@netgreener/runtime 0.1.0

package/dist/analyze/astDetectors.js

@@ -0,0 +1,566 @@
+/**
+ * TypeScript AST detectors for Analyze (Python AST parity path).
+ *
+ * Returns ``null`` when typescript is unavailable or the file cannot be parsed —
+ * callers must fall back to heuristic detectors.
+ */
+import { languageForPath, } from './resourceFindingCandidate.js';
+import { tryLoadTypescript } from './loadTypescript.js';
+const DETECTOR_VERSION = '0.1.0';
+const RETRY_NAME = /\b(?:attempt|retry|tries|retries|maxRetries|max_retries)\b/i;
+const CAP_HINT_RE = /\b(?:pLimit|p-limit|bottleneck|Semaphore|mapLimit|eachLimit|PromisePool|concurrency\s*:)\b/i;
+const API_ROOTS = new Set([
+    'fetch',
+    'axios',
+    'got',
+    'request',
+    'openai',
+    'anthropic',
+    'stripe',
+    'cohere',
+    'mistral',
+    'groq',
+    'replicate',
+    'huggingface',
+    'together',
+    'bedrock',
+    'sagemaker',
+    'twilio',
+    'sendgrid',
+    'pinecone',
+]);
+const FILE_READ_NAMES = new Set(['readFile', 'readFileSync']);
+const COMP_METHODS = new Set(['map', 'flatMap', 'filter', 'forEach']);
+const SUBPROCESS_NAMES = new Set([
+    'exec',
+    'execSync',
+    'spawn',
+    'spawnSync',
+    'fork',
+    'execFile',
+    'execFileSync',
+]);
+const SLEEP_NAMES = new Set(['setTimeout', 'setInterval']);
+/** Nested-loop per-item scans (Python unvectorized_nested_loops twin). */
+const LOOKUP_METHODS = new Set(['find', 'includes', 'indexOf', 'lastIndexOf']);
+/** Explicit model/runtime loaders (Python model_load_in_loop twin). */
+const MODEL_LOAD_NAMES = new Set([
+    'loadLayersModel',
+    'loadGraphModel',
+    'from_pretrained',
+    'loadModel',
+]);
+/** Explicit per-item inference (Python inference_inside_loop twin). */
+const INFERENCE_NAMES = new Set([
+    'predict',
+    'predictOnBatch',
+    'executeAsync',
+    'forward',
+]);
+const HEAVY_MODEL_PACKAGES = new Set([
+    '@tensorflow/tfjs',
+    '@tensorflow/tfjs-node',
+    'onnxruntime-node',
+    'onnxruntime-web',
+    'onnxruntime',
+    '@xenova/transformers',
+    '@huggingface/transformers',
+]);
+function emptyBundle() {
+    return {
+        retry: [],
+        fileReads: [],
+        overconsumption: [],
+        unbounded: [],
+        polling: [],
+        repeatedWork: [],
+        processChurn: [],
+        fullDataset: [],
+        perItem: [],
+        modelLoad: [],
+        inference: [],
+    };
+}
+function scriptKindForPath(ts, relPath) {
+    const lower = relPath.toLowerCase();
+    if (lower.endsWith('.tsx'))
+        return ts.ScriptKind.TSX;
+    if (lower.endsWith('.jsx'))
+        return ts.ScriptKind.JSX;
+    if (lower.endsWith('.ts'))
+        return ts.ScriptKind.TS;
+    return ts.ScriptKind.JS;
+}
+function calleeName(ts, expr) {
+    if (ts.isIdentifier(expr))
+        return expr.text;
+    if (ts.isPropertyAccessExpression(expr)) {
+        const right = expr.name.text;
+        if (ts.isIdentifier(expr.expression)) {
+            return `${expr.expression.text}.${right}`;
+        }
+        return right;
+    }
+    return '';
+}
+/** Leftmost identifier in a property chain (``groq.chat.completions.create`` → ``groq``). */
+function rootIdentifier(ts, expr) {
+    let cur = expr;
+    while (ts.isPropertyAccessExpression(cur) || ts.isParenthesizedExpression(cur)) {
+        cur = ts.isPropertyAccessExpression(cur) ? cur.expression : cur.expression;
+    }
+    return ts.isIdentifier(cur) ? cur.text : '';
+}
+function leafName(name) {
+    return name.includes('.') ? name.split('.').pop() || name : name;
+}
+function looksLikeApiCall(ts, expr) {
+    const name = calleeName(ts, expr);
+    if (name) {
+        const root = name.split('.')[0] || name;
+        if (API_ROOTS.has(root) || API_ROOTS.has(name))
+            return true;
+    }
+    const chainRoot = rootIdentifier(ts, expr);
+    return Boolean(chainRoot) && API_ROOTS.has(chainRoot);
+}
+function looksLikeFileRead(name) {
+    if (!name)
+        return false;
+    const leaf = leafName(name);
