@codacy/analysis-runner 0.23.1 → 0.24.0

package/dist/index.js

@@ -30,15 +30,19 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  DEFAULT_IMAGE_SCAN_PKG_TYPES: () => DEFAULT_IMAGE_SCAN_PKG_TYPES,
+  DEFAULT_IMAGE_SCAN_SEVERITIES: () => DEFAULT_IMAGE_SCAN_SEVERITIES,
   analyze: () => analyze,
   applyCodacyYamlExcludes: () => applyCodacyYamlExcludes,
   applyConfigOperation: () => applyConfigOperation,
+  buildCodacyrc: () => buildCodacyrc,
+  buildPatternTranslator: () => buildPatternTranslator,
   buildPayloads: () => buildPayloads,
   buildToolConfig: () => buildToolConfig,
   clearAdapters: () => clearAdapters,
   computePatternSummary: () => computePatternSummary,
   configureApiToken: () => configureApiToken,
-  configureProxy: () => import_tooling8.configureProxy,
+  configureProxy: () => import_tooling9.configureProxy,
   createCodacyConfig: () => createCodacyConfig,
   createLogger: () => createLogger,
   createNullLogger: () => createNullLogger,
@@ -65,29 +69,39 @@ __export(index_exports, {
   loadCredentials: () => loadCredentials,
   mergeConfigs: () => mergeConfigs,
   parseAutoFilters: () => parseAutoFilters,
+  parseCodacyrc: () => parseCodacyrc,
   parseReport: () => parseReport,
+  partitionContainerErrors: () => partitionContainerErrors,
   pruneEmptyTools: () => pruneEmptyTools,
   readBaselineConfig: () => readBaselineConfig,
   readCodacyConfig: () => readCodacyConfig,
   readCodacyYaml: () => readCodacyYaml,
+  readCodacyrc: () => readCodacyrc,
   registerAdapter: () => registerAdapter,
   registerLazyAdapter: () => registerLazyAdapter,
   registerUnsupportedTool: () => registerUnsupportedTool,
+  registryLookup: () => registryLookup,
   relativizeLocalConfigPaths: () => relativizeLocalConfigPaths,
   resolveApiToken: () => resolveApiToken,
   resolveBaselinePath: () => resolveBaselinePath,
+  resolveCodacyrc: () => resolveCodacyrc,
   resolveConfigPath: () => resolveConfigPath,
   resolveDiscoveryExcludes: () => resolveDiscoveryExcludes,
   resolveEngineToAdapter: () => resolveEngineToAdapter,
   resolveHeadCommit: () => resolveHeadCommit,
   resolveLocalConfigPaths: () => resolveLocalConfigPaths,
-  resolveProxyConfig: () => import_tooling8.resolveProxyConfig,
+  resolveProxyConfig: () => import_tooling9.resolveProxyConfig,
   resolveRemoteAuth: () => resolveRemoteAuth,
   resolveRepositoryRoot: () => resolveRepositoryRoot,
   resolveResultsApiBaseUrl: () => resolveResultsApiBaseUrl,
+  resolveToolName: () => resolveToolName,
   rotateLogFiles: () => rotateLogFiles,
   saveCredentials: () => saveCredentials,
+  scanContainerImage: () => scanContainerImage,
+  serializeCodacyrc: () => serializeCodacyrc,
+  toEnginePatternId: () => toEnginePatternId,
   updateConfigIncremental: () => updateConfigIncremental,
+  uploadImageSbom: () => uploadImageSbom2,
   uploadReport: () => uploadReport,
   validateApiToken: () => validateApiToken,
   writeBaselineConfig: () => writeBaselineConfig,
@@ -98,7 +112,7 @@ module.exports = __toCommonJS(index_exports);
 
 // src/analyze.ts
 var import_os2 = __toESM(require("os"));
-var import_path4 = __toESM(require("path"));
+var import_path5 = __toESM(require("path"));
 var import_fs3 = __toESM(require("fs"));
 var import_child_process3 = require("child_process");
 var import_util = require("util");
@@ -348,7 +362,7 @@ function createCodacyConfig(params = {}) {
     tools: params.tools ?? [],
     exclude: []
   };
-  if (params.includeFiles && params.includeFiles.length > 0) {
+  if (params.includeFiles !== void 0) {
     config.includeFiles = params.includeFiles;
   }
   return config;
@@ -602,6 +616,11 @@ function listRepoFiles(repositoryRoot, exclude) {
       encoding: "utf-8",
       maxBuffer: 50 * 1024 * 1024
     }).trim();
+    const deleted = (0, import_child_process2.execSync)("git ls-files --deleted", {
+      cwd: repositoryRoot,
+      encoding: "utf-8",
+      maxBuffer: 50 * 1024 * 1024
+    }).trim();
     const files = /* @__PURE__ */ new Set();
     for (const f of tracked.split("\n")) {
       if (f) files.add(f);
@@ -609,10 +628,15 @@ function listRepoFiles(repositoryRoot, exclude) {
     for (const f of untracked.split("\n")) {
       if (f) files.add(f);
     }
+    for (const f of deleted.split("\n")) {
+      if (f) files.delete(f);
+    }
     const all = Array.from(files).sort();
     return exclude && exclude.length > 0 ? applyExclusions(all, [...exclude], []) : all;
-  } catch {
-    return [];
+  } catch (err) {
+    throw new Error(
+      `Could not list repository files in ${repositoryRoot}: ${err instanceof Error ? err.message : String(err)}`
+    );
   }
 }
 function filterOversizedFiles(files, repositoryRoot, logger) {
@@ -652,6 +676,22 @@ function filterOversizedFiles(files, repositoryRoot, logger) {
   }
   return { files: result, skipped };
 }
+function filterSkippedFilesToTools(skipped, tools, globalExclude = []) {
+  if (skipped.length === 0 || tools.length === 0) return [];
+  const afterGlobal = applyExclusions(
+    skipped.map((s) => s.filePath),
+    [...globalExclude],
+    []
+  );
+  if (afterGlobal.length === 0) return [];
+  const routable = /* @__PURE__ */ new Set();
+  for (const { adapter, toolConfig } of tools) {
+    const toolExclude = toolConfig.exclude ?? [];
+    const visible = toolExclude.length > 0 ? applyExclusions(afterGlobal, [], [...toolExclude]) : afterGlobal;
+    for (const file of routeFilesToTool(visible, adapter, toolConfig)) routable.add(file);
+  }
+  return skipped.filter((s) => routable.has(s.filePath));
+}
 function applyExclusions(files, globalExclude, toolExclude) {
   if (globalExclude.length === 0 && toolExclude.length === 0) return files;
   const matcher = new CompiledMatcher([...globalExclude, ...toolExclude]);
@@ -683,6 +723,211 @@ function filterByTargetFiles(allFiles, targetPatterns) {
   );
 }
 
+// src/codacyrc.ts
+var import_promises2 = __toESM(require("fs/promises"));
+
+// src/pattern-id.ts
+function toEnginePatternId(patternId, toolId) {
+  const prefix = `${toolId}_`;
+  return patternId.startsWith(prefix) ? patternId.slice(prefix.length) : patternId;
+}
+function buildPatternTranslator(toolId, patternsMetadata) {
+  const prefix = `${toolId}_`;
+  const byEngineId = /* @__PURE__ */ new Map();
+  let prefixedCount = 0;
+  let total = 0;
+  for (const entry of patternsMetadata ?? []) {
+    if (typeof entry?.id !== "string" || entry.id === "") continue;
+    total++;
+    byEngineId.set(entry.id, entry.id);
+    const unprefixed = toEnginePatternId(entry.id, toolId);
+    if (unprefixed !== entry.id) {
+      byEngineId.set(unprefixed, entry.id);
+      prefixedCount++;
+    }
+  }
+  const hasCatalogue = total > 0;
+  const toolIsPrefixed = hasCatalogue ? prefixedCount === total : true;
+  return {
+    toolId,
+    hasCatalogue,
+    isKnown: (enginePatternId) => !hasCatalogue || byEngineId.has(enginePatternId),
+    toInternal(enginePatternId) {
+      const known = byEngineId.get(enginePatternId);
+      if (known) return known;
+      if (!toolIsPrefixed) return enginePatternId;
+      return enginePatternId.startsWith(prefix) ? enginePatternId : prefix + enginePatternId;
+    }
+  };
+}
+
+// src/codacyrc.ts
+function registryLookup() {
+  return { descriptors: getRegisteredDescriptors(), load: getAdapter };
+}
+function parseCodacyrc(raw, label = ".codacyrc") {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    try {
+      parsed = JSON.parse(Buffer.from(raw.trim(), "base64").toString("utf-8"));
+    } catch {
+      throw new Error(`Failed to parse ${label}: not valid JSON or base64-encoded JSON`);
+    }
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`Failed to parse ${label}: expected a JSON object`);
+  }
+  return parsed;
+}
+async function readCodacyrc(filePath) {
+  let raw;
+  try {
+    raw = await import_promises2.default.readFile(filePath, "utf-8");
+  } catch (err) {
+    if (err?.code === "ENOENT") return null;
+    throw err;
+  }
+  return parseCodacyrc(raw, filePath);
+}
+function resolveToolName(name, descriptors) {
+  const runnable = descriptors.filter((d) => !d.unsupported);
+  const lower = name.toLowerCase();
+  return runnable.find((d) => d.shortName === name) ?? runnable.find((d) => d.shortName?.toLowerCase() === lower) ?? runnable.find((d) => d.id === name) ?? runnable.find((d) => d.id.toLowerCase() === lower);
+}
+function toParameterRecord(parameters) {
+  const out = {};
+  if (!Array.isArray(parameters)) return out;
+  for (const parameter of parameters) {
+    if (!parameter || typeof parameter.name !== "string" || parameter.name === "") continue;
+    const { value } = parameter;
+    if (value === null || value === void 0) continue;
+    out[parameter.name] = typeof value === "object" ? JSON.stringify(value) : String(value);
+  }
+  return out;
+}
+function withSpecDefaults(entry, configured) {
+  const defaults = {};
+  for (const spec of entry?.parameters ?? []) {
+    if (typeof spec?.name !== "string" || spec.name === "") continue;
+    if (spec.default === void 0 || spec.default === null) continue;
+    defaults[spec.name] = String(spec.default);
+  }
+  return { ...defaults, ...configured };
+}
+async function resolveCodacyrc(codacyrc, opts = {}) {
+  const lookup = opts.lookup ?? registryLookup();
+  const logger = opts.logger;
+  const allowed = opts.toolIds && opts.toolIds.length > 0 ? new Set(opts.toolIds.map((id) => id.toLowerCase())) : void 0;
+  const descriptors = allowed ? lookup.descriptors.filter((d) => allowed.has(d.id.toLowerCase())) : lookup.descriptors;
+  const tools = [];
+  const matchedToolIds = [];
+  const unmatchedToolNames = [];
+  const unknownPatterns = [];
+  for (const entry of codacyrc?.tools ?? []) {
+    if (typeof entry !== "object" || entry === null || typeof entry.name !== "string") continue;
+    const descriptor = resolveToolName(entry.name, descriptors);
+    if (!descriptor) {
+      unmatchedToolNames.push(entry.name);
+      continue;
+    }
+    if (matchedToolIds.includes(descriptor.id)) continue;
+    const adapter = await lookup.load(descriptor.id);
+    const translator = buildPatternTranslator(descriptor.id, adapter?.patternsMetadata);
+    const byId = new Map((adapter?.patternsMetadata ?? []).map((p) => [p.id, p]));
+    const patterns = [];
+    for (const raw of entry.patterns ?? []) {
+      if (typeof raw !== "object" || raw === null || typeof raw.patternId !== "string") continue;
+      const translated = translator.toInternal(raw.patternId);
+      if (!translator.isKnown(raw.patternId)) {
+        unknownPatterns.push({ toolId: descriptor.id, patternId: raw.patternId });
+      }
+      const parameters = withSpecDefaults(byId.get(translated), toParameterRecord(raw.parameters));
+      patterns.push({
+        patternId: translated,
+        ...Object.keys(parameters).length > 0 ? { parameters } : {}
+      });
+    }
+    tools.push({ toolId: descriptor.id, patterns });
+    matchedToolIds.push(descriptor.id);
+  }
+  if (unmatchedToolNames.length > 0) {
+    logger?.warn(
+      `.codacyrc names ${unmatchedToolNames.length} tool(s) with no local analyzer here: ${unmatchedToolNames.join(", ")}`
+    );
+  }
+  for (const unknown of unknownPatterns) {
+    logger?.warn(
+      `.codacyrc enables "${unknown.patternId}", which ${unknown.toolId} does not ship; passing it through`
+    );
+  }
+  const files = Array.isArray(codacyrc?.files) ? codacyrc.files.filter((f) => typeof f === "string") : void 0;
+  const config = createCodacyConfig({ source: "container", tools, includeFiles: files });
+  return {
+    config,
+    matchedToolIds,
+    unmatchedToolNames,
+    unknownPatterns,
+    options: codacyrc?.options ?? {}
+  };
+}
+function toWireValue(raw, spec) {
+  const declared = spec?.default;
+  if (typeof declared === "number") {
+    const parsed = Number(raw);
+    return raw.trim() !== "" && Number.isFinite(parsed) ? parsed : raw;
+  }
+  if (typeof declared === "boolean") {
+    if (raw === "true") return true;
+    if (raw === "false") return false;
+    return raw;
+  }
+  if (declared !== null && typeof declared === "object") {
+    try {
+      return JSON.parse(raw);
+    } catch {
+      return raw;
+    }
+  }
+  return raw;
+}
+function toParameterList(entry, configured) {
+  const merged = withSpecDefaults(entry, configured ?? {});
+  const names = Object.keys(merged).sort();
+  if (names.length === 0) return void 0;
+  const specByName = /* @__PURE__ */ new Map();
+  for (const spec of entry?.parameters ?? []) {
+    if (typeof spec?.name === "string" && spec.name !== "") specByName.set(spec.name, spec);
+  }
+  return names.map((name) => ({ name, value: toWireValue(merged[name], specByName.get(name)) }));
+}
+function buildCodacyrc(tools, opts = {}) {
+  const files = /* @__PURE__ */ new Set();
+  const wireTools = [];
+  for (const { adapter, toolConfig, files: routed } of tools) {
+    for (const file of routed) files.add(file);
+    if (!adapter.shortName) {
+      opts.logger?.warn(
+        `${adapter.id} declares no Codacy short-name; emitting "${adapter.id}" as tools[].name, which a Codacy engine image will not recognize`
+      );
+    }
+    const byId = new Map((adapter.patternsMetadata ?? []).map((p) => [p.id, p]));
+    const patterns = toolConfig.useLocalConfigurationFile ? [] : (toolConfig.patterns ?? []).map((pattern) => {
+      const parameters = toParameterList(byId.get(pattern.patternId), pattern.parameters);
+      return {
+        patternId: toEnginePatternId(pattern.patternId, adapter.id),
+        ...parameters ? { parameters } : {}
+      };
+    });
+    wireTools.push({ name: adapter.shortName ?? adapter.id, patterns });
+  }
+  return { files: [...files].sort(), tools: wireTools };
+}
+function serializeCodacyrc(codacyrc) {
+  return JSON.stringify(codacyrc, null, 2) + "\n";
+}
+
 // src/executor.ts
 var import_tooling2 = require("@codacy/tooling");
 var HARD_TIMEOUT_GRACE_MS = 2e3;
@@ -1081,6 +1326,81 @@ function computePatternSummary(issues, lookup) {
   };
 }
 
