@netgreener/runtime 0.1.0

package/dist/analyze/cli.d.ts

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+/**
+ * Thin Node Analyze CLI — print ``service_manifest_v0`` + ``resource_finding_v1``
+ * candidates for a project path. Never uploads; never touches RunSession.
+ *
+ *   npx netgreener-analyze ./my-app
+ *   npm run example:analyze-cli -- ./fixtures/analyze-sample
+ *
+ * Options:
+ *   --project-id <id>          project_id stamped on candidates (default: local)
+ *   --paths a.ts,b.ts          explicit repo-relative paths (skip auto-walk)
+ *   --findings-only            print findings array only
+ *   --manifest-only            print service manifest only
+ *   --json-summary             print machine-readable gate summary only (CI)
+ *   --fail-on any|<mechanism>[,…]   CI gate (exit 1 when exceeded)
+ *   --max-at-or-above <n>      with --fail-on: allow up to N matches (default 0)
+ *   --quiet                    suppress non-JSON status lines on stderr
+ */
+/** Run analyze subcommand; ``argv`` is args after ``analyze`` / bin name. */
+export declare function runAnalyzeCli(argv: string[]): number;

package/dist/analyze/cli.js

@@ -0,0 +1,186 @@
+#!/usr/bin/env node
+/**
+ * Thin Node Analyze CLI — print ``service_manifest_v0`` + ``resource_finding_v1``
+ * candidates for a project path. Never uploads; never touches RunSession.
+ *
+ *   npx netgreener-analyze ./my-app
+ *   npm run example:analyze-cli -- ./fixtures/analyze-sample
+ *
+ * Options:
+ *   --project-id <id>          project_id stamped on candidates (default: local)
+ *   --paths a.ts,b.ts          explicit repo-relative paths (skip auto-walk)
+ *   --findings-only            print findings array only
+ *   --manifest-only            print service manifest only
+ *   --json-summary             print machine-readable gate summary only (CI)
+ *   --fail-on any|<mechanism>[,…]   CI gate (exit 1 when exceeded)
+ *   --max-at-or-above <n>      with --fail-on: allow up to N matches (default 0)
+ *   --quiet                    suppress non-JSON status lines on stderr
+ */
+import { accessSync, constants, statSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { buildAnalyzeGateSummary, findingsExceedFailThreshold, formatAnalyzeGateFailureMessage, resolveAnalyzeGateLimit, } from './analyzeGate.js';
+import { buildResourceAnalyzeResultFromPaths } from './buildResourceFindings.js';
+import { formatAnalyzeHelp } from '../cli/helpText.js';
+function printHelp() {
+    process.stdout.write(formatAnalyzeHelp());
+}
+function parseArgs(argv) {
+    const flags = {
+        projectId: 'local',
+        paths: null,
+        findingsOnly: false,
+        manifestOnly: false,
+        jsonSummary: false,
+        failOn: null,
+        maxAtOrAbove: null,
+        quiet: false,
+        help: false,
+        positional: [],
+    };
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i] ?? '';
+        if (arg === '-h' || arg === '--help') {
+            flags.help = true;
+            continue;
+        }
+        if (arg === '--findings-only') {
+            flags.findingsOnly = true;
+            continue;
+        }
+        if (arg === '--manifest-only') {
+            flags.manifestOnly = true;
+            continue;
+        }
+        if (arg === '--json-summary') {
+            flags.jsonSummary = true;
+            continue;
+        }
+        if (arg === '--quiet') {
+            flags.quiet = true;
+            continue;
+        }
+        if (arg === '--project-id') {
+            flags.projectId = String(argv[++i] || 'local');
+            continue;
+        }
+        if (arg.startsWith('--project-id=')) {
+            flags.projectId = arg.slice('--project-id='.length) || 'local';
+            continue;
+        }
+        if (arg === '--paths') {
+            const raw = String(argv[++i] || '');
+            flags.paths = raw
+                .split(',')
+                .map((p) => p.trim())
+                .filter(Boolean);
+            continue;
+        }
