@lbroth/rothunter 1.0.0-rc.1

package/dist/detectors/long-function.js

@@ -0,0 +1,45 @@
+import { stableHash } from '../utils/hash.js';
+// Flag function symbols over 60 (low) / 120 (med) / 200 (high) lines.
+// Test bodies (describe/it/test/suite) skipped.
+export function detectLongFunctions(input) {
+    const low = input.lowThreshold ?? 60;
+    const med = input.medThreshold ?? 120;
+    const high = input.highThreshold ?? 200;
+    const findings = [];
+    for (const sym of input.symbols) {
+        if (sym.kind !== 'function')
+            continue;
+        if (isTestHarnessName(sym.name))
+            continue;
+        const lines = sym.range.endLine - sym.range.startLine + 1;
+        if (lines < low)
+            continue;
+        const severity = lines >= high ? 'high' : lines >= med ? 'medium' : 'low';
+        findings.push({
+            detectorId: 'long-function',
+            severity,
+            confidence: 0.98,
+            layer: 1,
+            title: `Long function: \`${sym.name}\` (${lines} lines) in ${sym.file}`,
+            description: `\`${sym.name}\` spans ${lines} lines (${sym.range.startLine}–${sym.range.endLine}). Functions this long are hard to test, hard to reason about, and accumulate branching that begs to be flattened (polymorphism, lookup tables, early returns).`,
+            evidence: [
+                {
+                    file: sym.file,
+                    range: { startLine: sym.range.startLine, endLine: sym.range.endLine },
+                    snippet: firstLines(sym.source, 4),
+                },
+            ],
+            suggestion: 'Extract one cohesive chunk at a time into a well-named helper. If branching dominates, replace the switch/if chain with a dispatch table keyed by the discriminator.',
+            fingerprint: `long-function:${stableHash(`${sym.file}:${sym.name}:${sym.range.startLine}`)}`,
+        });
+    }
+    return findings;
+}
+const TEST_HARNESS_NAMES = new Set(['describe', 'it', 'test', 'suite', 'context']);
+function isTestHarnessName(name) {
+    return TEST_HARNESS_NAMES.has(name);
+}
+function firstLines(source, n) {
+    return source.split('\n').slice(0, n).join('\n');
+}
+//# sourceMappingURL=long-function.js.map

package/dist/detectors/long-function.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"long-function.js","sourceRoot":"","sources":["../../src/detectors/long-function.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAY9C,sEAAsE;AACtE,gDAAgD;AAChD,MAAM,UAAU,mBAAmB,CAAC,KAAgC;IAClE,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,GAAG,CAAC;IACtC,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,IAAI,GAAG,CAAC;IACxC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU;YAAE,SAAS;QACtC,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QAC1D,IAAI,KAAK,GAAG,GAAG;YAAE,SAAS;QAC1B,MAAM,QAAQ,GAA8B,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;QACrG,QAAQ,CAAC,IAAI,CAAC;YACZ,UAAU,EAAE,eAAe;YAC3B,QAAQ;YACR,UAAU,EAAE,IAAI;YAChB,KAAK,EAAE,CAAC;YACR,KAAK,EAAE,oBAAoB,GAAG,CAAC,IAAI,OAAO,KAAK,cAAc,GAAG,CAAC,IAAI,EAAE;YACvE,WAAW,EACT,KAAK,GAAG,CAAC,IAAI,YAAY,KAAK,WAAW,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,iKAAiK;YACpP,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE;oBACrE,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;iBACnC;aACF;YACD,UAAU,EACR,sKAAsK;YACxK,WAAW,EAAE,iBAAiB,UAAU,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE;SAC7F,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAEnF,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,MAAc,EAAE,CAAS;IAC3C,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC"}

package/dist/detectors/magic-numbers.d.ts

@@ -0,0 +1,10 @@
+import type { Finding } from '../types.js';
+import type { FileWalkingDetectorInput } from '../types/detector-input.js';
+export interface MagicNumbersDetectorInput extends FileWalkingDetectorInput {
+    /** Numbers considered "obvious" and not magic. Default `{0, 1, -1, 2, 10, 100, 1000}`. */
+    whitelist?: ReadonlySet<number>;
+    /** Per-file finding cap so a single noisy file doesn't dominate the report. Default 5. */
+    perFileCap?: number;
+}
+export declare function detectMagicNumbers(input: MagicNumbersDetectorInput): Finding[];
+//# sourceMappingURL=magic-numbers.d.ts.map

