@forvibe/cli 1.1.1 → 2.0.0

package/dist/index.js

@@ -6,13 +6,13 @@ import { Command } from "commander";
 // src/commands/analyze.ts
 import { createInterface } from "readline";
 import { readFileSync as readFileSync5, statSync as statSync6 } from "fs";
-import { basename as basename3, extname as extname4, relative as relative4 } from "path";
+import { basename as basename3, extname as extname4, relative as relative5 } from "path";
 import chalk from "chalk";
 import ora from "ora";
 
 // src/analyzers/tech-detector.ts
 import { existsSync as existsSync2, readdirSync as readdirSync2 } from "fs";
-import { join as join2 } from "path";
+import { join as join2, relative as relative2 } from "path";
 
 // src/utils/file-scanner.ts
 import { readFileSync, readdirSync, statSync, existsSync } from "fs";
@@ -139,8 +139,22 @@ function readFileSafe(filePath) {
     return null;
   }
 }
+function fileExists(filePath) {
+  return existsSync(filePath);
+}
 
 // src/analyzers/tech-detector.ts
+var KMP_PLUGIN_MARKER_RE = /kotlin\(\s*["']multiplatform["']\s*\)|id\(\s*["']org\.jetbrains\.kotlin\.multiplatform["']\s*\)|kotlinMultiplatform/;
+function findKmpModuleGradleFile(dir) {
+  const candidates = findFiles(dir, ["build.gradle.kts", "build.gradle"], 2);
+  for (const candidate of candidates) {
+    const content = readFileSafe(candidate);
+    if (content && KMP_PLUGIN_MARKER_RE.test(content)) {
+      return relative2(dir, candidate);
+    }
+  }
+  return null;
+}
 var DETECTION_RULES = [
   {
     stack: "flutter",
@@ -155,6 +169,45 @@ var DETECTION_RULES = [
       return files.length >= 2 ? files : [];
     }
   },
+  {
+    stack: "expo",
+    label: "Expo (React Native)",
+    platforms: ["ios", "android"],
+    detect: (dir) => {
+      const files = [];
+      const pkgPath = join2(dir, "package.json");
+      const pkgContent = existsSync2(pkgPath) ? readFileSafe(pkgPath) : null;
+      let hasExpoDep = false;
+      if (pkgContent) {
+        try {
+          const pkg = JSON.parse(pkgContent);
+          const allDeps = { ...pkg.dependencies || {}, ...pkg.devDependencies || {} };
+          if ("expo" in allDeps) {
+            hasExpoDep = true;
+          }
+        } catch {
+        }
+      }
+      let hasExpoBlock = false;
+      const appJsonPath = join2(dir, "app.json");
+      if (existsSync2(appJsonPath)) {
+        const appJson = readFileSafe(appJsonPath);
+        if (appJson && /"expo"\s*:\s*\{/.test(appJson)) {
+          hasExpoBlock = true;
+        }
+      }
+      const hasAppConfig = existsSync2(join2(dir, "app.config.js")) || existsSync2(join2(dir, "app.config.ts"));
+      const hasEas = existsSync2(join2(dir, "eas.json"));
+      if (hasExpoDep || hasExpoBlock || hasEas) {
+        if (pkgContent) files.push("package.json");
+        if (hasExpoBlock) files.push("app.json");
+        if (hasAppConfig) files.push(existsSync2(join2(dir, "app.config.ts")) ? "app.config.ts" : "app.config.js");
+        if (hasEas) files.push("eas.json");
+        if (existsSync2(join2(dir, "app"))) files.push("app/");
+      }
+      return files;
+    }
+  },
   {
     stack: "react-native",
     label: "React Native",
@@ -198,7 +251,7 @@ var DETECTION_RULES = [
   },
   {
     stack: "swift",
-    label: "Swift / SwiftUI",
+    label: "iOS Native (Swift/Objective-C)",
     platforms: ["ios"],
     detect: (dir) => {
       const files = [];
@@ -215,7 +268,7 @@ var DETECTION_RULES = [
       try {
         const entries = readdirSync2(dir);
         for (const entry of entries) {
-          if (entry.endsWith(".swift")) {
+          if (entry.endsWith(".swift") || entry.endsWith(".m") || entry.endsWith(".mm")) {
             files.push(entry);
             break;
           }
@@ -225,6 +278,37 @@ var DETECTION_RULES = [
       return files;
     }
   },
+  {
+    stack: "unity",
+    label: "Unity",
+    platforms: ["ios", "android"],
+    detect: (dir) => {
+      const manifest = join2(dir, "Packages", "manifest.json");
+      const projectSettings = join2(dir, "ProjectSettings", "ProjectSettings.asset");
+      const assets = join2(dir, "Assets");
+      if (existsSync2(manifest) && existsSync2(projectSettings) && existsSync2(assets)) {
+        return [
+          "Packages/manifest.json",
+          "ProjectSettings/ProjectSettings.asset",
+          "Assets/"
+        ];
+      }
+      return [];
+    }
+  },
+  {
+    stack: "kmp",
+    label: "Kotlin Multiplatform",
+    platforms: ["ios", "android"],
+    detect: (dir) => {
+      const rootGradleFile = ["build.gradle.kts", "build.gradle", "settings.gradle.kts", "settings.gradle"].find((name) => existsSync2(join2(dir, name)));
+      if (!rootGradleFile) return [];
+      if (!existsSync2(join2(dir, "iosApp"))) return [];
+      const moduleGradleFile = findKmpModuleGradleFile(dir);
+      if (!moduleGradleFile) return [];
+      return [rootGradleFile, moduleGradleFile, "iosApp/"];
+    }
+  },
   {
     stack: "kotlin",
     label: "Android (Kotlin)",
@@ -256,7 +340,9 @@ var DETECTION_RULES = [
         for (const entry of entries) {
           if (entry.endsWith(".csproj")) {
             const content = readFileSafe(join2(dir, entry));
-            if (content && (content.includes("Maui") || content.includes("MAUI"))) {
+            if (!content) continue;
+            const isMaui = /<UseMaui>\s*true\s*<\/UseMaui>/i.test(content) || /Microsoft\.Maui\.Controls/.test(content) || /Microsoft\.Maui\.Sdk/.test(content) || /-android|-ios|-maccatalyst/.test(content);
+            if (isMaui) {
               files.push(entry);
             }
           }
@@ -264,6 +350,7 @@ var DETECTION_RULES = [
       } catch {
       }
       if (existsSync2(join2(dir, "Platforms"))) files.push("Platforms/");
+      if (existsSync2(join2(dir, "Resources"))) files.push("Resources/");
       return files.length >= 1 ? files : [];
     }
   }
@@ -297,17 +384,22 @@ function parseConfig(rootDir, techStack) {
   switch (techStack) {
     case "flutter":
       return parseFlutterConfig(rootDir);
+    case "expo":
+      return parseExpoConfig(rootDir);
     case "react-native":
       return parseReactNativeConfig(rootDir);
     case "swift":
       return parseSwiftConfig(rootDir);
     case "kotlin":
-    case "java":
       return parseAndroidConfig(rootDir);
     case "capacitor":
       return parseCapacitorConfig(rootDir);
     case "dotnet-maui":
       return parseMauiConfig(rootDir);
+    case "unity":
+      return parseUnityConfig(rootDir);
+    case "kmp":
+      return parseKmpConfig(rootDir);
     default:
       return emptyConfig();
   }
@@ -370,6 +462,82 @@ function parseFlutterConfig(rootDir) {
   }
   return config;
 }
+function parseExpoConfig(rootDir) {
+  const config = emptyConfig();
+  const appJsonContent = readFileSafe(join3(rootDir, "app.json"));
+  if (appJsonContent) {
+    try {
+      const appJson = JSON.parse(appJsonContent);
+      const expo = appJson.expo || appJson;
+      config.app_name = expo.name || appJson.displayName || appJson.name || null;
+      config.version = expo.version || null;
+      config.bundle_id = expo.ios?.bundleIdentifier || expo.android?.package || null;
+      config.description = expo.description || null;
+      config.min_ios_version = expo.ios?.deploymentTarget || null;
+    } catch {
+    }
+  }
+  if (!config.app_name || !config.bundle_id || !config.version) {
+    for (const name of ["app.config.ts", "app.config.js"]) {
+      const content = readFileSafe(join3(rootDir, name));
+      if (!content) continue;
+      if (!config.app_name) {
+        const m = content.match(/name\s*:\s*['"]([^'"]+)['"]/);
+        if (m) config.app_name = m[1];
+      }
+      if (!config.version) {
+        const m = content.match(/version\s*:\s*['"]([^'"]+)['"]/);
+        if (m) config.version = m[1];
+      }
+      if (!config.bundle_id) {
+        const m = content.match(/bundleIdentifier\s*:\s*['"]([^'"]+)['"]/) || content.match(/package\s*:\s*['"]([^'"]+)['"]/);
+        if (m) config.bundle_id = m[1];
+      }
+      if (!config.description) {
+        const m = content.match(/description\s*:\s*['"]([^'"]+)['"]/);
+        if (m) config.description = m[1];
+      }
+    }
+  }
+  const pkgContent = readFileSafe(join3(rootDir, "package.json"));
+  if (pkgContent) {
+    try {
+      const pkg = JSON.parse(pkgContent);
+      if (!config.version) config.version = pkg.version || null;
+      if (!config.description) config.description = pkg.description || null;
+      if (!config.app_name) config.app_name = pkg.name || null;
+    } catch {
+    }
+  }
+  if (!config.bundle_id || !config.app_name) {
+    const infoPlistPath = findFile(join3(rootDir, "ios"), "Info.plist", 4);
+    if (infoPlistPath) {
+      const plistData = parsePlist(infoPlistPath);
+      if (plistData) {
+        if (!config.bundle_id) {
+          const id = plistData.CFBundleIdentifier;
+          if (id && !isXcodeVariable(id)) config.bundle_id = id;
+        }
+        if (!config.app_name) {
+          const display = plistData.CFBundleDisplayName || plistData.CFBundleName;
+          if (display && !isXcodeVariable(display)) config.app_name = display;
+        }
+      }
+    }
+  }
+  if (!config.bundle_id) {
+    const buildGradlePath = findFile(join3(rootDir, "android/app"), "build.gradle", 2) || findFile(join3(rootDir, "android/app"), "build.gradle.kts", 2);
+    if (buildGradlePath) {
+      const gradleConfig = parseGradle(buildGradlePath);
+      if (gradleConfig.applicationId) config.bundle_id = gradleConfig.applicationId;
+      if (!config.min_android_sdk) config.min_android_sdk = gradleConfig.minSdk || null;
+    }
+  }
+  if (!config.app_name) {
+    config.app_name = readAndroidAppName(join3(rootDir, "android"));
+  }
+  return config;
+}
 function parseReactNativeConfig(rootDir) {
   const config = emptyConfig();
   const appJsonContent = readFileSafe(join3(rootDir, "app.json"));
@@ -380,6 +548,17 @@ function parseReactNativeConfig(rootDir) {
     } catch {
     }
   }
+  if (!config.app_name) {
+    for (const name of ["app.config.ts", "app.config.js"]) {
+      const content = readFileSafe(join3(rootDir, name));
+      if (!content) continue;
+      const m = content.match(/name\s*:\s*['"]([^'"]+)['"]/);
+      if (m) {
+        config.app_name = m[1];
+        break;
+      }
+    }
+  }
   const pkgContent = readFileSafe(join3(rootDir, "package.json"));
   if (pkgContent) {
     try {
@@ -396,6 +575,12 @@ function parseReactNativeConfig(rootDir) {
     if (plistData) {
       config.bundle_id = plistData.CFBundleIdentifier || null;
       config.min_ios_version = plistData.MinimumOSVersion || null;
+      if (!config.app_name) {
+        const display = plistData.CFBundleDisplayName || plistData.CFBundleName;
+        if (display && !isXcodeVariable(display)) {
+          config.app_name = display;
+        }
+      }
     }
   }
   if (!config.bundle_id || config.bundle_id.includes("$(")) {
@@ -420,6 +605,9 @@ function parseReactNativeConfig(rootDir) {
     }
     config.min_android_sdk = gradleConfig.minSdk || null;
   }
+  if (!config.app_name) {
+    config.app_name = readAndroidAppName(join3(rootDir, "android"));
+  }
   return config;
 }
 var EXTENSION_SUFFIXES = [
@@ -562,34 +750,26 @@ function parseSwiftConfig(rootDir) {
 }
 function parseAndroidConfig(rootDir) {
   const config = emptyConfig();
-  const buildGradlePath = findFile(join3(rootDir, "app"), "build.gradle", 2) || findFile(join3(rootDir, "app"), "build.gradle.kts", 2) || findFile(rootDir, "build.gradle", 1) || findFile(rootDir, "build.gradle.kts", 1);
-  if (buildGradlePath) {
-    const gradleConfig = parseGradle(buildGradlePath);
-    config.bundle_id = gradleConfig.applicationId || null;
-    config.version = gradleConfig.versionName || null;
-    config.min_android_sdk = gradleConfig.minSdk || null;
-  }
-  const manifestPath = findFile(rootDir, "AndroidManifest.xml", 6);
-  if (manifestPath) {
-    const content = readFileSafe(manifestPath);
-    if (content) {
-      const labelMatch = content.match(/android:label="([^"]+)"/);
-      if (labelMatch && !labelMatch[1].startsWith("@")) {
-        config.app_name = labelMatch[1];
-      }
-    }
+  const candidates = [];
+  const addCandidate = (p) => {
+    if (p) candidates.push(p);
+  };
+  addCandidate(findFile(join3(rootDir, "app"), "build.gradle", 2));
+  addCandidate(findFile(join3(rootDir, "app"), "build.gradle.kts", 2));
+  addCandidate(findFile(rootDir, "build.gradle", 1));
+  addCandidate(findFile(rootDir, "build.gradle.kts", 1));
+  for (const f of findFiles(rootDir, ["build.gradle", "build.gradle.kts"], 4)) {
+    if (!candidates.includes(f)) candidates.push(f);
+  }
+  for (const path2 of candidates) {
+    const g = parseGradle(path2);
+    if (!config.bundle_id && g.applicationId) config.bundle_id = g.applicationId;
+    if (!config.version && g.versionName) config.version = g.versionName;
+    if (!config.min_android_sdk && g.minSdk) config.min_android_sdk = g.minSdk;
+    if (config.bundle_id && config.version && config.min_android_sdk) break;
   }
   if (!config.app_name) {
-    const stringsPath = findFile(rootDir, "strings.xml", 8);
-    if (stringsPath) {
-      const content = readFileSafe(stringsPath);
-      if (content) {
-        const nameMatch = content.match(
-          /<string name="app_name">(.*?)<\/string>/
-        );
-        if (nameMatch) config.app_name = nameMatch[1];
-      }
-    }
+    config.app_name = readAndroidAppName(rootDir);
   }
   return config;
 }
@@ -657,6 +837,58 @@ function parseMauiConfig(rootDir) {
   }
   return config;
 }
+function parseUnityConfig(rootDir) {
+  const config = emptyConfig();
+  const content = readFileSafe(
+    join3(rootDir, "ProjectSettings", "ProjectSettings.asset")
+  );
+  if (!content) return config;
+  const productNameMatch = content.match(/^\s*productName:\s*(.+)$/m);
+  if (productNameMatch) config.app_name = productNameMatch[1].trim();
+  const versionMatch = content.match(/^\s*bundleVersion:\s*(\S+)/m);
+  if (versionMatch) config.version = versionMatch[1].trim();
+  const blockIdx = content.indexOf("applicationIdentifier:");
+  if (blockIdx >= 0) {
+    const after = content.slice(blockIdx + "applicationIdentifier:".length);
+    const nextSiblingKey = after.search(/\n {0,2}\S/);
+    const block = nextSiblingKey >= 0 ? after.slice(0, nextSiblingKey) : after;
+    const iphone = block.match(/iPhone:\s*(\S+)/);
+    const android = block.match(/Android:\s*(\S+)/);
+    const id = iphone?.[1] ?? android?.[1] ?? null;
+    if (id) config.bundle_id = id.trim();
+  }
+  return config;
+}
+function parseKmpConfig(rootDir) {
+  const config = emptyConfig();
+  for (const moduleName of ["androidApp", "composeApp", "app"]) {
+    const moduleDir = join3(rootDir, moduleName);
+    let gradleConfig = parseGradle(join3(moduleDir, "build.gradle.kts"));
+    if (!gradleConfig.applicationId) {
+      gradleConfig = parseGradle(join3(moduleDir, "build.gradle"));
+    }
+    if (gradleConfig.applicationId) {
+      config.bundle_id = gradleConfig.applicationId;
+      if (gradleConfig.versionName) config.version = gradleConfig.versionName;
+      if (gradleConfig.minSdk) config.min_android_sdk = gradleConfig.minSdk;
+      break;
+    }
+  }
+  const infoPlistPath = findFile(join3(rootDir, "iosApp"), "Info.plist", 3);
+  if (infoPlistPath) {
+    const plistData = parsePlist(infoPlistPath);
+    if (plistData) {
+      const displayName = plistData.CFBundleDisplayName || plistData.CFBundleName;
+      if (displayName && !isXcodeVariable(displayName)) {
+        config.app_name = displayName;
+      }
+      if (!config.min_ios_version) {
+        config.min_ios_version = plistData.MinimumOSVersion || null;
+      }
+    }
+  }
+  return config;
+}
 function parsePlist(filePath) {
   const content = readFileSafe(filePath);
   if (!content) return null;
@@ -666,6 +898,38 @@ function parsePlist(filePath) {
     return null;
   }
 }
+function lookupAndroidString(searchDir, stringName) {
+  const stringsPath = findFile(searchDir, "strings.xml", 8);
+  if (!stringsPath) return null;
+  const content = readFileSafe(stringsPath);
+  if (!content) return null;
+  const escaped = stringName.replace(/[-/\\^$*+?.()|[\]{}]/g, "\\$&");
+  const pattern = new RegExp(
+    `<string\\s+name="${escaped}"[^>]*>([\\s\\S]*?)<\\/string>`
+  );
+  const m = content.match(pattern);
+  return m ? m[1].trim() : null;
+}
+function readAndroidAppName(searchDir) {
+  const manifestPath = findFile(searchDir, "AndroidManifest.xml", 6);
+  if (manifestPath) {
+    const content = readFileSafe(manifestPath);
+    if (content) {
+      const labelMatch = content.match(/android:label\s*=\s*"([^"]+)"/);
+      if (labelMatch) {
+        const label = labelMatch[1];
+        const stringRef = label.match(/^@string\/(.+)$/);
+        if (stringRef) {
+          const resolved = lookupAndroidString(searchDir, stringRef[1]);
+          if (resolved) return resolved;
+        } else if (!label.startsWith("@")) {
+          return label;
+        }
+      }
+    }
+  }
+  return lookupAndroidString(searchDir, "app_name");
+}
 function parseGradle(filePath) {
   const content = readFileSafe(filePath);
   if (!content) return { applicationId: null, versionName: null, minSdk: null };
@@ -687,6 +951,7 @@ function parseGradle(filePath) {
 