+    return FILE_READ_NAMES.has(leaf) || FILE_READ_NAMES.has(name);
+}
+function looksLikePromiseAll(name) {
+    return name === 'Promise.all' || name === 'Promise.allSettled' || name.endsWith('.all');
+}
+function looksLikeSleep(name) {
+    return SLEEP_NAMES.has(name) || name === 'Bun.sleep' || name.endsWith('.wait');
+}
+function looksLikeSubprocess(name) {
+    return SUBPROCESS_NAMES.has(leafName(name));
+}
+function looksLikeNestedLookup(name) {
+    return LOOKUP_METHODS.has(leafName(name));
+}
+function looksLikeModelLoadCall(name) {
+    if (!name)
+        return false;
+    const leaf = leafName(name);
+    if (MODEL_LOAD_NAMES.has(leaf))
+        return true;
+    // onnxruntime: InferenceSession.create
+    return name === 'InferenceSession.create' || name.endsWith('.InferenceSession.create');
+}
+function looksLikeInferenceCall(name) {
+    if (!name)
+        return false;
+    const leaf = leafName(name);
+    if (INFERENCE_NAMES.has(leaf))
+        return true;
+    // ONNX Runtime session.run / ort.run — require session-ish qualifier
+    if (leaf === 'run') {
+        const lower = name.toLowerCase();
+        return (lower.includes('session') ||
+            lower === 'ort.run' ||
+            lower.endsWith('.ort.run'));
+    }
+    return false;
+}
+function inferenceHit(path, line, language) {
+    return hit(path, line, language, {
+        mechanism_id: 'per_item_instead_of_batch',
+        primary_domain: 'compute.gpu',
+        admission_domain: 'compute.gpu',
+        title: 'Model inference inside loop may run per item instead of a supported batch path',
+        detector_id: 'js.ast.inference_inside_loop',
+        legacy_issue_type: 'inference_inside_loop',
+    });
+}
+function stringLiteralValue(ts, expr) {
+    if (!expr)
+        return null;
+    if (ts.isStringLiteral(expr) || ts.isNoSubstitutionTemplateLiteral(expr)) {
+        return expr.text;
+    }
+    return null;
+}
+function isHeavyModelPackage(spec) {
+    if (!spec)
+        return false;
+    return HEAVY_MODEL_PACKAGES.has(spec);
+}
+function modelLoadHit(path, line, language) {
+    return hit(path, line, language, {
+        mechanism_id: 'process_or_runtime_churn',
+        primary_domain: 'compute.cpu',
+        admission_domain: 'compute.cpu',
+        title: 'Model/runtime load inside loop may repeat expensive initialization',
+        detector_id: 'js.ast.model_load_in_loop',
+        legacy_issue_type: 'model_load_in_loop',
+    });
+}
+function loopHeaderLooksRetry(ts, node, sf) {
+    if (ts.isForStatement(node)) {
+        const parts = [node.initializer, node.condition, node.incrementor]
+            .filter(Boolean)
+            .map((p) => p.getText(sf))
+            .join(' ');
+        return RETRY_NAME.test(parts);
+    }
+    if (ts.isWhileStatement(node) || ts.isDoStatement(node)) {
+        return RETRY_NAME.test(node.expression.getText(sf));
+    }
+    if (ts.isForOfStatement(node) || ts.isForInStatement(node)) {
+        return RETRY_NAME.test(node.getText(sf).slice(0, 120));
+    }
+    return false;
+}
+function parseSource(ts, source, relPath) {
+    try {
+        return ts.createSourceFile(relPath.replace(/\\/g, '/'), source, ts.ScriptTarget.Latest, true, scriptKindForPath(ts, relPath));
+    }
+    catch {
+        return null;
+    }
+}
+function containsApiCall(ts, node) {
+    let found = false;
+    const walk = (n) => {
+        if (found)
+            return;
+        if (ts.isCallExpression(n) && looksLikeApiCall(ts, n.expression)) {
+            found = true;
+            return;
+        }
+        ts.forEachChild(n, walk);
+    };
+    walk(node);
+    return found;
+}
+function hit(path, line, language, opts) {
+    return {
+        mechanism_id: opts.mechanism_id,
+        primary_domain: opts.primary_domain,
+        admission_domain: opts.admission_domain,
+        title: opts.title,
+        rel_path: path,
+        start_line: line,
+        end_line: line,
+        language,
+        detector_id: opts.detector_id,
+        detector_version: DETECTOR_VERSION,