+// src/tool-install.ts
+var import_path4 = __toESM(require("path"));
+function makeToolContext(base, adapter, targetFiles, generatedRoot) {
+  return {
+    ...base,
+    targetFiles,
+    toolInstallDir: import_path4.default.join(base.globalDir, "tools", adapter.id),
+    generatedConfigDir: import_path4.default.join(
+      generatedRoot ?? import_path4.default.join(base.repositoryRoot, ".codacy", "generated"),
+      adapter.id
+    )
+  };
+}
+async function installMissingTool(adapter, ctx, logger) {
+  logger.info(`${adapter.displayName} is missing, attempting install...`);
+  try {
+    logger.info(`Downloading ${adapter.displayName}...`);
+    const installResult = await adapter.install(ctx);
+    if (installResult.success) {
+      logger.info(`Checking ${adapter.displayName} installation...`);
+      const recheck = await adapter.checkAvailability(ctx);
+      if (recheck.available) {
+        logger.info(`${adapter.displayName} is now available`);
+        return {
+          kind: "installed",
+          version: recheck.version ?? installResult.installedVersion ?? adapter.preferredVersion,
+          installation: recheck.installation ?? "codacy"
+        };
+      }
+      logger.error(
+        `${adapter.displayName} post-install check failed: ${recheck.reason ?? "unknown"}`
+      );
+      return {
+        kind: "failed",
+        error: {
+          toolId: adapter.id,
+          phase: "toolInstall",
+          kind: "PostInstallCheckFailed",
+          message: `Installed ${adapter.id} but availability check still fails: ${recheck.reason ?? "unknown"}`,
+          level: "error"
+        }
+      };
+    }
+    if (installResult.error?.kind === "NotSupported") {
+      logger.info(`${adapter.displayName} does not support automated install, skipping.`);
+      return { kind: "notSupported" };
+    }
+    const errMsg = installResult.error?.message ?? `Failed to install ${adapter.id}`;
+    logger.error(`${adapter.displayName} install failed: ${errMsg}`);
+    return {
+      kind: "failed",
+      error: installResult.error ?? {
+        toolId: adapter.id,
+        phase: "toolInstall",
+        kind: "InstallFailed",
+        message: errMsg,
+        level: "error"
+      }
+    };
+  } catch (err) {
+    const errMsg = err instanceof Error ? err.message : String(err);
+    logger.error(`${adapter.displayName} install failed: ${errMsg}`);
+    return {
+      kind: "failed",
+      error: {
+        toolId: adapter.id,
+        phase: "toolInstall",
+        kind: "InstallError",
+        message: `Install failed for ${adapter.id}: ${errMsg}`,
+        level: "error"
+      }
+    };
+  }
+}
+
 // src/analyze.ts
 var execFileAsync = (0, import_util.promisify)(import_child_process3.execFile);
 var CHECK_CONCURRENCY = 12;
@@ -1111,7 +1431,7 @@ async function analyze(options) {
     toolExecutionMs: 0,
     installMs: 0
   };
-  const emptyCapability = {
+  const emptyCapability2 = {
     ready: [],
     unavailable: [],
     checkedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -1122,7 +1442,7 @@ async function analyze(options) {
       startedAt,
       options.repositoryRoot,
       mode,
-      emptyCapability,
+      emptyCapability2,
       [],
       [
         {
@@ -1142,7 +1462,7 @@ async function analyze(options) {
       startedAt,
       options.repositoryRoot,
       mode,
-      emptyCapability,
+      emptyCapability2,
       [],
       [
         {
@@ -1156,34 +1476,42 @@ async function analyze(options) {
       []
     );
   }
+  let codacyConfig;
+  let configError;
   try {
-    await execFileAsync("git", ["rev-parse", "--is-inside-work-tree"], {
-      cwd: options.repositoryRoot
-    });
+    codacyConfig = options.config ?? await readCodacyConfig(options.repositoryRoot, options.configFile);
   } catch (err) {
-    const isGitMissing = err instanceof Error && "code" in err && err.code === "ENOENT";
-    const message = isGitMissing ? "git is not installed. Codacy analysis requires git for file discovery." : `${options.repositoryRoot} is not a git repository. Codacy analysis requires a git repository for file discovery. Run \`git init\` to initialize one.`;
-    const kind = isGitMissing ? "GitNotInstalled" : "NotAGitRepository";
-    return buildResult(
-      startedAt,
-      options.repositoryRoot,
-      mode,
-      emptyCapability,
-      [],
-      [{ toolId: "runner", phase: "requirementCheck", kind, message, level: "error" }],
-      []
-    );
+    codacyConfig = null;
+    configError = err;
+  }
+  if (configError === void 0 && codacyConfig?.includeFiles === void 0) {
+    try {
+      await execFileAsync("git", ["rev-parse", "--is-inside-work-tree"], {
+        cwd: options.repositoryRoot
+      });
+    } catch (err) {
+      const isGitMissing = err instanceof Error && "code" in err && err.code === "ENOENT";
+      const message = isGitMissing ? "git is not installed. Codacy analysis requires git for file discovery." : `${options.repositoryRoot} is not a git repository. Codacy analysis requires a git repository for file discovery. Run \`git init\` to initialize one.`;
+      const kind = isGitMissing ? "GitNotInstalled" : "NotAGitRepository";
+      return buildResult(
+        startedAt,
+        options.repositoryRoot,
+        mode,
+        emptyCapability2,
+        [],
+        [{ toolId: "runner", phase: "requirementCheck", kind, message, level: "error" }],
+        []
+      );
+    }
   }
   const configLabel = options.configFile ?? ".codacy/codacy.config.json";
-  let codacyConfig;
-  try {
-    codacyConfig = await readCodacyConfig(options.repositoryRoot, options.configFile);
-  } catch (err) {
+  if (configError !== void 0) {
+    const err = configError;
     return buildResult(
       startedAt,
       options.repositoryRoot,
       mode,
-      emptyCapability,
+      emptyCapability2,
       [],
       [
         {
@@ -1202,7 +1530,7 @@ async function analyze(options) {
       startedAt,
       options.repositoryRoot,
       mode,
-      emptyCapability,
+      emptyCapability2,
       [],
       [
         {
@@ -1219,7 +1547,7 @@ async function analyze(options) {
   const requestedTools = options.tools ?? codacyConfig.tools.map((t) => t.toolId);
   const adapters = await getRegisteredAdapters(requestedTools);
   logger.info("Pipeline started", { mode, toolCount: adapters.length, parallelTools, toolTimeout });
-  const globalDir = import_path4.default.join(import_os2.default.homedir(), ".codacy");
+  const globalDir = import_path5.default.join(import_os2.default.homedir(), ".codacy");
   const runnerEnv = options.runner ?? "local";
   const baseCtx = {
     repositoryRoot: options.repositoryRoot,
@@ -1266,7 +1594,7 @@ async function analyze(options) {
             displayName: adapter.displayName,
             version: availability.version ?? adapter.preferredVersion,
             installation: availability.installation ?? "global",
-            runner: "local"
+            runner: runnerEnv
           }
         };
       }
@@ -1366,6 +1694,25 @@ async function analyze(options) {
       logger.info(`Updated ${updatedCount} managed tool(s) to their pinned versions`);
     }
   }
+  if (mode === "auto-install" && runnerEnv === "container") {
+    return buildResult(
+      startedAt,
+      options.repositoryRoot,
+      mode,
+      capability,
+      [],
+      [
+        {
+          toolId: "runner",
+          phase: "requirementCheck",
+          kind: "InstallNotAllowed",
+          message: "Installs are disabled under the container runner; the image must ship its tools.",
+          level: "error"
+        }
+      ],
+      []
+    );
+  }
   if (mode === "auto-install" && capability.unavailable.length > 0) {
     const installStartMs = Date.now();
     const installErrors = [];
@@ -1373,62 +1720,24 @@ async function analyze(options) {
       const status = capability.unavailable[i];
       const adapter = adapters.find((a) => a.id === status.toolId);
       if (!adapter) continue;
-      const ctx = makeToolContext(baseCtx, adapter, []);
-      logger.info(`${adapter.displayName} is missing, attempting install...`);
-      try {
-        logger.info(`Downloading ${adapter.displayName}...`);
-        const installResult = await adapter.install(ctx);
-        if (installResult.success) {
-          logger.info(`Checking ${adapter.displayName} installation...`);
-          const recheck = await adapter.checkAvailability(ctx);
-          if (recheck.available) {
-            logger.info(`${adapter.displayName} is now available`);
-            capability.ready.push({
-              toolId: adapter.id,
-              displayName: adapter.displayName,
-              version: recheck.version ?? installResult.installedVersion ?? adapter.preferredVersion,
-              installation: recheck.installation ?? "codacy",
-              runner: "local"
-            });
-            capability.unavailable.splice(i, 1);
-          } else {
-            logger.error(
-              `${adapter.displayName} post-install check failed: ${recheck.reason ?? "unknown"}`
-            );
-            installErrors.push({
-              toolId: adapter.id,
-              phase: "toolInstall",
-              kind: "PostInstallCheckFailed",
-              message: `Installed ${adapter.id} but availability check still fails: ${recheck.reason ?? "unknown"}`,
-              level: "error"
-            });
-          }
-        } else if (installResult.error?.kind === "NotSupported") {
-          logger.info(`${adapter.displayName} does not support automated install, skipping.`);
-          capability.unavailable.splice(i, 1);
-        } else {
-          const errMsg = installResult.error?.message ?? `Failed to install ${adapter.id}`;
-          logger.error(`${adapter.displayName} install failed: ${errMsg}`);
-          installErrors.push(
-            installResult.error ?? {
-              toolId: adapter.id,
-              phase: "toolInstall",
-              kind: "InstallFailed",
-              message: errMsg,
-              level: "error"
-            }
-          );
-        }
-      } catch (err) {
-        const errMsg = err instanceof Error ? err.message : String(err);
-        logger.error(`${adapter.displayName} install failed: ${errMsg}`);
-        installErrors.push({
+      const outcome = await installMissingTool(
+        adapter,
+        makeToolContext(baseCtx, adapter, []),
+        logger
+      );
+      if (outcome.kind === "installed") {
+        capability.ready.push({
           toolId: adapter.id,
-          phase: "toolInstall",
-          kind: "InstallError",
-          message: `Install failed for ${adapter.id}: ${errMsg}`,
-          level: "error"
+          displayName: adapter.displayName,
+          version: outcome.version,
+          installation: outcome.installation,
+          runner: runnerEnv
         });
+        capability.unavailable.splice(i, 1);
+      } else if (outcome.kind === "notSupported") {
+        capability.unavailable.splice(i, 1);
+      } else {
+        installErrors.push(outcome.error);
       }
     }
     phaseTimings.installMs = Date.now() - installStartMs;
@@ -1497,8 +1806,59 @@ async function analyze(options) {
   }
   const fileDiscoveryStartMs = Date.now();
   const globalExclude = codacyConfig.exclude || [];
-  let allFiles = listRepoFiles(options.repositoryRoot);
-  logger.debug("File discovery", { totalFiles: allFiles.length });
+  let allFiles;
+  const runnerErrors = [];
+  if (codacyConfig.includeFiles === void 0) {
+    try {
+      allFiles = listRepoFiles(options.repositoryRoot);
+    } catch (err) {
+      return buildResult(
+        startedAt,
+        options.repositoryRoot,
+        mode,
+        capability,
+        [],
+        [
+          {
+            toolId: "runner",
+            phase: "requirementCheck",
+            kind: "FileDiscoveryFailed",
+            message: err instanceof Error ? err.message : String(err),
+            level: "error"
+          }
+        ],
+        []
+      );
+    }
+    logger.debug("File discovery", { source: "git", totalFiles: allFiles.length });
+  } else {
+    const seen = /* @__PURE__ */ new Set();
+    allFiles = [];
+    for (const raw of codacyConfig.includeFiles) {
+      const rel = raw.replace(/\\/g, "/").replace(/^\.\//, "");
+      if (rel === "" || seen.has(rel)) continue;
+      seen.add(rel);
+      const absolute = import_path5.default.resolve(options.repositoryRoot, rel);
+      const relativeToRoot = import_path5.default.relative(options.repositoryRoot, absolute);
+      const escapesRoot = relativeToRoot === ".." || relativeToRoot.startsWith(`..${import_path5.default.sep}`) || import_path5.default.isAbsolute(relativeToRoot);
+      const stat = escapesRoot ? void 0 : import_fs3.default.statSync(absolute, { throwIfNoEntry: false });
+      if (!stat?.isFile()) {
+        runnerErrors.push({
+          toolId: "runner",
+          phase: "requirementCheck",
+          kind: "FileNotFound",
+          message: escapesRoot ? `${rel} was requested for analysis but is outside the repository` : `${rel} was requested for analysis but does not exist`,
+          level: "warning",
+          filePath: rel,
+          fileNotAnalyzed: true
+        });
+        continue;
+      }
+      allFiles.push(rel);
+    }
+    allFiles.sort();
+    logger.debug("File discovery", { source: "config", totalFiles: allFiles.length });
+  }
   if (options.gitScope) {
     const scopeFiles = resolveGitScope(options.repositoryRoot, options.gitScope);
     logger.debug("Git scope resolved", {
@@ -1507,7 +1867,7 @@ async function analyze(options) {
     });
     if (scopeFiles.length === 0) {
       logger.info("Git scope resolved to zero files, skipping analysis");
-      return buildResult(startedAt, options.repositoryRoot, mode, capability, [], [], []);
+      return buildResult(startedAt, options.repositoryRoot, mode, capability, [], runnerErrors, []);
     }
     const scopeSet = new Set(scopeFiles);
     allFiles = allFiles.filter((f) => scopeSet.has(f));
@@ -1524,6 +1884,8 @@ async function analyze(options) {
   const fileRoutingStartMs = Date.now();
   const readyById = new Map(capability.ready.map((r) => [r.toolId, r]));
   const readyAdapters = adapters.filter((a) => readyById.has(a.id));
+  const generatedRoot = resolveGeneratedRoot(options.repositoryRoot, runnerEnv, logger);
+  const generatedRootIsTemporary = runnerEnv === "container";
   const filesAfterGlobalExclude = applyExclusions(allFiles, globalExclude, []);
   const toolRuns = [];
   const candidates = [];
@@ -1540,7 +1902,7 @@ async function analyze(options) {
     candidates.push({
       adapter,
       toolFiles,
-      configCtx: makeToolContext(baseCtx, adapter, toolFiles),
+      configCtx: makeToolContext(baseCtx, adapter, toolFiles, generatedRoot),
       readyEntry
     });
   }
@@ -1588,6 +1950,32 @@ async function analyze(options) {
     toolRuns.push({ adapter, ctx: configCtx, codacyToolConfig });
   }
   phaseTimings.fileRoutingMs = Date.now() - fileRoutingStartMs;
+  const analyzedSkippedFiles = filterSkippedFilesToTools(
+    skippedFiles,
+    toolRuns.map(({ adapter, codacyToolConfig }) => ({
+      adapter,
+      toolConfig: codacyToolConfig
+    })),
+    globalExclude
+  );
+  if (options.onCodacyrc && toolRuns.length > 0) {
+    if (toolRuns.length > 1) {
+      logger.info("Emitting .codacyrc for multiple tools", {
+        toolCount: toolRuns.length,
+        hint: "`files` is the union of their routed lists; use --tool to pin one"
+      });
+    }
+    await options.onCodacyrc(
+      buildCodacyrc(
+        toolRuns.map(({ adapter, ctx, codacyToolConfig }) => ({
+          adapter,
+          toolConfig: codacyToolConfig,
+          files: ctx.targetFiles
+        })),
+        { logger }
+      )
+    );
+  }
   const toolExecStartMs = Date.now();
   logger.info("Starting tool execution", {
     toolCount: toolRuns.length,
@@ -1613,7 +2001,17 @@ async function analyze(options) {
   }
   phaseTimings.toolExecutionMs = Date.now() - toolExecStartMs;
   const allIssues = normalizeIssues(results.flatMap((r) => r.issues));
-  const allErrors = results.flatMap((r) => r.errors);
+  if (generatedRootIsTemporary) {
+    try {
+      import_fs3.default.rmSync(generatedRoot, { recursive: true, force: true });
+    } catch (err) {
+      logger.debug("Could not remove the temporary generated-config directory", {
+        path: generatedRoot,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  const allErrors = [...runnerErrors, ...results.flatMap((r) => r.errors)];
   const allSummaries = results.map((r) => r.summary);
   const patternLookup = /* @__PURE__ */ new Map();
   for (const { adapter } of toolRuns) {
@@ -1643,16 +2041,14 @@ async function analyze(options) {
     allSummaries,
     patternSummary,
     phaseTimings,
-    skippedFiles
+    analyzedSkippedFiles
   );
 }
-function makeToolContext(base, adapter, targetFiles) {
-  return {
-    ...base,
-    targetFiles,
-    toolInstallDir: import_path4.default.join(base.globalDir, "tools", adapter.id),
-    generatedConfigDir: import_path4.default.join(base.repositoryRoot, ".codacy", "generated", adapter.id)
-  };
+function resolveGeneratedRoot(repositoryRoot, runnerEnv, logger) {
+  if (runnerEnv !== "container") return import_path5.default.join(repositoryRoot, ".codacy", "generated");
+  const dir = import_fs3.default.mkdtempSync(import_path5.default.join(import_os2.default.tmpdir(), "codacy-generated-"));
+  logger.info("Generated tool configs will be written outside the source directory", { path: dir });
+  return dir;
 }
 async function updateStaleManagedTools(capability, adapters, baseCtx, logger) {
   const adaptersById = new Map(adapters.map((a) => [a.id, a]));
@@ -1758,6 +2154,8 @@ async function repairMissingManagedTools(capability, adapters, baseCtx, logger)
         displayName: adapter.displayName,
         version: recheck.version ?? installResult.installedVersion ?? adapter.preferredVersion,
         installation: recheck.installation ?? "codacy",
+        // Always local: this repair pass is skipped entirely under the container
+        // runner, which never installs anything.
         runner: "local"
       });
       capability.unavailable.splice(i, 1);
@@ -1808,7 +2206,7 @@ function buildResult(startedAt, repositoryRoot, mode, capability, issues, errors
 }
 