 // src/analyzers/sdk-scanner.ts
 import { join as join4 } from "path";
+import { readdirSync as readdirSync4 } from "fs";
 import YAML2 from "yaml";
 var SDK_MAP = {
   // Analytics
@@ -791,6 +1056,45 @@ var SDK_MAP = {
   ARKit: { category: "other", collects: [] },
   RealityKit: { category: "other", collects: [] },
   EventKit: { category: "other", collects: [] },
+  // --- Expo SDK packages ---
+  "expo-notifications": { category: "other", collects: ["device_info"] },
+  "expo-tracking-transparency": { category: "ads", collects: ["device_info"], advertising: "personalized" },
+  "expo-location": { category: "other", collects: ["location"] },
+  "expo-contacts": { category: "other", collects: ["contacts"] },
+  "expo-camera": { category: "other", collects: ["photos_media"] },
+  "expo-image-picker": { category: "other", collects: ["photos_media"] },
+  "expo-media-library": { category: "other", collects: ["photos_media"] },
+  "expo-auth-session": { category: "auth", collects: ["name_email"] },
+  "expo-apple-authentication": { category: "auth", collects: ["name_email"] },
+  "expo-google-sign-in": { category: "auth", collects: ["name_email", "profile_photo"] },
+  "expo-in-app-purchases": { category: "payment", collects: ["financial_info"] },
+  "expo-ads-admob": { category: "ads", collects: ["device_info"], advertising: "personalized" },
+  "expo-firebase-analytics": { category: "analytics", collects: ["usage_analytics", "device_info"] },
+  "expo-local-authentication": { category: "auth", collects: ["biometric_data"] },
+  "expo-health-connect": { category: "other", collects: ["health_data"] },
+  "expo-sensors": { category: "other", collects: ["device_info"] },
+  "expo-device": { category: "other", collects: ["device_info"] },
+  // --- .NET MAUI packages ---
+  "Microsoft.AppCenter.Analytics": { category: "analytics", collects: ["usage_analytics", "device_info"] },
+  "Microsoft.AppCenter.Crashes": { category: "analytics", collects: ["device_info"] },
+  "Sentry.Maui": { category: "analytics", collects: ["device_info"] },
+  "Plugin.Firebase": { category: "analytics", collects: ["usage_analytics", "device_info"] },
+  "Plugin.Firebase.Analytics": { category: "analytics", collects: ["usage_analytics", "device_info"] },
+  "Plugin.Firebase.Auth": { category: "auth", collects: ["name_email"] },
+  "Plugin.Firebase.CloudMessaging": { category: "other", collects: ["device_info"] },
+  "Plugin.GoogleClient": { category: "auth", collects: ["name_email", "profile_photo"] },
+  "Plugin.SignInWithApple": { category: "auth", collects: ["name_email"] },
+  "Plugin.InAppBilling": { category: "payment", collects: ["financial_info"] },
+  "CommunityToolkit.Maui": { category: "other", collects: [] },
+  "CommunityToolkit.Maui.MediaElement": { category: "other", collects: ["photos_media"] },
+  "Plugin.Maui.Audio": { category: "other", collects: ["photos_media"] },
+  "Xamarin.Google.Android.Play.Review": { category: "other", collects: [] },
+  "Plugin.LocalNotification": { category: "other", collects: [] },
+  "Plugin.Maui.Biometric": { category: "auth", collects: ["biometric_data"] },
+  "Plugin.Permissions": { category: "other", collects: [] },
+  "Mapsui.Maui": { category: "other", collects: ["location"] },
+  "Plugin.Maui.AppRating": { category: "other", collects: [] },
+  "Plugin.Geolocator": { category: "other", collects: ["location"] },
   // --- Native Android frameworks (detected via `import` in Kotlin/Java source) ---
   "com.google.android.gms.ads": { category: "ads", collects: ["device_info"], advertising: "personalized" },
   "com.google.android.gms.maps": { category: "other", collects: ["location"] },
@@ -799,8 +1103,123 @@ var SDK_MAP = {
   "com.android.billingclient": { category: "payment", collects: ["financial_info"] },
   "androidx.health": { category: "other", collects: ["health_data"] },
   "androidx.biometric": { category: "auth", collects: ["biometric_data"] },
-  "androidx.camera": { category: "other", collects: ["photos_media"] }
+  "androidx.camera": { category: "other", collects: ["photos_media"] },
+  "androidx.compose": { category: "other", collects: [] },
+  "androidx.navigation.compose": { category: "other", collects: [] },
+  // --- Android artifact-name keys (unique enough that bare artifact name is safe) ---
+  "play-services-ads": { category: "ads", collects: ["device_info"], advertising: "personalized" },
+  "play-services-ads-lite": { category: "ads", collects: ["device_info"], advertising: "personalized" },
+  "play-services-maps": { category: "other", collects: ["location"] },
+  "play-services-location": { category: "other", collects: ["location"] },
+  "play-services-auth": { category: "auth", collects: ["name_email", "profile_photo"] },
+  "play-services-auth-api-phone": { category: "auth", collects: ["name_email"] },
+  billing: { category: "payment", collects: ["financial_info"] },
+  "billing-ktx": { category: "payment", collects: ["financial_info"] },
+  biometric: { category: "auth", collects: ["biometric_data"] },
+  "biometric-ktx": { category: "auth", collects: ["biometric_data"] },
+  "health-connect-client": { category: "other", collects: ["health_data"] },
+  "camera-core": { category: "other", collects: ["photos_media"] },
+  "camera-camera2": { category: "other", collects: ["photos_media"] },
+  "camera-lifecycle": { category: "other", collects: ["photos_media"] },
+  "camera-view": { category: "other", collects: ["photos_media"] },
+  "camera-extensions": { category: "other", collects: ["photos_media"] },
+  // firebase-analytics / firebase-auth already declared above (Flutter dep names)
+  "firebase-analytics-ktx": { category: "analytics", collects: ["usage_analytics", "device_info"] },
+  "firebase-auth-ktx": { category: "auth", collects: ["name_email"] },
+  "firebase-crashlytics": { category: "analytics", collects: ["device_info"] },
+  "firebase-crashlytics-ktx": { category: "analytics", collects: ["device_info"] },
+  "firebase-messaging": { category: "other", collects: ["device_info"] },
+  "firebase-messaging-ktx": { category: "other", collects: ["device_info"] },
+  "firebase-firestore": { category: "cloud", collects: [] },
+  "firebase-firestore-ktx": { category: "cloud", collects: [] },
+  "firebase-storage": { category: "cloud", collects: [] },
+  "firebase-storage-ktx": { category: "cloud", collects: [] },
+  "firebase-database": { category: "cloud", collects: [] },
+  "firebase-database-ktx": { category: "cloud", collects: [] },
+  "firebase-config": { category: "cloud", collects: [] },
+  "firebase-config-ktx": { category: "cloud", collects: [] },
+  "firebase-functions": { category: "cloud", collects: [] },
+  "firebase-functions-ktx": { category: "cloud", collects: [] },
+  "hilt-android": { category: "other", collects: [] },
+  "hilt-navigation-compose": { category: "other", collects: [] },
+  "koin-android": { category: "other", collects: [] },
+  "koin-androidx-compose": { category: "other", collects: [] },
+  "room-runtime": { category: "other", collects: [] },
+  "room-ktx": { category: "other", collects: [] },
+  "room-compiler": { category: "other", collects: [] },
+  retrofit: { category: "other", collects: [] },
+  "retrofit-converter-gson": { category: "other", collects: [] },
+  "retrofit-converter-moshi": { category: "other", collects: [] },
+  okhttp: { category: "other", collects: [] },
+  "okhttp-logging-interceptor": { category: "other", collects: [] },
+  "coil-compose": { category: "other", collects: [] },
+  coil: { category: "other", collects: [] },
+  glide: { category: "other", collects: [] },
+  "navigation-compose": { category: "other", collects: [] },
+  "activity-compose": { category: "other", collects: [] },
+  "lifecycle-viewmodel-compose": { category: "other", collects: [] },
+  "lifecycle-runtime-compose": { category: "other", collects: [] },
+  "work-runtime": { category: "other", collects: [] },
+  "work-runtime-ktx": { category: "other", collects: [] },
+  "datastore-preferences": { category: "other", collects: [] },
+  "kotlinx-coroutines-android": { category: "other", collects: [] },
+  // --- group:artifact keys for Compose (artifact names alone are ambiguous: "ui", "material3") ---
+  "androidx.compose.ui:ui": { category: "other", collects: [] },
+  "androidx.compose.ui:ui-tooling": { category: "other", collects: [] },
+  "androidx.compose.ui:ui-tooling-preview": { category: "other", collects: [] },
+  "androidx.compose.material3:material3": { category: "other", collects: [] },
+  "androidx.compose.material:material": { category: "other", collects: [] },
+  "androidx.compose.material:material-icons-extended": { category: "other", collects: [] },
+  "androidx.compose.foundation:foundation": { category: "other", collects: [] },
+  "androidx.compose.runtime:runtime": { category: "other", collects: [] },
+  "androidx.compose.animation:animation": { category: "other", collects: [] },
+  // --- Popular third-party Android SDKs (group:artifact keys) ---
+  "com.revenuecat.purchases:purchases": { category: "payment", collects: ["financial_info"] },
+  "com.adjust.sdk:adjust-android": { category: "analytics", collects: ["usage_analytics", "device_info"] },
+  "com.appsflyer:af-android-sdk": { category: "analytics", collects: ["usage_analytics", "device_info"] },
+  "io.sentry:sentry-android": { category: "analytics", collects: ["device_info"] },
+  "com.amplitude:android-sdk": { category: "analytics", collects: ["usage_analytics"] },
+  "com.mixpanel.android:mixpanel-android": { category: "analytics", collects: ["usage_analytics"] },
+  "com.posthog:posthog-android": { category: "analytics", collects: ["usage_analytics"] },
+  "com.stripe:stripe-android": { category: "payment", collects: ["financial_info"] }
 };
+function parseVersionCatalog(content, catalog) {
+  const idx = content.indexOf("[libraries]");
+  if (idx < 0) return;
+  const after = content.slice(idx + "[libraries]".length);
+  const nextSection = after.search(/\n\s*\[[^\]]+\]/);
+  const block = nextSection >= 0 ? after.slice(0, nextSection) : after;
+  for (const rawLine of block.split("\n")) {
+    const line = rawLine.replace(/#.*$/, "").trim();
+    if (!line || line.startsWith("[")) continue;
+    const eq = line.indexOf("=");
+    if (eq < 0) continue;
+    const alias = line.slice(0, eq).trim();
+    const value = line.slice(eq + 1).trim();
+    if (!alias) continue;
+    const shorthand = value.match(/^"([^"]+)"$/);
+    if (shorthand) {
+      const parts = shorthand[1].split(":");
+      if (parts.length >= 2 && parts[0] && parts[1]) {
+        catalog.set(alias, `${parts[0]}:${parts[1]}`);
+      }
+      continue;
+    }
+    const moduleMatch = value.match(/module\s*=\s*"([^"]+)"/);
+    if (moduleMatch) {
+      const parts = moduleMatch[1].split(":");
+      if (parts.length >= 2 && parts[0] && parts[1]) {
+        catalog.set(alias, `${parts[0]}:${parts[1]}`);
+      }
+      continue;
+    }
+    const groupMatch = value.match(/group\s*=\s*"([^"]+)"/);
+    const nameMatch = value.match(/name\s*=\s*"([^"]+)"/);
+    if (groupMatch && nameMatch) {
+      catalog.set(alias, `${groupMatch[1]}:${nameMatch[1]}`);
+    }
+  }
+}
 function scanSDKs(rootDir, techStack) {
   const detectedSDKs = [];
   const dataCollected = /* @__PURE__ */ new Set();
@@ -867,6 +1286,7 @@ function getDependencies(rootDir, techStack) {
       }
       break;
     }
+    case "expo":
     case "react-native":
     case "capacitor": {
       const pkgContent = readFileSafe(join4(rootDir, "package.json"));
@@ -880,6 +1300,30 @@ function getDependencies(rootDir, techStack) {
       }
       break;
     }
+    case "dotnet-maui": {
+      const csprojFiles = [];
+      try {
+        for (const entry of readdirSync4(rootDir)) {
+          if (entry.endsWith(".csproj")) csprojFiles.push(join4(rootDir, entry));
+        }
+      } catch {
+      }
+      const nested = findFiles(rootDir, [".csproj"], 3);
+      for (const f of nested) {
+        if (!csprojFiles.includes(f)) csprojFiles.push(f);
+      }
+      for (const path2 of csprojFiles) {
+        const content = readFileSafe(path2);
+        if (!content) continue;
+        const pkgMatches = content.matchAll(
+          /<PackageReference\s+[^>]*Include\s*=\s*"([^"]+)"/g
+        );
+        for (const match of pkgMatches) {
+          if (!deps.includes(match[1])) deps.push(match[1]);
+        }
+      }
+      break;
+    }
     case "swift": {
       const podfileContent = readFileSafe(join4(rootDir, "Podfile"));
       if (podfileContent) {
@@ -927,29 +1371,51 @@ function getDependencies(rootDir, techStack) {
       deps.push(...nativeImports);
       break;
     }
-    case "kotlin":
-    case "java": {
-      const gradlePaths = [
+    case "kotlin": {
+      const catalog = /* @__PURE__ */ new Map();
+      for (const p of [
+        join4(rootDir, "gradle/libs.versions.toml"),
+        join4(rootDir, "libs.versions.toml")
+      ]) {
+        const content = readFileSafe(p);
+        if (content) parseVersionCatalog(content, catalog);
+      }
+      const gradleFiles = /* @__PURE__ */ new Set([
         join4(rootDir, "app/build.gradle"),
         join4(rootDir, "app/build.gradle.kts"),
         join4(rootDir, "build.gradle"),
         join4(rootDir, "build.gradle.kts")
-      ];
-      for (const path2 of gradlePaths) {
+      ]);
+      for (const f of findFiles(rootDir, ["build.gradle", "build.gradle.kts"], 5)) {
+        gradleFiles.add(f);
+      }
+      const addCoord = (coord) => {
+        const parts = coord.split(":");
+        if (parts.length < 2) return;
+        const [group, artifact] = parts;
+        if (!group || !artifact) return;
+        if (!deps.includes(artifact)) deps.push(artifact);
+        const gav = `${group}:${artifact}`;
+        if (!deps.includes(gav)) deps.push(gav);
+      };
+      const coordRegex = /['"]([a-zA-Z][\w.-]*\.[a-zA-Z][\w.-]*:[a-zA-Z][\w.-]*(?::[^'"\s]+)?)['"]/g;
+      const libsRefRegex = /\blibs\.([a-zA-Z][\w.]*)/g;
+      for (const path2 of gradleFiles) {
         const content = readFileSafe(path2);
-        if (content) {
-          const implMatches = content.matchAll(
-            /implementation\s*\(?['"]([^'"]+)['"]\)?/g
-          );
-          for (const match of implMatches) {
-            const parts = match[1].split(":");
-            if (parts.length >= 2) {
-              deps.push(parts[1]);
-            }
-          }
+        if (!content) continue;
+        for (const m of content.matchAll(coordRegex)) {
+          addCoord(m[1]);
+        }
+        for (const m of content.matchAll(libsRefRegex)) {
+          const ref = m[1];
+          const resolved = catalog.get(ref) || catalog.get(ref.replace(/\./g, "-"));
+          if (resolved) addCoord(resolved);
         }
       }
-      const androidFiles = findFiles(join4(rootDir, "app/src"), [".kt", ".java"], 8);
+      const androidFiles = [
+        ...findFiles(join4(rootDir, "app/src"), [".kt", ".java"], 8),
+        ...findFiles(rootDir, [".kt", ".java"], 6)
+      ];
       const androidNativeImports = /* @__PURE__ */ new Set();
       const androidFrameworkPrefixes = [
         "com.google.android.gms.ads",
@@ -959,16 +1425,20 @@ function getDependencies(rootDir, techStack) {
         "com.android.billingclient",
         "androidx.health",
         "androidx.biometric",
-        "androidx.camera"
+        "androidx.camera",
+        "androidx.compose",
+        "androidx.navigation.compose"
       ];
-      for (const file of androidFiles.slice(0, 100)) {
+      const seen = /* @__PURE__ */ new Set();
+      for (const file of androidFiles) {
+        if (seen.has(file)) continue;
+        seen.add(file);
+        if (seen.size > 200) break;
         const content = readFileSafe(file);
         if (!content) continue;
         for (const prefix of androidFrameworkPrefixes) {
-          if (content.includes(`import ${prefix}`)) {
-            if (!androidNativeImports.has(prefix)) {
-              androidNativeImports.add(prefix);
-            }
+          if (content.includes(`import ${prefix}`) && !androidNativeImports.has(prefix)) {
+            androidNativeImports.add(prefix);
           }
         }
       }
@@ -978,9 +1448,262 @@ function getDependencies(rootDir, techStack) {
   }
   return deps;
 }
+function dedupeSorted(values) {
+  return Array.from(new Set(values)).sort();
+}
+function gradleCandidateFiles(baseDir) {
+  const candidates = /* @__PURE__ */ new Set([
+    join4(baseDir, "app/build.gradle"),
+    join4(baseDir, "app/build.gradle.kts"),
+    join4(baseDir, "build.gradle"),
+    join4(baseDir, "build.gradle.kts")
+  ]);
+  for (const f of findFiles(baseDir, ["build.gradle", "build.gradle.kts"], 5)) {
+    candidates.add(f);
+  }
+  return Array.from(candidates);
+}
+function collectGradleCoordinates(androidRoot, gradleFiles) {
+  const catalog = /* @__PURE__ */ new Map();
+  for (const p of [
+    join4(androidRoot, "gradle/libs.versions.toml"),
+    join4(androidRoot, "libs.versions.toml")
+  ]) {
+    const content = readFileSafe(p);
+    if (content) parseVersionCatalog(content, catalog);
+  }
+  const coordRegex = /['"]([a-zA-Z][\w.-]*\.[a-zA-Z][\w.-]*:[a-zA-Z][\w.-]*(?::[^'"\s]+)?)['"]/g;
+  const libsRefRegex = /\blibs\.([a-zA-Z][\w.]*)/g;
+  const deps = [];
+  const addCoord = (coord) => {
+    const parts = coord.split(":");
+    if (parts.length < 2) return;
+    const [group, artifact] = parts;
+    if (!group || !artifact) return;
+    deps.push(`${group}:${artifact}`);
+  };
+  for (const path2 of gradleFiles) {
+    const content = readFileSafe(path2);
+    if (!content) continue;
+    const filtered = content.split("\n").filter((line) => !/^\s*classpath\b/.test(line)).join("\n");
+    for (const m of filtered.matchAll(coordRegex)) {
+      addCoord(m[1]);
+    }
+    for (const m of filtered.matchAll(libsRefRegex)) {
+      const ref = m[1];
+      const resolved = catalog.get(ref) || catalog.get(ref.replace(/\./g, "-"));
+      if (resolved) addCoord(resolved);
+    }
+  }
+  return dedupeSorted(deps);
+}
+function collectPodfilePods(podfilePath) {
+  const content = readFileSafe(podfilePath);
+  if (!content) return [];
+  const deps = [];
+  for (const m of content.matchAll(/pod\s+['"]([^'"]+)['"]/g)) {
+    deps.push(m[1]);
+  }
+  return dedupeSorted(deps);
+}
+function collectSpmSlugs(rootDir) {
+  const deps = [];
+  const packageSwift = readFileSafe(join4(rootDir, "Package.swift"));
+  if (packageSwift) {
+    for (const m of packageSwift.matchAll(
+      /\.package\([^)]*url:\s*"[^"]*\/([^/"]+?)(?:\.git)?"/g
+    )) {
+      deps.push(m[1].toLowerCase());
+    }
+  }
+  const pbxprojPath = findFile(rootDir, "project.pbxproj", 5);
+  if (pbxprojPath) {
+    const pbxContent = readFileSafe(pbxprojPath);
+    if (pbxContent) {
+      for (const m of pbxContent.matchAll(
+        /repositoryURL\s*=\s*"[^"]*\/([^/"]+?)(?:\.git)?"/g
+      )) {
+        deps.push(m[1].toLowerCase());
+      }
+    }
+  }
+  return dedupeSorted(deps);
+}
+function collectSwiftImports(rootDir) {
+  const sourceFiles = findFiles(rootDir, [".swift", ".m", ".mm"], 6);
+  const imports = /* @__PURE__ */ new Set();
+  for (const file of sourceFiles.slice(0, 100)) {
+    const content = readFileSafe(file);
+    if (!content) continue;
+    for (const m of content.matchAll(/^\s*import\s+(\w+)/gm)) {
+      imports.add(m[1]);
+    }
+    for (const m of content.matchAll(/@import\s+(\w+)\s*;/g)) {
+      imports.add(m[1]);
+    }
+    for (const m of content.matchAll(/#import\s*<([^\/>]+)(?:\/[^>]*)?>/g)) {
+      imports.add(m[1]);
+    }
+  }
+  return dedupeSorted(Array.from(imports));
+}
+function collectAndroidImports(rootDir) {
+  const files = [
+    ...findFiles(join4(rootDir, "app/src"), [".kt", ".java"], 8),
+    ...findFiles(rootDir, [".kt", ".java"], 6)
+  ];
+  const seen = /* @__PURE__ */ new Set();
+  const imports = /* @__PURE__ */ new Set();
+  for (const file of files) {
+    if (seen.has(file)) continue;
+    seen.add(file);
+    if (seen.size > 200) break;
+    const content = readFileSafe(file);
+    if (!content) continue;
+    for (const m of content.matchAll(/^\s*import\s+([\w.]+)/gm)) {
+      imports.add(m[1].replace(/\.$/, ""));
+    }
+  }
+  return dedupeSorted(Array.from(imports));
+}
+function collectPubspecDeps(pubspecPath) {
+  const content = readFileSafe(pubspecPath);
+  if (!content) return [];
+  const deps = [];
+  try {
+    const pubspec = YAML2.parse(content);
+    if (pubspec?.dependencies) deps.push(...Object.keys(pubspec.dependencies));
+    if (pubspec?.dev_dependencies) deps.push(...Object.keys(pubspec.dev_dependencies));
+  } catch {
+  }
+  return dedupeSorted(deps);
+}
+function collectPackageJsonDeps(pkgPath) {
+  const content = readFileSafe(pkgPath);
+  if (!content) return [];
+  const deps = [];
+  try {
+    const pkg = JSON.parse(content);
+    if (pkg.dependencies) deps.push(...Object.keys(pkg.dependencies));
+    if (pkg.devDependencies) deps.push(...Object.keys(pkg.devDependencies));
+  } catch {
+  }
+  return dedupeSorted(deps);
+}
+function collectCsprojPackageRefs(rootDir) {
+  const csprojFiles = [];
+  try {
+    for (const entry of readdirSync4(rootDir)) {
+      if (entry.endsWith(".csproj")) csprojFiles.push(join4(rootDir, entry));
+    }
+  } catch {
+  }
+  for (const f of findFiles(rootDir, [".csproj"], 3)) {
+    if (!csprojFiles.includes(f)) csprojFiles.push(f);
+  }
+  const deps = [];
+  for (const path2 of csprojFiles) {
+    const content = readFileSafe(path2);
+    if (!content) continue;
+    for (const m of content.matchAll(/<PackageReference\s+[^>]*Include\s*=\s*"([^"]+)"/g)) {
+      deps.push(m[1]);
+    }
+  }
+  return dedupeSorted(deps);
+}
+function collectRawDependencies(rootDir, stack) {
+  const deps = {
+    npm: [],
+    pub: [],
+    pods: [],
+    spm: [],
+    gradle: [],
+    nuget: [],
+    upm: [],
+    ios_imports: [],
+    android_imports: []
+  };
+  switch (stack) {
+    case "flutter": {
+      deps.pub = collectPubspecDeps(join4(rootDir, "pubspec.yaml"));
+      deps.pods = collectPodfilePods(join4(rootDir, "ios", "Podfile"));
+      const androidRoot = join4(rootDir, "android");
+      deps.gradle = collectGradleCoordinates(androidRoot, gradleCandidateFiles(androidRoot));
+      break;
+    }
+    case "react-native":
+    case "expo":
+    case "capacitor": {
+      deps.npm = collectPackageJsonDeps(join4(rootDir, "package.json"));
+      deps.pods = collectPodfilePods(join4(rootDir, "ios", "Podfile"));
+      const androidRoot = join4(rootDir, "android");
+      deps.gradle = collectGradleCoordinates(androidRoot, gradleCandidateFiles(androidRoot));
+      break;
+    }
+    case "swift": {
+      deps.pods = collectPodfilePods(join4(rootDir, "Podfile"));
+      deps.spm = collectSpmSlugs(rootDir);
+      deps.ios_imports = collectSwiftImports(rootDir);
+      break;
+    }
+    case "kotlin": {
+      deps.gradle = collectGradleCoordinates(rootDir, gradleCandidateFiles(rootDir));
+      deps.android_imports = collectAndroidImports(rootDir);
+      break;
+    }
+    case "dotnet-maui": {
+      deps.nuget = collectCsprojPackageRefs(rootDir);
+      break;
+    }
+    case "unity": {
+      const manifestContent = readFileSafe(join4(rootDir, "Packages", "manifest.json"));
+      if (manifestContent) {
+        try {
+          const manifest = JSON.parse(manifestContent);
+          if (manifest?.dependencies && typeof manifest.dependencies === "object") {
+            deps.upm = dedupeSorted(Object.keys(manifest.dependencies));
+          }
+        } catch {
+        }
+      }
+      const gradleFromPlugins = [];
+      try {
+        for (const entry of readdirSync4(join4(rootDir, "Assets", "Plugins", "Android"))) {
+          if (entry.endsWith(".aar")) gradleFromPlugins.push(entry.slice(0, -".aar".length));
+          else if (entry.endsWith(".jar")) gradleFromPlugins.push(entry.slice(0, -".jar".length));
+        }
+      } catch {
+      }
+      deps.gradle = dedupeSorted(gradleFromPlugins);
+      const podsFromPlugins = [];
+      try {
+        for (const entry of readdirSync4(join4(rootDir, "Assets", "Plugins", "iOS"))) {
+          if (entry.endsWith(".xcframework")) podsFromPlugins.push(entry.slice(0, -".xcframework".length));
+          else if (entry.endsWith(".framework")) podsFromPlugins.push(entry.slice(0, -".framework".length));
+        }
+      } catch {
+      }
+      deps.pods = dedupeSorted(podsFromPlugins);
+      break;
+    }
+    case "kmp": {
+      deps.gradle = collectGradleCoordinates(rootDir, gradleCandidateFiles(rootDir));
+      const iosAppDir = join4(rootDir, "iosApp");
+      deps.ios_imports = collectSwiftImports(iosAppDir);
+      deps.pods = collectPodfilePods(join4(iosAppDir, "Podfile"));
+      deps.spm = collectSpmSlugs(iosAppDir);
+      deps.android_imports = collectAndroidImports(rootDir);
+      break;
+    }
+    // "unknown" only.
+    default:
+      break;
+  }
+  return deps;
+}
 