package/dist/detectors/magic-numbers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"magic-numbers.d.ts","sourceRoot":"","sources":["../../src/detectors/magic-numbers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAI3C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAE3E,MAAM,WAAW,yBAA0B,SAAQ,wBAAwB;IAC3E,0FAA0F;IACxF,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAChC,0FAA0F;IAC1F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,EAAE,CAY9E"}

package/dist/detectors/magic-numbers.js

@@ -0,0 +1,332 @@
+import { makeSourceReader } from '../utils/source-reader.js';
+import { stableHash } from '../utils/hash.js';
+import { hasIgnoreAnnotation } from '../utils/ignore-annotation.js';
+// Numeric literals outside the whitelist {0,1,-1,2,10,100,1000}. Skip
+// array indices, for-loop bounds, named-const declarations. LOW, per-file cap.
+export function detectMagicNumbers(input) {
+    const whitelist = input.whitelist ?? DEFAULT_WHITELIST;
+    const cap = input.perFileCap ?? 5;
+    const read = makeSourceReader(input.workspaceRoot, input.project);
+    const findings = [];
+    for (const rel of input.files) {
+        if (!isAnalysable(rel))
+            continue;
+        const raw = read(rel);
+        if (raw == null)
+            continue;
+        findings.push(...analyseFile(rel, raw, whitelist, cap));
+    }
+    return findings;
+}
+// Default whitelist. Includes the obvious math constants (0/1/-1/2),
+// common round numbers (10/100/1000), AND bit-width / byte-size
+// constants (8/16/24/32/64/128/256). Encoder/decoder code (base64,
+// chunking, hashing, network parsing) is otherwise flooded with FPs:
+// `Math.floor(byteLength / 9 * 8)` and friends are domain math, not
+// magic numbers. Add 512/1024/4096 too — they're page/buffer sizes
+// every reader recognises at a glance.
+const DEFAULT_WHITELIST = new Set([
+    0, 1, -1, 2,
+    10, 100, 1000,
+    8, 16, 24, 32, 64, 128, 256, 512, 1024, 4096,
+]);
+// Match positive integer literals (we treat negatives via the previous char).
+const NUM_RE = /\b(\d+(?:\.\d+)?)\b/g;
+function analyseFile(file, raw, whitelist, cap) {
+    const out = [];
+    // Pre-strip strings + comments AND regex literals so literals inside
+    // them aren't flagged. Regex masking matters a lot: `[A-Za-z0-9]` flags
+    // 9, `\d{15}` flags 15, `\d{1,3}` flags 3, etc. Those are charset/
+    // quantifier internals, not magic numbers.
+    const masked = maskStringsAndComments(raw);
+    for (const m of masked.matchAll(NUM_RE)) {
+        if (out.length >= cap)
+            break;
+        const positive = parseFloat(m[1]);
+        const before = masked.slice(Math.max(0, m.index - 30), m.index);
+        const after = masked.slice(m.index + m[0].length, m.index + m[0].length + 30);
+        // Distinguish UNARY minus (`-3`, `[-3]`, `f(-3)`, `return -3`) from
+        // BINARY subtraction (`x - 3`). Unary triggers when the char before
+        // the `-` is start-of-string, opening punctuation, a comma, an
+        // operator/comparison, or a `:=` assignment. Identifier or closing-
+        // bracket before `-` means subtraction → keep the value positive.
+        const unaryMinus = /(?:^|[=([{,;:?+\-*/%&|^!<>~]|\b(?:return|typeof|in|of|case|delete|void|throw|yield|await|new)\b)\s*-\s*$/.test(before);
+        const value = unaryMinus ? -positive : positive;
+        if (whitelist.has(value))
+            continue;
+        // Skip if the literal is being assigned to a constant (declaration site).
+        if (/\b(?:const|let|var|enum|readonly)\s+[A-Z_][A-Z0-9_]*\s*[:=]\s*-?\s*$/.test(before))
+            continue;
+        if (/\b(?:const|let|var)\s+\w+\s*[:=]\s*-?\s*$/.test(before))
+            continue;
+        // Skip array indices (preceded by `[`).
+        if (/\[\s*-?\s*$/.test(before))
+            continue;
+        // Skip enum members.
+        if (/=\s*-?\s*$/.test(before) && /\benum\b/.test(masked.slice(Math.max(0, m.index - 200), m.index)))
+            continue;
+        // Skip exponents (e.g. 1e-3 or 1e+3 — the `3` should not be flagged).
+        if (/e[+-]?$/i.test(before))
+            continue;
+        // Skip HTTP status code idioms — `reply.code(502)`, `res.status(404)`,
+        // `.code(401).send(...)`, `throw new HttpError(500, ...)`. The method
+        // name IS the named constant in framework code; introducing a
+        // `HTTP_BAD_GATEWAY = 502` const adds friction without clarity.
+        if (/\.(?:code|status|statusCode|sendStatus)\s*\(\s*-?\s*$/.test(before) && value >= 100 && value < 600)
+            continue;
+        // Skip HTTP success/error-tier range checks: `if (status < 200 ||
+        // status >= 300)` and friends. The 200/300/400/500 boundaries are
+        // textbook HTTP semantics; flagging them invites the reader to
+        // invent names that read worse than the literal.
+        if (value >= 100 && value < 600 && value % 100 === 0 &&
