@forvibe/cli 2.0.0 → 2.0.1

package/dist/index.js

@@ -6,13 +6,13 @@ import { Command } from "commander";
 // src/commands/analyze.ts
 import { createInterface } from "readline";
 import { readFileSync as readFileSync5, statSync as statSync6 } from "fs";
-import { basename as basename3, extname as extname4, relative as relative5 } from "path";
+import { basename as basename3, extname as extname4, relative as relative4 } from "path";
 import chalk from "chalk";
 import ora from "ora";
 
 // src/analyzers/tech-detector.ts
 import { existsSync as existsSync2, readdirSync as readdirSync2 } from "fs";
-import { join as join2, relative as relative2 } from "path";
+import { join as join2 } from "path";
 
 // src/utils/file-scanner.ts
 import { readFileSync, readdirSync, statSync, existsSync } from "fs";
@@ -129,7 +129,7 @@ function findFiles(rootDir, extensions, maxDepth = 5) {
     (f) => join(rootDir, f)
   );
 }
-function readFileSafe(filePath) {
+function readFileSafe2(filePath) {
   try {
     if (!existsSync(filePath)) return null;
     const stat = statSync(filePath);
@@ -139,22 +139,8 @@ function readFileSafe(filePath) {
     return null;
   }
 }
-function fileExists(filePath) {
-  return existsSync(filePath);
-}
 
 // src/analyzers/tech-detector.ts
-var KMP_PLUGIN_MARKER_RE = /kotlin\(\s*["']multiplatform["']\s*\)|id\(\s*["']org\.jetbrains\.kotlin\.multiplatform["']\s*\)|kotlinMultiplatform/;
-function findKmpModuleGradleFile(dir) {
-  const candidates = findFiles(dir, ["build.gradle.kts", "build.gradle"], 2);
-  for (const candidate of candidates) {
-    const content = readFileSafe(candidate);
-    if (content && KMP_PLUGIN_MARKER_RE.test(content)) {
-      return relative2(dir, candidate);
-    }
-  }
-  return null;
-}
 var DETECTION_RULES = [
   {
     stack: "flutter",
@@ -176,7 +162,7 @@ var DETECTION_RULES = [
     detect: (dir) => {
       const files = [];
       const pkgPath = join2(dir, "package.json");
-      const pkgContent = existsSync2(pkgPath) ? readFileSafe(pkgPath) : null;
+      const pkgContent = existsSync2(pkgPath) ? readFileSafe2(pkgPath) : null;
       let hasExpoDep = false;
       if (pkgContent) {
         try {
@@ -191,7 +177,7 @@ var DETECTION_RULES = [
       let hasExpoBlock = false;
       const appJsonPath = join2(dir, "app.json");
       if (existsSync2(appJsonPath)) {
-        const appJson = readFileSafe(appJsonPath);
+        const appJson = readFileSafe2(appJsonPath);
         if (appJson && /"expo"\s*:\s*\{/.test(appJson)) {
           hasExpoBlock = true;
         }
@@ -216,7 +202,7 @@ var DETECTION_RULES = [
       const files = [];
       const pkgPath = join2(dir, "package.json");
       if (existsSync2(pkgPath)) {
-        const content = readFileSafe(pkgPath);
+        const content = readFileSafe2(pkgPath);
         if (content && content.includes('"react-native"')) {
           files.push("package.json");
           if (existsSync2(join2(dir, "app.json"))) files.push("app.json");
@@ -251,7 +237,7 @@ var DETECTION_RULES = [
   },
   {
     stack: "swift",
-    label: "iOS Native (Swift/Objective-C)",
+    label: "Swift / SwiftUI",
     platforms: ["ios"],
     detect: (dir) => {
       const files = [];
@@ -268,7 +254,7 @@ var DETECTION_RULES = [
       try {
         const entries = readdirSync2(dir);
         for (const entry of entries) {
-          if (entry.endsWith(".swift") || entry.endsWith(".m") || entry.endsWith(".mm")) {
+          if (entry.endsWith(".swift")) {
             files.push(entry);
             break;
           }
@@ -278,37 +264,6 @@ var DETECTION_RULES = [
       return files;
     }
   },
-  {
-    stack: "unity",
-    label: "Unity",
-    platforms: ["ios", "android"],
-    detect: (dir) => {
-      const manifest = join2(dir, "Packages", "manifest.json");
-      const projectSettings = join2(dir, "ProjectSettings", "ProjectSettings.asset");
-      const assets = join2(dir, "Assets");
-      if (existsSync2(manifest) && existsSync2(projectSettings) && existsSync2(assets)) {
-        return [
-          "Packages/manifest.json",
-          "ProjectSettings/ProjectSettings.asset",
-          "Assets/"
-        ];
-      }
-      return [];
-    }
-  },
-  {
-    stack: "kmp",
-    label: "Kotlin Multiplatform",
-    platforms: ["ios", "android"],
-    detect: (dir) => {
-      const rootGradleFile = ["build.gradle.kts", "build.gradle", "settings.gradle.kts", "settings.gradle"].find((name) => existsSync2(join2(dir, name)));
-      if (!rootGradleFile) return [];
-      if (!existsSync2(join2(dir, "iosApp"))) return [];
-      const moduleGradleFile = findKmpModuleGradleFile(dir);
-      if (!moduleGradleFile) return [];
-      return [rootGradleFile, moduleGradleFile, "iosApp/"];
-    }
-  },
   {
     stack: "kotlin",
     label: "Android (Kotlin)",
@@ -339,7 +294,7 @@ var DETECTION_RULES = [
         const entries = readdirSync2(dir);
         for (const entry of entries) {
           if (entry.endsWith(".csproj")) {
-            const content = readFileSafe(join2(dir, entry));
+            const content = readFileSafe2(join2(dir, entry));
             if (!content) continue;
             const isMaui = /<UseMaui>\s*true\s*<\/UseMaui>/i.test(content) || /Microsoft\.Maui\.Controls/.test(content) || /Microsoft\.Maui\.Sdk/.test(content) || /-android|-ios|-maccatalyst/.test(content);
             if (isMaui) {
@@ -396,10 +351,6 @@ function parseConfig(rootDir, techStack) {
       return parseCapacitorConfig(rootDir);
     case "dotnet-maui":
       return parseMauiConfig(rootDir);
-    case "unity":
-      return parseUnityConfig(rootDir);
-    case "kmp":
-      return parseKmpConfig(rootDir);
     default:
       return emptyConfig();
   }
@@ -416,7 +367,7 @@ function emptyConfig() {
 }
 function parseFlutterConfig(rootDir) {
   const config = emptyConfig();
-  const pubspecContent = readFileSafe(join3(rootDir, "pubspec.yaml"));
+  const pubspecContent = readFileSafe2(join3(rootDir, "pubspec.yaml"));
   if (pubspecContent) {
     try {
       const pubspec = YAML.parse(pubspecContent);
@@ -441,7 +392,7 @@ function parseFlutterConfig(rootDir) {
   if (!config.bundle_id || config.bundle_id.includes("$(")) {
     const pbxprojPath = findFile(join3(rootDir, "ios"), "project.pbxproj", 4);
     if (pbxprojPath) {
-      const content = readFileSafe(pbxprojPath);
+      const content = readFileSafe2(pbxprojPath);
       if (content) {
         const bundleMatch = content.match(
           /PRODUCT_BUNDLE_IDENTIFIER\s*=\s*"?([^";]+)"?/
@@ -464,7 +415,7 @@ function parseFlutterConfig(rootDir) {
 }
 function parseExpoConfig(rootDir) {
   const config = emptyConfig();
-  const appJsonContent = readFileSafe(join3(rootDir, "app.json"));
+  const appJsonContent = readFileSafe2(join3(rootDir, "app.json"));
   if (appJsonContent) {
     try {
       const appJson = JSON.parse(appJsonContent);
@@ -479,7 +430,7 @@ function parseExpoConfig(rootDir) {
   }
   if (!config.app_name || !config.bundle_id || !config.version) {
     for (const name of ["app.config.ts", "app.config.js"]) {
-      const content = readFileSafe(join3(rootDir, name));
+      const content = readFileSafe2(join3(rootDir, name));
       if (!content) continue;
       if (!config.app_name) {
         const m = content.match(/name\s*:\s*['"]([^'"]+)['"]/);
@@ -499,7 +450,7 @@ function parseExpoConfig(rootDir) {
       }
     }
   }
-  const pkgContent = readFileSafe(join3(rootDir, "package.json"));
+  const pkgContent = readFileSafe2(join3(rootDir, "package.json"));
   if (pkgContent) {
     try {
       const pkg = JSON.parse(pkgContent);
@@ -540,7 +491,7 @@ function parseExpoConfig(rootDir) {
 }
 function parseReactNativeConfig(rootDir) {
   const config = emptyConfig();
-  const appJsonContent = readFileSafe(join3(rootDir, "app.json"));
+  const appJsonContent = readFileSafe2(join3(rootDir, "app.json"));
   if (appJsonContent) {
     try {
       const appJson = JSON.parse(appJsonContent);
@@ -550,7 +501,7 @@ function parseReactNativeConfig(rootDir) {
   }
   if (!config.app_name) {
     for (const name of ["app.config.ts", "app.config.js"]) {
-      const content = readFileSafe(join3(rootDir, name));
+      const content = readFileSafe2(join3(rootDir, name));
       if (!content) continue;
       const m = content.match(/name\s*:\s*['"]([^'"]+)['"]/);
       if (m) {
@@ -559,7 +510,7 @@ function parseReactNativeConfig(rootDir) {
       }
     }
   }
-  const pkgContent = readFileSafe(join3(rootDir, "package.json"));
+  const pkgContent = readFileSafe2(join3(rootDir, "package.json"));
   if (pkgContent) {
     try {
       const pkg = JSON.parse(pkgContent);
@@ -586,7 +537,7 @@ function parseReactNativeConfig(rootDir) {
   if (!config.bundle_id || config.bundle_id.includes("$(")) {
     const pbxprojPath = findFile(join3(rootDir, "ios"), "project.pbxproj", 4);
     if (pbxprojPath) {
-      const content = readFileSafe(pbxprojPath);
+      const content = readFileSafe2(pbxprojPath);
       if (content) {
         const bundleMatch = content.match(
           /PRODUCT_BUNDLE_IDENTIFIER\s*=\s*"?([^";]+)"?/
@@ -698,7 +649,7 @@ function parseSwiftConfig(rootDir) {
   const config = emptyConfig();
   const pbxprojPath = findFile(rootDir, "project.pbxproj", 5);
   if (pbxprojPath) {
-    const content = readFileSafe(pbxprojPath);
+    const content = readFileSafe2(pbxprojPath);
     if (content) {
       const pbx = parsePbxproj(content);
       config.bundle_id = pbx.bundleId;
@@ -780,7 +731,7 @@ function parseCapacitorConfig(rootDir) {
     "capacitor.config.ts",
     "capacitor.config.js"
   ]) {
-    const content = readFileSafe(join3(rootDir, name));
+    const content = readFileSafe2(join3(rootDir, name));
     if (content) {
       if (name.endsWith(".json")) {
         try {
@@ -798,7 +749,7 @@ function parseCapacitorConfig(rootDir) {
       break;
     }
   }
-  const pkgContent = readFileSafe(join3(rootDir, "package.json"));
+  const pkgContent = readFileSafe2(join3(rootDir, "package.json"));
   if (pkgContent) {
     try {
       const pkg = JSON.parse(pkgContent);
@@ -815,7 +766,7 @@ function parseMauiConfig(rootDir) {
     const entries = readdirSync3(rootDir);
     for (const entry of entries) {
       if (entry.endsWith(".csproj")) {
-        const content = readFileSafe(join3(rootDir, entry));
+        const content = readFileSafe2(join3(rootDir, entry));
         if (content) {
           const appIdMatch = content.match(
             /<ApplicationId>(.*?)<\/ApplicationId>/
@@ -837,60 +788,8 @@ function parseMauiConfig(rootDir) {
   }
   return config;
 }
-function parseUnityConfig(rootDir) {
-  const config = emptyConfig();
-  const content = readFileSafe(
-    join3(rootDir, "ProjectSettings", "ProjectSettings.asset")
-  );
-  if (!content) return config;
-  const productNameMatch = content.match(/^\s*productName:\s*(.+)$/m);
-  if (productNameMatch) config.app_name = productNameMatch[1].trim();
-  const versionMatch = content.match(/^\s*bundleVersion:\s*(\S+)/m);
-  if (versionMatch) config.version = versionMatch[1].trim();
-  const blockIdx = content.indexOf("applicationIdentifier:");
-  if (blockIdx >= 0) {
-    const after = content.slice(blockIdx + "applicationIdentifier:".length);
-    const nextSiblingKey = after.search(/\n {0,2}\S/);
-    const block = nextSiblingKey >= 0 ? after.slice(0, nextSiblingKey) : after;
-    const iphone = block.match(/iPhone:\s*(\S+)/);
-    const android = block.match(/Android:\s*(\S+)/);
-    const id = iphone?.[1] ?? android?.[1] ?? null;
-    if (id) config.bundle_id = id.trim();
-  }
-  return config;
-}
-function parseKmpConfig(rootDir) {
-  const config = emptyConfig();
-  for (const moduleName of ["androidApp", "composeApp", "app"]) {
-    const moduleDir = join3(rootDir, moduleName);
-    let gradleConfig = parseGradle(join3(moduleDir, "build.gradle.kts"));
-    if (!gradleConfig.applicationId) {
-      gradleConfig = parseGradle(join3(moduleDir, "build.gradle"));
-    }
-    if (gradleConfig.applicationId) {
-      config.bundle_id = gradleConfig.applicationId;
-      if (gradleConfig.versionName) config.version = gradleConfig.versionName;
-      if (gradleConfig.minSdk) config.min_android_sdk = gradleConfig.minSdk;
-      break;
-    }
-  }
-  const infoPlistPath = findFile(join3(rootDir, "iosApp"), "Info.plist", 3);
-  if (infoPlistPath) {
-    const plistData = parsePlist(infoPlistPath);
-    if (plistData) {
-      const displayName = plistData.CFBundleDisplayName || plistData.CFBundleName;
-      if (displayName && !isXcodeVariable(displayName)) {
-        config.app_name = displayName;
-      }
-      if (!config.min_ios_version) {
-        config.min_ios_version = plistData.MinimumOSVersion || null;
-      }
-    }
-  }
-  return config;
-}
 function parsePlist(filePath) {
-  const content = readFileSafe(filePath);
+  const content = readFileSafe2(filePath);
   if (!content) return null;
   try {
     return plist.parse(content);
@@ -901,7 +800,7 @@ function parsePlist(filePath) {
 function lookupAndroidString(searchDir, stringName) {
   const stringsPath = findFile(searchDir, "strings.xml", 8);
   if (!stringsPath) return null;
-  const content = readFileSafe(stringsPath);
+  const content = readFileSafe2(stringsPath);
   if (!content) return null;
   const escaped = stringName.replace(/[-/\\^$*+?.()|[\]{}]/g, "\\$&");
   const pattern = new RegExp(
@@ -913,7 +812,7 @@ function lookupAndroidString(searchDir, stringName) {
 function readAndroidAppName(searchDir) {
   const manifestPath = findFile(searchDir, "AndroidManifest.xml", 6);
   if (manifestPath) {
-    const content = readFileSafe(manifestPath);
+    const content = readFileSafe2(manifestPath);
     if (content) {
       const labelMatch = content.match(/android:label\s*=\s*"([^"]+)"/);
       if (labelMatch) {
@@ -931,7 +830,7 @@ function readAndroidAppName(searchDir) {
   return lookupAndroidString(searchDir, "app_name");
 }
 function parseGradle(filePath) {
-  const content = readFileSafe(filePath);
+  const content = readFileSafe2(filePath);
   if (!content) return { applicationId: null, versionName: null, minSdk: null };
   const appIdMatch = content.match(
     /applicationId\s*[=:]\s*['"]([^'"]+)['"]/
@@ -1271,7 +1170,7 @@ function getDependencies(rootDir, techStack) {
   const deps = [];
   switch (techStack) {
     case "flutter": {
-      const pubspecContent = readFileSafe(join4(rootDir, "pubspec.yaml"));
+      const pubspecContent = readFileSafe2(join4(rootDir, "pubspec.yaml"));
       if (pubspecContent) {
         try {
           const pubspec = YAML2.parse(pubspecContent);
@@ -1289,7 +1188,7 @@ function getDependencies(rootDir, techStack) {
     case "expo":
     case "react-native":
     case "capacitor": {
-      const pkgContent = readFileSafe(join4(rootDir, "package.json"));
+      const pkgContent = readFileSafe2(join4(rootDir, "package.json"));
       if (pkgContent) {
         try {
           const pkg = JSON.parse(pkgContent);
@@ -1313,7 +1212,7 @@ function getDependencies(rootDir, techStack) {
         if (!csprojFiles.includes(f)) csprojFiles.push(f);
       }
       for (const path2 of csprojFiles) {
-        const content = readFileSafe(path2);
+        const content = readFileSafe2(path2);
         if (!content) continue;
         const pkgMatches = content.matchAll(
           /<PackageReference\s+[^>]*Include\s*=\s*"([^"]+)"/g
@@ -1325,14 +1224,14 @@ function getDependencies(rootDir, techStack) {
       break;
     }
     case "swift": {
-      const podfileContent = readFileSafe(join4(rootDir, "Podfile"));
+      const podfileContent = readFileSafe2(join4(rootDir, "Podfile"));
       if (podfileContent) {
         const podMatches = podfileContent.matchAll(/pod\s+['"]([^'"]+)['"]/g);
         for (const match of podMatches) {
           deps.push(match[1]);
         }
       }
-      const packageSwift = readFileSafe(join4(rootDir, "Package.swift"));
+      const packageSwift = readFileSafe2(join4(rootDir, "Package.swift"));
       if (packageSwift) {
         const urlMatches = packageSwift.matchAll(
           /\.package\([^)]*url:\s*"[^"]*\/([^/"]+?)(?:\.git)?"/g
@@ -1343,7 +1242,7 @@ function getDependencies(rootDir, techStack) {
       }
       const pbxprojPath = findFile(rootDir, "project.pbxproj", 5);
       if (pbxprojPath) {
-        const pbxContent = readFileSafe(pbxprojPath);
+        const pbxContent = readFileSafe2(pbxprojPath);
         if (pbxContent) {
           const spmMatches = pbxContent.matchAll(
             /repositoryURL\s*=\s*"[^"]*\/([^/"]+?)(?:\.git)?"/g
@@ -1358,7 +1257,7 @@ function getDependencies(rootDir, techStack) {
       const swiftFiles = findFiles(rootDir, [".swift"], 6);
       const nativeImports = /* @__PURE__ */ new Set();
       for (const file of swiftFiles.slice(0, 100)) {
-        const content = readFileSafe(file);
+        const content = readFileSafe2(file);
         if (!content) continue;
         const importMatches = content.matchAll(/^import\s+(\w+)/gm);
         for (const match of importMatches) {
@@ -1377,7 +1276,7 @@ function getDependencies(rootDir, techStack) {
         join4(rootDir, "gradle/libs.versions.toml"),
         join4(rootDir, "libs.versions.toml")
       ]) {
-        const content = readFileSafe(p);
+        const content = readFileSafe2(p);
         if (content) parseVersionCatalog(content, catalog);
       }
       const gradleFiles = /* @__PURE__ */ new Set([
@@ -1401,7 +1300,7 @@ function getDependencies(rootDir, techStack) {
       const coordRegex = /['"]([a-zA-Z][\w.-]*\.[a-zA-Z][\w.-]*:[a-zA-Z][\w.-]*(?::[^'"\s]+)?)['"]/g;
       const libsRefRegex = /\blibs\.([a-zA-Z][\w.]*)/g;
       for (const path2 of gradleFiles) {
-        const content = readFileSafe(path2);
+        const content = readFileSafe2(path2);
         if (!content) continue;
         for (const m of content.matchAll(coordRegex)) {
           addCoord(m[1]);
@@ -1434,7 +1333,7 @@ function getDependencies(rootDir, techStack) {
         if (seen.has(file)) continue;
         seen.add(file);
         if (seen.size > 200) break;
-        const content = readFileSafe(file);
+        const content = readFileSafe2(file);
         if (!content) continue;
         for (const prefix of androidFrameworkPrefixes) {
           if (content.includes(`import ${prefix}`) && !androidNativeImports.has(prefix)) {
@@ -1448,259 +1347,6 @@ function getDependencies(rootDir, techStack) {
   }
   return deps;
 }
-function dedupeSorted(values) {
-  return Array.from(new Set(values)).sort();
-}
-function gradleCandidateFiles(baseDir) {
-  const candidates = /* @__PURE__ */ new Set([
-    join4(baseDir, "app/build.gradle"),
-    join4(baseDir, "app/build.gradle.kts"),
-    join4(baseDir, "build.gradle"),
-    join4(baseDir, "build.gradle.kts")
-  ]);
-  for (const f of findFiles(baseDir, ["build.gradle", "build.gradle.kts"], 5)) {
-    candidates.add(f);
-  }
-  return Array.from(candidates);
-}
-function collectGradleCoordinates(androidRoot, gradleFiles) {
-  const catalog = /* @__PURE__ */ new Map();
-  for (const p of [
-    join4(androidRoot, "gradle/libs.versions.toml"),
-    join4(androidRoot, "libs.versions.toml")
-  ]) {
-    const content = readFileSafe(p);
-    if (content) parseVersionCatalog(content, catalog);
-  }
-  const coordRegex = /['"]([a-zA-Z][\w.-]*\.[a-zA-Z][\w.-]*:[a-zA-Z][\w.-]*(?::[^'"\s]+)?)['"]/g;
-  const libsRefRegex = /\blibs\.([a-zA-Z][\w.]*)/g;
-  const deps = [];
-  const addCoord = (coord) => {
-    const parts = coord.split(":");
-    if (parts.length < 2) return;
-    const [group, artifact] = parts;
-    if (!group || !artifact) return;
-    deps.push(`${group}:${artifact}`);
-  };
-  for (const path2 of gradleFiles) {
-    const content = readFileSafe(path2);
-    if (!content) continue;
-    const filtered = content.split("\n").filter((line) => !/^\s*classpath\b/.test(line)).join("\n");
-    for (const m of filtered.matchAll(coordRegex)) {
-      addCoord(m[1]);
-    }
-    for (const m of filtered.matchAll(libsRefRegex)) {
-      const ref = m[1];
-      const resolved = catalog.get(ref) || catalog.get(ref.replace(/\./g, "-"));
-      if (resolved) addCoord(resolved);
-    }
-  }
-  return dedupeSorted(deps);
-}
-function collectPodfilePods(podfilePath) {
-  const content = readFileSafe(podfilePath);
-  if (!content) return [];
-  const deps = [];
-  for (const m of content.matchAll(/pod\s+['"]([^'"]+)['"]/g)) {
-    deps.push(m[1]);
-  }
-  return dedupeSorted(deps);
-}
-function collectSpmSlugs(rootDir) {
-  const deps = [];
-  const packageSwift = readFileSafe(join4(rootDir, "Package.swift"));
-  if (packageSwift) {
-    for (const m of packageSwift.matchAll(
-      /\.package\([^)]*url:\s*"[^"]*\/([^/"]+?)(?:\.git)?"/g
-    )) {
-      deps.push(m[1].toLowerCase());
-    }
-  }
-  const pbxprojPath = findFile(rootDir, "project.pbxproj", 5);
-  if (pbxprojPath) {
-    const pbxContent = readFileSafe(pbxprojPath);
-    if (pbxContent) {
-      for (const m of pbxContent.matchAll(
-        /repositoryURL\s*=\s*"[^"]*\/([^/"]+?)(?:\.git)?"/g
-      )) {
-        deps.push(m[1].toLowerCase());
-      }
-    }
-  }
-  return dedupeSorted(deps);
-}
-function collectSwiftImports(rootDir) {
-  const sourceFiles = findFiles(rootDir, [".swift", ".m", ".mm"], 6);
-  const imports = /* @__PURE__ */ new Set();
-  for (const file of sourceFiles.slice(0, 100)) {
-    const content = readFileSafe(file);
-    if (!content) continue;
-    for (const m of content.matchAll(/^\s*import\s+(\w+)/gm)) {
-      imports.add(m[1]);
-    }
-    for (const m of content.matchAll(/@import\s+(\w+)\s*;/g)) {
-      imports.add(m[1]);
-    }
-    for (const m of content.matchAll(/#import\s*<([^\/>]+)(?:\/[^>]*)?>/g)) {
-      imports.add(m[1]);
-    }
-  }
-  return dedupeSorted(Array.from(imports));
-}
-function collectAndroidImports(rootDir) {
-  const files = [
-    ...findFiles(join4(rootDir, "app/src"), [".kt", ".java"], 8),
-    ...findFiles(rootDir, [".kt", ".java"], 6)
-  ];
-  const seen = /* @__PURE__ */ new Set();
-  const imports = /* @__PURE__ */ new Set();
-  for (const file of files) {
-    if (seen.has(file)) continue;
-    seen.add(file);
-    if (seen.size > 200) break;
-    const content = readFileSafe(file);
-    if (!content) continue;
-    for (const m of content.matchAll(/^\s*import\s+([\w.]+)/gm)) {
-      imports.add(m[1].replace(/\.$/, ""));
-    }
-  }
-  return dedupeSorted(Array.from(imports));
-}
-function collectPubspecDeps(pubspecPath) {
-  const content = readFileSafe(pubspecPath);
-  if (!content) return [];
-  const deps = [];
-  try {
-    const pubspec = YAML2.parse(content);
-    if (pubspec?.dependencies) deps.push(...Object.keys(pubspec.dependencies));
-    if (pubspec?.dev_dependencies) deps.push(...Object.keys(pubspec.dev_dependencies));
-  } catch {
-  }
-  return dedupeSorted(deps);
-}
-function collectPackageJsonDeps(pkgPath) {
-  const content = readFileSafe(pkgPath);
-  if (!content) return [];
-  const deps = [];
-  try {
-    const pkg = JSON.parse(content);
-    if (pkg.dependencies) deps.push(...Object.keys(pkg.dependencies));
-    if (pkg.devDependencies) deps.push(...Object.keys(pkg.devDependencies));
-  } catch {
-  }
-  return dedupeSorted(deps);
-}
-function collectCsprojPackageRefs(rootDir) {
-  const csprojFiles = [];
-  try {
-    for (const entry of readdirSync4(rootDir)) {
-      if (entry.endsWith(".csproj")) csprojFiles.push(join4(rootDir, entry));
-    }
-  } catch {
-  }
-  for (const f of findFiles(rootDir, [".csproj"], 3)) {
-    if (!csprojFiles.includes(f)) csprojFiles.push(f);
-  }
-  const deps = [];
-  for (const path2 of csprojFiles) {
-    const content = readFileSafe(path2);
-    if (!content) continue;
-    for (const m of content.matchAll(/<PackageReference\s+[^>]*Include\s*=\s*"([^"]+)"/g)) {
-      deps.push(m[1]);
-    }
-  }
-  return dedupeSorted(deps);
-}
-function collectRawDependencies(rootDir, stack) {
-  const deps = {
-    npm: [],
-    pub: [],
-    pods: [],
-    spm: [],
-    gradle: [],
-    nuget: [],
-    upm: [],
-    ios_imports: [],
-    android_imports: []
-  };
-  switch (stack) {
-    case "flutter": {
-      deps.pub = collectPubspecDeps(join4(rootDir, "pubspec.yaml"));
-      deps.pods = collectPodfilePods(join4(rootDir, "ios", "Podfile"));
-      const androidRoot = join4(rootDir, "android");
-      deps.gradle = collectGradleCoordinates(androidRoot, gradleCandidateFiles(androidRoot));
-      break;
-    }
-    case "react-native":
-    case "expo":
-    case "capacitor": {
-      deps.npm = collectPackageJsonDeps(join4(rootDir, "package.json"));
-      deps.pods = collectPodfilePods(join4(rootDir, "ios", "Podfile"));
-      const androidRoot = join4(rootDir, "android");
-      deps.gradle = collectGradleCoordinates(androidRoot, gradleCandidateFiles(androidRoot));
-      break;
-    }
-    case "swift": {
-      deps.pods = collectPodfilePods(join4(rootDir, "Podfile"));
-      deps.spm = collectSpmSlugs(rootDir);
-      deps.ios_imports = collectSwiftImports(rootDir);
-      break;
-    }
-    case "kotlin": {
-      deps.gradle = collectGradleCoordinates(rootDir, gradleCandidateFiles(rootDir));
-      deps.android_imports = collectAndroidImports(rootDir);
-      break;
-    }
-    case "dotnet-maui": {
-      deps.nuget = collectCsprojPackageRefs(rootDir);
-      break;
-    }
-    case "unity": {
-      const manifestContent = readFileSafe(join4(rootDir, "Packages", "manifest.json"));
-      if (manifestContent) {
-        try {
-          const manifest = JSON.parse(manifestContent);
-          if (manifest?.dependencies && typeof manifest.dependencies === "object") {
-            deps.upm = dedupeSorted(Object.keys(manifest.dependencies));
-          }
-        } catch {
-        }
-      }
-      const gradleFromPlugins = [];
-      try {
-        for (const entry of readdirSync4(join4(rootDir, "Assets", "Plugins", "Android"))) {
-          if (entry.endsWith(".aar")) gradleFromPlugins.push(entry.slice(0, -".aar".length));
-          else if (entry.endsWith(".jar")) gradleFromPlugins.push(entry.slice(0, -".jar".length));
-        }
-      } catch {
-      }
-      deps.gradle = dedupeSorted(gradleFromPlugins);
-      const podsFromPlugins = [];
-      try {
-        for (const entry of readdirSync4(join4(rootDir, "Assets", "Plugins", "iOS"))) {
-          if (entry.endsWith(".xcframework")) podsFromPlugins.push(entry.slice(0, -".xcframework".length));
-          else if (entry.endsWith(".framework")) podsFromPlugins.push(entry.slice(0, -".framework".length));
-        }
-      } catch {
-      }
-      deps.pods = dedupeSorted(podsFromPlugins);
-      break;
-    }
-    case "kmp": {
-      deps.gradle = collectGradleCoordinates(rootDir, gradleCandidateFiles(rootDir));
-      const iosAppDir = join4(rootDir, "iosApp");
-      deps.ios_imports = collectSwiftImports(iosAppDir);
-      deps.pods = collectPodfilePods(join4(iosAppDir, "Podfile"));
-      deps.spm = collectSpmSlugs(iosAppDir);
-      deps.android_imports = collectAndroidImports(rootDir);
-      break;
-    }
-    // "unknown" only.
-    default:
-      break;
-  }
-  return deps;
-}
 