+        if (arg.startsWith('--paths=')) {
+            flags.paths = arg
+                .slice('--paths='.length)
+                .split(',')
+                .map((p) => p.trim())
+                .filter(Boolean);
+            continue;
+        }
+        if (arg === '--fail-on') {
+            flags.failOn = String(argv[++i] || '').trim() || null;
+            continue;
+        }
+        if (arg.startsWith('--fail-on=')) {
+            flags.failOn = arg.slice('--fail-on='.length).trim() || null;
+            continue;
+        }
+        if (arg === '--max-at-or-above') {
+            flags.maxAtOrAbove = Number(argv[++i]);
+            continue;
+        }
+        if (arg.startsWith('--max-at-or-above=')) {
+            flags.maxAtOrAbove = Number(arg.slice('--max-at-or-above='.length));
+            continue;
+        }
+        if (arg.startsWith('-')) {
+            throw new Error(`Unknown option: ${arg}`);
+        }
+        flags.positional.push(arg);
+    }
+    return flags;
+}
+/** Run analyze subcommand; ``argv`` is args after ``analyze`` / bin name. */
+export function runAnalyzeCli(argv) {
+    let flags;
+    try {
+        flags = parseArgs(argv);
+    }
+    catch (err) {
+        process.stderr.write(`${err instanceof Error ? err.message : String(err)}\n`);
+        printHelp();
+        return 2;
+    }
+    if (flags.help || flags.positional.length === 0) {
+        printHelp();
+        return flags.help ? 0 : 2;
+    }
+    const modeCount = [flags.findingsOnly, flags.manifestOnly, flags.jsonSummary].filter(Boolean)
+        .length;
+    if (modeCount > 1) {
+        process.stderr.write('Choose at most one of --findings-only / --manifest-only / --json-summary\n');
+        return 2;
+    }
+    if (flags.maxAtOrAbove != null && flags.failOn == null) {
+        process.stderr.write('--max-at-or-above requires --fail-on\n');
+        return 2;
+    }
+    if (flags.maxAtOrAbove != null && (!Number.isFinite(flags.maxAtOrAbove) || flags.maxAtOrAbove < 0)) {
+        process.stderr.write('--max-at-or-above must be a non-negative number\n');
+        return 2;
+    }
+    const projectDir = resolve(flags.positional[0]);
+    try {
+        accessSync(projectDir, constants.R_OK);
+        if (!statSync(projectDir).isDirectory()) {
+            throw new Error('not a directory');
+        }
+    }
+    catch {
+        process.stderr.write(`Project path is not a readable directory: ${projectDir}\n`);
+        return 2;
+    }
+    const result = buildResourceAnalyzeResultFromPaths(projectDir, flags.paths, {
+        projectId: flags.projectId,
+    });
+    const summary = buildAnalyzeGateSummary({
+        projectId: flags.projectId,
+        filesScanned: result.stats.files_scanned,
+        findings: result.findings,
+        failOn: flags.failOn,
+        maxAtOrAbove: flags.maxAtOrAbove,
+    });
+    const payload = flags.jsonSummary
+        ? summary
+        : flags.findingsOnly
+            ? result.findings
+            : flags.manifestOnly
+                ? result.manifest
+                : result;
+    process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
+    if (!flags.quiet && !flags.jsonSummary) {
+        process.stderr.write(`netgreener analyze: files=${result.stats.files_scanned} findings=${result.stats.findings} upload=never\n`);
+    }
+    const limit = resolveAnalyzeGateLimit(flags.failOn, flags.maxAtOrAbove);
+    if (flags.failOn && limit != null) {
+        if (findingsExceedFailThreshold(result.findings, flags.failOn, limit)) {
+            if (!flags.jsonSummary) {
+                process.stderr.write(`${formatAnalyzeGateFailureMessage(result.findings, flags.failOn, limit)}\n`);
+            }
+            return 1;
+        }
+    }
+    return summary.exit_code;
+}
+const invokedDirectly = typeof process.argv[1] === 'string' &&
+    pathToFileURL(resolve(process.argv[1])).href === import.meta.url;
+if (invokedDirectly) {
+    process.exitCode = runAnalyzeCli(process.argv.slice(2));
+}