+            /(?:<=?|>=?|===?|!==?)\s*$/.test(before) &&
+            /\b(?:status|statusCode|httpStatus|http_status|code)\b/.test(lineAround(masked, m.index)))
+            continue;
+        // Skip elements of `new Set([...])` / `new Map([...])` / array literal
+        // bound to a named const. The CONST NAME documents what each value
+        // represents (`RETRYABLE_HTTP`, `ALLOWED_PORTS`, …) — naming each
+        // element individually is busywork.
+        if (insideNamedConstCollection(masked, m.index))
+            continue;
+        // Skip `key: NUMBER,` inside object literals when the value is a
+        // bare literal (no expression). `confidence: 0.95,` / `timeoutMs:
+        // 1500,` style — the KEY names the magic. Same effective semantics
+        // as `const KEY = NUMBER`. Tight bounds avoid catching subtraction.
+        if (/[:=]\s*-?\s*$/.test(before) &&
+            /^\s*-?\s*[,;)}\]\n]/.test(after) &&
+            !/\b(?:return|throw|case|new)\b\s*-?\s*$/.test(before)) {
+            continue;
+        }
+        const line = lineOf(raw, m.index);
+        if (hasIgnoreAnnotation(raw, line, 'magic-numbers'))
+            continue;
+        out.push({
+            detectorId: 'magic-numbers',
+            severity: 'low',
+            confidence: 0.7,
+            layer: 1,
+            title: `Magic number \`${m[1]}\` in ${file}:${line}`,
+            description: `Numeric literal \`${m[1]}\` appears in business logic without a named constant. Re-readers must guess what it represents (a timeout? a port? a column count?).`,
+            evidence: [
+                {
+                    file,
+                    range: { startLine: line, endLine: line },
+                    snippet: snippetAround(raw, line),
+                },
+            ],
+            suggestion: 'Extract to a named const (`const RETRY_LIMIT = 3;`). If it derives from a real-world unit, encode the unit in the name (`TIMEOUT_MS`, `MAX_AGE_DAYS`).',
+            fingerprint: `magic-numbers:${stableHash(`${file}:${line}:${m[1]}`)}`,
+        });
+    }
+    return out;
+}
+function maskStringsAndComments(raw) {
+    let out = '';
+    let inString = null;
+    let inLineComment = false;
+    let inBlockComment = false;
+    let inRegex = false;
+    let inRegexClass = false;
+    // Track the previous non-whitespace masked-output character so we can
+    // disambiguate `/` as regex-start vs division. After punctuation /
+    // keywords a `/` opens a regex; after an identifier or closing bracket
+    // it is division.
+    let prevSig = '';
+    for (let i = 0; i < raw.length; i++) {
+        const c = raw[i];
+        const next = raw[i + 1];
+        if (inLineComment) {
+            if (c === '\n') {
+                inLineComment = false;
+                out += '\n';
+            }
+            else {
+                out += ' ';
+            }
+            continue;
+        }
+        if (inBlockComment) {
+            if (c === '*' && next === '/') {
+                inBlockComment = false;
+                out += '  ';
+                i++;
+            }
+            else {
+                out += c === '\n' ? '\n' : ' ';
+            }
+            continue;
+        }
+        if (inString) {
+            if (c === '\\') {
+                out += '  ';
+                i++;
+                continue;
+            }
+            if (c === inString) {
+                inString = null;
+                out += c;
+                prevSig = c;
+                continue;
+            }
+            out += c === '\n' ? '\n' : ' ';
+            continue;
+        }
+        if (inRegex) {
+            // Mask everything inside the regex body so the numeric scanner sees
+            // no digits. Track `[…]` character classes only to know when the
+            // regex actually ends (slash inside class does not terminate).
+            if (c === '\\') {
+                out += '  ';
+                i++;
+                continue;
+            }
+            if (c === '[' && !inRegexClass)
+                inRegexClass = true;
+            else if (c === ']' && inRegexClass)
+                inRegexClass = false;
+            if (c === '/' && !inRegexClass) {
+                inRegex = false;
+                out += c;
+                prevSig = c;
+                // Consume trailing flags (g, i, m, s, u, y, d) so they cannot be
+                // misread as identifiers in lookback.
+                while (i + 1 < raw.length && /[gimsuyd]/.test(raw[i + 1] ?? '')) {
+                    out += ' ';
+                    i++;
+                }
+                continue;
+            }
+            out += c === '\n' ? '\n' : ' ';
+            continue;
+        }
+        if (c === '/' && next === '/') {
+            inLineComment = true;
+            out += '  ';
+            i++;
+            continue;
+        }
