@oxog/codeguardian 1.0.0

package/dist/cli.cjs

@@ -0,0 +1,3498 @@
+#!/usr/bin/env node
+'use strict';
+
+var path8 = require('path');
+var ts2 = require('typescript');
+var fs2 = require('fs');
+var child_process = require('child_process');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var path8__namespace = /*#__PURE__*/_interopNamespace(path8);
+var ts2__default = /*#__PURE__*/_interopDefault(ts2);
+var fs2__namespace = /*#__PURE__*/_interopNamespace(fs2);
+
+// src/utils/args.ts
+function parseArgs(argv) {
+  const result = {
+    command: "",
+    flags: {},
+    positional: []
+  };
+  let i = 0;
+  while (i < argv.length) {
+    const arg = argv[i];
+    if (!arg.startsWith("-")) {
+      result.command = arg;
+      i++;
+      break;
+    }
+    i++;
+  }
+  while (i < argv.length) {
+    const arg = argv[i];
+    if (arg.startsWith("--")) {
+      const key = arg.slice(2);
+      const eqIndex = key.indexOf("=");
+      if (eqIndex !== -1) {
+        const name = key.slice(0, eqIndex);
+        const value = key.slice(eqIndex + 1);
+        if (name) {
+          result.flags[name] = value;
+        }
+      } else {
+        const next = argv[i + 1];
+        if (next !== void 0 && !next.startsWith("-")) {
+          result.flags[key] = next;
+          i++;
+        } else {
+          result.flags[key] = true;
+        }
+      }
+    } else if (arg.startsWith("-")) {
+      const key = arg.slice(1);
+      const next = argv[i + 1];
+      if (next !== void 0 && !next.startsWith("-")) {
+        result.flags[key] = next;
+        i++;
+      } else {
+        result.flags[key] = true;
+      }
+    } else {
+      result.positional.push(arg);
+    }
+    i++;
+  }
+  return result;
+}
+
+// src/utils/color.ts
+var isColorSupported = () => {
+  if (typeof process !== "undefined") {
+    if (process.env["NO_COLOR"] !== void 0) return false;
+    if (process.env["FORCE_COLOR"] !== void 0) return true;
+    if (process.stdout && "isTTY" in process.stdout) return !!process.stdout.isTTY;
+  }
+  return false;
+};
+var enabled = isColorSupported();
+var wrap = (open, close) => {
+  if (!enabled) return (str) => str;
+  return (str) => `\x1B[${open}m${str}\x1B[${close}m`;
+};
+var color = {
+  /** Check if colors are enabled */
+  enabled,
+  // Modifiers
+  bold: wrap("1", "22"),
+  dim: wrap("2", "22"),
+  italic: wrap("3", "23"),
+  underline: wrap("4", "24"),
+  // Colors
+  red: wrap("31", "39"),
+  green: wrap("32", "39"),
+  yellow: wrap("33", "39"),
+  blue: wrap("34", "39"),
+  magenta: wrap("35", "39"),
+  cyan: wrap("36", "39"),
+  white: wrap("37", "39"),
+  gray: wrap("90", "39"),
+  // Background
+  bgRed: wrap("41", "49"),
+  bgGreen: wrap("42", "49"),
+  bgYellow: wrap("43", "49"),
+  bgBlue: wrap("44", "49")
+};
+
+// src/errors.ts
+var CodeGuardianError = class extends Error {
+  code;
+  context;
+  constructor(message, code, context) {
+    super(message);
+    this.name = "CodeGuardianError";
+    this.code = code;
+    this.context = context;
+  }
+};
+var ConfigError = class extends CodeGuardianError {
+  constructor(message, context) {
+    super(message, "CONFIG_ERROR", context);
+    this.name = "ConfigError";
+  }
+};
+var ParseError = class extends CodeGuardianError {
+  constructor(message, context) {
+    super(message, "PARSE_ERROR", context);
+    this.name = "ParseError";
+  }
+};
+var PluginError = class extends CodeGuardianError {
+  constructor(message, context) {
+    super(message, "PLUGIN_ERROR", context);
+    this.name = "PluginError";
+  }
+};
+var GraphError = class extends CodeGuardianError {
+  constructor(message, context) {
+    super(message, "GRAPH_ERROR", context);
+    this.name = "GraphError";
+  }
+};
+var GitError = class extends CodeGuardianError {
+  constructor(message, context) {
+    super(message, "GIT_ERROR", context);
+    this.name = "GitError";
+  }
+};
+
+// src/kernel.ts
+function createKernel() {
+  const plugins = /* @__PURE__ */ new Map();
+  const rules = /* @__PURE__ */ new Map();
+  function createKernelAdapter(config) {
+    return {
+      registerRule(rule) {
+        if (rules.has(rule.name)) {
+          throw new PluginError(`Rule "${rule.name}" is already registered`, {
+            rule: rule.name
+          });
+        }
+        rules.set(rule.name, rule);
+      },
+      unregisterRule(name) {
+        rules.delete(name);
+      },
+      getRules() {
+        return Array.from(rules.values());
+      },
+      getConfig() {
+        return config;
+      }
+    };
+  }
+  return {
+    /**
+     * Install a plugin into the kernel.