 // src/format.ts
-var import_path5 = __toESM(require("path"));
+var import_path6 = __toESM(require("path"));
 var import_tooling4 = require("@codacy/tooling");
 var import_ansis = __toESM(require("ansis"));
 var import_cli_table3 = __toESM(require("cli-table3"));
@@ -1924,17 +2322,48 @@ function mapSeverityToSarif(severity) {
       return "warning";
   }
 }
+function partitionContainerErrors(errors) {
+  const fileErrors = [];
+  const otherErrors = [];
+  for (const error of errors) {
+    if (error.fileNotAnalyzed && error.filePath) fileErrors.push(error);
+    else otherErrors.push(error);
+  }
+  return { fileErrors, otherErrors };
+}
 function formatContainer(result) {
-  return result.issues.map(
-    (issue) => JSON.stringify({
+  const lines = [];
+  const fileErrors = /* @__PURE__ */ new Map();
+  for (const error of partitionContainerErrors(result.errors).fileErrors) {
+    const filename = error.filePath;
+    if (fileErrors.has(filename)) continue;
+    fileErrors.set(filename, flattenErrorMessage(error.message) || void 0);
+  }
+  for (const skipped of result.skippedFiles ?? []) {
+    if (fileErrors.has(skipped.filePath)) continue;
+    fileErrors.set(
+      skipped.filePath,
+      `File skipped: ${skipped.sizeBytes} bytes exceeds the ${MAX_FILE_SIZE_BYTES}-byte limit`
+    );
+  }
+  for (const issue of result.issues) {
+    if (issue.line <= 0) {
+      if (!fileErrors.has(issue.filePath)) {
+        fileErrors.set(issue.filePath, import_tooling4.LINE_NUMBERS_NOT_SUPPORTED);
+      }
+      continue;
+    }
+    lines.push({
       filename: issue.filePath,
-      patternId: issue.patternId,
+      patternId: toEnginePatternId(issue.patternId, issue.toolId),
       line: issue.line,
       message: issue.message,
       suggestion: issue.suggestion,
       sourceId: issue.sourceId
-    })
-  ).join("\n");
+    });
+  }
+  for (const [filename, message] of fileErrors) lines.push({ filename, message });
+  return lines.map((line) => JSON.stringify(line)).join("\n");
 }
 function formatText(result) {
   const lines = [];
@@ -2246,7 +2675,7 @@ function formatFilesCell(filesRouted) {
 }
 function formatConfigCell(tool, repositoryRoot) {
   if (tool.configSource === "local" && tool.configPath) {
-    const rawPath = import_path5.default.isAbsolute(tool.configPath) ? import_path5.default.relative(repositoryRoot, tool.configPath) : tool.configPath;
+    const rawPath = import_path6.default.isAbsolute(tool.configPath) ? import_path6.default.relative(repositoryRoot, tool.configPath) : tool.configPath;
     return rawPath.startsWith("./") ? rawPath : `./${rawPath}`;
   }
   if (tool.configSource === "codacy") return "Codacy";
@@ -2541,15 +2970,14 @@ function updateConfigIncremental(base, current, next) {
 }
 
