@databuddy/scan 0.1.0 → 0.1.1

package/dist/cli.js

@@ -32,6 +32,17 @@ __export(exports_actions, {
 });
 import { posix } from "node:path";
 import ts2 from "typescript";
+function writesOverFetch(call, owner) {
+  const init = call.arguments[1];
+  if (!(init && ts2.isObjectLiteralExpression(init))) {
+    return false;
+  }
+  const method = init.properties.find((property) => ts2.isPropertyAssignment(property) && property.name.getText(owner.file) === "method");
+  if (!(method && ts2.isPropertyAssignment(method))) {
+    return false;
+  }
+  return !(ts2.isStringLiteralLike(method.initializer) && readMethod.test(method.initializer.text));
+}
 function walk2(node, visit) {
   visit(node);
   ts2.forEachChild(node, (child) => walk2(child, visit));
@@ -90,6 +101,47 @@ function lookup(unit, name, at) {
     }
   }
 }
+function routeTable(sources) {
+  let table = routeTables.get(sources);
+  if (!table) {
+    table = [];
+    for (const path of sources.keys()) {
+      const app = appRoute.exec(path);
+      const pages = app ? null : pagesRoute.exec(path);
+      const route = app?.[1] ?? pages?.[1];
+      if (route) {
+        table.push({
+          path,
+          export: app ? "method" : "default",
+          parts: route.split("/").filter((part) => !routeGroup.test(part))
+        });
+      }
+    }
+    routeTables.set(sources, table);
+  }
+  return table;
+}
+function urlParts(input) {
+  const node = unwrap(input);
+  const text = ts2.isStringLiteralLike(node) ? node.text : ts2.isTemplateExpression(node) ? node.head.text + node.templateSpans.map((span) => `\x00${span.literal.text}`).join("") : undefined;
+  const pathname = text?.split(queryOrHash)[0];
+  if (!pathname?.startsWith("/")) {
+    return;
+  }
+  return pathname.split("/").filter(Boolean).map((part) => part.includes("\x00") ? null : part);
+}
+function routeMatches(route, url) {
+  for (const [index, part] of route.entries()) {
+    if (part.startsWith("[...") || part.startsWith("[[...")) {
+      return url.length > index || part.startsWith("[[");
+    }
+    const piece = url[index];
+    if (piece === undefined || !(part.startsWith("[") || piece === part)) {
+      return false;
+    }
+  }
+  return route.length === url.length;
+}
 function groupActions(path, source, sources) {
   const units = new Map;
   function parse(key, text) {
@@ -311,6 +363,33 @@ function groupActions(path, source, sources) {
       return routineCall.test(name) || ts2.isIdentifier(call.expression) && routine(call.expression, owner, new Set(visited));
     });
   }
+  function describe(initializer, labels) {
+    const expression = initializer && ts2.isJsxExpression(initializer) && initializer.expression ? unwrap(initializer.expression) : undefined;
+    if (expression && ts2.isIdentifier(expression) && !genericHandler.test(expression.text)) {
+      return ` ${expression.text}`;
+    }
+    const text = labels.join(" ").replace(entity, (match) => entities[match] ?? match).replace(whitespaceRun, " ").trim();
+    return text ? ` "${text.slice(0, 40)}"` : "";
+  }
+  function routeHandler(call, owner, issues) {
+    const url = call.arguments[0] && urlParts(call.arguments[0]);
+    if (!url) {
+      return;
+    }
+    const dynamic = (parts) => parts.filter((part) => part.startsWith("[")).length;
+    const matches = routeTable(sources).filter((route) => routeMatches(route.parts, url)).sort((a, b) => dynamic(a.parts) - dynamic(b.parts));
+    const route = matches.length === 1 || matches[0] && matches[1] && dynamic(matches[0].parts) < dynamic(matches[1].parts) ? matches[0] : undefined;
+    if (!route) {
+      return;
+    }
+    const init = call.arguments[1];
+    const method = init && ts2.isObjectLiteralExpression(init) ? init.properties.find((property) => ts2.isPropertyAssignment(property) && property.name.getText(owner.file) === "method")?.initializer : undefined;
+    const target = parse(route.path, sources.get(route.path) ?? "");
+    if (!target) {
+      return;
+    }
+    return exported(target, route.export === "default" ? "default" : method && ts2.isStringLiteralLike(method) ? method.text.toUpperCase() : "GET", issues);
+  }
   const roots = [];
   walk2(unit.file, (node) => {
     if (ts2.isJsxOpeningElement(node) || ts2.isJsxSelfClosingElement(node)) {
@@ -321,20 +400,26 @@ function groupActions(path, source, sources) {
         return;
       }
       const attributes = node.attributes.properties.filter(ts2.isJsxAttribute);
-      const events = attributes.filter((attribute) => handlers.has(attribute.name.getText(unit.file)) && attribute.initializer && ts2.isJsxExpression(attribute.initializer) && attribute.initializer.expression && ![ts2.SyntaxKind.NullKeyword, ts2.SyntaxKind.FalseKeyword].includes(attribute.initializer.expression.kind));
+      const events = attributes.filter((attribute) => handlers.has(attribute.name.getText(unit.file)) && attribute.initializer && ts2.isJsxExpression(attribute.initializer) && attribute.initializer.expression && ![ts2.SyntaxKind.NullKeyword, ts2.SyntaxKind.FalseKeyword].includes(attribute.initializer.expression.kind) && (!formAttributes.has(attribute.name.getText(unit.file)) || ts2.isIdentifier(unwrap(attribute.initializer.expression)) || isFunction(unwrap(attribute.initializer.expression))));
       const labels = [];
+      const buttonText = (part) => ts2.isJsxElement(part) && part.openingElement.tagName.getText(unit.file).toLowerCase().endsWith("button") ? part : ts2.forEachChild(part, buttonText);
       const visible = (part) => {
         if (ts2.isJsxAttribute(part)) {
           return;
         }
-        if (ts2.isJsxText(part) || ts2.isStringLiteralLike(part)) {
+        if ((ts2.isJsxText(part) || ts2.isStringLiteralLike(part) && !ts2.isBinaryExpression(part.parent)) && !pending.test(part.text)) {
           labels.push(part.text);
         }
         ts2.forEachChild(part, visible);
       };
       if (ts2.isJsxElement(whole)) {
-        for (const child of whole.children) {
-          visible(child);
+        const button = component.toLowerCase() === "form" ? whole.children.map(buttonText).find(Boolean) : undefined;
+        if (button) {
+          visible(button);
+        } else if (component.toLowerCase() !== "form") {
+          for (const child of whole.children) {
+            visible(child);
+          }
         }
       }
       for (const attribute of attributes) {
@@ -355,7 +440,7 @@ function groupActions(path, source, sources) {
         node: active[0] ?? whole,
         owner: whole,
         callbacks: active.map((attribute) => attribute.initializer.expression).filter((expression) => !!expression),
-        label: `${tag}.${active[0]?.name.getText(unit.file) ?? (component === "CopyButton" ? "copy" : "intent")}`,
+        label: `${tag}.${active[0]?.name.getText(unit.file) ?? (component === "CopyButton" ? "copy" : "intent")}${describe(active[0]?.initializer, labels)}`,
         ...component === "CopyButton" ? { component: tag } : {}
       });
     }
@@ -385,6 +470,15 @@ function groupActions(path, source, sources) {