+        legacy_issue_type: opts.legacy_issue_type,
+    };
+}
+function looksLikeJsonParse(name) {
+    return name === 'JSON.parse';
+}
+function unwrapExpr(ts, expr) {
+    let cur = expr;
+    while (true) {
+        if (ts.isAwaitExpression(cur)) {
+            cur = cur.expression;
+            continue;
+        }
+        if (ts.isParenthesizedExpression(cur)) {
+            cur = cur.expression;
+            continue;
+        }
+        if (ts.isAsExpression(cur)) {
+            cur = cur.expression;
+            continue;
+        }
+        break;
+    }
+    return cur;
+}
+function isFileReadCall(ts, expr) {
+    const inner = unwrapExpr(ts, expr);
+    return ts.isCallExpression(inner) && looksLikeFileRead(calleeName(ts, inner.expression));
+}
+function fullDatasetHit(path, line, language) {
+    return hit(path, line, language, {
+        mechanism_id: 'memory_retention_or_materialization',
+        primary_domain: 'memory.host',
+        admission_domain: 'memory.host',
+        title: 'Loading and parsing an entire file may retain a full dataset in memory',
+        detector_id: 'js.ast.full_dataset_in_memory',
+        legacy_issue_type: 'full_dataset_in_memory',
+    });
+}
+function walkHits(ts, sf, relPath) {
+    const language = languageForPath(relPath);
+    const path = relPath.replace(/\\/g, '/');
+    const out = emptyBundle();
+    const stack = [];
+    let comprehensionDepth = 0;
+    let promiseAllDepth = 0;
+    /** Recent ``const x = readFile…`` bindings for JSON.parse(x) pairing. */
+    const recentFileReads = [];
+    const mentionsChildProcess = /\b(?:node:)?child_process\b/.test(sf.text) ||
+        /\bfrom\s+['"](?:node:)?child_process['"]/.test(sf.text);
+    const rememberFileReadBinding = (name, line) => {
+        recentFileReads.push({ name, line });
+        if (recentFileReads.length > 8)
+            recentFileReads.shift();
+    };
+    const visit = (node) => {
+        const isLoop = ts.isForStatement(node) ||
+            ts.isForOfStatement(node) ||
+            ts.isForInStatement(node) ||
+            ts.isWhileStatement(node) ||
+            ts.isDoStatement(node);
+        if (isLoop) {
+            const kind = loopHeaderLooksRetry(ts, node, sf)
+                ? 'retry'
+                : 'plain';
+            stack.push({ kind });
+            ts.forEachChild(node, visit);
+            stack.pop();
+            return;
+        }
+        if (ts.isVariableDeclaration(node) && node.name && ts.isIdentifier(node.name) && node.initializer) {
+            if (isFileReadCall(ts, node.initializer)) {
+                const line = sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1;
+                rememberFileReadBinding(node.name.text, line);
+            }
+        }
+        if (ts.isCallExpression(node)) {
+            const name = calleeName(ts, node.expression);
+            const leaf = leafName(name);
+            const line = sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1;
+            const inLoop = stack.length > 0;
+            const inRetry = stack.some((f) => f.kind === 'retry');
+            if (looksLikeJsonParse(name) && node.arguments.length > 0) {
+                const arg = unwrapExpr(ts, node.arguments[0]);
+                if (ts.isCallExpression(arg) && looksLikeFileRead(calleeName(ts, arg.expression))) {
+                    out.fullDataset.push(fullDatasetHit(path, line, language));
+                }
+                else if (ts.isIdentifier(arg)) {
+                    const prior = [...recentFileReads].reverse().find((r) => r.name === arg.text);
+                    if (prior) {
+                        out.fullDataset.push(fullDatasetHit(path, prior.line, language));
+                    }
+                }
+            }
+            if (looksLikePromiseAll(name)) {
+                const argText = node.arguments.map((a) => a.getText(sf)).join(' ');
+                if (!CAP_HINT_RE.test(argText) &&
+                    (/\.map\s*\(/.test(argText) || /\.flatMap\s*\(/.test(argText)) &&