 // src/analyzers/branding.ts
 import { readFileSync as readFileSync2, existsSync as existsSync3, readdirSync as readdirSync5, statSync as statSync2 } from "fs";
@@ -1753,7 +1399,7 @@ function extractExpoColors(rootDir) {
     if (/^#[0-9a-fA-F]{8}$/.test(v)) return `#${v.slice(3).toLowerCase()}`;
     return null;
   };
-  const appJsonContent = readFileSafe(join5(rootDir, "app.json"));
+  const appJsonContent = readFileSafe2(join5(rootDir, "app.json"));
   if (appJsonContent) {
     try {
       const data = JSON.parse(appJsonContent);
@@ -1794,7 +1440,7 @@ function extractMauiColors(rootDir) {
     if (/Colors\.xaml$/i.test(p) && !xamlPaths.includes(p)) xamlPaths.push(p);
   }
   for (const path2 of xamlPaths) {
-    const content = readFileSafe(path2);
+    const content = readFileSafe2(path2);
     if (!content) continue;
     const colorMatches = content.matchAll(
       /<Color\s+x:Key="([^"]+)"\s*>\s*#([0-9a-fA-F]{6,8})\s*<\/Color>/g
@@ -1821,7 +1467,7 @@ function extractMauiColors(rootDir) {
   }
   const csFiles = findFiles(rootDir, [".cs"], 5);
   for (const file of csFiles.slice(0, 50)) {
-    const content = readFileSafe(file);
+    const content = readFileSafe2(file);
     if (!content) continue;
     const argbMatches = content.matchAll(
       /Color\.FromArgb\s*\(\s*"#?([0-9a-fA-F]{6,8})"/g
@@ -1871,7 +1517,7 @@ function extractFlutterColors(rootDir) {
   const dartFiles = findFiles(rootDir, [".dart"], 6);
   const hexColors = [];
   for (const file of dartFiles.slice(0, 50)) {
-    const content = readFileSafe(file);
+    const content = readFileSafe2(file);
     if (!content) continue;
     const colorMatches = content.matchAll(/Color\(0[xX]([0-9a-fA-F]{8})\)/g);
     for (const match of colorMatches) {
@@ -1923,7 +1569,7 @@ function extractJSColors(rootDir) {
       (f) => f.endsWith(fileName)
     );
     for (const file of files) {
-      const content = readFileSafe(file);
+      const content = readFileSafe2(file);
       if (!content) continue;
       const matches = content.matchAll(
         /['"]#([0-9a-fA-F]{6})['"]/g
@@ -1977,7 +1623,7 @@ function extractSwiftColors(rootDir) {
   }
   const swiftFiles = findFiles(rootDir, [".swift"], 6);
   for (const file of swiftFiles.slice(0, 50)) {
-    const content = readFileSafe(file);
+    const content = readFileSafe2(file);
     if (!content) continue;
     const hexMatches = content.matchAll(
       /(?:UIColor|Color)\s*\(\s*(?:hex|hexString)\s*:\s*(?:0[xX]|"#?)([0-9a-fA-F]{6})/g
@@ -2022,7 +1668,7 @@ function extractAndroidColors(rootDir) {
   const colorMap = /* @__PURE__ */ new Map();
   const colorsFiles = findAllFiles(rootDir, "colors.xml", 8);
   for (const path2 of colorsFiles) {
-    const content = readFileSafe(path2);
+    const content = readFileSafe2(path2);
     if (!content) continue;
     const matches = content.matchAll(
       /<color\s+name="([^"]+)"[^>]*>\s*#([0-9a-fA-F]{6,8})\s*<\/color>/g
@@ -2044,7 +1690,7 @@ function extractAndroidColors(rootDir) {
     ...findAllFiles(rootDir, "styles.xml", 8)
   ];
   for (const path2 of themeFiles) {
-    const content = readFileSafe(path2);
+    const content = readFileSafe2(path2);
     if (!content) continue;
     const itemMatches = content.matchAll(
       /<item\s+name="(?:android:)?([A-Za-z]+)"[^>]*>\s*(?:@color\/([A-Za-z0-9_]+)|#([0-9a-fA-F]{6,8}))\s*<\/item>/g
@@ -2068,7 +1714,7 @@ function extractAndroidColors(rootDir) {
   for (const file of ktFiles.slice(0, 80)) {
     const fileName = file.toLowerCase();
     if (!fileName.includes("color") && !fileName.includes("theme")) continue;
-    const content = readFileSafe(file);
+    const content = readFileSafe2(file);
     if (!content) continue;
     const valMap = /* @__PURE__ */ new Map();
     const valMatches = content.matchAll(
@@ -2144,7 +1790,7 @@ function parseColorSetInCatalog(catalogPath, colorName) {
 }
 function parseColorSet(colorSetPath) {
   const contentsPath = join5(colorSetPath, "Contents.json");
-  const content = readFileSafe(contentsPath);
+  const content = readFileSafe2(contentsPath);
   if (!content) return null;
   try {
     const data = JSON.parse(content);
@@ -2275,7 +1921,7 @@ function findAppIcon(rootDir, techStack) {
 }
 function resolveExpoIconPaths(rootDir) {
   const paths = [];
-  const appJsonContent = readFileSafe(join5(rootDir, "app.json"));
+  const appJsonContent = readFileSafe2(join5(rootDir, "app.json"));
   if (!appJsonContent) return paths;
   try {
     const data = JSON.parse(appJsonContent);
@@ -2304,7 +1950,7 @@ function findIconsInAppIconSet(searchDir) {
         const fullPath = join5(dir, entry);
         if (entry === "AppIcon.appiconset") {
           const contentsPath = join5(fullPath, "Contents.json");
-          const content = readFileSafe(contentsPath);
+          const content = readFileSafe2(contentsPath);
           if (content) {
             try {
               const data = JSON.parse(content);
@@ -2429,7 +2075,7 @@ function scanForFontFiles(dir, maxDepth = 3) {
 function detectFlutterFonts(rootDir) {
   const fonts = [];
   const pubspecPath = join6(rootDir, "pubspec.yaml");
-  const pubspecContent = readFileSafe(pubspecPath);
+  const pubspecContent = readFileSafe2(pubspecPath);
   if (pubspecContent) {
     try {
       const doc = yaml.parse(pubspecContent);
@@ -2446,7 +2092,7 @@ function detectFlutterFonts(rootDir) {
   }
   const dartFiles = findFiles(rootDir, [".dart"], 6);
   for (const file of dartFiles.slice(0, 80)) {
-    const content = readFileSafe(file);
+    const content = readFileSafe2(file);
     if (!content) continue;
     const fontFamilyMatches = content.matchAll(/fontFamily\s*:\s*['"]([^'"]+)['"]/g);
     for (const match of fontFamilyMatches) {
@@ -2469,7 +2115,7 @@ function detectJSFonts(rootDir) {
   const fonts = [];
   const jsFiles = findFiles(rootDir, [".ts", ".tsx", ".js", ".jsx"], 5);
   for (const file of jsFiles.slice(0, 100)) {
-    const content = readFileSafe(file);
+    const content = readFileSafe2(file);
     if (!content) continue;
     const matches = content.matchAll(/fontFamily\s*:\s*['"]([^'"]+)['"]/g);
     for (const match of matches) {
@@ -2493,7 +2139,7 @@ function detectSwiftFonts(rootDir) {
   const fonts = [];
   const swiftFiles = findFiles(rootDir, [".swift"], 6);
   for (const file of swiftFiles.slice(0, 80)) {
-    const content = readFileSafe(file);
+    const content = readFileSafe2(file);
     if (!content) continue;
     const uiFontMatches = content.matchAll(/UIFont\s*\(\s*name:\s*"([^"]+)"/g);
     for (const match of uiFontMatches) {
@@ -2509,7 +2155,7 @@ function detectSwiftFonts(rootDir) {
     ...findPlistFiles(rootDir)
   ];
   for (const plistPath of plistPaths) {
-    const content = readFileSafe(plistPath);
+    const content = readFileSafe2(plistPath);
     if (!content) continue;
     try {
       const data = plist2.parse(content);
@@ -2576,7 +2222,7 @@ function detectAndroidFonts(rootDir) {
   }
   const xmlFiles = findFiles(rootDir, [".xml"], 5);
   for (const file of xmlFiles.slice(0, 50)) {
-    const content = readFileSafe(file);
+    const content = readFileSafe2(file);
     if (!content) continue;
     const matches = content.matchAll(/android:fontFamily\s*=\s*"(?:@font\/)?([^"]+)"/g);
     for (const match of matches) {
@@ -2586,7 +2232,7 @@ function detectAndroidFonts(rootDir) {
   }
   const ktFiles = findFiles(rootDir, [".kt"], 6);
   for (const file of ktFiles.slice(0, 80)) {
-    const content = readFileSafe(file);
+    const content = readFileSafe2(file);
     if (!content) continue;
     const fontResMatches = content.matchAll(/Font\s*\(\s*R\.font\.(\w+)/g);
     for (const match of fontResMatches) {
@@ -2612,7 +2258,7 @@ function detectExpoFonts(rootDir) {
   }
   const jsFiles = findFiles(rootDir, [".ts", ".tsx", ".js", ".jsx"], 6);
   for (const file of jsFiles.slice(0, 100)) {
-    const content = readFileSafe(file);
+    const content = readFileSafe2(file);
     if (!content) continue;
     const useFontsMatch = content.match(/useFonts\s*\(\s*\{([\s\S]*?)\}\s*\)/);
     if (useFontsMatch) {
@@ -2635,7 +2281,7 @@ function detectExpoFonts(rootDir) {
       fonts.push(m[1]);
     }
   }
-  const appJsonContent = readFileSafe(join6(rootDir, "app.json"));
+  const appJsonContent = readFileSafe2(join6(rootDir, "app.json"));
   if (appJsonContent) {
     try {
       const data = JSON.parse(appJsonContent);
@@ -2670,7 +2316,7 @@ function detectMauiFonts(rootDir) {
   }
   const csFiles = findFiles(rootDir, [".cs"], 4);
   for (const file of csFiles.slice(0, 30)) {
-    const content = readFileSafe(file);
+    const content = readFileSafe2(file);
     if (!content) continue;
     if (!content.includes("AddFont")) continue;
     const matches = content.matchAll(
@@ -2682,7 +2328,7 @@ function detectMauiFonts(rootDir) {
   }
   const xamlFiles = findFiles(rootDir, [".xaml"], 5);
   for (const file of xamlFiles.slice(0, 50)) {
-    const content = readFileSafe(file);
+    const content = readFileSafe2(file);
     if (!content) continue;
     const matches = content.matchAll(/FontFamily\s*=\s*"([^"]+)"/g);
     for (const match of matches) {
@@ -2734,7 +2380,7 @@ function detectFonts(rootDir, techStack) {
 