         label: node.name.text
       });
     }
+    if (ts2.isFunctionDeclaration(node) && node.name && node.body && httpMethods.has(node.name.text) && ts2.getModifiers(node)?.some((modifier) => modifier.kind === ts2.SyntaxKind.ExportKeyword)) {
+      roots.push({
+        node,
+        owner: node,
+        callbacks: [node],
+        label: node.name.text,
+        needsWrite: !writeMethods.has(node.name.text)
+      });
+    }
     if (ts2.isPropertyAssignment(node) && afterHook.test(node.name.getText(unit.file)) && functionValue(node.initializer)) {
       for (let ancestor = node.parent;ancestor; ancestor = ancestor.parent) {
         if (ts2.isPropertyAssignment(ancestor) && hookContainer.test(ancestor.name.getText(unit.file))) {
@@ -399,8 +493,8 @@ function groupActions(path, source, sources) {
       }
     }
   });
-  return roots.map((root) => {
-    const issues = new Set, sites = new Map, contexts = new Map;
+  return roots.flatMap((root) => {
+    const issues = new Set, sites = new Map, contexts = new Map, excerpts = [];
     let characters = 0;
     const addSite = (owner, node) => {
       const location = site(owner, node);
@@ -418,6 +512,7 @@ ${text}`;
         return;
       }
       contexts.set(key, framed);
+      excerpts.push(location);
       characters += framed.length + 2;
     };
     addSite(unit, root.node);
@@ -445,6 +540,7 @@ ${text}`;
       }
     }
     const visited = new Set;
+    let commits = false;
     function evidence(owner, node, depth) {
       if (visited.has(node)) {
         return;
@@ -458,20 +554,11 @@ ${text}`;
         const callee = child.expression;
         if (ts2.isPropertyAccessExpression(callee)) {
           const method = callee.name.text;
-          if ([
-            "mutate",
-            "mutateAsync",
-            "writeText",
-            "write",
-            "setItem",
-            "removeItem",
-            "insert",
-            "update",
-            "delete",
-            "track",
-            "capture",
-            "logEvent"
-          ].includes(method)) {
+          const write = writes.has(method) && callee.expression.getText(owner.file) !== "Object";
+          if (write || httpWrites.has(method)) {
+            commits = true;
+          }
+          if (write || ["track", "capture", "logEvent"].includes(method)) {
             addSite(owner, child);
           }
           if (["mutate", "mutateAsync"].includes(method) && ts2.isIdentifier(callee.expression)) {
@@ -490,6 +577,16 @@ ${text}`;
         if (trackingCall2.test(callee.text)) {
           addSite(owner, child);
         }
+        if (callee.text === "fetch") {
+          if (writesOverFetch(child, owner)) {
+            commits = true;
+          }
+          const handler = routeHandler(child, owner, issues);
+          if (handler && depth < 2) {
+            addSite(handler.unit, handler.node);
+            evidence(handler.unit, handler.node, depth + 1);
+          }
+        }
         const resolved = resolve(owner, callee.text, child, issues);
         if (resolved?.unit.stateSetters.has(resolved.node)) {
           return;
@@ -515,20 +612,43 @@ ${text}`;
         }
       });
     }
-    for (const callback of root.callbacks) {
-      const expression = unwrap(callback);
-      if (ts2.isIdentifier(expression)) {
-        const resolved = resolve(unit, expression.text, expression, issues);
-        if (resolved && !ts2.isParameter(resolved.node)) {
-          evidence(resolved.unit, resolved.node, 0);
-        } else {
-          issues.add(`unresolved_callback:${expression.text}`);
+    function follow(owner, input) {
+      const expression = unwrap(input);
+      if (isFunction(expression)) {
+        evidence(owner, expression, 0);
+        return;
+      }
+      if (ts2.isConditionalExpression(expression)) {
+        follow(owner, expression.whenTrue);
+        follow(owner, expression.whenFalse);
+        return;
+      }
+      if (ts2.isCallExpression(expression)) {
+        const handlers = expression.arguments.filter((argument) => isFunction(unwrap(argument)) || ts2.isIdentifier(unwrap(argument)));
+        for (const argument of handlers) {
+          follow(owner, argument);
+        }
+        if (handlers.length) {
+          return;
         }
-      } else if (isFunction(expression)) {
-        evidence(unit, expression, 0);
-      } else {
-        issues.add(`unresolved_callback:${expression.getText(unit.file)}`);
       }
+      const resolved = ts2.isIdentifier(expression) ? resolve(owner, expression.text, expression, issues) : undefined;
+      if (!resolved || ts2.isParameter(resolved.node)) {
+        issues.add(`unresolved_callback:${expression.getText(owner.file)}`);
+        return;
+      }
+      const holder = resolved.node.parent?.parent;
+      const hook = ts2.isBindingElement(resolved.node) && holder && ts2.isVariableDeclaration(holder) && holder.initializer ? unwrap(holder.initializer) : undefined;
+      if (hook && ts2.isCallExpression(hook) && formHook.test(hook.expression.getText(resolved.unit.file)) && hook.arguments[0] && !visited.has(hook)) {
+        visited.add(hook);
+        addContext(resolved.unit, declaration(holder));
+        follow(resolved.unit, hook.arguments[0]);
+        return;
+      }
+      evidence(resolved.unit, resolved.node, 0);
+    }
+    for (const callback of root.callbacks) {
+      follow(unit, callback);
     }
     if (root.component) {
       const resolved = resolve(unit, root.component, root.node, issues);
@@ -552,24 +672,58 @@ ${text}`;
         }
       }
     }
+    if ((selection.test(root.label) || root.needsWrite) && !commits) {
+      return [];
+    }
     const location = site(unit, root.node);
-    return {
-      start: location.start,
-      end: location.end,
-      label: root.label,
-      source: [...contexts.values()].join(`
+    return [
+      {
+        start: location.start,
+        end: location.end,
+        label: root.label,
+        source: [...contexts.values()].join(`
 
 `),
-      sites: [...sites.values()],
-      issues: [...issues]
-    };
+        sites: [...sites.values()],
+        issues: [...issues],
+        excerpts
+      }
+    ];
   });
 }
-var extension, intent, handlers, routeMethods, httpMethods, contextLimit = 16000, jsxExtension, jsExtension, importExtension, routineCall, afterHook, hookContainer, trackingCall2;
+var extension, intent, selection, handlers, writes, httpWrites, readMethod, routeMethods, httpMethods, writeMethods, contextLimit = 16000, jsxExtension, jsExtension, importExtension, routineCall, afterHook, hookContainer, trackingCall2, whitespaceRun, pending, formAttributes, formHook, appRoute, pagesRoute, routeGroup, queryOrHash, genericHandler, entities, entity, routeTables;
 var init_actions = __esm(() => {
   extension = /\.[cm]?[jt]sx?$/i;
   intent = /\b(?:copy|export|download|connect|install|upgrade|checkout|subscribe|sign up|register|start trial|accept invitation)\b/i;
-  handlers = new Set(["onClick", "onSubmit", "onCopy"]);