+        if (c === '/' && next === '*') {
+            inBlockComment = true;
+            out += '  ';
+            i++;
+            continue;
+        }
+        if (c === '/' && canStartRegexAfter(prevSig)) {
+            inRegex = true;
+            inRegexClass = false;
+            out += c;
+            prevSig = c;
+            continue;
+        }
+        if (c === '"' || c === "'" || c === '`') {
+            inString = c;
+            out += c;
+            prevSig = c;
+            continue;
+        }
+        out += c;
+        if (c !== ' ' && c !== '\t' && c !== '\n' && c !== '\r')
+            prevSig = c;
+    }
+    return out;
+}
+/**
+ * Decide whether a `/` is the start of a regex literal (vs division)
+ * based on the previous non-whitespace character. After punctuation,
+ * an opening bracket / paren / brace, a comma, a return-like keyword,
+ * or an operator a slash starts a regex. After an identifier char or
+ * closing bracket it's division.
+ */
+function canStartRegexAfter(prev) {
+    if (prev === '')
+        return true;
+    return /[=(,;:?{[+\-*/%&|^!<>~]/.test(prev);
+}
+/**
+ * Detect whether a numeric literal at `idx` sits inside a collection
+ * literal (`new Set([…])`, `new Map([…])`, plain `[…]`) bound to a
+ * named const declared earlier on the same logical statement. The
+ * collection name documents each element — `RETRYABLE_HTTP = new Set
+ * ([408, 425, 429, …])` does not need every literal extracted to its
+ * own const.
+ *
+ * Walks backwards from `idx` counting `[` / `]` / `(` / `)` to find the
+ * enclosing bracket open, then checks whether the chunk between the
+ * preceding `=` and the bracket looks like a collection constructor or
+ * a bare array literal.
+ */
+function insideNamedConstCollection(masked, idx) {
+    let depthSq = 0;
+    let depthPar = 0;
+    for (let i = idx - 1; i >= 0; i--) {
+        const c = masked[i];
+        if (c === ']')
+            depthSq++;
+        else if (c === '[') {
+            if (depthSq === 0) {
+                // Found the enclosing array open. Look back for `=` to find the
+                // assignment target.
+                const lhs = masked.slice(Math.max(0, i - 200), i);
+                const eq = lhs.lastIndexOf('=');
+                if (eq === -1)
+                    return false;
+                const declHead = lhs.slice(Math.max(0, eq - 80), eq);
+                if (!/\b(?:const|let|var|readonly)\s+\w+/.test(declHead))
+                    return false;
+                const between = lhs.slice(eq + 1).trim();
+                // Bracket directly follows `=` (bare array) OR follows
+                // `new Set(` / `new Map(` / `new Array(` / `new Uint8Array(`
+                // etc. The trailing `(` is part of the constructor call —
+                // `new Set([...])` has the array inside the call parens.
+                if (between === '' || /\bnew\s+\w+\s*\(?\s*$/.test(between))
+                    return true;
+                return false;
+            }
+            depthSq--;
+        }
+        else if (c === ')')
+            depthPar++;
+        else if (c === '(') {
+            if (depthPar === 0)
+                return false;
+            depthPar--;
+        }
+        else if (c === ';' && depthSq === 0 && depthPar === 0) {
+            return false;
+        }
+    }
+    return false;
+}
+function isAnalysable(file) {
+    const posix = file.replace(/\\/g, '/');
+    return /\.(?:ts|tsx|mts|cts)$/.test(posix)
+        && !/\.d\.ts$/.test(posix)
+        && !/(^|\/)node_modules\//.test(posix)
+        && !/(?:^|\/)__tests__\//.test(posix)
+        && !/(?:^|\/)tests?\//.test(posix)
+        && !/(?:^|\/)scripts?\//.test(posix)
+        && !/\.test\.(?:ts|tsx)$/.test(posix)
+        && !/\.spec\.(?:ts|tsx)$/.test(posix)
+        // Tool config files are mostly threshold / timeout / port numbers
+        // by design — flagging every coverage threshold + chunk-size limit
+        // as a magic number is noise. Skip the common tooling configs.
+        && !/(?:^|\/)(?:vite|vitest|jest|rollup|webpack|esbuild|tsup|playwright|cypress|drizzle|next|nuxt|astro|svelte|remix|tailwind|postcss|prettier|eslint|biome|babel|rome|tsdown|tsconfig\.[^/]*)\.config\.(?:ts|tsx|mts|cts|js|mjs|cjs)$/.test(posix)
+        && !/(?:^|\/)\.?(?:eslint|prettier|stylelint)rc(?:\.[^/]+)?$/.test(posix);
+}
+function lineOf(raw, idx) {
+    return raw.slice(0, idx).split('\n').length;
+}
+function lineAround(raw, idx) {
+    const start = raw.lastIndexOf('\n', idx) + 1;
+    let end = raw.indexOf('\n', idx);
+    if (end === -1)
+        end = raw.length;
+    return raw.slice(start, end);
+}
+function snippetAround(raw, line) {
+    const lines = raw.split('\n');
+    const from = Math.max(0, line - 1);
+    const to = Math.min(lines.length, line + 1);
+    return lines.slice(from, to).join('\n');
+}
+//# sourceMappingURL=magic-numbers.js.map