 // src/analyzers/source-reader.ts
 import { readdirSync as readdirSync7, statSync as statSync4 } from "fs";
-import { join as join7, relative as relative3 } from "path";
+import { join as join7, relative as relative2 } from "path";
 var README_NAMES = [
   "README.md",
   "readme.md",
@@ -2773,14 +2419,14 @@ var TREE_IGNORE = /* @__PURE__ */ new Set([
 ]);
 function readReadme(rootDir) {
   for (const name of README_NAMES) {
-    const content = readFileSafe(join7(rootDir, name));
+    const content = readFileSafe2(join7(rootDir, name));
     if (content && content.trim().length > 0) {
       return content.substring(0, 1e4);
     }
   }
   return null;
 }
-function readSourceFiles(rootDir, techStack, maxTotalChars = 5e4) {
+function readSourceCode(rootDir, techStack, maxTotalChars = 5e4) {
   const extensions = getExtensionsForStack(techStack);
   const priorityPatterns = getPriorityPatternsForStack(techStack);
   const allFiles = scanDirectory(rootDir, {
@@ -2789,33 +2435,27 @@ function readSourceFiles(rootDir, techStack, maxTotalChars = 5e4) {
     maxFiles: 500
   });
   const sorted = sortByPriority(allFiles, priorityPatterns);
-  const files = [];
+  const parts = [];
   let totalChars = 0;
   for (const file of sorted) {
     if (totalChars >= maxTotalChars) break;
-    const content = readFileSafe(join7(rootDir, file));
+    const content = readFileSafe2(join7(rootDir, file));
     if (!content || content.trim().length < 20) continue;
     if (isTestFile(file)) continue;
     if (isGeneratedFile(file, content)) continue;
     const truncated = content.substring(0, 15e3);
-    files.push({ path: file, content: truncated });
+    parts.push(`--- ${file} ---
+${truncated}`);
     totalChars += truncated.length;
   }
-  return files;
-}
-function joinSourceFiles(files) {
-  return files.map((f) => `--- ${f.path} ---
-${f.content}`).join("\n\n");
-}
-function readSourceCode(rootDir, techStack, maxTotalChars = 5e4) {
-  return joinSourceFiles(readSourceFiles(rootDir, techStack, maxTotalChars));
+  return parts.join("\n\n");
 }
 function getExtensionsForStack(techStack) {
   switch (techStack) {
     case "flutter":
       return [".dart"];
     case "swift":
-      return [".swift", ".m", ".mm", ".h"];
+      return [".swift"];
     case "kotlin":
       return [".kt", ".kts"];
     case "expo":
@@ -2824,10 +2464,6 @@ function getExtensionsForStack(techStack) {
       return [".ts", ".tsx", ".js", ".jsx"];
     case "dotnet-maui":
       return [".cs", ".xaml"];
-    case "unity":
-      return [".cs"];
-    case "kmp":
-      return [".kt", ".kts", ".swift"];
     default:
       return [".ts", ".js", ".swift", ".dart", ".kt"];
   }
@@ -2877,10 +2513,6 @@ function getPriorityPatternsForStack(techStack) {
       return [...common, "screen", "component", "hook", "context", "store", "slice"];
     case "dotnet-maui":
       return [...common, "page", "view", "viewmodel", "service", "mauiprogram", "appshell"];
-    case "unity":
-      return [...common, "gamemanager", "main", "controller", "manager"];
-    case "kmp":
-      return [...common, "app", "mainactivity", "contentview", "viewmodel"];
     default:
       return common;
   }
@@ -2969,7 +2601,7 @@ function generateProjectTree(rootDir, maxDepth = 5, maxEntries = 300) {
       return false;
     }
   }
-  const rootName = relative3(join7(rootDir, ".."), rootDir) || "project";
+  const rootName = relative2(join7(rootDir, ".."), rootDir) || "project";
   lines.push(`${rootName}/`);
   walk(rootDir, "", 0);
   return lines.join("\n");
@@ -2977,7 +2609,7 @@ function generateProjectTree(rootDir, maxDepth = 5, maxEntries = 300) {
 
 // src/analyzers/asset-scanner.ts
 import { readFileSync as readFileSync4, existsSync as existsSync5, readdirSync as readdirSync8, statSync as statSync5 } from "fs";
-import { join as join8, extname as extname3, relative as relative4, basename as basename2 } from "path";
+import { join as join8, extname as extname3, relative as relative3, basename as basename2 } from "path";
 var MAX_ASSET_SIZE = 5 * 1024 * 1024;
 var MAX_TOTAL_ASSETS = 10;
 var MAX_SCREENSHOTS = 5;
@@ -3008,7 +2640,7 @@ function tryReadImage(rootDir, filePath, assetType, minSize = MIN_ASSET_SIZE) {
       base64_data: buffer.toString("base64"),
       width: null,
       height: null,
-      source_path: relative4(rootDir, filePath)
+      source_path: relative3(rootDir, filePath)
     };
   } catch {
     return null;
@@ -3627,7 +3259,7 @@ async function uploadAssetsToStorage(client, rootDir, assets, appIconPath) {
             mime_type: mimeForPath(appIconPath),
             width: null,
             height: null,
-            source_path: relative5(rootDir, appIconPath)
+            source_path: relative4(rootDir, appIconPath)
           },
           buffer
         });
@@ -4168,1668 +3800,143 @@ import { createInterface as createInterface2 } from "readline";
 import chalk3 from "chalk";
 import ora2 from "ora";
 
-// src/engine/index.ts
-import { join as join14 } from "path";
+// src/review/feature-detector.ts
+function getFeatureDiscoveryPrompt() {
+  return `You are an expert app analyst. Your job is to understand WHAT an app does from the USER's perspective by reading its source code. You are NOT reviewing code quality.
 
-// src/engine/registry.ts
-var ECOSYSTEM_KEYS = [
-  "npm",
-  "pub",
-  "pods",
-  "spm",
-  "gradle",
-  "nuget",
-  "upm",
-  "ios_imports",
-  "android_imports"
-];
-function matchDefault(pattern, dep, caseInsensitive) {
-  const p = caseInsensitive ? pattern.toLowerCase() : pattern;
-  const d = caseInsensitive ? dep.toLowerCase() : dep;
-  if (p.endsWith("*")) return d.startsWith(p.slice(0, -1));
-  return d === p;
-}
-function matchGradle(pattern, dep) {
-  if (pattern.endsWith("*")) {
-    const prefix = pattern.slice(0, -1);
-    if (prefix === "") return false;
-    if (prefix.includes(":")) return dep.startsWith(prefix);
-    if (!dep.includes(":")) return dep.startsWith(prefix);
-    const idx2 = dep.lastIndexOf(":");
-    return dep.slice(idx2 + 1).startsWith(prefix);
-  }
-  if (pattern.includes(":")) return dep === pattern;
-  if (dep === pattern) return true;
-  const idx = dep.lastIndexOf(":");
-  return idx >= 0 && dep.slice(idx + 1) === pattern;
-}
-function matchImportPrefix(pattern, dep) {
-  return dep === pattern || dep.startsWith(`${pattern}.`);
-}
-function ecosystemMatches(key, pattern, dep) {
-  switch (key) {
-    case "gradle":
-      return matchGradle(pattern, dep);
-    case "ios_imports":
-    case "android_imports":
-      return matchImportPrefix(pattern, dep);
-    case "pods":
-    case "spm":
-      return matchDefault(pattern, dep, true);
-    default:
-      return matchDefault(pattern, dep, false);
-  }
-}
-function matchSDKs(deps, registry) {
-  const results = [];
-  for (const entry of registry) {
-    const coordinates = /* @__PURE__ */ new Set();
-    for (const key of ECOSYSTEM_KEYS) {
-      const patterns = entry.match[key];
-      if (!patterns || patterns.length === 0) continue;
-      const bucket = deps[key];
-      if (!bucket || bucket.length === 0) continue;
-      for (const pattern of patterns) {
-        for (const dep of bucket) {
-          if (ecosystemMatches(key, pattern, dep)) {
-            coordinates.add(`${key}:${dep}`);
-          }
-        }
-      }
-    }
-    if (coordinates.size > 0) {
-      results.push({
-        id: entry.id,
-        name: entry.name,
-        category: entry.category,
-        matched_coordinates: Array.from(coordinates).sort(),
-        data_collection: entry.data_collection,
-        flags: entry.flags
-      });
+Respond in English.
+
+Answer this question: "If someone downloads this app and opens it on their iPhone, what will they see and experience?"
+
+Analyze the source code and identify:
+
+1. **App Purpose**: What does this app do? (1-2 sentences)
+2. **User Flows**: What are the main things a user can do? (list each)
+3. **Onboarding**: What happens when you first open the app? Login required? Permissions asked immediately?
+4. **Monetization**: How does the app make money? Subscriptions? IAP? Ads? External payments? Free?
+5. **Data & Privacy**: What user data does the app collect? What device permissions does it need? Is there a privacy policy link?
+6. **Content**: Is there user-generated content (posts, comments, chat)? Third-party content? Web content?
+7. **Account Management**: Can users create accounts? Can they delete their accounts?
+8. **Platform Features**: Does it use WebViews, widgets, extensions, push notifications, background processing?
+9. **Settings & Legal**: What can users configure? Is there a privacy policy accessible in-app? Terms of service?
+10. **External Links**: Does the app link to external payment pages, websites, or other apps?
+
+IMPORTANT: You are seeing a SUBSET of the source code, not the entire codebase. Do not make definitive claims about features being absent \u2014 only report features you can positively identify from the code shown. If something might exist but you don't see it, do not list it as missing.
+
+Respond ONLY with valid JSON in this exact format:
+
+{
+  "appPurpose": "string describing what the app does",
+  "features": [
+    {
+      "feature": "string identifier (e.g., 'subscriptions', 'webview', 'ugc', 'account_creation', 'push_notifications', 'camera_usage', 'location_tracking')",
+      "description": "string describing what the user experiences",
+      "confidence": 0.0-1.0,
+      "keywords": ["relevant", "keywords", "from", "code"],
+      "category": "safety|performance|business|design|legal|common-pitfalls",
+      "relevantFiles": ["file1.swift", "file2.ts"]
     }
-  }
-  return results.sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+  ],
+  "riskAreas": ["string describing areas that Apple reviewers commonly flag for apps like this"],
+  "appType": "native|hybrid|webview-heavy|web-wrapper"
+}`;
 }
+async function detectFeatures(provider, platform, appName, bundleId, sourceCode) {
+  const systemPrompt = getFeatureDiscoveryPrompt();
+  const userPrompt = `## App Information
+- Platform: ${platform}
+- App Name: ${appName}
+- Bundle ID: ${bundleId}
 
-// src/engine/extractors/ios-plist.ts
-import { join as join9, relative as relative6 } from "path";
-import plistLib from "plist";
+## Source Code
 