 // src/init.ts
-var import_promises4 = __toESM(require("fs/promises"));
 var import_os3 = __toESM(require("os"));
-var import_path8 = __toESM(require("path"));
+var import_path9 = __toESM(require("path"));
 var import_child_process4 = require("child_process");
 var import_tooling7 = require("@codacy/tooling");
 
 // src/discover/index.ts
-var import_promises2 = __toESM(require("fs/promises"));
-var import_path6 = __toESM(require("path"));
+var import_promises3 = __toESM(require("fs/promises"));
+var import_path7 = __toESM(require("path"));
 
 // src/discover/classify.ts
 var import_tooling6 = require("@codacy/tooling");
@@ -4049,7 +4477,12 @@ function isNotableFile(filePath) {
 
 // src/discover/index.ts
 async function discover(repositoryRoot, options) {
-  const unfiltered = listRepoFiles(repositoryRoot);
+  let unfiltered;
+  try {
+    unfiltered = listRepoFiles(repositoryRoot);
+  } catch {
+    unfiltered = [];
+  }
   const files = applyExclusions(unfiltered, [...options?.exclude ?? []], []);
   const excludedFiles = unfiltered.length - files.length;
   const filePatterns = extractFilePatterns(files);
@@ -4072,7 +4505,7 @@ async function discover(repositoryRoot, options) {
     frameworks,
     libraries,
     metadata: {
-      repositoryRoot: import_path6.default.resolve(repositoryRoot),
+      repositoryRoot: import_path7.default.resolve(repositoryRoot),
       totalFiles: files.length,
       scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
       // Surfaced so a scan narrowed by excludes is never mistaken for a repo
@@ -4084,7 +4517,7 @@ async function discover(repositoryRoot, options) {
 function extractFilePatterns(files) {
   const extensions = /* @__PURE__ */ new Set();
   for (const file of files) {
-    const ext = import_path6.default.extname(file).toLowerCase();
+    const ext = import_path7.default.extname(file).toLowerCase();
     if (ext) {
       extensions.add(`*${ext}`);
     }
@@ -4107,7 +4540,7 @@ async function extractDependencies(repositoryRoot, files) {
     if (!manifest) continue;
     let content;
     try {
-      content = await import_promises2.default.readFile(import_path6.default.join(repositoryRoot, filePath), "utf-8");
+      content = await import_promises3.default.readFile(import_path7.default.join(repositoryRoot, filePath), "utf-8");
     } catch {
       continue;
     }
@@ -4147,15 +4580,15 @@ function deduplicateDeps(deps) {
 }
 
 // src/codacy-yaml.ts
-var import_promises3 = __toESM(require("fs/promises"));
-var import_path7 = __toESM(require("path"));
+var import_promises4 = __toESM(require("fs/promises"));
+var import_path8 = __toESM(require("path"));
 var import_yaml = require("yaml");
 async function readCodacyYaml(repositoryRoot) {
   const candidates = [".codacy.yaml", ".codacy.yml"];
   let raw = null;
   for (const filename of candidates) {
     try {
-      raw = await import_promises3.default.readFile(import_path7.default.join(repositoryRoot, filename), "utf-8");
+      raw = await import_promises4.default.readFile(import_path8.default.join(repositoryRoot, filename), "utf-8");
       break;
     } catch {
     }
@@ -4256,7 +4689,7 @@ async function resolveDiscoveryExcludes(repositoryRoot, adapters, existingConfig
 