+  selection = /\.on(?:ValueChange|CheckedChange|Select)$/;
+  handlers = new Set([
+    "onClick",
+    "onSubmit",
+    "onCopy",
+    "action",
+    "formAction",
+    "onValueChange",
+    "onCheckedChange",
+    "onSelect"
+  ]);
+  writes = new Set([
+    "mutate",
+    "mutateAsync",
+    "writeText",
+    "write",
+    "setItem",
+    "removeItem",
+    "insert",
+    "update",
+    "delete",
+    "create",
+    "upsert",
+    "createMany",
+    "updateMany",
+    "deleteMany"
+  ]);
+  httpWrites = new Set(["post", "put", "patch"]);
+  readMethod = /^(?:get|head|options)$/i;
   routeMethods = new Set([
     "post",
     "put",
@@ -579,6 +733,7 @@ var init_actions = __esm(() => {
     "handler"
   ]);
   httpMethods = new Set(["POST", "PUT", "PATCH", "DELETE", "GET"]);
+  writeMethods = new Set(["POST", "PUT", "PATCH", "DELETE"]);
   jsxExtension = /x$/i;
   jsExtension = /\.[cm]?js$/i;
   importExtension = /\.[cm]?jsx?$/i;
@@ -586,22 +741,43 @@ var init_actions = __esm(() => {
   afterHook = /^after[A-Z]/;
   hookContainer = /^(?:hooks|organizationHooks|databaseHooks)$/;
   trackingCall2 = /^(?:track|capture|logEvent)/;
+  whitespaceRun = /\s+/g;
+  pending = /(?:\.\.\.|\u2026)\s*$/;
+  formAttributes = new Set(["action", "formAction"]);
+  formHook = /^(?:React\.)?use(?:ActionState|FormState)$/;
+  appRoute = /(?:^|\/)app\/(.+)\/route\.[cm]?[jt]sx?$/;
+  pagesRoute = /(?:^|\/)pages\/(api\/.+?)(?:\/index)?\.[cm]?[jt]sx?$/;
+  routeGroup = /^\(.*\)$/;
+  queryOrHash = /[?#]/;
+  genericHandler = /^(?:on(?:Click|Submit|Select|Change)|handle(?:Click|Submit|Change)|submit|handler|callback|formAction)$/;
+  entities = {
+    "&apos;": "'",
+    "&#39;": "'",
+    "&quot;": '"',
+    "&amp;": "&",
+    "&lt;": "<",
+    "&gt;": ">",
+    "&nbsp;": " "
+  };
+  entity = /&(?:apos|#39|quot|amp|lt|gt|nbsp);/g;
+  routeTables = new WeakMap;
 });
 
 // src/cli.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { realpath as realpath2 } from "node:fs/promises";
+import { realpath as realpath2, stat } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join as join3, resolve } from "node:path";
+import { dirname, join as join3, relative, resolve } from "node:path";
 import { Command, CommanderError, Option } from "commander";
 import { z as z3 } from "zod";
 // package.json
-var version = "0.1.0";
+var version = "0.1.1";
 
 // src/scan.ts
 import { execFileSync } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import {
+  access,
   lstat,
   mkdir,
   open,
@@ -917,6 +1093,24 @@ var rowSchema = z.object({
   categoryProbability: probability.nullable(),
   action: actionSchema.optional()
 });
+var catalogEntries = z.array(z.string().max(600)).max(400);
+var scanRequestSchema = z.object({
+  segments: z.array(z.object({
+    path: z.string().min(1).max(512),
+    start: z.number().int().positive(),
+    end: z.number().int().positive(),
+    source: z.string().max(40000),
+    action: actionSchema.optional()
+  })).min(1).max(4),
+  catalog: z.object({
+    attributeTracking: catalogEntries,
+    directTrackingCandidates: catalogEntries,
+    note: z.string().max(4000),
+    trackedRoutes: catalogEntries,
+    trackingHelpers: catalogEntries,
+    warehouseWrites: catalogEntries
+  })
+});
 var responseSchema = z.object({ answers: z.record(z.string(), z.unknown()) });
 var numeric = z.union([z.number(), z.string().trim().min(1)]).pipe(z.coerce.number().nonnegative());
 var usageSchema = z.object({ inputTokens: numeric.catch(0), outputTokens: numeric.catch(0) }).catch({ inputTokens: 0, outputTokens: 0 });
@@ -1057,8 +1251,29 @@ function retryDelay(value, attempt, timeoutMs) {
   const duration = Number.isFinite(Number(value)) ? Number(value) * 1000 : Date.parse(value) - Date.now();
   return Number.isFinite(duration) ? Math.min(Math.max(0, duration), 60000) : 0;
 }
+var gatewayUrl = "https://ai-gateway.vercel.sh/v4/ai/evaluation-model";
+var hostedScanUrl = process.env.DATABUDDY_SCAN_URL ?? "https://api.databuddy.cc/public/v1/scan/evaluate";
 async function requestEvaluation(body, options) {
-  for (let attempt = 1;attempt <= maxAttempts; attempt++) {
+  const attempts = options.attempts ?? maxAttempts;
+  const direct = Boolean(options.apiKey);
+  const { state } = direct ? { state: null } : JSON.parse(body);
+  const payload = direct ? body : JSON.stringify({ segments: state.segments, catalog: state.catalog });
+  const headers = direct ? {
+    Authorization: `Bearer ${options.apiKey}`,
+    "Content-Type": "application/json",
+    "ai-gateway-protocol-version": "0.0.1",
+    "ai-gateway-auth-method": "api-key",
+    "ai-evaluation-model-specification-version": "4",
+    "ai-model-id": "typesafe-ai/jev"
+  } : {
+    "Content-Type": "application/json",
+    "x-databuddy-scan-version": version,
+    ...options.run ? {
+      "x-databuddy-scan-run": options.run.id,
+      "x-databuddy-scan-mode": options.run.mode
+    } : {}
+  };
+  for (let attempt = 1;attempt <= attempts; attempt++) {
     options.signal.throwIfAborted();
     const started = performance.now();
     const timeout = AbortSignal.timeout(options.timeoutMs);
@@ -1066,17 +1281,10 @@ async function requestEvaluation(body, options) {
     let providerCode;
     let requestId = "";
     try {
-      response = await fetch("https://ai-gateway.vercel.sh/v4/ai/evaluation-model", {
+      response = await fetch(direct ? gatewayUrl : hostedScanUrl, {
         method: "POST",
-        body,
-        headers: {
-          Authorization: `Bearer ${options.apiKey}`,
-          "Content-Type": "application/json",
-          "ai-gateway-protocol-version": "0.0.1",
-          "ai-gateway-auth-method": "api-key",
-          "ai-evaluation-model-specification-version": "4",
-          "ai-model-id": "typesafe-ai/jev"
-        },
+        body: payload,
+        headers,
         signal: AbortSignal.any([timeout, options.signal])
       });
       requestId = safeRequestId.parse(response.headers.get("x-vercel-id") ?? response.headers.get("x-request-id"));
@@ -1108,7 +1316,7 @@ async function requestEvaluation(body, options) {
         ...providerCode ? { providerCode } : {},
         ...requestId ? { requestId } : {}
       });
-      if (options.signal.aborted || attempt === maxAttempts || !(response && response.status >= 500 || name === "TimeoutError")) {
+      if (options.signal.aborted || attempt === attempts || !(response && response.status >= 500 || name === "TimeoutError")) {
         throw failure;
       }
       const waitMs = retryDelay(response?.headers.get("retry-after") ?? null, attempt, options.timeoutMs);
@@ -1129,12 +1337,12 @@ async function requestEvaluation(body, options) {
 var scanOptionsSchema = z2.object({
   root: z2.string().trim().min(1).default("."),
   output: z2.string().trim().min(1).optional(),
-  run: z2.boolean().default(false),
+  dryRun: z2.boolean().default(false),
   fresh: z2.boolean().default(false),
   cacheOnly: z2.boolean().default(false),
   actions: z2.boolean().default(true),
   concurrency: z2.coerce.number().int().positive().default(8),