 // src/analyzers/branding.ts
-import { readFileSync as readFileSync2, existsSync as existsSync3, readdirSync as readdirSync4, statSync as statSync2 } from "fs";
+import { readFileSync as readFileSync2, existsSync as existsSync3, readdirSync as readdirSync5, statSync as statSync2 } from "fs";
 import { join as join5, extname } from "path";
 function extractBranding(rootDir, techStack) {
   const result = {
@@ -1003,20 +1726,129 @@ function extractColors(rootDir, techStack) {
   switch (techStack) {
     case "flutter":
       return extractFlutterColors(rootDir);
+    case "expo":
+      return extractExpoColors(rootDir);
     case "react-native":
     case "capacitor":
       return extractJSColors(rootDir);
     case "swift":
       return extractSwiftColors(rootDir);
     case "kotlin":
-    case "java":
       return extractAndroidColors(rootDir);
+    case "dotnet-maui":
+      return extractMauiColors(rootDir);
     default:
       return { primary: null, secondary: null, allColors: [] };
   }
 }
-function isIrrelevantColor(hex) {
-  const r = parseInt(hex.slice(1, 3), 16);
+function extractExpoColors(rootDir) {
+  const hexColors = [];
+  let primary = null;
+  let secondary = null;
+  const HEX = /^#[0-9a-fA-F]{6}$/;
+  const normalize = (raw) => {
+    if (!raw) return null;
+    const v = raw.trim();
+    if (HEX.test(v)) return v.toLowerCase();
+    if (/^#[0-9a-fA-F]{8}$/.test(v)) return `#${v.slice(3).toLowerCase()}`;
+    return null;
+  };
+  const appJsonContent = readFileSafe(join5(rootDir, "app.json"));
+  if (appJsonContent) {
+    try {
+      const data = JSON.parse(appJsonContent);
+      const expo = data.expo || data;
+      const candidates = [
+        expo.primaryColor,
+        expo.splash?.backgroundColor,
+        expo.android?.adaptiveIcon?.backgroundColor,
+        expo.android?.splash?.backgroundColor,
+        expo.ios?.splash?.backgroundColor
+      ];
+      for (const c of candidates) {
+        const n = normalize(c || "");
+        if (n) hexColors.push(n);
+      }
+      primary = normalize(expo.primaryColor || "") || null;
+    } catch {
+    }
+  }
+  const jsResult = extractJSColors(rootDir);
+  if (!primary) primary = jsResult.primary;
+  if (!secondary) secondary = jsResult.secondary;
+  hexColors.push(...jsResult.allColors);
+  return {
+    primary: primary || (hexColors[0] ?? null),
+    secondary: secondary || (hexColors[1] ?? null),
+    allColors: hexColors
+  };
+}
+function extractMauiColors(rootDir) {
+  const hexColors = [];
+  const xamlPaths = [
+    join5(rootDir, "Resources/Styles/Colors.xaml"),
+    join5(rootDir, "Resources/Styles/Styles.xaml")
+  ];
+  const allXaml = findFiles(rootDir, [".xaml"], 5);
+  for (const p of allXaml) {
+    if (/Colors\.xaml$/i.test(p) && !xamlPaths.includes(p)) xamlPaths.push(p);
+  }
+  for (const path2 of xamlPaths) {
+    const content = readFileSafe(path2);
+    if (!content) continue;
+    const colorMatches = content.matchAll(
+      /<Color\s+x:Key="([^"]+)"\s*>\s*#([0-9a-fA-F]{6,8})\s*<\/Color>/g
+    );
+    for (const match of colorMatches) {
+      const name = match[1].toLowerCase();
+      let hex = match[2];
+      if (hex.length === 8) hex = hex.substring(2);
+      const color = `#${hex.toLowerCase()}`;
+      if (name.includes("primary") && !name.includes("dark") && !name.includes("light")) {
+        hexColors.unshift(color);
+      } else {
+        hexColors.push(color);
+      }
+    }
+    const brushMatches = content.matchAll(
+      /<SolidColorBrush\s+[^>]*Color\s*=\s*"#([0-9a-fA-F]{6,8})"/g
+    );
+    for (const match of brushMatches) {
+      let hex = match[1];
+      if (hex.length === 8) hex = hex.substring(2);
+      hexColors.push(`#${hex.toLowerCase()}`);
+    }
+  }
+  const csFiles = findFiles(rootDir, [".cs"], 5);
+  for (const file of csFiles.slice(0, 50)) {
+    const content = readFileSafe(file);
+    if (!content) continue;
+    const argbMatches = content.matchAll(
+      /Color\.FromArgb\s*\(\s*"#?([0-9a-fA-F]{6,8})"/g
+    );
+    for (const match of argbMatches) {
+      let hex = match[1];
+      if (hex.length === 8) hex = hex.substring(2);
+      hexColors.push(`#${hex.toLowerCase()}`);
+    }
+    const rgbMatches = content.matchAll(
+      /Color\.FromRgb\s*\(\s*(\d+)\s*,\s*(\d+)\s*,\s*(\d+)/g
+    );
+    for (const match of rgbMatches) {
+      const r = parseInt(match[1]).toString(16).padStart(2, "0");
+      const g = parseInt(match[2]).toString(16).padStart(2, "0");
+      const b = parseInt(match[3]).toString(16).padStart(2, "0");
+      hexColors.push(`#${r}${g}${b}`);
+    }
+  }
+  return {
+    primary: hexColors[0] ?? null,
+    secondary: hexColors[1] ?? null,
+    allColors: hexColors
+  };
+}
+function isIrrelevantColor(hex) {
+  const r = parseInt(hex.slice(1, 3), 16);
   const g = parseInt(hex.slice(3, 5), 16);
   const b = parseInt(hex.slice(5, 7), 16);
   const brightness = (r * 299 + g * 587 + b * 114) / 1e3;
@@ -1132,7 +1964,7 @@ function extractSwiftColors(rootDir) {
   }
   for (const catalog of assetsCatalogs) {
     try {
-      const entries = readdirSync4(catalog);
+      const entries = readdirSync5(catalog);
       for (const entry of entries) {
         if (entry.endsWith(".colorset") && entry !== "AccentColor.colorset") {
           const color = parseColorSet(join5(catalog, entry));
@@ -1181,51 +2013,103 @@ function extractSwiftColors(rootDir) {
 }
 function extractAndroidColors(rootDir) {
   const hexColors = [];
-  const colorFiles = ["colors.xml", "themes.xml", "styles.xml"];
-  for (const fileName of colorFiles) {
-    for (const resDir of ["app/src/main/res/values", "src/main/res/values"]) {
-      const filePath = join5(rootDir, resDir, fileName);
-      const content = readFileSafe(filePath);
-      if (!content) continue;
-      const colorMatches = content.matchAll(
-        /<color\s+name="([^"]*)">\s*#([0-9a-fA-F]{6,8})\s*<\/color>/g
-      );
-      for (const match of colorMatches) {
-        const name = match[1].toLowerCase();
-        let hex = match[2];
-        if (hex.length === 8) hex = hex.substring(2);
-        const color = `#${hex}`;
-        if (name.includes("primary") && !name.includes("variant") && !name.includes("dark")) {
-          hexColors.unshift(color);
-        } else if (name.includes("secondary") || name.includes("accent")) {
-          hexColors.push(color);
-        } else {
-          hexColors.push(color);
-        }
+  let primary = null;
+  let secondary = null;
+  const normalize = (hexDigits) => {
+    const h = hexDigits.length === 8 ? hexDigits.slice(2) : hexDigits;
+    return `#${h.toLowerCase()}`;
+  };
+  const colorMap = /* @__PURE__ */ new Map();
+  const colorsFiles = findAllFiles(rootDir, "colors.xml", 8);
+  for (const path2 of colorsFiles) {
+    const content = readFileSafe(path2);
+    if (!content) continue;
+    const matches = content.matchAll(
+      /<color\s+name="([^"]+)"[^>]*>\s*#([0-9a-fA-F]{6,8})\s*<\/color>/g
+    );
+    for (const m of matches) {
+      const hex = normalize(m[2]);
+      colorMap.set(m[1], hex);
+      hexColors.push(hex);
+      const name = m[1].toLowerCase();
+      if (name.includes("primary") && !name.includes("variant") && !name.includes("dark") && !name.includes("container") && !primary) {
+        primary = hex;
+      } else if ((name.includes("secondary") || name.includes("accent")) && !secondary) {
+        secondary = hex;
       }
-      const themeColorMatches = content.matchAll(
-        /<item\s+name="(?:color|android:color)([^"]*)">\s*@color\/([^<]+)\s*<\/item>/g
-      );
-      for (const match of themeColorMatches) {
-        if (match[1].toLowerCase().includes("primary")) {
-        }
+    }
+  }
+  const themeFiles = [
+    ...findAllFiles(rootDir, "themes.xml", 8),
+    ...findAllFiles(rootDir, "styles.xml", 8)
+  ];
+  for (const path2 of themeFiles) {
+    const content = readFileSafe(path2);
+    if (!content) continue;
+    const itemMatches = content.matchAll(
+      /<item\s+name="(?:android:)?([A-Za-z]+)"[^>]*>\s*(?:@color\/([A-Za-z0-9_]+)|#([0-9a-fA-F]{6,8}))\s*<\/item>/g
+    );
+    for (const m of itemMatches) {
+      const itemName = m[1].toLowerCase();
+      if (!itemName.startsWith("color")) continue;
+      let hex = null;
+      if (m[2]) hex = colorMap.get(m[2]) || null;
+      else if (m[3]) hex = normalize(m[3]);
+      if (!hex) continue;
+      if (itemName === "colorprimary" || itemName === "colorprimarydark") {
+        if (!primary) primary = hex;
+      } else if (itemName === "colorsecondary" || itemName === "colortertiary" || itemName === "coloraccent") {
+        if (!secondary) secondary = hex;
       }
+      hexColors.push(hex);
     }
   }
   const ktFiles = findFiles(rootDir, [".kt"], 6);
-  for (const file of ktFiles.slice(0, 50)) {
+  for (const file of ktFiles.slice(0, 80)) {
     const fileName = file.toLowerCase();
     if (!fileName.includes("color") && !fileName.includes("theme")) continue;
     const content = readFileSafe(file);
     if (!content) continue;
-    const colorMatches = content.matchAll(/Color\s*\(\s*0[xX]([0-9a-fA-F]{8})\s*\)/g);
-    for (const match of colorMatches) {
-      hexColors.push(`#${match[1].substring(2)}`);
+    const valMap = /* @__PURE__ */ new Map();
+    const valMatches = content.matchAll(
+      /val\s+(\w+)\s*(?::\s*Color\s*)?=\s*Color\s*\(\s*0[xX]([0-9a-fA-F]{8})\s*\)/g
+    );
+    for (const m of valMatches) {
+      const hex = normalize(m[2]);
+      valMap.set(m[1], hex);
+      hexColors.push(hex);
+    }
+    const literalMatches = content.matchAll(/Color\s*\(\s*0[xX]([0-9a-fA-F]{8})\s*\)/g);
+    for (const m of literalMatches) {
+      hexColors.push(normalize(m[1]));
+    }
+    const schemeMatch = content.match(
+      /(?:light|dark)ColorScheme\s*\(\s*([\s\S]*?)\n\s*\)/
+    );
+    if (schemeMatch) {
+      const body = schemeMatch[1];
+      const resolve = (key) => {
+        const re = new RegExp(
+          `\\b${key}\\s*=\\s*(?:Color\\s*\\(\\s*0[xX]([0-9a-fA-F]{8})\\s*\\)|(\\w+))`
+        );
+        const m = body.match(re);
+        if (!m) return null;
+        if (m[1]) return normalize(m[1]);
+        return valMap.get(m[2]) || null;
+      };
+      if (!primary) {
+        const p = resolve("primary");
+        if (p) primary = p;
+      }
+      if (!secondary) {
+        const s = resolve("secondary") || resolve("tertiary");
+        if (s) secondary = s;
+      }
     }
   }
   return {
-    primary: hexColors.length > 0 ? hexColors[0] : null,
-    secondary: hexColors.length > 1 ? hexColors[1] : null,
+    primary: primary || hexColors[0] || null,
+    secondary: secondary || hexColors[1] || null,
     allColors: hexColors
   };
 }
@@ -1234,7 +2118,7 @@ function findAssetsCatalogs(rootDir) {
   function search(dir, depth) {
     if (depth > 5) return;
     try {
-      const entries = readdirSync4(dir);
+      const entries = readdirSync5(dir);
       for (const entry of entries) {
         if (entry.startsWith(".") || entry === "Pods" || entry === "DerivedData") continue;
         const fullPath = join5(dir, entry);
@@ -1300,6 +2184,18 @@ function findAppIcon(rootDir, techStack) {
         join5(rootDir, "android/app/src/main/res/mipmap-xxhdpi/ic_launcher.png")
       );
       break;
+    case "expo":
+      iconPaths.push(
+        ...resolveExpoIconPaths(rootDir),
+        // Common Expo defaults
+        join5(rootDir, "assets/icon.png"),
+        join5(rootDir, "assets/adaptive-icon.png"),
+        join5(rootDir, "assets/images/icon.png"),
+        join5(rootDir, "assets/images/adaptive-icon.png"),
+        ...findIconsInAppIconSet(join5(rootDir, "ios")),
+        join5(rootDir, "android/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png")
+      );
+      break;
     case "react-native":
     case "capacitor":
       iconPaths.push(
@@ -1315,13 +2211,47 @@ function findAppIcon(rootDir, techStack) {
         ...findIconsInAppIconSet(rootDir)
       );
       break;
-    case "kotlin":
-    case "java":
+    case "kotlin": {
+      const modules = ["app", "mobile", "androidApp", "presentation", ""];
+      const densities = ["xxxhdpi", "xxhdpi", "xhdpi"];
+      for (const mod of modules) {
+        const prefix = mod ? `${mod}/` : "";
+        iconPaths.push(
+          join5(rootDir, `${prefix}src/main/ic_launcher-playstore.png`),
+          join5(rootDir, `${prefix}ic_launcher-playstore.png`)
+        );
+      }
+      for (const mod of modules) {
+        const prefix = mod ? `${mod}/` : "";
+        for (const d of densities) {
+          iconPaths.push(
+            join5(rootDir, `${prefix}src/main/res/mipmap-${d}/ic_launcher_foreground.png`),
+            join5(rootDir, `${prefix}src/main/res/mipmap-${d}/ic_launcher_foreground.webp`)
+          );
+        }
+      }
+      for (const mod of modules) {
+        const prefix = mod ? `${mod}/` : "";
+        for (const d of densities) {
+          iconPaths.push(
+            join5(rootDir, `${prefix}src/main/res/mipmap-${d}/ic_launcher.png`),
+            join5(rootDir, `${prefix}src/main/res/mipmap-${d}/ic_launcher.webp`),
+            join5(rootDir, `${prefix}src/main/res/mipmap-${d}/ic_launcher_round.png`),
+            join5(rootDir, `${prefix}src/main/res/mipmap-${d}/ic_launcher_round.webp`)
+          );
+        }
+      }
+      break;
+    }
+    case "dotnet-maui":
       iconPaths.push(
-        join5(rootDir, "app/src/main/res/mipmap-xxxhdpi/ic_launcher.png"),
-        join5(rootDir, "app/src/main/res/mipmap-xxhdpi/ic_launcher.png"),
-        join5(rootDir, "app/src/main/res/mipmap-xhdpi/ic_launcher.png"),
-        join5(rootDir, "app/src/main/ic_launcher-playstore.png")
+        join5(rootDir, "Resources/AppIcon/appicon.png"),
+        join5(rootDir, "Resources/AppIcon/appiconfg.png"),
+        join5(rootDir, "Resources/Images/icon.png"),
+        join5(rootDir, "Resources/Images/appicon.png"),
+        // SVG fallback (MAUI default is SVG appicon.svg)
+        join5(rootDir, "Resources/AppIcon/appicon.svg"),
+        join5(rootDir, "Resources/AppIcon/appiconfg.svg")
       );
       break;
   }
@@ -1333,7 +2263,7 @@ function findAppIcon(rootDir, techStack) {
         if (stat.size < 100) continue;
         const buffer = readFileSync2(iconPath);
         const ext = extname(iconPath).toLowerCase();
-        const mime = ext === ".png" ? "image/png" : ext === ".jpg" || ext === ".jpeg" ? "image/jpeg" : "image/png";
+        const mime = ext === ".png" ? "image/png" : ext === ".jpg" || ext === ".jpeg" ? "image/jpeg" : ext === ".svg" ? "image/svg+xml" : ext === ".webp" ? "image/webp" : "image/png";
         const base64 = `data:${mime};base64,${buffer.toString("base64")}`;
         return { base64, path: iconPath };
       } catch {
@@ -1343,12 +2273,33 @@ function findAppIcon(rootDir, techStack) {
   }
   return { base64: null, path: null };
 }
+function resolveExpoIconPaths(rootDir) {
+  const paths = [];
+  const appJsonContent = readFileSafe(join5(rootDir, "app.json"));
+  if (!appJsonContent) return paths;
+  try {
+    const data = JSON.parse(appJsonContent);
+    const expo = data.expo || data;
+    const candidates = [
+      expo.icon,
+      expo.android?.icon,
+      expo.android?.adaptiveIcon?.foregroundImage,
+      expo.ios?.icon
+    ].filter((v) => typeof v === "string");
+    for (const rel of candidates) {
+      const cleaned = rel.replace(/^\.?\//, "");
+      paths.push(join5(rootDir, cleaned));
+    }
+  } catch {
+  }
+  return paths;
+}
 function findIconsInAppIconSet(searchDir) {
   const icons = [];
   function searchRecursive(dir, depth) {
     if (depth > 6) return;
     try {
-      const entries = readdirSync4(dir);
+      const entries = readdirSync5(dir);
       for (const entry of entries) {
         const fullPath = join5(dir, entry);
         if (entry === "AppIcon.appiconset") {
@@ -1372,7 +2323,7 @@ function findIconsInAppIconSet(searchDir) {
             }
           }
           try {
-            const iconEntries = readdirSync4(fullPath);
+            const iconEntries = readdirSync5(fullPath);
             for (const ie of iconEntries) {
               if (ie.endsWith(".png")) {
                 icons.push(join5(fullPath, ie));
@@ -1400,7 +2351,7 @@ function findIconsInAppIconSet(searchDir) {
 }
 
 // src/analyzers/font-detector.ts
-import { existsSync as existsSync4, readdirSync as readdirSync5, statSync as statSync3 } from "fs";
+import { existsSync as existsSync4, readdirSync as readdirSync6, statSync as statSync3 } from "fs";
 import { join as join6, extname as extname2, basename } from "path";
 import yaml from "yaml";
 import plist2 from "plist";
@@ -1452,7 +2403,7 @@ function scanForFontFiles(dir, maxDepth = 3) {
   function walk(d, depth) {
     if (depth > maxDepth) return;
     try {
-      const entries = readdirSync5(d);
+      const entries = readdirSync6(d);
       for (const entry of entries) {
         if (entry.startsWith(".")) continue;
         const fullPath = join6(d, entry);
@@ -1590,7 +2541,7 @@ function findPlistFiles(rootDir) {
   function search(dir, depth) {
     if (depth > 4) return;
     try {
-      const entries = readdirSync5(dir);
+      const entries = readdirSync6(dir);
       for (const entry of entries) {
         if (entry.startsWith(".") || entry === "Pods" || entry === "DerivedData" || entry === "build") continue;
         const fullPath = join6(dir, entry);
@@ -1646,12 +2597,111 @@ function detectAndroidFonts(rootDir) {
   }
   return fonts;
 }
+function detectExpoFonts(rootDir) {
+  const fonts = [];
+  const fontDirs = [
+    join6(rootDir, "assets/fonts"),
+    join6(rootDir, "src/assets/fonts"),
+    join6(rootDir, "assets")
+  ];
+  for (const dir of fontDirs) {
+    const fontFiles = scanForFontFiles(dir, 2);
+    for (const f of fontFiles) {
+      fonts.push(fontNameFromFile(f));
+    }
+  }
+  const jsFiles = findFiles(rootDir, [".ts", ".tsx", ".js", ".jsx"], 6);
+  for (const file of jsFiles.slice(0, 100)) {
+    const content = readFileSafe(file);
+    if (!content) continue;
+    const useFontsMatch = content.match(/useFonts\s*\(\s*\{([\s\S]*?)\}\s*\)/);
+    if (useFontsMatch) {
+      const block = useFontsMatch[1];
+      const keyMatches = block.matchAll(/['"`]([^'"`]+)['"`]\s*:/g);
+      for (const m of keyMatches) {
+        fonts.push(m[1]);
+      }
+    }
+    const loadAsyncMatch = content.match(/Font\.loadAsync\s*\(\s*\{([\s\S]*?)\}\s*\)/);
+    if (loadAsyncMatch) {
+      const block = loadAsyncMatch[1];
+      const keyMatches = block.matchAll(/['"`]([^'"`]+)['"`]\s*:/g);
+      for (const m of keyMatches) {
+        fonts.push(m[1]);
+      }
+    }
+    const familyMatches = content.matchAll(/fontFamily\s*:\s*['"]([^'"]+)['"]/g);
+    for (const m of familyMatches) {
+      fonts.push(m[1]);
+    }
+  }
+  const appJsonContent = readFileSafe(join6(rootDir, "app.json"));
+  if (appJsonContent) {
+    try {
+      const data = JSON.parse(appJsonContent);
+      const expoFonts = data.expo?.fonts || data.fonts;
+      if (Array.isArray(expoFonts)) {
+        for (const entry of expoFonts) {
+          if (typeof entry === "string") {
+            fonts.push(fontNameFromFile(entry));
+          } else if (entry?.name) {
+            fonts.push(entry.name);
+          } else if (entry?.path) {
+            fonts.push(fontNameFromFile(entry.path));
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  return fonts;
+}
+function detectMauiFonts(rootDir) {
+  const fonts = [];
+  const fontDirs = [
+    join6(rootDir, "Resources/Fonts"),
+    join6(rootDir, "Resources/Font")
+  ];
+  for (const dir of fontDirs) {
+    const fontFiles = scanForFontFiles(dir, 2);
+    for (const f of fontFiles) {
+      fonts.push(fontNameFromFile(f));
+    }
+  }
+  const csFiles = findFiles(rootDir, [".cs"], 4);
+  for (const file of csFiles.slice(0, 30)) {
+    const content = readFileSafe(file);
+    if (!content) continue;
+    if (!content.includes("AddFont")) continue;
+    const matches = content.matchAll(
+      /\.AddFont\s*\(\s*"([^"]+)"\s*,\s*"([^"]+)"\s*\)/g
+    );
+    for (const match of matches) {
+      fonts.push(match[2]);
+    }
+  }
+  const xamlFiles = findFiles(rootDir, [".xaml"], 5);
+  for (const file of xamlFiles.slice(0, 50)) {
+    const content = readFileSafe(file);
+    if (!content) continue;
+    const matches = content.matchAll(/FontFamily\s*=\s*"([^"]+)"/g);
+    for (const match of matches) {
+      const v = match[1];
+      if (v.startsWith("{") || v.includes(",")) continue;
+      fonts.push(v);
+    }
+  }
+  return fonts;
+}
 function detectFonts(rootDir, techStack) {
   let rawFonts;
   switch (techStack) {
     case "flutter":
       rawFonts = detectFlutterFonts(rootDir);
       break;
+    case "expo":
+      rawFonts = detectExpoFonts(rootDir);
+      break;
     case "react-native":
     case "capacitor":
       rawFonts = detectJSFonts(rootDir);
@@ -1660,9 +2710,11 @@ function detectFonts(rootDir, techStack) {
       rawFonts = detectSwiftFonts(rootDir);
       break;
     case "kotlin":
-    case "java":
       rawFonts = detectAndroidFonts(rootDir);
       break;
+    case "dotnet-maui":
+      rawFonts = detectMauiFonts(rootDir);
+      break;
     default:
       rawFonts = [];
   }
@@ -1681,8 +2733,8 @@ function detectFonts(rootDir, techStack) {
 }
 