package/dist/detectors/magic-numbers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"magic-numbers.js","sourceRoot":"","sources":["../../src/detectors/magic-numbers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAUpE,sEAAsE;AACtE,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,KAAgC;IACjE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,iBAAiB,CAAC;IACvD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,GAAG,IAAI,IAAI;YAAE,SAAS;QAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,qEAAqE;AACrE,gEAAgE;AAChE,mEAAmE;AACnE,qEAAqE;AACrE,oEAAoE;AACpE,mEAAmE;AACnE,uCAAuC;AACvC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IACX,EAAE,EAAE,GAAG,EAAE,IAAI;IACb,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI;CAC7C,CAAC,CAAC;AACH,8EAA8E;AAC9E,MAAM,MAAM,GAAG,sBAAsB,CAAC;AAEtC,SAAS,WAAW,CAAC,IAAY,EAAE,GAAW,EAAE,SAA8B,EAAE,GAAW;IACzF,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,qEAAqE;IACrE,wEAAwE;IACxE,mEAAmE;IACnE,2CAA2C;IAC3C,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;YAAE,MAAM;QAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,KAAM,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,KAAM,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAChF,oEAAoE;QACpE,oEAAoE;QACpE,+DAA+D;QAC/D,oEAAoE;QACpE,kEAAkE;QAClE,MAAM,UAAU,GAAG,0GAA0G,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3I,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAChD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACnC,0EAA0E;QAC1E,IAAI,sEAAsE,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS;QAClG,IAAI,2CAA2C,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS;QACvE,wCAAwC;QACxC,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS;QACzC,qBAAqB;QACrB,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,KAAM,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,KAAM,CAAC,CAAC;YAAE,SAAS;QAChH,sEAAsE;QACtE,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS;QACtC,uEAAuE;QACvE,sEAAsE;QACtE,8DAA8D;QAC9D,gEAAgE;QAChE,IAAI,uDAAuD,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,GAAG,GAAG;YAAE,SAAS;QAClH,kEAAkE;QAClE,kEAAkE;QAClE,+DAA+D;QAC/D,iDAAiD;QACjD,IACE,KAAK,IAAI,GAAG,IAAI,KAAK,GAAG,GAAG,IAAI,KAAK,GAAG,GAAG,KAAK,CAAC;YAChD,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC;YACxC,uDAAuD,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,KAAM,CAAC,CAAC;YAC1F,SAAS;QACX,uEAAuE;QACvE,mEAAmE;QACnE,kEAAkE;QAClE,oCAAoC;QACpC,IAAI,0BAA0B,CAAC,MAAM,EAAE,CAAC,CAAC,KAAM,CAAC;YAAE,SAAS;QAC3D,iEAAiE;QACjE,kEAAkE;QAClE,mEAAmE;QACnE,oEAAoE;QACpE,IACE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;YAC5B,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;YACjC,CAAC,wCAAwC,CAAC,IAAI,CAAC,MAAM,CAAC,EACtD,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,KAAM,CAAC,CAAC;QACnC,IAAI,mBAAmB,CAAC,GAAG,EAAE,IAAI,EAAE,eAAe,CAAC;YAAE,SAAS;QAC9D,GAAG,CAAC,IAAI,CAAC;YACP,UAAU,EAAE,eAAe;YAC3B,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,GAAG;YACf,KAAK,EAAE,CAAC;YACR,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE;YACpD,WAAW,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,uIAAuI;YAC7K,QAAQ,EAAE;gBACR;oBACE,IAAI;oBACJ,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;oBACzC,OAAO,EAAE,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC;iBAClC;aACF;YACD,UAAU,EACR,wJAAwJ;YAC1J,WAAW,EAAE,iBAAiB,UAAU,CAAC,GAAG,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACtE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAW;IACzC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,QAAQ,GAA2B,IAAI,CAAC;IAC5C,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,sEAAsE;IACtE,mEAAmE;IACnE,uEAAuE;IACvE,kBAAkB;IAClB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