 // src/api/client/core/OpenAPI.ts
 var OpenAPI = {
-  BASE: "https://app.codacy.com/api/v3",
+  BASE: "https://api.codacy.com/api/v3",
   VERSION: "3.1.0",
   WITH_CREDENTIALS: false,
   CREDENTIALS: "include",
@@ -4435,13 +4868,13 @@ var getQueryString = (params) => {
 };
 var getUrl = (config, options) => {
   const encoder = config.ENCODE_PATH || encodeURI;
-  const path10 = options.url.replace("{api-version}", config.VERSION).replace(/{(.*?)}/g, (substring, group) => {
+  const path12 = options.url.replace("{api-version}", config.VERSION).replace(/{(.*?)}/g, (substring, group) => {
     if (options.path?.hasOwnProperty(group)) {
       return encoder(String(options.path[group]));
     }
     return substring;
   });
-  const url = `${config.BASE}${path10}`;
+  const url = `${config.BASE}${path12}`;
   if (options.query) {
     return `${url}${getQueryString(options.query)}`;
   }
@@ -5176,10 +5609,10 @@ var AnalysisService = class {
    * Patterns configuration for (repository, tool). Uses standard if applied, repository settings otherwise.
    *
    * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param repositoryName Repository name on the Git provider organization* @param toolUuid Unique identifier (UUID) for the tool* @param languages Comma-separated list of programming languages to filter results by* @param categories Filter by a comma-separated list of code pattern categories. Valid values are `Security`, `ErrorProne`, `CodeStyle`, `Compatibility`, `UnusedCode`, `Complexity`, `Comprehensibility`, `Documentation`, `BestPractice`, and `Performance`.
-   * * @param severityLevels Filter by a comma-separated list of code pattern severity levels. Valid values are `Error`, `High`, `Warning`, and `Info`.* @param tags Filter by a comma-separated list of pattern tags* @param search Filter results by searching for this string* @param enabled Filter by pattern status. Set to `true` to return only enabled patterns, or `false` to return only disabled patterns* @param recommended Filter by recommended status. Set to `true` to return only recommended patterns, or `false` to return only non-recommended patterns* @param sort Field used to sort the tool's code patterns. Valid values are `category`, `recommended`, and `severity`.* @param direction Sort direction. Possible values are 'asc' (ascending) or 'desc' (descending).* @param cursor Cursor to [specify a batch of results to request](https://docs.codacy.com/codacy-api/using-the-codacy-api/#using-pagination)* @param limit Maximum number of items to return   * @returns ConfiguredPatternsListResponse Successful operation
+   * * @param severityLevels Filter by a comma-separated list of code pattern severity levels. Valid values are `Error`, `High`, `Warning`, and `Info`.* @param tags Filter by a comma-separated list of pattern tags* @param search Filter results by searching for this string* @param enabled Filter by pattern status. Set to `true` to return only enabled patterns, or `false` to return only disabled patterns* @param recommended Filter by recommended status. Set to `true` to return only recommended patterns, or `false` to return only non-recommended patterns* @param matchesStack Filter repository code patterns by whether they match the repository stack.* @param sort Field used to sort the tool's code patterns. Valid values are `category`, `recommended`, and `severity`.* @param direction Sort direction. Possible values are 'asc' (ascending) or 'desc' (descending).* @param cursor Cursor to [specify a batch of results to request](https://docs.codacy.com/codacy-api/using-the-codacy-api/#using-pagination)* @param limit Maximum number of items to return   * @returns ConfiguredPatternsListResponse Successful operation
    * @throws ApiError
    */
-  static listRepositoryToolPatterns(provider, remoteOrganizationName, repositoryName, toolUuid, languages, categories, severityLevels, tags, search, enabled, recommended, sort, direction, cursor, limit = 100, abortSignal) {
+  static listRepositoryToolPatterns(provider, remoteOrganizationName, repositoryName, toolUuid, languages, categories, severityLevels, tags, search, enabled, recommended, matchesStack, sort, direction, cursor, limit = 100, abortSignal) {
     return request(OpenAPI, {
       method: "GET",
       url: "/analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/tools/{toolUuid}/patterns",
@@ -5197,6 +5630,7 @@ var AnalysisService = class {
         "search": search,
         "enabled": enabled,
         "recommended": recommended,
+        "matchesStack": matchesStack,
         "sort": sort,
         "direction": direction,
         "cursor": cursor,
@@ -5218,10 +5652,10 @@ var AnalysisService = class {
    * Use filters to specify the code patterns to update, or omit the filters to update all code patterns.
    *
    * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param repositoryName Repository name on the Git provider organization* @param toolUuid Unique identifier (UUID) for the tool* @param requestBody * @param languages Comma-separated list of programming languages to filter results by* @param categories Filter by a comma-separated list of code pattern categories. Valid values are `Security`, `ErrorProne`, `CodeStyle`, `Compatibility`, `UnusedCode`, `Complexity`, `Comprehensibility`, `Documentation`, `BestPractice`, and `Performance`.
-   * * @param severityLevels Filter by a comma-separated list of code pattern severity levels. Valid values are `Error`, `High`, `Warning`, and `Info`.* @param tags Filter by a comma-separated list of pattern tags* @param search Filter results by searching for this string* @param recommended Filter by recommended status. Set to `true` to return only recommended patterns, or `false` to return only non-recommended patterns   * @returns void
+   * * @param severityLevels Filter by a comma-separated list of code pattern severity levels. Valid values are `Error`, `High`, `Warning`, and `Info`.* @param tags Filter by a comma-separated list of pattern tags* @param search Filter results by searching for this string* @param recommended Filter by recommended status. Set to `true` to return only recommended patterns, or `false` to return only non-recommended patterns* @param matchesStack Filter repository code patterns by whether they match the repository stack.   * @returns void
    * @throws ApiError
    */
-  static updateRepositoryToolPatterns(provider, remoteOrganizationName, repositoryName, toolUuid, requestBody, languages, categories, severityLevels, tags, search, recommended, abortSignal) {
+  static updateRepositoryToolPatterns(provider, remoteOrganizationName, repositoryName, toolUuid, requestBody, languages, categories, severityLevels, tags, search, recommended, matchesStack, abortSignal) {
     return request(OpenAPI, {
       method: "PATCH",
       url: "/analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/tools/{toolUuid}/patterns",
@@ -5237,7 +5671,8 @@ var AnalysisService = class {
         "severityLevels": severityLevels,
         "tags": tags,
         "search": search,
-        "recommended": recommended
+        "recommended": recommended,
+        "matchesStack": matchesStack
       },
       abortSignal,
       body: requestBody,
@@ -5285,10 +5720,10 @@ var AnalysisService = class {
    * Patterns overview for tool. Uses standard if applied, repository settings otherwise.
    *
    * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param repositoryName Repository name on the Git provider organization* @param toolUuid Unique identifier (UUID) for the tool* @param languages Comma-separated list of programming languages to filter results by* @param categories Filter by a comma-separated list of code pattern categories. Valid values are `Security`, `ErrorProne`, `CodeStyle`, `Compatibility`, `UnusedCode`, `Complexity`, `Comprehensibility`, `Documentation`, `BestPractice`, and `Performance`.
-   * * @param severityLevels Filter by a comma-separated list of code pattern severity levels. Valid values are `Error`, `High`, `Warning`, and `Info`.* @param tags Filter by a comma-separated list of pattern tags* @param search Filter results by searching for this string* @param enabled Filter by pattern status. Set to `true` to return only enabled patterns, or `false` to return only disabled patterns* @param recommended Filter by recommended status. Set to `true` to return only recommended patterns, or `false` to return only non-recommended patterns   * @returns ToolPatternsOverviewResponse Successful operation
+   * * @param severityLevels Filter by a comma-separated list of code pattern severity levels. Valid values are `Error`, `High`, `Warning`, and `Info`.* @param tags Filter by a comma-separated list of pattern tags* @param search Filter results by searching for this string* @param enabled Filter by pattern status. Set to `true` to return only enabled patterns, or `false` to return only disabled patterns* @param recommended Filter by recommended status. Set to `true` to return only recommended patterns, or `false` to return only non-recommended patterns* @param matchesStack Filter repository code patterns by whether they match the repository stack.   * @returns ToolPatternsOverviewResponse Successful operation
    * @throws ApiError
    */
-  static toolPatternsOverview(provider, remoteOrganizationName, repositoryName, toolUuid, languages, categories, severityLevels, tags, search, enabled, recommended, abortSignal) {
+  static toolPatternsOverview(provider, remoteOrganizationName, repositoryName, toolUuid, languages, categories, severityLevels, tags, search, enabled, recommended, matchesStack, abortSignal) {
     return request(OpenAPI, {
       method: "GET",
       url: "/analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/tools/{toolUuid}/patterns/overview",
@@ -5305,7 +5740,8 @@ var AnalysisService = class {
         "tags": tags,
         "search": search,
         "enabled": enabled,
-        "recommended": recommended
+        "recommended": recommended,
+        "matchesStack": matchesStack
       },
       abortSignal,
       errors: {
@@ -5378,33 +5814,34 @@ var AnalysisService = class {
     });
   }
   /**
-   * List pull requests from a repository that the user has access to
-   * You can search this endpoint for either `last-updated` (default), `impact` or `merged`
-   *
-   * **Note:** When applied to public repositories, this operation does not require authentication.
+   * Recover a stuck repository
+   * Triggers a recovery action when the repository is stuck on its first analysis.
+   * The exact action taken depends on the stuck state.
+   * Returns `422 Unprocessable Entity` when the repository is not stuck.
    *
-   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param repositoryName Repository name on the Git provider organization* @param limit Maximum number of items to return* @param cursor Cursor to [specify a batch of results to request](https://docs.codacy.com/codacy-api/using-the-codacy-api/#using-pagination)* @param search Filter results by searching for this string* @param includeNotAnalyzed If true, also return pull requests that weren't analyzed   * @returns PullRequestWithAnalysisListResponse Successful operation
+   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param repositoryName Repository name on the Git provider organization* @param branch Name of a [repository branch enabled on Codacy](https://docs.codacy.com/repositories-configure/managing-branches/),
+   * as returned by the endpoint [listRepositoryBranches](#listrepositorybranches).
+   * By default, uses the main branch defined on the Codacy repository settings.
+   *    * @returns void
    * @throws ApiError
    */
-  static listRepositoryPullRequests(provider, remoteOrganizationName, repositoryName, limit = 100, cursor, search, includeNotAnalyzed = false, abortSignal) {
+  static recoverRepository(provider, remoteOrganizationName, repositoryName, branch, abortSignal) {
     return request(OpenAPI, {
-      method: "GET",
-      url: "/analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/pull-requests",
+      method: "POST",
+      url: "/analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/recover",
       path: {
         "provider": provider,
         "remoteOrganizationName": remoteOrganizationName,
         "repositoryName": repositoryName
       },
       query: {
-        "limit": limit,
-        "cursor": cursor,
-        "search": search,
-        "includeNotAnalyzed": includeNotAnalyzed
+        "branch": branch
       },
       abortSignal,
       errors: {
         400: `Bad Request`,
         401: `Unauthorized`,
+        403: `Forbidden`,
         404: `Not Found`,
         422: `Unprocessable Entity`,
         500: `Internal Server Error`
@@ -5412,15 +5849,134 @@ var AnalysisService = class {
     });
   }
   /**
-   * Get pull request from a repository
-   * **Note:** When applied to public repositories, this operation does not require authentication.
+   * Add repository autoconfiguration run
+   * **[Experimental]** Autoconfig enqueuing endpoint
    *
-   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param repositoryName Repository name on the Git provider organization* @param pullRequestNumber Pull request number   * @returns PullRequestWithAnalysis Successful operation
+   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param repositoryName Repository name on the Git provider organization   * @returns AddAutoconfigResponse Autoconfig run accepted
    * @throws ApiError
    */
-  static getRepositoryPullRequest(provider, remoteOrganizationName, repositoryName, pullRequestNumber, abortSignal) {
+  static addAutoconfig(provider, remoteOrganizationName, repositoryName, abortSignal) {
     return request(OpenAPI, {
-      method: "GET",
+      method: "POST",
+      url: "/analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/autoconfig",
+      path: {
+        "provider": provider,
+        "remoteOrganizationName": remoteOrganizationName,
+        "repositoryName": repositoryName
+      },
+      abortSignal,
+      errors: {
+        400: `Bad Request`,
+        401: `Unauthorized`,
+        403: `Forbidden`,
+        404: `Not Found`,
+        422: `Unprocessable Entity`,
+        429: `Too Many Requests`,
+        500: `Internal Server Error`
+      }
+    });
+  }
+  /**
+   * Get latest autoconfig run summary
+   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param repositoryName Repository name on the Git provider organization   * @returns AutoconfigRunSummaryResponse Successful operation
+   * @throws ApiError
+   */
+  static getLatestAutoconfigRunSummary(provider, remoteOrganizationName, repositoryName, abortSignal) {
+    return request(OpenAPI, {
+      method: "GET",
+      url: "/analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/autoconfig/runs",
+      path: {
+        "provider": provider,
+        "remoteOrganizationName": remoteOrganizationName,
+        "repositoryName": repositoryName
+      },
+      abortSignal,
+      errors: {
+        400: `Bad Request`,
+        401: `Unauthorized`,
+        403: `Forbidden`,
+        404: `Not Found`,
+        500: `Internal Server Error`
+      }
+    });
+  }
+  /**
+   * Get autoconfig run status
+   * **[Experimental]** Fetch latest autoconfig run state managed (can be `Requested`, `Running`, `Done` or `Failed`)
+   *
+   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param repositoryName Repository name on the Git provider organization   * @returns AutoconfigStatusResponse Successful operation
+   * @throws ApiError
+   */
+  static getAutoconfigStatus(provider, remoteOrganizationName, repositoryName, abortSignal) {
+    return request(OpenAPI, {
+      method: "GET",
+      url: "/analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/autoconfig/status",
+      path: {
+        "provider": provider,
+        "remoteOrganizationName": remoteOrganizationName,
+        "repositoryName": repositoryName
+      },
+      abortSignal,
+      errors: {
+        400: `Bad Request`,
+        401: `Unauthorized`,
+        403: `Forbidden`,
+        404: `Not Found`,
+        500: `Internal Server Error`
+      }
+    });
+  }
+  /**
+   * List pull requests from a repository that the user has access to
+   * You can search this endpoint for either `last-updated` (default), `merged`
+   *
+   * **Note:** When applied to public repositories, this operation does not require authentication.
+   *
+   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param repositoryName Repository name on the Git provider organization* @param limit Maximum number of items to return* @param cursor Cursor to [specify a batch of results to request](https://docs.codacy.com/codacy-api/using-the-codacy-api/#using-pagination)* @param search Filter results by searching for this string* @param textQuery Filter pull requests by a free-text search matched, case-insensitively, against the
+   * pull request title or the author's handle.
+   * * @param targetBranch Filter pull requests by the name of their target branch.
+   * Pull requests targeting any other branch are excluded from the results.
+   * By default, pull requests targeting any branch are returned.
+   * * @param includeNotAnalyzed If true, also return pull requests that weren't analyzed   * @returns PullRequestWithAnalysisListResponse Successful operation
+   * @throws ApiError
+   */
+  static listRepositoryPullRequests(provider, remoteOrganizationName, repositoryName, limit = 100, cursor, search, textQuery, targetBranch, includeNotAnalyzed = false, abortSignal) {
+    return request(OpenAPI, {
+      method: "GET",
+      url: "/analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/pull-requests",
+      path: {
+        "provider": provider,
+        "remoteOrganizationName": remoteOrganizationName,
+        "repositoryName": repositoryName
+      },
+      query: {
+        "limit": limit,
+        "cursor": cursor,
+        "search": search,
+        "textQuery": textQuery,
+        "targetBranch": targetBranch,
+        "includeNotAnalyzed": includeNotAnalyzed
+      },
+      abortSignal,
+      errors: {
+        400: `Bad Request`,
+        401: `Unauthorized`,
+        404: `Not Found`,
+        422: `Unprocessable Entity`,
+        500: `Internal Server Error`
+      }
+    });
+  }
+  /**
+   * Get pull request from a repository
+   * **Note:** When applied to public repositories, this operation does not require authentication.
+   *
+   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param repositoryName Repository name on the Git provider organization* @param pullRequestNumber Pull request number   * @returns PullRequestWithAnalysis Successful operation
+   * @throws ApiError
+   */
+  static getRepositoryPullRequest(provider, remoteOrganizationName, repositoryName, pullRequestNumber, abortSignal) {
+    return request(OpenAPI, {
+      method: "GET",
       url: "/analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/pull-requests/{pullRequestNumber}",
       path: {
         "provider": provider,
@@ -5494,6 +6050,33 @@ var AnalysisService = class {
       }
     });
   }
+  /**
+   * Triggers an AI review for a pull request
+   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param repositoryName Repository name on the Git provider organization* @param pullRequestNumber Pull request number   * @returns void
+   * @throws ApiError
+   */
+  static triggerPullRequestAiReview(provider, remoteOrganizationName, repositoryName, pullRequestNumber, abortSignal) {
+    return request(OpenAPI, {
+      method: "POST",
+      url: "/analysis/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/pull-requests/{pullRequestNumber}/ai-reviewer/trigger",
+      path: {
+        "provider": provider,
+        "remoteOrganizationName": remoteOrganizationName,
+        "repositoryName": repositoryName,
+        "pullRequestNumber": pullRequestNumber
+      },
+      abortSignal,
+      errors: {
+        400: `Bad Request`,
+        401: `Unauthorized`,
+        403: `Forbidden`,
+        404: `Not Found`,
+        409: `Conflict`,
+        422: `Unprocessable Entity`,
+        500: `Internal Server Error`
+      }
+    });
+  }
   /**
    * List all coverage reports uploaded for the common ancestor commit and head commit of a pull request branch
    * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param repositoryName Repository name on the Git provider organization* @param pullRequestNumber Pull request number   * @returns CoveragePullRequestResponse Successful operation
@@ -5767,7 +6350,7 @@ var AnalysisService = class {
   }
   /**
    * List organization pull requests from repositories that the user has access to
-   * You can sort by `last-updated` (default), `impact`, or `merged`
+   * You can sort by `last-updated` (default), `merged`
    * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param limit Maximum number of items to return* @param search Filter results by searching for this string* @param repositories **Deprecated:** Use [searchOrganizationRepositoriesWithAnalysis](#searchorganizationrepositorieswithanalysis) instead.   * @returns PullRequestWithAnalysisListResponse Successful operation
    * @throws ApiError
    */
@@ -5896,7 +6479,7 @@ var AnalysisService = class {
   }
   /**
    * Bulk ignore issues in a repository
-   * Receives a list of issue ids and ignores them in the specified repository. Limited to 50 issues at once
+   * Receives a list of issue ids and ignores them in the specified repository. Limited to 100 issues at once
    * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param repositoryName Repository name on the Git provider organization* @param requestBody List of issue ids to ignore   * @returns void
    * @throws ApiError
    */
@@ -7114,10 +7697,16 @@ var RepositoryService = class {
    * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param repositoryName Repository name on the Git provider organization* @param branch Name of a [repository branch enabled on Codacy](https://docs.codacy.com/repositories-configure/managing-branches/),
    * as returned by the endpoint [listRepositoryBranches](#listrepositorybranches).
    * By default, uses the main branch defined on the Codacy repository settings.
-   * * @param search Filter files that include this string anywhere in their relative path* @param sort Field used to sort the list of files. Valid values are `filename`, `issues`, `grade`, `duplication`, `complexity`, and `coverage`.* @param direction Sort direction. Possible values are 'asc' (ascending) or 'desc' (descending).* @param cursor Cursor to [specify a batch of results to request](https://docs.codacy.com/codacy-api/using-the-codacy-api/#using-pagination)* @param limit Maximum number of items to return   * @returns FileListResponse List of files in the repository
+   * * @param path Relative path of the folder whose direct child files are listed.
+   * When absent, all files in the repository are returned (recursive).
+   * When empty, only files at the repository root are returned.
+   * * @param search Filter files that include this string anywhere in their relative path* @param sort Field used to sort the results.
+   * For files the valid values are `filename`, `issues`, `grade`, `duplication`, `complexity`, and `coverage`.
+   * For folders the valid values are `name`, `issues`, `grade`, `duplication`, `complexity`, and `coverage`.
+   * * @param direction Sort direction. Possible values are 'asc' (ascending) or 'desc' (descending).* @param cursor Cursor to [specify a batch of results to request](https://docs.codacy.com/codacy-api/using-the-codacy-api/#using-pagination)* @param limit Maximum number of items to return   * @returns FileListResponse List of files in the repository
    * @throws ApiError
    */
-  static listFiles(provider, remoteOrganizationName, repositoryName, branch, search, sort, direction, cursor, limit = 100, abortSignal) {
+  static listFiles(provider, remoteOrganizationName, repositoryName, branch, path12, search, sort, direction, cursor, limit = 100, abortSignal) {
     return request(OpenAPI, {
       method: "GET",
       url: "/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/files",
@@ -7128,6 +7717,7 @@ var RepositoryService = class {
       },
       query: {
         "branch": branch,
+        "path": path12,
         "search": search,
         "sort": sort,
         "direction": direction,
@@ -7144,6 +7734,48 @@ var RepositoryService = class {
       }
     });
   }
+  /**
+   * List folders in a repository
+   * Returns the most recent analysis information for the folders directly inside a path of a repository, with metrics aggregated over every file in each folder's subtree.
+   * Use the `path` parameter to list the folders inside a folder; when absent or empty, the folders at the repository root are returned.
+   *
+   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param repositoryName Repository name on the Git provider organization* @param branch Name of a [repository branch enabled on Codacy](https://docs.codacy.com/repositories-configure/managing-branches/),
+   * as returned by the endpoint [listRepositoryBranches](#listrepositorybranches).
+   * By default, uses the main branch defined on the Codacy repository settings.
+   * * @param path Path of the folder whose child folders are listed.
+   * When absent or empty, the folders at the repository root are returned.
+   * * @param sort Field used to sort the results.
+   * For files the valid values are `filename`, `issues`, `grade`, `duplication`, `complexity`, and `coverage`.
+   * For folders the valid values are `name`, `issues`, `grade`, `duplication`, `complexity`, and `coverage`.
+   * * @param direction Sort direction. Possible values are 'asc' (ascending) or 'desc' (descending).* @param cursor Cursor to [specify a batch of results to request](https://docs.codacy.com/codacy-api/using-the-codacy-api/#using-pagination)* @param limit Maximum number of items to return   * @returns DirectoryListResponse List of folders in the repository
+   * @throws ApiError
+   */
+  static listDirectories(provider, remoteOrganizationName, repositoryName, branch, path12, sort, direction, cursor, limit = 100, abortSignal) {
+    return request(OpenAPI, {
+      method: "GET",
+      url: "/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/directories",
+      path: {
+        "provider": provider,
+        "remoteOrganizationName": remoteOrganizationName,
+        "repositoryName": repositoryName
+      },
+      query: {
+        "branch": branch,
+        "path": path12,
+        "sort": sort,
+        "direction": direction,
+        "cursor": cursor,
+        "limit": limit
+      },
+      abortSignal,
+      errors: {
+        400: `Bad Request`,
+        401: `Unauthorized`,
+        404: `Not Found`,
+        500: `Internal Server Error`
+      }
+    });
+  }
   /**
    * List ignored files in a repository
    * Returns the most recent ignored files information.
@@ -7267,6 +7899,9 @@ var RepositoryService = class {
   }
   /**
    * List the [repository API tokens](https://docs.codacy.com/codacy-api/api-tokens/)
+   * Each token reports its name, expiration and creation date. Tokens created before creation dates were
+   * recorded have no `createdAt`
+   *
    * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param repositoryName Repository name on the Git provider organization   * @returns ApiTokenListResponse Successful operation
    * @throws ApiError
    */
@@ -7291,10 +7926,10 @@ var RepositoryService = class {
   }
   /**
    * Create a new [repository API token](https://docs.codacy.com/codacy-api/api-tokens/)
-   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param repositoryName Repository name on the Git provider organization   * @returns ApiTokenResponse Successful operation
+   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param repositoryName Repository name on the Git provider organization* @param requestBody    * @returns ApiTokenResponse Successful operation
    * @throws ApiError
    */
-  static createRepositoryApiToken(provider, remoteOrganizationName, repositoryName, abortSignal) {
+  static createRepositoryApiToken(provider, remoteOrganizationName, repositoryName, requestBody, abortSignal) {
     return request(OpenAPI, {
       method: "POST",
       url: "/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/tokens",
@@ -7304,6 +7939,35 @@ var RepositoryService = class {
         "repositoryName": repositoryName
       },
       abortSignal,
+      body: requestBody,
+      mediaType: "application/json",
+      errors: {
+        400: `Bad Request`,
+        401: `Unauthorized`,
+        404: `Not Found`,
+        422: `Unprocessable Entity`,
+        500: `Internal Server Error`
+      }
+    });
+  }
+  /**
+   * Delete multiple [repository API tokens](https://docs.codacy.com/codacy-api/api-tokens/) by id
+   * Deletes the repository API tokens with the given ids
+   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param repositoryName Repository name on the Git provider organization* @param requestBody    * @returns void
+   * @throws ApiError
+   */
+  static deleteRepositoryApiTokens(provider, remoteOrganizationName, repositoryName, requestBody, abortSignal) {
+    return request(OpenAPI, {
+      method: "POST",
+      url: "/organizations/{provider}/{remoteOrganizationName}/repositories/{repositoryName}/tokens/delete",
+      path: {
+        "provider": provider,
+        "remoteOrganizationName": remoteOrganizationName,
+        "repositoryName": repositoryName
+      },
+      abortSignal,
+      body: requestBody,
+      mediaType: "application/json",
       errors: {
         400: `Bad Request`,
         401: `Unauthorized`,
@@ -7555,6 +8219,256 @@ var RepositoryService = class {
   }
 };
 