package/dist/analyze/cpuResourceDetectors.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Heuristic JS/TS twins for local CPU-ish RD0 candidate_map rules:
+ *   - sleep_polling → polling_or_idle_work / compute.cpu
+ *   - regex_compile_in_loop / string_concat_in_loop → repeated_work / compute.cpu
+ *   - subprocess_in_loop → process_or_runtime_churn / compute.cpu
+ *   - model_load_in_loop → process_or_runtime_churn / compute.cpu
+ *   - unvectorized_nested_loops → per_item_instead_of_batch / compute.cpu
+ *   - inference_inside_loop → per_item_instead_of_batch / compute.gpu
+ *
+ * Skips low-energy ``print_in_loop`` (Python always-downgrade class).
+ * Skips ML-only training gates (``no_early_stopping`` / ``no_lr_scheduler`` /
+ * ``no_mixed_precision`` → excess_training_work / accelerator_underutilization).
+ */
+import { type ResourceCandidateHit } from './resourceFindingCandidate.js';
+/** Python ``sleep_polling`` twin. */
+export declare function detectPollingIdleHits(source: string, relPath: string): ResourceCandidateHit[];
+/** Python ``regex_compile_in_loop`` + ``string_concat_in_loop`` twins. */
+export declare function detectRepeatedWorkHits(source: string, relPath: string): ResourceCandidateHit[];
+/** Python ``subprocess_in_loop`` twin (child_process spawn/exec). */
+export declare function detectProcessChurnHits(source: string, relPath: string): ResourceCandidateHit[];
+/**
+ * Python ``model_load_in_loop`` twin (TF.js / ONNX / transformers loaders,
+ * or dynamic import/require of heavy model packages inside a loop).
+ */
+export declare function detectModelLoadInLoopHits(source: string, relPath: string): ResourceCandidateHit[];
+/**
+ * Python ``unvectorized_nested_loops`` twin: array lookup inside nested loops
+ * (O(n²) per-item scan instead of a batched/indexed path).
+ */
+export declare function detectPerItemInsteadOfBatchHits(source: string, relPath: string): ResourceCandidateHit[];
+/**
+ * Python ``inference_inside_loop`` twin (TF.js predict / ONNX session.run /
+ * executeAsync inside a loop → per-item instead of batch; compute.gpu).
+ */
+export declare function detectInferenceInsideLoopHits(source: string, relPath: string): ResourceCandidateHit[];

