzzle", { displayName: "Guzzle", kind: "library" }],
-  ["monolog/monolog", { displayName: "Monolog", kind: "library" }],
-  ["nesbot/carbon", { displayName: "Carbon", kind: "library" }],
-  ["doctrine/orm", { displayName: "Doctrine ORM", kind: "library" }],
-  ["doctrine/dbal", { displayName: "Doctrine DBAL", kind: "library" }],
-  ["league/flysystem", { displayName: "Flysystem", kind: "library" }],
-  ["php-amqplib/php-amqplib", { displayName: "php-amqplib", kind: "library" }],
-  ["predis/predis", { displayName: "Predis", kind: "library" }],
-  // --- PHP — Tools ---
-  ["phpstan/phpstan", { displayName: "PHPStan", kind: "tool" }],
-  ["squizlabs/php_codesniffer", { displayName: "PHP_CodeSniffer", kind: "tool" }],
-  // --- Swift — Frameworks ---
-  ["vapor", { displayName: "Vapor", kind: "framework" }],
-  // --- Swift — Libraries ---
-  ["Alamofire", { displayName: "Alamofire", kind: "library" }],
-  ["SnapKit", { displayName: "SnapKit", kind: "library" }],
-  ["Kingfisher", { displayName: "Kingfisher", kind: "library" }],
-  ["Moya", { displayName: "Moya", kind: "library" }],
-  ["RxSwift", { displayName: "RxSwift", kind: "library" }],
-  ["RealmSwift", { displayName: "Realm", kind: "library" }],
+  // the `grails-`/`gorm-` prefix rules catch the rest.
+  ["grails-core", "grails"],
+  ["gorm-core", "grails-gorm"],
   // --- Scala — Frameworks ---
   // Play is declared as an sbt *plugin*, so `group:artifact` (from
-  // `addSbtPlugin`) is the reliable signal; the library artifacts below only
+  // `addSbtPlugin`) is the reliable signal; the library artifacts that follow only
   // appear in some builds. `play-json` is deliberately absent — it is a
   // standalone JSON library used widely outside Play.
-  ["com.typesafe.play:sbt-plugin", { displayName: "Play Framework", kind: "framework" }],
-  ["org.playframework:sbt-plugin", { displayName: "Play Framework", kind: "framework" }],
-  ["play", { displayName: "Play Framework", kind: "framework" }],
-  ["play-server", { displayName: "Play Framework", kind: "framework" }],
-  ["play-ws", { displayName: "Play Framework", kind: "framework" }],
-  ["play-test", { displayName: "Play Framework", kind: "framework" }],
-  ["play-slick", { displayName: "Play Framework", kind: "framework" }],
-  ["twirl-api", { displayName: "Play Framework", kind: "framework" }],
-  ["scalatestplus-play", { displayName: "Play Framework", kind: "framework" }],
-  ["akka-actor", { displayName: "Akka", kind: "framework" }],
-  ["spray-can", { displayName: "Spray", kind: "framework" }],
+  ["com.typesafe.play:sbt-plugin", "play-framework"],
+  ["org.playframework:sbt-plugin", "play-framework"],
+  ["play", "play-framework"],
+  ["play-server", "play-framework"],
+  ["play-ws", "play-framework"],
+  ["play-test", "play-framework"],
+  ["play-slick", "play-framework"],
+  ["twirl-api", "play-framework"],
+  ["scalatestplus-play", "play-framework"],
+  ["akka-actor", "akka"],
+  ["spray-can", "spray"],
   // --- Scala — Libraries ---
-  ["scalatest", { displayName: "ScalaTest", kind: "library" }],
-  ["specs2-core", { displayName: "Specs2", kind: "library" }],
-  ["cats-core", { displayName: "Cats", kind: "library" }],
-  ["circe-core", { displayName: "Circe", kind: "library" }],
+  ["scalatest", "scalatest"],
+  ["specs2-core", "specs2"],
+  ["cats-core", "cats"],
+  ["circe-core", "circe"],
   // Slick gates Opengrep's `scala.slick.` SQL-injection patterns.
-  ["slick", { displayName: "Slick", kind: "library" }],
-  ["slick-hikaricp", { displayName: "Slick", kind: "library" }],
+  ["slick", "slick"],
+  ["slick-hikaricp", "slick"],
   // jwt-scala publishes one artifact per JSON backend; all gate the same
   // hardcoded-secret patterns.
-  ["jwt-core", { displayName: "jwt-scala", kind: "library" }],
-  ["jwt-circe", { displayName: "jwt-scala", kind: "library" }],
-  ["jwt-play-json", { displayName: "jwt-scala", kind: "library" }],
-  ["jwt-json4s", { displayName: "jwt-scala", kind: "library" }],
-  ["jwt-spray-json", { displayName: "jwt-scala", kind: "library" }],
-  ["jwt-upickle", { displayName: "jwt-scala", kind: "library" }],
-  ["jwt-argonaut", { displayName: "jwt-scala", kind: "library" }],
-  ["munit", { displayName: "MUnit", kind: "library" }],
-  ["scalacheck", { displayName: "ScalaCheck", kind: "library" }],
-  ["scala-logging", { displayName: "scala-logging", kind: "library" }],
-  ["chimney", { displayName: "Chimney", kind: "library" }],
-  // --- Elixir — Frameworks ---
-  ["phoenix", { displayName: "Phoenix", kind: "framework" }],
-  ["plug", { displayName: "Plug", kind: "framework" }],
-  ["plug_cowboy", { displayName: "Plug", kind: "framework" }],
-  // --- Elixir — Libraries ---
-  ["ecto", { displayName: "Ecto", kind: "library" }],
-  ["ecto_sql", { displayName: "Ecto", kind: "library" }],
-  ["phoenix_ecto", { displayName: "Ecto", kind: "library" }],
-  // --- Crystal — Frameworks ---
-  ["amber", { displayName: "Amber", kind: "framework" }],
-  ["lucky", { displayName: "Lucky", kind: "framework" }],
-  ["kemal", { displayName: "Kemal", kind: "framework" }],
-  // --- Dart — Frameworks ---
-  // `flutter` and `angular` appear as plain keys in pubspec.yaml. NOTE: `angular`
-  // here is Dart's AngularDart. The npm package `angular` is AngularJS (1.x) — a
-  // different framework — so package.json overrides this via MANIFEST_SCOPED_CATALOG.
-  ["flutter", { displayName: "Flutter", kind: "framework" }],
-  ["flutter_test", { displayName: "Flutter", kind: "framework" }],
-  ["angular", { displayName: "Angular", kind: "framework" }],
-  // --- Dart — Libraries ---
-  // Kept to Dart-specific names with negligible cross-ecosystem collision risk
-  // (generic names like "get"/"provider" are intentionally omitted).
-  ["riverpod", { displayName: "Riverpod", kind: "library" }],
-  ["flutter_bloc", { displayName: "Bloc", kind: "library" }],
-  ["dio", { displayName: "Dio", kind: "library" }],
-  // --- .NET (C# / VB) — Libraries ---
-  // NuGet package IDs. Microsoft.* families are also covered by prefix rules below.
-  ["EntityFramework", { displayName: "Entity Framework", kind: "library" }],
-  ["NUnit", { displayName: "NUnit", kind: "library" }],
-  ["Moq", { displayName: "Moq", kind: "library" }],
-  ["NSubstitute", { displayName: "NSubstitute", kind: "library" }],
-  ["FluentAssertions", { displayName: "FluentAssertions", kind: "library" }],
-  ["Shouldly", { displayName: "Shouldly", kind: "library" }],
-  ["NLog", { displayName: "NLog", kind: "library" }],
-  ["log4net", { displayName: "log4net", kind: "library" }],
-  ["Newtonsoft.Json", { displayName: "Json.NET", kind: "library" }],
-  ["AutoMapper", { displayName: "AutoMapper", kind: "library" }],
-  ["Dapper", { displayName: "Dapper", kind: "library" }],
-  ["MediatR", { displayName: "MediatR", kind: "library" }]
-]);
-var DEPENDENCY_PREFIX_RULES = [
-  { prefix: "@angular/", classification: { displayName: "Angular", kind: "framework" } },
-  { prefix: "@nestjs/", classification: { displayName: "NestJS", kind: "framework" } },
-  { prefix: "@remix-run/", classification: { displayName: "Remix", kind: "framework" } },
-  { prefix: "@sveltejs/", classification: { displayName: "SvelteKit", kind: "framework" } },
-  { prefix: "@nuxt/", classification: { displayName: "Nuxt", kind: "framework" } },
-  { prefix: "@storybook/", classification: { displayName: "Storybook", kind: "library" } },
-  {
-    prefix: "@testing-library/",
-    classification: { displayName: "Testing Library", kind: "library" }
-  },
-  { prefix: "@tanstack/", classification: { displayName: "TanStack", kind: "library" } },
-  { prefix: "@wdio/", classification: { displayName: "WebdriverIO", kind: "library" } },
-  // AWS CDK v1 construct libraries are published under the @aws-cdk/ scope.
-  { prefix: "@aws-cdk/", classification: { displayName: "AWS CDK", kind: "framework" } },
-  { prefix: "@reduxjs/", classification: { displayName: "Redux", kind: "library" } },
-  { prefix: "@prisma/", classification: { displayName: "Prisma", kind: "library" } },
-  { prefix: "@apollo/", classification: { displayName: "Apollo", kind: "library" } },
-  { prefix: "@formatjs/", classification: { displayName: "formatjs", kind: "library" } },
-  { prefix: "@lingui/", classification: { displayName: "Lingui", kind: "library" } },
-  { prefix: "@emotion/", classification: { displayName: "Emotion", kind: "library" } },
-  { prefix: "@mui/", classification: { displayName: "Material UI", kind: "library" } },
-  { prefix: "@chakra-ui/", classification: { displayName: "Chakra UI", kind: "library" } },
-  {
-    prefix: "@lwc/",
-    classification: { displayName: "Lightning Web Components", kind: "platform" }
-  },
-  { prefix: "@salesforce/", classification: { displayName: "Salesforce", kind: "platform" } },
-  { prefix: "@shopify/", classification: { displayName: "Shopify", kind: "platform" } },
-  { prefix: "@aws-sdk/", classification: { displayName: "AWS SDK", kind: "library" } },
-  { prefix: "@google-cloud/", classification: { displayName: "Google Cloud", kind: "library" } },
-  { prefix: "@azure/", classification: { displayName: "Azure SDK", kind: "library" } },
+  ["jwt-core", "jwt-scala"],
+  ["jwt-circe", "jwt-scala"],
+  ["jwt-play-json", "jwt-scala"],
+  ["jwt-json4s", "jwt-scala"],
+  ["jwt-spray-json", "jwt-scala"],
+  ["jwt-upickle", "jwt-scala"],
+  ["jwt-argonaut", "jwt-scala"],
+  ["munit", "munit"],
+  ["scalacheck", "scalacheck"],
+  ["scala-logging", "scala-logging"],
+  ["chimney", "chimney"],
+  // --- WebJars — front-end libraries republished to Maven Central ---
+  // A JVM web app serves its JavaScript from a WebJar instead of from npm, so
+  // `"org.webjars" % "jquery"` is real evidence of jQuery in the repo — and jQuery
+  // gates Opengrep's `javascript.jquery.` rules. This is the one place where an
+  // entity legitimately belongs to two registries, and dropping it was the only
+  // recall loss the before/after sweep over local repos turned up (codacy-website).
+  // The parsers emit bare artifact ids, so the `org.webjars` group is not visible
+  // here; nothing else on Maven Central is named after a front-end library, so
+  // matching the artifact alone is safe.