+// src/api/client/services/SbomService.ts
+var SbomService = class {
+  /**
+   * Return a list of SBOM dependencies, used across the organization.
+   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param cursor Cursor to [specify a batch of results to request](https://docs.codacy.com/codacy-api/using-the-codacy-api/#using-pagination)* @param limit Maximum number of items to return* @param sortColumn Field used to sort the results. The possible values are `severity` (default, to sort by the item's severity), or `order` (to sort by the OSSF order).* @param columnOrder Sort direction. The possible values are `asc` (ascending) or `desc` (descending - default).* @param requestBody Request body with filters.   * @returns SearchSbomDependenciesResponse Successful operation
+   * @throws ApiError
+   */
+  static searchSbomDependencies(provider, remoteOrganizationName, cursor, limit = 100, sortColumn = "severity", columnOrder = "desc", requestBody, abortSignal) {
+    return request(OpenAPI, {
+      method: "POST",
+      url: "/organizations/{provider}/{remoteOrganizationName}/sbom/dependencies/search",
+      path: {
+        "provider": provider,
+        "remoteOrganizationName": remoteOrganizationName
+      },
+      query: {
+        "cursor": cursor,
+        "limit": limit,
+        "sortColumn": sortColumn,
+        "columnOrder": columnOrder
+      },
+      abortSignal,
+      body: requestBody,
+      mediaType: "application/json",
+      errors: {
+        400: `Bad Request`,
+        401: `Unauthorized`,
+        403: `Forbidden`,
+        404: `Not Found`,
+        422: `Unprocessable Entity`,
+        500: `Internal Server Error`,
+        501: `Not Implemented`,
+        502: `Bad Gateway`
+      }
+    });
+  }
+  /**
+   * Return a paginated list of repositories where a version of the specified SBOM dependency is used.
+   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param requestBody Request body with filters.* @param cursor Cursor to [specify a batch of results to request](https://docs.codacy.com/codacy-api/using-the-codacy-api/#using-pagination)* @param limit Maximum number of items to return   * @returns SearchRepositoriesOfSbomDependencyResponse Successful operation
+   * @throws ApiError
+   */
+  static searchRepositoriesOfSbomDependency(provider, remoteOrganizationName, requestBody, cursor, limit = 100, abortSignal) {
+    return request(OpenAPI, {
+      method: "POST",
+      url: "/organizations/{provider}/{remoteOrganizationName}/sbom/dependencies/repositories/search",
+      path: {
+        "provider": provider,
+        "remoteOrganizationName": remoteOrganizationName
+      },
+      query: {
+        "cursor": cursor,
+        "limit": limit
+      },
+      abortSignal,
+      body: requestBody,
+      mediaType: "application/json",
+      errors: {
+        400: `Bad Request`,
+        401: `Unauthorized`,
+        403: `Forbidden`,
+        404: `Not Found`,
+        422: `Unprocessable Entity`,
+        500: `Internal Server Error`,
+        501: `Not Implemented`,
+        502: `Bad Gateway`
+      }
+    });
+  }
+  /**
+   * List repositories with SBOM dependency information
+   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param cursor Cursor to [specify a batch of results to request](https://docs.codacy.com/codacy-api/using-the-codacy-api/#using-pagination)* @param limit Maximum number of items to return* @param requestBody Request body with filters.   * @returns SearchSbomRepositoriesResponse Successful operation
+   * @throws ApiError
+   */
+  static searchSbomRepositories(provider, remoteOrganizationName, cursor, limit = 100, requestBody, abortSignal) {
+    return request(OpenAPI, {
+      method: "POST",
+      url: "/organizations/{provider}/{remoteOrganizationName}/sbom/repositories/search",
+      path: {
+        "provider": provider,
+        "remoteOrganizationName": remoteOrganizationName
+      },
+      query: {
+        "cursor": cursor,
+        "limit": limit
+      },
+      abortSignal,
+      body: requestBody,
+      mediaType: "application/json",
+      errors: {
+        400: `Bad Request`,
+        401: `Unauthorized`,
+        403: `Forbidden`,
+        404: `Not Found`,
+        422: `Unprocessable Entity`,
+        500: `Internal Server Error`,
+        501: `Not Implemented`,
+        502: `Bad Gateway`
+      }
+    });
+  }
+  /**
+   * Get a presigned URL for the latest SBOM of the repository
+   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param repositoryName Repository name on the Git provider organization   * @returns SbomPresignResponse Successful operation.
+   * @throws ApiError
+   */
+  static getRepositorySbomPresignedUrl(provider, remoteOrganizationName, repositoryName, abortSignal) {
+    return request(OpenAPI, {
+      method: "GET",
+      url: "/organizations/{provider}/{remoteOrganizationName}/projects/{repositoryName}/sbom",
+      path: {
+        "provider": provider,
+        "remoteOrganizationName": remoteOrganizationName,
+        "repositoryName": repositoryName
+      },
+      abortSignal,
+      errors: {
+        400: `Bad Request`,
+        401: `Unauthorized`,
+        404: `Not Found`,
+        500: `Internal Server Error`
+      }
+    });
+  }
+  /**
+   * Upload an SBOM for a Docker image
+   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param formData    * @returns void
+   * @throws ApiError
+   */
+  static uploadImageSbom(provider, remoteOrganizationName, formData, abortSignal) {
+    return request(OpenAPI, {
+      method: "POST",
+      url: "/organizations/{provider}/{remoteOrganizationName}/image-sboms",
+      path: {
+        "provider": provider,
+        "remoteOrganizationName": remoteOrganizationName
+      },
+      abortSignal,
+      formData,
+      mediaType: "multipart/form-data",
+      errors: {
+        400: `Bad Request`,
+        401: `Unauthorized`,
+        404: `Not Found`,
+        409: `Conflict`,
+        500: `Internal Server Error`
+      }
+    });
+  }
+  /**
+   * Delete all SBOMs for a given image
+   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param imageName Image name of the SBOM Image   * @returns void
+   * @throws ApiError
+   */
+  static deleteImageSboms(provider, remoteOrganizationName, imageName, abortSignal) {
+    return request(OpenAPI, {
+      method: "DELETE",
+      url: "/organizations/{provider}/{remoteOrganizationName}/image-sboms/{imageName}",
+      path: {
+        "provider": provider,
+        "remoteOrganizationName": remoteOrganizationName,
+        "imageName": imageName
+      },
+      abortSignal,
+      errors: {
+        400: `Bad Request`,
+        401: `Unauthorized`,
+        404: `Not Found`,
+        500: `Internal Server Error`
+      }
+    });
+  }
+  /**
+   * Delete SBOM for a given image/tag combination
+   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param imageName Image name of the SBOM Image* @param tag Image Tag of the SBOM Image   * @returns void
+   * @throws ApiError
+   */
+  static deleteImageTag(provider, remoteOrganizationName, imageName, tag, abortSignal) {
+    return request(OpenAPI, {
+      method: "DELETE",
+      url: "/organizations/{provider}/{remoteOrganizationName}/image-sboms/{imageName}/tags/{tag}",
+      path: {
+        "provider": provider,
+        "remoteOrganizationName": remoteOrganizationName,
+        "imageName": imageName,
+        "tag": tag
+      },
+      abortSignal,
+      errors: {
+        400: `Bad Request`,
+        401: `Unauthorized`,
+        404: `Not Found`,
+        500: `Internal Server Error`
+      }
+    });
+  }
+  /**
+   * List Docker images for an organization
+   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param cursor Cursor to [specify a batch of results to request](https://docs.codacy.com/codacy-api/using-the-codacy-api/#using-pagination)* @param limit Maximum number of items to return   * @returns ListImagesResponse Successful operation
+   * @throws ApiError
+   */
+  static listOrganizationImages(provider, remoteOrganizationName, cursor, limit = 100, abortSignal) {
+    return request(OpenAPI, {
+      method: "GET",
+      url: "/organizations/{provider}/{remoteOrganizationName}/images",
+      path: {
+        "provider": provider,
+        "remoteOrganizationName": remoteOrganizationName
+      },
+      query: {
+        "cursor": cursor,
+        "limit": limit
+      },
+      abortSignal,
+      errors: {
+        400: `Bad Request`,
+        401: `Unauthorized`,
+        404: `Not Found`,
+        500: `Internal Server Error`
+      }
+    });
+  }
+  /**
+   * List Docker image tags for an organization
+   * @param provider Git provider identifier (e.g., gh for GitHub, gl for GitLab, bb for Bitbucket)* @param remoteOrganizationName Organization name on the Git provider* @param imageName Image name of the SBOM Image* @param cursor Cursor to [specify a batch of results to request](https://docs.codacy.com/codacy-api/using-the-codacy-api/#using-pagination)* @param limit Maximum number of items to return   * @returns ListImageTagsResponse Successful operation
+   * @throws ApiError
+   */
+  static listImageTags(provider, remoteOrganizationName, imageName, cursor, limit = 100, abortSignal) {
+    return request(OpenAPI, {
+      method: "GET",
+      url: "/organizations/{provider}/{remoteOrganizationName}/images/{imageName}/tags",
+      path: {
+        "provider": provider,
+        "remoteOrganizationName": remoteOrganizationName,
+        "imageName": imageName
+      },
+      query: {
+        "cursor": cursor,
+        "limit": limit
+      },
+      abortSignal,
+      errors: {
+        400: `Bad Request`,
+        401: `Unauthorized`,
+        404: `Not Found`,
+        500: `Internal Server Error`
+      }
+    });
+  }
+};
+
 // src/api/client/services/ToolsService.ts
 var ToolsService = class {
   /**
@@ -7753,6 +8667,8 @@ async function listRepositoryToolPatterns(provider, org, repo, toolUuid) {
       void 0,
       // recommended
       void 0,
+      // matchesStack
+      void 0,
       // sort
       void 0,
       // direction
@@ -7790,6 +8706,20 @@ async function listIgnoredFiles(provider, org, repo) {
     capped: pages >= MAX_PAGES && cursor !== void 0
   };
 }
+async function uploadImageSbom(provider, organization, upload, signal) {
+  await SbomService.uploadImageSbom(
+    provider,
+    organization,
+    {
+      sbom: upload.sbom,
+      imageName: upload.imageName,
+      tag: upload.tag,
+      ...upload.repositoryName ? { repositoryName: upload.repositoryName } : {},
+      ...upload.environment ? { environment: upload.environment } : {}
+    },
+    signal
+  );
+}
 