package/dist/analyze/cpuResourceDetectors.js

@@ -0,0 +1,163 @@
+/**
+ * Heuristic JS/TS twins for local CPU-ish RD0 candidate_map rules:
+ *   - sleep_polling → polling_or_idle_work / compute.cpu
+ *   - regex_compile_in_loop / string_concat_in_loop → repeated_work / compute.cpu
+ *   - subprocess_in_loop → process_or_runtime_churn / compute.cpu
+ *   - model_load_in_loop → process_or_runtime_churn / compute.cpu
+ *   - unvectorized_nested_loops → per_item_instead_of_batch / compute.cpu
+ *   - inference_inside_loop → per_item_instead_of_batch / compute.gpu
+ *
+ * Skips low-energy ``print_in_loop`` (Python always-downgrade class).
+ * Skips ML-only training gates (``no_early_stopping`` / ``no_lr_scheduler`` /
+ * ``no_mixed_precision`` → excess_training_work / accelerator_underutilization).
+ */
+import { forEachSourceLine, INFERENCE_RE, MODEL_LOAD_RE, NESTED_LOOKUP_RE, REGEX_COMPILE_RE, SLEEP_POLL_RE, STRING_CONCAT_RE, SUBPROCESS_RE, } from './heuristicScan.js';
+import { languageForPath, } from './resourceFindingCandidate.js';
+const DETECTOR_VERSION = '0.1.0';
+function baseHit(relPath, lineNo, language, opts) {
+    const primary = opts.primary_domain ?? 'compute.cpu';
+    return {
+        mechanism_id: opts.mechanism_id,
+        primary_domain: primary,
+        admission_domain: primary,
+        title: opts.title,
+        rel_path: relPath,
+        start_line: lineNo,
+        end_line: lineNo,
+        language,
+        detector_id: opts.detector_id,
+        detector_version: DETECTOR_VERSION,
+        legacy_issue_type: opts.legacy_issue_type,
+    };
+}
+/** Python ``sleep_polling`` twin. */
+export function detectPollingIdleHits(source, relPath) {
+    const hits = [];
+    const language = languageForPath(relPath);
+    const path = relPath.replace(/\\/g, '/');
+    forEachSourceLine(source, ({ line, lineNo, inLoop }) => {
+        if (!inLoop || !SLEEP_POLL_RE.test(line))
+            return;
+        hits.push(baseHit(path, lineNo, language, {
+            mechanism_id: 'polling_or_idle_work',
+            title: 'Sleep/delay inside loop may burn CPU with idle wakeups',
+            detector_id: 'js.static.sleep_polling',
+            legacy_issue_type: 'sleep_polling',
+        }));
+    });
+    return hits;
+}
+/** Python ``regex_compile_in_loop`` + ``string_concat_in_loop`` twins. */
+export function detectRepeatedWorkHits(source, relPath) {
+    const hits = [];
+    const language = languageForPath(relPath);
+    const path = relPath.replace(/\\/g, '/');
+    forEachSourceLine(source, ({ line, lineNo, inLoop }) => {
+        if (!inLoop)
+            return;
+        if (REGEX_COMPILE_RE.test(line)) {
+            hits.push(baseHit(path, lineNo, language, {
+                mechanism_id: 'repeated_work',
+                title: 'RegExp compiled inside loop may repeat avoidable CPU work',
+                detector_id: 'js.static.regex_compile_in_loop',
+                legacy_issue_type: 'regex_compile_in_loop',
+            }));
+        }
+        if (STRING_CONCAT_RE.test(line)) {
+            hits.push(baseHit(path, lineNo, language, {
+                mechanism_id: 'repeated_work',
+                title: 'String concatenation inside loop may repeat avoidable CPU work',
+                detector_id: 'js.static.string_concat_in_loop',
+                legacy_issue_type: 'string_concat_in_loop',
+            }));
+        }
+    });
+    return hits;
+}
+/** Python ``subprocess_in_loop`` twin (child_process spawn/exec). */
+export function detectProcessChurnHits(source, relPath) {
+    const hits = [];
+    const language = languageForPath(relPath);
+    const path = relPath.replace(/\\/g, '/');
+    const mentionsChildProcess = /\bchild_process\b|\bnode:child_process\b/.test(source) ||
+        /\bfrom\s+['"](?:node:)?child_process['"]/.test(source) ||
+        /\brequire\(\s*['"](?:node:)?child_process['"]\s*\)/.test(source);
+    forEachSourceLine(source, ({ line, lineNo, inLoop }) => {
+        if (!inLoop || !SUBPROCESS_RE.test(line))
+            return;
+        // Avoid flagging unrelated ``spawn`` names unless child_process is in file,
+        // except execSync/spawnSync which are strongly Node subprocess APIs.
+        const strong = /\b(?:execSync|spawnSync|execFileSync|fork)\s*\(/.test(line) ||
+            mentionsChildProcess;
+        if (!strong)
+            return;
+        hits.push(baseHit(path, lineNo, language, {
+            mechanism_id: 'process_or_runtime_churn',
+            title: 'Subprocess spawn/exec inside loop may repeat process churn',
+            detector_id: 'js.static.subprocess_in_loop',
+            legacy_issue_type: 'subprocess_in_loop',
+        }));
+    });
+    return hits;
+}
+/**
+ * Python ``model_load_in_loop`` twin (TF.js / ONNX / transformers loaders,
+ * or dynamic import/require of heavy model packages inside a loop).
+ */
+export function detectModelLoadInLoopHits(source, relPath) {
+    const hits = [];
+    const language = languageForPath(relPath);
+    const path = relPath.replace(/\\/g, '/');
+    forEachSourceLine(source, ({ line, lineNo, inLoop }) => {
+        if (!inLoop || !MODEL_LOAD_RE.test(line))
+            return;
+        hits.push(baseHit(path, lineNo, language, {
+            mechanism_id: 'process_or_runtime_churn',
+            title: 'Model/runtime load inside loop may repeat expensive initialization',
+            detector_id: 'js.static.model_load_in_loop',
+            legacy_issue_type: 'model_load_in_loop',
+        }));
+    });
+    return hits;
+}
+/**
+ * Python ``unvectorized_nested_loops`` twin: array lookup inside nested loops
+ * (O(n²) per-item scan instead of a batched/indexed path).
+ */
+export function detectPerItemInsteadOfBatchHits(source, relPath) {
+    const hits = [];
+    const language = languageForPath(relPath);
+    const path = relPath.replace(/\\/g, '/');
+    forEachSourceLine(source, ({ line, lineNo, loopDepth }) => {
+        if (loopDepth < 2 || !NESTED_LOOKUP_RE.test(line))
+            return;
+        hits.push(baseHit(path, lineNo, language, {
+            mechanism_id: 'per_item_instead_of_batch',
+            title: 'Nested-loop array lookup may scan per item instead of a batched/indexed path',
+            detector_id: 'js.static.unvectorized_nested_loops',
+            legacy_issue_type: 'unvectorized_nested_loops',
+        }));
+    });
+    return hits;
+}
+/**
+ * Python ``inference_inside_loop`` twin (TF.js predict / ONNX session.run /
+ * executeAsync inside a loop → per-item instead of batch; compute.gpu).
+ */
+export function detectInferenceInsideLoopHits(source, relPath) {
+    const hits = [];
+    const language = languageForPath(relPath);
+    const path = relPath.replace(/\\/g, '/');
+    forEachSourceLine(source, ({ line, lineNo, inLoop }) => {
+        if (!inLoop || !INFERENCE_RE.test(line))
+            return;
+        hits.push(baseHit(path, lineNo, language, {
+            mechanism_id: 'per_item_instead_of_batch',
+            primary_domain: 'compute.gpu',
+            title: 'Model inference inside loop may run per item instead of a supported batch path',
+            detector_id: 'js.static.inference_inside_loop',
+            legacy_issue_type: 'inference_inside_loop',
+        }));
+    });
+    return hits;
+}