+                    containsApiCall(ts, node)) {
+                    out.unbounded.push(hit(path, line, language, {
+                        mechanism_id: 'unbounded_parallelism',
+                        primary_domain: 'network.io',
+                        admission_domain: 'network.io',
+                        title: 'Unbounded Promise.all fan-out may spike concurrent I/O cost',
+                        detector_id: 'js.ast.unbounded_promise_all',
+                        legacy_issue_type: 'unbounded_asyncio_gather_with_io',
+                    }));
+                }
+                promiseAllDepth += 1;
+                ts.forEachChild(node, visit);
+                promiseAllDepth -= 1;
+                return;
+            }
+            if (COMP_METHODS.has(leaf)) {
+                comprehensionDepth += 1;
+                ts.forEachChild(node, visit);
+                comprehensionDepth -= 1;
+                return;
+            }
+            if (looksLikeApiCall(ts, node.expression)) {
+                if (inRetry) {
+                    out.retry.push(hit(path, line, language, {
+                        mechanism_id: 'retry_amplification',
+                        primary_domain: 'external_api',
+                        admission_domain: 'external_api',
+                        title: 'Retry loop may amplify billed API attempts',
+                        detector_id: 'js.ast.retry_loop',
+                        legacy_issue_type: 'api_call_in_retry_loop',
+                    }));
+                }
+                else if (comprehensionDepth > 0 && promiseAllDepth === 0) {
+                    out.overconsumption.push(hit(path, line, language, {
+                        mechanism_id: 'external_api_overconsumption',
+                        primary_domain: 'external_api',
+                        admission_domain: 'external_api',
+                        title: 'API call inside map/filter may multiply billed attempts',
+                        detector_id: 'js.ast.api_in_comprehension',
+                        legacy_issue_type: 'api_call_in_comprehension',
+                    }));
+                }
+                else if (inLoop && !inRetry) {
+                    out.overconsumption.push(hit(path, line, language, {
+                        mechanism_id: 'external_api_overconsumption',
+                        primary_domain: 'external_api',
+                        admission_domain: 'external_api',
+                        title: 'API call inside loop may multiply billed attempts',
+                        detector_id: 'js.ast.api_in_loop',
+                        legacy_issue_type: 'network_call_in_loop',
+                    }));
+                }
+            }
+            if (inLoop && looksLikeFileRead(name)) {
+                out.fileReads.push(hit(path, line, language, {
+                    mechanism_id: 'repeated_work',
+                    primary_domain: 'storage.io',
+                    admission_domain: 'storage.io',
+                    title: 'File read inside loop may repeat avoidable I/O work',
+                    detector_id: 'js.ast.repeated_file_reads',
+                    legacy_issue_type: 'repeated_file_reads',
+                }));
+            }
+            if (inLoop && looksLikeSleep(name)) {
+                out.polling.push(hit(path, line, language, {
+                    mechanism_id: 'polling_or_idle_work',
+                    primary_domain: 'compute.cpu',
+                    admission_domain: 'compute.cpu',
+                    title: 'Sleep/delay inside loop may burn CPU with idle wakeups',
+                    detector_id: 'js.ast.sleep_polling',
+                    legacy_issue_type: 'sleep_polling',
+                }));
+            }
+            if (inLoop && looksLikeSubprocess(name)) {
+                const strong = /(?:Sync|fork)$/.test(leaf) || mentionsChildProcess || leaf === 'fork';
+                if (strong) {
+                    out.processChurn.push(hit(path, line, language, {