 // src/init.ts
 function isAuthFailure(err) {
@@ -7827,6 +8757,13 @@ function buildAdapterByUuid(adapters, apiTools) {
   }
   return result;
 }
+function listRepoFilesOrEmpty(repositoryRoot, exclude) {
+  try {
+    return listRepoFiles(repositoryRoot, exclude);
+  } catch {
+    return [];
+  }
+}
 async function detectLanguages(repositoryRoot, precomputedFiles, exclude) {
   let files;
   if (precomputedFiles) {
@@ -7848,8 +8785,8 @@ async function detectLanguages(repositoryRoot, precomputedFiles, exclude) {
   }
   const detected = /* @__PURE__ */ new Set();
   for (const file of files) {
-    const basename = import_path8.default.basename(file);
-    const ext = import_path8.default.extname(file).toLowerCase();
+    const basename = import_path9.default.basename(file);
+    const ext = import_path9.default.extname(file).toLowerCase();
     for (const [lang, config] of Object.entries(import_tooling7.LANGUAGE_CONFIG)) {
       if (config.extensions.includes(ext)) {
         detected.add(lang);
@@ -7866,9 +8803,9 @@ async function detectLocalConfigFiles(repositoryRoot, adapters) {
     adapters.map(async (adapter) => {
       const result = await adapter.checkLocalConfigurationFile({
         repositoryRoot,
-        generatedConfigDir: import_path8.default.join(repositoryRoot, ".codacy", "generated"),
-        globalDir: import_path8.default.join(process.env.HOME ?? "~", ".codacy"),
-        toolInstallDir: import_path8.default.join(process.env.HOME ?? "~", ".codacy", "tools", adapter.id),
+        generatedConfigDir: import_path9.default.join(repositoryRoot, ".codacy", "generated"),
+        globalDir: import_path9.default.join(process.env.HOME ?? "~", ".codacy"),
+        toolInstallDir: import_path9.default.join(process.env.HOME ?? "~", ".codacy", "tools", adapter.id),
         targetFiles: [],
         platform: { os: process.platform, arch: process.arch },
         logger: createNullLogger(),
@@ -7894,7 +8831,7 @@ function enrichWithCodacyYaml(config, adapters, excludes) {
 async function initLocalConfigBase(repositoryRoot, adapters, excludes) {
   const languages = await detectLanguages(
     repositoryRoot,
-    listRepoFiles(repositoryRoot, excludes.global)
+    listRepoFilesOrEmpty(repositoryRoot, excludes.global)
   );
   const localConfigs = await detectLocalConfigFiles(repositoryRoot, adapters);
   const tools = [];
@@ -8078,60 +9015,11 @@ async function initRemoteConfig(repositoryRoot, provider, organization, reposito
     }
   };
 }
-async function initContainerConfig(repositoryRoot, adapters) {
-  const codacyrcPath = import_path8.default.join(repositoryRoot, ".codacyrc");
-  let raw;
-  try {
-    raw = await import_promises4.default.readFile(codacyrcPath, "utf-8");
-  } catch {
-    throw new Error(`.codacyrc not found at ${codacyrcPath}`);
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    try {
-      const decoded = Buffer.from(raw.trim(), "base64").toString("utf-8");
-      parsed = JSON.parse(decoded);
-    } catch {
-      throw new Error(`Failed to parse .codacyrc: not valid JSON or base64-encoded JSON`);
-    }
-  }
-  const includeFiles = Array.isArray(parsed.files) ? parsed.files.filter((f) => typeof f === "string") : [];
-  const adapterById = new Map(adapters.map((a) => [a.id, a]));
-  const tools = [];
-  if (Array.isArray(parsed.tools)) {
-    for (const toolEntry of parsed.tools) {
-      if (typeof toolEntry !== "object" || toolEntry === null) continue;
-      const entry = toolEntry;
-      const toolId = typeof entry["toolId"] === "string" ? entry["toolId"] : void 0;
-      if (!toolId || !adapterById.has(toolId)) continue;
-      const patterns = [];
-      if (Array.isArray(entry["patterns"])) {
-        for (const p of entry["patterns"]) {
-          if (typeof p === "object" && p !== null && typeof p["patternId"] === "string") {
-            const pe = p;
-            const rawParams = pe["parameters"];
-            let params;
-            if (rawParams && typeof rawParams === "object" && !Array.isArray(rawParams)) {
-              params = Object.fromEntries(
-                Object.entries(rawParams).map(([k, v]) => [
-                  k,
-                  String(v)
-                ])
-              );
-            }
-            patterns.push({
-              patternId: pe["patternId"],
-              ...params ? { parameters: params } : {}
-            });
-          }
-        }
-      }
-      tools.push({ toolId, patterns });
-    }
-  }
-  return createCodacyConfig({ source: "container", tools, includeFiles });
+async function initContainerConfig(repositoryRoot, adapters, codacyrcPath) {
+  const resolvedPath = codacyrcPath ?? import_path9.default.join(repositoryRoot, ".codacyrc");
+  const codacyrc = await readCodacyrc(resolvedPath);
+  const { config } = await resolveCodacyrc(codacyrc, { toolIds: adapters.map((a) => a.id) });
+  return config;
 }
 function hasMatchingFiles(files, filePatterns) {
   const matcher = new CompiledMatcher(filePatterns);
@@ -8152,7 +9040,7 @@ async function initAutoConfig(repositoryRoot, adapters, descriptors, filters, on
   for (const lib of discoveryResult.libraries) detectedKeys.add(lib.key);
   const repoLanguages = new Set(discoveryResult.languages);
   const localConfigs = await detectLocalConfigFiles(repositoryRoot, adapters);
-  const repoFiles = listRepoFiles(repositoryRoot, excludes.global);
+  const repoFiles = listRepoFilesOrEmpty(repositoryRoot, excludes.global);
   const descriptorMap = new Map(descriptors.map((d) => [d.id, d]));
   const perToolFiles = /* @__PURE__ */ new Map();
   const filesVisibleTo = (toolId) => {
@@ -8279,12 +9167,12 @@ async function applyAdapterConfigSuggestions(adapter, toolEntry, repositoryRoot,
     }
   };
   try {
-    const globalDir = import_path8.default.join(import_os3.default.homedir(), ".codacy");
+    const globalDir = import_path9.default.join(import_os3.default.homedir(), ".codacy");
     const ctx = {
       repositoryRoot,
-      generatedConfigDir: import_path8.default.join(repositoryRoot, ".codacy", "generated", adapter.id),
+      generatedConfigDir: import_path9.default.join(repositoryRoot, ".codacy", "generated", adapter.id),
       globalDir,
-      toolInstallDir: import_path8.default.join(globalDir, "tools", adapter.id),
+      toolInstallDir: import_path9.default.join(globalDir, "tools", adapter.id),
       targetFiles: routeFilesToTool(repoFiles, adapter, toolEntry),
       platform: { os: process.platform, arch: process.arch },
       logger,
@@ -8545,15 +9433,15 @@ function parseAutoFilters(raw) {
 }
 
 // src/index.ts
-var import_tooling8 = require("@codacy/tooling");
+var import_tooling9 = require("@codacy/tooling");
 