+  ["jquery", "jquery"]
+];
+var PREFIXES2 = [
+  // Kotlin — coroutines ships one artifact per target (`-core`, `-android`,
+  // `-test`, `-jdk8`, `-reactive`, …) and any of them means the project uses
+  // coroutines, which is what detekt's `coroutines` rules gate on.
+  ["kotlinx-coroutines-", "kotlinx-coroutines"],
+  // JUnit 5 ships one artifact per role (`-engine`, `-params`, `-launcher`), and
+  // Gradle builds declare them separately from `junit-jupiter` itself.
+  ["junit-jupiter-", "junit-5"],
+  ["junit-platform-", "junit-5"],
+  // A modern Android project declares `androidx.*`, never the deprecated
+  // `com.google.android:android` jar the exact telltale matches.
+  ["androidx-", "android-sdk"],
+  ["androidx.", "android-sdk"],
   // Groovy — Grails/GORM artifact families (build.gradle artifactIds).
-  { prefix: "grails-", classification: { displayName: "Grails", kind: "framework" } },
-  { prefix: "gorm-", classification: { displayName: "GORM", kind: "library" } },
+  ["grails-", "grails"],
+  ["gorm-", "grails-gorm"],
   // Scala — artifact families published one module per feature (sbt artifactIds).
   // Enumerating members would go stale on every release; the prefixes are
   // distinctive enough not to collide with other ecosystems.
-  { prefix: "http4s-", classification: { displayName: "http4s", kind: "framework" } },
-  { prefix: "akka-", classification: { displayName: "Akka", kind: "framework" } },
-  { prefix: "pekko-", classification: { displayName: "Pekko", kind: "framework" } },
-  { prefix: "zio-", classification: { displayName: "ZIO", kind: "library" } },
+  ["http4s-", "http4s"],
+  ["akka-", "akka"],
+  ["pekko-", "pekko"],
+  ["zio-", "zio"],
   // Must precede any broader `cats-` rule: cats-effect is its own project.
-  { prefix: "cats-effect", classification: { displayName: "Cats Effect", kind: "library" } },
-  { prefix: "doobie-", classification: { displayName: "Doobie", kind: "library" } },
-  { prefix: "fs2-", classification: { displayName: "FS2", kind: "library" } },
-  { prefix: "circe-", classification: { displayName: "Circe", kind: "library" } },
-  { prefix: "pureconfig", classification: { displayName: "PureConfig", kind: "library" } },
-  { prefix: "kamon-", classification: { displayName: "Kamon", kind: "library" } },
-  { prefix: "flyway-", classification: { displayName: "Flyway", kind: "library" } },
-  {
-    prefix: "testcontainers-scala",
-    classification: { displayName: "Testcontainers", kind: "library" }
-  },
+  ["cats-effect", "cats-effect"],
+  ["doobie-", "doobie"],
+  ["fs2-", "fs2"],
+  ["circe-", "circe"],
+  ["pureconfig", "pureconfig"],
+  ["kamon-", "kamon"],
+  ["flyway-", "flyway"],
+  ["testcontainers-scala", "testcontainers"]
+];
+var maven = {
+  id: "maven",
+  manifests: [
+    { basename: "pom.xml", parser: parsePomXml },
+    { basename: "build.gradle", parser: parseBuildGradle },
+    { basename: "build.gradle.kts", parser: parseBuildGradle },
+    { basename: "libs.versions.toml", parser: parseVersionCatalogToml },
+    { basename: "build.sbt", parser: parseBuildSbt },
+    {
+      // sbt build definition: `project/Dependencies.scala`, `project/plugins.sbt`
+      // and the meta-build's own `project/project/*`. Matching by directory rather
+      // than basename is what this rule exists for — the Scala file can be called
+      // anything, and `*.scala` on its own is source code, not a manifest.
+      //
+      // Case-sensitive deliberately: sbt's directory is always lowercase `project`,
+      // while `Project` is an ordinary domain-package name, and reading
+      // `…/domain/Project/Project.scala` as a manifest would be wrong.
+      matches: (filePath) => /(^|\/)project\/[^/]+\.(scala|sbt)$/.test(filePath),
+      parser: parseSbtBuildDefinition
+    }
+  ],
+  telltales: TELLTALES4,
+  prefixes: PREFIXES2
+};
+
+// src/discover/ecosystems/golang.ts
+function parseGoMod(content) {
+  const deps = [];
+  const singleRegex = /^require\s+(\S+)\s+(\S+)/gm;
+  let match;
+  while ((match = singleRegex.exec(content)) !== null) {
+    if (!match[1].startsWith("(")) {
+      deps.push({ name: match[1], version: match[2] });
+    }
+  }
+  const blockRegex = /require\s*\(([\s\S]*?)\)/g;
+  while ((match = blockRegex.exec(content)) !== null) {
+    const lines = match[1].split("\n");
+    for (const line of lines) {
+      const m = line.trim().match(/^(\S+)\s+(\S+)/);
+      if (m && !m[1].startsWith("//")) {
+        deps.push({ name: m[1], version: m[2] });
+      }
+    }
+  }
+  return deps;
+}
+var TELLTALES5 = [
+  // --- Frameworks ---
+  ["github.com/gin-gonic/gin", "gin"],
+  ["github.com/labstack/echo", "echo"],
+  ["github.com/gofiber/fiber", "fiber"],
+  ["github.com/go-chi/chi", "chi"],
+  ["github.com/gorilla/mux", "gorilla-mux"],
+  ["github.com/beego/beego", "beego"],
+  // --- Libraries ---
+  ["github.com/stretchr/testify", "testify"],
+  ["github.com/spf13/cobra", "cobra"],
+  ["github.com/spf13/viper", "viper"],
+  ["go.uber.org/zap", "zap"],
+  ["github.com/sirupsen/logrus", "logrus"],
+  ["gorm.io/gorm", "go-gorm"],
+  ["github.com/go-kit/kit", "go-kit"],
+  ["google.golang.org/protobuf", "protocol-buffers"],
+  ["google.golang.org/grpc", "grpc"],
+  ["github.com/jackc/pgx", "pgx"],
+  ["github.com/redis/go-redis", "go-redis"],
+  // v1 is still widely deployed; both gate Opengrep's AWS Lambda packs.
+  ["github.com/aws/aws-sdk-go", "aws-sdk-go"],
+  ["github.com/aws/aws-sdk-go-v2", "aws-sdk-go"],
+  ["github.com/prometheus/client_golang", "prometheus-client"]
+];
+var golang = {
+  id: "golang",
+  manifests: [{ basename: "go.mod", parser: parseGoMod }],
+  telltales: TELLTALES5
+};
+
+// src/discover/ecosystems/cargo.ts
+function parseCargoToml(content) {
+  const deps = [];
+  let inDepsSection = false;
+  for (const rawLine of content.split("\n")) {
+    const line = rawLine.trim();
+    if (/^\[((?:dev-|build-)?dependencies)\]/.test(line)) {
+      inDepsSection = true;
+      continue;
+    }
+    if (line.startsWith("[") && !line.includes("dependencies.")) {
+      inDepsSection = false;
+      continue;
+    }
+    if (inDepsSection) {
+      const m = line.match(/^([a-zA-Z0-9_-]+)\s*=/);
+      if (m) {
+        const versionMatch = line.match(/["']([^"']+)["']/);
+        deps.push({ name: m[1], version: versionMatch?.[1] });
+      }
+    }
+  }
+  return deps;
+}
+var TELLTALES6 = [
+  // --- Frameworks ---
+  ["actix-web", "actix-web"],
+  ["axum", "axum"],
+  ["rocket", "rocket"],
+  ["warp", "warp"],
+  ["tauri", "tauri"],
+  // --- Libraries ---
+  ["tokio", "tokio"],
+  ["serde", "serde"],
+  ["clap", "clap"],
+  ["reqwest", "reqwest"],
+  ["diesel", "diesel"],
+  ["sqlx", "sqlx"],
+  ["tracing", "tracing"],
+  ["anyhow", "anyhow"],
+  ["thiserror", "thiserror"],
+  ["rayon", "rayon"]
+];
+var cargo = {
+  id: "cargo",
+  manifests: [{ basename: "Cargo.toml", parser: parseCargoToml }],
+  telltales: TELLTALES6
+};
+
+// src/discover/ecosystems/composer.ts
+function parseComposerJson(content) {
+  try {
+    const pkg = JSON.parse(content);
+    const deps = [];
+    for (const section of ["require", "require-dev"]) {
+      const entries2 = pkg[section];
+      if (entries2 && typeof entries2 === "object") {
+        for (const [name, version] of Object.entries(entries2)) {
+          if (name === "php" || name.startsWith("ext-")) continue;
+          deps.push({ name, version: typeof version === "string" ? version : void 0 });
+        }
+      }
+    }
+    return deps;
+  } catch {
+    return [];
+  }
+}
+var TELLTALES7 = [
+  // --- Frameworks ---
+  ["laravel/framework", "laravel"],
+  ["symfony/framework-bundle", "symfony"],
+  ["symfony/symfony", "symfony"],
+  ["codeigniter4/framework", "codeigniter"],
+  ["slim/slim", "slim"],
+  ["cakephp/cakephp", "cakephp"],
+  // WordPress is rarely a real Composer dependency; these are the common
+  // "WordPress as a dependency" packages used by Bedrock/Composer-based sites.
+  ["johnpbloch/wordpress-core", "wordpress"],
+  ["johnpbloch/wordpress", "wordpress"],
+  ["roots/wordpress", "wordpress"],
+  ["drupal/core", "drupal"],
+  ["drupal/core-recommended", "drupal"],
+  ["magento/product-community-edition", "magento"],
+  ["magento/product-enterprise-edition", "magento"],
+  ["magento/framework", "magento"],
+  // --- Libraries ---
+  ["phpunit/phpunit", "phpunit"],
+  ["guzzlehttp/guzzle", "guzzle"],
+  ["monolog/monolog", "monolog"],
+  ["nesbot/carbon", "carbon"],
+  ["doctrine/orm", "doctrine-orm"],
+  ["doctrine/dbal", "doctrine-dbal"],
+  ["league/flysystem", "flysystem"],
+  ["php-amqplib/php-amqplib", "php-amqplib"],
+  ["predis/predis", "predis"],
+  // --- Tools ---
+  ["phpstan/phpstan", "phpstan"],
+  ["squizlabs/php_codesniffer", "php-codesniffer"]
+];
+var composer = {
+  id: "composer",
+  manifests: [{ basename: "composer.json", parser: parseComposerJson }],
+  telltales: TELLTALES7
+};
+
+// src/discover/ecosystems/nuget.ts
+function parseXmlDependencyElements(content, elementRegex, nameAttr) {
+  const deps = [];
+  const nameRegex = new RegExp(`\\b${nameAttr}\\s*=\\s*["']([^"']+)["']`, "i");
+  const versionRegex = /\bversion\s*=\s*["']([^"']+)["']/i;
+  let match;
+  while ((match = elementRegex.exec(content)) !== null) {
+    const attrs = match[1];
+    const nameMatch = attrs.match(nameRegex);
+    if (!nameMatch) continue;
+    const versionMatch = attrs.match(versionRegex);
+    deps.push({ name: nameMatch[1].trim(), version: versionMatch?.[1]?.trim() });
+  }
+  return deps;
+}
+function parseCsproj(content) {
+  return parseXmlDependencyElements(
+    content,
+    /<Package(?:Reference|Version)\s+([^>]+?)\/?>/gi,
+    "Include"
+  );
+}
+function parsePackagesConfig(content) {
+  return parseXmlDependencyElements(content, /<package\s+([^>]+?)\/?>/gi, "id");
+}
+var TELLTALES8 = [
+  // --- Libraries ---
+  // NuGet package IDs. Microsoft.* families are covered by the prefix rules.