-// src/engine/extractors/shared.ts
-var EXTENSION_SUFFIXES2 = [
-  "Extension",
-  "Widget",
-  "WidgetExtension",
-  "Intent",
-  "IntentExtension",
-  "NotificationService",
-  "NotificationContent",
-  "ShieldConfiguration",
-  "ShieldConfigurationExtension",
-  "ShieldAction",
-  "ShieldActionExtension",
-  "WatchKit",
-  "Watch",
-  "Clip",
-  "Tests",
-  "UITests",
-  "StickerPack",
-  "ShareExtension",
-  "TodayExtension",
-  "KeyboardExtension"
-];
-function isExtensionPath(relPath) {
-  const segments = relPath.split(/[\\/]/);
-  return segments.some((segment, idx) => {
-    if (idx === segments.length - 1) return false;
-    if (!segment) return false;
-    return EXTENSION_SUFFIXES2.some(
-      (suffix) => segment.endsWith(suffix) || segment.toLowerCase().endsWith(suffix.toLowerCase())
-    );
-  });
-}
-function isXcodeVariable2(value) {
-  return typeof value === "string" && (value.includes("$(") || value.includes("${"));
-}
-function normalizeStringValue(value) {
-  if (typeof value !== "string") return null;
-  if (value.length === 0) return null;
-  if (isXcodeVariable2(value)) return null;
-  return value;
-}
-function parsePlistBoolean(value) {
-  if (typeof value === "boolean") return value;
-  if (typeof value === "string") {
-    const normalized = value.trim().toLowerCase();
-    if (normalized === "yes" || normalized === "true" || normalized === "1") return true;
-    if (normalized === "no" || normalized === "false" || normalized === "0") return false;
+${sourceCode}`;
+  try {
+    const response = await provider.generateJSON(systemPrompt, userPrompt, 0.2);
+    return parseFeatureAnalysis(response);
+  } catch {
+    return null;
   }
-  return null;
 }
-function pathDepth(relPath) {
-  return relPath.split(/[\\/]/).length;
-}
-
-// src/engine/extractors/ios-plist.ts
-var NAMED_FIELD_KEYS = /* @__PURE__ */ new Set([
-  "UIBackgroundModes",
-  "NSAppTransportSecurity",
-  "GADApplicationIdentifier",
-  "SKAdNetworkItems",
-  "ITSAppUsesNonExemptEncryption",
-  "UIRequiredDeviceCapabilities"
-]);
-function findMainInfoPlist(rootDir) {
-  const candidates = findAllFiles(rootDir, "Info.plist", 4);
-  const nonExtension = candidates.filter(
-    (abs) => !isExtensionPath(relative6(rootDir, abs))
-  );
-  if (nonExtension.length === 0) return null;
-  return [...nonExtension].sort(
-    (a, b) => pathDepth(relative6(rootDir, a)) - pathDepth(relative6(rootDir, b))
-  )[0];
-}
-function readInfoPlistFile(filePath) {
-  const content = readFileSafe(filePath);
-  if (!content) return null;
+function parseFeatureAnalysis(response) {
   try {
-    const parsed = plistLib.parse(content);
-    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-      return parsed;
-    }
-    return null;
+    return JSON.parse(response);
   } catch {
+    const jsonMatch = response.match(/```(?:json)?\s*\n?([\s\S]*?)\n?```/);
+    if (jsonMatch) {
+      try {
+        return JSON.parse(jsonMatch[1]);
+      } catch {
+      }
+    }
+    const objectMatch = response.match(/\{[\s\S]*"features"[\s\S]*\}/);
+    if (objectMatch) {
+      try {
+        return JSON.parse(objectMatch[0]);
+      } catch {
+      }
+    }
     return null;
   }
 }
-function readPbxprojInfoplistKeys(content) {
-  const keys = {};
-  const keyPattern = /INFOPLIST_KEY_([A-Za-z0-9_]+)\s*=\s*"?([^";]+)"?;/g;
-  for (const match of content.matchAll(keyPattern)) {
-    keys[match[1]] = match[2].trim();
-  }
-  const generatesInfoPlist = /GENERATE_INFOPLIST_FILE\s*=\s*YES/.test(content);
-  return { keys, generatesInfoPlist };
-}
-function findExpoGadAppId(appJson) {
-  const asRecord = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : null;
-  const asId = (v) => typeof v === "string" && v.length > 0 ? v : null;
-  const root = asRecord(appJson);
-  if (!root) return null;
-  const expo = asRecord(root.expo);
-  const legacy = asId(asRecord(asRecord(expo?.ios)?.config)?.googleMobileAdsAppId);
-  if (legacy) return legacy;
-  const rnTop = asId(asRecord(root["react-native-google-mobile-ads"])?.ios_app_id);
-  if (rnTop) return rnTop;
-  const plugins = expo?.plugins;
-  if (Array.isArray(plugins)) {
-    for (const entry of plugins) {
-      if (!Array.isArray(entry) || entry[0] !== "react-native-google-mobile-ads") continue;
-      const props = asRecord(entry[1]);
-      const id = asId(props?.iosAppId) ?? asId(props?.ios_app_id);
-      if (id) return id;
-    }
-  }
-  return null;
-}
-function readExpoConfigFallback(content) {
-  const found = {};
-  for (const m of content.matchAll(
-    /(NS[A-Za-z]+UsageDescription)\s*:\s*["']([^"']*)["']/g
-  )) {
-    found[m[1]] = m[2];
-  }
-  const gad = content.match(/GADApplicationIdentifier\s*:\s*["']([^"']*)["']/);
-  if (gad) found.GADApplicationIdentifier = gad[1];
-  return found;
-}
-function extractPlistFields(merged) {
-  const usageDescriptions = {};
-  for (const key of Object.keys(merged)) {
-    if (/UsageDescription$/.test(key)) {
-      usageDescriptions[key] = normalizeStringValue(merged[key]);
-    }
-  }
-  const backgroundModes = Array.isArray(merged.UIBackgroundModes) ? merged.UIBackgroundModes.filter((v) => typeof v === "string") : [];
-  let atsAllowsArbitraryLoads = null;
-  const ats = merged.NSAppTransportSecurity;
-  if (ats && typeof ats === "object" && !Array.isArray(ats)) {
-    const atsDict = ats;
-    if ("NSAllowsArbitraryLoads" in atsDict) {
-      atsAllowsArbitraryLoads = parsePlistBoolean(atsDict.NSAllowsArbitraryLoads);
-    }
-  }
-  const skAdNetworkCount = Array.isArray(merged.SKAdNetworkItems) ? merged.SKAdNetworkItems.length : 0;
-  const requiredDeviceCapabilities = Array.isArray(merged.UIRequiredDeviceCapabilities) ? merged.UIRequiredDeviceCapabilities.filter((v) => typeof v === "string") : [];
-  const otherKeys = Array.from(
-    new Set(
-      Object.keys(merged).filter(
-        (k) => !NAMED_FIELD_KEYS.has(k) && !/UsageDescription$/.test(k)
-      )
-    )
-  ).sort();
-  const fields = {
-    usage_descriptions: usageDescriptions,
-    background_modes: backgroundModes,
-    ats_allows_arbitrary_loads: atsAllowsArbitraryLoads,
-    sk_ad_network_count: skAdNetworkCount,
-    required_device_capabilities: requiredDeviceCapabilities,
-    other_keys: otherKeys
-  };
-  if ("GADApplicationIdentifier" in merged) {
-    fields.gad_application_identifier = normalizeStringValue(merged.GADApplicationIdentifier);
-  }
-  if ("ITSAppUsesNonExemptEncryption" in merged) {
-    fields.non_exempt_encryption = parsePlistBoolean(merged.ITSAppUsesNonExemptEncryption);
-  }
-  return fields;
-}
-function extractIosPlist(rootDir) {
-  const evidence = {};
-  const plistFilePath = findMainInfoPlist(rootDir);
-  const plistFileData = plistFilePath ? readInfoPlistFile(plistFilePath) : null;
-  if (plistFilePath && plistFileData) {
-    evidence["ios.plist.plist_file"] = { file: relative6(rootDir, plistFilePath) };
-  }
-  const pbxprojPath = findFile(rootDir, "project.pbxproj", 5);
-  let pbxprojData = null;
-  if (pbxprojPath) {
-    const content = readFileSafe(pbxprojPath);
-    if (content) {
-      const { keys, generatesInfoPlist } = readPbxprojInfoplistKeys(content);
-      if (Object.keys(keys).length > 0 || generatesInfoPlist) {
-        pbxprojData = keys;
-        evidence["ios.plist.pbxproj_infoplist_keys"] = {
-          file: relative6(rootDir, pbxprojPath),
-          detail: generatesInfoPlist ? "GENERATE_INFOPLIST_FILE = YES" : void 0
-        };
-      }
-    }
-  }
-  let expoData = null;
-  const appJsonContent = readFileSafe(join9(rootDir, "app.json"));
-  if (appJsonContent) {
-    try {
-      const appJson = JSON.parse(appJsonContent);
-      const infoPlist = appJson?.expo?.ios?.infoPlist;
-      if (infoPlist && typeof infoPlist === "object" && !Array.isArray(infoPlist)) {
-        expoData = { ...infoPlist };
-        if (!("GADApplicationIdentifier" in expoData)) {
-          const gadId = findExpoGadAppId(appJson);
-          if (gadId !== null) expoData.GADApplicationIdentifier = gadId;
-        }
-        evidence["ios.plist.expo_config"] = { file: "app.json" };
-      }
-    } catch {
-    }
-  }
-  if (!expoData) {
-    for (const name of ["app.config.ts", "app.config.js"]) {
-      const content = readFileSafe(join9(rootDir, name));
-      if (!content) continue;
-      const found = readExpoConfigFallback(content);
-      if (Object.keys(found).length > 0) {
-        expoData = found;
-        evidence["ios.plist.expo_config"] = {
-          file: name,
-          detail: "best-effort regex extraction (app.config.js/ts)"
-        };
-      }
-      break;
-    }
-  }
-  const contributing = [];
-  if (expoData) contributing.push("expo_config");
-  if (pbxprojData) contributing.push("pbxproj_infoplist_keys");
-  if (plistFileData) contributing.push("plist_file");
-  if (contributing.length === 0) {
-    return { plist_source: "none", plist: null, evidence };
-  }
-  const merged = {
-    ...expoData ?? {},
-    ...pbxprojData ?? {},
-    ...plistFileData ?? {}
-  };
-  return {
-    plist_source: contributing.length > 1 ? "merged" : contributing[0],
-    plist: extractPlistFields(merged),
-    evidence
-  };
-}
-
-// src/engine/extractors/ios-entitlements.ts
-import { relative as relative7 } from "path";
-import plistLib2 from "plist";
-function extractIosEntitlements(rootDir) {
-  const evidence = {};
-  const allFiles = findFiles(rootDir, [".entitlements"], 5);
-  if (allFiles.length === 0) {
-    return { entitlements: null, evidence };
-  }
-  const nonExtensionFiles = allFiles.filter(
-    (abs) => !isExtensionPath(relative7(rootDir, abs))
-  );
-  const usedExtensionOnly = nonExtensionFiles.length === 0;
-  const files = (usedExtensionOnly ? allFiles : nonExtensionFiles).sort();
-  let apsEnvironment = null;
-  const associatedDomains = /* @__PURE__ */ new Set();
-  let healthkit = false;
-  let signInWithApple = false;
-  const appGroups = /* @__PURE__ */ new Set();
-  const keys = /* @__PURE__ */ new Set();
-  for (const file of files) {
-    const content = readFileSafe(file);
-    if (!content) continue;
-    let parsed;
-    try {
-      const value = plistLib2.parse(content);
-      if (!value || typeof value !== "object" || Array.isArray(value)) continue;
-      parsed = value;
-    } catch {
-      continue;
-    }
-    for (const key of Object.keys(parsed)) keys.add(key);
-    if (apsEnvironment === null) {
-      const aps = parsed["aps-environment"];
-      if (typeof aps === "string" && aps.length > 0) apsEnvironment = aps;
-    }
-    const domains = parsed["com.apple.developer.associated-domains"];
-    if (Array.isArray(domains)) {
-      for (const d of domains) if (typeof d === "string") associatedDomains.add(d);
-    }
-    if (parsed["com.apple.developer.healthkit"]) healthkit = true;
-    const appleSignIn = parsed["com.apple.developer.applesignin"];
-    if (Array.isArray(appleSignIn) && appleSignIn.length > 0) signInWithApple = true;
-    const groups = parsed["com.apple.security.application-groups"];
-    if (Array.isArray(groups)) {
-      for (const g of groups) if (typeof g === "string") appGroups.add(g);
-    }
-  }
-  evidence["ios.entitlements"] = {
-    file: files.map((f) => relative7(rootDir, f)).join(", "),
-    detail: usedExtensionOnly ? `${files.length} extension-target entitlements file(s) - no main-target entitlements found` : `${files.length} entitlements file(s) merged`
-  };
-  return {
-    entitlements: {
-      aps_environment: apsEnvironment,
-      associated_domains: Array.from(associatedDomains).sort(),
-      healthkit,
-      sign_in_with_apple: signInWithApple,
-      app_groups: Array.from(appGroups).sort(),
-      keys: Array.from(keys).sort()
-    },
-    evidence
-  };
-}
-
-// src/engine/extractors/ios-privacy-manifest.ts
-import { relative as relative8 } from "path";
-import plistLib3 from "plist";
-function emptyPrivacyManifest() {
-  return {
-    app_manifest_present: false,
-    collected_data_types: [],
-    accessed_api_types: [],
-    tracking: null,
-    tracking_domains: [],
-    sdk_manifests_found: 0
-  };
-}
-function extractIosPrivacyManifest(rootDir) {
-  const evidence = {};
-  const allFiles = findAllFiles(rootDir, "PrivacyInfo.xcprivacy", 6);
-  if (allFiles.length === 0) {
-    return { privacy_manifest: emptyPrivacyManifest(), evidence };
-  }
-  const sorted = [...allFiles].sort(
-    (a, b) => pathDepth(relative8(rootDir, a)) - pathDepth(relative8(rootDir, b))
-  );
-  const appManifestPath = sorted[0];
-  const otherCount = sorted.length - 1;
-  evidence["ios.privacy_manifest"] = { file: relative8(rootDir, appManifestPath) };
-  if (otherCount > 0) {
-    evidence["ios.privacy_manifest.sdk_manifests_found"] = {
-      file: sorted.slice(1).map((f) => relative8(rootDir, f)).join(", "),
-      detail: `${otherCount} other .xcprivacy file(s) visible in the scanned tree`
-    };
-  }
-  const content = readFileSafe(appManifestPath);
-  let parsed = null;
-  if (content) {
-    try {
-      const value = plistLib3.parse(content);
-      if (value && typeof value === "object" && !Array.isArray(value)) {
-        parsed = value;
-      }
-    } catch {
-      parsed = null;
-    }
-  }
-  if (!parsed) {
-    return {
-      privacy_manifest: { ...emptyPrivacyManifest(), app_manifest_present: true, sdk_manifests_found: otherCount },
-      evidence
-    };
-  }
-  const collectedDataTypes = [];
-  if (Array.isArray(parsed.NSPrivacyCollectedDataTypes)) {
-    for (const entry of parsed.NSPrivacyCollectedDataTypes) {
-      if (entry && typeof entry === "object") {
-        const type = entry.NSPrivacyCollectedDataType;
-        if (typeof type === "string") collectedDataTypes.push(type);
-      }
-    }
-  }
-  const accessedApiTypes = [];
-  if (Array.isArray(parsed.NSPrivacyAccessedAPITypes)) {
-    for (const entry of parsed.NSPrivacyAccessedAPITypes) {
-      if (entry && typeof entry === "object") {
-        const type = entry.NSPrivacyAccessedAPIType;
-        if (typeof type === "string") accessedApiTypes.push(type);
-      }
-    }
-  }
-  const tracking = "NSPrivacyTracking" in parsed ? Boolean(parsed.NSPrivacyTracking) : null;
-  const trackingDomains = Array.isArray(parsed.NSPrivacyTrackingDomains) ? parsed.NSPrivacyTrackingDomains.filter((v) => typeof v === "string") : [];
-  return {
-    privacy_manifest: {
-      app_manifest_present: true,
-      collected_data_types: collectedDataTypes,
-      accessed_api_types: accessedApiTypes,
-      tracking,
-      tracking_domains: trackingDomains,
-      sdk_manifests_found: otherCount
-    },
-    evidence
-  };
-}
-
-// src/engine/extractors/android-manifest.ts
-import { join as join10, relative as relative9 } from "path";
-var EXCLUDED_SEGMENTS = /* @__PURE__ */ new Set(["build", "test", "androidTest", "debug"]);
-function isExcludedManifestPath(relPath) {
-  return relPath.split(/[\\/]/).some((segment) => EXCLUDED_SEGMENTS.has(segment));
-}
-function findMainManifest(rootDir) {
-  const knownCandidates = [
-    join10(rootDir, "app/src/main/AndroidManifest.xml"),
-    join10(rootDir, "android/app/src/main/AndroidManifest.xml"),
-    join10(rootDir, "src/main/AndroidManifest.xml")
-  ];
-  for (const candidate of knownCandidates) {
-    if (fileExists(candidate)) return candidate;
-  }
-  const found = findAllFiles(rootDir, "AndroidManifest.xml", 5).filter(
-    (abs) => !isExcludedManifestPath(relative9(rootDir, abs))
-  );
-  if (found.length === 0) return null;
-  return [...found].sort(
-    (a, b) => relative9(rootDir, a).split(/[\\/]/).length - relative9(rootDir, b).split(/[\\/]/).length
-  )[0];
-}
-function extractPermissions(content) {
-  const permissions = /* @__PURE__ */ new Set();
-  const tagPattern = /<uses-permission(?:-sdk-23)?\b[^>]*>/g;
-  const nameAttrPattern = /android:name\s*=\s*"([^"]+)"/;
-  for (const tagMatch of content.matchAll(tagPattern)) {
-    const nameMatch = tagMatch[0].match(nameAttrPattern);
-    if (nameMatch) permissions.add(nameMatch[1]);
-  }
-  return Array.from(permissions).sort();
-}
-function extractAndroidManifest(rootDir) {
-  const evidence = {};
-  const manifestPath = findMainManifest(rootDir);
-  if (!manifestPath) {
-    return {
-      android: {
-        manifest_found: false,
-        permissions: [],
-        exported_components: 0,
-        queries_declared: false
-      },
-      evidence
-    };
-  }
-  const content = readFileSafe(manifestPath);
-  if (!content) {
-    return {
-      android: {
-        manifest_found: false,
-        permissions: [],
-        exported_components: 0,
-        queries_declared: false
-      },
-      evidence
-    };
-  }
-  evidence["android.manifest"] = { file: relative9(rootDir, manifestPath) };
-  const permissions = extractPermissions(content);
-  const exportedComponents = (content.match(/android:exported\s*=\s*"true"/g) ?? []).length;
-  const queriesDeclared = /<queries[\s>]/.test(content);
-  return {
-    android: {
-      manifest_found: true,
-      permissions,
-      exported_components: exportedComponents,
-      queries_declared: queriesDeclared
-    },
-    evidence
-  };
-}
-
-// src/engine/extractors/gradle-targets.ts
-import { join as join11, relative as relative10 } from "path";
-function candidateGradleFiles(rootDir) {
-  const candidates = [];
-  const add = (p) => {
-    if (p && !candidates.includes(p)) candidates.push(p);
-  };
-  add(findFile(join11(rootDir, "app"), "build.gradle", 2));
-  add(findFile(join11(rootDir, "app"), "build.gradle.kts", 2));
-  add(findFile(join11(rootDir, "android/app"), "build.gradle", 2));
-  add(findFile(join11(rootDir, "android/app"), "build.gradle.kts", 2));
-  add(findFile(rootDir, "build.gradle", 1));
-  add(findFile(rootDir, "build.gradle.kts", 1));
-  for (const f of findFiles(rootDir, ["build.gradle", "build.gradle.kts"], 4)) {
-    add(f);
-  }
-  return candidates;
-}
-function extractIntSetting(content, name) {
-  const pattern = new RegExp(`\\b${name}(?:Version)?\\s*(?:=)?\\s*(\\d+)`);
-  const match = content.match(pattern);
-  return match ? parseInt(match[1], 10) : null;
-}
-function extractGradleTargets(rootDir) {
-  const evidence = {};
-  let targetAndroidSdk = null;
-  let compileSdk = null;
-  let minAndroidSdk = null;
-  let usedFile = null;
-  for (const filePath of candidateGradleFiles(rootDir)) {
-    const content = readFileSafe(filePath);
-    if (!content) continue;
-    const target = extractIntSetting(content, "targetSdk");
-    const compile = extractIntSetting(content, "compileSdk");
-    const min = extractIntSetting(content, "minSdk");
-    if (target === null && compile === null && min === null) continue;
-    if (targetAndroidSdk === null && target !== null) targetAndroidSdk = target;
-    if (compileSdk === null && compile !== null) compileSdk = compile;
-    if (minAndroidSdk === null && min !== null) minAndroidSdk = min;
-    if (usedFile === null) usedFile = filePath;
-    if (targetAndroidSdk !== null && compileSdk !== null && minAndroidSdk !== null) break;
-  }
-  if (usedFile) {
-    evidence["android.gradle"] = { file: relative10(rootDir, usedFile) };
-  }
-  return {
-    target_android_sdk: targetAndroidSdk,
-    compile_sdk: compileSdk,
-    min_android_sdk: minAndroidSdk,
-    evidence
-  };
-}
-
-// src/engine/extractors/unity.ts
-import { join as join12 } from "path";
-import YAML3 from "yaml";
-var PROJECT_SETTINGS_REL = join12("ProjectSettings", "ProjectSettings.asset");
-function toPlainYaml(raw) {
-  return raw.split("\n").filter((line) => !line.startsWith("%")).map((line) => /^---\s*!u!/.test(line) ? "---" : line).join("\n");
-}
-function regexFallbackAppIds(raw) {
-  const idx = raw.indexOf("applicationIdentifier:");
-  if (idx < 0) return { ios: null, android: null };
-  const after = raw.slice(idx + "applicationIdentifier:".length);
-  const nextSiblingKey = after.search(/\n {0,2}\S/);
-  const block = nextSiblingKey >= 0 ? after.slice(0, nextSiblingKey) : after;
-  const iphone = block.match(/iPhone:\s*(\S+)/);
-  const android = block.match(/Android:\s*(\S+)/);
-  return {
-    ios: iphone ? iphone[1].trim() : null,
-    android: android ? android[1].trim() : null
-  };
-}
-function extractUnityProjectSettings(rootDir) {
-  const filePath = join12(rootDir, "ProjectSettings", "ProjectSettings.asset");
-  const raw = readFileSafe(filePath);
-  if (raw === null) return null;
-  const evidence = {
-    "unity.project_settings": { file: PROJECT_SETTINGS_REL }
-  };
-  let ios = null;
-  let android = null;
-  let version = null;
-  let productName = null;
-  try {
-    const parsed = YAML3.parse(toPlainYaml(raw));
-    const player = parsed?.PlayerSettings;
-    if (player && typeof player === "object") {
-      const appId = player.applicationIdentifier;
-      if (appId && typeof appId === "object") {
-        ios = typeof appId.iPhone === "string" ? appId.iPhone : null;
-        android = typeof appId.Android === "string" ? appId.Android : null;
-      }
-      version = typeof player.bundleVersion === "string" ? player.bundleVersion : null;
-      productName = typeof player.productName === "string" ? player.productName : null;
-    }
-  } catch {
-    const fallback = regexFallbackAppIds(raw);
-    ios = fallback.ios;
-    android = fallback.android;
-    evidence["unity.project_settings"] = {
-      file: PROJECT_SETTINGS_REL,
-      detail: "regex fallback (malformed YAML)"
-    };
-  }
-  return {
-    bundle_id: ios ?? android ?? null,
-    bundle_ids: { ios, android },
-    app_version: version,
-    product_name: productName,
-    evidence
-  };
-}
-
-// src/engine/extractors/kmp.ts
-import { readdirSync as readdirSync9, statSync as statSync7, existsSync as existsSync6 } from "fs";
-import { join as join13 } from "path";
-function containsXcodeproj(dir, maxDepth) {
-  function walk(current, depth) {
-    let entries;
-    try {
-      entries = readdirSync9(current);
-    } catch {
-      return false;
-    }
-    for (const entry of entries) {
-      const full = join13(current, entry);
-      let isDirectory = false;
-      try {
-        isDirectory = statSync7(full).isDirectory();
-      } catch {
-        continue;
-      }
-      if (!isDirectory) continue;
-      if (entry.endsWith(".xcodeproj")) return true;
-      if (depth < maxDepth && walk(full, depth + 1)) return true;
-    }
-    return false;
-  }
-  return walk(dir, 0);
-}
-var ANDROID_APPLICATION_MODULE_RE = /applicationId\b|com\.android\.application/;
-var KMP_PLUGIN_MARKER_RE2 = /kotlin\(\s*["']multiplatform["']\s*\)|id\(\s*["']org\.jetbrains\.kotlin\.multiplatform["']\s*\)|kotlinMultiplatform/;
-function readModuleGradle(moduleDir) {
-  return readFileSafe(join13(moduleDir, "build.gradle.kts")) ?? readFileSafe(join13(moduleDir, "build.gradle"));
-}
-function findKmpLayout(rootDir) {
-  let iosAppDir = null;
-  const iosAppCandidate = join13(rootDir, "iosApp");
-  if (existsSync6(iosAppCandidate)) {
-    const hasXcodeproj = containsXcodeproj(iosAppCandidate, 3);
-    const hasInfoPlist = findFile(iosAppCandidate, "Info.plist", 3) !== null;
-    if (hasXcodeproj || hasInfoPlist) iosAppDir = iosAppCandidate;
-  }
-  let androidModuleDir = null;
-  for (const name of ["androidApp", "composeApp", "app"]) {
-    const candidate = join13(rootDir, name);
-    const content = readModuleGradle(candidate);
-    if (content && ANDROID_APPLICATION_MODULE_RE.test(content)) {
-      androidModuleDir = candidate;
-      break;
-    }
-  }
-  let sharedDir = null;
-  try {
-    const entries = [...readdirSync9(rootDir)].sort();
-    for (const entry of entries) {
-      const candidate = join13(rootDir, entry);
-      let isDirectory = false;
-      try {
-        isDirectory = statSync7(candidate).isDirectory();
-      } catch {
-        continue;
-      }
-      if (!isDirectory) continue;
-      const content = readModuleGradle(candidate);
-      if (content && KMP_PLUGIN_MARKER_RE2.test(content)) {
-        sharedDir = candidate;
-        break;
-      }
-    }
-  } catch {
-  }
-  return { iosAppDir, androidModuleDir, sharedDir };
-}
-
-// src/engine/profile-builder.ts
-var RESTORE_RE = /restorePurchases|restoreCompletedTransactions|restoreTransactions|queryPurchasesAsync|\brestore\s*\(\s*\)/;
-var ACCOUNT_DELETION_RE = /deleteAccount|removeAccount|deleteUser|closeAccount|account.{0,20}delet/i;
-var ACCOUNT_CREATION_RE = /createAccount|createUser|signUp|register(?:User|Account|WithEmail)/;
-var PRIVACY_POLICY_RE = /privacy[\s_-]?policy/i;
-var EXTERNAL_CHECKOUT_RE = /checkout\.stripe\.com|buy\.stripe\.com|paypal\.com|lemonsqueezy|gumroad|paddle\.com/i;
-var WEBVIEW_RE = /WKWebView|UIWebView|webview_flutter|react-native-webview|InAppWebView|android\.webkit\.WebView/;
-function round2(n) {
-  return Math.round(n * 100) / 100;
-}
-function scanSourceSignals(input) {
-  let restore = false;
-  let deletion = false;
-  let creation = false;
-  let privacyPolicy = false;
-  let externalCheckout = false;
-  let webviewFiles = 0;
-  let sourceChars = 0;
-  for (const { content } of input.files) {
-    sourceChars += content.length;
-    if (!restore && RESTORE_RE.test(content)) restore = true;
-    if (!deletion && ACCOUNT_DELETION_RE.test(content)) deletion = true;
-    if (!creation && ACCOUNT_CREATION_RE.test(content)) creation = true;
-    if (!privacyPolicy && PRIVACY_POLICY_RE.test(content)) privacyPolicy = true;
-    if (!externalCheckout && EXTERNAL_CHECKOUT_RE.test(content)) externalCheckout = true;
-    if (WEBVIEW_RE.test(content)) webviewFiles += 1;
-  }
-  const scannedFiles = input.files.length;
-  return {
-    restore_purchases_found: restore,
-    account_deletion_found: deletion,
-    privacy_policy_link_found: privacyPolicy,
-    external_checkout_url_found: externalCheckout,
-    webview_ratio: round2(webviewFiles / Math.max(scannedFiles, 1)),
-    account_creation_found: creation,
-    webview_files: webviewFiles,
-    scanned_files: scannedFiles,
-    source_chars: sourceChars
-  };
-}
-function permissionShortName(permission) {
-  const idx = permission.lastIndexOf(".");
-  return idx >= 0 ? permission.slice(idx + 1) : permission;
-}
-function sdkOriginFile(coordinate, stack) {
-  const ecosystem = coordinate.slice(0, coordinate.indexOf(":"));
-  switch (ecosystem) {
-    case "npm":
-      return "package.json";
-    case "pub":
-      return "pubspec.yaml";
-    case "pods":
-      return stack === "swift" ? "Podfile" : "ios/Podfile";
-    case "spm":
-      return "Package.swift";
-    case "gradle":
-      return stack === "kotlin" ? "app/build.gradle" : "android/app/build.gradle";
-    case "nuget":
-      return "*.csproj";
-    case "upm":
-      return "Packages/manifest.json";
-    default:
-      return null;
-  }
-}
-function deriveCapabilities(input) {
-  const caps = /* @__PURE__ */ new Set();
-  const registryById = new Map(
-    input.registry.map((entry) => [entry.id, entry])
-  );
-  for (const sdk of input.sdks) {
-    const entry = registryById.get(sdk.id);
-    for (const cap of entry?.implies ?? []) caps.add(cap);
-  }
-  const ent = input.entitlements?.entitlements;
-  if (ent) {
-    if (ent.sign_in_with_apple) caps.add("sign_in_with_apple");
-    if (ent.aps_environment !== null) caps.add("push_notifications");
-    if (ent.healthkit) caps.add("health");
-  }
-  if (input.privacyManifest?.privacy_manifest.tracking === true) {
-    caps.add("tracking");
-  }
-  const signals = input.signals;
-  if (signals) {
-    if (signals.account_creation_found) caps.add("account_creation");
-    if (signals.account_deletion_found) caps.add("account_deletion");
-    if (signals.webview_ratio >= 0.5) caps.add("webview_heavy");
-    if (signals.external_checkout_url_found) caps.add("external_payment");
-  }
-  for (const permission of input.android?.android.permissions ?? []) {
-    switch (permissionShortName(permission)) {
-      case "ACCESS_FINE_LOCATION":
-      case "ACCESS_COARSE_LOCATION":
-        caps.add("location");
-        break;
-      case "CAMERA":
-        caps.add("camera");
-        break;
-      case "RECORD_AUDIO":
-        caps.add("microphone");
-        break;
-      case "ACTIVITY_RECOGNITION":
-      case "BODY_SENSORS":
-        caps.add("health");
-        break;
-      case "READ_CONTACTS":
-        caps.add("contacts");
-        break;
-      default:
-        break;
-    }
-  }
-  const usage = input.ios?.plist?.usage_descriptions;
-  if (usage) {
-    const has = (key) => Object.prototype.hasOwnProperty.call(usage, key);
-    const keys = Object.keys(usage);
-    if (has("NSCameraUsageDescription")) caps.add("camera");
-    if (has("NSMicrophoneUsageDescription")) caps.add("microphone");
-    if (keys.some((k) => k.startsWith("NSLocationWhenInUse") || k.startsWith("NSLocationAlways"))) {
-      caps.add("location");
-    }
-    if (has("NSContactsUsageDescription")) caps.add("contacts");
-    if (keys.some((k) => k.startsWith("NSPhotoLibrary"))) caps.add("photos");
-    if (has("NSHealthShareUsageDescription") || has("NSHealthUpdateUsageDescription")) {
-      caps.add("health");
-    }
-    if (keys.some((k) => k.startsWith("NSBluetooth"))) caps.add("bluetooth");
-    if (has("NSUserTrackingUsageDescription")) caps.add("tracking");
-  }
-  return Array.from(caps).sort();
-}
-function mergeEvidence(input) {
-  const evidence = {};
-  const sources = [
-    input.ios?.evidence,
-    input.entitlements?.evidence,
-    input.privacyManifest?.evidence,
-    input.android?.evidence,
-    input.gradleTargets?.evidence
-  ];
-  for (const source of sources) {
-    if (source) Object.assign(evidence, source);
-  }
-  const firstCoordinate = input.sdks[0]?.matched_coordinates[0];
-  if (firstCoordinate) {
-    const file = sdkOriginFile(firstCoordinate, input.stackResult.stack);