 // src/credentials.ts
 var import_crypto = __toESM(require("crypto"));
 var import_promises5 = __toESM(require("fs/promises"));
 var import_os4 = __toESM(require("os"));
-var import_path9 = __toESM(require("path"));
+var import_path10 = __toESM(require("path"));
 function credentialsPath() {
-  return import_path9.default.join(import_os4.default.homedir(), ".codacy", "credentials");
+  return import_path10.default.join(import_os4.default.homedir(), ".codacy", "credentials");
 }
 function deriveKey(salt) {
   const info = import_os4.default.userInfo();
@@ -8574,7 +9462,7 @@ async function saveCredentials(token) {
     authTag: authTag.toString("hex"),
     encrypted: encrypted.toString("hex")
   });
-  await import_promises5.default.mkdir(import_path9.default.dirname(credentialsFile), { recursive: true });
+  await import_promises5.default.mkdir(import_path10.default.dirname(credentialsFile), { recursive: true });
   await import_promises5.default.writeFile(credentialsFile, payload, { encoding: "utf-8", mode: 384 });
 }
 async function loadCredentials() {
@@ -8875,11 +9763,287 @@ async function safeReadBody(res) {
     return "";
   }
 }
+
+// src/container-image.ts
+var import_promises7 = __toESM(require("fs/promises"));
+var import_os5 = __toESM(require("os"));
+var import_path11 = __toESM(require("path"));
+var import_tooling8 = require("@codacy/tooling");
+var DEFAULT_IMAGE_SCAN_SEVERITIES = ["HIGH", "CRITICAL"];
+var DEFAULT_IMAGE_SCAN_PKG_TYPES = ["os"];
+var SBOM_UPLOAD_TIMEOUT_MS = 5 * 60 * 1e3;
+var PROVIDERS = ["gh", "gl", "bb"];
+async function scanContainerImage(options) {
+  const startedAt = /* @__PURE__ */ new Date();
+  (0, import_tooling8.validateImageReference)(options.image);
+  const severities = parseVocabulary(
+    options.severities ?? DEFAULT_IMAGE_SCAN_SEVERITIES,
+    import_tooling8.IMAGE_SCAN_SEVERITIES,
+    "severity",
+    (v) => v.toUpperCase()
+  );
+  const pkgTypes = parseVocabulary(
+    options.pkgTypes ?? DEFAULT_IMAGE_SCAN_PKG_TYPES,
+    import_tooling8.IMAGE_SCAN_PKG_TYPES,
+    "package type",
+    (v) => v.toLowerCase()
+  );
+  if (options.signal?.aborted) {
+    return imageResult(startedAt, emptyCapability(), [], [cancelledError("before it started")], []);
+  }
+  const logger = options.logger ?? createNullLogger();
+  const adapter = await resolveImageAdapter();
+  const baseCtx = makeBaseContext(logger, options.signal);
+  const prepared = await prepareTool(adapter, baseCtx, logger);
+  if (!prepared.ok) {
+    return imageResult(startedAt, prepared.capability, [], [prepared.error], []);
+  }
+  if (options.signal?.aborted) {
+    return imageResult(startedAt, prepared.capability, [], [cancelledError("before the scan")], []);
+  }
+  const run = await adapter.containerImage.scan(makeToolContext(baseCtx, adapter, []), {
+    image: options.image,
+    severities,
+    pkgTypes,
+    ignoreUnfixed: options.ignoreUnfixed ?? true
+  });
+  const lookup = /* @__PURE__ */ new Map();
+  for (const entry of adapter.patternsMetadata ?? []) {
+    lookup.set(`${adapter.id}|${entry.id}`, {
+      title: entry.title,
+      toolDisplayName: adapter.displayName
+    });
+  }
+  const patternSummary = run.issues.length > 0 ? computePatternSummary(run.issues, lookup) : void 0;
+  return imageResult(
+    startedAt,
+    prepared.capability,
+    run.issues,
+    run.errors,
+    [run.summary],
+    patternSummary
+  );
+}
+async function uploadImageSbom2(options) {
+  const target = (0, import_tooling8.resolveImageTarget)(options.image, options.tag);
+  const format = parseSbomFormat(options.format);
+  if (!PROVIDERS.includes(options.provider)) {
+    throw new Error(
+      `Invalid provider "${options.provider}": expected one of ${PROVIDERS.join(", ")}`
+    );
+  }
+  assertValidCoordinate("organization", options.organization);
+  if (options.repositoryName) assertValidCoordinate("repository", options.repositoryName);
+  if (!options.apiToken) {
+    throw new Error("An account API token is required to upload an SBOM.");
+  }
+  throwIfCancelled(options.signal, "before it started");
+  const logger = options.logger ?? createNullLogger();
+  const progress = options.onProgress ?? (() => {
+  });
+  const adapter = await resolveImageAdapter();
+  const baseCtx = makeBaseContext(logger, options.signal);
+  const prepared = await prepareTool(adapter, baseCtx, logger);
+  if (!prepared.ok) {
+    throw new Error(`Could not install ${adapter.displayName}: ${prepared.error.message}`);
+  }
+  throwIfCancelled(options.signal, "before SBOM generation");
+  const tempDir = await import_promises7.default.mkdtemp(import_path11.default.join(import_os5.default.tmpdir(), "codacy-sbom-"));
+  try {
+    const outputPath = import_path11.default.join(
+      tempDir,
+      format === "cyclonedx" ? "sbom.cdx.json" : "sbom.spdx.json"
+    );
+    progress(`Generating SBOM for image: ${target.scanRef}`);
+    const generated = await adapter.containerImage.generateSbom(
+      makeToolContext(baseCtx, adapter, []),
+      { image: target.scanRef, format, outputPath }
+    );
+    if (!generated.success) {
+      throw new Error(`Failed to generate SBOM: ${generated.error?.message ?? "unknown error"}`);
+    }
+    const contents = await import_promises7.default.readFile(outputPath);
+    const sbom = new File([contents], import_path11.default.basename(outputPath), { type: "application/json" });
+    throwIfCancelled(options.signal, "before the upload");
+    progress(`Uploading SBOM to Codacy (org: ${options.provider}/${options.organization})...`);
+    configureApiToken({ kind: "account-token", token: options.apiToken });
+    const timeout = AbortSignal.timeout(SBOM_UPLOAD_TIMEOUT_MS);
+    try {
+      await uploadImageSbom(
+        options.provider,
+        options.organization,
+        {
+          sbom,
+          imageName: target.name,
+          tag: target.tag,
+          repositoryName: options.repositoryName,
+          environment: options.environment
+        },
+        options.signal ? AbortSignal.any([options.signal, timeout]) : timeout
+      );
+    } catch (err) {
+      throw new Error(`Failed to upload SBOM: ${describeUploadError(err)}`);
+    }
+    return { imageName: target.name, tag: target.tag, format };
+  } finally {
+    await import_promises7.default.rm(tempDir, { recursive: true, force: true });
+  }
+}
+function parseVocabulary(values, allowed, label, normalize) {
+  const parsed = values.flatMap((v) => v.split(",")).map((v) => normalize(v.trim())).filter((v) => v.length > 0);
+  if (parsed.length === 0) {
+    throw new Error(`At least one ${label} is required (accepted: ${allowed.join(", ")})`);
+  }
+  for (const value of parsed) {
+    if (!allowed.includes(value)) {
+      throw new Error(`Invalid ${label} "${value}": expected one of ${allowed.join(", ")}`);
+    }
+  }
+  return [...new Set(parsed)];
+}
+function parseSbomFormat(format) {
+  const value = format ?? import_tooling8.SBOM_FORMATS[0];
+  if (!import_tooling8.SBOM_FORMATS.includes(value)) {
+    throw new Error(`Invalid format "${value}": expected one of ${import_tooling8.SBOM_FORMATS.join(", ")}`);
+  }
+  return value;
+}
+async function resolveImageAdapter() {
+  const descriptor = getRegisteredDescriptors().find(
+    (d) => d.scansContainerImages && !d.unsupported
+  );
+  const adapter = descriptor ? await getAdapter(descriptor.id) : void 0;
+  if (!adapter?.containerImage) {
+    throw new Error(
+      "No registered tool can scan container images. Call registerBuiltinAdapters() first."
+    );
+  }
+  return adapter;
+}
+function makeBaseContext(logger, signal) {
+  return {
+    repositoryRoot: process.cwd(),
+    globalDir: import_path11.default.join(import_os5.default.homedir(), ".codacy"),
+    platform: { os: import_os5.default.platform(), arch: import_os5.default.arch() },
+    logger,
+    runner: "local",
+    ...signal ? { signal } : {}
+  };
+}
+async function prepareTool(adapter, baseCtx, logger) {
+  const ctx = makeToolContext(baseCtx, adapter, []);
+  const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const availability = await adapter.checkAvailability(ctx);
+  if (availability.available) {
+    const status = {
+      toolId: adapter.id,
+      displayName: adapter.displayName,
+      version: availability.version ?? adapter.preferredVersion,
+      installation: availability.installation ?? "global",
+      runner: "local"
+    };
+    const capability = { ready: [status], unavailable: [], checkedAt };
+    await updateStaleManagedTools(capability, [adapter], baseCtx, logger);
+    return { ok: true, capability };
+  }
+  const outcome = await installMissingTool(adapter, ctx, logger);
+  if (outcome.kind === "installed") {
+    return {
+      ok: true,
+      capability: {
+        ready: [
+          {
+            toolId: adapter.id,
+            displayName: adapter.displayName,
+            version: outcome.version,
+            installation: outcome.installation,
+            runner: "local"
+          }
+        ],
+        unavailable: [],
+        checkedAt
+      }
+    };
+  }
+  const error = outcome.kind === "failed" ? outcome.error : {
+    toolId: adapter.id,
+    phase: "toolInstall",
+    kind: "NotInstalled",
+    message: `${adapter.displayName} is not installed and cannot be installed automatically: ${availability.reason ?? "not found"}`,
+    level: "error"
+  };
+  return {
+    ok: false,
+    error,
+    capability: {
+      ready: [],
+      unavailable: [
+        {
+          toolId: adapter.id,
+          displayName: adapter.displayName,
+          reason: error.message,
+          ...availability.installHint ? { remediation: availability.installHint } : {}
+        }
+      ],
+      checkedAt
+    }
+  };
+}
+function emptyCapability() {
+  return { ready: [], unavailable: [], checkedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function cancelledError(when) {
+  return {
+    toolId: "",
+    phase: "toolInvoke",
+    kind: "Cancelled",
+    message: `Container image scan cancelled by caller ${when}`,
+    level: "error"
+  };
+}
+function throwIfCancelled(signal, when) {
+  if (signal?.aborted) throw new Error(`SBOM upload cancelled by caller ${when}`);
+}
+function imageResult(startedAt, capability, issues, errors, toolResults, patternSummary) {
+  const completedAt = /* @__PURE__ */ new Date();
+  return {
+    metadata: {
+      startedAt: startedAt.toISOString(),
+      completedAt: completedAt.toISOString(),
+      durationMs: completedAt.getTime() - startedAt.getTime(),
+      repositoryRoot: process.cwd(),
+      executionMode: "auto-install"
+    },
+    capability,
+    issues,
+    errors,
+    toolResults,
+    ...patternSummary ? { patternSummary } : {}
+  };
+}
+function describeUploadError(err) {
+  if (err instanceof Error && err.name === "AbortError") {
+    return "cancelled by caller";
+  }
+  if (err instanceof Error && err.name === "TimeoutError") {
+    return `timed out after ${SBOM_UPLOAD_TIMEOUT_MS / 6e4} minutes`;
+  }
+  const apiError = err;
+  if (typeof apiError?.status === "number") {
+    const body = typeof apiError.body === "string" ? apiError.body : JSON.stringify(apiError.body ?? "");
+    return `API returned status ${apiError.status}${body && body !== '""' ? `: ${body.slice(0, 500)}` : ""}`;
+  }
+  return err instanceof Error ? err.message : String(err);
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  DEFAULT_IMAGE_SCAN_PKG_TYPES,
+  DEFAULT_IMAGE_SCAN_SEVERITIES,
   analyze,
   applyCodacyYamlExcludes,
   applyConfigOperation,
+  buildCodacyrc,
+  buildPatternTranslator,
   buildPayloads,
   buildToolConfig,
   clearAdapters,
@@ -8912,17 +10076,22 @@ async function safeReadBody(res) {
   loadCredentials,
   mergeConfigs,
   parseAutoFilters,
+  parseCodacyrc,
   parseReport,
+  partitionContainerErrors,
   pruneEmptyTools,
   readBaselineConfig,
   readCodacyConfig,
   readCodacyYaml,
+  readCodacyrc,
   registerAdapter,
   registerLazyAdapter,
   registerUnsupportedTool,
+  registryLookup,
   relativizeLocalConfigPaths,
   resolveApiToken,
   resolveBaselinePath,
+  resolveCodacyrc,
   resolveConfigPath,
   resolveDiscoveryExcludes,
   resolveEngineToAdapter,
@@ -8932,9 +10101,14 @@ async function safeReadBody(res) {
   resolveRemoteAuth,
   resolveRepositoryRoot,
   resolveResultsApiBaseUrl,
+  resolveToolName,
   rotateLogFiles,
   saveCredentials,
+  scanContainerImage,
+  serializeCodacyrc,
+  toEnginePatternId,
   updateConfigIncremental,
+  uploadImageSbom,
   uploadReport,
   validateApiToken,
   writeBaselineConfig,