+  ["EntityFramework", "entity-framework"],
+  ["NUnit", "nunit"],
+  ["Moq", "moq"],
+  ["NSubstitute", "nsubstitute"],
+  ["FluentAssertions", "fluentassertions"],
+  ["Shouldly", "shouldly"],
+  ["NLog", "nlog"],
+  ["log4net", "log4net"],
+  ["Newtonsoft.Json", "json-net"],
+  ["AutoMapper", "automapper"],
+  ["Dapper", "dapper"],
+  ["MediatR", "mediatr"]
+];
+var PREFIXES3 = [
   // .NET — Microsoft package families and common test/logging libraries. More
   // specific prefixes (Blazor) must precede broader ones (ASP.NET Core).
-  {
-    prefix: "Microsoft.AspNetCore.Components.WebAssembly",
-    classification: { displayName: "Blazor", kind: "framework" }
-  },
-  {
-    prefix: "Microsoft.AspNetCore.",
-    classification: { displayName: "ASP.NET Core", kind: "framework" }
-  },
-  {
-    prefix: "Microsoft.EntityFrameworkCore",
-    classification: { displayName: "Entity Framework", kind: "library" }
-  },
-  {
-    prefix: "Microsoft.Azure.Functions",
-    classification: { displayName: "Azure Functions", kind: "framework" }
-  },
-  {
-    prefix: "Microsoft.Azure.WebJobs",
-    classification: { displayName: "Azure Functions", kind: "framework" }
-  },
-  { prefix: "xunit", classification: { displayName: "xUnit", kind: "library" } },
-  { prefix: "MSTest.", classification: { displayName: "MSTest", kind: "library" } },
-  { prefix: "Serilog", classification: { displayName: "Serilog", kind: "library" } }
+  ["Microsoft.AspNetCore.Components.WebAssembly", "blazor"],
+  ["Microsoft.AspNetCore.", "aspnet-core"],
+  ["Microsoft.EntityFrameworkCore", "entity-framework"],
+  ["Microsoft.Azure.Functions", "azure-functions"],
+  ["Microsoft.Azure.WebJobs", "azure-functions"],
+  ["xunit", "xunit"],
+  ["MSTest.", "mstest"],
+  ["Serilog", "serilog"]
 ];
-var MANIFEST_SCOPED_CATALOG = /* @__PURE__ */ new Map([
-  ["package.json", /* @__PURE__ */ new Map([["angular", { displayName: "AngularJS", kind: "framework" }]])],
-  [
-    "Gemfile",
-    /* @__PURE__ */ new Map([
-      ["faker", { displayName: "Faker", kind: "library" }],
-      ["rake", { displayName: "Rake", kind: "tool" }]
-    ])
-  ]
-]);
-function classifyDependency(name, manifestBasename) {
-  if (manifestBasename) {
-    const scoped = MANIFEST_SCOPED_CATALOG.get(manifestBasename)?.get(name);
-    if (scoped) return scoped;
+var nuget = {
+  id: "nuget",
+  manifests: [
+    { basename: "packages.config", parser: parsePackagesConfig },
+    { basename: "Directory.Packages.props", parser: parseCsproj },
+    // Project files carry an arbitrary basename, so they match by suffix. Matched
+    // case-insensitively — .NET project extensions may be upper-cased.
+    { suffix: ".csproj", parser: parseCsproj },
+    { suffix: ".vbproj", parser: parseCsproj },
+    { suffix: ".fsproj", parser: parseCsproj }
+  ],
+  telltales: TELLTALES8,
+  prefixes: PREFIXES3
+};
+
+// src/discover/ecosystems/pub.ts
+function parsePubspecYaml(content) {
+  const deps = [];
+  let inSection = false;
+  let childIndent = -1;
+  for (const rawLine of content.split("\n")) {
+    const trimmed = rawLine.trim();
+    if (trimmed === "" || trimmed.startsWith("#")) continue;
+    const indent = rawLine.length - rawLine.trimStart().length;
+    if (indent === 0) {
+      inSection = /^(dependencies|dev_dependencies|dependency_overrides):/.test(trimmed);
+      childIndent = -1;
+      continue;
+    }
+    if (!inSection) continue;
+    if (childIndent === -1) childIndent = indent;
+    if (indent !== childIndent) continue;
+    const m = trimmed.match(/^([a-zA-Z0-9_.]+)\s*:(?:\s*["']?\^?([0-9][^"'#\s]*))?/);
+    if (m) deps.push({ name: m[1], version: m[2] });
   }
-  const exact = DEPENDENCY_CATALOG.get(name);
-  if (exact) return exact;
-  for (const rule of DEPENDENCY_PREFIX_RULES) {
-    if (name.startsWith(rule.prefix)) return rule.classification;
+  return deps;
+}
+var TELLTALES9 = [
+  // --- Frameworks ---
+  // `flutter` and `angular` appear as plain keys in pubspec.yaml. `angular` here is
+  // AngularDart — a different framework from npm's `angular` (AngularJS 1.x) and
+  // from modern Angular — hence the distinct `angular-dart` entity.
+  ["flutter", "flutter"],
+  ["flutter_test", "flutter"],
+  ["angular", "angular-dart"],
+  // --- Libraries ---
+  // Kept to Dart-specific names with negligible cross-ecosystem collision risk
+  // (generic names like "get"/"provider" are intentionally omitted).
+  ["riverpod", "riverpod"],
+  ["flutter_bloc", "bloc"],
+  ["dio", "dio"]
+];
+var pub = {
+  id: "pub",
+  manifests: [{ basename: "pubspec.yaml", parser: parsePubspecYaml }],
+  telltales: TELLTALES9
+};
+
+// src/discover/ecosystems/hex.ts
+function parseMixExs(content) {
+  const deps = [];
+  const depRegex = /\{:([a-zA-Z_][a-zA-Z0-9_]*)\s*,\s*"([^"]*)"/g;
+  let match;
+  while ((match = depRegex.exec(content)) !== null) {
+    deps.push({ name: match[1], version: match[2] || void 0 });
+  }
+  return deps;
+}
+var TELLTALES10 = [
+  // --- Frameworks ---
+  ["phoenix", "phoenix"],
+  ["plug", "plug"],
+  ["plug_cowboy", "plug"],
+  // --- Libraries ---
+  ["ecto", "ecto"],
+  ["ecto_sql", "ecto"],
+  ["phoenix_ecto", "ecto"]
+];
+var hex = {
+  id: "hex",
+  manifests: [{ basename: "mix.exs", parser: parseMixExs }],
+  telltales: TELLTALES10
+};
+
+// src/discover/ecosystems/swift.ts
+function parsePodfile(content) {
+  const deps = [];
+  const podRegex = /^\s*pod\s+["']([^"']+)["'](?:\s*,\s*["']([^"']+)["'])?/gm;
+  let match;
+  while ((match = podRegex.exec(content)) !== null) {
+    deps.push({ name: match[1], version: match[2] });
+  }
+  return deps;
+}
+function parsePackageSwift(content) {
+  const deps = [];
+  const pkgRegex = /\.package\s*\(\s*url:\s*["'](?:https?:\/\/[^/]+\/[^/]+\/|git@[^:]+:[^/]+\/)([^"'/.]+)/g;
+  let match;
+  while ((match = pkgRegex.exec(content)) !== null) {
+    deps.push({ name: match[1] });
+  }
+  return deps;
+}
+var TELLTALES11 = [
+  // --- Frameworks ---
+  ["vapor", "vapor"],
+  // --- Libraries ---
+  ["Alamofire", "alamofire"],
+  ["SnapKit", "snapkit"],
+  ["Kingfisher", "kingfisher"],
+  ["Moya", "moya"],
+  ["RxSwift", "rxswift"],
+  ["RealmSwift", "realm"],
+  // Quick and Nimble ship from separate repos and are declared independently —
+  // Nimble is usable on its own with XCTest — so they are two entities, gating
+  // SwiftLint's `quick_discouraged_*` and `prefer_nimble` rules respectively.
+  // Ids are matched exactly and case-sensitively: `parsePackageSwift` yields the
+  // GitHub repo name and `parsePodfile` the pod name, and both are `Quick`/`Nimble`.