 // src/analyzers/source-reader.ts
-import { readdirSync as readdirSync6, statSync as statSync4 } from "fs";
-import { join as join7, relative as relative2 } from "path";
+import { readdirSync as readdirSync7, statSync as statSync4 } from "fs";
+import { join as join7, relative as relative3 } from "path";
 var README_NAMES = [
   "README.md",
   "readme.md",
@@ -1728,7 +2780,7 @@ function readReadme(rootDir) {
   }
   return null;
 }
-function readSourceCode(rootDir, techStack, maxTotalChars = 5e4) {
+function readSourceFiles(rootDir, techStack, maxTotalChars = 5e4) {
   const extensions = getExtensionsForStack(techStack);
   const priorityPatterns = getPriorityPatternsForStack(techStack);
   const allFiles = scanDirectory(rootDir, {
@@ -1737,7 +2789,7 @@ function readSourceCode(rootDir, techStack, maxTotalChars = 5e4) {
     maxFiles: 500
   });
   const sorted = sortByPriority(allFiles, priorityPatterns);
-  const parts = [];
+  const files = [];
   let totalChars = 0;
   for (const file of sorted) {
     if (totalChars >= maxTotalChars) break;
@@ -1746,27 +2798,36 @@ function readSourceCode(rootDir, techStack, maxTotalChars = 5e4) {
     if (isTestFile(file)) continue;
     if (isGeneratedFile(file, content)) continue;
     const truncated = content.substring(0, 15e3);
-    parts.push(`--- ${file} ---
-${truncated}`);
+    files.push({ path: file, content: truncated });
     totalChars += truncated.length;
   }
-  return parts.join("\n\n");
+  return files;
+}
+function joinSourceFiles(files) {
+  return files.map((f) => `--- ${f.path} ---
+${f.content}`).join("\n\n");
+}
+function readSourceCode(rootDir, techStack, maxTotalChars = 5e4) {
+  return joinSourceFiles(readSourceFiles(rootDir, techStack, maxTotalChars));
 }
 function getExtensionsForStack(techStack) {
   switch (techStack) {
     case "flutter":
       return [".dart"];
     case "swift":
-      return [".swift"];
+      return [".swift", ".m", ".mm", ".h"];
     case "kotlin":
       return [".kt", ".kts"];
-    case "java":
-      return [".java"];
+    case "expo":
     case "react-native":
     case "capacitor":
       return [".ts", ".tsx", ".js", ".jsx"];
     case "dotnet-maui":
       return [".cs", ".xaml"];
+    case "unity":
+      return [".cs"];
+    case "kmp":
+      return [".kt", ".kts", ".swift"];
     default:
       return [".ts", ".js", ".swift", ".dart", ".kt"];
   }
@@ -1792,11 +2853,34 @@ function getPriorityPatternsForStack(techStack) {
     case "swift":
       return [...common, "view", "controller", "manager", "delegate", "contentview"];
     case "kotlin":
-    case "java":
-      return [...common, "activity", "fragment", "viewmodel", "repository"];
+      return [
+        ...common,
+        "activity",
+        "fragment",
+        "viewmodel",
+        "repository",
+        // Jetpack Compose deyimleri — Compose-first projelerde UI kodları
+        // bunlar olmadan priority listesinde aşağı sıralanıyordu
+        "composable",
+        "screen",
+        "theme",
+        "navigation",
+        "navgraph",
+        "scaffold",
+        "compose",
+        "material"
+      ];
+    case "expo":
+      return [...common, "screen", "component", "hook", "context", "store", "slice", "_layout", "tabs"];
     case "react-native":
     case "capacitor":
       return [...common, "screen", "component", "hook", "context", "store", "slice"];
+    case "dotnet-maui":
+      return [...common, "page", "view", "viewmodel", "service", "mauiprogram", "appshell"];
+    case "unity":
+      return [...common, "gamemanager", "main", "controller", "manager"];
+    case "kmp":
+      return [...common, "app", "mainactivity", "contentview", "viewmodel"];
     default:
       return common;
   }
@@ -1819,7 +2903,14 @@ function sortByPriority(files, patterns) {
 }
 function isTestFile(file) {
   const lower = file.toLowerCase();
-  return lower.includes("test") || lower.includes("spec") || lower.includes("mock") || lower.includes("fixture") || lower.includes("__tests__");
+  if (/(?:^|[/\\])(?:test|tests|__tests__|spec|specs|androidtest|mocks?|fixtures?)[/\\]/.test(
+    lower
+  )) {
+    return true;
+  }
+  if (/\.(?:test|spec|mock|fixture)\.[a-z]+$/.test(lower)) return true;
+  if (/(?:test|tests|spec|specs)\.[a-z]+$/.test(lower)) return true;
+  return false;
 }
 function isGeneratedFile(file, content) {
   const lower = file.toLowerCase();
@@ -1836,7 +2927,7 @@ function generateProjectTree(rootDir, maxDepth = 5, maxEntries = 300) {
     if (depth > maxDepth || entryCount >= maxEntries) return;
     let entries;
     try {
-      entries = readdirSync6(dir).sort((a, b) => {
+      entries = readdirSync7(dir).sort((a, b) => {
         const aIsDir = isDir(join7(dir, a));
         const bIsDir = isDir(join7(dir, b));
         if (aIsDir && !bIsDir) return -1;
@@ -1878,15 +2969,15 @@ function generateProjectTree(rootDir, maxDepth = 5, maxEntries = 300) {
       return false;
     }
   }
-  const rootName = relative2(join7(rootDir, ".."), rootDir) || "project";
+  const rootName = relative3(join7(rootDir, ".."), rootDir) || "project";
   lines.push(`${rootName}/`);
   walk(rootDir, "", 0);
   return lines.join("\n");
 }
 
 // src/analyzers/asset-scanner.ts
-import { readFileSync as readFileSync4, existsSync as existsSync5, readdirSync as readdirSync7, statSync as statSync5 } from "fs";
-import { join as join8, extname as extname3, relative as relative3, basename as basename2 } from "path";
+import { readFileSync as readFileSync4, existsSync as existsSync5, readdirSync as readdirSync8, statSync as statSync5 } from "fs";
+import { join as join8, extname as extname3, relative as relative4, basename as basename2 } from "path";
 var MAX_ASSET_SIZE = 5 * 1024 * 1024;
 var MAX_TOTAL_ASSETS = 10;
 var MAX_SCREENSHOTS = 5;
@@ -1917,7 +3008,7 @@ function tryReadImage(rootDir, filePath, assetType, minSize = MIN_ASSET_SIZE) {
       base64_data: buffer.toString("base64"),
       width: null,
       height: null,
-      source_path: relative3(rootDir, filePath)
+      source_path: relative4(rootDir, filePath)
     };
   } catch {
     return null;
@@ -1927,7 +3018,7 @@ function collectImagesRecursive(rootDir, dirPath, assetType, assets, maxCount, m
   if (currentDepth > maxDepth) return;
   if (!existsSync5(dirPath)) return;
   try {
-    const entries = readdirSync7(dirPath);
+    const entries = readdirSync8(dirPath);
     for (const entry of entries) {
       if (assets.filter((a) => a.asset_type === assetType).length >= maxCount) return;
       if (assets.length >= MAX_TOTAL_ASSETS) return;
@@ -1976,6 +3067,17 @@ function getScreenshotDirs(rootDir, techStack) {
         gen(join8(rootDir, "assets"))
       );
       break;
+    case "expo":
+      dirs.push(
+        ss(join8(rootDir, "assets/screenshots")),
+        ss(join8(rootDir, "src/assets/screenshots")),
+        ss(join8(rootDir, "docs/screenshots")),
+        gen(join8(rootDir, "assets/images")),
+        gen(join8(rootDir, "assets")),
+        gen(join8(rootDir, "src/assets/images")),
+        gen(join8(rootDir, "src/assets"))
+      );
+      break;
     case "react-native":
     case "capacitor":
       dirs.push(
@@ -1996,7 +3098,6 @@ function getScreenshotDirs(rootDir, techStack) {
       );
       break;
     case "kotlin":
-    case "java":
       dirs.push(
         ss(join8(rootDir, "fastlane/metadata/android/en-US/images/phoneScreenshots")),
         gen(join8(rootDir, "metadata/android/en-US/images")),
@@ -2004,6 +3105,15 @@ function getScreenshotDirs(rootDir, techStack) {
         gen(join8(rootDir, "Marketing"))
       );
       break;
+    case "dotnet-maui":
+      dirs.push(
+        ss(join8(rootDir, "Resources/Images/screenshots")),
+        ss(join8(rootDir, "Resources/Screenshots")),
+        gen(join8(rootDir, "Resources/Images")),
+        gen(join8(rootDir, "marketing")),
+        gen(join8(rootDir, "Marketing"))
+      );
+      break;
   }
   return dirs;
 }
@@ -2030,6 +3140,31 @@ function getSplashPaths(rootDir, techStack) {
         );
       }
       break;
+    case "expo":
+      paths.push(
+        join8(rootDir, "assets/splash.png"),
+        join8(rootDir, "assets/splash-icon.png"),
+        join8(rootDir, "assets/images/splash.png"),
+        join8(rootDir, "assets/images/splash-icon.png"),
+        join8(rootDir, "src/assets/splash.png")
+      );
+      const expoSplashContent = readFileSafe(join8(rootDir, "app.json"));
+      if (expoSplashContent) {
+        try {
+          const data = JSON.parse(expoSplashContent);
+          const expo = data.expo || data;
+          const candidates = [
+            expo.splash?.image,
+            expo.android?.splash?.image,
+            expo.ios?.splash?.image
+          ].filter((v) => typeof v === "string");
+          for (const rel of candidates) {
+            paths.push(join8(rootDir, rel.replace(/^\.?\//, "")));
+          }
+        } catch {
+        }
+      }
+      break;
     case "react-native":
     case "capacitor":
       paths.push(
@@ -2040,7 +3175,6 @@ function getSplashPaths(rootDir, techStack) {
       );
       break;
     case "kotlin":
-    case "java":
       for (const density of ["xxxhdpi", "xxhdpi", "xhdpi"]) {
         paths.push(
           join8(rootDir, `app/src/main/res/drawable-${density}/splash.png`),
@@ -2048,6 +3182,14 @@ function getSplashPaths(rootDir, techStack) {
         );
       }
       break;
+    case "dotnet-maui":
+      paths.push(
+        join8(rootDir, "Resources/Splash/splash.png"),
+        join8(rootDir, "Resources/Splash/splashscreen.png"),
+        join8(rootDir, "Resources/Splash/splash.svg"),
+        join8(rootDir, "Resources/Images/splash.png")
+      );
+      break;
   }
   return paths;
 }
@@ -2060,19 +3202,26 @@ function getFeatureGraphicPaths(rootDir, techStack) {
   );
   switch (techStack) {
     case "flutter":
+    case "expo":
     case "react-native":
     case "capacitor":
       paths.push(
         join8(rootDir, "assets/feature_graphic.png"),
-        join8(rootDir, "assets/feature-graphic.png")
+        join8(rootDir, "assets/feature-graphic.png"),
+        join8(rootDir, "assets/images/feature_graphic.png")
       );
       break;
     case "kotlin":
-    case "java":
       paths.push(
         join8(rootDir, "app/src/main/feature_graphic.png")
       );
       break;
+    case "dotnet-maui":
+      paths.push(
+        join8(rootDir, "Resources/Images/feature_graphic.png"),
+        join8(rootDir, "Resources/Images/feature-graphic.png")
+      );
+      break;
   }
   return paths;
 }
@@ -2478,7 +3627,7 @@ async function uploadAssetsToStorage(client, rootDir, assets, appIconPath) {
             mime_type: mimeForPath(appIconPath),
             width: null,
             height: null,
-            source_path: relative4(rootDir, appIconPath)
+            source_path: relative5(rootDir, appIconPath)
           },
           buffer
         });
@@ -2607,7 +3756,7 @@ async function analyzeCommand(options) {
   if (techStack.stack === "unknown") {
     techSpinner.fail(
       chalk.red(
-        "No supported project found. Supported: Swift, Flutter, React Native, Kotlin, Capacitor, .NET MAUI"
+        "No supported project found. Supported: Swift, Flutter, React Native, Expo, Kotlin, Capacitor, .NET MAUI"
       )
     );
     process.exit(1);
@@ -3019,20 +4168,1584 @@ import { createInterface as createInterface2 } from "readline";
 import chalk3 from "chalk";
 import ora2 from "ora";
 
-// src/review/feature-detector.ts
-function getFeatureDiscoveryPrompt() {
-  return `You are an expert app analyst. Your job is to understand WHAT an app does from the USER's perspective by reading its source code. You are NOT reviewing code quality.
+// src/engine/index.ts
+import { join as join14 } from "path";
 
-Respond in English.
+// src/engine/registry.ts
+var ECOSYSTEM_KEYS = [
+  "npm",
+  "pub",
+  "pods",
+  "spm",
+  "gradle",
+  "nuget",
+  "upm",
+  "ios_imports",
+  "android_imports"
+];
+function matchDefault(pattern, dep, caseInsensitive) {
+  const p = caseInsensitive ? pattern.toLowerCase() : pattern;
+  const d = caseInsensitive ? dep.toLowerCase() : dep;
+  if (p.endsWith("*")) return d.startsWith(p.slice(0, -1));
+  return d === p;
+}
+function matchGradle(pattern, dep) {
+  if (pattern.endsWith("*")) {
+    const prefix = pattern.slice(0, -1);
+    if (prefix === "") return false;
+    if (prefix.includes(":")) return dep.startsWith(prefix);
+    if (!dep.includes(":")) return dep.startsWith(prefix);
+    const idx2 = dep.lastIndexOf(":");
+    return dep.slice(idx2 + 1).startsWith(prefix);
+  }
+  if (pattern.includes(":")) return dep === pattern;
+  if (dep === pattern) return true;
+  const idx = dep.lastIndexOf(":");
+  return idx >= 0 && dep.slice(idx + 1) === pattern;
+}
+function matchImportPrefix(pattern, dep) {
+  return dep === pattern || dep.startsWith(`${pattern}.`);
+}
+function ecosystemMatches(key, pattern, dep) {
+  switch (key) {
+    case "gradle":
+      return matchGradle(pattern, dep);
+    case "ios_imports":
+    case "android_imports":
+      return matchImportPrefix(pattern, dep);
+    case "pods":
+    case "spm":
+      return matchDefault(pattern, dep, true);
+    default:
+      return matchDefault(pattern, dep, false);
+  }
+}
+function matchSDKs(deps, registry) {
+  const results = [];
+  for (const entry of registry) {
+    const coordinates = /* @__PURE__ */ new Set();
+    for (const key of ECOSYSTEM_KEYS) {
+      const patterns = entry.match[key];
+      if (!patterns || patterns.length === 0) continue;
+      const bucket = deps[key];
+      if (!bucket || bucket.length === 0) continue;
+      for (const pattern of patterns) {
+        for (const dep of bucket) {
+          if (ecosystemMatches(key, pattern, dep)) {
+            coordinates.add(`${key}:${dep}`);
+          }
+        }
+      }
+    }
+    if (coordinates.size > 0) {
+      results.push({
+        id: entry.id,
+        name: entry.name,
+        category: entry.category,
+        matched_coordinates: Array.from(coordinates).sort(),
+        data_collection: entry.data_collection,
+        flags: entry.flags
+      });
+    }
+  }
+  return results.sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+}
 
-Answer this question: "If someone downloads this app and opens it on their iPhone, what will they see and experience?"
+// src/engine/extractors/ios-plist.ts
+import { join as join9, relative as relative6 } from "path";
+import plistLib from "plist";
 
-Analyze the source code and identify:
+// src/engine/extractors/shared.ts
+var EXTENSION_SUFFIXES2 = [
+  "Extension",
+  "Widget",
+  "WidgetExtension",
+  "Intent",
+  "IntentExtension",
+  "NotificationService",
+  "NotificationContent",
+  "ShieldConfiguration",
+  "ShieldConfigurationExtension",
+  "ShieldAction",
+  "ShieldActionExtension",
+  "WatchKit",
+  "Watch",
+  "Clip",
+  "Tests",
+  "UITests",
+  "StickerPack",
+  "ShareExtension",
+  "TodayExtension",
+  "KeyboardExtension"
+];
+function isExtensionPath(relPath) {
+  const segments = relPath.split(/[\\/]/);
+  return segments.some((segment, idx) => {
+    if (idx === segments.length - 1) return false;
+    if (!segment) return false;
+    return EXTENSION_SUFFIXES2.some(
+      (suffix) => segment.endsWith(suffix) || segment.toLowerCase().endsWith(suffix.toLowerCase())
+    );
+  });
+}
+function isXcodeVariable2(value) {
+  return typeof value === "string" && (value.includes("$(") || value.includes("${"));
+}
+function normalizeStringValue(value) {
+  if (typeof value !== "string") return null;
+  if (value.length === 0) return null;
+  if (isXcodeVariable2(value)) return null;
+  return value;
+}
+function parsePlistBoolean(value) {
+  if (typeof value === "boolean") return value;
+  if (typeof value === "string") {
+    const normalized = value.trim().toLowerCase();
+    if (normalized === "yes" || normalized === "true" || normalized === "1") return true;
+    if (normalized === "no" || normalized === "false" || normalized === "0") return false;
+  }
+  return null;
+}
+function pathDepth(relPath) {
+  return relPath.split(/[\\/]/).length;
+}
 