package/dist/analyze/heuristicScan.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Shared heuristic helpers for MP4 JS/TS resource detectors.
+ * Not a TypeScript AST — line + brace-depth only.
+ */
+/** HTTP / paid API call sites commonly metered as external_api. */
+export declare const API_CALL_RE: RegExp;
+/** Retry-ish for/while headers (Python attempt|retry|tries twin). */
+export declare const RETRY_HEADER_RE: RegExp;
+/** Plain for/while loop header (any). */
+export declare const LOOP_HEADER_RE: RegExp;
+/** Array iteration that behaves like a Python comprehension for fan-out cost. */
+export declare const COMPREHENSION_RE: RegExp;
+/** Unbounded concurrent fan-out (JS twin of asyncio.gather). */
+export declare const PROMISE_ALL_RE: RegExp;
+/** Sleep / delay polling (Python sleep_polling twin). */
+export declare const SLEEP_POLL_RE: RegExp;
+/** RegExp compiled inside a hot path (Python regex_compile_in_loop twin). */
+export declare const REGEX_COMPILE_RE: RegExp;
+/** String concat growth in a loop (Python string_concat_in_loop twin). */
+export declare const STRING_CONCAT_RE: RegExp;
+/** child_process style spawn/exec (Python subprocess_in_loop twin). */
+export declare const SUBPROCESS_RE: RegExp;
+/** Whole-file reads (fs) — loop reuse → repeated_file_reads. */
+export declare const FILE_READ_RE: RegExp;
+/**
+ * Per-item array lookup (JS twin of Python ``unvectorized_nested_loops``).
+ * Meaningful when nested loop depth ≥ 2.
+ */
+export declare const NESTED_LOOKUP_RE: RegExp;
+/**
+ * Model / runtime load inside a loop (Python ``model_load_in_loop`` twin).
+ * Prefer explicit loader APIs; avoid bare ``pipeline(`` (Node streams).
+ */
+export declare const MODEL_LOAD_RE: RegExp;
+/**
+ * Per-item model inference inside a loop (Python ``inference_inside_loop`` twin).
+ * Prefer explicit predict/execute/session.run; avoid bare ``.run(`` / Node streams.
+ */
+export declare const INFERENCE_RE: RegExp;
+export declare function stripLineComment(line: string): string;
+export declare function hasApiCall(line: string): boolean;
+/**
+ * Walk lines updating brace depth; returns depth after processing ``line``.
+ * Also reports whether an opening `{` occurred on this line.
+ */
+export declare function advanceBraceDepth(line: string, braceDepth: number): {
+    braceDepth: number;
+    openedBrace: boolean;
+};
+export type LoopBodyVisitor = (input: {
+    line: string;
+    lineNo: number;
+    inLoop: boolean;
+    /** Nested for/while depth (same-line `{` headers only, matching prior heuristic). */
+    loopDepth: number;
+}) => void;
+/**
+ * Invoke ``visit`` for each line; ``inLoop`` is true inside for/while bodies.
+ * Tracks nested loop depth when headers open a brace on the same line.
+ */
+export declare function forEachSourceLine(source: string, visit: LoopBodyVisitor): void;