-    if (file) evidence["sdks"] = { file, detail: "dependency manifest" };
-  }
-  return evidence;
-}
-function buildAppProfile(input) {
-  const hasIos = input.ios !== null || input.entitlements !== null || input.privacyManifest !== null;
-  const ios = hasIos ? {
-    plist_source: input.ios?.plist_source ?? "none",
-    plist: input.ios?.plist ?? null,
-    entitlements: input.entitlements?.entitlements ?? null,
-    privacy_manifest: input.privacyManifest?.privacy_manifest ?? null
-  } : null;
-  const android = input.android ? input.android.android : null;
-  const signals = input.signals ? {
-    restore_purchases_found: input.signals.restore_purchases_found,
-    account_deletion_found: input.signals.account_deletion_found,
-    privacy_policy_link_found: input.signals.privacy_policy_link_found,
-    external_checkout_url_found: input.signals.external_checkout_url_found,
-    webview_ratio: input.signals.webview_ratio
-  } : {
-    restore_purchases_found: null,
-    account_deletion_found: null,
-    privacy_policy_link_found: null,
-    external_checkout_url_found: null,
-    webview_ratio: null
-  };
-  return {
-    schema_version: 1,
-    generated_at: input.generatedAt,
-    stack: input.stackResult.stack,
-    stack_label: input.stackResult.label,
-    platforms: input.stackResult.platforms,
-    app: {
-      name: input.appConfig.app_name,
-      bundle_id: input.appConfig.bundle_id,
-      version: input.appConfig.version ?? null,
-      min_ios_version: input.appConfig.min_ios_version ?? null,
-      min_android_sdk: input.gradleTargets?.min_android_sdk ?? null,
-      target_android_sdk: input.gradleTargets?.target_android_sdk ?? null
-    },
-    sdks: input.sdks,
-    raw_dependencies: input.deps,
-    ios,
-    android,
-    capabilities: deriveCapabilities(input),
-    signals,
-    evidence: mergeEvidence(input),
-    stats: {
-      files_scanned: input.signals?.scanned_files ?? 0,
-      source_chars_read: input.signals?.source_chars ?? 0
-    }
-  };
-}
-
-// src/engine/rules.ts
-function resolveFact(profile, path2) {
-  const segments = path2.split(".");
-  let current = profile;
-  for (let i = 0; i < segments.length; i++) {
-    if (current === null || current === void 0) return { kind: "unknown" };
-    if (typeof current !== "object") return { kind: "unknown" };
-    const obj = current;
-    const seg = segments[i];
-    const isLeaf = i === segments.length - 1;
-    if (isLeaf) {
-      if (!Object.prototype.hasOwnProperty.call(obj, seg)) return { kind: "missing" };
-      const value = obj[seg];
-      if (value === null || value === void 0) return { kind: "nullvalue" };
-      return { kind: "value", value };
-    }
-    current = obj[seg];
-  }
-  return { kind: "unknown" };
-}
-function strictEquals(a, b) {
-  return a === b;
-}
-function valueIncludes(collection, needle) {
-  if (Array.isArray(collection)) return collection.includes(needle);
-  if (typeof collection === "string") return collection.includes(String(needle));
-  return false;
-}
-function evaluateFactPredicate(profile, fact, op, value) {
-  const r = resolveFact(profile, fact);
-  if (r.kind === "unknown") return "unknown";
-  switch (op) {
-    case "exists":
-      if (r.kind === "value") return "true";
-      if (r.kind === "nullvalue") return "unknown";
-      return "false";
-    // missing
-    case "absent":
-      if (r.kind === "value") return "false";
-      if (r.kind === "nullvalue") return "unknown";
-      return "true";
-    // missing
-    case "eq":
-      if (r.kind === "value") return strictEquals(r.value, value) ? "true" : "false";
-      return "false";
-    case "neq":
-      if (r.kind === "value") return strictEquals(r.value, value) ? "false" : "true";
-      return "true";
-    case "gte":
-      if (r.kind === "value" && typeof r.value === "number" && typeof value === "number") {
-        return r.value >= value ? "true" : "false";
-      }
-      return "unknown";
-    // non-numeric VALUE, or NULLVALUE/MISSING
-    case "lte":
-      if (r.kind === "value" && typeof r.value === "number" && typeof value === "number") {
-        return r.value <= value ? "true" : "false";
-      }
-      return "unknown";
-    case "includes":
-      if (r.kind === "value") return valueIncludes(r.value, value) ? "true" : "false";
-      return "unknown";
-    case "not_includes":
-      if (r.kind === "value") return valueIncludes(r.value, value) ? "false" : "true";
-      return "unknown";
-    case "matches":
-      if (r.kind === "value") {
-        if (typeof r.value !== "string") return "unknown";
-        let re;
-        try {
-          re = new RegExp(String(value));
-        } catch {
-          return "unknown";
-        }
-        return re.test(r.value) ? "true" : "false";
-      }
-      return "unknown";
-    // nullvalue/missing
-    default:
-      return "unknown";
-  }
-}
-function evaluateCondition(profile, condition, matchedSdkIds) {
-  if ("all" in condition) {
-    let sawUnknown = false;
-    for (const child of condition.all) {
-      const t = evaluateCondition(profile, child, matchedSdkIds);
-      if (t === "false") return "false";
-      if (t === "unknown") sawUnknown = true;
-    }
-    return sawUnknown ? "unknown" : "true";
-  }
-  if ("any" in condition) {
-    let sawUnknown = false;
-    for (const child of condition.any) {
-      const t = evaluateCondition(profile, child, matchedSdkIds);
-      if (t === "true") return "true";
-      if (t === "unknown") sawUnknown = true;
-    }
-    return sawUnknown ? "unknown" : "false";
-  }
-  if ("not" in condition) {
-    const t = evaluateCondition(profile, condition.not, matchedSdkIds);
-    if (t === "unknown") return "unknown";
-    return t === "true" ? "false" : "true";
-  }
-  return evaluatePredicate(profile, condition, matchedSdkIds);
-}
-function evaluatePredicate(profile, pred, matchedSdkIds) {
-  if ("always" in pred) return "true";
-  if ("sdk" in pred) {
-    const hit = profile.sdks.some((s) => s.id === pred.sdk);
-    if (hit && matchedSdkIds) matchedSdkIds.add(pred.sdk);
-    return hit ? "true" : "false";
-  }
-  if ("sdk_category" in pred) {
-    let hit = false;
-    for (const s of profile.sdks) {
-      if (s.category === pred.sdk_category) {
-        hit = true;
-        if (matchedSdkIds) matchedSdkIds.add(s.id);
-      }
-    }
-    return hit ? "true" : "false";
-  }
-  if ("sdk_flag" in pred) {
-    let hit = false;
-    for (const s of profile.sdks) {
-      if (s.flags[pred.sdk_flag] === true) {
-        hit = true;
-        if (matchedSdkIds) matchedSdkIds.add(s.id);
-      }
-    }
-    return hit ? "true" : "false";
-  }
-  if ("capability" in pred) {
-    return profile.capabilities.includes(pred.capability) ? "true" : "false";
-  }
-  if ("platform" in pred) {
-    return profile.platforms.includes(pred.platform) ? "true" : "false";
-  }
-  return evaluateFactPredicate(profile, pred.fact, pred.op, pred.value);
-}
-function interpolate(text, ctx) {
-  return text.replace(
-    /\{\{(\w+)\}\}/g,
-    (match, key) => Object.prototype.hasOwnProperty.call(ctx, key) ? ctx[key] : match
-  );
-}
-function formatFactValue(value) {
-  if (Array.isArray(value)) {
-    return value.map(
-      (el) => el && typeof el === "object" && "name" in el ? String(el.name) : String(el)
-    ).join(", ");
-  }
-  if (value && typeof value === "object") return JSON.stringify(value);
-  return String(value);
-}
-function buildEvidence(profile, facts) {
-  const parts = [];
-  for (const fact of facts) {
-    const r = resolveFact(profile, fact);
-    if (r.kind !== "value") continue;
-    const formatted = formatFactValue(r.value);
-    if (formatted === "") continue;
-    parts.push(`${fact}: ${formatted}`);
-  }
-  return parts.join("; ");
-}
-function firstEvidenceFile(profile, facts) {
-  for (const fact of facts) {
-    const entry = profile.evidence[fact];
-    if (entry?.file) return entry.file;
-  }
-  return void 0;
-}
-function expandTemplateRule(templateRule, profile, bundle) {
-  const registryById = new Map(
-    bundle.sdk_registry.map((entry) => [entry.id, entry])
-  );
-  const synthesized = [];
-  for (const profileSdk of profile.sdks) {
-    const entry = registryById.get(profileSdk.id);
-    const requiredKeys = entry?.requires?.ios_plist_keys;
-    if (!requiredKeys) continue;
-    for (const req of requiredKeys) {
-      if (!req.key.endsWith("UsageDescription")) continue;
-      const guidelineName = bundle.guidelines[req.guideline]?.name ?? templateRule.guideline.name;
-      const ctx = {
-        plist_key: req.key,
-        reason: req.reason,
-        sdk_names: profileSdk.name
-      };
-      synthesized.push({
-        id: `appstore.sdk-plist.${profileSdk.id}.${req.key}`,
-        store: templateRule.store,
-        guideline: { number: req.guideline, name: guidelineName },
-        severity: templateRule.severity,
-        category: templateRule.category,
-        title: interpolate(templateRule.title, ctx),
-        description: interpolate(templateRule.description, ctx),
-        user_impact: interpolate(templateRule.user_impact, ctx),
-        fix: interpolate(templateRule.fix, ctx),
-        tags: templateRule.tags,
-        applies_if: { all: [{ platform: "ios" }, { sdk: profileSdk.id }] },
-        unverified_if: { fact: "ios.plist", op: "absent" },
-        fail_if: { fact: `ios.plist.usage_descriptions.${req.key}`, op: "absent" },
-        evidence_facts: templateRule.evidence_facts
-      });
-    }
-  }
-  return synthesized;
-}
-function evaluateRule(profile, rule) {
-  const matchedSdkIds = /* @__PURE__ */ new Set();
-  const appliesTri = rule.applies_if ? evaluateCondition(profile, rule.applies_if, matchedSdkIds) : "true";
-  let status;
-  let isFail = false;
-  if (appliesTri === "false") {
-    status = "na";
-  } else if (appliesTri === "unknown") {
-    status = "unverified";
-  } else {
-    const unverifiedTri = rule.unverified_if ? evaluateCondition(profile, rule.unverified_if, matchedSdkIds) : "false";
-    if (unverifiedTri === "true" || unverifiedTri === "unknown") {
-      status = "unverified";
-    } else {
-      const failTri = evaluateCondition(profile, rule.fail_if, matchedSdkIds);
-      if (failTri === "true") {
-        status = "fail";
-        isFail = true;
-      } else if (failTri === "unknown") {
-        status = "unverified";
-      } else {
-        status = "pass";
-      }
-    }
-  }
-  const sdkNames = profile.sdks.filter((s) => matchedSdkIds.has(s.id)).map((s) => s.name);
-  const sdkNamesStr = sdkNames.length > 0 ? sdkNames.join(", ") : "the detected SDKs";
-  const evidenceStr = buildEvidence(profile, rule.evidence_facts);
-  const ctx = { sdk_names: sdkNamesStr, evidence: evidenceStr };
-  const title = interpolate(rule.title, ctx);
-  const check = {
-    rule_id: rule.id,
-    title,
-    status,
-    severity: rule.severity,
-    guideline_number: rule.guideline.number
-  };
-  if (evidenceStr) check.evidence = evidenceStr;
-  let finding;
-  if (isFail) {
-    check.finding_id = rule.id;
-    finding = {
-      id: rule.id,
-      title,
-      risk_level: rule.severity,
-      category: rule.category,
-      source: "codebase",
-      detection: "static",
-      guideline_number: rule.guideline.number,
-      guideline_name: rule.guideline.name,
-      description: interpolate(rule.description, ctx),
-      user_impact: interpolate(rule.user_impact, ctx),
-      evidence: evidenceStr,
-      recommendation: interpolate(rule.fix, ctx),
-      rule_id: rule.id
-    };
-    const file = firstEvidenceFile(profile, rule.evidence_facts);
-    if (file) finding.file = file;
-  }
-  return { check, finding };
-}
-var STATUS_ORDER = {
-  fail: 0,
-  unverified: 1,
-  pass: 2,
-  na: 3
-};
-var SEVERITY_ORDER = {
-  high: 0,
-  medium: 1,
-  low: 2,
-  info: 3
-};
-function compareIds(a, b) {
-  return a < b ? -1 : a > b ? 1 : 0;
-}
-function evaluateRules(profile, bundle) {
-  const effectiveRules = [];
-  for (const rule of bundle.rules) {
-    if (rule.template === "sdk_required_plist_keys") {
-      effectiveRules.push(...expandTemplateRule(rule, profile, bundle));
-    } else if (rule.template) {
-      continue;
-    } else {
-      effectiveRules.push(rule);
-    }
-  }
-  const checks = [];
-  const findings = [];
-  const seenIds = /* @__PURE__ */ new Set();
-  for (const rule of effectiveRules) {
-    if (seenIds.has(rule.id)) continue;
-    seenIds.add(rule.id);
-    const { check, finding } = evaluateRule(profile, rule);
-    checks.push(check);
-    if (finding) findings.push(finding);
-  }
-  checks.sort(
-    (a, b) => STATUS_ORDER[a.status] - STATUS_ORDER[b.status] || SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity] || compareIds(a.rule_id, b.rule_id)
-  );
-  findings.sort(
-    (a, b) => SEVERITY_ORDER[a.risk_level] - SEVERITY_ORDER[b.risk_level] || compareIds(a.rule_id ?? a.id, b.rule_id ?? b.id)
-  );
-  return { checks, findings };
-}
-
-// src/engine/index.ts
-function extensionsForStack(stack) {
-  switch (stack) {
-    case "flutter":
-      return [".dart"];
-    case "swift":
-      return [".swift", ".m", ".mm", ".h"];
-    case "kotlin":
-      return [".kt", ".kts"];
-    case "expo":
-    case "react-native":
-    case "capacitor":
-      return [".ts", ".tsx", ".js", ".jsx"];
-    case "dotnet-maui":
-      return [".cs", ".xaml"];
-    case "unity":
-      return [".cs"];
-    case "kmp":
-      return [".kt", ".kts", ".swift"];
-    default:
-      return [".ts", ".js", ".swift", ".dart", ".kt"];
-  }
-}
-var SELF_SCAN_MAX_FILES = 300;
-var SELF_SCAN_MAX_TOTAL_CHARS = 200 * 1024;
-function selfScanSource(rootDir, stack) {
-  const relPaths = scanDirectory(rootDir, {
-    extensions: extensionsForStack(stack),
-    maxDepth: 8,
-    maxFiles: SELF_SCAN_MAX_FILES
-  });
-  const files = [];
-  let totalChars = 0;
-  for (const rel of relPaths) {
-    if (files.length >= SELF_SCAN_MAX_FILES || totalChars >= SELF_SCAN_MAX_TOTAL_CHARS) break;
-    const content = readFileSafe(join14(rootDir, rel));
-    if (content === null) continue;
-    files.push({ path: rel, content });
-    totalChars += content.length;
-  }
-  return files;
-}
-function runStaticEngine(input) {
-  const { rootDir, stackResult, bundle } = input;
-  const { stack, platforms } = stackResult;
-  const deps = collectRawDependencies(rootDir, stack);
-  const sdks = matchSDKs(deps, bundle.sdk_registry);
-  const isIos = platforms.includes("ios");
-  const isAndroid = platforms.includes("android");
-  const kmpLayout = stack === "kmp" ? findKmpLayout(rootDir) : null;
-  const iosRoot = kmpLayout?.iosAppDir ?? rootDir;
-  const androidRoot = kmpLayout?.androidModuleDir ?? rootDir;
-  const ios = isIos ? extractIosPlist(iosRoot) : null;
-  const entitlements = isIos ? extractIosEntitlements(iosRoot) : null;
-  const privacyManifest = isIos ? extractIosPrivacyManifest(iosRoot) : null;
-  const android = isAndroid ? extractAndroidManifest(androidRoot) : null;
-  const gradleTargets = isAndroid ? extractGradleTargets(androidRoot) : null;
-  let appConfig = input.appConfig;
-  let extraEvidence = null;
-  if (stack === "unity") {
-    const unityExtraction = extractUnityProjectSettings(rootDir);
-    if (unityExtraction) {
-      appConfig = {
-        ...appConfig,
-        app_name: appConfig.app_name ?? unityExtraction.product_name,
-        bundle_id: appConfig.bundle_id ?? unityExtraction.bundle_id,
-        version: appConfig.version ?? unityExtraction.app_version
-      };
-      extraEvidence = unityExtraction.evidence;
-    }
-  }
-  let signals;
-  if (input.sourceFiles !== void 0) {
-    signals = scanSourceSignals({ files: input.sourceFiles });
-  } else {
-    const selfFiles = selfScanSource(rootDir, stack);
-    signals = selfFiles.length > 0 ? scanSourceSignals({ files: selfFiles }) : null;
-  }
-  const profile = buildAppProfile({
-    rootDir,
-    stackResult,
-    appConfig,
-    deps,
-    sdks,
-    registry: bundle.sdk_registry,
-    ios,
-    entitlements,
-    privacyManifest,
-    android,
-    gradleTargets,
-    signals,
-    generatedAt: input.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString()
-  });
-  if (extraEvidence) {
-    profile.evidence = { ...profile.evidence, ...extraEvidence };
-  }
-  const { checks, findings } = evaluateRules(profile, bundle);
-  return { profile, checks, findings };
-}
-
-// src/engine/remote.ts
-import { readFileSync as readFileSync6 } from "fs";
-import { readFile, writeFile, mkdir, rm } from "fs/promises";
-import os from "os";
-import path from "path";
-import { fileURLToPath } from "url";
-var DEFAULT_BASE_URL = "https://forvibe.app";
-var DEFAULT_TIMEOUT_MS = 2500;
-var ENDPOINT_PATH = "/api/v1/review-rulepack?store=appstore";
-var BUNDLE_FILENAME = "bundle.appstore.json";
-var CACHE_BUNDLE_FILENAME = "rulepack-appstore.json";
-var CACHE_META_FILENAME = "rulepack-appstore.meta.json";
-async function loadRulepackBundle(opts = {}) {
-  const baseUrl = opts.baseUrl ?? DEFAULT_BASE_URL;
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const cacheDir = opts.cacheDir ?? path.join(os.homedir(), ".forvibe", "cache");
-  if (!opts.disableRemote) {
-    const meta = await readCacheMeta(cacheDir);
-    const headers = {};
-    if (meta?.etag) headers["If-None-Match"] = meta.etag;
-    const url = `${baseUrl.replace(/\/+$/, "")}${ENDPOINT_PATH}`;
-    const outcome = await tryFetch(url, headers, timeoutMs);
-    if (outcome.kind === "fresh") {
-      await writeCache(cacheDir, outcome.bundle, outcome.etag);
-      return { bundle: outcome.bundle, source: "remote", version: outcome.bundle.version };
-    }
-    if (outcome.kind === "not-modified") {
-      const cached = await readCachedBundle(cacheDir);
-      if (cached) {
-        return { bundle: cached, source: "cache", version: cached.version };
-      }
-      await deleteStaleMeta(cacheDir);
-      return loadFromCacheOrBundled(cacheDir);
-    }
-  }
-  return loadFromCacheOrBundled(cacheDir);
-}
-async function loadFromCacheOrBundled(cacheDir) {
-  const cached = await readCachedBundle(cacheDir);
-  if (cached) {
-    return { bundle: cached, source: "cache", version: cached.version };
-  }
-  const bundled = loadBundledSnapshot();
-  return { bundle: bundled, source: "bundled", version: bundled.version };
-}
-async function tryFetch(url, headers, timeoutMs) {
-  let res;
-  try {
-    res = await fetchWithTimeout(url, headers, timeoutMs);
-  } catch {
-    return { kind: "failed" };
-  }
-  if (res.status === 304) {
-    return { kind: "not-modified" };
-  }
-  if (!res.ok) {
-    return { kind: "failed" };
-  }
-  let bundle;
-  try {
-    bundle = await res.json();
-  } catch {
-    return { kind: "failed" };
-  }
-  if (bundle?.schema_version !== 1) {
-    return { kind: "failed" };
-  }
-  return { kind: "fresh", bundle, etag: res.headers.get("etag") ?? void 0 };
-}
-async function fetchWithTimeout(url, headers, timeoutMs) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  const fetchPromise = fetch(url, { headers, signal: controller.signal });
-  fetchPromise.catch(() => {
-  });
-  try {
-    return await Promise.race([
-      fetchPromise,
-      new Promise((_resolve, reject) => {
-        controller.signal.addEventListener(
-          "abort",
-          () => reject(new Error(`rulepack fetch timed out after ${timeoutMs}ms`)),
-          { once: true }
-        );
-      })
-    ]);
-  } finally {
-    clearTimeout(timer);
-  }
-}
-async function readCacheMeta(cacheDir) {
-  try {
-    const raw = await readFile(path.join(cacheDir, CACHE_META_FILENAME), "utf-8");
-    const parsed = JSON.parse(raw);
-    return parsed && typeof parsed === "object" ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-async function readCachedBundle(cacheDir) {
-  try {
-    const raw = await readFile(path.join(cacheDir, CACHE_BUNDLE_FILENAME), "utf-8");
-    const parsed = JSON.parse(raw);
-    return parsed && parsed.schema_version === 1 ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-async function deleteStaleMeta(cacheDir) {
-  try {
-    await rm(path.join(cacheDir, CACHE_META_FILENAME), { force: true });
-  } catch {
-  }
-}
-async function writeCache(cacheDir, bundle, etag) {
-  try {
-    await mkdir(cacheDir, { recursive: true });
-    await writeFile(path.join(cacheDir, CACHE_BUNDLE_FILENAME), JSON.stringify(bundle, null, 2), "utf-8");
-    const meta = { fetched_at: (/* @__PURE__ */ new Date()).toISOString() };
-    if (etag) meta.etag = etag;
-    await writeFile(path.join(cacheDir, CACHE_META_FILENAME), JSON.stringify(meta, null, 2), "utf-8");
-  } catch {
-  }
-}
-function getEngineDataDir() {
-  const __filename = fileURLToPath(import.meta.url);
-  const __dirname = path.dirname(__filename);
-  const candidates = [
-    path.join(__dirname, "data"),
-    // dev, running from source (src/engine/data)
-    path.join(__dirname, "engine", "data"),
-    // bundled, __dirname = dist/ -> dist/engine/data
-    path.join(__dirname, "..", "engine", "data"),
-    path.join(__dirname, "..", "src", "engine", "data")
-  ];
-  for (const dir of candidates) {
-    try {
-      readFileSync6(path.join(dir, BUNDLE_FILENAME));
-      return dir;
-    } catch {
-    }
-  }
-  return candidates[0];
-}
-function loadBundledSnapshot() {
-  const filePath = path.join(getEngineDataDir(), BUNDLE_FILENAME);
-  let raw;
-  try {
-    raw = readFileSync6(filePath, "utf-8");
-  } catch (err) {
-    throw new Error(
-      `Bundled rulepack snapshot not found at ${filePath}. This indicates a broken install - bundle.appstore.json should always ship with the package. (${err.message})`
-    );
-  }
-  try {
-    return JSON.parse(raw);
-  } catch (err) {
-    throw new Error(`Bundled rulepack snapshot at ${filePath} is not valid JSON: ${err.message}`);
-  }
-}
-
-// src/engine/redactor.ts
-function buildSimpleRules() {
-  return [
-    {
-      kind: "pem",
-      regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g
-    },
-    { kind: "anthropic", regex: /sk-ant-[A-Za-z0-9_-]{16,}/g },
-    {
-      kind: "openai",
-      regex: /sk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{16,}|sk-[A-Za-z0-9]{32,}/g
-    },
-    { kind: "stripe", regex: /(?:sk|pk|rk)_(?:live|test)_[A-Za-z0-9]{16,}/g },
-    { kind: "google", regex: /AIza[0-9A-Za-z_-]{35}/g },
-    { kind: "aws", regex: /AKIA[0-9A-Z]{16}/g },
-    { kind: "github", regex: /gh[pousr]_[A-Za-z0-9]{20,}/g },
-    { kind: "slack", regex: /xox[baprs]-[A-Za-z0-9-]{10,}/g },
-    {
-      kind: "jwt",
-      regex: /eyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g
-    }
-  ];
-}
-function buildGenericRule() {
-  return /(api[_-]?key|apikey|secret|token|passwd|password|client[_-]?secret)(\s*[:=]\s*)(["'])([^"'\n]{12,})(["'])/gi;
-}
-var ALREADY_REDACTED = /^\[REDACTED:[A-Za-z0-9_]+\]$/;
-function redactSecrets(source) {
-  let text = source;
-  let redactedCount = 0;
-  for (const { kind, regex } of buildSimpleRules()) {
-    text = text.replace(regex, () => {
-      redactedCount++;
-      return `[REDACTED:${kind}]`;
-    });
-  }
-  text = text.replace(
-    buildGenericRule(),
-    (full, key, delim, openQuote, value, closeQuote) => {
-      if (ALREADY_REDACTED.test(value)) return full;
-      redactedCount++;
-      return `${key}${delim}${openQuote}[REDACTED:generic]${closeQuote}`;
-    }
-  );
-  return { text, redactedCount };
-}
-
-// src/review/feature-detector.ts
-function getFeatureDiscoveryPrompt() {
-  return `You are an expert app analyst. Your job is to understand WHAT an app does from the USER's perspective by reading its source code. You are NOT reviewing code quality.
-
-Respond in English.
-
-Answer this question: "If someone downloads this app and opens it on their iPhone, what will they see and experience?"
-
-Analyze the source code and identify:
-
-1. **App Purpose**: What does this app do? (1-2 sentences)
-2. **User Flows**: What are the main things a user can do? (list each)
-3. **Onboarding**: What happens when you first open the app? Login required? Permissions asked immediately?
-4. **Monetization**: How does the app make money? Subscriptions? IAP? Ads? External payments? Free?
-5. **Data & Privacy**: What user data does the app collect? What device permissions does it need? Is there a privacy policy link?
-6. **Content**: Is there user-generated content (posts, comments, chat)? Third-party content? Web content?
-7. **Account Management**: Can users create accounts? Can they delete their accounts?
-8. **Platform Features**: Does it use WebViews, widgets, extensions, push notifications, background processing?
-9. **Settings & Legal**: What can users configure? Is there a privacy policy accessible in-app? Terms of service?
-10. **External Links**: Does the app link to external payment pages, websites, or other apps?
-
-IMPORTANT: You are seeing a SUBSET of the source code, not the entire codebase. Do not make definitive claims about features being absent \u2014 only report features you can positively identify from the code shown. If something might exist but you don't see it, do not list it as missing.
-
-Respond ONLY with valid JSON in this exact format:
-
-{
-  "appPurpose": "string describing what the app does",
-  "features": [
-    {
-      "feature": "string identifier (e.g., 'subscriptions', 'webview', 'ugc', 'account_creation', 'push_notifications', 'camera_usage', 'location_tracking')",
-      "description": "string describing what the user experiences",
-      "confidence": 0.0-1.0,
-      "keywords": ["relevant", "keywords", "from", "code"],
-      "category": "safety|performance|business|design|legal|common-pitfalls",
-      "relevantFiles": ["file1.swift", "file2.ts"]
-    }
-  ],
-  "riskAreas": ["string describing areas that Apple reviewers commonly flag for apps like this"],
-  "appType": "native|hybrid|webview-heavy|web-wrapper"
-}`;
-}
-async function detectFeatures(provider, platform, appName, bundleId, sourceCode) {
-  const systemPrompt = getFeatureDiscoveryPrompt();
-  const userPrompt = `## App Information
-- Platform: ${platform}
-- App Name: ${appName}
-- Bundle ID: ${bundleId}
-
-## Source Code
-
-${sourceCode}`;
-  try {
-    const response = await provider.generateJSON(systemPrompt, userPrompt, 0.2);
-    return parseFeatureAnalysis(response);
-  } catch {
-    return null;
-  }
-}
-function parseFeatureAnalysis(response) {
-  try {
-    return JSON.parse(response);
-  } catch {
-    const jsonMatch = response.match(/```(?:json)?\s*\n?([\s\S]*?)\n?```/);
-    if (jsonMatch) {
-      try {
-        return JSON.parse(jsonMatch[1]);
-      } catch {
-      }
-    }
-    const objectMatch = response.match(/\{[\s\S]*"features"[\s\S]*\}/);
-    if (objectMatch) {
-      try {
-        return JSON.parse(objectMatch[0]);
-      } catch {
-      }
+
+// src/review/rag-selector.ts
+import { readFileSync as readFileSync6 } from "fs";
+import { fileURLToPath } from "url";
+import path from "path";
+var DATA_FILES = [
+  "safety.json",
+  "performance.json",
+  "business.json",
+  "design.json",
+  "legal.json",
+  "common-pitfalls.json"
+];
+var cachedStories = null;
+function getDataDir() {
+  const __filename = fileURLToPath(import.meta.url);
+  const __dirname = path.dirname(__filename);
+  const candidates = [
+    path.join(__dirname, "rag-data"),
+    path.join(__dirname, "review", "rag-data"),
+    path.join(__dirname, "..", "review", "rag-data"),
+    path.join(__dirname, "..", "src", "review", "rag-data")
+  ];
+  for (const dir of candidates) {
+    try {
+      readFileSync6(path.join(dir, "safety.json"));
+      return dir;
+    } catch {
     }
-    return null;
   }
+  return candidates[0];
 }
-
-// src/review/rag-selector.ts
-function searchStories(stories, signals, maxResults = 20) {
-  if (signals.length === 0) return stories.slice(0, maxResults);
-  const signalKeywords = /* @__PURE__ */ new Set();
-  const signalFeatures = /* @__PURE__ */ new Set();
-  const signalCategories = /* @__PURE__ */ new Set();
-  for (const signal of signals) {
-    if (typeof signal === "string") {
-      const value = signal.toLowerCase();
-      signalFeatures.add(value);
-      signalKeywords.add(value);
-    } else {
-      signalFeatures.add(signal.feature.toLowerCase());
-      for (const keyword of signal.keywords) signalKeywords.add(keyword.toLowerCase());
-      signalCategories.add(signal.category);
+function loadAllStories() {
+  if (cachedStories) return cachedStories;
+  const dataDir = getDataDir();
+  const stories = [];
+  for (const file of DATA_FILES) {
+    try {
+      const content = readFileSync6(path.join(dataDir, file), "utf-8");
+      const parsed = JSON.parse(content);
+      stories.push(...parsed);
+    } catch {
     }
   }
-  const scored = stories.map((story) => {
+  cachedStories = stories;
+  return stories;
+}
+function searchStories(signals, maxResults = 20) {
+  const allStories = loadAllStories();
+  if (signals.length === 0) return allStories.slice(0, maxResults);
+  const signalKeywords = new Set(
+    signals.flatMap((s) => s.keywords.map((k) => k.toLowerCase()))
+  );
+  const signalFeatures = new Set(
+    signals.map((s) => s.feature.toLowerCase())
+  );
+  const signalCategories = new Set(signals.map((s) => s.category));
+  const scored = allStories.map((story) => {
     let score = 0;
     for (const signal of story.behavioralSignals) {
       const signalLower = signal.toLowerCase();
@@ -5876,21 +3983,6 @@ You do NOT review code quality. You review the APP \u2014 what a user sees, touc
 For every issue, think through this exact scenario:
 "I downloaded this app on my iPhone. I opened it. I [did something specific]. I saw [specific result]. This violates Guideline [X.X] because [reason]."
 