-1. **App Purpose**: What does this app do? (1-2 sentences)
-2. **User Flows**: What are the main things a user can do? (list each)
-3. **Onboarding**: What happens when you first open the app? Login required? Permissions asked immediately?
-4. **Monetization**: How does the app make money? Subscriptions? IAP? Ads? External payments? Free?
+// src/engine/extractors/ios-plist.ts
+var NAMED_FIELD_KEYS = /* @__PURE__ */ new Set([
+  "UIBackgroundModes",
+  "NSAppTransportSecurity",
+  "GADApplicationIdentifier",
+  "SKAdNetworkItems",
+  "ITSAppUsesNonExemptEncryption",
+  "UIRequiredDeviceCapabilities"
+]);
+function findMainInfoPlist(rootDir) {
+  const candidates = findAllFiles(rootDir, "Info.plist", 4);
+  const nonExtension = candidates.filter(
+    (abs) => !isExtensionPath(relative6(rootDir, abs))
+  );
+  if (nonExtension.length === 0) return null;
+  return [...nonExtension].sort(
+    (a, b) => pathDepth(relative6(rootDir, a)) - pathDepth(relative6(rootDir, b))
+  )[0];
+}
+function readInfoPlistFile(filePath) {
+  const content = readFileSafe(filePath);
+  if (!content) return null;
+  try {
+    const parsed = plistLib.parse(content);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function readPbxprojInfoplistKeys(content) {
+  const keys = {};
+  const keyPattern = /INFOPLIST_KEY_([A-Za-z0-9_]+)\s*=\s*"?([^";]+)"?;/g;
+  for (const match of content.matchAll(keyPattern)) {
+    keys[match[1]] = match[2].trim();
+  }
+  const generatesInfoPlist = /GENERATE_INFOPLIST_FILE\s*=\s*YES/.test(content);
+  return { keys, generatesInfoPlist };
+}
+function findExpoGadAppId(appJson) {
+  const asRecord = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : null;
+  const asId = (v) => typeof v === "string" && v.length > 0 ? v : null;
+  const root = asRecord(appJson);
+  if (!root) return null;
+  const expo = asRecord(root.expo);
+  const legacy = asId(asRecord(asRecord(expo?.ios)?.config)?.googleMobileAdsAppId);
+  if (legacy) return legacy;
+  const rnTop = asId(asRecord(root["react-native-google-mobile-ads"])?.ios_app_id);
+  if (rnTop) return rnTop;
+  const plugins = expo?.plugins;
+  if (Array.isArray(plugins)) {
+    for (const entry of plugins) {
+      if (!Array.isArray(entry) || entry[0] !== "react-native-google-mobile-ads") continue;
+      const props = asRecord(entry[1]);
+      const id = asId(props?.iosAppId) ?? asId(props?.ios_app_id);
+      if (id) return id;
+    }
+  }
+  return null;
+}
+function readExpoConfigFallback(content) {
+  const found = {};
+  for (const m of content.matchAll(
+    /(NS[A-Za-z]+UsageDescription)\s*:\s*["']([^"']*)["']/g
+  )) {
+    found[m[1]] = m[2];
+  }
+  const gad = content.match(/GADApplicationIdentifier\s*:\s*["']([^"']*)["']/);
+  if (gad) found.GADApplicationIdentifier = gad[1];
+  return found;
+}
+function extractPlistFields(merged) {
+  const usageDescriptions = {};
+  for (const key of Object.keys(merged)) {
+    if (/UsageDescription$/.test(key)) {
+      usageDescriptions[key] = normalizeStringValue(merged[key]);
+    }
+  }
+  const backgroundModes = Array.isArray(merged.UIBackgroundModes) ? merged.UIBackgroundModes.filter((v) => typeof v === "string") : [];
+  let atsAllowsArbitraryLoads = null;
+  const ats = merged.NSAppTransportSecurity;
+  if (ats && typeof ats === "object" && !Array.isArray(ats)) {
+    const atsDict = ats;
+    if ("NSAllowsArbitraryLoads" in atsDict) {
+      atsAllowsArbitraryLoads = parsePlistBoolean(atsDict.NSAllowsArbitraryLoads);
+    }
+  }
+  const skAdNetworkCount = Array.isArray(merged.SKAdNetworkItems) ? merged.SKAdNetworkItems.length : 0;
+  const requiredDeviceCapabilities = Array.isArray(merged.UIRequiredDeviceCapabilities) ? merged.UIRequiredDeviceCapabilities.filter((v) => typeof v === "string") : [];
+  const otherKeys = Array.from(
+    new Set(
+      Object.keys(merged).filter(
+        (k) => !NAMED_FIELD_KEYS.has(k) && !/UsageDescription$/.test(k)
+      )
+    )
+  ).sort();
+  const fields = {
+    usage_descriptions: usageDescriptions,
+    background_modes: backgroundModes,
+    ats_allows_arbitrary_loads: atsAllowsArbitraryLoads,
+    sk_ad_network_count: skAdNetworkCount,
+    required_device_capabilities: requiredDeviceCapabilities,
+    other_keys: otherKeys
+  };
+  if ("GADApplicationIdentifier" in merged) {
+    fields.gad_application_identifier = normalizeStringValue(merged.GADApplicationIdentifier);
+  }
+  if ("ITSAppUsesNonExemptEncryption" in merged) {
+    fields.non_exempt_encryption = parsePlistBoolean(merged.ITSAppUsesNonExemptEncryption);
+  }
+  return fields;
+}
+function extractIosPlist(rootDir) {
+  const evidence = {};
+  const plistFilePath = findMainInfoPlist(rootDir);
+  const plistFileData = plistFilePath ? readInfoPlistFile(plistFilePath) : null;
+  if (plistFilePath && plistFileData) {
+    evidence["ios.plist.plist_file"] = { file: relative6(rootDir, plistFilePath) };
+  }
+  const pbxprojPath = findFile(rootDir, "project.pbxproj", 5);
+  let pbxprojData = null;
+  if (pbxprojPath) {
+    const content = readFileSafe(pbxprojPath);
+    if (content) {
+      const { keys, generatesInfoPlist } = readPbxprojInfoplistKeys(content);
+      if (Object.keys(keys).length > 0 || generatesInfoPlist) {
+        pbxprojData = keys;
+        evidence["ios.plist.pbxproj_infoplist_keys"] = {
+          file: relative6(rootDir, pbxprojPath),
+          detail: generatesInfoPlist ? "GENERATE_INFOPLIST_FILE = YES" : void 0
+        };
+      }
+    }
+  }
+  let expoData = null;
+  const appJsonContent = readFileSafe(join9(rootDir, "app.json"));
+  if (appJsonContent) {
+    try {
+      const appJson = JSON.parse(appJsonContent);
+      const infoPlist = appJson?.expo?.ios?.infoPlist;
+      if (infoPlist && typeof infoPlist === "object" && !Array.isArray(infoPlist)) {
+        expoData = { ...infoPlist };
+        if (!("GADApplicationIdentifier" in expoData)) {
+          const gadId = findExpoGadAppId(appJson);
+          if (gadId !== null) expoData.GADApplicationIdentifier = gadId;
+        }
+        evidence["ios.plist.expo_config"] = { file: "app.json" };
+      }
+    } catch {
+    }
+  }
+  if (!expoData) {
+    for (const name of ["app.config.ts", "app.config.js"]) {
+      const content = readFileSafe(join9(rootDir, name));
+      if (!content) continue;
+      const found = readExpoConfigFallback(content);
+      if (Object.keys(found).length > 0) {
+        expoData = found;
+        evidence["ios.plist.expo_config"] = {
+          file: name,
+          detail: "best-effort regex extraction (app.config.js/ts)"
+        };
+      }
+      break;
+    }
+  }
+  const contributing = [];
+  if (expoData) contributing.push("expo_config");
+  if (pbxprojData) contributing.push("pbxproj_infoplist_keys");
+  if (plistFileData) contributing.push("plist_file");
+  if (contributing.length === 0) {
+    return { plist_source: "none", plist: null, evidence };
+  }
+  const merged = {
+    ...expoData ?? {},
+    ...pbxprojData ?? {},
+    ...plistFileData ?? {}
+  };
+  return {
+    plist_source: contributing.length > 1 ? "merged" : contributing[0],
+    plist: extractPlistFields(merged),
+    evidence
+  };
+}
+
+// src/engine/extractors/ios-entitlements.ts
+import { relative as relative7 } from "path";
+import plistLib2 from "plist";
+function extractIosEntitlements(rootDir) {
+  const evidence = {};
+  const allFiles = findFiles(rootDir, [".entitlements"], 5);
+  if (allFiles.length === 0) {
+    return { entitlements: null, evidence };
+  }
+  const nonExtensionFiles = allFiles.filter(
+    (abs) => !isExtensionPath(relative7(rootDir, abs))
+  );
+  const usedExtensionOnly = nonExtensionFiles.length === 0;
+  const files = (usedExtensionOnly ? allFiles : nonExtensionFiles).sort();
+  let apsEnvironment = null;
+  const associatedDomains = /* @__PURE__ */ new Set();
+  let healthkit = false;
+  let signInWithApple = false;
+  const appGroups = /* @__PURE__ */ new Set();
+  const keys = /* @__PURE__ */ new Set();
+  for (const file of files) {
+    const content = readFileSafe(file);
+    if (!content) continue;
+    let parsed;
+    try {
+      const value = plistLib2.parse(content);
+      if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+      parsed = value;
+    } catch {
+      continue;
+    }
+    for (const key of Object.keys(parsed)) keys.add(key);
+    if (apsEnvironment === null) {
+      const aps = parsed["aps-environment"];
+      if (typeof aps === "string" && aps.length > 0) apsEnvironment = aps;
+    }
+    const domains = parsed["com.apple.developer.associated-domains"];
+    if (Array.isArray(domains)) {
+      for (const d of domains) if (typeof d === "string") associatedDomains.add(d);
+    }
+    if (parsed["com.apple.developer.healthkit"]) healthkit = true;
+    const appleSignIn = parsed["com.apple.developer.applesignin"];
+    if (Array.isArray(appleSignIn) && appleSignIn.length > 0) signInWithApple = true;
+    const groups = parsed["com.apple.security.application-groups"];
+    if (Array.isArray(groups)) {
+      for (const g of groups) if (typeof g === "string") appGroups.add(g);
+    }
+  }
+  evidence["ios.entitlements"] = {
+    file: files.map((f) => relative7(rootDir, f)).join(", "),
+    detail: usedExtensionOnly ? `${files.length} extension-target entitlements file(s) - no main-target entitlements found` : `${files.length} entitlements file(s) merged`
+  };
+  return {
+    entitlements: {
+      aps_environment: apsEnvironment,
+      associated_domains: Array.from(associatedDomains).sort(),
+      healthkit,
+      sign_in_with_apple: signInWithApple,
+      app_groups: Array.from(appGroups).sort(),
+      keys: Array.from(keys).sort()
+    },
+    evidence
+  };
+}
+
+// src/engine/extractors/ios-privacy-manifest.ts
+import { relative as relative8 } from "path";
+import plistLib3 from "plist";
+function emptyPrivacyManifest() {
+  return {
+    app_manifest_present: false,
+    collected_data_types: [],
+    accessed_api_types: [],
+    tracking: null,
+    tracking_domains: [],
+    sdk_manifests_found: 0
+  };
+}
+function extractIosPrivacyManifest(rootDir) {
+  const evidence = {};
+  const allFiles = findAllFiles(rootDir, "PrivacyInfo.xcprivacy", 6);
+  if (allFiles.length === 0) {
+    return { privacy_manifest: emptyPrivacyManifest(), evidence };
+  }
+  const sorted = [...allFiles].sort(
+    (a, b) => pathDepth(relative8(rootDir, a)) - pathDepth(relative8(rootDir, b))
+  );
+  const appManifestPath = sorted[0];
+  const otherCount = sorted.length - 1;
+  evidence["ios.privacy_manifest"] = { file: relative8(rootDir, appManifestPath) };
+  if (otherCount > 0) {
+    evidence["ios.privacy_manifest.sdk_manifests_found"] = {
+      file: sorted.slice(1).map((f) => relative8(rootDir, f)).join(", "),
+      detail: `${otherCount} other .xcprivacy file(s) visible in the scanned tree`
+    };
+  }
+  const content = readFileSafe(appManifestPath);
+  let parsed = null;
+  if (content) {
+    try {
+      const value = plistLib3.parse(content);
+      if (value && typeof value === "object" && !Array.isArray(value)) {
+        parsed = value;
+      }
+    } catch {
+      parsed = null;
+    }
+  }
+  if (!parsed) {
+    return {
+      privacy_manifest: { ...emptyPrivacyManifest(), app_manifest_present: true, sdk_manifests_found: otherCount },
+      evidence
+    };
+  }
+  const collectedDataTypes = [];
+  if (Array.isArray(parsed.NSPrivacyCollectedDataTypes)) {
+    for (const entry of parsed.NSPrivacyCollectedDataTypes) {
+      if (entry && typeof entry === "object") {
+        const type = entry.NSPrivacyCollectedDataType;
+        if (typeof type === "string") collectedDataTypes.push(type);
+      }
+    }
+  }
+  const accessedApiTypes = [];
+  if (Array.isArray(parsed.NSPrivacyAccessedAPITypes)) {
+    for (const entry of parsed.NSPrivacyAccessedAPITypes) {
+      if (entry && typeof entry === "object") {
+        const type = entry.NSPrivacyAccessedAPIType;
+        if (typeof type === "string") accessedApiTypes.push(type);
+      }
+    }
+  }
+  const tracking = "NSPrivacyTracking" in parsed ? Boolean(parsed.NSPrivacyTracking) : null;
+  const trackingDomains = Array.isArray(parsed.NSPrivacyTrackingDomains) ? parsed.NSPrivacyTrackingDomains.filter((v) => typeof v === "string") : [];
+  return {
+    privacy_manifest: {
+      app_manifest_present: true,
+      collected_data_types: collectedDataTypes,
+      accessed_api_types: accessedApiTypes,
+      tracking,
+      tracking_domains: trackingDomains,
+      sdk_manifests_found: otherCount
+    },
+    evidence
+  };
+}
+
+// src/engine/extractors/android-manifest.ts
+import { join as join10, relative as relative9 } from "path";
+var EXCLUDED_SEGMENTS = /* @__PURE__ */ new Set(["build", "test", "androidTest", "debug"]);
+function isExcludedManifestPath(relPath) {
+  return relPath.split(/[\\/]/).some((segment) => EXCLUDED_SEGMENTS.has(segment));
+}
+function findMainManifest(rootDir) {
+  const knownCandidates = [
+    join10(rootDir, "app/src/main/AndroidManifest.xml"),
+    join10(rootDir, "android/app/src/main/AndroidManifest.xml"),
+    join10(rootDir, "src/main/AndroidManifest.xml")
+  ];
+  for (const candidate of knownCandidates) {
+    if (fileExists(candidate)) return candidate;
+  }
+  const found = findAllFiles(rootDir, "AndroidManifest.xml", 5).filter(
+    (abs) => !isExcludedManifestPath(relative9(rootDir, abs))
+  );
+  if (found.length === 0) return null;
+  return [...found].sort(
+    (a, b) => relative9(rootDir, a).split(/[\\/]/).length - relative9(rootDir, b).split(/[\\/]/).length
+  )[0];
+}
+function extractPermissions(content) {
+  const permissions = /* @__PURE__ */ new Set();
+  const tagPattern = /<uses-permission(?:-sdk-23)?\b[^>]*>/g;
+  const nameAttrPattern = /android:name\s*=\s*"([^"]+)"/;
+  for (const tagMatch of content.matchAll(tagPattern)) {
+    const nameMatch = tagMatch[0].match(nameAttrPattern);
+    if (nameMatch) permissions.add(nameMatch[1]);
+  }
+  return Array.from(permissions).sort();
+}
+function extractAndroidManifest(rootDir) {
+  const evidence = {};
+  const manifestPath = findMainManifest(rootDir);
+  if (!manifestPath) {
+    return {
+      android: {
+        manifest_found: false,
+        permissions: [],
+        exported_components: 0,
+        queries_declared: false
+      },
+      evidence
+    };
+  }
+  const content = readFileSafe(manifestPath);
+  if (!content) {
+    return {
+      android: {
+        manifest_found: false,
+        permissions: [],
+        exported_components: 0,
+        queries_declared: false
+      },
+      evidence
+    };
+  }
+  evidence["android.manifest"] = { file: relative9(rootDir, manifestPath) };
+  const permissions = extractPermissions(content);
+  const exportedComponents = (content.match(/android:exported\s*=\s*"true"/g) ?? []).length;
+  const queriesDeclared = /<queries[\s>]/.test(content);
+  return {
+    android: {
+      manifest_found: true,
+      permissions,
+      exported_components: exportedComponents,
+      queries_declared: queriesDeclared
+    },
+    evidence
+  };
+}
+
+// src/engine/extractors/gradle-targets.ts
+import { join as join11, relative as relative10 } from "path";
+function candidateGradleFiles(rootDir) {
+  const candidates = [];
+  const add = (p) => {
+    if (p && !candidates.includes(p)) candidates.push(p);
+  };
+  add(findFile(join11(rootDir, "app"), "build.gradle", 2));
+  add(findFile(join11(rootDir, "app"), "build.gradle.kts", 2));
+  add(findFile(join11(rootDir, "android/app"), "build.gradle", 2));
+  add(findFile(join11(rootDir, "android/app"), "build.gradle.kts", 2));
+  add(findFile(rootDir, "build.gradle", 1));
+  add(findFile(rootDir, "build.gradle.kts", 1));
+  for (const f of findFiles(rootDir, ["build.gradle", "build.gradle.kts"], 4)) {
+    add(f);
+  }
+  return candidates;
+}
+function extractIntSetting(content, name) {
+  const pattern = new RegExp(`\\b${name}(?:Version)?\\s*(?:=)?\\s*(\\d+)`);
+  const match = content.match(pattern);
+  return match ? parseInt(match[1], 10) : null;
+}
+function extractGradleTargets(rootDir) {
+  const evidence = {};
+  let targetAndroidSdk = null;
+  let compileSdk = null;
+  let minAndroidSdk = null;
+  let usedFile = null;
+  for (const filePath of candidateGradleFiles(rootDir)) {
+    const content = readFileSafe(filePath);
+    if (!content) continue;
+    const target = extractIntSetting(content, "targetSdk");
+    const compile = extractIntSetting(content, "compileSdk");
+    const min = extractIntSetting(content, "minSdk");
+    if (target === null && compile === null && min === null) continue;
+    if (targetAndroidSdk === null && target !== null) targetAndroidSdk = target;
+    if (compileSdk === null && compile !== null) compileSdk = compile;
+    if (minAndroidSdk === null && min !== null) minAndroidSdk = min;
+    if (usedFile === null) usedFile = filePath;
+    if (targetAndroidSdk !== null && compileSdk !== null && minAndroidSdk !== null) break;
+  }
+  if (usedFile) {
+    evidence["android.gradle"] = { file: relative10(rootDir, usedFile) };
+  }
+  return {
+    target_android_sdk: targetAndroidSdk,
+    compile_sdk: compileSdk,
+    min_android_sdk: minAndroidSdk,
+    evidence
+  };
+}
+
+// src/engine/extractors/unity.ts
+import { join as join12 } from "path";
+import YAML3 from "yaml";
+var PROJECT_SETTINGS_REL = join12("ProjectSettings", "ProjectSettings.asset");
+function toPlainYaml(raw) {
+  return raw.split("\n").filter((line) => !line.startsWith("%")).map((line) => /^---\s*!u!/.test(line) ? "---" : line).join("\n");
+}
+function regexFallbackAppIds(raw) {
+  const idx = raw.indexOf("applicationIdentifier:");
+  if (idx < 0) return { ios: null, android: null };
+  const after = raw.slice(idx + "applicationIdentifier:".length);
+  const nextSiblingKey = after.search(/\n {0,2}\S/);
+  const block = nextSiblingKey >= 0 ? after.slice(0, nextSiblingKey) : after;
+  const iphone = block.match(/iPhone:\s*(\S+)/);
+  const android = block.match(/Android:\s*(\S+)/);
+  return {
+    ios: iphone ? iphone[1].trim() : null,
+    android: android ? android[1].trim() : null
+  };
+}
+function extractUnityProjectSettings(rootDir) {
+  const filePath = join12(rootDir, "ProjectSettings", "ProjectSettings.asset");
+  const raw = readFileSafe(filePath);
+  if (raw === null) return null;
+  const evidence = {
+    "unity.project_settings": { file: PROJECT_SETTINGS_REL }
+  };
+  let ios = null;
+  let android = null;
+  let version = null;
+  let productName = null;
+  try {
+    const parsed = YAML3.parse(toPlainYaml(raw));
+    const player = parsed?.PlayerSettings;
+    if (player && typeof player === "object") {
+      const appId = player.applicationIdentifier;
+      if (appId && typeof appId === "object") {
+        ios = typeof appId.iPhone === "string" ? appId.iPhone : null;
+        android = typeof appId.Android === "string" ? appId.Android : null;
+      }
+      version = typeof player.bundleVersion === "string" ? player.bundleVersion : null;
+      productName = typeof player.productName === "string" ? player.productName : null;
+    }
+  } catch {
+    const fallback = regexFallbackAppIds(raw);
+    ios = fallback.ios;
+    android = fallback.android;
+    evidence["unity.project_settings"] = {
+      file: PROJECT_SETTINGS_REL,
+      detail: "regex fallback (malformed YAML)"
+    };
+  }
+  return {
+    bundle_id: ios ?? android ?? null,
+    bundle_ids: { ios, android },
+    app_version: version,
+    product_name: productName,
+    evidence
+  };
+}
+
+// src/engine/extractors/kmp.ts
+import { readdirSync as readdirSync9, statSync as statSync7, existsSync as existsSync6 } from "fs";
+import { join as join13 } from "path";
+function containsXcodeproj(dir, maxDepth) {
+  function walk(current, depth) {
+    let entries;
+    try {
+      entries = readdirSync9(current);
+    } catch {
+      return false;
+    }
+    for (const entry of entries) {
+      const full = join13(current, entry);
+      let isDirectory = false;
+      try {
+        isDirectory = statSync7(full).isDirectory();
+      } catch {
+        continue;
+      }
+      if (!isDirectory) continue;
+      if (entry.endsWith(".xcodeproj")) return true;
+      if (depth < maxDepth && walk(full, depth + 1)) return true;
+    }
+    return false;
+  }
+  return walk(dir, 0);
+}
+var ANDROID_APPLICATION_MODULE_RE = /applicationId\b|com\.android\.application/;
+var KMP_PLUGIN_MARKER_RE2 = /kotlin\(\s*["']multiplatform["']\s*\)|id\(\s*["']org\.jetbrains\.kotlin\.multiplatform["']\s*\)|kotlinMultiplatform/;
+function readModuleGradle(moduleDir) {
+  return readFileSafe(join13(moduleDir, "build.gradle.kts")) ?? readFileSafe(join13(moduleDir, "build.gradle"));
+}
+function findKmpLayout(rootDir) {
+  let iosAppDir = null;
+  const iosAppCandidate = join13(rootDir, "iosApp");
+  if (existsSync6(iosAppCandidate)) {
+    const hasXcodeproj = containsXcodeproj(iosAppCandidate, 3);
+    const hasInfoPlist = findFile(iosAppCandidate, "Info.plist", 3) !== null;
+    if (hasXcodeproj || hasInfoPlist) iosAppDir = iosAppCandidate;
+  }
+  let androidModuleDir = null;
+  for (const name of ["androidApp", "composeApp", "app"]) {
+    const candidate = join13(rootDir, name);
+    const content = readModuleGradle(candidate);
+    if (content && ANDROID_APPLICATION_MODULE_RE.test(content)) {
+      androidModuleDir = candidate;
+      break;
+    }
+  }
+  let sharedDir = null;
+  try {
+    const entries = [...readdirSync9(rootDir)].sort();
+    for (const entry of entries) {
+      const candidate = join13(rootDir, entry);
+      let isDirectory = false;
+      try {
+        isDirectory = statSync7(candidate).isDirectory();
+      } catch {
+        continue;
+      }
+      if (!isDirectory) continue;
+      const content = readModuleGradle(candidate);
+      if (content && KMP_PLUGIN_MARKER_RE2.test(content)) {
+        sharedDir = candidate;
+        break;
+      }
+    }
+  } catch {
+  }
+  return { iosAppDir, androidModuleDir, sharedDir };
+}
+
+// src/engine/profile-builder.ts
+var RESTORE_RE = /restorePurchases|restoreCompletedTransactions|restoreTransactions|queryPurchasesAsync|\brestore\s*\(\s*\)/;
+var ACCOUNT_DELETION_RE = /deleteAccount|removeAccount|deleteUser|closeAccount|account.{0,20}delet/i;
+var ACCOUNT_CREATION_RE = /createAccount|createUser|signUp|register(?:User|Account|WithEmail)/;
+var PRIVACY_POLICY_RE = /privacy[\s_-]?policy/i;
+var EXTERNAL_CHECKOUT_RE = /checkout\.stripe\.com|buy\.stripe\.com|paypal\.com|lemonsqueezy|gumroad|paddle\.com/i;
+var WEBVIEW_RE = /WKWebView|UIWebView|webview_flutter|react-native-webview|InAppWebView|android\.webkit\.WebView/;
+function round2(n) {
+  return Math.round(n * 100) / 100;
+}
+function scanSourceSignals(input) {
+  let restore = false;
+  let deletion = false;
+  let creation = false;
+  let privacyPolicy = false;
+  let externalCheckout = false;
+  let webviewFiles = 0;
+  let sourceChars = 0;
+  for (const { content } of input.files) {
+    sourceChars += content.length;
+    if (!restore && RESTORE_RE.test(content)) restore = true;
+    if (!deletion && ACCOUNT_DELETION_RE.test(content)) deletion = true;
+    if (!creation && ACCOUNT_CREATION_RE.test(content)) creation = true;
+    if (!privacyPolicy && PRIVACY_POLICY_RE.test(content)) privacyPolicy = true;
+    if (!externalCheckout && EXTERNAL_CHECKOUT_RE.test(content)) externalCheckout = true;
+    if (WEBVIEW_RE.test(content)) webviewFiles += 1;
+  }
+  const scannedFiles = input.files.length;
+  return {
+    restore_purchases_found: restore,
+    account_deletion_found: deletion,
+    privacy_policy_link_found: privacyPolicy,
+    external_checkout_url_found: externalCheckout,
+    webview_ratio: round2(webviewFiles / Math.max(scannedFiles, 1)),
+    account_creation_found: creation,
+    webview_files: webviewFiles,
+    scanned_files: scannedFiles,
+    source_chars: sourceChars
+  };
+}
+function permissionShortName(permission) {
+  const idx = permission.lastIndexOf(".");
+  return idx >= 0 ? permission.slice(idx + 1) : permission;
+}
+function sdkOriginFile(coordinate, stack) {
+  const ecosystem = coordinate.slice(0, coordinate.indexOf(":"));
+  switch (ecosystem) {
+    case "npm":
+      return "package.json";
+    case "pub":
+      return "pubspec.yaml";
+    case "pods":
+      return stack === "swift" ? "Podfile" : "ios/Podfile";
+    case "spm":
+      return "Package.swift";
+    case "gradle":
+      return stack === "kotlin" ? "app/build.gradle" : "android/app/build.gradle";
+    case "nuget":
+      return "*.csproj";
+    case "upm":
+      return "Packages/manifest.json";
+    default:
+      return null;
+  }
+}
+function deriveCapabilities(input) {
+  const caps = /* @__PURE__ */ new Set();
+  const registryById = new Map(
+    input.registry.map((entry) => [entry.id, entry])
+  );
+  for (const sdk of input.sdks) {
+    const entry = registryById.get(sdk.id);
+    for (const cap of entry?.implies ?? []) caps.add(cap);
+  }
+  const ent = input.entitlements?.entitlements;
+  if (ent) {
+    if (ent.sign_in_with_apple) caps.add("sign_in_with_apple");
+    if (ent.aps_environment !== null) caps.add("push_notifications");
+    if (ent.healthkit) caps.add("health");
+  }
+  if (input.privacyManifest?.privacy_manifest.tracking === true) {
+    caps.add("tracking");
+  }
+  const signals = input.signals;
+  if (signals) {
+    if (signals.account_creation_found) caps.add("account_creation");
+    if (signals.account_deletion_found) caps.add("account_deletion");
+    if (signals.webview_ratio >= 0.5) caps.add("webview_heavy");
+    if (signals.external_checkout_url_found) caps.add("external_payment");
+  }
+  for (const permission of input.android?.android.permissions ?? []) {
+    switch (permissionShortName(permission)) {
+      case "ACCESS_FINE_LOCATION":
+      case "ACCESS_COARSE_LOCATION":
+        caps.add("location");
+        break;
+      case "CAMERA":
+        caps.add("camera");
+        break;
+      case "RECORD_AUDIO":
+        caps.add("microphone");
+        break;
+      case "ACTIVITY_RECOGNITION":
+      case "BODY_SENSORS":
+        caps.add("health");
+        break;
+      case "READ_CONTACTS":
+        caps.add("contacts");
+        break;
+      default:
+        break;
+    }
+  }
+  const usage = input.ios?.plist?.usage_descriptions;
+  if (usage) {
+    const has = (key) => Object.prototype.hasOwnProperty.call(usage, key);
+    const keys = Object.keys(usage);
+    if (has("NSCameraUsageDescription")) caps.add("camera");
+    if (has("NSMicrophoneUsageDescription")) caps.add("microphone");
+    if (keys.some((k) => k.startsWith("NSLocationWhenInUse") || k.startsWith("NSLocationAlways"))) {
+      caps.add("location");
+    }
+    if (has("NSContactsUsageDescription")) caps.add("contacts");
+    if (keys.some((k) => k.startsWith("NSPhotoLibrary"))) caps.add("photos");
+    if (has("NSHealthShareUsageDescription") || has("NSHealthUpdateUsageDescription")) {
+      caps.add("health");
+    }
+    if (keys.some((k) => k.startsWith("NSBluetooth"))) caps.add("bluetooth");
+    if (has("NSUserTrackingUsageDescription")) caps.add("tracking");
+  }
+  return Array.from(caps).sort();
+}
+function mergeEvidence(input) {
+  const evidence = {};
+  const sources = [
+    input.ios?.evidence,
+    input.entitlements?.evidence,
+    input.privacyManifest?.evidence,
+    input.android?.evidence,
+    input.gradleTargets?.evidence
+  ];
+  for (const source of sources) {
+    if (source) Object.assign(evidence, source);
+  }
+  const firstCoordinate = input.sdks[0]?.matched_coordinates[0];
+  if (firstCoordinate) {
+    const file = sdkOriginFile(firstCoordinate, input.stackResult.stack);
+    if (file) evidence["sdks"] = { file, detail: "dependency manifest" };
+  }
+  return evidence;
+}
+function buildAppProfile(input) {
+  const hasIos = input.ios !== null || input.entitlements !== null || input.privacyManifest !== null;
+  const ios = hasIos ? {
+    plist_source: input.ios?.plist_source ?? "none",
+    plist: input.ios?.plist ?? null,
+    entitlements: input.entitlements?.entitlements ?? null,
+    privacy_manifest: input.privacyManifest?.privacy_manifest ?? null
+  } : null;
+  const android = input.android ? input.android.android : null;
+  const signals = input.signals ? {
+    restore_purchases_found: input.signals.restore_purchases_found,
+    account_deletion_found: input.signals.account_deletion_found,
+    privacy_policy_link_found: input.signals.privacy_policy_link_found,
+    external_checkout_url_found: input.signals.external_checkout_url_found,
+    webview_ratio: input.signals.webview_ratio
+  } : {
+    restore_purchases_found: null,
+    account_deletion_found: null,
+    privacy_policy_link_found: null,
+    external_checkout_url_found: null,
+    webview_ratio: null
+  };
+  return {
+    schema_version: 1,
+    generated_at: input.generatedAt,
+    stack: input.stackResult.stack,
+    stack_label: input.stackResult.label,
+    platforms: input.stackResult.platforms,
+    app: {
+      name: input.appConfig.app_name,
+      bundle_id: input.appConfig.bundle_id,
+      version: input.appConfig.version ?? null,
+      min_ios_version: input.appConfig.min_ios_version ?? null,
+      min_android_sdk: input.gradleTargets?.min_android_sdk ?? null,
+      target_android_sdk: input.gradleTargets?.target_android_sdk ?? null
+    },
+    sdks: input.sdks,
+    raw_dependencies: input.deps,
+    ios,
+    android,
+    capabilities: deriveCapabilities(input),
+    signals,
+    evidence: mergeEvidence(input),
+    stats: {
+      files_scanned: input.signals?.scanned_files ?? 0,
+      source_chars_read: input.signals?.source_chars ?? 0
+    }
+  };
+}
+
+// src/engine/rules.ts
+function resolveFact(profile, path2) {
+  const segments = path2.split(".");
+  let current = profile;
+  for (let i = 0; i < segments.length; i++) {
+    if (current === null || current === void 0) return { kind: "unknown" };
+    if (typeof current !== "object") return { kind: "unknown" };
+    const obj = current;
+    const seg = segments[i];
+    const isLeaf = i === segments.length - 1;
+    if (isLeaf) {
+      if (!Object.prototype.hasOwnProperty.call(obj, seg)) return { kind: "missing" };
+      const value = obj[seg];
+      if (value === null || value === void 0) return { kind: "nullvalue" };
+      return { kind: "value", value };
+    }
+    current = obj[seg];
+  }
+  return { kind: "unknown" };
+}
+function strictEquals(a, b) {
+  return a === b;
+}
+function valueIncludes(collection, needle) {
+  if (Array.isArray(collection)) return collection.includes(needle);
+  if (typeof collection === "string") return collection.includes(String(needle));
+  return false;
+}
+function evaluateFactPredicate(profile, fact, op, value) {
+  const r = resolveFact(profile, fact);
+  if (r.kind === "unknown") return "unknown";
+  switch (op) {
+    case "exists":
+      if (r.kind === "value") return "true";
+      if (r.kind === "nullvalue") return "unknown";
+      return "false";
+    // missing
+    case "absent":
+      if (r.kind === "value") return "false";
+      if (r.kind === "nullvalue") return "unknown";
+      return "true";
+    // missing
+    case "eq":
+      if (r.kind === "value") return strictEquals(r.value, value) ? "true" : "false";
+      return "false";
+    case "neq":
+      if (r.kind === "value") return strictEquals(r.value, value) ? "false" : "true";
+      return "true";
+    case "gte":
+      if (r.kind === "value" && typeof r.value === "number" && typeof value === "number") {
+        return r.value >= value ? "true" : "false";
+      }
+      return "unknown";
+    // non-numeric VALUE, or NULLVALUE/MISSING
+    case "lte":
+      if (r.kind === "value" && typeof r.value === "number" && typeof value === "number") {
+        return r.value <= value ? "true" : "false";
+      }
+      return "unknown";
+    case "includes":
+      if (r.kind === "value") return valueIncludes(r.value, value) ? "true" : "false";
+      return "unknown";
+    case "not_includes":
+      if (r.kind === "value") return valueIncludes(r.value, value) ? "false" : "true";
+      return "unknown";
+    case "matches":
+      if (r.kind === "value") {
+        if (typeof r.value !== "string") return "unknown";
+        let re;
+        try {
+          re = new RegExp(String(value));
+        } catch {
+          return "unknown";
+        }
+        return re.test(r.value) ? "true" : "false";
+      }
+      return "unknown";
+    // nullvalue/missing
+    default:
+      return "unknown";
+  }
+}
+function evaluateCondition(profile, condition, matchedSdkIds) {
+  if ("all" in condition) {
+    let sawUnknown = false;
+    for (const child of condition.all) {
+      const t = evaluateCondition(profile, child, matchedSdkIds);
+      if (t === "false") return "false";
+      if (t === "unknown") sawUnknown = true;
+    }
+    return sawUnknown ? "unknown" : "true";
+  }
+  if ("any" in condition) {
+    let sawUnknown = false;
+    for (const child of condition.any) {
+      const t = evaluateCondition(profile, child, matchedSdkIds);
+      if (t === "true") return "true";
+      if (t === "unknown") sawUnknown = true;
+    }
+    return sawUnknown ? "unknown" : "false";
+  }
+  if ("not" in condition) {
+    const t = evaluateCondition(profile, condition.not, matchedSdkIds);
+    if (t === "unknown") return "unknown";
+    return t === "true" ? "false" : "true";
+  }
+  return evaluatePredicate(profile, condition, matchedSdkIds);
+}
+function evaluatePredicate(profile, pred, matchedSdkIds) {
+  if ("always" in pred) return "true";
+  if ("sdk" in pred) {
+    const hit = profile.sdks.some((s) => s.id === pred.sdk);
+    if (hit && matchedSdkIds) matchedSdkIds.add(pred.sdk);
+    return hit ? "true" : "false";
+  }
+  if ("sdk_category" in pred) {
+    let hit = false;
+    for (const s of profile.sdks) {
+      if (s.category === pred.sdk_category) {
+        hit = true;
+        if (matchedSdkIds) matchedSdkIds.add(s.id);
+      }
+    }
+    return hit ? "true" : "false";
+  }
+  if ("sdk_flag" in pred) {
+    let hit = false;
+    for (const s of profile.sdks) {
+      if (s.flags[pred.sdk_flag] === true) {
+        hit = true;
+        if (matchedSdkIds) matchedSdkIds.add(s.id);
+      }
+    }
+    return hit ? "true" : "false";
+  }
+  if ("capability" in pred) {
+    return profile.capabilities.includes(pred.capability) ? "true" : "false";
+  }
+  if ("platform" in pred) {
+    return profile.platforms.includes(pred.platform) ? "true" : "false";
+  }
+  return evaluateFactPredicate(profile, pred.fact, pred.op, pred.value);
+}
+function interpolate(text, ctx) {
+  return text.replace(
+    /\{\{(\w+)\}\}/g,
+    (match, key) => Object.prototype.hasOwnProperty.call(ctx, key) ? ctx[key] : match
+  );
+}
+function formatFactValue(value) {
+  if (Array.isArray(value)) {
+    return value.map(
+      (el) => el && typeof el === "object" && "name" in el ? String(el.name) : String(el)
+    ).join(", ");
+  }
+  if (value && typeof value === "object") return JSON.stringify(value);
+  return String(value);
+}
+function buildEvidence(profile, facts) {
+  const parts = [];
+  for (const fact of facts) {
+    const r = resolveFact(profile, fact);
+    if (r.kind !== "value") continue;
+    const formatted = formatFactValue(r.value);
+    if (formatted === "") continue;
+    parts.push(`${fact}: ${formatted}`);
+  }
+  return parts.join("; ");
+}
+function firstEvidenceFile(profile, facts) {
+  for (const fact of facts) {
+    const entry = profile.evidence[fact];
+    if (entry?.file) return entry.file;
+  }
+  return void 0;
+}
+function expandTemplateRule(templateRule, profile, bundle) {
+  const registryById = new Map(
+    bundle.sdk_registry.map((entry) => [entry.id, entry])
+  );
+  const synthesized = [];
+  for (const profileSdk of profile.sdks) {
+    const entry = registryById.get(profileSdk.id);
+    const requiredKeys = entry?.requires?.ios_plist_keys;
+    if (!requiredKeys) continue;
+    for (const req of requiredKeys) {
+      if (!req.key.endsWith("UsageDescription")) continue;
+      const guidelineName = bundle.guidelines[req.guideline]?.name ?? templateRule.guideline.name;
+      const ctx = {
+        plist_key: req.key,
+        reason: req.reason,
+        sdk_names: profileSdk.name
+      };
+      synthesized.push({
+        id: `appstore.sdk-plist.${profileSdk.id}.${req.key}`,
+        store: templateRule.store,
+        guideline: { number: req.guideline, name: guidelineName },
+        severity: templateRule.severity,
+        category: templateRule.category,
+        title: interpolate(templateRule.title, ctx),
+        description: interpolate(templateRule.description, ctx),
+        user_impact: interpolate(templateRule.user_impact, ctx),
+        fix: interpolate(templateRule.fix, ctx),
+        tags: templateRule.tags,
+        applies_if: { all: [{ platform: "ios" }, { sdk: profileSdk.id }] },
+        unverified_if: { fact: "ios.plist", op: "absent" },
+        fail_if: { fact: `ios.plist.usage_descriptions.${req.key}`, op: "absent" },
+        evidence_facts: templateRule.evidence_facts
+      });
+    }
+  }
+  return synthesized;
+}
+function evaluateRule(profile, rule) {
+  const matchedSdkIds = /* @__PURE__ */ new Set();
+  const appliesTri = rule.applies_if ? evaluateCondition(profile, rule.applies_if, matchedSdkIds) : "true";
+  let status;
+  let isFail = false;
+  if (appliesTri === "false") {
+    status = "na";
+  } else if (appliesTri === "unknown") {
+    status = "unverified";
+  } else {
+    const unverifiedTri = rule.unverified_if ? evaluateCondition(profile, rule.unverified_if, matchedSdkIds) : "false";
+    if (unverifiedTri === "true" || unverifiedTri === "unknown") {
+      status = "unverified";
+    } else {
+      const failTri = evaluateCondition(profile, rule.fail_if, matchedSdkIds);
+      if (failTri === "true") {
+        status = "fail";
+        isFail = true;
+      } else if (failTri === "unknown") {
+        status = "unverified";
+      } else {
+        status = "pass";
+      }
+    }
+  }
+  const sdkNames = profile.sdks.filter((s) => matchedSdkIds.has(s.id)).map((s) => s.name);
+  const sdkNamesStr = sdkNames.length > 0 ? sdkNames.join(", ") : "the detected SDKs";
+  const evidenceStr = buildEvidence(profile, rule.evidence_facts);
+  const ctx = { sdk_names: sdkNamesStr, evidence: evidenceStr };
+  const title = interpolate(rule.title, ctx);
+  const check = {
+    rule_id: rule.id,
+    title,
+    status,
+    severity: rule.severity,
+    guideline_number: rule.guideline.number
+  };
+  if (evidenceStr) check.evidence = evidenceStr;
+  let finding;
+  if (isFail) {
+    check.finding_id = rule.id;
+    finding = {
+      id: rule.id,
+      title,
+      risk_level: rule.severity,
+      category: rule.category,
+      source: "codebase",
+      detection: "static",
+      guideline_number: rule.guideline.number,
+      guideline_name: rule.guideline.name,
+      description: interpolate(rule.description, ctx),
+      user_impact: interpolate(rule.user_impact, ctx),
+      evidence: evidenceStr,
+      recommendation: interpolate(rule.fix, ctx),
+      rule_id: rule.id
+    };
+    const file = firstEvidenceFile(profile, rule.evidence_facts);
+    if (file) finding.file = file;
+  }
+  return { check, finding };
+}
+var STATUS_ORDER = {
+  fail: 0,
+  unverified: 1,
+  pass: 2,
+  na: 3
+};
+var SEVERITY_ORDER = {
+  high: 0,
+  medium: 1,
+  low: 2,
+  info: 3
+};
+function compareIds(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+function evaluateRules(profile, bundle) {
+  const effectiveRules = [];
+  for (const rule of bundle.rules) {
+    if (rule.template === "sdk_required_plist_keys") {
+      effectiveRules.push(...expandTemplateRule(rule, profile, bundle));
+    } else if (rule.template) {
+      continue;
+    } else {
+      effectiveRules.push(rule);
+    }
+  }
+  const checks = [];
+  const findings = [];
+  const seenIds = /* @__PURE__ */ new Set();
+  for (const rule of effectiveRules) {
+    if (seenIds.has(rule.id)) continue;
+    seenIds.add(rule.id);
+    const { check, finding } = evaluateRule(profile, rule);
+    checks.push(check);
+    if (finding) findings.push(finding);
+  }
+  checks.sort(
+    (a, b) => STATUS_ORDER[a.status] - STATUS_ORDER[b.status] || SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity] || compareIds(a.rule_id, b.rule_id)
+  );
+  findings.sort(
+    (a, b) => SEVERITY_ORDER[a.risk_level] - SEVERITY_ORDER[b.risk_level] || compareIds(a.rule_id ?? a.id, b.rule_id ?? b.id)
+  );
+  return { checks, findings };
+}
+
+// src/engine/index.ts
+function extensionsForStack(stack) {
+  switch (stack) {
+    case "flutter":
+      return [".dart"];
+    case "swift":
+      return [".swift", ".m", ".mm", ".h"];
+    case "kotlin":
+      return [".kt", ".kts"];
+    case "expo":
+    case "react-native":
+    case "capacitor":
+      return [".ts", ".tsx", ".js", ".jsx"];
+    case "dotnet-maui":
+      return [".cs", ".xaml"];
+    case "unity":
+      return [".cs"];
+    case "kmp":
+      return [".kt", ".kts", ".swift"];
+    default:
+      return [".ts", ".js", ".swift", ".dart", ".kt"];
+  }
+}
+var SELF_SCAN_MAX_FILES = 300;
+var SELF_SCAN_MAX_TOTAL_CHARS = 200 * 1024;
+function selfScanSource(rootDir, stack) {
+  const relPaths = scanDirectory(rootDir, {
+    extensions: extensionsForStack(stack),
+    maxDepth: 8,
+    maxFiles: SELF_SCAN_MAX_FILES
+  });
+  const files = [];
+  let totalChars = 0;
+  for (const rel of relPaths) {
+    if (files.length >= SELF_SCAN_MAX_FILES || totalChars >= SELF_SCAN_MAX_TOTAL_CHARS) break;
+    const content = readFileSafe(join14(rootDir, rel));
+    if (content === null) continue;
+    files.push({ path: rel, content });
+    totalChars += content.length;
+  }
+  return files;
+}
+function runStaticEngine(input) {
+  const { rootDir, stackResult, bundle } = input;
+  const { stack, platforms } = stackResult;
+  const deps = collectRawDependencies(rootDir, stack);
+  const sdks = matchSDKs(deps, bundle.sdk_registry);
+  const isIos = platforms.includes("ios");
+  const isAndroid = platforms.includes("android");
+  const kmpLayout = stack === "kmp" ? findKmpLayout(rootDir) : null;
+  const iosRoot = kmpLayout?.iosAppDir ?? rootDir;
+  const androidRoot = kmpLayout?.androidModuleDir ?? rootDir;
+  const ios = isIos ? extractIosPlist(iosRoot) : null;
+  const entitlements = isIos ? extractIosEntitlements(iosRoot) : null;
+  const privacyManifest = isIos ? extractIosPrivacyManifest(iosRoot) : null;
+  const android = isAndroid ? extractAndroidManifest(androidRoot) : null;
+  const gradleTargets = isAndroid ? extractGradleTargets(androidRoot) : null;
+  let appConfig = input.appConfig;
+  let extraEvidence = null;
+  if (stack === "unity") {
+    const unityExtraction = extractUnityProjectSettings(rootDir);
+    if (unityExtraction) {
+      appConfig = {
+        ...appConfig,
+        app_name: appConfig.app_name ?? unityExtraction.product_name,
+        bundle_id: appConfig.bundle_id ?? unityExtraction.bundle_id,
+        version: appConfig.version ?? unityExtraction.app_version
+      };
+      extraEvidence = unityExtraction.evidence;
+    }
+  }
+  let signals;
+  if (input.sourceFiles !== void 0) {
+    signals = scanSourceSignals({ files: input.sourceFiles });
+  } else {
+    const selfFiles = selfScanSource(rootDir, stack);
+    signals = selfFiles.length > 0 ? scanSourceSignals({ files: selfFiles }) : null;
+  }
+  const profile = buildAppProfile({
+    rootDir,
+    stackResult,
+    appConfig,
+    deps,
+    sdks,
+    registry: bundle.sdk_registry,
+    ios,
+    entitlements,
+    privacyManifest,
+    android,
+    gradleTargets,
+    signals,
+    generatedAt: input.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString()
+  });
+  if (extraEvidence) {
+    profile.evidence = { ...profile.evidence, ...extraEvidence };
+  }
+  const { checks, findings } = evaluateRules(profile, bundle);
+  return { profile, checks, findings };
+}
+
+// src/engine/remote.ts
+import { readFileSync as readFileSync6 } from "fs";
+import { readFile, writeFile, mkdir, rm } from "fs/promises";
+import os from "os";
+import path from "path";
+import { fileURLToPath } from "url";
+var DEFAULT_BASE_URL = "https://forvibe.app";
+var DEFAULT_TIMEOUT_MS = 2500;
+var ENDPOINT_PATH = "/api/v1/review-rulepack?store=appstore";
+var BUNDLE_FILENAME = "bundle.appstore.json";
+var CACHE_BUNDLE_FILENAME = "rulepack-appstore.json";
+var CACHE_META_FILENAME = "rulepack-appstore.meta.json";
+async function loadRulepackBundle(opts = {}) {
+  const baseUrl = opts.baseUrl ?? DEFAULT_BASE_URL;
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const cacheDir = opts.cacheDir ?? path.join(os.homedir(), ".forvibe", "cache");
+  if (!opts.disableRemote) {
+    const meta = await readCacheMeta(cacheDir);
+    const headers = {};
+    if (meta?.etag) headers["If-None-Match"] = meta.etag;
+    const url = `${baseUrl.replace(/\/+$/, "")}${ENDPOINT_PATH}`;
+    const outcome = await tryFetch(url, headers, timeoutMs);
+    if (outcome.kind === "fresh") {
+      await writeCache(cacheDir, outcome.bundle, outcome.etag);
+      return { bundle: outcome.bundle, source: "remote", version: outcome.bundle.version };
+    }
+    if (outcome.kind === "not-modified") {
+      const cached = await readCachedBundle(cacheDir);
+      if (cached) {
+        return { bundle: cached, source: "cache", version: cached.version };
+      }
+      await deleteStaleMeta(cacheDir);
+      return loadFromCacheOrBundled(cacheDir);
+    }
+  }
+  return loadFromCacheOrBundled(cacheDir);
+}
+async function loadFromCacheOrBundled(cacheDir) {
+  const cached = await readCachedBundle(cacheDir);
+  if (cached) {
+    return { bundle: cached, source: "cache", version: cached.version };
+  }
+  const bundled = loadBundledSnapshot();
+  return { bundle: bundled, source: "bundled", version: bundled.version };
+}
+async function tryFetch(url, headers, timeoutMs) {
+  let res;
+  try {
+    res = await fetchWithTimeout(url, headers, timeoutMs);
+  } catch {
+    return { kind: "failed" };
+  }
+  if (res.status === 304) {
+    return { kind: "not-modified" };
+  }
+  if (!res.ok) {
+    return { kind: "failed" };
+  }
+  let bundle;
+  try {
+    bundle = await res.json();
+  } catch {
+    return { kind: "failed" };
+  }
+  if (bundle?.schema_version !== 1) {
+    return { kind: "failed" };
+  }
+  return { kind: "fresh", bundle, etag: res.headers.get("etag") ?? void 0 };
+}
+async function fetchWithTimeout(url, headers, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const fetchPromise = fetch(url, { headers, signal: controller.signal });
+  fetchPromise.catch(() => {
+  });
+  try {
+    return await Promise.race([
+      fetchPromise,
+      new Promise((_resolve, reject) => {
+        controller.signal.addEventListener(
+          "abort",
+          () => reject(new Error(`rulepack fetch timed out after ${timeoutMs}ms`)),
+          { once: true }
+        );
+      })
+    ]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function readCacheMeta(cacheDir) {
+  try {
+    const raw = await readFile(path.join(cacheDir, CACHE_META_FILENAME), "utf-8");
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function readCachedBundle(cacheDir) {
+  try {
+    const raw = await readFile(path.join(cacheDir, CACHE_BUNDLE_FILENAME), "utf-8");
+    const parsed = JSON.parse(raw);
+    return parsed && parsed.schema_version === 1 ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function deleteStaleMeta(cacheDir) {
+  try {
+    await rm(path.join(cacheDir, CACHE_META_FILENAME), { force: true });
+  } catch {
+  }
+}
+async function writeCache(cacheDir, bundle, etag) {
+  try {
+    await mkdir(cacheDir, { recursive: true });
+    await writeFile(path.join(cacheDir, CACHE_BUNDLE_FILENAME), JSON.stringify(bundle, null, 2), "utf-8");
+    const meta = { fetched_at: (/* @__PURE__ */ new Date()).toISOString() };
+    if (etag) meta.etag = etag;
+    await writeFile(path.join(cacheDir, CACHE_META_FILENAME), JSON.stringify(meta, null, 2), "utf-8");
+  } catch {
+  }
+}
+function getEngineDataDir() {
+  const __filename = fileURLToPath(import.meta.url);
+  const __dirname = path.dirname(__filename);
+  const candidates = [
+    path.join(__dirname, "data"),
+    // dev, running from source (src/engine/data)
+    path.join(__dirname, "engine", "data"),
+    // bundled, __dirname = dist/ -> dist/engine/data
+    path.join(__dirname, "..", "engine", "data"),
+    path.join(__dirname, "..", "src", "engine", "data")
+  ];
+  for (const dir of candidates) {
+    try {
+      readFileSync6(path.join(dir, BUNDLE_FILENAME));
+      return dir;
+    } catch {
+    }
+  }
+  return candidates[0];
+}
+function loadBundledSnapshot() {
+  const filePath = path.join(getEngineDataDir(), BUNDLE_FILENAME);
+  let raw;
+  try {
+    raw = readFileSync6(filePath, "utf-8");
+  } catch (err) {
+    throw new Error(
+      `Bundled rulepack snapshot not found at ${filePath}. This indicates a broken install - bundle.appstore.json should always ship with the package. (${err.message})`
+    );
+  }
+  try {
+    return JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`Bundled rulepack snapshot at ${filePath} is not valid JSON: ${err.message}`);
+  }
+}
+
+// src/engine/redactor.ts
+function buildSimpleRules() {
+  return [
+    {
+      kind: "pem",
+      regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g
+    },
+    { kind: "anthropic", regex: /sk-ant-[A-Za-z0-9_-]{16,}/g },
+    {
+      kind: "openai",
+      regex: /sk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{16,}|sk-[A-Za-z0-9]{32,}/g
+    },
+    { kind: "stripe", regex: /(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9]{16,}/g },
+    { kind: "google", regex: /AIza[0-9A-Za-z_-]{35}/g },
+    { kind: "aws", regex: /AKIA[0-9A-Z]{16}/g },
+    { kind: "github", regex: /gh[pousr]_[A-Za-z0-9]{20,}/g },
+    { kind: "slack", regex: /xox[baprs]-[A-Za-z0-9-]{10,}/g },
+    {
+      kind: "jwt",
+      regex: /eyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g
+    }
+  ];
+}
+function buildGenericRule() {
+  return /(api[_-]?key|apikey|secret|token|passwd|password|client[_-]?secret)(\s*[:=]\s*)(["'])([^"'\n]{12,})(["'])/gi;
+}
+var ALREADY_REDACTED = /^\[REDACTED:[A-Za-z0-9_]+\]$/;
+function redactSecrets(source) {
+  let text = source;
+  let redactedCount = 0;
+  for (const { kind, regex } of buildSimpleRules()) {
+    text = text.replace(regex, () => {
+      redactedCount++;
+      return `[REDACTED:${kind}]`;
+    });
+  }
+  text = text.replace(
+    buildGenericRule(),
+    (full, key, delim, openQuote, value, closeQuote) => {
+      if (ALREADY_REDACTED.test(value)) return full;
+      redactedCount++;
+      return `${key}${delim}${openQuote}[REDACTED:generic]${closeQuote}`;
+    }
+  );
+  return { text, redactedCount };
+}
+
+// src/review/feature-detector.ts
+function getFeatureDiscoveryPrompt() {
+  return `You are an expert app analyst. Your job is to understand WHAT an app does from the USER's perspective by reading its source code. You are NOT reviewing code quality.
+
+Respond in English.
+
+Answer this question: "If someone downloads this app and opens it on their iPhone, what will they see and experience?"
+
+Analyze the source code and identify:
+
+1. **App Purpose**: What does this app do? (1-2 sentences)
+2. **User Flows**: What are the main things a user can do? (list each)
+3. **Onboarding**: What happens when you first open the app? Login required? Permissions asked immediately?
+4. **Monetization**: How does the app make money? Subscriptions? IAP? Ads? External payments? Free?
 5. **Data & Privacy**: What user data does the app collect? What device permissions does it need? Is there a privacy policy link?
 6. **Content**: Is there user-generated content (posts, comments, chat)? Third-party content? Web content?
 7. **Account Management**: Can users create accounts? Can they delete their accounts?
@@ -3100,62 +5813,23 @@ function parseFeatureAnalysis(response) {
 }
 