+                        mechanism_id: 'process_or_runtime_churn',
+                        primary_domain: 'compute.cpu',
+                        admission_domain: 'compute.cpu',
+                        title: 'Subprocess spawn/exec inside loop may repeat process churn',
+                        detector_id: 'js.ast.subprocess_in_loop',
+                        legacy_issue_type: 'subprocess_in_loop',
+                    }));
+                }
+            }
+            if (stack.length >= 2 && looksLikeNestedLookup(name)) {
+                out.perItem.push(hit(path, line, language, {
+                    mechanism_id: 'per_item_instead_of_batch',
+                    primary_domain: 'compute.cpu',
+                    admission_domain: 'compute.cpu',
+                    title: 'Nested-loop array lookup may scan per item instead of a batched/indexed path',
+                    detector_id: 'js.ast.unvectorized_nested_loops',
+                    legacy_issue_type: 'unvectorized_nested_loops',
+                }));
+            }
+            if (inLoop && looksLikeModelLoadCall(name)) {
+                out.modelLoad.push(modelLoadHit(path, line, language));
+            }
+            if (inLoop && looksLikeInferenceCall(name)) {
+                out.inference.push(inferenceHit(path, line, language));
+            }
+            if (inLoop && leaf === 'require' && node.arguments.length > 0) {
+                const spec = stringLiteralValue(ts, node.arguments[0]);
+                if (isHeavyModelPackage(spec)) {
+                    out.modelLoad.push(modelLoadHit(path, line, language));
+                }
+            }
+            if (inLoop &&
+                node.expression.kind === ts.SyntaxKind.ImportKeyword &&
+                node.arguments.length > 0) {
+                const spec = stringLiteralValue(ts, node.arguments[0]);
+                if (isHeavyModelPackage(spec)) {
+                    out.modelLoad.push(modelLoadHit(path, line, language));
+                }
+            }
+        }
+        if (ts.isNewExpression(node) && stack.length > 0) {
+            const ctor = node.expression.getText(sf);
+            if (ctor === 'RegExp') {
+                const line = sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1;
+                out.repeatedWork.push(hit(path, line, language, {
+                    mechanism_id: 'repeated_work',
+                    primary_domain: 'compute.cpu',
+                    admission_domain: 'compute.cpu',
+                    title: 'RegExp compiled inside loop may repeat avoidable CPU work',
+                    detector_id: 'js.ast.regex_compile_in_loop',
+                    legacy_issue_type: 'regex_compile_in_loop',
+                }));
+            }
+        }
+        if (ts.isBinaryExpression(node) && stack.length > 0) {
+            if (node.operatorToken.kind === ts.SyntaxKind.PlusEqualsToken) {
+                const right = node.right;
+                const isStringy = ts.isStringLiteral(right) ||
+                    ts.isNoSubstitutionTemplateLiteral(right) ||
+                    ts.isTemplateExpression(right) ||
+                    (ts.isCallExpression(right) && calleeName(ts, right.expression) === 'String');
+                if (isStringy) {
+                    const line = sf.getLineAndCharacterOfPosition(node.getStart(sf)).line + 1;
+                    out.repeatedWork.push(hit(path, line, language, {
+                        mechanism_id: 'repeated_work',
+                        primary_domain: 'compute.cpu',
+                        admission_domain: 'compute.cpu',
+                        title: 'String concatenation inside loop may repeat avoidable CPU work',
+                        detector_id: 'js.ast.string_concat_in_loop',
+                        legacy_issue_type: 'string_concat_in_loop',
+                    }));
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(sf);
+    return out;
+}
+/** Full AST hit bundle, or ``null`` to signal heuristic fallback. */