+  ["Quick", "quick"],
+  ["Nimble", "nimble"]
+];
+var swift = {
+  id: "swift",
+  manifests: [
+    { basename: "Package.swift", parser: parsePackageSwift },
+    { basename: "Podfile", parser: parsePodfile }
+  ],
+  telltales: TELLTALES11
+};
+
+// src/discover/ecosystems/shards.ts
+function parseShardYml(content) {
+  const deps = [];
+  let inSection = false;
+  let depIndent = -1;
+  let current;
+  const flush = () => {
+    if (current) deps.push(current);
+    current = void 0;
+  };
+  for (const rawLine of content.split("\n")) {
+    const trimmed = rawLine.trim();
+    if (trimmed === "" || trimmed.startsWith("#")) continue;
+    const indent = rawLine.length - rawLine.trimStart().length;
+    if (indent === 0) {
+      flush();
+      inSection = /^(dependencies|development_dependencies):/.test(trimmed);
+      depIndent = -1;
+      continue;
+    }
+    if (!inSection) continue;
+    if (depIndent === -1) depIndent = indent;
+    if (indent === depIndent) {
+      flush();
+      const m = trimmed.match(/^([a-zA-Z0-9_-]+)\s*:/);
+      current = m ? { name: m[1] } : void 0;
+      continue;
+    }
+    if (indent > depIndent && current) {
+      const v = trimmed.match(/^version\s*:\s*["']?(?:~>|[~^])?\s*([0-9][^"'\s]*)/);
+      if (v) current.version = v[1];
+    }
+  }
+  flush();
+  return deps;
+}
+var TELLTALES12 = [
+  // --- Frameworks ---
+  ["amber", "amber"],
+  ["lucky", "lucky"],
+  ["kemal", "kemal"]
+];
+var shards = {
+  id: "shards",
+  manifests: [{ basename: "shard.yml", parser: parseShardYml }],
+  telltales: TELLTALES12
+};
+
+// src/discover/ecosystems/index.ts
+var ECOSYSTEMS = [
+  npm,
+  pypi,
+  gem,
+  maven,
+  golang,
+  cargo,
+  composer,
+  nuget,
+  pub,
+  hex,
+  swift,
+  shards
+];
+var BY_BASENAME = /* @__PURE__ */ new Map();
+var BY_SUFFIX = [];
+var BY_PATH = [];
+for (const ecosystem of ECOSYSTEMS) {
+  for (const rule of ecosystem.manifests) {
+    const resolved = { ecosystem: ecosystem.id, parser: rule.parser };
+    if ("basename" in rule) BY_BASENAME.set(rule.basename, resolved);
+    else if ("suffix" in rule) BY_SUFFIX.push({ suffix: rule.suffix, resolved });
+    else BY_PATH.push({ matches: rule.matches, resolved });
+  }
+}
+function getEcosystem(id) {
+  const found = ECOSYSTEMS.find((e) => e.id === id);
+  if (!found) throw new Error(`Unknown dependency ecosystem: ${id}`);
+  return found;
+}
+function resolveManifest(filePath) {
+  const basename = filePath.split("/").pop() ?? filePath;
+  const byName = BY_BASENAME.get(basename);
+  if (byName) return byName;
+  const lowerBasename = basename.toLowerCase();
+  for (const { suffix, resolved } of BY_SUFFIX) {
+    if (lowerBasename.endsWith(suffix)) return resolved;
+  }
+  for (const { matches, resolved } of BY_PATH) {
+    if (matches(filePath, basename)) return resolved;
   }
   return void 0;
 }
+
+// src/discover/signals.ts
+var import_tooling5 = require("@codacy/tooling");
 function pathBasename(filePath) {
   return filePath.split("/").pop() ?? filePath;
 }
@@ -2840,57 +3555,57 @@ var FILE_SIGNAL_RULES = [
   {
     name: ".flowconfig",
     matches: (f) => pathBasename(f) === ".flowconfig",
-    classification: { displayName: "Flow", kind: "library" }
+    entity: "flow"
   },
   {
     name: "cdk.json",
     matches: (f) => pathBasename(f) === "cdk.json",
-    classification: { displayName: "AWS CDK", kind: "framework" }
+    entity: "aws-cdk"
   },
   {
     name: ".meteor/release",
     matches: (f) => f === ".meteor/release" || f.endsWith("/.meteor/release"),
-    classification: { displayName: "Meteor", kind: "framework" }
+    entity: "meteor"
   },
   {
     name: "sfdx-project.json",
     matches: (f) => pathBasename(f) === "sfdx-project.json",
-    classification: { displayName: "Salesforce", kind: "platform" }
+    entity: "salesforce"
   },
   {
     name: "lwc.config.json",
     matches: (f) => pathBasename(f) === "lwc.config.json",
-    classification: { displayName: "Lightning Web Components", kind: "platform" }
+    entity: "lightning-web-components"
   },
   {
     name: "suitecloud.config.js",
     matches: (f) => pathBasename(f) === "suitecloud.config.js",
-    classification: { displayName: "SuiteScript", kind: "platform" }
+    entity: "suitescript"
   },
   {
     name: ".github/workflows",
     matches: (f) => f.startsWith(".github/workflows/"),
-    classification: { displayName: "GitHub Actions", kind: "framework" }
+    entity: "github-actions"
   },
   {
     name: ".circleci",
     matches: (f) => f.startsWith(".circleci/"),
-    classification: { displayName: "CircleCI", kind: "framework" }
+    entity: "circleci"
   },
   {
     name: ".gitlab-ci.yml",
     matches: (f) => f === ".gitlab-ci.yml" || f.startsWith(".gitlab/"),
-    classification: { displayName: "GitLab CI", kind: "framework" }
+    entity: "gitlab-ci"
   },
   {
     name: "bitbucket-pipelines.yml",
     matches: (f) => f === "bitbucket-pipelines.yml",
-    classification: { displayName: "Bitbucket Pipelines", kind: "framework" }
+    entity: "bitbucket-pipelines"
   },
   {
     name: "azure-pipelines.yml",
     matches: (f) => f === "azure-pipelines.yml" || f === "azure-pipelines.yaml",
-    classification: { displayName: "Azure Pipelines", kind: "framework" }
+    entity: "azure-pipelines"
   },
   {
     // Jenkins pipelines are Groovy scripts with no manifest at all — the
@@ -2901,14 +3616,14 @@ var FILE_SIGNAL_RULES = [
       const base = pathBasename(f);
       return base === "Jenkinsfile" || base.startsWith("Jenkinsfile.");
     },
-    classification: { displayName: "Jenkins", kind: "tool" }
+    entity: "jenkins"
   },
   {
     // A `sorbet/` directory (typically `sorbet/config` + RBI files) marks a
     // Sorbet-typed Ruby project even when the gem is pulled in transitively.
     name: "sorbet/config",
     matches: (f) => f === "sorbet/config" || f.endsWith("/sorbet/config"),
-    classification: { displayName: "Sorbet", kind: "tool" }
+    entity: "sorbet"
   },
   {
     name: "Rakefile",
@@ -2916,7 +3631,105 @@ var FILE_SIGNAL_RULES = [
       const base = pathBasename(f);
       return base === "Rakefile" || base === "rakefile" || base.endsWith(".rake");
     },
-    classification: { displayName: "Rake", kind: "tool" }
+    entity: "rake"
+  },
+  {
+    // XCTest ships with Xcode, so no manifest ever declares it and a file signal
+    // is the only producer available. `FooTests.swift` / `FooTest.swift` is the
+    // naming Xcode's templates and SwiftPM's `Tests/` layout both generate, and it
+    // is what SwiftLint's own test rules key on. Matching the file name rather than
+    // a `Tests/` directory also covers CocoaPods/Xcode projects, which have no
+    // fixed directory convention.
+    name: "*Tests.swift",
+    matches: (f) => /Tests?\.swift$/.test(pathBasename(f)),
+    entity: "xctest"
+  },
+  // ── Infrastructure-as-Code ─────────────────────────────────────────────────
+  //
+  // These gate Checkov, whose ~1,300 cloud-security checks are otherwise
+  // universal: they are all default-on and the only other filter is the language
+  // one, which passes on any repo containing a `.json` or `.yaml` file. Terraform
+  // needs no rule here — `.tf` is the `Terraform` language, so `lang:Terraform`
+  // already means "this repo has Terraform". What the language axis cannot
+  // express is which IaC *framework* a YAML/JSON file belongs to, since
+  // Kubernetes manifests, Helm charts, Ansible playbooks, CloudFormation
+  // templates and ARM templates are all YAML or JSON.
+  //
+  // Bias these rules **permissive**, the opposite of the rules above. A Checkov
+  // check declares the resource types it applies to, so a check enabled in a repo
+  // that has none of them is inert — it produces no findings and costs only a line
+  // of config. A false negative is what's expensive: it silently drops hundreds of
+  // checks from a repo that needed them. Where a signal is ambiguous, prefer
+  // matching.
+  {
+    // A Helm chart's templates render to Kubernetes manifests, so a chart is
+    // evidence of Kubernetes as much as of Helm. `Chart.yaml` is the chart
+    // manifest and carries no other meaning at a chart root.
+    name: "Chart.yaml",
+    matches: (f) => {
+      const base = pathBasename(f);
+      return base === "Chart.yaml" || base === "Chart.yml";
+    },
+    entity: "helm"
+  },
+  {
+    // Kustomize is the one Kubernetes layout with a distinctive filename. Bare
+    // manifests declare themselves only in their content (`apiVersion:`/`kind:`),
+    // which a path-only rule cannot see. `kustomization.yaml` is exact; the
+    // directory rule covers the far more common layout — loose manifests under
+    // `k8s/`, `kubernetes/` or `manifests/`, applied with `kubectl apply -f`.
+    //
+    // Gating on `kustomization.yaml` alone dropped 14 default-on Opengrep rules
+    // (privileged-container, secrets-in-config-file, skip-tls-verify-*, …) from
+    // exactly that layout. Per the bias above, a directory name matched wrongly
+    // only enables inert checks, while missing it loses real coverage.
+    name: "k8s manifests",
+    matches: (f) => {
+      const base = pathBasename(f);
+      if (base === "kustomization.yaml" || base === "kustomization.yml") return true;
+      return /(^|\/)(k8s|kubernetes|manifests)\/.+\.ya?ml$/.test(f);
+    },
+    entity: "kubernetes"
+  },
+  {
+    // `ansible.cfg` is unambiguous; the `roles/<name>/tasks/main.yml` layout is
+    // Ansible's own role convention and is the only marker in a playbook repo
+    // that ships no config file.
+    name: "ansible.cfg",
+    matches: (f) => pathBasename(f) === "ansible.cfg" || /(^|\/)roles\/[^/]+\/tasks\/main\.ya?ml$/.test(f),
+    entity: "ansible"
+  },
+  {
+    name: "serverless.yml",
+    matches: (f) => /(^|\/)serverless\.(ya?ml|json|ts|js)$/.test(f),
+    entity: "serverless-framework"
+  },
+  {
+    // Bicep compiles to ARM, so `.bicep` is Azure IaC. Plain ARM templates are
+    // JSON identified by their `$schema`, which needs a content probe.
+    name: "*.bicep",
+    matches: (f) => {
+      const base = pathBasename(f);
+      return base.endsWith(".bicep") || base.endsWith(".bicepparam");
+    },
+    entity: "bicep"
+  },
+  {
+    // A CloudFormation template is identified by `AWSTemplateFormatVersion` in its
+    // body, not by its name, so this covers only the conventional shells: the SAM
+    // CLI's config file, SAM's root `template.yaml`, and a `cloudformation/`
+    // directory. Deliberately loose per the note above — over-matching enables AWS
+    // checks that then find nothing, under-matching drops 456 of them.
+    name: "cloudformation template",
+    matches: (f) => {
+      const base = pathBasename(f);
+      if (base === "samconfig.toml" || base === "samconfig.yaml" || base === "samconfig.yml") {
+        return true;
+      }
+      if (f === "template.yaml" || f === "template.yml") return true;
+      return /(^|\/)cloudformation\//.test(f);
+    },
+    entity: "cloudformation"
   },
   {
     // Play's routes file — `conf/routes`, plus the `conf/*.routes` sub-files a
@@ -2926,594 +3739,175 @@ var FILE_SIGNAL_RULES = [
     // artifact names. Note `conf/application.conf` is NOT a signal: plain
     // Typesafe Config uses the same filename without any Play involvement.
     name: "conf/routes",
-    matches: (f) => /(^|\/)conf\/([^/]+\.)?routes$/.test(f),
-    classification: { displayName: "Play Framework", kind: "framework" }
-  }
-];
-function detectFileSignals(files) {
-  const result = [];
-  for (const rule of FILE_SIGNAL_RULES) {
-    const hit = files.find((f) => rule.matches(f));
-    if (!hit) continue;
-    result.push({
-      name: rule.name,
-      displayName: rule.classification.displayName,
-      kind: rule.classification.kind,
-      source: "file",
-      manifestFile: hit
-    });
-  }
-  return result;
-}
-var PACKAGE_JSON_SIGNAL_DISPLAY_NAMES = ["ESLint Plugin"];
-function isEslintPluginName(name) {
-  return /^eslint-plugin-/.test(name) || /^@[^/]+\/eslint-plugin(-.*)?$/.test(name);
-}
-function detectPackageJsonSignals(content) {
-  let pkg;
-  try {
-    pkg = JSON.parse(content);
-  } catch {
-    return [];
-  }
-  const name = pkg && typeof pkg.name === "string" ? pkg.name : "";
-  if (name && isEslintPluginName(name)) {
-    return [
-      {
-        name,
-        displayName: "ESLint Plugin",
-        kind: "tool",
-        source: "manifest",
-        manifestFile: "package.json"
-      }
-    ];
-  }
-  return [];
-}
-function getKnownDisplayNames() {
-  const names = /* @__PURE__ */ new Set();
-  for (const { displayName } of DEPENDENCY_CATALOG.values()) names.add(displayName);
-  for (const scoped of MANIFEST_SCOPED_CATALOG.values())
-    for (const { displayName } of scoped.values()) names.add(displayName);
-  for (const rule of DEPENDENCY_PREFIX_RULES) names.add(rule.classification.displayName);
-  for (const rule of FILE_SIGNAL_RULES) names.add(rule.classification.displayName);
-  for (const name of PACKAGE_JSON_SIGNAL_DISPLAY_NAMES) names.add(name);
-  return names;
-}
-var NOTABLE_ANY_DEPTH = /* @__PURE__ */ new Set([
-  "Dockerfile",
-  "docker-compose.yml",
-  "docker-compose.yaml",
-  "compose.yml",
-  "compose.yaml",
-  "Makefile",
-  "Justfile",
-  "pom.xml",
-  "build.gradle",
-  "build.gradle.kts",
-  "build.sbt",
-  "go.mod",
-  "Cargo.toml",
-  "Gemfile",
-  "Podfile",
-  "Package.swift",
-  "Jenkinsfile",
-  "Vagrantfile",
-  "Procfile",
-  "pubspec.yaml",
-  "mix.exs",
-  "shard.yml",
-  "packages.config",
-  "Directory.Packages.props"
-]);
-var NOTABLE_ROOT_ONLY = /* @__PURE__ */ new Set([
-  ".dockerignore",
-  "Taskfile.yml",
-  "Rakefile",
-  "Gruntfile.js",
-  "Gulpfile.js",
-  "settings.gradle",
-  "settings.gradle.kts",
-  "go.sum",
-  "Cargo.lock",
-  "CLAUDE.md",
-  "AGENTS.md",
-  "agents.md",
-  ".cursorrules",
-  "copilot-instructions.md",
-  ".travis.yml",
-  ".gitlab-ci.yml",
-  "azure-pipelines.yml",
-  "bitbucket-pipelines.yml",
-  "appveyor.yml",
-  "package.json",
-  "requirements.txt",
-  "pyproject.toml",
-  "Pipfile",
-  "composer.json",
-  "tsconfig.json",
-  "jsconfig.json",
-  "serverless.yml",
-  "serverless.yaml",
-  "cdk.json",
-  "pulumi.yaml",
-  "README.md",
-  "CHANGELOG.md",
-  "CONTRIBUTING.md",
-  "LICENSE",
-  "renovate.json",
-  ".nvmrc",
-  ".node-version",
-  ".python-version",
-  ".ruby-version",
-  ".tool-versions"
-]);
-var NOTABLE_PATH_PREFIXES = [".github/workflows/", ".circleci/", ".gitlab/"];
-var CONFIG_HEURISTIC_PATTERNS = [
-  /^\..*rc$/,
-  // .eslintrc, .prettierrc, etc.