-  batchFiles: z2.coerce.number().int().positive().default(4)
+  batchFiles: z2.coerce.number().int().positive().max(4).default(2)
 });
 var timeoutMs = 15000;
 var maxRequestBytes = 48000;
@@ -1154,52 +1362,49 @@ var callSchema = z2.object({
   cached: z2.boolean(),
   split: z2.boolean(),
   ms: z2.number(),
-  inputTokens: z2.number(),
-  costUsd: z2.number().nullable(),
   attempts: z2.array(attemptSchema),
   error: z2.string().optional()
 });
 var resultSchema = z2.object({
   summary: z2.object({
     root: z2.string(),
+    scope: z2.string(),
     head: z2.string().nullable(),
     model: z2.string(),
     runId: z2.string(),
     finishedAt: z2.string(),
-    sourceHash: z2.string(),
-    cacheOnly: z2.boolean(),
+    destination: z2.object({
+      host: z2.string(),
+      kind: z2.enum(["databuddy", "gateway"])
+    }),
+    zeroDataRetention: z2.literal(true),
     interrupted: z2.boolean(),
     includedFiles: z2.number(),
     skippedFiles: z2.number(),
     classifiedFiles: z2.number(),
-    segments: z2.number(),
-    classifiedSegments: z2.number(),
     batches: z2.number(),
-    oversizedBatches: z2.number(),
-    splitBatches: z2.number(),
-    completedBatches: z2.number(),
     unattemptedBatches: z2.number(),
     failures: z2.number(),
     cachedBatches: z2.number(),
     requestAttempts: z2.number(),
     retries: z2.number(),
-    wallSeconds: z2.number(),
-    currentRunReportedCostUsd: z2.number(),
-    unknownFailedCallCosts: z2.number(),
-    missingCostReports: z2.number()
+    wallSeconds: z2.number()
   }),
-  rows: z2.array(rowSchema),
-  calls: z2.array(callSchema)
+  rows: z2.array(rowSchema)
 });
 var hash = (value) => createHash("sha256").update(value).digest("hex");
 var excluded = /(?:^|\/)(?:tests?|__tests__|fixtures?|__fixtures__|__mocks__|examples?|playground|node_modules|dist|\.next|\.agents|\.codex|vendor)(?:\/|$)|\.(?:test|spec|stories|generated|d)\.[^.]+$/i;
 var sourceFile = /\.(?:[cm]?[jt]sx?|vue|swift|py|sh|sql|html|css)$/;
+var repositoryKey = /^[ \t]*(?:export[ \t]+)?AI_GATEWAY_API_KEY[ \t]*=[ \t]*(.*?)[ \t]*$/m;
+var quoted = /^(["'])(.*)\1$/;
+var routeHandlerLabel = /^(?:GET|POST|PUT|PATCH|DELETE)$/;
+var reviewable = /\.(?:[cm]?[jt]sx?|vue|swift|py)$/;
 var sourceLineBoundary = /(?<=\n)/;
 var secret = /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|(?:sk_live_|sk-proj-|ghp_|github_pat_)[A-Za-z0-9_-]{20,}/;
 var trackingCall3 = /\b((?:[\w$]+\.)?(?:track[A-Z]\w*|track|capture|logEvent))\s*\(/;
 var closers = { "(": ")", "[": "]", "{": "}" };
 var trailingSeparator = /[\s,]+$/;
-var whitespaceRun = /\s+/g;
+var whitespaceRun2 = /\s+/g;
 function firstArgument(text) {
   const open = [];
   let argument = "";
@@ -1219,11 +1424,12 @@ function firstArgument(text) {
       break;
     }
   }
-  return argument.trim().replace(whitespaceRun, " ").replace(trailingSeparator, "") + open.reverse().map((character) => closers[character]).join("");
+  return argument.trim().replace(whitespaceRun2, " ").replace(trailingSeparator, "") + open.reverse().map((character) => closers[character]).join("");
 }
 var safeError = /^(?:Gateway HTTP [0-9]{3}|No matching cached response; network disabled)$/;
 var shedError = /^(?:Gateway HTTP 5[0-9]{2}|Gateway request timed out)$/;
 var splitDepth = 2;
+var keyHelp = "Check the key, or unset it to use Databuddy's scan API.";
 var catalogByteLimit = 24000;
 async function readJSON(path) {
   try {
@@ -1281,9 +1487,9 @@ function planRequests(segments, catalog, batchFiles) {
   }
   return batches.map((jobs) => ({ body: build(jobs), jobs }));
 }
-async function readSources(root) {
+async function readSources(root, scope = "") {
   const inventory = [], sources = new Map, tracking = new Set;
-  for (const path of execFileSync("git", ["ls-files", "-z"], {
+  for (const path of execFileSync("git", ["ls-files", "-z", ...scope ? ["--", `:(literal)${scope}`] : []], {
     cwd: root,
     encoding: "utf8",
     maxBuffer: 64 * 1024 * 1024
@@ -1361,9 +1567,28 @@ async function readSources(root) {
   };
   return { inventory, sources, catalog };
 }
-async function scan(options, onProgress) {
-  const { root, output, cacheOnly, fresh, concurrency, batchFiles } = options;
-  const run = options.run || fresh || cacheOnly;
+function sentFiles(segments, excerpts) {
+  const files = new Map;
+  for (const segment of segments) {
+    for (const { path, start, end } of excerpts.get(segment) ?? [segment]) {
+      files.set(path, [...files.get(path) ?? [], [start, end]]);
+    }
+  }
+  return [...files].sort(([left], [right]) => left.localeCompare(right)).map(([path, ranges]) => {
+    const lines = [];
+    for (const [start, end] of ranges.sort((a, b) => a[0] - b[0])) {
+      const last = lines.at(-1);
+      if (last && start <= last[1] + 1) {
+        last[1] = Math.max(last[1], end);
+      } else {
+        lines.push([start, end]);
+      }
+    }
+    return { path, lines };
+  });
+}
+async function scan(options, onProgress, announce) {
+  const { root, scope, output, cacheOnly, fresh, concurrency, batchFiles } = options;
   const git = (...args) => execFileSync("git", args, {
     cwd: root,
     encoding: "utf8",
@@ -1377,24 +1602,37 @@ async function scan(options, onProgress) {
   try {
     head = git("rev-parse", "--verify", "HEAD").trim();
   } catch {}
-  const { inventory, sources, catalog } = await readSources(root);
+  const { inventory, sources, catalog } = await readSources(root, scope);
   const { groupActions } = options.actions ? await Promise.resolve().then(() => (init_actions(), exports_actions)) : { groupActions: null };
   const segments = [];
+  const excerpts = new Map;
   const noActionFiles = [];
   for (const [path, source] of sources) {
     const actions = groupActions?.(path, source, sources);
     if (actions?.length) {
-      for (const { start, end, source: context, ...action } of actions) {
-        segments.push({ path, start, end, source: context, action });
-      }
-    } else if (actions) {
+      for (const {
+        start,
+        end,
+        source: context,
+        excerpts: lines,
+        ...action
+      } of actions) {
+        const segment = { path, start, end, source: context, action };
+        segments.push(segment);
+        excerpts.set(segment, lines);
+      }
+    } else if (actions || !reviewable.test(path)) {
       noActionFiles.push(path);
     } else {
       segments.push(...splitSource(path, source));
     }
   }
+  const linkedRoutes = new Set(segments.flatMap((segment) => (segment.action?.sites ?? []).filter((site) => site.path !== segment.path).map((site) => `${site.path}:${site.start}`)));
+  const linked = (segment) => routeHandlerLabel.test(segment.action?.label ?? "") && linkedRoutes.has(`${segment.path}:${segment.start}`);
+  for (const segment of segments.filter(linked)) {
+    segments.splice(segments.indexOf(segment), 1);
+  }
   const includedFiles = new Set(segments.map((s) => s.path)).size;
-  const sourceHash = hash(JSON.stringify(inventory.filter((f) => f.status === "included").map((f) => [f.path, f.sha256])));