package/dist/analyze/heuristicScan.js

@@ -0,0 +1,91 @@
+/**
+ * Shared heuristic helpers for MP4 JS/TS resource detectors.
+ * Not a TypeScript AST — line + brace-depth only.
+ */
+/** HTTP / paid API call sites commonly metered as external_api. */
+export const API_CALL_RE = /\b(?:fetch|axios(?:\.(?:get|post|put|delete|patch|request|head|options))?|got|request|openai|anthropic|stripe|cohere|mistral|groq|replicate|huggingface|together|bedrock|sagemaker|twilio|sendgrid|pinecone|@aws-sdk)\b|\bhttps?\.(?:get|request)\s*\(/i;
+/** Retry-ish for/while headers (Python attempt|retry|tries twin). */
+export const RETRY_HEADER_RE = /^\s*(?:for|while)\s*\([^;)]*(?:\battempt\b|\bretry\b|\btries\b|\bretries\b|\bmaxRetries\b|\bmax_retries\b)[^)]*\)/i;
+/** Plain for/while loop header (any). */
+export const LOOP_HEADER_RE = /^\s*(?:for|while)\s*\(/i;
+/** Array iteration that behaves like a Python comprehension for fan-out cost. */
+export const COMPREHENSION_RE = /\.(?:map|flatMap|filter|forEach)\s*\(/i;
+/** Unbounded concurrent fan-out (JS twin of asyncio.gather). */
+export const PROMISE_ALL_RE = /\bPromise\.all(?:Settled)?\s*\(/i;
+/** Sleep / delay polling (Python sleep_polling twin). */
+export const SLEEP_POLL_RE = /\b(?:setTimeout|setInterval|Atomics\.wait)\s*\(|\b(?:Bun\.sleep|await\s+(?:delay|sleep|wait)\s*\()/i;
+/** RegExp compiled inside a hot path (Python regex_compile_in_loop twin). */
+export const REGEX_COMPILE_RE = /\bnew\s+RegExp\s*\(/;
+/** String concat growth in a loop (Python string_concat_in_loop twin). */
+export const STRING_CONCAT_RE = /\w+\s*\+=\s*(?:['"`]|String\s*\()/;
+/** child_process style spawn/exec (Python subprocess_in_loop twin). */
+export const SUBPROCESS_RE = /\b(?:exec(?:File)?(?:Sync)?|spawn(?:Sync)?|fork)\s*\(/;
+/** Whole-file reads (fs) — loop reuse → repeated_file_reads. */
+export const FILE_READ_RE = /\b(?:readFileSync|readFile)\s*\(|\bfs\.promises\.readFile\s*\(|\bpromises\.readFile\s*\(/;
+/**
+ * Per-item array lookup (JS twin of Python ``unvectorized_nested_loops``).
+ * Meaningful when nested loop depth ≥ 2.
+ */
+export const NESTED_LOOKUP_RE = /\.\s*(?:find|includes|indexOf|lastIndexOf)\s*\(/;
+/**
+ * Model / runtime load inside a loop (Python ``model_load_in_loop`` twin).
+ * Prefer explicit loader APIs; avoid bare ``pipeline(`` (Node streams).
+ */
+export const MODEL_LOAD_RE = /\b(?:loadLayersModel|loadGraphModel|from_pretrained|loadModel)\s*\(|\bInferenceSession\.create\s*\(|\b(?:tf|ort)\.(?:loadLayersModel|loadGraphModel|InferenceSession)\b|\brequire\(\s*['"](?:@tensorflow\/(?:tfjs(?:-node)?)|onnxruntime(?:-node|-web)?|@xenova\/transformers|@huggingface\/transformers)['"]\s*\)|\bimport\(\s*['"](?:@tensorflow\/(?:tfjs(?:-node)?)|onnxruntime(?:-node|-web)?|@xenova\/transformers|@huggingface\/transformers)['"]\s*\)/;
+/**
+ * Per-item model inference inside a loop (Python ``inference_inside_loop`` twin).
+ * Prefer explicit predict/execute/session.run; avoid bare ``.run(`` / Node streams.
+ */
+export const INFERENCE_RE = /\.\s*(?:predict(?:OnBatch)?|executeAsync|forward)\s*\(|\b(?:session|ortSession|inferenceSession|ort)\.run\s*\(/i;
+export function stripLineComment(line) {
+    const idx = line.indexOf('//');
+    return idx >= 0 ? line.slice(0, idx) : line;
+}
+export function hasApiCall(line) {
+    return API_CALL_RE.test(line);
+}
+/**
+ * Walk lines updating brace depth; returns depth after processing ``line``.
+ * Also reports whether an opening `{` occurred on this line.
+ */
+export function advanceBraceDepth(line, braceDepth) {
+    let depth = braceDepth;
+    let openedBrace = false;
+    for (let c = 0; c < line.length; c += 1) {
+        const ch = line[c];
+        if (ch === '{') {
+            depth += 1;
+            openedBrace = true;
+        }
+        else if (ch === '}') {
+            depth = Math.max(0, depth - 1);
+        }
+    }
+    return { braceDepth: depth, openedBrace };
+}
+/**
+ * Invoke ``visit`` for each line; ``inLoop`` is true inside for/while bodies.
+ * Tracks nested loop depth when headers open a brace on the same line.
+ */
+export function forEachSourceLine(source, visit) {
+    const lines = source.split(/\r?\n/);
+    let braceDepth = 0;
+    /** Exit thresholds: leave loop when braceDepth ≤ entry. */
+    const loopStack = [];
+    for (let i = 0; i < lines.length; i += 1) {
+        const line = stripLineComment(lines[i] ?? '');
+        const lineNo = i + 1;
+        const isLoopHeader = LOOP_HEADER_RE.test(line);
+        const before = braceDepth;
+        const { braceDepth: next, openedBrace } = advanceBraceDepth(line, braceDepth);
+        if (isLoopHeader && openedBrace) {
+            loopStack.push(before);
+        }
+        braceDepth = next;
+        while (loopStack.length > 0 && braceDepth <= loopStack[loopStack.length - 1]) {
+            loopStack.pop();
+        }
+        const loopDepth = loopStack.length;
+        visit({ line, lineNo, inLoop: loopDepth > 0, loopDepth });
+    }
+}