-## STATIC ANALYSIS ALREADY RAN
-
-A deterministic static rule engine scanned this codebase before you. The user prompt contains a section titled "## Already Detected By Static Analysis (do not repeat)". Those violations are CONFIRMED and already in the final report.
-
-HARD RULES:
-1. You MUST NOT re-report anything listed in that section. A finding that duplicates a listed guideline violation will be discarded.
-2. Focus on what static analysis CANNOT see:
-   - Minimum functionality and app completeness (Guideline 4.2): is this a real, useful app or a thin shell?
-   - Spam, template, and repetitive app patterns (Guideline 4.3)
-   - User-generated content without moderation: report, block, and filter mechanisms (Guideline 1.2)
-   - Misleading claims, undelivered features, fake functionality (Guideline 2.3.1)
-   - Purchase flows that bypass or confuse Apple's in-app purchase system (Guidelines 3.1.x)
-   - Objectionable or age-inappropriate content (Guideline 1.1)
-3. Every finding MUST cite a specific guideline number AND describe the user-visible impact.
-
 ## WHAT YOU CHECK (as if using the app)
 
 1. **First Launch**: What happens when I open the app? Does it crash? Show a blank screen? Force me to log in? Ask for too many permissions at once?
@@ -5941,11 +4033,11 @@ You MUST respond with valid JSON:
       "relatedRejection": "string | null (reference to a similar rejection case if provided)"
     }
   ],
-  "overallAssessment": "string (2-3 sentence assessment of the app's review readiness)"
+  "overallAssessment": "string (2-3 sentence assessment of the app's review readiness)",
+  "estimatedOutcome": "likely-approved | likely-rejected | needs-attention",
+  "estimatedApprovalChance": 0-100
 }
 
-Do not include an approval estimate; the final outcome is computed deterministically from the merged findings.
-
 ## IMPORTANT RULES
 