   if (!cacheOnly) {
     await mkdir(join(output, "responses"), { recursive: true, mode: 448 });
     await saveJSON(join(output, "inventory.json"), {
@@ -1405,26 +1643,30 @@ async function scan(options, onProgress) {
       catalog
     });
   }
-  if (!run) {
-    return { includedFiles, skippedFiles: noActionFiles.length };
+  const apiKey = process.env.AI_GATEWAY_API_KEY?.trim() || repositoryKey.exec(await readFile(join(root, ".env"), "utf8").catch(() => ""))?.[1]?.trim().replace(quoted, "$2") || undefined;
+  const destination = apiKey ? { host: "ai-gateway.vercel.sh", kind: "gateway" } : { host: new URL(hostedScanUrl).host, kind: "databuddy" };
+  if (options.dryRun) {
+    return {
+      dryRun: true,
+      destination,
+      files: sentFiles(segments, excerpts),
+      skippedFiles: noActionFiles.length,
+      payload: { catalog, segments }
+    };
   }
   const batches = planRequests(segments, catalog, batchFiles);
-  if (!(cacheOnly || process.env.AI_GATEWAY_API_KEY)) {
-    try {
-      process.loadEnvFile(join(root, ".env"));
-    } catch (error) {
-      if (!(error instanceof Error && ("code" in error) && error.code === "ENOENT")) {
-        throw new Error("Could not load the repository .env.");
-      }
-    }
-  }
-  const apiKey = process.env.AI_GATEWAY_API_KEY;
-  if (!(cacheOnly || apiKey)) {
-    throw new Error("Set AI_GATEWAY_API_KEY in the repository .env to run Jev.");
+  const cacheFile = (body, kind = "json") => join(output, "responses", `${hash(body)}.${kind}`);
+  const exists = (path) => access(path).then(() => true, () => false);
+  if (!cacheOnly) {
+    const pending = await Promise.all(batches.map(async ({ body, jobs }) => fresh || !(await exists(cacheFile(body)) || await exists(cacheFile(body, "split"))) ? jobs : []));
+    announce({
+      destination,
+      files: sentFiles(pending.flat(), excerpts).length
+    });
   }
   const started = performance.now(), runId = randomUUID(), controller = new AbortController, limit = pLimit(concurrency);
   const rows = [], calls = [];
-  let plannedBatches = batches.length, interrupted = false, logFailure;
+  let plannedBatches = batches.length, interrupted = false, logFailed = false;
   const logFile = cacheOnly ? null : await open(join(output, "progress.ndjson"), "a", 384);
   let writes = Promise.resolve();
   const log = (type, fields = {}) => {
@@ -1436,7 +1678,7 @@ async function scan(options, onProgress) {
 `);
     });
     writes.catch((error) => {
-      logFailure = error;
+      logFailed = true;
       controller.abort(error);
     });
   };
@@ -1449,8 +1691,7 @@ async function scan(options, onProgress) {
     retries: calls.reduce((n, c) => n + Math.max(0, c.attempts.length - 1), 0),
     failures: calls.filter((c) => c.error && !c.split).length,
     elapsedSeconds: (performance.now() - started) / 1000,
-    rows,
-    cacheOnly
+    rows
   });
   const cancel = () => {
     if (!interrupted) {
@@ -1466,8 +1707,8 @@ async function scan(options, onProgress) {
     log("start", {
       pid: process.pid,
       root,
+      scope,
       head,
-      sourceHash,
       concurrency,
       timeoutMs,
       includedFiles,
@@ -1478,7 +1719,7 @@ async function scan(options, onProgress) {
       if (controller.signal.aborted) {
         return;
       }
-      const cacheKey = hash(body), cacheFile = join(output, "responses", `${cacheKey}.json`), at = performance.now();
+      const cacheKey = hash(body), at = performance.now();
       const attempts = [], call = {
         batch: index,
         depth,
@@ -1487,8 +1728,6 @@ async function scan(options, onProgress) {
         cached: false,
         split: false,
         ms: 0,
-        inputTokens: 0,
-        costUsd: null,
         attempts
       };
       let response = null;
@@ -1502,7 +1741,7 @@ async function scan(options, onProgress) {
       try {
         if (!fresh) {
           try {
-            response = await readJSON(cacheFile);
+            response = await readJSON(cacheFile(body));
             if (response !== null) {
               parseResponse(response, jobs);
               call.cached = true;
@@ -1514,13 +1753,18 @@ async function scan(options, onProgress) {
             log("cache_invalid", { batch: index, cacheKey });
           }
         }
-        if (!call.cached) {
+        const splittable = jobs.length > 1 && depth < splitDepth;
+        if (!(call.cached || fresh) && splittable && await exists(cacheFile(body, "split"))) {
+          call.split = true;
+        } else if (!call.cached) {
           response = null;
           if (cacheOnly) {
             throw new Error("No matching cached response; network disabled");
           }
           response = await requestEvaluation(body, {
-            apiKey: apiKey ?? "",
+            apiKey,
+            attempts: splittable ? 2 : undefined,
+            run: { id: runId, mode: options.actions ? "actions" : "files" },
             timeoutMs,
             signal: controller.signal,
             onAttempt: (attempt) => {
@@ -1530,20 +1774,17 @@ async function scan(options, onProgress) {
             onRetry: (retry) => log("retry", { batch: index, ...retry })
           });
         }
-        const parsed = parseResponse(response, jobs);
-        call.inputTokens = parsed.inputTokens;
-        call.costUsd = parsed.costUsd;
-        if (!call.cached) {
-          await saveJSON(cacheFile, response);
+        if (!call.split) {
+          const parsed = parseResponse(response, jobs);
+          if (!call.cached) {
+            await saveJSON(cacheFile(body), response);
+          }
+          rows.push(...parsed.rows);
         }
-        rows.push(...parsed.rows);
       } catch (error) {
-        const usage = readUsage(response);
-        call.inputTokens = usage.inputTokens;
-        call.costUsd = usage.costUsd;
         call.error = interrupted ? "Interrupted by user" : error instanceof z2.ZodError ? "Invalid model response" : error instanceof Error && safeError.test(error.message) ? error.message : error instanceof Error && error.name === "TimeoutError" ? "Gateway request timed out" : error instanceof Error && ("code" in error) ? `Scan failed (${String(error.code)})` : "Scan failed";
         call.split = !(cacheOnly || controller.signal.aborted) && jobs.length > 1 && depth < splitDepth && shedError.test(call.error);
-        if (attempts.some((a) => a.status === 401 || a.status === 403) || logFailure) {
+        if (attempts.some((a) => a.status === 401 || a.status === 403) || logFailed) {
           controller.abort();
         }
       } finally {
@@ -1561,6 +1802,9 @@ async function scan(options, onProgress) {
         update();
       }
       if (call.split) {
+        if (!cacheOnly) {
+          await writeFile(cacheFile(body, "split"), "", { mode: 384 });
+        }
         const half = Math.ceil(jobs.length / 2);
         const halves = [jobs.slice(0, half), jobs.slice(half)];
         plannedBatches += halves.length - 1;