+export function detectAllHitsAst(source, relPath) {
+    const ts = tryLoadTypescript();
+    if (!ts)
+        return null;
+    const sf = parseSource(ts, source, relPath);
+    if (!sf)
+        return null;
+    return walkHits(ts, sf, relPath);
+}
+/** @deprecated Prefer detectAllHitsAst — kept for callers. */
+export function detectHotPathHitsAst(source, relPath) {
+    const all = detectAllHitsAst(source, relPath);
+    if (!all)
+        return null;
+    return { retry: all.retry, fileReads: all.fileReads };
+}
+export function detectRetryAmplificationHitsAst(source, relPath) {
+    const all = detectAllHitsAst(source, relPath);
+    return all ? all.retry : null;
+}
+export function detectRepeatedFileReadHitsAst(source, relPath) {
+    const all = detectAllHitsAst(source, relPath);
+    return all ? all.fileReads : null;
+}
+export function detectApiOverconsumptionHitsAst(source, relPath) {
+    const all = detectAllHitsAst(source, relPath);
+    return all ? all.overconsumption : null;
+}
+export function detectUnboundedParallelismHitsAst(source, relPath) {
+    const all = detectAllHitsAst(source, relPath);
+    return all ? all.unbounded : null;
+}
+export function detectPollingIdleHitsAst(source, relPath) {
+    const all = detectAllHitsAst(source, relPath);
+    return all ? all.polling : null;
+}
+export function detectRepeatedWorkHitsAst(source, relPath) {
+    const all = detectAllHitsAst(source, relPath);
+    return all ? all.repeatedWork : null;
+}
+export function detectProcessChurnHitsAst(source, relPath) {
+    const all = detectAllHitsAst(source, relPath);
+    return all ? all.processChurn : null;
+}
+export function detectFullDatasetInMemoryHitsAst(source, relPath) {
+    const all = detectAllHitsAst(source, relPath);
+    return all ? all.fullDataset : null;
+}
+export function detectPerItemInsteadOfBatchHitsAst(source, relPath) {
+    const all = detectAllHitsAst(source, relPath);
+    return all ? all.perItem : null;
+}
+export function detectModelLoadInLoopHitsAst(source, relPath) {
+    const all = detectAllHitsAst(source, relPath);
+    return all ? all.modelLoad : null;
+}
+export function detectInferenceInsideLoopHitsAst(source, relPath) {
+    const all = detectAllHitsAst(source, relPath);
+    return all ? all.inference : null;
+}

package/dist/analyze/buildResourceFindings.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Orchestrate resource-candidate emission from in-memory sources or disk.
+ * Prefer TypeScript AST when available; heuristics otherwise.
+ * Additive Analyze path — never touches RunSession upload.
+ */
+import { type ListCandidateSourceFilesOptions } from './projectScan.js';
+import { type ResourceFindingCandidateV1 } from './resourceFindingCandidate.js';
+import type { ServiceManifestV0 } from './serviceDiscovery.js';
+export type BuildResourceFindingsOptions = ListCandidateSourceFilesOptions & {
+    projectId?: string;
+    /** Max candidate findings to return (default 50). */
+    maxFindings?: number;
+};
+export type ResourceAnalyzeResultV0 = {
+    schema: 'resource_analyze_result_v0';
+    contract_status: 'mp4_scaffold';
+    project_id: string;
+    manifest: ServiceManifestV0;
+    findings: ResourceFindingCandidateV1[];
+    stats: {
+        files_scanned: number;
+        findings: number;
+        by_mechanism: Record<string, number>;
+    };
+    notes: string[];
+};
+/**
+ * Build admitted ``resource_finding_v1`` candidates from path→source map.
+ */
+export declare function buildResourceFindingsFromSources(sources: Record<string, string>, opts?: BuildResourceFindingsOptions): ResourceFindingCandidateV1[];
+/**
+ * Walk project (or explicit paths), emit candidates + service manifest together.
+ */
+export declare function buildResourceAnalyzeResultFromPaths(projectDir: string, relPaths?: Iterable<string> | null, opts?: BuildResourceFindingsOptions): ResourceAnalyzeResultV0;

package/dist/analyze/buildResourceFindings.js

@@ -0,0 +1,86 @@
+/**
+ * Orchestrate resource-candidate emission from in-memory sources or disk.