QAClB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,aAAa,GAAG,KAAK,CAAC;gBACtB,GAAG,IAAI,IAAI,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,GAAG,IAAI,GAAG,CAAC;YACb,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAC9B,cAAc,GAAG,KAAK,CAAC;gBACvB,GAAG,IAAI,IAAI,CAAC;gBACZ,CAAC,EAAE,CAAC;YACN,CAAC;iBAAM,CAAC;gBACN,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;YACjC,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,GAAG,IAAI,IAAI,CAAC;gBACZ,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACnB,QAAQ,GAAG,IAAI,CAAC;gBAChB,GAAG,IAAI,CAAC,CAAC;gBACT,OAAO,GAAG,CAAC,CAAC;gBACZ,SAAS;YACX,CAAC;YACD,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,oEAAoE;YACpE,iEAAiE;YACjE,+DAA+D;YAC/D,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,GAAG,IAAI,IAAI,CAAC;gBACZ,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY;gBAAE,YAAY,GAAG,IAAI,CAAC;iBAC/C,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY;gBAAE,YAAY,GAAG,KAAK,CAAC;YACzD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC/B,OAAO,GAAG,KAAK,CAAC;gBAChB,GAAG,IAAI,CAAC,CAAC;gBACT,OAAO,GAAG,CAAC,CAAC;gBACZ,iEAAiE;gBACjE,sCAAsC;gBACtC,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;oBAChE,GAAG,IAAI,GAAG,CAAC;oBACX,CAAC,EAAE,CAAC;gBACN,CAAC;gBACD,SAAS;YACX,CAAC;YACD,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC9B,aAAa,GAAG,IAAI,CAAC;YACrB,GAAG,IAAI,IAAI,CAAC;YACZ,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC9B,cAAc,GAAG,IAAI,CAAC;YACtB,GAAG,IAAI,IAAI,CAAC;YACZ,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,GAAG,KAAK,CAAC;YACrB,GAAG,IAAI,CAAC,CAAC;YACT,OAAO,GAAG,CAAC,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,QAAQ,GAAG,CAAC,CAAC;YACb,GAAG,IAAI,CAAC,CAAC;YACT,OAAO,GAAG,CAAC,CAAC;YACZ,SAAS;QACX,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;QACT,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,0BAA0B,CAAC,MAAc,EAAE,GAAW;IAC7D,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,EAAE,CAAC;aACpB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAClB,gEAAgE;gBAChE,qBAAqB;gBACrB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;gBAClD,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAChC,IAAI,EAAE,KAAK,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBACrD,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACvE,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzC,uDAAuD;gBACvD,6DAA6D;gBAC7D,0DAA0D;gBAC1D,yDAAyD;gBACzD,IAAI,OAAO,KAAK,EAAE,IAAI,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACzE,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG;YAAE,QAAQ,EAAE,CAAC;aAC5B,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,QAAQ,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACjC,QAAQ,EAAE,CAAC;QACb,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvC,OAAO,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;WACrC,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;WACvB,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;WACnC,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;WAClC,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;WAC/B,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;WACjC,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;WAClC,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QACrC,kEAAkE;QAClE,mEAAmE;QACnE,+DAA+D;WAC5D,CAAC,mOAAmO,CAAC,IAAI,CAAC,KAAK,CAAC;WAChP,CAAC,yDAAyD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,MAAM,CAAC,GAAW,EAAE,GAAW;IACtC,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,GAAW;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;IACjC,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,IAAY;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC"}