@@ -1575,39 +1819,50 @@ async function scan(options, onProgress) {
       throw rejected.reason;
     }
     await writes;
-    if (logFailure) {
+    if (logFailed) {
       throw new Error("Could not write scan diagnostics.");
     }
-    rows.sort((a, b) => b.priority - a.priority || a.path.localeCompare(b.path) || a.start - b.start);
+    const statuses = calls.flatMap((c) => c.attempts).map((a) => a.status);
+    const failures = calls.filter((c) => c.error && !c.split).length;
+    const denied = statuses.find((status) => status === 401 || status === 403);
+    if (apiKey && denied) {
+      throw new Error(`Vercel AI Gateway rejected AI_GATEWAY_API_KEY (HTTP ${denied}). ${keyHelp}`);
+    }
+    if (!apiKey && failures && statuses.includes(429)) {
+      throw new Error("Databuddy's scan API rate limit was reached. Try again later, or set AI_GATEWAY_API_KEY to use your own Vercel AI Gateway key.");
+    }
+    rows.sort((a, b) => Number(a.category === "none") - Number(b.category === "none") || b.priority - a.priority || a.path.localeCompare(b.path) || a.start - b.start);
     const summary = {
       root,
+      scope,
       head,
       model: "typesafe-ai/jev",
       runId,
       finishedAt: new Date().toISOString(),
-      sourceHash,
-      cacheOnly,
+      destination,
+      zeroDataRetention: true,
       interrupted,
       includedFiles,
       skippedFiles: noActionFiles.length,
       classifiedFiles: new Set(rows.map((r) => r.path)).size,
-      segments: segments.length,
-      classifiedSegments: rows.length,
       batches: plannedBatches,
-      oversizedBatches: calls.filter((c) => c.requestBytes > maxRequestBytes).length,
-      splitBatches: calls.filter((c) => c.split).length,
-      completedBatches: calls.filter((c) => !c.split).length,
       unattemptedBatches: plannedBatches - calls.filter((c) => !c.split).length,
-      failures: calls.filter((c) => c.error && !c.split).length,
+      failures,
       cachedBatches: calls.filter((c) => c.cached).length,
       requestAttempts: calls.reduce((n, c) => n + c.attempts.length, 0),
       retries: calls.reduce((n, c) => n + Math.max(0, c.attempts.length - 1), 0),
-      wallSeconds: Math.round((performance.now() - started) / 100) / 10,
-      currentRunReportedCostUsd: calls.reduce((n, c) => n + (c.cached ? 0 : c.costUsd ?? 0), 0),
-      unknownFailedCallCosts: calls.flatMap((c) => c.attempts).filter((a) => a.error).length,
-      missingCostReports: calls.filter((c) => c.costUsd === null && (c.cached || c.attempts.some((a) => a.status === 200 && !a.error))).length
+      wallSeconds: Math.round((performance.now() - started) / 100) / 10
+    };
+    const round = (value) => value === null ? null : Math.round(value * 100) / 100;
+    const result = {
+      summary,
+      rows: rows.map((row) => ({
+        ...row,
+        priority: round(row.priority) ?? 0,
+        coverageProbability: round(row.coverageProbability),
+        categoryProbability: round(row.categoryProbability)
+      }))
     };
-    const result = { summary, rows, calls };
     if (!cacheOnly) {
       await saveJSON(join(output, "results.json"), result);
     }
@@ -1640,10 +1895,10 @@ var areas = {
   acquisition: "Acquisition",
   none: "Other actions"
 };
+var privacy = `Code is sent to Databuddy's scan API (${new URL(hostedScanUrl).host}), which classifies it with the Jev model (typesafe-ai/jev) on Vercel AI Gateway under zero data retention: your source is never stored or logged. For JavaScript and TypeScript only the actions it finds and the functions they call are sent, not whole files; --dry-run lists every line without sending anything. Set AI_GATEWAY_API_KEY to send it to your own Vercel AI Gateway account instead, and Databuddy receives nothing. Privacy policy: https://www.databuddy.cc/privacy`;
 var controls = /[\x00-\x1f\x7f-\x9f\u202a-\u202e\u2066-\u2069]/g;
 var clean = (value) => stripVTControlCharacters(String(value ?? "")).replace(controls, "");
-var disputed = (row) => row.category === "none" ? 1 : 0;
-var gaps = (rows) => rows.filter((row) => row.coverage === "missing" || row.coverage === "partial").sort((a, b) => disputed(a) - disputed(b) || b.priority - a.priority);
+var gaps = (rows) => rows.filter((row) => row.coverage === "missing" || row.coverage === "partial");
 function uniqueFiles(rows) {
   const found = new Map;
   for (const row of rows) {
@@ -1655,13 +1910,9 @@ function uniqueFiles(rows) {
 }
 var elapsed = (seconds) => seconds < 60 ? `${Math.round(seconds)}s` : `${Math.floor(seconds / 60)}m ${Math.floor(seconds % 60)}s`;
 var location = (row, root = "") => `${clean(root ? join2(root, row.path) : row.path)}:${row.start}`;
-function createTerminal({
-  json = false,
-  plain = false,
-  verbose = false
-} = {}) {
-  const interactive = process.stderr.isTTY && process.env.TERM !== "dumb" && !plain && !json;
-  const noColor = plain || json || Object.hasOwn(process.env, "NO_COLOR") || process.env.TERM === "dumb";
+function createTerminal({ json = false } = {}) {
+  const interactive = process.stderr.isTTY && process.env.TERM !== "dumb" && !json;
+  const noColor = json || Object.hasOwn(process.env, "NO_COLOR") || process.env.TERM === "dumb";
   const monochrome = new Chalk({ level: 0 });
   const output = noColor ? monochrome : chalk;
   const progress = noColor ? monochrome : chalkStderr;
@@ -1669,7 +1920,7 @@ function createTerminal({
   const print = (lines) => process.stdout.write(`${lines.join(`
 `)}
 `);
-  const title = (suffix = "") => `  ${output.bold("databuddy.")} ${output.dim(`/ event scan${suffix}`)}`;
+  const title = `  ${output.bold("databuddy.")} ${output.dim("/ event scan")}`;
   let rendered = false;
   function stop() {
     if (rendered) {
@@ -1685,149 +1936,93 @@ function createTerminal({
     const found = uniqueFiles(gaps(snapshot.rows));
     const fraction = snapshot.batches ? Math.min(1, snapshot.completedBatches / snapshot.batches) : 0;
     const filled = Math.round(fraction * 28);
-    const lines = [
-      `  ${progress.bold("databuddy.")} ${progress.dim("/ event scan")}`,
+    rendered = true;
+    live([
+      title,
       "",
-      `  ${snapshot.cacheOnly ? "Reading saved responses" : "Scanning your code"}`,
       `  ${progress.hex("#e3a514")("━".repeat(filled))}${progress.dim("─".repeat(28 - filled))} ${Math.round(fraction * 100)}%`,
       `  ${snapshot.classifiedFiles} / ${snapshot.includedFiles} files · ${elapsed(snapshot.elapsedSeconds)}`,
       "",
       progress.hex("#e3a514")(`  ${found.length} files to review`),
       ...found.slice(0, 3).map((row) => `  ${location(row)} · ${areas[row.category]}`)
-    ];
-    if (verbose) {
-      lines.push(`  ${snapshot.active} active · ${snapshot.retries} retries · ${snapshot.failures} failed`);
-    }
-    rendered = true;
-    live(lines.join(`
+    ].join(`
 `));
   }
-  function finish(result, options = {}) {
+  function announce({
+    destination,
+    files
+  }) {
+    process.stderr.write(files === 0 ? `Nothing to send: every result is cached from an earlier scan.