 // src/review/rag-selector.ts
-import { readFileSync as readFileSync6 } from "fs";
-import { fileURLToPath } from "url";
-import path from "path";
-var DATA_FILES = [
-  "safety.json",
-  "performance.json",
-  "business.json",
-  "design.json",
-  "legal.json",
-  "common-pitfalls.json"
-];
-var cachedStories = null;
-function getDataDir() {
-  const __filename = fileURLToPath(import.meta.url);
-  const __dirname = path.dirname(__filename);
-  const candidates = [
-    path.join(__dirname, "rag-data"),
-    path.join(__dirname, "review", "rag-data"),
-    path.join(__dirname, "..", "review", "rag-data"),
-    path.join(__dirname, "..", "src", "review", "rag-data")
-  ];
-  for (const dir of candidates) {
-    try {
-      readFileSync6(path.join(dir, "safety.json"));
-      return dir;
-    } catch {
-    }
-  }
-  return candidates[0];
-}
-function loadAllStories() {
-  if (cachedStories) return cachedStories;
-  const dataDir = getDataDir();
-  const stories = [];
-  for (const file of DATA_FILES) {
-    try {
-      const content = readFileSync6(path.join(dataDir, file), "utf-8");
-      const parsed = JSON.parse(content);
-      stories.push(...parsed);
-    } catch {
+function searchStories(stories, signals, maxResults = 20) {
+  if (signals.length === 0) return stories.slice(0, maxResults);
+  const signalKeywords = /* @__PURE__ */ new Set();
+  const signalFeatures = /* @__PURE__ */ new Set();
+  const signalCategories = /* @__PURE__ */ new Set();
+  for (const signal of signals) {
+    if (typeof signal === "string") {
+      const value = signal.toLowerCase();
+      signalFeatures.add(value);
+      signalKeywords.add(value);
+    } else {
+      signalFeatures.add(signal.feature.toLowerCase());
+      for (const keyword of signal.keywords) signalKeywords.add(keyword.toLowerCase());
+      signalCategories.add(signal.category);
     }
   }
-  cachedStories = stories;
-  return stories;
-}
-function searchStories(signals, maxResults = 20) {
-  const allStories = loadAllStories();
-  if (signals.length === 0) return allStories.slice(0, maxResults);
-  const signalKeywords = new Set(
-    signals.flatMap((s) => s.keywords.map((k) => k.toLowerCase()))
-  );
-  const signalFeatures = new Set(
-    signals.map((s) => s.feature.toLowerCase())
-  );
-  const signalCategories = new Set(signals.map((s) => s.category));
-  const scored = allStories.map((story) => {
+  const scored = stories.map((story) => {
     let score = 0;
     for (const signal of story.behavioralSignals) {
       const signalLower = signal.toLowerCase();
@@ -3202,6 +5876,21 @@ You do NOT review code quality. You review the APP \u2014 what a user sees, touc
 For every issue, think through this exact scenario:
 "I downloaded this app on my iPhone. I opened it. I [did something specific]. I saw [specific result]. This violates Guideline [X.X] because [reason]."
 