 1. Every finding MUST describe user-visible behavior, not code patterns
@@ -5995,8 +4087,14 @@ function validateCategory(c) {
   }
   return "performance";
 }
+function validateOutcome(o) {
+  if (["likely-approved", "likely-rejected", "needs-attention"].includes(o)) {
+    return o;
+  }
+  return "needs-attention";
+}
 function convertFindings(raw) {
-  return (raw.findings ?? []).map((f, i) => ({
+  return raw.findings.map((f, i) => ({
     id: f.ruleId || `finding-${i + 1}`,
     title: f.title,
     risk_level: validateRiskLevel(f.severity),
@@ -6009,164 +4107,51 @@ function convertFindings(raw) {
     evidence: f.evidence ?? "",
     recommendation: f.fixSuggestion,
     file: f.file ?? void 0,
-    related_story_id: f.relatedRejection ?? void 0,
-    // No rule_id: AI findings have no backing rulepack rule.
-    detection: "ai"
+    related_story_id: f.relatedRejection ?? void 0
   }));
 }
-function normalizeTitle(title) {
-  return title.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
-}
-function dedupeAIFindings(aiFindings, staticFindings) {
-  const kept = aiFindings.filter((ai) => {
-    const aiTitle = normalizeTitle(ai.title ?? "");
-    return !staticFindings.some((st) => {
-      if (st.guideline_number !== ai.guideline_number) return false;
-      const stTitle = normalizeTitle(st.title ?? "");
-      if (!aiTitle || !stTitle) return false;
-      return stTitle.includes(aiTitle) || aiTitle.includes(stTitle);
-    });
-  });
-  return { kept, droppedCount: aiFindings.length - kept.length };
-}
-var FEATURE_CAPABILITY_MAP = {
-  push_notifications: "push_notifications",
-  push_notification: "push_notifications",
-  iap: "iap",
-  in_app_purchase: "iap",
-  in_app_purchases: "iap",
-  subscription: "subscriptions",
-  subscriptions: "subscriptions",
-  ads: "ads",
-  advertising: "ads",
-  advertisements: "ads",
-  tracking: "tracking",
-  health: "health",
-  healthkit: "health",
-  location: "location",
-  location_tracking: "location",
-  camera: "camera",
-  camera_usage: "camera",
-  microphone: "microphone",
-  contacts: "contacts",
-  photos: "photos",
-  photo_library: "photos",
-  bluetooth: "bluetooth",
-  background_audio: "background_audio",
-  background_location: "background_location",
-  account_creation: "account_creation",
-  account_deletion: "account_deletion",
-  sign_in_with_apple: "sign_in_with_apple",
-  third_party_login: "third_party_login",
-  social_login: "third_party_login",
-  webview: "webview_heavy",
-  webview_heavy: "webview_heavy",
-  ugc: "ugc",
-  user_generated_content: "ugc",
-  external_payment: "external_payment",
-  external_payments: "external_payment",
-  kids_category: "kids_category",
-  ai_generated_content: "ai_generated_content",
-  gambling: "gambling",
-  crypto: "crypto",
-  cryptocurrency: "crypto"
-};
-function mapFeaturesToCapabilities(analysis) {
-  const caps = /* @__PURE__ */ new Set();
-  for (const feature of analysis.features ?? []) {
-    const key = feature.feature.toLowerCase().trim().replace(/[\s-]+/g, "_");
-    const cap = FEATURE_CAPABILITY_MAP[key];
-    if (cap) caps.add(cap);
-  }
-  if (analysis.appType === "webview-heavy" || analysis.appType === "web-wrapper") {
-    caps.add("webview_heavy");
-  }
-  return [...caps].sort();
-}
-function formatValueOrUnknown(value) {
-  if (value === null) return "unknown";
-  return value ? "yes" : "no";
-}
-function formatProfileDigest(profile) {
-  const lines = [];
-  lines.push(`- Stack: ${profile.stack_label} (platforms: ${profile.platforms.join(", ") || "unknown"})`);
-  if (profile.app.bundle_id) lines.push(`- Bundle ID: ${profile.app.bundle_id}`);
-  if (profile.sdks.length > 0) {
-    const byCategory = /* @__PURE__ */ new Map();
-    for (const sdk of profile.sdks) {
-      const names = byCategory.get(sdk.category) ?? [];
-      names.push(sdk.name);
-      byCategory.set(sdk.category, names);
-    }
-    const parts = [...byCategory.entries()].map(([category, names]) => `${category}: ${names.join(", ")}`);
-    lines.push(`- Detected SDKs: ${parts.join("; ")}`);
-  } else {
-    lines.push("- Detected SDKs: none");
-  }
-  lines.push(`- Capabilities: ${profile.capabilities.join(", ") || "none detected"}`);
-  const plist3 = profile.ios?.plist;
-  if (plist3) {
-    const usageKeys = Object.keys(plist3.usage_descriptions);
-    lines.push(`- iOS usage descriptions declared: ${usageKeys.length > 0 ? usageKeys.join(", ") : "none"}`);
-    if (plist3.background_modes.length > 0) {
-      lines.push(`- iOS background modes: ${plist3.background_modes.join(", ")}`);
-    }
-    if (plist3.ats_allows_arbitrary_loads === true) {
-      lines.push("- ATS: NSAllowsArbitraryLoads is enabled");
-    }
-  }
-  if (profile.platforms.includes("ios")) {
-    const manifest = profile.ios?.privacy_manifest;
-    lines.push(`- Privacy manifest: ${manifest?.app_manifest_present ? "present" : "not found"}`);
-  }
-  if (profile.android?.manifest_found) {
-    lines.push(`- Android permissions: ${profile.android.permissions.join(", ") || "none"}`);
-  }
-  const signals = profile.signals;
-  lines.push(
-    `- Source signals: restore purchases ${formatValueOrUnknown(signals.restore_purchases_found)}, account deletion ${formatValueOrUnknown(signals.account_deletion_found)}, privacy policy link ${formatValueOrUnknown(signals.privacy_policy_link_found)}, external checkout URL ${formatValueOrUnknown(signals.external_checkout_url_found)}`
-  );
-  return lines.join("\n");
-}
-function formatAlreadyDetected(staticFindings) {
-  if (staticFindings.length === 0) {
-    return "(none - the static rule engine found no definitive violations)";
-  }
-  return staticFindings.map((f) => `- [${f.rule_id ?? f.id}] ${f.title} (Guideline ${f.guideline_number})`).join("\n");
+function buildSummary(findings, aiResponse) {
+  const high = findings.filter((f) => f.risk_level === "high").length;
+  const medium = findings.filter((f) => f.risk_level === "medium").length;
+  const low = findings.filter((f) => f.risk_level === "low").length;
+  const info = findings.filter((f) => f.risk_level === "info").length;
+  const outcome = validateOutcome(aiResponse.estimatedOutcome);
+  let approvalChance = aiResponse.estimatedApprovalChance ?? 75;
+  if (outcome === "likely-rejected") approvalChance = Math.min(approvalChance, 30);
+  if (outcome === "likely-approved") approvalChance = Math.max(approvalChance, 70);
+  const topRisks = findings.filter((f) => f.risk_level === "high" || f.risk_level === "medium").slice(0, 3).map((f) => f.title);
+  return {
+    total_findings: findings.length,
+    high_risk: high,
+    medium_risk: medium,
+    low_risk: low,
+    info,
+    outcome,
+    estimated_approval_chance: approvalChance,
+    top_risks: topRisks,
+    ai_assessment: aiResponse.overallAssessment
+  };
 }
-async function runCodeReview(input) {
-  let profile = input.profile;
-  let checks = input.staticChecks;
-  let staticFindings = input.staticFindings;
+async function runCodeReview(provider, platform, appName, bundleId, sourceCode, sourceFilesCount, deep) {
+  const startTime = Date.now();
   let featureAnalysis = null;
-  if (input.deep) {
+  let relevantStories;
+  if (deep) {
     featureAnalysis = await detectFeatures(
-      input.provider,
-      input.platform,
-      input.appName,
-      input.bundleId,
-      input.sourceContext
+      provider,
+      platform,
+      appName,
+      bundleId,
+      sourceCode
     );
     if (featureAnalysis) {
-      const discovered = mapFeaturesToCapabilities(featureAnalysis);
-      const added = discovered.filter((cap) => !profile.capabilities.includes(cap));
-      if (added.length > 0) {
-        profile = {
-          ...profile,
-          capabilities: [...profile.capabilities, ...added].sort()
-        };
-        const rerun = evaluateRules(profile, input.bundle);
-        checks = rerun.checks;
-        staticFindings = rerun.findings;
-      }
+      relevantStories = searchStories(featureAnalysis.features, 20);
+    } else {
+      relevantStories = loadAllStories().slice(0, 15);
     }
+  } else {
+    relevantStories = loadAllStories().slice(0, 15);
   }
-  const profileSignals = [
-    ...profile.sdks.map((sdk) => sdk.id),
-    ...profile.capabilities
-  ];
-  const signals = featureAnalysis ? [...featureAnalysis.features, ...profileSignals] : profileSignals;
-  const relevantStories = searchStories(input.bundle.stories, signals, input.deep ? 20 : 15);
   const storiesText = formatStoriesForPrompt(relevantStories);
   const featureSection = featureAnalysis ? `## App Analysis (from feature discovery)
 
@@ -6177,136 +4162,60 @@ async function runCodeReview(input) {
 ${featureAnalysis.features.map((f) => `- ${f.feature}: ${f.description} (confidence: ${f.confidence})`).join("\n")}
 
 **Risk Areas:**
-${featureAnalysis.riskAreas.map((r) => `- ${r}`).join("\n")}
-
-` : "";
+${featureAnalysis.riskAreas.map((r) => `- ${r}`).join("\n")}` : "";
   const userPrompt = `## App Information
-- Platform: ${input.platform}
-- App Name: ${input.appName}
-- Bundle ID: ${input.bundleId}
-
-## App Profile (from static analysis)
-${formatProfileDigest(profile)}
-
-## Already Detected By Static Analysis (do not repeat)
-These violations are already confirmed and included in the report. Do NOT re-report them:
+- Platform: ${platform}
+- App Name: ${appName}
+- Bundle ID: ${bundleId}
 
-${formatAlreadyDetected(staticFindings)}
+${featureSection}
 
-${featureSection}## Real Rejection Cases (from other developers)
+## Real Rejection Cases (from other developers)
 These are REAL cases where Apple rejected similar apps. Use them to calibrate:
 
 ${storiesText}
 
-## Source Code Context
+## Source Code
 
-${input.sourceContext}
+${sourceCode}
 
-Now review this app as an Apple reviewer testing it on a device. Focus on behavioral issues that static analysis cannot detect. What would you flag?`;
+Now review this app as an Apple reviewer testing it on a device. What would you flag?`;
   const systemPrompt = getReviewerSimulationPrompt();
-  const response = await input.provider.generateJSON(systemPrompt, userPrompt, 0.2);
+  const response = await provider.generateJSON(systemPrompt, userPrompt, 0.2);
   const parsed = parseAIResponse(response);
-  const featuresDetected = featureAnalysis?.features.map((f) => f.feature) ?? [];
   if (!parsed) {
     return {
-      aiFindings: [],
-      aiAssessment: "AI analysis could not produce structured results.",
-      featuresDetected,
-      ragStoriesUsed: relevantStories.length,
-      dedupedCount: 0,
-      profile,
-      checks,
-      staticFindings
+      features_detected: featureAnalysis?.features.map((f) => f.feature) ?? [],
+      source_files_analyzed: sourceFilesCount,
+      platform,
+      bundle_id: bundleId || null,
+      findings: [],
+      summary: {
+        total_findings: 0,
+        high_risk: 0,
+        medium_risk: 0,
+        low_risk: 0,
+        info: 0,
+        outcome: "needs-attention",
+        estimated_approval_chance: 50,
+        top_risks: [],
+        ai_assessment: "AI analysis could not produce structured results."
+      },
+      rag_stories_used: relevantStories.length,
+      scan_duration_ms: Date.now() - startTime
     };
   }
-  const converted = convertFindings(parsed);
-  const { kept, droppedCount } = dedupeAIFindings(converted, staticFindings);
-  return {
-    aiFindings: kept,
-    aiAssessment: parsed.overallAssessment || "AI review completed.",
-    featuresDetected,
-    ragStoriesUsed: relevantStories.length,
-    dedupedCount: droppedCount,
-    profile,
-    checks,
-    staticFindings
-  };
-}
-
-// src/review/report-builder.ts
-var SEVERITY_ORDER2 = {
-  high: 0,
-  medium: 1,
-  low: 2,
-  info: 3
-};
-function buildDeterministicSummary(findings, opts) {
-  const high = findings.filter((f) => f.risk_level === "high").length;
-  const medium = findings.filter((f) => f.risk_level === "medium").length;
-  const low = findings.filter((f) => f.risk_level === "low").length;
-  const info = findings.filter((f) => f.risk_level === "info").length;
-  const rawChance = 85 - 20 * high - 5 * medium - 1 * low;
-  const estimatedApprovalChance = Math.min(95, Math.max(5, rawChance));
-  let outcome;
-  if (high >= 2) {
-    outcome = "likely-rejected";
-  } else if (high >= 1 || medium >= 3) {
-    outcome = "needs-attention";
-  } else {
-    outcome = "likely-approved";
-  }
-  const topRisks = [...findings].sort((a, b) => SEVERITY_ORDER2[a.risk_level] - SEVERITY_ORDER2[b.risk_level]).slice(0, 3).map((f) => f.title);
-  let aiAssessment;
-  if (opts.aiReviewRan && opts.aiAssessment) {
-    aiAssessment = opts.aiAssessment;
-  } else {
-    const violations = findings.length === 1 ? "violation" : "violations";
-    aiAssessment = `Static rule scan found ${findings.length} guideline ${violations} across ${opts.checksCount ?? 0} checks. AI behavioral review was not run.`;
-  }
-  return {
-    total_findings: findings.length,
-    high_risk: high,
-    medium_risk: medium,
-    low_risk: low,
-    info,
-    outcome,
-    estimated_approval_chance: estimatedApprovalChance,
-    top_risks: topRisks,
-    ai_assessment: aiAssessment
-  };
-}
-var RAW_DEPS_CAP = 50;
-function trimProfileForReport(profile) {
-  const raw = profile.raw_dependencies;
-  const trimmed = Object.fromEntries(
-    Object.entries(raw).map(([bucket, entries]) => [bucket, entries.slice(0, RAW_DEPS_CAP)])
-  );
-  return { ...profile, raw_dependencies: trimmed };
-}
-function assembleReportV2(input) {
-  const findings = [...input.staticFindings, ...input.aiFindings];
-  const summary = buildDeterministicSummary(findings, {
-    aiReviewRan: input.aiReviewRan,
-    aiAssessment: input.aiAssessment,
-    checksCount: input.checks.length
-  });
+  const findings = convertFindings(parsed);
+  const summary = buildSummary(findings, parsed);
   return {
-    features_detected: input.featuresDetected,
-    source_files_analyzed: input.sourceFilesAnalyzed,
-    platform: input.platform,
-    bundle_id: input.bundleId,
+    features_detected: featureAnalysis?.features.map((f) => f.feature) ?? [],
+    source_files_analyzed: sourceFilesCount,
+    platform,
+    bundle_id: bundleId || null,
     findings,
     summary,
-    rag_stories_used: input.ragStoriesUsed,
-    scan_duration_ms: input.scanDurationMs,
-    report_schema_version: 2,
-    engine_version: input.engineVersion,
-    rulepack_version: input.rulepack.version,
-    rulepack_store: input.rulepack.store,
-    rulepack_source: input.rulepack.source,
-    app_profile: trimProfileForReport(input.profile),
-    checks: input.checks,
-    ai_review_ran: input.aiReviewRan
+    rag_stories_used: relevantStories.length,
+    scan_duration_ms: Date.now() - startTime
   };
 }
 