-  /^\..*rc\.(json|js|cjs|mjs|yml|yaml|ts)$/,
-  // .eslintrc.json, etc.
-  /^.*\.config\.(js|ts|mjs|cjs)$/,
-  // vite.config.ts, jest.config.js, etc.
-  /^\.env(\..+)?$/
-  // .env, .env.local, .env.production
-];
-function isNotableFile(filePath) {
-  const basename = filePath.split("/").pop() ?? filePath;
-  const isRoot = !filePath.includes("/");
-  if (NOTABLE_ANY_DEPTH.has(basename)) return true;
-  if (isRoot && NOTABLE_ROOT_ONLY.has(basename)) return true;
-  if (/\.(csproj|vbproj|fsproj|sln)$/i.test(basename)) return true;
-  for (const prefix of NOTABLE_PATH_PREFIXES) {
-    if (filePath.startsWith(prefix)) return true;
-  }
-  if (!filePath.includes("/")) {
-    for (const pattern of CONFIG_HEURISTIC_PATTERNS) {
-      if (pattern.test(basename)) return true;
-    }
-  }
-  return false;
-}
-function parsePackageJson(content) {
-  try {
-    const pkg = JSON.parse(content);
-    const deps = [];
-    for (const section of ["dependencies", "devDependencies", "peerDependencies"]) {
-      const entries2 = pkg[section];
-      if (entries2 && typeof entries2 === "object") {
-        for (const [name, version] of Object.entries(entries2)) {
-          deps.push({ name, version: typeof version === "string" ? version : void 0 });
-        }
-      }
-    }
-    return deps;
-  } catch {
-    return [];
-  }
-}
-function parseRequirementLine(rawLine) {
-  const line = rawLine.trim();
-  if (!line || line.startsWith("#") || line.startsWith("-")) return void 0;
-  const noComment = line.split("#")[0].trim();
-  if (!noComment) return void 0;
-  const match = noComment.match(/^([a-zA-Z0-9_.-]+(?:\[[^\]]*\])?)\s*([<>=!~@;].*)?$/);
-  if (!match) return void 0;
-  const rawName = match[1].replace(/\[.*\]$/, "");
-  return { name: rawName.toLowerCase().replace(/_/g, "-"), version: match[2]?.trim() };
-}
-function parseRequirementsTxt(content) {
-  const deps = [];
-  for (const rawLine of content.split("\n")) {
-    const dep = parseRequirementLine(rawLine);
-    if (dep) deps.push(dep);
-  }
-  return deps;
-}
-function sliceBalanced(content, fromIndex, open, close) {
-  const start = content.indexOf(open, fromIndex);
-  if (start === -1) return void 0;
-  let depth = 0;
-  let quote;
-  for (let i = start; i < content.length; i++) {
-    const ch = content[i];
-    if (quote) {
-      if (ch === "\\") i++;
-      else if (ch === quote) quote = void 0;
-      continue;
-    }
-    if (ch === '"' || ch === "'") {
-      quote = ch;
-      continue;
-    }
-    if (ch === open) depth++;
-    else if (ch === close && --depth === 0) {
-      return { body: content.slice(start + 1, i), endIndex: i };
-    }
-  }
-  return void 0;
-}
-function parseSetupPy(content) {
-  const deps = [];
-  const collectQuoted = (block) => {
-    for (const quoted of block.matchAll(/["']([^"']+)["']/g)) {
-      const dep = parseRequirementLine(quoted[1]);
-      if (dep) deps.push(dep);
-    }
-  };
-  const valueStartOf = (key) => {
-    const match = new RegExp(`\\b${key}\\s*=\\s*`).exec(content);
-    return match ? match.index + match[0].length : -1;
-  };
-  for (const key of ["install_requires", "tests_require", "setup_requires"]) {
-    const start = valueStartOf(key);
-    if (start === -1 || content[start] !== "[") continue;
-    const list = sliceBalanced(content, start, "[", "]");
-    if (list) collectQuoted(list.body);
-  }
-  const extrasStart = valueStartOf("extras_require");
-  if (extrasStart !== -1 && content[extrasStart] === "{") {
-    const dict = sliceBalanced(content, extrasStart, "{", "}");
-    if (dict) {
-      let cursor = 0;
-      while (cursor < dict.body.length) {
-        const list = sliceBalanced(dict.body, cursor, "[", "]");
-        if (!list) break;
-        collectQuoted(list.body);
-        cursor = list.endIndex + 1;
-      }
-    }
-  }
-  return deps;
-}
-function parsePyprojectToml(content) {
-  const deps = [];
-  const projectDepsMatch = content.match(/\[project\][\s\S]*?dependencies\s*=\s*\[([\s\S]*?)\]/);
-  if (projectDepsMatch) {
-    const items = projectDepsMatch[1].match(/"([^"]+)"|'([^']+)'/g) ?? [];
-    for (const item of items) {
-      const raw = item.replace(/["']/g, "");
-      const name = raw.split(/[<>=!~;\s]/)[0].replace(/\[.*\]$/, "");
-      if (name) deps.push({ name: name.toLowerCase().replace(/_/g, "-") });
-    }
-  }
-  const poetryMatch = content.match(/\[tool\.poetry\.dependencies\]([\s\S]*?)(?:\n\[|\n$)/);
-  if (poetryMatch) {
-    const lines = poetryMatch[1].split("\n");
-    for (const line of lines) {
-      const m = line.match(/^([a-zA-Z0-9_.-]+)\s*=/);
-      if (m && m[1] !== "python") {
-        deps.push({ name: m[1].toLowerCase().replace(/_/g, "-") });
-      }
-    }
-  }
-  const poetryGroupRegex = /\[tool\.poetry\.group\.\w+\.dependencies\]([\s\S]*?)(?:\n\[|\n$)/g;
-  let groupMatch;
-  while ((groupMatch = poetryGroupRegex.exec(content)) !== null) {
-    const lines = groupMatch[1].split("\n");
-    for (const line of lines) {
-      const m = line.match(/^([a-zA-Z0-9_.-]+)\s*=/);
-      if (m) {
-        deps.push({ name: m[1].toLowerCase().replace(/_/g, "-") });
-      }
-    }
-  }
-  return deps;
-}
-function parsePipfile(content) {
-  const deps = [];
-  let inDepsSection = false;
-  for (const rawLine of content.split("\n")) {
-    const line = rawLine.trim();
-    if (/^\[(packages|dev-packages)\]/.test(line)) {
-      inDepsSection = true;
-      continue;
-    }
-    if (line.startsWith("[")) {
-      inDepsSection = false;
-      continue;
-    }
-    if (inDepsSection) {
-      const m = line.match(/^([a-zA-Z0-9_.-]+)\s*=/);
-      if (m) {
-        deps.push({ name: m[1].toLowerCase().replace(/_/g, "-") });
-      }
-    }
-  }
-  return deps;
-}
-function parseGemfile(content) {
-  const deps = [];
-  const gemRegex = /^\s*gem\s+["']([^"']+)["'](?:\s*,\s*["']([^"']+)["'])?/gm;
-  let match;
-  while ((match = gemRegex.exec(content)) !== null) {
-    deps.push({ name: match[1], version: match[2] });
-  }
-  return deps;
-}
-function parseMixExs(content) {
-  const deps = [];
-  const depRegex = /\{:([a-zA-Z_][a-zA-Z0-9_]*)\s*,\s*"([^"]*)"/g;
-  let match;
-  while ((match = depRegex.exec(content)) !== null) {
-    deps.push({ name: match[1], version: match[2] || void 0 });
-  }
-  return deps;
-}
-function parseGoMod(content) {
-  const deps = [];
-  const singleRegex = /^require\s+(\S+)\s+(\S+)/gm;
-  let match;
-  while ((match = singleRegex.exec(content)) !== null) {
-    if (!match[1].startsWith("(")) {
-      deps.push({ name: match[1], version: match[2] });
-    }
-  }
-  const blockRegex = /require\s*\(([\s\S]*?)\)/g;
-  while ((match = blockRegex.exec(content)) !== null) {
-    const lines = match[1].split("\n");
-    for (const line of lines) {
-      const m = line.trim().match(/^(\S+)\s+(\S+)/);
-      if (m && !m[1].startsWith("//")) {
-        deps.push({ name: m[1], version: m[2] });
-      }
-    }
-  }
-  return deps;
-}
-function parsePomXml(content) {
-  const deps = [];
-  const depRegex = /<dependency>[\s\S]*?<artifactId>([^<]+)<\/artifactId>[\s\S]*?<\/dependency>/g;
-  let match;
-  while ((match = depRegex.exec(content)) !== null) {
-    deps.push({ name: match[1].trim() });
-  }
-  return deps;
-}
-function parseBuildGradle(content) {
-  const deps = [];
-  const depRegex = /(?:implementation|testImplementation|api|compileOnly|runtimeOnly|kapt|annotationProcessor)\s*(?:\(\s*)?["']([^"':]+):([^"':]+)(?::([^"']+))?["']/g;
-  let match;
-  while ((match = depRegex.exec(content)) !== null) {
-    deps.push({ name: match[2].trim(), version: match[3]?.trim() });
-  }
-  return deps;
-}
-function parseVersionCatalogToml(content) {
-  const deps = [];
-  let inLibraries = false;
-  for (const rawLine of content.split("\n")) {
-    const line = rawLine.trim();
-    if (line === "" || line.startsWith("#")) continue;
-    if (line.startsWith("[")) {
-      inLibraries = /^\[\s*libraries\s*\]/.test(line);
-      continue;
-    }
-    if (!inLibraries) continue;
-    const moduleMatch = line.match(/\bmodule\s*=\s*["'][^"':]+:([^"']+)["']/);
-    const nameMatch = line.match(/\bname\s*=\s*["']([^"']+)["']/);
-    const versionMatch = line.match(/\bversion\s*=\s*["']([^"']+)["']/);
-    if (moduleMatch || nameMatch) {
-      deps.push({
-        name: (moduleMatch?.[1] ?? nameMatch?.[1] ?? "").trim(),
-        version: versionMatch?.[1]?.trim()
-      });
-      continue;
-    }
-    const shorthand = line.match(/^[A-Za-z0-9_.-]+\s*=\s*["'][^"':]+:([^"':]+)(?::([^"']+))?["']/);
-    if (shorthand) {
-      deps.push({ name: shorthand[1].trim(), version: shorthand[2]?.trim() });
-    }
-  }
-  return deps;
-}
-function parseBuildSbt(content) {
-  const deps = [];
-  const depRegex = /"([^"]+)"\s*%%?\s*"([^"]+)"\s*%(?!%)\s*(?:"([^"]+)")?/g;
-  let match;
-  while ((match = depRegex.exec(content)) !== null) {
-    deps.push({ name: match[2], version: match[3] });
-  }
-  return deps;
-}
-function parseSbtBuildDefinition(content) {
-  const deps = parseBuildSbt(content);
-  const pluginRegex = /addSbtPlugin\s*\(\s*"([^"]+)"\s*%%?\s*"([^"]+)"/g;
-  let match;
-  while ((match = pluginRegex.exec(content)) !== null) {
-    deps.push({ name: `${match[1]}:${match[2]}` });