+## STATIC ANALYSIS ALREADY RAN
+
+A deterministic static rule engine scanned this codebase before you. The user prompt contains a section titled "## Already Detected By Static Analysis (do not repeat)". Those violations are CONFIRMED and already in the final report.
+
+HARD RULES:
+1. You MUST NOT re-report anything listed in that section. A finding that duplicates a listed guideline violation will be discarded.
+2. Focus on what static analysis CANNOT see:
+   - Minimum functionality and app completeness (Guideline 4.2): is this a real, useful app or a thin shell?
+   - Spam, template, and repetitive app patterns (Guideline 4.3)
+   - User-generated content without moderation: report, block, and filter mechanisms (Guideline 1.2)
+   - Misleading claims, undelivered features, fake functionality (Guideline 2.3.1)
+   - Purchase flows that bypass or confuse Apple's in-app purchase system (Guidelines 3.1.x)
+   - Objectionable or age-inappropriate content (Guideline 1.1)
+3. Every finding MUST cite a specific guideline number AND describe the user-visible impact.
+
 ## WHAT YOU CHECK (as if using the app)
 
 1. **First Launch**: What happens when I open the app? Does it crash? Show a blank screen? Force me to log in? Ask for too many permissions at once?
@@ -3252,11 +5941,11 @@ You MUST respond with valid JSON:
       "relatedRejection": "string | null (reference to a similar rejection case if provided)"
     }
   ],
-  "overallAssessment": "string (2-3 sentence assessment of the app's review readiness)",
-  "estimatedOutcome": "likely-approved | likely-rejected | needs-attention",
-  "estimatedApprovalChance": 0-100
+  "overallAssessment": "string (2-3 sentence assessment of the app's review readiness)"
 }
 
+Do not include an approval estimate; the final outcome is computed deterministically from the merged findings.
+
 ## IMPORTANT RULES
 
 1. Every finding MUST describe user-visible behavior, not code patterns
@@ -3306,14 +5995,8 @@ function validateCategory(c) {
   }
   return "performance";
 }
-function validateOutcome(o) {
-  if (["likely-approved", "likely-rejected", "needs-attention"].includes(o)) {
-    return o;
-  }
-  return "needs-attention";
-}
 function convertFindings(raw) {
-  return raw.findings.map((f, i) => ({
+  return (raw.findings ?? []).map((f, i) => ({
     id: f.ruleId || `finding-${i + 1}`,
     title: f.title,
     risk_level: validateRiskLevel(f.severity),
@@ -3326,51 +6009,164 @@ function convertFindings(raw) {
     evidence: f.evidence ?? "",
     recommendation: f.fixSuggestion,
     file: f.file ?? void 0,
-    related_story_id: f.relatedRejection ?? void 0
+    related_story_id: f.relatedRejection ?? void 0,
+    // No rule_id: AI findings have no backing rulepack rule.
+    detection: "ai"
   }));
 }
-function buildSummary(findings, aiResponse) {
-  const high = findings.filter((f) => f.risk_level === "high").length;
-  const medium = findings.filter((f) => f.risk_level === "medium").length;
-  const low = findings.filter((f) => f.risk_level === "low").length;
-  const info = findings.filter((f) => f.risk_level === "info").length;
-  const outcome = validateOutcome(aiResponse.estimatedOutcome);
-  let approvalChance = aiResponse.estimatedApprovalChance ?? 75;
-  if (outcome === "likely-rejected") approvalChance = Math.min(approvalChance, 30);
-  if (outcome === "likely-approved") approvalChance = Math.max(approvalChance, 70);
-  const topRisks = findings.filter((f) => f.risk_level === "high" || f.risk_level === "medium").slice(0, 3).map((f) => f.title);
-  return {
-    total_findings: findings.length,
-    high_risk: high,
-    medium_risk: medium,
-    low_risk: low,
-    info,
-    outcome,
-    estimated_approval_chance: approvalChance,
-    top_risks: topRisks,
-    ai_assessment: aiResponse.overallAssessment
-  };
+function normalizeTitle(title) {
+  return title.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
 }
-async function runCodeReview(provider, platform, appName, bundleId, sourceCode, sourceFilesCount, deep) {
-  const startTime = Date.now();
+function dedupeAIFindings(aiFindings, staticFindings) {
+  const kept = aiFindings.filter((ai) => {
+    const aiTitle = normalizeTitle(ai.title ?? "");
+    return !staticFindings.some((st) => {
+      if (st.guideline_number !== ai.guideline_number) return false;
+      const stTitle = normalizeTitle(st.title ?? "");
+      if (!aiTitle || !stTitle) return false;
+      return stTitle.includes(aiTitle) || aiTitle.includes(stTitle);
+    });
+  });
+  return { kept, droppedCount: aiFindings.length - kept.length };
+}
+var FEATURE_CAPABILITY_MAP = {
+  push_notifications: "push_notifications",
+  push_notification: "push_notifications",
+  iap: "iap",
+  in_app_purchase: "iap",
+  in_app_purchases: "iap",
+  subscription: "subscriptions",
+  subscriptions: "subscriptions",
+  ads: "ads",
+  advertising: "ads",
+  advertisements: "ads",
+  tracking: "tracking",
+  health: "health",
+  healthkit: "health",
+  location: "location",
+  location_tracking: "location",
+  camera: "camera",
+  camera_usage: "camera",
+  microphone: "microphone",
+  contacts: "contacts",
+  photos: "photos",
+  photo_library: "photos",
+  bluetooth: "bluetooth",
+  background_audio: "background_audio",
+  background_location: "background_location",
+  account_creation: "account_creation",
+  account_deletion: "account_deletion",
+  sign_in_with_apple: "sign_in_with_apple",
+  third_party_login: "third_party_login",
+  social_login: "third_party_login",
+  webview: "webview_heavy",
+  webview_heavy: "webview_heavy",
+  ugc: "ugc",
+  user_generated_content: "ugc",
+  external_payment: "external_payment",
+  external_payments: "external_payment",
+  kids_category: "kids_category",
+  ai_generated_content: "ai_generated_content",
+  gambling: "gambling",
+  crypto: "crypto",
+  cryptocurrency: "crypto"
+};
+function mapFeaturesToCapabilities(analysis) {
+  const caps = /* @__PURE__ */ new Set();
+  for (const feature of analysis.features ?? []) {
+    const key = feature.feature.toLowerCase().trim().replace(/[\s-]+/g, "_");
+    const cap = FEATURE_CAPABILITY_MAP[key];
+    if (cap) caps.add(cap);
+  }
+  if (analysis.appType === "webview-heavy" || analysis.appType === "web-wrapper") {
+    caps.add("webview_heavy");
+  }
+  return [...caps].sort();
+}
+function formatValueOrUnknown(value) {
+  if (value === null) return "unknown";
+  return value ? "yes" : "no";
+}
+function formatProfileDigest(profile) {
+  const lines = [];
+  lines.push(`- Stack: ${profile.stack_label} (platforms: ${profile.platforms.join(", ") || "unknown"})`);
+  if (profile.app.bundle_id) lines.push(`- Bundle ID: ${profile.app.bundle_id}`);
+  if (profile.sdks.length > 0) {
+    const byCategory = /* @__PURE__ */ new Map();
+    for (const sdk of profile.sdks) {
+      const names = byCategory.get(sdk.category) ?? [];
+      names.push(sdk.name);
+      byCategory.set(sdk.category, names);
+    }
+    const parts = [...byCategory.entries()].map(([category, names]) => `${category}: ${names.join(", ")}`);
+    lines.push(`- Detected SDKs: ${parts.join("; ")}`);
+  } else {
+    lines.push("- Detected SDKs: none");
+  }
+  lines.push(`- Capabilities: ${profile.capabilities.join(", ") || "none detected"}`);
+  const plist3 = profile.ios?.plist;
+  if (plist3) {
+    const usageKeys = Object.keys(plist3.usage_descriptions);
+    lines.push(`- iOS usage descriptions declared: ${usageKeys.length > 0 ? usageKeys.join(", ") : "none"}`);
+    if (plist3.background_modes.length > 0) {
+      lines.push(`- iOS background modes: ${plist3.background_modes.join(", ")}`);
+    }
+    if (plist3.ats_allows_arbitrary_loads === true) {
+      lines.push("- ATS: NSAllowsArbitraryLoads is enabled");
+    }
+  }
+  if (profile.platforms.includes("ios")) {
+    const manifest = profile.ios?.privacy_manifest;
+    lines.push(`- Privacy manifest: ${manifest?.app_manifest_present ? "present" : "not found"}`);
+  }
+  if (profile.android?.manifest_found) {
+    lines.push(`- Android permissions: ${profile.android.permissions.join(", ") || "none"}`);
+  }
+  const signals = profile.signals;
+  lines.push(
+    `- Source signals: restore purchases ${formatValueOrUnknown(signals.restore_purchases_found)}, account deletion ${formatValueOrUnknown(signals.account_deletion_found)}, privacy policy link ${formatValueOrUnknown(signals.privacy_policy_link_found)}, external checkout URL ${formatValueOrUnknown(signals.external_checkout_url_found)}`
+  );
+  return lines.join("\n");
+}
+function formatAlreadyDetected(staticFindings) {
+  if (staticFindings.length === 0) {
+    return "(none - the static rule engine found no definitive violations)";
+  }
+  return staticFindings.map((f) => `- [${f.rule_id ?? f.id}] ${f.title} (Guideline ${f.guideline_number})`).join("\n");
+}
+async function runCodeReview(input) {
+  let profile = input.profile;
+  let checks = input.staticChecks;
+  let staticFindings = input.staticFindings;
   let featureAnalysis = null;
-  let relevantStories;
-  if (deep) {
+  if (input.deep) {
     featureAnalysis = await detectFeatures(
-      provider,
-      platform,
-      appName,
-      bundleId,
-      sourceCode
+      input.provider,
+      input.platform,
+      input.appName,
+      input.bundleId,
+      input.sourceContext
     );
     if (featureAnalysis) {
-      relevantStories = searchStories(featureAnalysis.features, 20);
-    } else {
-      relevantStories = loadAllStories().slice(0, 15);
+      const discovered = mapFeaturesToCapabilities(featureAnalysis);
+      const added = discovered.filter((cap) => !profile.capabilities.includes(cap));
+      if (added.length > 0) {
+        profile = {
+          ...profile,
+          capabilities: [...profile.capabilities, ...added].sort()
+        };
+        const rerun = evaluateRules(profile, input.bundle);
+        checks = rerun.checks;
+        staticFindings = rerun.findings;
+      }
     }
-  } else {
-    relevantStories = loadAllStories().slice(0, 15);
   }
+  const profileSignals = [
+    ...profile.sdks.map((sdk) => sdk.id),
+    ...profile.capabilities
+  ];
+  const signals = featureAnalysis ? [...featureAnalysis.features, ...profileSignals] : profileSignals;
+  const relevantStories = searchStories(input.bundle.stories, signals, input.deep ? 20 : 15);
   const storiesText = formatStoriesForPrompt(relevantStories);
   const featureSection = featureAnalysis ? `## App Analysis (from feature discovery)
 
@@ -3381,60 +6177,136 @@ async function runCodeReview(provider, platform, appName, bundleId, sourceCode,
 ${featureAnalysis.features.map((f) => `- ${f.feature}: ${f.description} (confidence: ${f.confidence})`).join("\n")}
 
 **Risk Areas:**
-${featureAnalysis.riskAreas.map((r) => `- ${r}`).join("\n")}` : "";
+${featureAnalysis.riskAreas.map((r) => `- ${r}`).join("\n")}
+
+` : "";
   const userPrompt = `## App Information
-- Platform: ${platform}
-- App Name: ${appName}
-- Bundle ID: ${bundleId}
+- Platform: ${input.platform}
+- App Name: ${input.appName}
+- Bundle ID: ${input.bundleId}
 
-${featureSection}
+## App Profile (from static analysis)
+${formatProfileDigest(profile)}
 
-## Real Rejection Cases (from other developers)
+## Already Detected By Static Analysis (do not repeat)
+These violations are already confirmed and included in the report. Do NOT re-report them:
+
+${formatAlreadyDetected(staticFindings)}
+
+${featureSection}## Real Rejection Cases (from other developers)
 These are REAL cases where Apple rejected similar apps. Use them to calibrate:
 
 ${storiesText}
 
-## Source Code
+## Source Code Context
 
-${sourceCode}
+${input.sourceContext}
 
-Now review this app as an Apple reviewer testing it on a device. What would you flag?`;
+Now review this app as an Apple reviewer testing it on a device. Focus on behavioral issues that static analysis cannot detect. What would you flag?`;
   const systemPrompt = getReviewerSimulationPrompt();
-  const response = await provider.generateJSON(systemPrompt, userPrompt, 0.2);
+  const response = await input.provider.generateJSON(systemPrompt, userPrompt, 0.2);
   const parsed = parseAIResponse(response);
+  const featuresDetected = featureAnalysis?.features.map((f) => f.feature) ?? [];
   if (!parsed) {
     return {
-      features_detected: featureAnalysis?.features.map((f) => f.feature) ?? [],
-      source_files_analyzed: sourceFilesCount,
-      platform,
-      bundle_id: bundleId || null,
-      findings: [],
-      summary: {
-        total_findings: 0,
-        high_risk: 0,
-        medium_risk: 0,
-        low_risk: 0,
-        info: 0,
-        outcome: "needs-attention",
-        estimated_approval_chance: 50,
-        top_risks: [],
-        ai_assessment: "AI analysis could not produce structured results."
-      },
-      rag_stories_used: relevantStories.length,
-      scan_duration_ms: Date.now() - startTime
+      aiFindings: [],
+      aiAssessment: "AI analysis could not produce structured results.",
+      featuresDetected,
+      ragStoriesUsed: relevantStories.length,
+      dedupedCount: 0,
+      profile,
+      checks,
+      staticFindings
     };
   }
-  const findings = convertFindings(parsed);
-  const summary = buildSummary(findings, parsed);
+  const converted = convertFindings(parsed);
+  const { kept, droppedCount } = dedupeAIFindings(converted, staticFindings);
+  return {
+    aiFindings: kept,
+    aiAssessment: parsed.overallAssessment || "AI review completed.",
+    featuresDetected,
+    ragStoriesUsed: relevantStories.length,
+    dedupedCount: droppedCount,
+    profile,
+    checks,
+    staticFindings
+  };
+}
+
+// src/review/report-builder.ts
+var SEVERITY_ORDER2 = {
+  high: 0,
+  medium: 1,
+  low: 2,
+  info: 3
+};
+function buildDeterministicSummary(findings, opts) {
+  const high = findings.filter((f) => f.risk_level === "high").length;
+  const medium = findings.filter((f) => f.risk_level === "medium").length;
+  const low = findings.filter((f) => f.risk_level === "low").length;
+  const info = findings.filter((f) => f.risk_level === "info").length;
+  const rawChance = 85 - 20 * high - 5 * medium - 1 * low;
+  const estimatedApprovalChance = Math.min(95, Math.max(5, rawChance));
+  let outcome;
+  if (high >= 2) {
+    outcome = "likely-rejected";
+  } else if (high >= 1 || medium >= 3) {
+    outcome = "needs-attention";
+  } else {
+    outcome = "likely-approved";
+  }
+  const topRisks = [...findings].sort((a, b) => SEVERITY_ORDER2[a.risk_level] - SEVERITY_ORDER2[b.risk_level]).slice(0, 3).map((f) => f.title);
+  let aiAssessment;
+  if (opts.aiReviewRan && opts.aiAssessment) {
+    aiAssessment = opts.aiAssessment;
+  } else {
+    const violations = findings.length === 1 ? "violation" : "violations";
+    aiAssessment = `Static rule scan found ${findings.length} guideline ${violations} across ${opts.checksCount ?? 0} checks. AI behavioral review was not run.`;
+  }
+  return {
+    total_findings: findings.length,
+    high_risk: high,
+    medium_risk: medium,
+    low_risk: low,
+    info,
+    outcome,
+    estimated_approval_chance: estimatedApprovalChance,
+    top_risks: topRisks,
+    ai_assessment: aiAssessment
+  };
+}
+var RAW_DEPS_CAP = 50;
+function trimProfileForReport(profile) {
+  const raw = profile.raw_dependencies;
+  const trimmed = Object.fromEntries(
+    Object.entries(raw).map(([bucket, entries]) => [bucket, entries.slice(0, RAW_DEPS_CAP)])
+  );
+  return { ...profile, raw_dependencies: trimmed };
+}
+function assembleReportV2(input) {
+  const findings = [...input.staticFindings, ...input.aiFindings];
+  const summary = buildDeterministicSummary(findings, {
+    aiReviewRan: input.aiReviewRan,
+    aiAssessment: input.aiAssessment,
+    checksCount: input.checks.length
+  });
   return {
-    features_detected: featureAnalysis?.features.map((f) => f.feature) ?? [],
-    source_files_analyzed: sourceFilesCount,
-    platform,
-    bundle_id: bundleId || null,
+    features_detected: input.featuresDetected,
+    source_files_analyzed: input.sourceFilesAnalyzed,
+    platform: input.platform,
+    bundle_id: input.bundleId,
     findings,
     summary,
-    rag_stories_used: relevantStories.length,
-    scan_duration_ms: Date.now() - startTime
+    rag_stories_used: input.ragStoriesUsed,
+    scan_duration_ms: input.scanDurationMs,
+    report_schema_version: 2,
+    engine_version: input.engineVersion,
+    rulepack_version: input.rulepack.version,
+    rulepack_store: input.rulepack.store,
+    rulepack_source: input.rulepack.source,
+    app_profile: trimProfileForReport(input.profile),
+    checks: input.checks,
+    ai_review_ran: input.aiReviewRan
   };
 }
 