package/dist/detectors/mutable-globals.d.ts

@@ -0,0 +1,6 @@
+import type { Finding } from '../types.js';
+import type { FileWalkingDetectorInput } from '../types/detector-input.js';
+export interface MutableGlobalsDetectorInput extends FileWalkingDetectorInput {
+}
+export declare function detectMutableGlobals(input: MutableGlobalsDetectorInput): Finding[];
+//# sourceMappingURL=mutable-globals.d.ts.map

package/dist/detectors/mutable-globals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutable-globals.d.ts","sourceRoot":"","sources":["../../src/detectors/mutable-globals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAK3C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAE3E,MAAM,WAAW,2BAA4B,SAAQ,wBAAwB;CAAG;AAIhF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,EAAE,CAUlF"}

package/dist/detectors/mutable-globals.js

@@ -0,0 +1,95 @@
+import { makeSourceReader } from '../utils/source-reader.js';
+import { stableHash } from '../utils/hash.js';
+import { hasIgnoreAnnotation } from '../utils/ignore-annotation.js';
+import { escapeForRegex } from '../utils/regex.js';
+// Top-level `let`/`var` reassigned in the same file → shared mutable
+// state across importers. MED. One-shot assignment at decl is skipped.
+export function detectMutableGlobals(input) {
+    const read = makeSourceReader(input.workspaceRoot, input.project);
+    const findings = [];
+    for (const rel of input.files) {
+        if (!isAnalysable(rel))
+            continue;
+        const raw = read(rel);
+        if (raw == null)
+            continue;
+        findings.push(...analyseFile(rel, raw));
+    }
+    return findings;
+}
+function analyseFile(file, raw) {
+    const lines = raw.split('\n');
+    const out = [];
+    // Locate top-level let/var declarations: line starts with `let `/`var `
+    // (allow `export let`).
+    const declRe = /^(?:export\s+)?(?:let|var)\s+(\w+)\b/;
+    const declarations = [];
+    let braceDepth = 0;
+    let parenDepth = 0;
+    let lineNo = 0;
+    for (const line of lines) {
+        lineNo++;
+        // crude tracking — strings/comments are NOT masked here, so multiline
+        // template-literal-heavy files may misalign; the heuristic still works
+        // in practice because we only care about indentation-0 declarations.
+        const m = declRe.exec(line);
+        if (m && braceDepth === 0 && parenDepth === 0) {
+            declarations.push({ name: m[1], line: lineNo });
+        }
+        for (const c of line) {
+            if (c === '{')
+                braceDepth++;
+            else if (c === '}')
+                braceDepth = Math.max(0, braceDepth - 1);
+            else if (c === '(')
+                parenDepth++;
+            else if (c === ')')
+                parenDepth = Math.max(0, parenDepth - 1);
+        }
+    }
+    for (const d of declarations) {
+        // Look for reassignments anywhere after the declaration line.
+        const after = lines.slice(d.line).join('\n');
+        const re = new RegExp(`(?<![\\.\\w])${escapeForRegex(d.name)}\\s*(?:=(?!=)|\\+=|-=|\\*=|/=|\\?\\?=|\\|\\|=|&&=)`, 'g');
+        const matches = [...after.matchAll(re)];
+        if (matches.length === 0)
+            continue;
+        if (hasIgnoreAnnotation(raw, d.line, 'mutable-globals'))
+            continue;
+        out.push({
+            detectorId: 'mutable-globals',
+            severity: 'medium',
+            confidence: 0.8,
+            layer: 1,
+            title: `Mutable top-level binding: \`${d.name}\` in ${file}:${d.line}`,
+            description: `\`${d.name}\` is declared with \`let\`/\`var\` at module scope and reassigned later. Module-scope mutation is shared by every importer — common cause of cross-test pollution, hidden state in SSR, and bugs that only appear after the second request.`,
+            evidence: [
+                {
+                    file,
+                    range: { startLine: d.line, endLine: d.line },
+                    snippet: snippetAround(raw, d.line),
+                },
+            ],
+            suggestion: 'Encapsulate the state in a class / closure / module factory so each consumer gets its own copy, or move to `const` if no mutation is actually needed.',
+            fingerprint: `mutable-globals:${stableHash(`${file}:${d.name}`)}`,
+        });
+    }
+    return out;
+}
+function isAnalysable(file) {
+    const posix = file.replace(/\\/g, '/');
+    return /\.(?:ts|tsx|mts|cts|js|jsx|mjs|cjs)$/.test(posix)
+        && !/\.d\.ts$/.test(posix)
+        && !/(^|\/)node_modules\//.test(posix)
+        && !/(?:^|\/)__tests__\//.test(posix)
+        && !/(?:^|\/)tests?\//.test(posix)
+        && !/\.test\.(?:ts|tsx|js|jsx)$/.test(posix)
+        && !/\.spec\.(?:ts|tsx|js|jsx)$/.test(posix);
+}
+function snippetAround(raw, line) {
+    const lines = raw.split('\n');
+    const from = Math.max(0, line - 1);
+    const to = Math.min(lines.length, line + 1);
+    return lines.slice(from, to).join('\n');
+}
+//# sourceMappingURL=mutable-globals.js.map