-  }
-  return deps;
-}
-function parseCargoToml(content) {
-  const deps = [];
-  let inDepsSection = false;
-  for (const rawLine of content.split("\n")) {
-    const line = rawLine.trim();
-    if (/^\[((?:dev-|build-)?dependencies)\]/.test(line)) {
-      inDepsSection = true;
-      continue;
-    }
-    if (line.startsWith("[") && !line.includes("dependencies.")) {
-      inDepsSection = false;
-      continue;
-    }
-    if (inDepsSection) {
-      const m = line.match(/^([a-zA-Z0-9_-]+)\s*=/);
-      if (m) {
-        const versionMatch = line.match(/["']([^"']+)["']/);
-        deps.push({ name: m[1], version: versionMatch?.[1] });
-      }
-    }
-  }
-  return deps;
-}
-function parseComposerJson(content) {
-  try {
-    const pkg = JSON.parse(content);
-    const deps = [];
-    for (const section of ["require", "require-dev"]) {
-      const entries2 = pkg[section];
-      if (entries2 && typeof entries2 === "object") {
-        for (const [name, version] of Object.entries(entries2)) {
-          if (name === "php" || name.startsWith("ext-")) continue;
-          deps.push({ name, version: typeof version === "string" ? version : void 0 });
-        }
-      }
-    }
-    return deps;
-  } catch {
-    return [];
-  }
-}
-function parsePodfile(content) {
-  const deps = [];
-  const podRegex = /^\s*pod\s+["']([^"']+)["'](?:\s*,\s*["']([^"']+)["'])?/gm;
-  let match;
-  while ((match = podRegex.exec(content)) !== null) {
-    deps.push({ name: match[1], version: match[2] });
+    matches: (f) => /(^|\/)conf\/([^/]+\.)?routes$/.test(f),
+    entity: "play-framework"
   }
-  return deps;
-}
-function parsePackageSwift(content) {
-  const deps = [];
-  const pkgRegex = /\.package\s*\(\s*url:\s*["'](?:https?:\/\/[^/]+\/[^/]+\/|git@[^:]+:[^/]+\/)([^"'/.]+)/g;
-  let match;
-  while ((match = pkgRegex.exec(content)) !== null) {
-    deps.push({ name: match[1] });
+];
+function detectFileSignals(files) {
+  const result = [];
+  for (const rule of FILE_SIGNAL_RULES) {
+    const hit = files.find((f) => rule.matches(f));
+    if (!hit) continue;
+    const entity = import_tooling5.DEPENDENCY_ENTITIES[rule.entity];
+    result.push({
+      name: rule.name,
+      key: entity.key,
+      displayName: entity.displayName,
+      kind: entity.kind,
+      source: "file",
+      manifestFile: hit
+    });
   }
-  return deps;
+  return result;
 }
-function parsePubspecYaml(content) {
-  const deps = [];
-  let inSection = false;
-  let childIndent = -1;
-  for (const rawLine of content.split("\n")) {
-    const trimmed = rawLine.trim();
-    if (trimmed === "" || trimmed.startsWith("#")) continue;
-    const indent = rawLine.length - rawLine.trimStart().length;
-    if (indent === 0) {
-      inSection = /^(dependencies|dev_dependencies|dependency_overrides):/.test(trimmed);
-      childIndent = -1;
-      continue;
-    }
-    if (!inSection) continue;
-    if (childIndent === -1) childIndent = indent;
-    if (indent !== childIndent) continue;
-    const m = trimmed.match(/^([a-zA-Z0-9_.]+)\s*:(?:\s*["']?\^?([0-9][^"'#\s]*))?/);
-    if (m) deps.push({ name: m[1], version: m[2] });
-  }
-  return deps;
+function isEslintPluginName(name) {
+  return /^eslint-plugin-/.test(name) || /^@[^/]+\/eslint-plugin(-.*)?$/.test(name);
 }
-function parseShardYml(content) {
-  const deps = [];
-  let inSection = false;
-  let depIndent = -1;
-  let current;
-  const flush = () => {
-    if (current) deps.push(current);
-    current = void 0;
-  };
-  for (const rawLine of content.split("\n")) {
-    const trimmed = rawLine.trim();
-    if (trimmed === "" || trimmed.startsWith("#")) continue;
-    const indent = rawLine.length - rawLine.trimStart().length;
-    if (indent === 0) {
-      flush();
-      inSection = /^(dependencies|development_dependencies):/.test(trimmed);
-      depIndent = -1;
-      continue;
-    }
-    if (!inSection) continue;
-    if (depIndent === -1) depIndent = indent;
-    if (indent === depIndent) {
-      flush();
-      const m = trimmed.match(/^([a-zA-Z0-9_-]+)\s*:/);
-      current = m ? { name: m[1] } : void 0;
-      continue;
-    }
-    if (indent > depIndent && current) {
-      const v = trimmed.match(/^version\s*:\s*["']?(?:~>|[~^])?\s*([0-9][^"'\s]*)/);
-      if (v) current.version = v[1];
-    }
+function detectPackageJsonSignals(content) {
+  let pkg;
+  try {
+    pkg = JSON.parse(content);
+  } catch {
+    return [];
   }
-  flush();
-  return deps;
-}
-function parseXmlDependencyElements(content, elementRegex, nameAttr) {
-  const deps = [];
-  const nameRegex = new RegExp(`\\b${nameAttr}\\s*=\\s*["']([^"']+)["']`, "i");
-  const versionRegex = /\bversion\s*=\s*["']([^"']+)["']/i;
-  let match;
-  while ((match = elementRegex.exec(content)) !== null) {
-    const attrs = match[1];
-    const nameMatch = attrs.match(nameRegex);
-    if (!nameMatch) continue;
-    const versionMatch = attrs.match(versionRegex);
-    deps.push({ name: nameMatch[1].trim(), version: versionMatch?.[1]?.trim() });
+  const name = pkg && typeof pkg.name === "string" ? pkg.name : "";
+  if (name && isEslintPluginName(name)) {
+    const entity = import_tooling5.DEPENDENCY_ENTITIES["eslint-plugin"];
+    return [
+      {
+        name,
+        key: entity.key,
+        displayName: entity.displayName,
+        kind: entity.kind,
+        source: "manifest",
+        manifestFile: "package.json",
+        ecosystem: "npm"
+      }
+    ];
   }
-  return deps;
+  return [];
 }
-function parseCsproj(content) {
-  return parseXmlDependencyElements(
-    content,
-    /<Package(?:Reference|Version)\s+([^>]+?)\/?>/gi,
-    "Include"
-  );
+
+// src/discover/classify.ts
+var TELLTALE_INDEX = /* @__PURE__ */ new Map();
+function telltaleIndex(ecosystem) {
+  let index = TELLTALE_INDEX.get(ecosystem);
+  if (!index) {
+    index = new Map(getEcosystem(ecosystem).telltales);
+    TELLTALE_INDEX.set(ecosystem, index);
+  }
+  return index;
+}
+function classifyDependency(name, ecosystem) {
+  const exact = telltaleIndex(ecosystem).get(name);
+  if (exact) return import_tooling6.DEPENDENCY_ENTITIES[exact];
+  for (const [prefix, entity] of getEcosystem(ecosystem).prefixes ?? []) {
+    if (name.startsWith(prefix)) return import_tooling6.DEPENDENCY_ENTITIES[entity];
+  }
+  return void 0;
 }
-function parsePackagesConfig(content) {
-  return parseXmlDependencyElements(content, /<package\s+([^>]+?)\/?>/gi, "id");
+function getKnownDisplayNames() {
+  return new Set(Object.values(import_tooling6.DEPENDENCY_ENTITIES).map((entity) => entity.displayName));
 }
-var MANIFEST_PARSERS = /* @__PURE__ */ new Map([
-  ["package.json", parsePackageJson],
-  ["requirements.txt", parseRequirementsTxt],
-  ["pyproject.toml", parsePyprojectToml],
-  ["Pipfile", parsePipfile],
-  ["Gemfile", parseGemfile],
-  ["go.mod", parseGoMod],
-  ["pom.xml", parsePomXml],
-  ["build.gradle", parseBuildGradle],
-  ["build.gradle.kts", parseBuildGradle],
-  ["libs.versions.toml", parseVersionCatalogToml],
-  ["setup.py", parseSetupPy],
-  ["build.sbt", parseBuildSbt],
-  ["Cargo.toml", parseCargoToml],
-  ["composer.json", parseComposerJson],
-  ["Podfile", parsePodfile],
-  ["Package.swift", parsePackageSwift],
-  ["pubspec.yaml", parsePubspecYaml],
-  ["mix.exs", parseMixExs],
-  ["shard.yml", parseShardYml],
-  ["packages.config", parsePackagesConfig],
-  ["Directory.Packages.props", parseCsproj]
+
+// src/discover/notable-files.ts
+var NOTABLE_ANY_DEPTH = /* @__PURE__ */ new Set([
+  "Dockerfile",
+  "docker-compose.yml",
+  "docker-compose.yaml",
+  "compose.yml",
+  "compose.yaml",
+  "Makefile",
+  "Justfile",
+  "pom.xml",
+  "build.gradle",
+  "build.gradle.kts",
+  "build.sbt",
+  "go.mod",
+  "Cargo.toml",
+  "Gemfile",
+  "Podfile",
+  "Package.swift",
+  "Jenkinsfile",
+  "Vagrantfile",
+  "Procfile",
+  "pubspec.yaml",
+  "mix.exs",
+  "shard.yml",
+  "packages.config",
+  "Directory.Packages.props"
 ]);
-var MANIFEST_SUFFIX_PARSERS = /* @__PURE__ */ new Map([
-  [".csproj", parseCsproj],
-  [".vbproj", parseCsproj],
-  [".fsproj", parseCsproj]
+var NOTABLE_ROOT_ONLY = /* @__PURE__ */ new Set([
+  ".dockerignore",
+  "Taskfile.yml",
+  "Rakefile",
+  "Gruntfile.js",
+  "Gulpfile.js",
+  "settings.gradle",
+  "settings.gradle.kts",
+  "go.sum",
+  "Cargo.lock",
+  "CLAUDE.md",
+  "AGENTS.md",
+  "agents.md",
+  ".cursorrules",
+  "copilot-instructions.md",
+  ".travis.yml",
+  ".gitlab-ci.yml",
+  "azure-pipelines.yml",
+  "bitbucket-pipelines.yml",
+  "appveyor.yml",
+  "package.json",
+  "requirements.txt",
+  "pyproject.toml",
+  "Pipfile",
+  "composer.json",
+  "tsconfig.json",
+  "jsconfig.json",
+  "serverless.yml",
+  "serverless.yaml",
+  "cdk.json",
+  "pulumi.yaml",
+  "README.md",
+  "CHANGELOG.md",
+  "CONTRIBUTING.md",
+  "LICENSE",
+  "renovate.json",
+  ".nvmrc",
+  ".node-version",
+  ".python-version",
+  ".ruby-version",
+  ".tool-versions"
 ]);
-var MANIFEST_PATH_PARSERS = [
-  {
-    matches: (filePath, basename) => /^requirements[a-zA-Z0-9_.-]*\.(txt|in)$/i.test(basename) || // Any .txt/.in directly inside a `requirements/` directory: base.txt,
-    // dev.txt, prod.in — the other common split-layout convention.