package/dist/analyze/index.d.ts

@@ -0,0 +1,15 @@
+export { buildServiceManifest, detectFrameworks, extractServiceUnits, isServiceProject, type ServiceEndpointUnit, type ServiceFileExtraction, type ServiceManifestV0, type ServiceTaskUnit, } from './serviceDiscovery.js';
+export { buildServiceManifestFromPaths, listCandidateSourceFiles, type ListCandidateSourceFilesOptions, } from './projectScan.js';
+export { NON_RESOURCE_CATEGORIES, RESOURCE_DOMAINS, admitAnalyzeCandidate, isNonResourceCategory, type AdmissionDecision, type NonResourceCategory, type ResourceDomain, } from './resourceAdmission.js';
+export { languageForPath, toResourceFindingCandidate, type ResourceCandidateHit, type ResourceFindingCandidateV1, type ResourcePrimaryDomain, } from './resourceFindingCandidate.js';
+export { detectRetryAmplificationHits } from './retryAmplificationDetector.js';
+export { detectApiOverconsumptionHits } from './apiOverconsumptionDetector.js';
+export { detectUnboundedParallelismHits } from './unboundedParallelismDetector.js';
+export { detectInferenceInsideLoopHits, detectModelLoadInLoopHits, detectPollingIdleHits, detectPerItemInsteadOfBatchHits, detectProcessChurnHits, detectRepeatedWorkHits, } from './cpuResourceDetectors.js';
+export { detectFullDatasetInMemoryHits, detectRepeatedFileReadHits, } from './memoryIoDetectors.js';
+export { detectAllHitsAst, detectHotPathHitsAst, detectApiOverconsumptionHitsAst, detectPollingIdleHitsAst, detectProcessChurnHitsAst, detectRepeatedFileReadHitsAst, detectRepeatedWorkHitsAst, detectRetryAmplificationHitsAst, detectUnboundedParallelismHitsAst, detectFullDatasetInMemoryHitsAst, detectPerItemInsteadOfBatchHitsAst, detectModelLoadInLoopHitsAst, detectInferenceInsideLoopHitsAst, type AstHitBundle, } from './astDetectors.js';
+export { collectPreferAstHits, detectApiOverconsumptionHitsPreferAst, detectPollingIdleHitsPreferAst, detectProcessChurnHitsPreferAst, detectRepeatedFileReadHitsPreferAst, detectRepeatedWorkHitsPreferAst, detectRetryAmplificationHitsPreferAst, detectUnboundedParallelismHitsPreferAst, detectFullDatasetInMemoryHitsPreferAst, detectPerItemInsteadOfBatchHitsPreferAst, detectModelLoadInLoopHitsPreferAst, detectInferenceInsideLoopHitsPreferAst, } from './preferAstDetectors.js';
+export { isTypescriptAnalyzeAvailable, tryLoadTypescript, } from './loadTypescript.js';
+export { allResourceFindingsValid, filterValidResourceFindings, validateResourceFindingCandidate, type ResourceFindingValidation, type ResourceFindingValidationError, } from './validateResourceFinding.js';
+export { buildAnalyzeGateSummary, countGateFindings, findingsExceedFailThreshold, formatAnalyzeGateFailureMessage, resolveAnalyzeGateLimit, type AnalyzeGateLimit, type AnalyzeGateSummaryV0, } from './analyzeGate.js';
+export { buildResourceAnalyzeResultFromPaths, buildResourceFindingsFromSources, type BuildResourceFindingsOptions, type ResourceAnalyzeResultV0, } from './buildResourceFindings.js';