package/dist/detectors/mutable-globals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutable-globals.js","sourceRoot":"","sources":["../../src/detectors/mutable-globals.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAKnD,qEAAqE;AACrE,uEAAuE;AACvE,MAAM,UAAU,oBAAoB,CAAC,KAAkC;IACrE,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,GAAG,IAAI,IAAI;YAAE,SAAS;QAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,GAAW;IAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,wEAAwE;IACxE,wBAAwB;IACxB,MAAM,MAAM,GAAG,sCAAsC,CAAC;IACtD,MAAM,YAAY,GAA0C,EAAE,CAAC;IAC/D,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,CAAC;QACT,sEAAsE;QACtE,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,UAAU,KAAK,CAAC,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;YAC9C,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK,GAAG;gBAAE,UAAU,EAAE,CAAC;iBACvB,IAAI,CAAC,KAAK,GAAG;gBAAE,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;iBACxD,IAAI,CAAC,KAAK,GAAG;gBAAE,UAAU,EAAE,CAAC;iBAC5B,IAAI,CAAC,KAAK,GAAG;gBAAE,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,8DAA8D;QAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,gBAAgB,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,oDAAoD,EAAE,GAAG,CAAC,CAAC;QACvH,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QACxC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,IAAI,mBAAmB,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,iBAAiB,CAAC;YAAE,SAAS;QAClE,GAAG,CAAC,IAAI,CAAC;YACP,UAAU,EAAE,iBAAiB;YAC7B,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,GAAG;YACf,KAAK,EAAE,CAAC;YACR,KAAK,EAAE,gCAAgC,CAAC,CAAC,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE;YACtE,WAAW,EACT,KAAK,CAAC,CAAC,IAAI,8OAA8O;YAC3P,QAAQ,EAAE;gBACR;oBACE,IAAI;oBACJ,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;oBAC7C,OAAO,EAAE,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC;iBACpC;aACF;YACD,UAAU,EACR,uJAAuJ;YACzJ,WAAW,EAAE,mBAAmB,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE;SAClE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAGD,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvC,OAAO,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC;WACpD,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;WACvB,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;WACnC,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;WAClC,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;WAC/B,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC;WACzC,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,IAAY;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IAC5C,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC"}

package/dist/detectors/mutation.d.ts

@@ -0,0 +1,11 @@
+import type { Finding } from '../types.js';
+import type { FileWalkingDetectorInput } from '../types/detector-input.js';
+export interface MutationDetectorInput extends FileWalkingDetectorInput {
+}
+export declare function detectMutations(input: MutationDetectorInput): Finding[];
+/**
+ * Compress the enclosing function source so the LLM prompt stays in budget.
+ * We keep the full signature line plus up to ~40 lines of body — enough to
+ * judge intent without paying for the model to read a 200-line method.
+ */
+//# sourceMappingURL=mutation.d.ts.map

package/dist/detectors/mutation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutation.d.ts","sourceRoot":"","sources":["../../src/detectors/mutation.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,OAAO,EAAY,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAE3E,MAAM,WAAW,qBAAsB,SAAQ,wBAAwB;CAAG;AAiE1E,wBAAgB,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,EAAE,CAsCvE;AAkUD;;;;GAIG"}