-    /(^|\/)requirements\/[^/]+\.(txt|in)$/i.test(filePath),
-    parser: parseRequirementsTxt
-  },
-  {
-    // sbt build definition: `project/Dependencies.scala`, `project/plugins.sbt`
-    // and the meta-build's own `project/project/*`. Matching by directory rather
-    // than basename is what this rule exists for — the Scala file can be called
-    // anything, and `*.scala` on its own is source code, not a manifest.
-    //
-    // Case-sensitive deliberately: sbt's directory is always lowercase `project`,
-    // while `Project` is an ordinary domain-package name, and reading
-    // `…/domain/Project/Project.scala` as a manifest would be wrong.
-    matches: (filePath) => /(^|\/)project\/[^/]+\.(scala|sbt)$/.test(filePath),
-    parser: parseSbtBuildDefinition
-  }
+var NOTABLE_PATH_PREFIXES = [".github/workflows/", ".circleci/", ".gitlab/"];
+var CONFIG_HEURISTIC_PATTERNS = [
+  /^\..*rc$/,
+  // .eslintrc, .prettierrc, etc.
+  /^\..*rc\.(json|js|cjs|mjs|yml|yaml|ts)$/,
+  // .eslintrc.json, etc.
+  /^.*\.config\.(js|ts|mjs|cjs)$/,
+  // vite.config.ts, jest.config.js, etc.
+  /^\.env(\..+)?$/
+  // .env, .env.local, .env.production
 ];
+function isNotableFile(filePath) {
+  const basename = filePath.split("/").pop() ?? filePath;
+  const isRoot = !filePath.includes("/");
+  if (NOTABLE_ANY_DEPTH.has(basename)) return true;
+  if (isRoot && NOTABLE_ROOT_ONLY.has(basename)) return true;
+  if (/\.(csproj|vbproj|fsproj|sln)$/i.test(basename)) return true;
+  for (const prefix of NOTABLE_PATH_PREFIXES) {
+    if (filePath.startsWith(prefix)) return true;
+  }
+  if (!filePath.includes("/")) {
+    for (const pattern of CONFIG_HEURISTIC_PATTERNS) {
+      if (pattern.test(basename)) return true;
+    }
+  }
+  return false;
+}
 
-// src/discover.ts
+// src/discover/index.ts
 async function discover(repositoryRoot, options) {
   const unfiltered = listRepoFiles(repositoryRoot);
   const files = applyExclusions(unfiltered, [...options?.exclude ?? []], []);
@@ -3566,46 +3960,33 @@ function findNotableFiles(files) {
   }
   return Array.from(notable).sort();
 }
-function resolveManifestParser(filePath) {
-  const basename = filePath.split("/").pop() ?? filePath;
-  const byName = MANIFEST_PARSERS.get(basename);
-  if (byName) return byName;
-  const lowerBasename = basename.toLowerCase();
-  for (const [suffix, parser] of MANIFEST_SUFFIX_PARSERS) {
-    if (lowerBasename.endsWith(suffix)) return parser;
-  }
-  for (const rule of MANIFEST_PATH_PARSERS) {
-    if (rule.matches(filePath, basename)) return rule.parser;
-  }
-  return void 0;
-}
 async function extractDependencies(repositoryRoot, files) {
   const allDeps = [];
   for (const filePath of files) {
-    const parser = resolveManifestParser(filePath);
-    if (!parser) continue;
+    const manifest = resolveManifest(filePath);
+    if (!manifest) continue;
     let content;
     try {
       content = await import_promises2.default.readFile(import_path6.default.join(repositoryRoot, filePath), "utf-8");
     } catch {
       continue;
     }
-    const basename = filePath.split("/").pop() ?? filePath;
-    const rawDeps = parser(content);
-    for (const raw of rawDeps) {
-      const classification = classifyDependency(raw.name, basename);
-      if (classification) {
+    for (const raw of manifest.parser(content)) {
+      const entity = classifyDependency(raw.name, manifest.ecosystem);
+      if (entity) {
         allDeps.push({
           name: raw.name,
-          displayName: classification.displayName,
-          kind: classification.kind,
+          key: entity.key,
+          displayName: entity.displayName,
+          kind: entity.kind,
           source: "manifest",
           manifestFile: filePath,
-          version: raw.version
+          version: raw.version,
+          ecosystem: manifest.ecosystem
         });
       }
     }
-    if (basename === "package.json") {
+    if (filePath.split("/").pop() === "package.json") {
       for (const signal of detectPackageJsonSignals(content)) {
         allDeps.push({ ...signal, manifestFile: filePath });
       }
@@ -3617,8 +3998,8 @@ function deduplicateDeps(deps) {
   const seen = /* @__PURE__ */ new Set();
   const result = [];
   for (const dep of deps) {
-    if (!seen.has(dep.displayName)) {
-      seen.add(dep.displayName);
+    if (!seen.has(dep.key)) {
+      seen.add(dep.key);
       result.push(dep);
     }
   }
@@ -7171,8 +7552,14 @@ var ToolsService = class {
 
 // src/api/index.ts
 OpenAPI.BASE = (process.env.CODACY_API_BASE_URL || "https://app.codacy.com").replace(/\/$/, "") + "/api/v3";
-function configureApiToken(token) {
-  OpenAPI.HEADERS = { "api-token": token };
+function configureApiToken(auth) {
+  const resolved = typeof auth === "string" ? { kind: "account-token", token: auth } : auth;
+  if (!resolved || resolved.kind !== "account-token" && resolved.kind !== "repository-token" || !resolved.token) {
+    throw new Error(
+      'configureApiToken requires a non-empty apiToken string, or a RemoteAuth object ({ kind: "account-token" | "repository-token", token: string }).'
+    );
+  }
+  OpenAPI.HEADERS = resolved.kind === "account-token" ? { "api-token": resolved.token } : { "project-token": resolved.token };
 }
 async function fetchAllPages(fetcher) {
   const results = [];
@@ -7265,6 +7652,10 @@ async function listIgnoredFiles(provider, org, repo) {
 }
 
 // src/init.ts
+function isAuthFailure(err) {
+  return err instanceof ApiError && (err.status === 401 || err.status === 403);
+}
+var AUTH_FAILURE_HINT = "The token was accepted for earlier reads but rejected here: if it is a repository token, check that it belongs to this repository; if it is an account token, check that the account has access to it.";
 function deriveApiToolId(tool) {
   return tool.prefix ? tool.prefix.replace(/_$/, "") : tool.shortName;
 }
@@ -7319,7 +7710,7 @@ async function detectLanguages(repositoryRoot, precomputedFiles, exclude) {
   for (const file of files) {
     const basename = import_path8.default.basename(file);
     const ext = import_path8.default.extname(file).toLowerCase();
-    for (const [lang, config] of Object.entries(import_tooling5.LANGUAGE_CONFIG)) {
+    for (const [lang, config] of Object.entries(import_tooling7.LANGUAGE_CONFIG)) {
       if (config.extensions.includes(ext)) {
         detected.add(lang);
       } else if (config.files.includes(basename)) {
@@ -7437,14 +7828,21 @@ async function initDefaultConfig(repositoryRoot, adapters, options) {
     stats: { totalApiTools: apiTools.length, addedTools, addedUnsupported, codacyYamlApplied }
   };
 }
-async function initRemoteConfig(repositoryRoot, provider, organization, repositoryName, adapters, apiToken, onRemoteToolsFound, onToolProcessed, onIgnoredFilesFetched) {
-  configureApiToken(apiToken);
+async function initRemoteConfig(repositoryRoot, provider, organization, repositoryName, adapters, auth, onRemoteToolsFound, onToolProcessed, onIgnoredFilesFetched) {
+  configureApiToken(auth);
+  const repositoryLabel = `${provider}/${organization}/${repositoryName}`;
   const repoInfo = await getRepository(provider, organization, repositoryName);
   const remoteTools = await listRepositoryTools(provider, organization, repositoryName);
   let ignoredFilesResult = { files: [], totalFetched: 0, capped: false };
   try {
     ignoredFilesResult = await listIgnoredFiles(provider, organization, repositoryName);
-  } catch {
+  } catch (err) {
+    if (isAuthFailure(err)) {
+      throw new Error(
+        `Failed to fetch cloud-ignored files for ${repositoryLabel}: ${err.status} ${err.statusText}. ${AUTH_FAILURE_HINT} Aborting: continuing would silently drop this repository's cloud excludes from the generated config.`,
+        { cause: err }
+      );
+    }
   }
   onIgnoredFilesFetched?.(ignoredFilesResult.totalFetched, ignoredFilesResult.capped);
   const localConfigs = await detectLocalConfigFiles(repositoryRoot, adapters);
@@ -7453,7 +7851,7 @@ async function initRemoteConfig(repositoryRoot, provider, organization, reposito
   const apiToolByUuid = new Map(allApiTools.map((t) => [t.uuid, t]));
   const matchedAdapterCount = remoteTools.filter((t) => adapterByUuid.has(t.uuid)).length;
   onRemoteToolsFound?.(remoteTools.length, matchedAdapterCount);
-  const fetchPatterns = async (uuid) => {
+  const fetchPatterns = async (uuid, toolLabel) => {
     try {
       const configuredPatterns = await listRepositoryToolPatterns(
         provider,
@@ -7468,7 +7866,13 @@ async function initRemoteConfig(repositoryRoot, provider, organization, reposito
           ...params ? { parameters: params } : {}
         };
       });
-    } catch {
+    } catch (err) {
+      if (isAuthFailure(err)) {
+        throw new Error(
+          `Failed to fetch enabled patterns for ${toolLabel} in ${repositoryLabel}: ${err.status} ${err.statusText}. ${AUTH_FAILURE_HINT} Aborting: continuing would write a configuration with no enabled patterns.`,
+          { cause: err }
+        );
+      }
       return [];
     }
   };
@@ -7481,7 +7885,7 @@ async function initRemoteConfig(repositoryRoot, provider, organization, reposito
     if (adapter) {
       matchedAdapters++;
       const localConfigPath = localConfigs.get(adapter.id);
-      const patterns2 = usesLocalConfig ? [] : await fetchPatterns(remoteTool.uuid);
+      const patterns2 = usesLocalConfig ? [] : await fetchPatterns(remoteTool.uuid, adapter.displayName);
       onToolProcessed?.(adapter.displayName, patterns2.length, usesLocalConfig);
       tools.push({
         toolId: adapter.id,
@@ -7496,7 +7900,7 @@ async function initRemoteConfig(repositoryRoot, provider, organization, reposito
     const apiTool = apiToolByUuid.get(remoteTool.uuid);
     if (!apiTool || !isTrackableTool(apiTool)) continue;
     const toolId = deriveApiToolId(apiTool);
-    const patterns = usesLocalConfig ? [] : await fetchPatterns(remoteTool.uuid);