@@ -3458,6 +6330,7 @@ var RISK_COLORS = {
   low: chalk2.blue,
   info: chalk2.gray
 };
+var STATIC_ONLY_BANNER = "AI behavioral review skipped. Static rule results only.";
 function outcomeDisplay(outcome) {
   switch (outcome) {
     case "likely-approved":
@@ -3480,6 +6353,30 @@ function approvalBar(chance) {
   else color = chalk2.red;
   return color("\u2588".repeat(filled)) + chalk2.gray("\u2591".repeat(empty)) + ` ${chance}%`;
 }
+function groupChecks(checks) {
+  return {
+    failed: checks.filter((c) => c.status === "fail"),
+    unverified: checks.filter((c) => c.status === "unverified"),
+    passed: checks.filter((c) => c.status === "pass"),
+    na: checks.filter((c) => c.status === "na")
+  };
+}
+function detectionBadge(finding) {
+  if (finding.detection === "static") return chalk2.dim("[static]") + " ";
+  if (finding.detection === "ai") return chalk2.cyan("[AI]") + " ";
+  return "";
+}
+function versionFooter(report) {
+  const parts = [];
+  if (report.rulepack_version) {
+    const source = report.rulepack_source ? ` (${report.rulepack_source})` : "";
+    parts.push(`Rulepack v${report.rulepack_version}${source}`);
+  }
+  if (report.engine_version) {
+    parts.push(`Engine v${report.engine_version}`);
+  }
+  return parts.length > 0 ? parts.join(" \xB7 ") : null;
+}
 function formatTerminal(report) {
   const lines = [];
   lines.push("");
@@ -3503,7 +6400,9 @@ function formatTerminal(report) {
     report.summary.low_risk > 0 && chalk2.blue(`${report.summary.low_risk} low`),
     report.summary.info > 0 && chalk2.gray(`${report.summary.info} info`)
   ].filter(Boolean);
-  lines.push(`  Findings:    ${chalk2.bold(String(report.summary.total_findings))} total \u2014 ${counts.join(" \xB7 ")}`);
+  lines.push(
+    `  Findings:    ${chalk2.bold(String(report.summary.total_findings))} total` + (counts.length > 0 ? ` (${counts.join(" \xB7 ")})` : "")
+  );
   lines.push("");
   if (report.features_detected.length > 0) {
     lines.push(`  Features:    ${chalk2.gray(report.features_detected.join(", "))}`);
@@ -3515,6 +6414,29 @@ function formatTerminal(report) {
     lines.push(chalk2.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
     lines.push("");
   }
+  if (report.checks && report.checks.length > 0) {
+    const groups = groupChecks(report.checks);
+    lines.push(chalk2.bold("  COMPLIANCE CHECKS"));
+    lines.push(
+      `  ${chalk2.red(`${groups.failed.length} failed`)}, ${chalk2.yellow(`${groups.unverified.length} verify manually`)}, ${chalk2.green(`${groups.passed.length} passed`)}, ${chalk2.gray(`${groups.na.length} not applicable`)}`
+    );
+    lines.push("");
+    for (const check of groups.failed) {
+      lines.push(`  ${chalk2.red(`\u2717 [${check.guideline_number}] ${check.title}`)}`);
+    }
+    for (const check of groups.unverified) {
+      lines.push(`  ${chalk2.yellow(`VERIFY: [${check.guideline_number}] ${check.title}`)}`);
+    }
+    if (groups.passed.length > 0) {
+      const noun = groups.passed.length === 1 ? "check" : "checks";
+      lines.push(
+        chalk2.gray(
+          `  ${groups.passed.length} ${noun} passed (run with --format json for the full list)`
+        )
+      );
+    }
+    lines.push("");
+  }
   const findingsByRisk = {
     high: [],
     medium: [],
@@ -3532,10 +6454,10 @@ function formatTerminal(report) {
       const label = RISK_LABELS[level];
       const color = RISK_COLORS[level];
       lines.push(chalk2.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-      lines.push(`  ${icon} ${color(label)}  Guideline ${finding.guideline_number} \u2014 ${finding.guideline_name}`);
+      lines.push(`  ${icon} ${color(label)}  Guideline ${finding.guideline_number} - ${finding.guideline_name}`);
       lines.push(chalk2.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
       lines.push("");
-      lines.push(`  ${chalk2.bold(finding.title)}`);
+      lines.push(`  ${detectionBadge(finding)}${chalk2.bold(finding.title)}`);
       lines.push(`  ${finding.description}`);
       lines.push("");
       lines.push(`  ${chalk2.cyan("User Impact:")} ${finding.user_impact}`);
@@ -3554,7 +6476,14 @@ function formatTerminal(report) {
     lines.push("");
   }
   lines.push(chalk2.gray("  \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550"));
-  lines.push(chalk2.gray("  Powered by Forvibe CLI \u2014 forvibe.app"));
+  if (report.ai_review_ran === false) {
+    lines.push(chalk2.yellow(`  ${STATIC_ONLY_BANNER}`));
+  }
+  const footer = versionFooter(report);
+  if (footer) {
+    lines.push(chalk2.gray(`  ${footer}`));
+  }
+  lines.push(chalk2.gray("  Powered by Forvibe CLI (forvibe.app)"));
   lines.push("");
   return lines.join("\n");
 }
@@ -3573,6 +6502,10 @@ function formatMarkdown(report) {
   lines.push(`**Rejection Cases Referenced:** ${report.rag_stories_used}`);
   lines.push(`**Scan Duration:** ${(report.scan_duration_ms / 1e3).toFixed(1)}s`);
   lines.push("");
+  if (report.ai_review_ran === false) {
+    lines.push(`> ${STATIC_ONLY_BANNER}`);
+    lines.push("");
+  }
   lines.push("## Result");
   lines.push("");
   lines.push(`**Outcome:** ${report.summary.outcome.replace(/-/g, " ").toUpperCase()}`);
@@ -3590,6 +6523,26 @@ function formatMarkdown(report) {
     lines.push(`> ${report.summary.ai_assessment}`);
     lines.push("");
   }
+  if (report.checks && report.checks.length > 0) {
+    const groups = groupChecks(report.checks);
+    lines.push("## Compliance Checks");
+    lines.push("");
+    lines.push(
+      `${groups.failed.length} failed, ${groups.unverified.length} verify manually, ${groups.passed.length} passed, ${groups.na.length} not applicable`
+    );
+    lines.push("");
+    for (const check of groups.failed) {
+      lines.push(`- FAILED: [${check.guideline_number}] ${check.title}`);
+    }
+    for (const check of groups.unverified) {
+      lines.push(`- VERIFY: [${check.guideline_number}] ${check.title}`);
+    }
+    if (groups.passed.length > 0) {
+      const noun = groups.passed.length === 1 ? "check" : "checks";
+      lines.push(`- ${groups.passed.length} ${noun} passed (run with \`--format json\` for the full list)`);
+    }
+    lines.push("");
+  }
   if (report.features_detected.length > 0) {
     lines.push("## Detected Features");
     lines.push("");
@@ -3603,13 +6556,15 @@ function formatMarkdown(report) {
   if (report.findings.length === 0) {
     lines.push("No significant issues found. Your app looks ready for review!");
     lines.push("");
+    appendMarkdownFooter(lines, report);
     return lines.join("\n");
   }
   for (const finding of report.findings) {
     const riskEmoji = RISK_ICONS[finding.risk_level];
-    lines.push(`### ${riskEmoji} ${finding.title}`);
+    const badge = finding.detection === "static" ? "[static] " : finding.detection === "ai" ? "[AI] " : "";
+    lines.push(`### ${riskEmoji} ${badge}${finding.title}`);
     lines.push("");
-    lines.push(`**Guideline:** ${finding.guideline_number} \u2014 ${finding.guideline_name}`);
+    lines.push(`**Guideline:** ${finding.guideline_number} - ${finding.guideline_name}`);
     lines.push(`**Risk Level:** ${finding.risk_level}`);
     lines.push(`**Category:** ${finding.category}`);
     lines.push("");
@@ -3626,12 +6581,36 @@ function formatMarkdown(report) {
     lines.push("---");
     lines.push("");
   }
-  lines.push("*Powered by Forvibe CLI \u2014 forvibe.app*");
-  lines.push("");
+  appendMarkdownFooter(lines, report);
   return lines.join("\n");
 }
+function appendMarkdownFooter(lines, report) {
+  const footer = versionFooter(report);
+  if (footer) {
+    lines.push(`*${footer}*`);
+    lines.push("");
+  }
+  lines.push("*Powered by Forvibe CLI (forvibe.app)*");
+  lines.push("");
+}
+
+// src/utils/version.ts
+import { createRequire } from "module";
+var FALLBACK_VERSION = "0.0.0";
+function getCliVersion() {
+  const require2 = createRequire(import.meta.url);
+  for (const candidate of ["../package.json", "../../package.json"]) {
+    try {
+      const pkg = require2(candidate);
+      if (pkg?.version && pkg.name === "@forvibe/cli") return pkg.version;
+    } catch {
+    }
+  }
+  return FALLBACK_VERSION;
+}
 
 // src/commands/review.ts
+var DEFAULT_RULEPACK_BASE_URL = "https://forvibe.app";
 function askQuestion2(question) {
   const rl = createInterface2({
     input: process.stdin,
@@ -3647,55 +6626,14 @@ function askQuestion2(question) {
 async function reviewCommand(options) {
   const rootDir = options.dir || process.cwd();
   const deep = options.deep ?? false;
+  const staticOnly = options.staticOnly ?? false;
   const format = options.format || "terminal";
+  const startTime = Date.now();
   console.log();
   console.log(
-    chalk3.bold("  Forvibe CLI") + chalk3.gray(" \u2014 App Store Review Simulation") + (deep ? chalk3.cyan(" [DEEP MODE]") : "")
+    chalk3.bold("  Forvibe CLI") + chalk3.gray(" - App Store Review Simulation") + (deep ? chalk3.cyan(" [DEEP MODE]") : "") + (staticOnly ? chalk3.cyan(" [STATIC ONLY]") : "")
   );
   console.log();
-  const availableProviders = getAvailableProviders(deep);
-  if (availableProviders.length === 0) {
-    console.log(chalk3.red("  \u2717 No AI API key found. Set one of the following:\n"));
-    console.log(
-      chalk3.cyan("    export ANTHROPIC_API_KEY=your-key") + chalk3.gray("   https://console.anthropic.com/settings/keys") + chalk3.green(" (recommended)")
-    );
-    console.log(
-      chalk3.cyan("    export OPENAI_API_KEY=your-key") + chalk3.gray("      https://platform.openai.com/api-keys")
-    );
-    console.log(
-      chalk3.cyan("    export GEMINI_API_KEY=your-key") + chalk3.gray("       https://aistudio.google.com/apikey")
-    );
-    console.log();
-    console.log(
-      chalk3.gray("  Your source code is analyzed locally \u2014 it never leaves your machine.\n")
-    );
-    process.exit(1);
-  }
-  let provider;
-  if (availableProviders.length === 1) {
-    provider = availableProviders[0].create();
-  } else {
-    console.log(chalk3.white("  Multiple AI API keys detected. Choose a provider:\n"));
-    availableProviders.forEach((p, i) => {
-      const label = `${i + 1}. ${p.name}${p.recommended ? chalk3.green(" (recommended)") : ""}`;
-      console.log(`    ${label}`);
-    });
-    console.log();
-    const answer = await askQuestion2(
-      chalk3.cyan(`  Enter choice (1-${availableProviders.length}): `)
-    );
-    const index = parseInt(answer, 10) - 1;
-    if (isNaN(index) || index < 0 || index >= availableProviders.length) {
-      const recommended = availableProviders.find((p) => p.recommended) || availableProviders[0];
-      provider = recommended.create();
-      console.log(chalk3.gray(`  Using ${recommended.name} (default)
-`));
-    } else {
-      provider = availableProviders[index].create();
-    }
-  }
-  console.log(chalk3.gray(`  AI Provider: ${provider.name} \u2713`));
-  console.log();
   const techSpinner = ora2({
     text: "Detecting tech stack...",
     prefixText: "  "
@@ -3704,7 +6642,7 @@ async function reviewCommand(options) {
   if (techStack.stack === "unknown") {
     techSpinner.fail(
       chalk3.red(
-        "No supported project found. Supported: Swift, Flutter, React Native, Kotlin, Capacitor, .NET MAUI"
+        "No supported project found. Supported: Swift, Objective-C, Flutter, React Native, Kotlin, Kotlin Multiplatform, Capacitor, .NET MAUI, Unity"
       )
     );
     process.exit(1);
@@ -3722,59 +6660,199 @@ async function reviewCommand(options) {
   configSpinner.succeed(
     `Config: ${chalk3.white(appName)} ${bundleId ? chalk3.gray(`(${bundleId})`) : ""}`
   );
-  const sdkSpinner = ora2({
-    text: "Scanning dependencies...",
+  const rulepackSpinner = ora2({
+    text: "Loading review rulepack...",
     prefixText: "  "
   }).start();
-  const sdkScan = scanSDKs(rootDir, techStack.stack);
-  sdkSpinner.succeed(
-    `Dependencies: ${chalk3.bold(String(sdkScan.detected_sdks.length))} known SDKs detected`
+  const rulepackBaseUrl = options.rulepackUrl || options.apiUrl || DEFAULT_RULEPACK_BASE_URL;
+  let loadedRulepack;
+  try {
+    loadedRulepack = await loadRulepackBundle({ baseUrl: rulepackBaseUrl });
+  } catch (error) {
+    rulepackSpinner.fail(
+      chalk3.red(error instanceof Error ? error.message : "Failed to load rulepack")
+    );
+    process.exit(1);
+  }
+  const { bundle } = loadedRulepack;
+  rulepackSpinner.succeed(
+    `Rulepack ${chalk3.bold(`v${loadedRulepack.version}`)} ${chalk3.gray(`(${loadedRulepack.source})`)}`
   );
   const sourceSpinner = ora2({
     text: "Reading source code...",
     prefixText: "  "
   }).start();
   const maxChars = deep ? 4e5 : 15e4;
-  const sourceCode = readSourceCode(rootDir, techStack.stack, maxChars);
+  const sourceFiles = readSourceFiles(rootDir, techStack.stack, maxChars);
+  const sourceCode = joinSourceFiles(sourceFiles);
   const projectTree = generateProjectTree(rootDir);
   const sourceLines = sourceCode.split("\n").length;
   sourceSpinner.succeed(
-    `Source code: ${chalk3.bold(String(sourceLines))} lines analyzed`
+    `Source code: ${chalk3.bold(String(sourceLines))} lines in ${chalk3.bold(String(sourceFiles.length))} files`
   );
-  console.log();
-  const reviewSpinner = ora2({
-    text: deep ? `Running deep review with ${provider.name} (Pass 1: feature detection, Pass 2: Apple reviewer simulation)...` : `Running review with ${provider.name} (simulating Apple's review process)...`,
+  const staticSpinner = ora2({
+    text: "Running static rule engine...",
     prefixText: "  "
   }).start();
+  const staticResult = runStaticEngine({
+    rootDir,
+    stackResult: techStack,
+    appConfig: {
+      app_name: config.app_name,
+      bundle_id: config.bundle_id,
+      version: config.version,
+      min_ios_version: config.min_ios_version,
+      min_android_sdk: config.min_android_sdk
+    },
+    bundle,
+    sourceFiles
+  });
+  const checkCount = (status) => staticResult.checks.filter((c) => c.status === status).length;
+  staticSpinner.succeed(
+    `Static scan: ${chalk3.red(`${checkCount("fail")} failed`)}, ${chalk3.yellow(`${checkCount("unverified")} unverified`)}, ${chalk3.green(`${checkCount("pass")} passed`)}, ${chalk3.gray(`${checkCount("na")} n/a`)}`
+  );
+  let provider = null;
+  if (!staticOnly) {
+    const availableProviders = getAvailableProviders(deep);
+    if (availableProviders.length === 0) {
+      console.log();
+      console.log(
+        chalk3.yellow(
+          "  No AI API key found. AI behavioral review skipped. Static rule results below."
+        )
+      );
+      console.log(chalk3.gray("  To enable the AI review pass, set one of the following:"));
+      console.log(
+        chalk3.cyan("    export ANTHROPIC_API_KEY=your-key") + chalk3.gray("   https://console.anthropic.com/settings/keys") + chalk3.green(" (recommended)")
+      );
+      console.log(
+        chalk3.cyan("    export OPENAI_API_KEY=your-key") + chalk3.gray("      https://platform.openai.com/api-keys")
+      );
+      console.log(
+        chalk3.cyan("    export GEMINI_API_KEY=your-key") + chalk3.gray("       https://aistudio.google.com/apikey")
+      );
+      console.log();
+    } else if (availableProviders.length === 1) {
+      provider = availableProviders[0].create();
+    } else {
+      console.log();
+      console.log(chalk3.white("  Multiple AI API keys detected. Choose a provider:\n"));
+      availableProviders.forEach((p, i) => {
+        const label = `${i + 1}. ${p.name}${p.recommended ? chalk3.green(" (recommended)") : ""}`;
+        console.log(`    ${label}`);
+      });
+      console.log();
+      const answer = await askQuestion2(
+        chalk3.cyan(`  Enter choice (1-${availableProviders.length}): `)
+      );
+      const index = parseInt(answer, 10) - 1;
+      if (isNaN(index) || index < 0 || index >= availableProviders.length) {
+        const recommended = availableProviders.find((p) => p.recommended) || availableProviders[0];
+        provider = recommended.create();
+        console.log(chalk3.gray(`  Using ${recommended.name} (default)
+`));
+      } else {
+        provider = availableProviders[index].create();
+      }
+    }
+    if (provider) {
+      console.log(chalk3.gray(`  AI Provider: ${provider.name} \u2713`));
+      console.log();
+    }
+  }
   let report;
-  try {
+  if (!provider) {
+    report = assembleReportV2({
+      platform: techStack.label,
+      bundleId: config.bundle_id,
+      sourceFilesAnalyzed: sourceFiles.length,
+      featuresDetected: [],
+      staticFindings: staticResult.findings,
+      aiFindings: [],
+      checks: staticResult.checks,
+      profile: staticResult.profile,
+      rulepack: {
+        version: loadedRulepack.version,
+        store: bundle.store,
+        source: loadedRulepack.source
+      },
+      engineVersion: getCliVersion(),
+      aiReviewRan: false,
+      ragStoriesUsed: 0,
+      scanDurationMs: Date.now() - startTime
+    });
+  } else {
     const enrichedSource = buildEnrichedContext(
       sourceCode,
       projectTree,
-      sdkScan,
-      config
-    );
-    report = await runCodeReview(
-      provider,
-      techStack.label,
-      appName,
-      bundleId,
-      enrichedSource,
-      sourceLines,
-      deep
-    );
-    reviewSpinner.succeed(
-      chalk3.green(
-        `Review complete! ${report.summary.total_findings} findings (${report.summary.high_risk} high risk)`
-      )
-    );
-  } catch (error) {
-    reviewSpinner.fail(
-      chalk3.red(
-        `Review failed: ${error instanceof Error ? error.message : "Unknown error"}`
-      )
+      staticResult.profile.sdks
     );
-    process.exit(1);
+    const { text: redactedSource, redactedCount } = redactSecrets(enrichedSource);
+    if (redactedCount > 0) {
+      console.log(
+        chalk3.yellow(
+          `  Redacted ${redactedCount} secret-like values before sending source to the AI provider.`
+        )
+      );
+      console.log();
+    }
+    const reviewSpinner = ora2({
+      text: deep ? `Running deep review with ${provider.name} (Pass 1: feature detection, Pass 2: Apple reviewer simulation)...` : `Running review with ${provider.name} (simulating Apple's review process)...`,
+      prefixText: "  "
+    }).start();
+    try {
+      const aiResult = await runCodeReview({
+        provider,
+        platform: techStack.label,
+        appName,
+        bundleId,
+        sourceContext: redactedSource,
+        deep,
+        profile: staticResult.profile,
+        staticChecks: staticResult.checks,
+        staticFindings: staticResult.findings,
+        bundle
+      });
+      report = assembleReportV2({
+        platform: techStack.label,
+        bundleId: config.bundle_id,
+        sourceFilesAnalyzed: sourceFiles.length,
+        featuresDetected: aiResult.featuresDetected,
+        staticFindings: aiResult.staticFindings,
+        aiFindings: aiResult.aiFindings,
+        checks: aiResult.checks,
+        profile: aiResult.profile,
+        rulepack: {
+          version: loadedRulepack.version,
+          store: bundle.store,
+          source: loadedRulepack.source
+        },
+        engineVersion: getCliVersion(),
+        aiReviewRan: true,
+        aiAssessment: aiResult.aiAssessment,
+        ragStoriesUsed: aiResult.ragStoriesUsed,
+        scanDurationMs: Date.now() - startTime
+      });
+      reviewSpinner.succeed(
+        chalk3.green(
+          `Review complete! ${report.summary.total_findings} findings (${report.summary.high_risk} high risk)`
+        )
+      );
+      if (aiResult.dedupedCount > 0) {
+        console.log(
+          chalk3.gray(
+            `  Deduplicated ${aiResult.dedupedCount} findings already covered by static analysis.`
+          )
+        );
+      }
+    } catch (error) {
+      reviewSpinner.fail(
+        chalk3.red(
+          `Review failed: ${error instanceof Error ? error.message : "Unknown error"}`
+        )
+      );
+      process.exit(1);
+    }
   }
   switch (format) {
     case "json":
@@ -3839,14 +6917,16 @@ async function reviewCommand(options) {
     }
   }
 }
-function buildEnrichedContext(sourceCode, projectTree, sdkScan, config) {
+function buildEnrichedContext(sourceCode, projectTree, sdks) {
   const sections = [];
   sections.push(`## Project Structure
 \`\`\`
 ${projectTree}
 \`\`\``);
-  if (sdkScan.detected_sdks.length > 0) {
-    const sdkList = sdkScan.detected_sdks.map((sdk) => `- ${sdk.name} (${sdk.category})${sdk.collects.length > 0 ? ` \u2014 collects: ${sdk.collects.join(", ")}` : ""}`).join("\n");
+  if (sdks.length > 0) {
+    const sdkList = sdks.map(
+      (sdk) => `- ${sdk.name} (${sdk.category})${sdk.data_collection.length > 0 ? `, collects: ${sdk.data_collection.join(", ")}` : ""}`
+    ).join("\n");
     sections.push(`## Detected SDKs
 ${sdkList}`);
   }
@@ -3858,7 +6938,7 @@ ${sourceCode}`);
 
 // src/index.ts
 var program = new Command();
-program.name("forvibe").description("Forvibe CLI \u2014 AI-powered App Store automation").version("0.1.0");
+program.name("forvibe").description("Forvibe CLI - AI-powered App Store automation").version(getCliVersion());
 program.command("analyze", { isDefault: true }).description(
   "Analyze your project and send the report to Forvibe for automated App Store setup"
 ).option("-d, --dir <path>", "Project directory to analyze", process.cwd()).option(
@@ -3868,9 +6948,13 @@ program.command("analyze", { isDefault: true }).description(
 ).action(analyzeCommand);
 program.command("review").description(
   "Simulate Apple's App Store review process on your project"
-).option("-d, --dir <path>", "Project directory to review", process.cwd()).option("--deep", "Enable deep 2-pass review (feature detection + reviewer simulation)").option("--format <type>", "Output format: terminal, json, markdown", "terminal").option("--send", "Send results to Forvibe for combined review with metadata analysis").option(
+).option("-d, --dir <path>", "Project directory to review", process.cwd()).option("--deep", "Enable deep 2-pass review (feature detection + reviewer simulation)").option("--format <type>", "Output format: terminal, json, markdown", "terminal").option("--static-only", "Run only the static rule engine, skipping the AI behavioral review (no API key needed)").option("--send", "Send results to Forvibe for combined review with metadata analysis").option(
   "--api-url <url>",
   "Forvibe API URL (for development)",
   void 0
+).option(
+  "--rulepack-url <url>",
+  "Base URL to fetch the review rulepack from (defaults to the Forvibe API URL)",
+  void 0
 ).action(reviewCommand);
 program.parse();