@@ -6330,7 +4239,6 @@ var RISK_COLORS = {
   low: chalk2.blue,
   info: chalk2.gray
 };
-var STATIC_ONLY_BANNER = "AI behavioral review skipped. Static rule results only.";
 function outcomeDisplay(outcome) {
   switch (outcome) {
     case "likely-approved":
@@ -6353,30 +4261,6 @@ function approvalBar(chance) {
   else color = chalk2.red;
   return color("\u2588".repeat(filled)) + chalk2.gray("\u2591".repeat(empty)) + ` ${chance}%`;
 }
-function groupChecks(checks) {
-  return {
-    failed: checks.filter((c) => c.status === "fail"),
-    unverified: checks.filter((c) => c.status === "unverified"),
-    passed: checks.filter((c) => c.status === "pass"),
-    na: checks.filter((c) => c.status === "na")
-  };
-}
-function detectionBadge(finding) {
-  if (finding.detection === "static") return chalk2.dim("[static]") + " ";
-  if (finding.detection === "ai") return chalk2.cyan("[AI]") + " ";
-  return "";
-}
-function versionFooter(report) {
-  const parts = [];
-  if (report.rulepack_version) {
-    const source = report.rulepack_source ? ` (${report.rulepack_source})` : "";
-    parts.push(`Rulepack v${report.rulepack_version}${source}`);
-  }
-  if (report.engine_version) {
-    parts.push(`Engine v${report.engine_version}`);
-  }
-  return parts.length > 0 ? parts.join(" \xB7 ") : null;
-}
 function formatTerminal(report) {
   const lines = [];
   lines.push("");
@@ -6400,9 +4284,7 @@ function formatTerminal(report) {
     report.summary.low_risk > 0 && chalk2.blue(`${report.summary.low_risk} low`),
     report.summary.info > 0 && chalk2.gray(`${report.summary.info} info`)
   ].filter(Boolean);
-  lines.push(
-    `  Findings:    ${chalk2.bold(String(report.summary.total_findings))} total` + (counts.length > 0 ? ` (${counts.join(" \xB7 ")})` : "")
-  );
+  lines.push(`  Findings:    ${chalk2.bold(String(report.summary.total_findings))} total \u2014 ${counts.join(" \xB7 ")}`);
   lines.push("");
   if (report.features_detected.length > 0) {
     lines.push(`  Features:    ${chalk2.gray(report.features_detected.join(", "))}`);
@@ -6414,29 +4296,6 @@ function formatTerminal(report) {
     lines.push(chalk2.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
     lines.push("");
   }
-  if (report.checks && report.checks.length > 0) {
-    const groups = groupChecks(report.checks);
-    lines.push(chalk2.bold("  COMPLIANCE CHECKS"));
-    lines.push(
-      `  ${chalk2.red(`${groups.failed.length} failed`)}, ${chalk2.yellow(`${groups.unverified.length} verify manually`)}, ${chalk2.green(`${groups.passed.length} passed`)}, ${chalk2.gray(`${groups.na.length} not applicable`)}`
-    );
-    lines.push("");
-    for (const check of groups.failed) {
-      lines.push(`  ${chalk2.red(`\u2717 [${check.guideline_number}] ${check.title}`)}`);
-    }
-    for (const check of groups.unverified) {
-      lines.push(`  ${chalk2.yellow(`VERIFY: [${check.guideline_number}] ${check.title}`)}`);
-    }
-    if (groups.passed.length > 0) {
-      const noun = groups.passed.length === 1 ? "check" : "checks";
-      lines.push(
-        chalk2.gray(
-          `  ${groups.passed.length} ${noun} passed (run with --format json for the full list)`
-        )
-      );
-    }
-    lines.push("");
-  }
   const findingsByRisk = {
     high: [],
     medium: [],
@@ -6454,10 +4313,10 @@ function formatTerminal(report) {
       const label = RISK_LABELS[level];
       const color = RISK_COLORS[level];
       lines.push(chalk2.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-      lines.push(`  ${icon} ${color(label)}  Guideline ${finding.guideline_number} - ${finding.guideline_name}`);
+      lines.push(`  ${icon} ${color(label)}  Guideline ${finding.guideline_number} \u2014 ${finding.guideline_name}`);
       lines.push(chalk2.gray("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
       lines.push("");
-      lines.push(`  ${detectionBadge(finding)}${chalk2.bold(finding.title)}`);
+      lines.push(`  ${chalk2.bold(finding.title)}`);
       lines.push(`  ${finding.description}`);
       lines.push("");
       lines.push(`  ${chalk2.cyan("User Impact:")} ${finding.user_impact}`);
@@ -6476,14 +4335,7 @@ function formatTerminal(report) {
     lines.push("");
   }
   lines.push(chalk2.gray("  \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550"));
-  if (report.ai_review_ran === false) {
-    lines.push(chalk2.yellow(`  ${STATIC_ONLY_BANNER}`));
-  }
-  const footer = versionFooter(report);
-  if (footer) {
-    lines.push(chalk2.gray(`  ${footer}`));
-  }
-  lines.push(chalk2.gray("  Powered by Forvibe CLI (forvibe.app)"));
+  lines.push(chalk2.gray("  Powered by Forvibe CLI \u2014 forvibe.app"));
   lines.push("");
   return lines.join("\n");
 }
@@ -6502,10 +4354,6 @@ function formatMarkdown(report) {
   lines.push(`**Rejection Cases Referenced:** ${report.rag_stories_used}`);
   lines.push(`**Scan Duration:** ${(report.scan_duration_ms / 1e3).toFixed(1)}s`);
   lines.push("");
-  if (report.ai_review_ran === false) {
-    lines.push(`> ${STATIC_ONLY_BANNER}`);
-    lines.push("");
-  }
   lines.push("## Result");
   lines.push("");
   lines.push(`**Outcome:** ${report.summary.outcome.replace(/-/g, " ").toUpperCase()}`);
@@ -6523,26 +4371,6 @@ function formatMarkdown(report) {
     lines.push(`> ${report.summary.ai_assessment}`);
     lines.push("");
   }
-  if (report.checks && report.checks.length > 0) {
-    const groups = groupChecks(report.checks);
-    lines.push("## Compliance Checks");
-    lines.push("");
-    lines.push(
-      `${groups.failed.length} failed, ${groups.unverified.length} verify manually, ${groups.passed.length} passed, ${groups.na.length} not applicable`
-    );
-    lines.push("");
-    for (const check of groups.failed) {
-      lines.push(`- FAILED: [${check.guideline_number}] ${check.title}`);
-    }
-    for (const check of groups.unverified) {
-      lines.push(`- VERIFY: [${check.guideline_number}] ${check.title}`);
-    }
-    if (groups.passed.length > 0) {
-      const noun = groups.passed.length === 1 ? "check" : "checks";
-      lines.push(`- ${groups.passed.length} ${noun} passed (run with \`--format json\` for the full list)`);
-    }
-    lines.push("");
-  }
   if (report.features_detected.length > 0) {
     lines.push("## Detected Features");
     lines.push("");
@@ -6556,15 +4384,13 @@ function formatMarkdown(report) {
   if (report.findings.length === 0) {
     lines.push("No significant issues found. Your app looks ready for review!");
     lines.push("");
-    appendMarkdownFooter(lines, report);
     return lines.join("\n");
   }
   for (const finding of report.findings) {
     const riskEmoji = RISK_ICONS[finding.risk_level];
-    const badge = finding.detection === "static" ? "[static] " : finding.detection === "ai" ? "[AI] " : "";
-    lines.push(`### ${riskEmoji} ${badge}${finding.title}`);
+    lines.push(`### ${riskEmoji} ${finding.title}`);
     lines.push("");
-    lines.push(`**Guideline:** ${finding.guideline_number} - ${finding.guideline_name}`);
+    lines.push(`**Guideline:** ${finding.guideline_number} \u2014 ${finding.guideline_name}`);
     lines.push(`**Risk Level:** ${finding.risk_level}`);
     lines.push(`**Category:** ${finding.category}`);
     lines.push("");
@@ -6581,36 +4407,12 @@ function formatMarkdown(report) {
     lines.push("---");
     lines.push("");
   }
-  appendMarkdownFooter(lines, report);
-  return lines.join("\n");
-}
-function appendMarkdownFooter(lines, report) {
-  const footer = versionFooter(report);
-  if (footer) {
-    lines.push(`*${footer}*`);
-    lines.push("");
-  }
-  lines.push("*Powered by Forvibe CLI (forvibe.app)*");
+  lines.push("*Powered by Forvibe CLI \u2014 forvibe.app*");
   lines.push("");
-}
-
-// src/utils/version.ts
-import { createRequire } from "module";
-var FALLBACK_VERSION = "0.0.0";
-function getCliVersion() {
-  const require2 = createRequire(import.meta.url);
-  for (const candidate of ["../package.json", "../../package.json"]) {
-    try {
-      const pkg = require2(candidate);
-      if (pkg?.version && pkg.name === "@forvibe/cli") return pkg.version;
-    } catch {
-    }
-  }
-  return FALLBACK_VERSION;
+  return lines.join("\n");
 }
 
 // src/commands/review.ts
-var DEFAULT_RULEPACK_BASE_URL = "https://forvibe.app";
 function askQuestion2(question) {
   const rl = createInterface2({
     input: process.stdin,
@@ -6626,14 +4428,55 @@ function askQuestion2(question) {
 async function reviewCommand(options) {
   const rootDir = options.dir || process.cwd();
   const deep = options.deep ?? false;
-  const staticOnly = options.staticOnly ?? false;
   const format = options.format || "terminal";
-  const startTime = Date.now();
   console.log();
   console.log(
-    chalk3.bold("  Forvibe CLI") + chalk3.gray(" - App Store Review Simulation") + (deep ? chalk3.cyan(" [DEEP MODE]") : "") + (staticOnly ? chalk3.cyan(" [STATIC ONLY]") : "")
+    chalk3.bold("  Forvibe CLI") + chalk3.gray(" \u2014 App Store Review Simulation") + (deep ? chalk3.cyan(" [DEEP MODE]") : "")
   );
   console.log();
+  const availableProviders = getAvailableProviders(deep);
+  if (availableProviders.length === 0) {
+    console.log(chalk3.red("  \u2717 No AI API key found. Set one of the following:\n"));
+    console.log(
+      chalk3.cyan("    export ANTHROPIC_API_KEY=your-key") + chalk3.gray("   https://console.anthropic.com/settings/keys") + chalk3.green(" (recommended)")
+    );
+    console.log(
+      chalk3.cyan("    export OPENAI_API_KEY=your-key") + chalk3.gray("      https://platform.openai.com/api-keys")
+    );
+    console.log(
+      chalk3.cyan("    export GEMINI_API_KEY=your-key") + chalk3.gray("       https://aistudio.google.com/apikey")
+    );
+    console.log();
+    console.log(
+      chalk3.gray("  Your source code is analyzed locally \u2014 it never leaves your machine.\n")
+    );
+    process.exit(1);
+  }
+  let provider;
+  if (availableProviders.length === 1) {
+    provider = availableProviders[0].create();
+  } else {
+    console.log(chalk3.white("  Multiple AI API keys detected. Choose a provider:\n"));
+    availableProviders.forEach((p, i) => {
+      const label = `${i + 1}. ${p.name}${p.recommended ? chalk3.green(" (recommended)") : ""}`;
+      console.log(`    ${label}`);
+    });
+    console.log();
+    const answer = await askQuestion2(
+      chalk3.cyan(`  Enter choice (1-${availableProviders.length}): `)
+    );
+    const index = parseInt(answer, 10) - 1;
+    if (isNaN(index) || index < 0 || index >= availableProviders.length) {
+      const recommended = availableProviders.find((p) => p.recommended) || availableProviders[0];
+      provider = recommended.create();
+      console.log(chalk3.gray(`  Using ${recommended.name} (default)
+`));
+    } else {
+      provider = availableProviders[index].create();
+    }
+  }
+  console.log(chalk3.gray(`  AI Provider: ${provider.name} \u2713`));
+  console.log();
   const techSpinner = ora2({
     text: "Detecting tech stack...",
     prefixText: "  "
@@ -6642,7 +4485,7 @@ async function reviewCommand(options) {
   if (techStack.stack === "unknown") {
     techSpinner.fail(
       chalk3.red(
-        "No supported project found. Supported: Swift, Objective-C, Flutter, React Native, Kotlin, Kotlin Multiplatform, Capacitor, .NET MAUI, Unity"
+        "No supported project found. Supported: Swift, Flutter, React Native, Kotlin, Capacitor, .NET MAUI"
       )
     );
     process.exit(1);
@@ -6660,199 +4503,59 @@ async function reviewCommand(options) {
   configSpinner.succeed(
     `Config: ${chalk3.white(appName)} ${bundleId ? chalk3.gray(`(${bundleId})`) : ""}`
   );
-  const rulepackSpinner = ora2({
-    text: "Loading review rulepack...",
+  const sdkSpinner = ora2({
+    text: "Scanning dependencies...",
     prefixText: "  "
   }).start();
-  const rulepackBaseUrl = options.rulepackUrl || options.apiUrl || DEFAULT_RULEPACK_BASE_URL;
-  let loadedRulepack;
-  try {
-    loadedRulepack = await loadRulepackBundle({ baseUrl: rulepackBaseUrl });
-  } catch (error) {
-    rulepackSpinner.fail(
-      chalk3.red(error instanceof Error ? error.message : "Failed to load rulepack")
-    );
-    process.exit(1);
-  }
-  const { bundle } = loadedRulepack;
-  rulepackSpinner.succeed(
-    `Rulepack ${chalk3.bold(`v${loadedRulepack.version}`)} ${chalk3.gray(`(${loadedRulepack.source})`)}`
+  const sdkScan = scanSDKs(rootDir, techStack.stack);
+  sdkSpinner.succeed(
+    `Dependencies: ${chalk3.bold(String(sdkScan.detected_sdks.length))} known SDKs detected`
   );
   const sourceSpinner = ora2({
     text: "Reading source code...",
     prefixText: "  "
   }).start();
   const maxChars = deep ? 4e5 : 15e4;
-  const sourceFiles = readSourceFiles(rootDir, techStack.stack, maxChars);
-  const sourceCode = joinSourceFiles(sourceFiles);
+  const sourceCode = readSourceCode(rootDir, techStack.stack, maxChars);
   const projectTree = generateProjectTree(rootDir);
   const sourceLines = sourceCode.split("\n").length;
   sourceSpinner.succeed(
-    `Source code: ${chalk3.bold(String(sourceLines))} lines in ${chalk3.bold(String(sourceFiles.length))} files`
+    `Source code: ${chalk3.bold(String(sourceLines))} lines analyzed`
   );
-  const staticSpinner = ora2({
-    text: "Running static rule engine...",
+  console.log();
+  const reviewSpinner = ora2({
+    text: deep ? `Running deep review with ${provider.name} (Pass 1: feature detection, Pass 2: Apple reviewer simulation)...` : `Running review with ${provider.name} (simulating Apple's review process)...`,
     prefixText: "  "
   }).start();
-  const staticResult = runStaticEngine({
-    rootDir,
-    stackResult: techStack,
-    appConfig: {
-      app_name: config.app_name,
-      bundle_id: config.bundle_id,
-      version: config.version,
-      min_ios_version: config.min_ios_version,
-      min_android_sdk: config.min_android_sdk
-    },
-    bundle,
-    sourceFiles
-  });
-  const checkCount = (status) => staticResult.checks.filter((c) => c.status === status).length;
-  staticSpinner.succeed(
-    `Static scan: ${chalk3.red(`${checkCount("fail")} failed`)}, ${chalk3.yellow(`${checkCount("unverified")} unverified`)}, ${chalk3.green(`${checkCount("pass")} passed`)}, ${chalk3.gray(`${checkCount("na")} n/a`)}`
-  );
-  let provider = null;
-  if (!staticOnly) {
-    const availableProviders = getAvailableProviders(deep);
-    if (availableProviders.length === 0) {
-      console.log();
-      console.log(
-        chalk3.yellow(
-          "  No AI API key found. AI behavioral review skipped. Static rule results below."
-        )
-      );
-      console.log(chalk3.gray("  To enable the AI review pass, set one of the following:"));
-      console.log(
-        chalk3.cyan("    export ANTHROPIC_API_KEY=your-key") + chalk3.gray("   https://console.anthropic.com/settings/keys") + chalk3.green(" (recommended)")
-      );
-      console.log(
-        chalk3.cyan("    export OPENAI_API_KEY=your-key") + chalk3.gray("      https://platform.openai.com/api-keys")
-      );
-      console.log(
-        chalk3.cyan("    export GEMINI_API_KEY=your-key") + chalk3.gray("       https://aistudio.google.com/apikey")
-      );
-      console.log();
-    } else if (availableProviders.length === 1) {
-      provider = availableProviders[0].create();
-    } else {
-      console.log();
-      console.log(chalk3.white("  Multiple AI API keys detected. Choose a provider:\n"));
-      availableProviders.forEach((p, i) => {
-        const label = `${i + 1}. ${p.name}${p.recommended ? chalk3.green(" (recommended)") : ""}`;
-        console.log(`    ${label}`);
-      });
-      console.log();
-      const answer = await askQuestion2(
-        chalk3.cyan(`  Enter choice (1-${availableProviders.length}): `)
-      );
-      const index = parseInt(answer, 10) - 1;
-      if (isNaN(index) || index < 0 || index >= availableProviders.length) {
-        const recommended = availableProviders.find((p) => p.recommended) || availableProviders[0];
-        provider = recommended.create();
-        console.log(chalk3.gray(`  Using ${recommended.name} (default)
-`));
-      } else {
-        provider = availableProviders[index].create();
-      }
-    }
-    if (provider) {
-      console.log(chalk3.gray(`  AI Provider: ${provider.name} \u2713`));
-      console.log();
-    }
-  }
   let report;
-  if (!provider) {
-    report = assembleReportV2({
-      platform: techStack.label,
-      bundleId: config.bundle_id,
-      sourceFilesAnalyzed: sourceFiles.length,
-      featuresDetected: [],
-      staticFindings: staticResult.findings,
-      aiFindings: [],
-      checks: staticResult.checks,
-      profile: staticResult.profile,
-      rulepack: {
-        version: loadedRulepack.version,
-        store: bundle.store,
-        source: loadedRulepack.source
-      },
-      engineVersion: getCliVersion(),
-      aiReviewRan: false,
-      ragStoriesUsed: 0,
-      scanDurationMs: Date.now() - startTime
-    });
-  } else {
+  try {
     const enrichedSource = buildEnrichedContext(
       sourceCode,
       projectTree,
-      staticResult.profile.sdks
+      sdkScan,
+      config
     );
-    const { text: redactedSource, redactedCount } = redactSecrets(enrichedSource);
-    if (redactedCount > 0) {
-      console.log(
-        chalk3.yellow(
-          `  Redacted ${redactedCount} secret-like values before sending source to the AI provider.`
-        )
-      );
-      console.log();
-    }
-    const reviewSpinner = ora2({
-      text: deep ? `Running deep review with ${provider.name} (Pass 1: feature detection, Pass 2: Apple reviewer simulation)...` : `Running review with ${provider.name} (simulating Apple's review process)...`,
-      prefixText: "  "
-    }).start();
-    try {
-      const aiResult = await runCodeReview({
-        provider,
-        platform: techStack.label,
-        appName,
-        bundleId,
-        sourceContext: redactedSource,
-        deep,
-        profile: staticResult.profile,
-        staticChecks: staticResult.checks,
-        staticFindings: staticResult.findings,
-        bundle
-      });
-      report = assembleReportV2({
-        platform: techStack.label,
-        bundleId: config.bundle_id,
-        sourceFilesAnalyzed: sourceFiles.length,
-        featuresDetected: aiResult.featuresDetected,
-        staticFindings: aiResult.staticFindings,
-        aiFindings: aiResult.aiFindings,
-        checks: aiResult.checks,
-        profile: aiResult.profile,
-        rulepack: {
-          version: loadedRulepack.version,
-          store: bundle.store,
-          source: loadedRulepack.source
-        },
-        engineVersion: getCliVersion(),
-        aiReviewRan: true,
-        aiAssessment: aiResult.aiAssessment,
-        ragStoriesUsed: aiResult.ragStoriesUsed,
-        scanDurationMs: Date.now() - startTime
-      });
-      reviewSpinner.succeed(
-        chalk3.green(
-          `Review complete! ${report.summary.total_findings} findings (${report.summary.high_risk} high risk)`
-        )
-      );
-      if (aiResult.dedupedCount > 0) {
-        console.log(
-          chalk3.gray(
-            `  Deduplicated ${aiResult.dedupedCount} findings already covered by static analysis.`
-          )
-        );
-      }
-    } catch (error) {
-      reviewSpinner.fail(
-        chalk3.red(
-          `Review failed: ${error instanceof Error ? error.message : "Unknown error"}`
-        )
-      );
-      process.exit(1);
-    }
+    report = await runCodeReview(
+      provider,
+      techStack.label,
+      appName,
+      bundleId,
+      enrichedSource,
+      sourceLines,
+      deep
+    );
+    reviewSpinner.succeed(
+      chalk3.green(
+        `Review complete! ${report.summary.total_findings} findings (${report.summary.high_risk} high risk)`
+      )
+    );
+  } catch (error) {
+    reviewSpinner.fail(
+      chalk3.red(
+        `Review failed: ${error instanceof Error ? error.message : "Unknown error"}`
+      )
+    );
+    process.exit(1);
   }
   switch (format) {
     case "json":
@@ -6917,16 +4620,14 @@ async function reviewCommand(options) {
     }
   }
 }
-function buildEnrichedContext(sourceCode, projectTree, sdks) {
+function buildEnrichedContext(sourceCode, projectTree, sdkScan, config) {
   const sections = [];
   sections.push(`## Project Structure
 \`\`\`
 ${projectTree}
 \`\`\``);
-  if (sdks.length > 0) {
-    const sdkList = sdks.map(
-      (sdk) => `- ${sdk.name} (${sdk.category})${sdk.data_collection.length > 0 ? `, collects: ${sdk.data_collection.join(", ")}` : ""}`
-    ).join("\n");
+  if (sdkScan.detected_sdks.length > 0) {
+    const sdkList = sdkScan.detected_sdks.map((sdk) => `- ${sdk.name} (${sdk.category})${sdk.collects.length > 0 ? ` \u2014 collects: ${sdk.collects.join(", ")}` : ""}`).join("\n");
     sections.push(`## Detected SDKs
 ${sdkList}`);
   }
@@ -6938,7 +4639,7 @@ ${sourceCode}`);
 
 // src/index.ts
 var program = new Command();
-program.name("forvibe").description("Forvibe CLI - AI-powered App Store automation").version(getCliVersion());
+program.name("forvibe").description("Forvibe CLI \u2014 AI-powered App Store automation").version("0.1.0");
 program.command("analyze", { isDefault: true }).description(
   "Analyze your project and send the report to Forvibe for automated App Store setup"
 ).option("-d, --dir <path>", "Project directory to analyze", process.cwd()).option(
@@ -6948,13 +4649,9 @@ program.command("analyze", { isDefault: true }).description(
 ).action(analyzeCommand);
 program.command("review").description(
   "Simulate Apple's App Store review process on your project"
-).option("-d, --dir <path>", "Project directory to review", process.cwd()).option("--deep", "Enable deep 2-pass review (feature detection + reviewer simulation)").option("--format <type>", "Output format: terminal, json, markdown", "terminal").option("--static-only", "Run only the static rule engine, skipping the AI behavioral review (no API key needed)").option("--send", "Send results to Forvibe for combined review with metadata analysis").option(
+).option("-d, --dir <path>", "Project directory to review", process.cwd()).option("--deep", "Enable deep 2-pass review (feature detection + reviewer simulation)").option("--format <type>", "Output format: terminal, json, markdown", "terminal").option("--send", "Send results to Forvibe for combined review with metadata analysis").option(
   "--api-url <url>",
   "Forvibe API URL (for development)",
   void 0
-).option(
-  "--rulepack-url <url>",
-  "Base URL to fetch the review rulepack from (defaults to the Forvibe API URL)",
-  void 0
 ).action(reviewCommand);
 program.parse();