+` : destination.kind === "databuddy" ? `Sending code from ${files} files to Databuddy's scan API (${destination.host}). Jev classifies it on Vercel AI Gateway with zero data retention; your source is never stored or logged. Preview with --dry-run, or set AI_GATEWAY_API_KEY to use your own gateway. https://www.databuddy.cc/privacy
+` : `Sending code from ${files} files directly to your Vercel AI Gateway account (${destination.host}) with zero data retention. Databuddy receives nothing.
+`);
+  }
+  function dryRun(result) {
+    if (json) {
+      return print([
+        JSON.stringify({ ...result, sent: false, zeroDataRetention: true })
+      ]);
+    }
+    const width = Math.max(0, ...result.files.map((file) => file.path.length));
+    if (result.files.length === 0) {
+      return print([
+        "",
+        title,
+        "",
+        `  Nothing to send: none of the ${result.skippedFiles} files here has a user action to review. Scan a wider folder.`,
+        ""
+      ]);
+    }
+    print([
+      "",
+      title,
+      "",
+      `  Would send these lines from ${result.files.length} ${result.files.length === 1 ? "file" : "files"} to ${result.destination.host}. Nothing was sent.`,
+      "",
+      ...result.files.map((file) => `  ${clean(file.path).padEnd(width)}  ${file.lines.map(([start, end]) => start === end ? start : `${start}-${end}`).join(", ")}`),
+      "",
+      `  ${result.skippedFiles} files have nothing to review and are not sent. --dry-run --json prints the exact payload.`,
+      ""
+    ]);
+  }
+  function finish(result) {
     stop();
     if (json) {
       return print([JSON.stringify(result)]);
     }
     const { summary: s, rows } = result;
-    const flagged = gaps(rows), found = uniqueFiles(flagged);
-    const uncertain = rows.filter((row) => row.coverage === "uncertain");
-    const incomplete = s.failures > 0 || s.unattemptedBatches > 0 || s.classifiedFiles < s.includedFiles;
-    let status = incomplete ? "Scan incomplete" : "Scan complete";
-    if (s.interrupted) {
-      status = "Stopped";
-    }
-    const suffix = options.saved || s.cacheOnly ? " · saved results" : "";
+    const flagged = gaps(rows);
+    const visible = interactive ? flagged.slice(0, 10) : flagged;
     const lines = [
       "",
-      title(suffix),
+      title,
       "",
-      `  ${output.hex("#e3a514")(status)} · ${s.classifiedFiles} / ${s.includedFiles} files · ${incomplete ? `${s.classifiedSegments} / ${s.segments} segments · ` : ""}${s.skippedFiles ? `${s.skippedFiles} skipped · ` : ""}${elapsed(s.wallSeconds)}`,
+      `  ${s.interrupted ? "Stopped" : "Scan complete"} · ${flagged.length} findings in ${uniqueFiles(flagged).length} files · ${elapsed(s.wallSeconds)}`,
       "",
-      output.hex("#e3a514")(`  ${found.length} files to review`)
+      ...visible.map((row) => `  ${location(row)} · ${row.action ? `${clean(row.action.label)} · ` : ""}${row.coverage} · ${areas[row.category]}`)
     ];
-    if (flagged.length) {
-      lines.push("  Potential gaps · review the source");
-    }
-    const visible = verbose ? flagged : found.slice(0, 3);
-    for (const row of visible) {
-      lines.push(`  ${location(row, verbose ? s.root : "")} · ${row.action ? `${clean(row.action.label)} · ` : ""}${row.coverage} · ${areas[row.category]}`);
-    }
-    if (!verbose && flagged.length > visible.length) {
-      lines.push("  All locations: databuddy-scan --report --verbose");
+    if (flagged.length > visible.length) {
+      lines.push(`  ${flagged.length - visible.length} more · databuddy-scan --json lists every finding`);
     }
-    if (uncertain.length) {
-      lines.push(`  ${uniqueFiles(uncertain).length} files have uncertain segments`);
-      if (verbose) {
-        lines.push(...uncertain.map((row) => `  ${location(row, s.root)} · ${row.action ? `${clean(row.action.label)} · ` : ""}needs context`));
-      }
-    }
-    if (incomplete || s.interrupted) {
-      lines.push("", "  Progress saved. Continue: databuddy-scan --run", "  Diagnose: databuddy-scan --diagnostics");
-    }
-    if (verbose) {
-      for (const call of result.calls.filter((call) => call.error).slice(0, 3)) {
-        lines.push(`  Batch ${call.batch + 1}: ${clean(call.error)}`);
-      }
-      if (options.directory) {
-        lines.push(`  Reports: ${clean(options.directory)}`);
-      }
+    if (s.failures || s.unattemptedBatches || s.interrupted) {
+      lines.push("", `  ${s.failures + s.unattemptedBatches} batches did not finish. Run again to retry them; finished work is kept.`);
     }
     print([...lines, ""]);
   }
-  function diagnostics(result, directory) {
-    stop();
-    const s = result.summary;
-    const attempts = result.calls.flatMap((call) => call.attempts);
-    const statuses = new Map;
-    for (const attempt of attempts) {
-      const status = attempt.providerCode ?? attempt.error ?? String(attempt.status);
-      statuses.set(status, (statuses.get(status) ?? 0) + 1);
-    }
-    const latency = attempts.map((attempt) => attempt.ms).filter(Number.isFinite).sort((a, b) => a - b);
-    const percentile = (fraction) => latency[Math.ceil(latency.length * fraction) - 1] ?? null;
-    const data = {
-      files: `${s.classifiedFiles}/${s.includedFiles}`,
-      requests: attempts.length,
-      retries: s.retries,
-      cachedBatches: s.cachedBatches,
-      failedBatches: s.failures,
-      unattemptedBatches: s.unattemptedBatches,
-      statuses: Object.fromEntries(statuses),
-      latencyMs: { p50: percentile(0.5), p95: percentile(0.95) },
-      batchLatencyMs: (() => {
-        const spent = result.calls.map((call) => call.ms).sort((a, b) => a - b);
-        return {
-          p50: spent[Math.ceil(spent.length * 0.5) - 1] ?? null,
-          p95: spent[Math.ceil(spent.length * 0.95) - 1] ?? null
-        };
-      })(),
-      skippedFiles: s.skippedFiles,
-      oversizedBatches: s.oversizedBatches,
-      splitBatches: s.splitBatches,
-      reviewFiles: uniqueFiles(gaps(result.rows)).length,
-      uncertainSegments: result.rows.filter((row) => row.coverage === "uncertain").length,
-      reportedCostUsd: s.currentRunReportedCostUsd,
-      unknownFailedCallCosts: s.unknownFailedCallCosts,
-      missingCostReports: s.missingCostReports
-    };
-    if (json) {
-      return print([JSON.stringify(data)]);
-    }
-    const statusCounts = [...statuses].map(([status, count]) => `${clean(status)}: ${count}`).join(", ");
-    print([
-      "",
-      title(" · diagnostics"),
-      "",
-      `  ${data.files} files · ${data.failedBatches} failed batches · ${data.unattemptedBatches} unattempted`,
-      `  ${data.skippedFiles} files skipped with no detected action · listed in inventory.json`,
-      `  ${data.requests} requests · ${data.retries} retries · ${statusCounts}`,
-      `  ${data.splitBatches} batches split after a failure · ${data.oversizedBatches} single segments over the request limit`,
-      `  Request latency: median ${data.latencyMs.p50 ?? "—"} ms · p95 ${data.latencyMs.p95 ?? "—"} ms`,