+    const patterns = usesLocalConfig ? [] : await fetchPatterns(remoteTool.uuid, apiTool.name ?? toolId);
     unsupportedTools++;
     onToolProcessed?.(apiTool.name ?? toolId, patterns.length, usesLocalConfig);
     tools.push({
@@ -7603,9 +8007,9 @@ async function initAutoConfig(repositoryRoot, adapters, descriptors, filters, on
   const discoveryResult = await discover(repositoryRoot, { exclude: excludes.global });
   onDiscoveryComplete?.(discoveryResult);
   const detectedKeys = /* @__PURE__ */ new Set();
-  for (const lang of discoveryResult.languages) detectedKeys.add(lang);
-  for (const fw of discoveryResult.frameworks) detectedKeys.add(fw.displayName);
-  for (const lib of discoveryResult.libraries) detectedKeys.add(lib.displayName);
+  for (const lang of discoveryResult.languages) detectedKeys.add((0, import_tooling7.languageKey)(lang));
+  for (const fw of discoveryResult.frameworks) detectedKeys.add(fw.key);
+  for (const lib of discoveryResult.libraries) detectedKeys.add(lib.key);
   const repoLanguages = new Set(discoveryResult.languages);
   const localConfigs = await detectLocalConfigFiles(repositoryRoot, adapters);
   const repoFiles = listRepoFiles(repositoryRoot, excludes.global);
@@ -7659,13 +8063,15 @@ async function initAutoConfig(repositoryRoot, adapters, descriptors, filters, on
         toolId: adapter.id,
         patterns: selectedPatterns.map((p) => ({ patternId: p.id }))
       };
-      tools.push(toolEntry);
-      await applyAdapterParameterSuggestions(
+      await applyAdapterConfigSuggestions(
         adapter,
         toolEntry,
         repositoryRoot,
-        filesVisibleTo(adapter.id)
+        filesVisibleTo(adapter.id),
+        repoLanguages,
+        filters
       );
+      if (toolEntry.patterns.length > 0) tools.push(toolEntry);
     }
   }
   let selectedUnsupported = 0;
@@ -7718,8 +8124,8 @@ async function initAutoConfig(repositoryRoot, adapters, descriptors, filters, on
     }
   };
 }
-async function applyAdapterParameterSuggestions(adapter, toolEntry, repositoryRoot, repoFiles) {
-  if (!adapter.suggestParameters) return;
+async function applyAdapterConfigSuggestions(adapter, toolEntry, repositoryRoot, repoFiles, repoLanguages, filters) {
+  if (!adapter.suggestConfiguration) return;
   const logger = {
     debug() {
     },
@@ -7744,15 +8150,38 @@ async function applyAdapterParameterSuggestions(adapter, toolEntry, repositoryRo
       logger,
       runner: "local"
     };
-    const suggestions = await adapter.suggestParameters(ctx);
-    if (!suggestions) return;
-    for (const pattern of toolEntry.patterns) {
-      const params = suggestions[pattern.patternId];
-      if (!params) continue;
-      pattern.parameters = { ...pattern.parameters, ...params };
+    const suggestion = await adapter.suggestConfiguration(ctx);
+    if (!suggestion) return;
+    const staticSelection = toolEntry.patterns;
+    if (suggestion.disablePatterns?.length) {
+      const drop = new Set(suggestion.disablePatterns);
+      toolEntry.patterns = toolEntry.patterns.filter((p) => !drop.has(p.patternId));
+    }
+    if (suggestion.enablePatterns?.length) {
+      const { severityFilter, categoryFilter } = buildFilterLookups(filters);
+      const metadata = new Map((adapter.patternsMetadata ?? []).map((p) => [p.id, p]));
+      const present = new Set(toolEntry.patterns.map((p) => p.patternId));
+      for (const patternId of suggestion.enablePatterns) {
+        if (present.has(patternId)) continue;
+        const pattern = metadata.get(patternId);
+        if (!pattern) continue;
+        if (!passesSelectionGates(pattern, repoLanguages, severityFilter, categoryFilter)) continue;
+        toolEntry.patterns.push({ patternId });
+        present.add(patternId);
+      }
+    }
+    if (toolEntry.patterns.length === 0) {
+      toolEntry.patterns = staticSelection;
+    }
+    if (suggestion.parameters) {
+      for (const pattern of toolEntry.patterns) {
+        const params = suggestion.parameters[pattern.patternId];
+        if (!params) continue;
+        pattern.parameters = { ...pattern.parameters, ...params };
+      }
     }
   } catch (err) {
-    logger.error("suggestParameters failed", {
+    logger.error("suggestConfiguration failed", {
       error: err instanceof Error ? err.message : String(err)
     });
   }
@@ -7778,6 +8207,13 @@ function deduplicateToolFamilies(candidates, localConfigs) {
       continue;
     }
     const withConfig = group.filter((a) => localConfigs.has(a.id));
+    const configuredFamilies = groupByToolFamily(withConfig);
+    if (configuredFamilies.size > 1) {
+      for (const members of configuredFamilies.values()) {
+        result.push(members.length === 1 ? members[0] : highestVersion(members));
+      }
+      continue;
+    }
     const pool = withConfig.length > 0 ? withConfig : group;
     if (pool.length === 1) {
       result.push(pool[0]);
@@ -7792,17 +8228,27 @@ function deduplicateToolFamilies(candidates, localConfigs) {
       group.filter((a) => a.alternativeGroupDefault).map((a) => toolFamily(a.id))
     );
     const defaultFamilyMembers = defaultFamilies.size === 1 ? pool.filter((a) => defaultFamilies.has(toolFamily(a.id))) : [];
-    const ranked = [...defaultFamilyMembers.length > 0 ? defaultFamilyMembers : pool].sort(
-      (a, b) => {
-        const majorA = parseInt(a.preferredVersion.split(".")[0], 10) || 0;
-        const majorB = parseInt(b.preferredVersion.split(".")[0], 10) || 0;
-        return majorB - majorA;
-      }
-    );
-    result.push(ranked[0]);
+    result.push(highestVersion(defaultFamilyMembers.length > 0 ? defaultFamilyMembers : pool));
   }
   return result;
 }
+function groupByToolFamily(adapters) {
+  const byFamily = /* @__PURE__ */ new Map();
+  for (const adapter of adapters) {
+    const family = toolFamily(adapter.id);
+    const members = byFamily.get(family) ?? [];
+    members.push(adapter);
+    byFamily.set(family, members);
+  }
+  return byFamily;
+}
+function highestVersion(adapters) {
+  return [...adapters].sort((a, b) => {
+    const majorA = parseInt(a.preferredVersion.split(".")[0], 10) || 0;
+    const majorB = parseInt(b.preferredVersion.split(".")[0], 10) || 0;
+    return majorB - majorA;
+  })[0];
+}
 function filterAutoPatterns(patterns, mappings, detectedKeys, repoLanguages, filters) {
   const allMappedPrefixes = [];
   const prefixToKeys = /* @__PURE__ */ new Map();
@@ -7828,8 +8274,7 @@ function filterAutoPatterns(patterns, mappings, detectedKeys, repoLanguages, fil
       }
     }
   }
-  const severityFilter = filters?.severities.length ? new Map(filters.severities.map((s) => [s.level, s.all])) : void 0;
-  const categoryFilter = filters?.categories.length ? new Map(filters.categories.map((c) => [c.category, c.all])) : void 0;
+  const { severityFilter, categoryFilter } = buildFilterLookups(filters);
   const result = [];
   for (const pattern of patterns) {
     const matchedKeys = findMappedKeys(
@@ -7849,15 +8294,25 @@ function filterAutoPatterns(patterns, mappings, detectedKeys, repoLanguages, fil
         }
       }
     }
-    if (pattern.languages.length > 0 && repoLanguages.size > 0) {
-      if (!pattern.languages.some((lang) => repoLanguages.has(lang))) continue;
-    }
-    if (severityFilter && !severityFilter.has(pattern.severityLevel)) continue;
-    if (categoryFilter && !categoryFilter.has(pattern.category)) continue;
+    if (!passesSelectionGates(pattern, repoLanguages, severityFilter, categoryFilter)) continue;
     result.push(pattern);
   }
   return result;
 }
+function buildFilterLookups(filters) {
+  return {
+    severityFilter: filters?.severities.length ? new Map(filters.severities.map((s) => [s.level, s.all])) : void 0,
+    categoryFilter: filters?.categories.length ? new Map(filters.categories.map((c) => [c.category, c.all])) : void 0
+  };
+}
+function passesSelectionGates(pattern, repoLanguages, severityFilter, categoryFilter) {
+  if (pattern.languages.length > 0 && repoLanguages.size > 0) {
+    if (!pattern.languages.some((lang) => repoLanguages.has(lang))) return false;
+  }
+  if (severityFilter && !severityFilter.has(pattern.severityLevel)) return false;
+  if (categoryFilter && !categoryFilter.has(pattern.category)) return false;
+  return true;
+}
 function findMappedKeys(patternId, patternTags, allPrefixes, prefixToKeys, allTags, tagToKeys) {
   const matched = /* @__PURE__ */ new Set();
   let longestPrefix = "";
@@ -7950,7 +8405,7 @@ function parseAutoFilters(raw) {
 }
 
 // src/index.ts
-var import_tooling6 = require("@codacy/tooling");
+var import_tooling8 = require("@codacy/tooling");
 
 // src/credentials.ts
 var import_crypto = __toESM(require("crypto"));
@@ -8015,6 +8470,17 @@ async function resolveApiToken() {
   if (stored) return stored;
   throw new Error("No API token found. Set CODACY_API_TOKEN or run 'codacy-analysis login'.");
 }
+async function resolveRemoteAuth(repositoryToken) {
+  const projectToken = repositoryToken || process.env.CODACY_PROJECT_TOKEN || void 0;
+  if (projectToken) return { kind: "repository-token", token: projectToken };
+  const apiToken = process.env.CODACY_API_TOKEN || await loadCredentials() || void 0;
+  if (!apiToken) {
+    throw new Error(
+      "No API token found. Provide --repository-token, set CODACY_PROJECT_TOKEN, set CODACY_API_TOKEN, or run 'codacy-analysis login'."
+    );
+  }
+  return { kind: "account-token", token: apiToken };
+}
 
 // src/git-info.ts
 var import_child_process5 = require("child_process");
@@ -8314,13 +8780,16 @@ async function safeReadBody(res) {
   registerAdapter,
   registerLazyAdapter,
   registerUnsupportedTool,
+  relativizeLocalConfigPaths,
   resolveApiToken,
   resolveBaselinePath,
   resolveConfigPath,
   resolveDiscoveryExcludes,
   resolveEngineToAdapter,
   resolveHeadCommit,
+  resolveLocalConfigPaths,
   resolveProxyConfig,
+  resolveRemoteAuth,
   resolveRepositoryRoot,
   resolveResultsApiBaseUrl,
   rotateLogFiles,