+ * Prefer TypeScript AST when available; heuristics otherwise.
+ * Additive Analyze path — never touches RunSession upload.
+ */
+import { readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { collectPreferAstHits } from './preferAstDetectors.js';
+import { buildServiceManifestFromPaths, listCandidateSourceFiles, } from './projectScan.js';
+import { toResourceFindingCandidate, } from './resourceFindingCandidate.js';
+import { filterValidResourceFindings } from './validateResourceFinding.js';
+import { isTypescriptAnalyzeAvailable } from './loadTypescript.js';
+function collectHitsFromSources(sources) {
+    const hits = [];
+    for (const [rel, source] of Object.entries(sources)) {
+        hits.push(...collectPreferAstHits(source, rel));
+    }
+    return hits;
+}
+/**
+ * Build admitted ``resource_finding_v1`` candidates from path→source map.
+ */
+export function buildResourceFindingsFromSources(sources, opts = {}) {
+    const maxFindings = Math.max(1, opts.maxFindings ?? 50);
+    const projectId = opts.projectId ?? 'local';
+    const out = [];
+    for (const hit of collectHitsFromSources(sources)) {
+        const finding = toResourceFindingCandidate(hit, projectId);
+        if (!finding)
+            continue;
+        out.push(finding);
+        if (out.length >= maxFindings)
+            break;
+    }
+    return filterValidResourceFindings(out);
+}
+/**
+ * Walk project (or explicit paths), emit candidates + service manifest together.
+ */
+export function buildResourceAnalyzeResultFromPaths(projectDir, relPaths, opts = {}) {
+    const projectId = opts.projectId ?? 'local';
+    const maxFileBytes = Math.max(1024, opts.maxFileBytes ?? 512 * 1024);
+    const paths = relPaths
+        ? [...relPaths].filter(Boolean).map((p) => String(p).replace(/\\/g, '/'))
+        : listCandidateSourceFiles(projectDir, opts);
+    const sources = {};
+    for (const rel of paths) {
+        try {
+            const abs = join(projectDir, rel);
+            const st = statSync(abs);
+            if (!st.isFile() || st.size > maxFileBytes)
+                continue;
+            sources[rel.replace(/\\/g, '/')] = readFileSync(abs, { encoding: 'utf8' });
+        }
+        catch {
+            continue;
+        }
+    }
+    const findings = buildResourceFindingsFromSources(sources, opts);
+    const by_mechanism = {};
+    for (const f of findings) {
+        by_mechanism[f.mechanism_id] = (by_mechanism[f.mechanism_id] || 0) + 1;
+    }
+    const manifest = buildServiceManifestFromPaths(projectDir, Object.keys(sources), opts);
+    return {
+        schema: 'resource_analyze_result_v0',
+        contract_status: 'mp4_scaffold',
+        project_id: projectId,
+        manifest,
+        findings,
+        stats: {
+            files_scanned: Object.keys(sources).length,
+            findings: findings.length,
+            by_mechanism,
+        },
+        notes: [
+            'MP4 scaffold: TypeScript AST preferred for all current RD0 twins; heuristics fallback when typescript absent',
+            'Stable mechanism_id/evidence_state aligned to resource_finding_v1 + RD0 disposition',
+            'Does not modify RunSession upload, CLI, or VSCE wiring',
+            'Detectors: retry_amplification, external_api_overconsumption, unbounded_parallelism, polling_or_idle_work, repeated_work, process_or_runtime_churn (subprocess + model_load), memory_retention_or_materialization, per_item_instead_of_batch (nested lookup + inference_inside_loop)',
+            `typescript AST available=${isTypescriptAnalyzeAvailable()}`,
+            'Candidates are fail-closed filtered through vendored resource_finding_v1 JSON Schema (Ajv)',
+            'Skipped RD0 context-only: http_call_without_timeout; skipped low-energy print_in_loop; skipped ML-only excess_training_work / accelerator_underutilization',
+        ],
+    };
+}