-      `  Batch latency, retries included: median ${data.batchLatencyMs.p50 ?? "—"} ms · p95 ${data.batchLatencyMs.p95 ?? "—"} ms`,
-      `  ${data.cachedBatches} cached responses · no new requests for cached results`,
-      `  $${data.reportedCostUsd.toFixed(3)} reported this run · ${data.unknownFailedCallCosts} failed request costs unknown · ${data.missingCostReports} responses missing cost`,
-      `  ${data.reviewFiles} files flagged · ${data.uncertainSegments} uncertain segments`,
-      `  Request log: ${clean(join2(directory, "progress.ndjson"))}`,
-      ""
-    ]);
-  }
   return {
     update,
+    announce,
+    dryRun,
     finish,
-    diagnostics,
     stop,
-    inventory(info) {
-      print(json ? [JSON.stringify(info)] : [
-        "",
-        title(),
-        "",
-        `  ${info.includedFiles} files with product actions ready to scan${info.skippedFiles ? ` · ${info.skippedFiles} with none detected` : ""}. Start: databuddy-scan --run`,
-        ""
-      ]);
-    },
     error(message) {
       stop();
-      const text = json ? JSON.stringify({ error: clean(message) }) : `Error: ${clean(message)}`;
-      process.stderr.write(`${text}
+      if (json) {
+        process.stdout.write(`${JSON.stringify({ error: clean(message) })}
+`);
+        return;
+      }
+      process.stderr.write(`Error: ${clean(message)}
 `);
     }
   };
@@ -1835,67 +2030,40 @@ function createTerminal({
 
 // src/cli.ts
 var optionsSchema = scanOptionsSchema.extend({
-  report: z3.boolean().default(false),
-  diagnostics: z3.boolean().default(false),
-  plain: z3.boolean().default(false),
-  json: z3.boolean().default(false),
-  verbose: z3.boolean().default(false)
+  json: z3.boolean().default(false)
 });
-var command = new Command().name("databuddy-scan").description(`Find product analytics gaps in your Git repository.
-Preview offline, or use --run to send source to Jev through Vercel AI Gateway.`).version(version).option("--run", "Scan or resume").option("--actions", "Group product actions with their evidence (default)").option("--no-actions", "Review whole files instead: slower, and weaker at spotting existing coverage").addOption(new Option("--fresh", "Scan without reusing responses").conflicts("cacheOnly")).option("--cache-only", "Replay matching responses without network or writes").addOption(new Option("--report", "Show saved findings").conflicts([
-  "run",
-  "fresh",
-  "cacheOnly",
-  "diagnostics"
-])).addOption(new Option("--diagnostics", "Explain request failures and output quality").conflicts(["run", "fresh", "cacheOnly"])).option("--root <path>", "Repository to scan (default: current repository)").option("--output <path>", "Results directory (default: per-repository user cache)").option("--concurrency <count>", "Concurrent requests (default: 8)").option("--batch-files <count>", "Maximum segments per request (default: 4)").option("--verbose", "Show every source location and request details").option("--plain", "Disable terminal control codes").option("--json", "Write JSON without progress output").addHelpText("after", `
-Examples:
-  npx @databuddy/scan --run
-  bunx @databuddy/scan --report --verbose
+var command = new Command().name("databuddy-scan").description(`Find where your product is missing analytics events.
 
-Requires AI_GATEWAY_API_KEY for new requests. Zero data retention is requested.
-Ctrl+C saves completed work; repeat --run to resume.`).exitOverride();
+${privacy}
+
+Results are cached in ~/.cache/databuddy/scan, so unchanged code is not sent again.`).version(version).argument("[path]", "directory or file to scan; nothing outside it is read", ".").option("--dry-run", "list the files that would be sent, and send nothing").option("--json", "print results as JSON").addOption(new Option("--output <path>").hideHelp()).addOption(new Option("--concurrency <count>").hideHelp()).addOption(new Option("--batch-files <count>").hideHelp()).addOption(new Option("--cache-only").hideHelp()).addOption(new Option("--fresh").conflicts("cacheOnly").hideHelp()).addOption(new Option("--no-actions").hideHelp()).exitOverride();
 async function main() {
   command.parse();
-  const options = optionsSchema.parse(command.opts());
+  const options = optionsSchema.parse({
+    ...command.opts(),
+    root: command.args[0] ?? "."
+  });
   const terminal = createTerminal(options);
   try {
-    let root;
+    let root, target;
     try {
+      target = await realpath2(resolve(options.root));
       root = await realpath2(execFileSync2("git", ["rev-parse", "--show-toplevel"], {
-        cwd: resolve(options.root),
+        cwd: (await stat(target)).isFile() ? dirname(target) : target,
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"]
       }).trim());
     } catch {
-      throw new Error("Run inside a Git repository, or use --root=/path/to/repository.");
+      throw new Error("Run inside a Git repository, or pass its path: databuddy-scan <path>");
     }
     const output = resolve(options.output ?? join3(process.env.XDG_CACHE_HOME ?? join3(homedir(), ".cache"), "databuddy", "scan", hash(root).slice(0, 16)));
-    if (options.report || options.diagnostics) {
-      const saved = await readJSON(join3(output, "results.json"));
-      if (!saved) {
-        throw new Error("No saved scan for this repository. Use --run first.");
-      }
-      const parsed = resultSchema.safeParse(saved);
-      if (!parsed.success) {
-        throw new Error("Saved results use an older or invalid format. Run --run to rebuild them using the cached responses.");
-      }
-      if (parsed.data.summary.root !== root) {
-        throw new Error("This output directory belongs to another repository. Choose another --output.");
-      }
-      if (options.diagnostics) {
-        terminal.diagnostics(parsed.data, output);
-      } else {
-        terminal.finish(parsed.data, { saved: true, directory: output });
-      }
+    const result = await scan({ ...options, root, output, scope: relative(root, target) }, terminal.update, terminal.announce);
+    if ("dryRun" in result) {
+      terminal.dryRun(result);
       return;
     }
-    const result = await scan({ ...options, root, output }, terminal.update);
-    if ("summary" in result) {
-      terminal.finish(result, { directory: output });
-      process.exitCode = result.summary.interrupted ? 130 : result.summary.failures || result.summary.unattemptedBatches ? 1 : 0;
-    } else {
-      terminal.inventory(result);
-    }
+    terminal.finish(result);
+    process.exitCode = result.summary.interrupted ? 130 : result.summary.failures || result.summary.unattemptedBatches ? 1 : 0;
   } catch (error) {
     terminal.error(error instanceof Error ? error.message : "Scan failed");
     process.exitCode = 1;
@@ -1910,9 +2078,7 @@ main().catch((error) => {
   }
   const message = error instanceof z3.ZodError ? error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ") : "Could not start the scanner.";
   createTerminal({
-    json: command.opts().json ?? false,
-    plain: true,
-    verbose: false
+    json: command.opts().json ?? false
   }).error(message);
   process.exitCode = 1;
 });