package/dist/analyze/index.js

@@ -0,0 +1,15 @@
+export { buildServiceManifest, detectFrameworks, extractServiceUnits, isServiceProject, } from './serviceDiscovery.js';
+export { buildServiceManifestFromPaths, listCandidateSourceFiles, } from './projectScan.js';
+export { NON_RESOURCE_CATEGORIES, RESOURCE_DOMAINS, admitAnalyzeCandidate, isNonResourceCategory, } from './resourceAdmission.js';
+export { languageForPath, toResourceFindingCandidate, } from './resourceFindingCandidate.js';
+export { detectRetryAmplificationHits } from './retryAmplificationDetector.js';
+export { detectApiOverconsumptionHits } from './apiOverconsumptionDetector.js';
+export { detectUnboundedParallelismHits } from './unboundedParallelismDetector.js';
+export { detectInferenceInsideLoopHits, detectModelLoadInLoopHits, detectPollingIdleHits, detectPerItemInsteadOfBatchHits, detectProcessChurnHits, detectRepeatedWorkHits, } from './cpuResourceDetectors.js';
+export { detectFullDatasetInMemoryHits, detectRepeatedFileReadHits, } from './memoryIoDetectors.js';
+export { detectAllHitsAst, detectHotPathHitsAst, detectApiOverconsumptionHitsAst, detectPollingIdleHitsAst, detectProcessChurnHitsAst, detectRepeatedFileReadHitsAst, detectRepeatedWorkHitsAst, detectRetryAmplificationHitsAst, detectUnboundedParallelismHitsAst, detectFullDatasetInMemoryHitsAst, detectPerItemInsteadOfBatchHitsAst, detectModelLoadInLoopHitsAst, detectInferenceInsideLoopHitsAst, } from './astDetectors.js';
+export { collectPreferAstHits, detectApiOverconsumptionHitsPreferAst, detectPollingIdleHitsPreferAst, detectProcessChurnHitsPreferAst, detectRepeatedFileReadHitsPreferAst, detectRepeatedWorkHitsPreferAst, detectRetryAmplificationHitsPreferAst, detectUnboundedParallelismHitsPreferAst, detectFullDatasetInMemoryHitsPreferAst, detectPerItemInsteadOfBatchHitsPreferAst, detectModelLoadInLoopHitsPreferAst, detectInferenceInsideLoopHitsPreferAst, } from './preferAstDetectors.js';
+export { isTypescriptAnalyzeAvailable, tryLoadTypescript, } from './loadTypescript.js';
+export { allResourceFindingsValid, filterValidResourceFindings, validateResourceFindingCandidate, } from './validateResourceFinding.js';
+export { buildAnalyzeGateSummary, countGateFindings, findingsExceedFailThreshold, formatAnalyzeGateFailureMessage, resolveAnalyzeGateLimit, } from './analyzeGate.js';
+export { buildResourceAnalyzeResultFromPaths, buildResourceFindingsFromSources, } from './buildResourceFindings.js';

package/dist/analyze/loadTypescript.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Optional TypeScript compiler API loader for Analyze AST detectors.
+ * Missing ``typescript`` → callers fall back to heuristics (no hard dep).
+ */
+export type TypescriptApi = typeof import('typescript');
+/** Return typescript module or null when unavailable. */
+export declare function tryLoadTypescript(): TypescriptApi | null;
+export declare function isTypescriptAnalyzeAvailable(): boolean;

package/dist/analyze/loadTypescript.js

@@ -0,0 +1,23 @@
+/**
+ * Optional TypeScript compiler API loader for Analyze AST detectors.
+ * Missing ``typescript`` → callers fall back to heuristics (no hard dep).
+ */
+import { createRequire } from 'node:module';
+let cached;
+/** Return typescript module or null when unavailable. */
+export function tryLoadTypescript() {
+    if (cached !== undefined)
+        return cached;
+    try {
+        const require = createRequire(import.meta.url);
+        cached = require('typescript');
+        return cached;
+    }
+    catch {
+        cached = null;
+        return null;
+    }
+}
+export function isTypescriptAnalyzeAvailable() {
+    return tryLoadTypescript() !== null;
+}

package/dist/analyze/memoryIoDetectors.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Heuristic JS/TS twins for memory / storage RD0 candidate_map rules:
+ *   - repeated_file_reads → repeated_work / storage.io
+ *   - full_dataset_in_memory → memory_retention_or_materialization / memory.host
+ */
+import { type ResourceCandidateHit } from './resourceFindingCandidate.js';
+/**
+ * Python ``repeated_file_reads`` twin — fs read inside a loop.
+ */
+export declare function detectRepeatedFileReadHits(source: string, relPath: string): ResourceCandidateHit[];
+/**
+ * Python ``full_dataset_in_memory`` twin — load+parse entire file payload.
+ * Flags JSON.parse(readFile…) on one line, or readFile then JSON.parse within 2 lines.
+ */
+export declare function detectFullDatasetInMemoryHits(source: string, relPath: string): ResourceCandidateHit[];