+     *
+     * @example
+     * ```typescript
+     * kernel.installPlugin(architecturePlugin({ layers: [...] }));
+     * ```
+     */
+    installPlugin(plugin, config) {
+      if (plugins.has(plugin.name)) {
+        throw new PluginError(`Plugin "${plugin.name}" is already installed`, {
+          plugin: plugin.name
+        });
+      }
+      if (plugin.dependencies) {
+        for (const dep of plugin.dependencies) {
+          if (!plugins.has(dep)) {
+            throw new PluginError(
+              `Plugin "${plugin.name}" depends on "${dep}" which is not installed`,
+              { plugin: plugin.name, dependency: dep }
+            );
+          }
+        }
+      }
+      const adapter = createKernelAdapter(config ?? {});
+      try {
+        plugin.install(adapter);
+        plugins.set(plugin.name, plugin);
+      } catch (err) {
+        if (plugin.onError && err instanceof Error) {
+          plugin.onError(err);
+        }
+        throw new PluginError(
+          `Failed to install plugin "${plugin.name}": ${err instanceof Error ? err.message : String(err)}`,
+          { plugin: plugin.name }
+        );
+      }
+    },
+    /**
+     * Uninstall a plugin from the kernel.
+     */
+    async uninstallPlugin(name) {
+      const plugin = plugins.get(name);
+      if (!plugin) return;
+      const prefix = name + "/";
+      for (const [ruleName] of rules) {
+        if (ruleName.startsWith(prefix)) {
+          rules.delete(ruleName);
+        }
+      }
+      if (plugin.onDestroy) {
+        await plugin.onDestroy();
+      }
+      plugins.delete(name);
+    },
+    /**
+     * Initialize all plugins with the built graph.
+     */
+    async initPlugins(graph) {
+      for (const plugin of plugins.values()) {
+        if (plugin.onInit) {
+          try {
+            await plugin.onInit(graph);
+          } catch (err) {
+            if (plugin.onError && err instanceof Error) {
+              plugin.onError(err);
+            }
+          }
+        }
+      }
+    },
+    /**
+     * Get all registered rules.
+     */
+    getRules() {
+      return Array.from(rules.values());
+    },
+    /**
+     * Get all installed plugin names.
+     */
+    getPluginNames() {
+      return Array.from(plugins.keys());
+    },
+    /**
+     * Check if a plugin is installed.
+     */
+    hasPlugin(name) {
+      return plugins.has(name);
+    },
+    /**
+     * Get the number of registered rules.
+     */
+    getRuleCount() {
+      return rules.size;
+    }
+  };
+}
+function readFileSync2(filePath) {
+  return fs2__namespace.readFileSync(filePath, "utf-8");
+}
+function writeFileSync2(filePath, content) {
+  const dir = path8__namespace.dirname(filePath);
+  if (!fs2__namespace.existsSync(dir)) {
+    fs2__namespace.mkdirSync(dir, { recursive: true });
+  }
+  fs2__namespace.writeFileSync(filePath, content, "utf-8");
+}
+function fileExists(filePath) {
+  return fs2__namespace.existsSync(filePath);
+}
+function readJsonSync(filePath) {
+  const content = readFileSync2(filePath);
+  return JSON.parse(content);
+}
+function writeJsonSync(filePath, data) {
+  writeFileSync2(filePath, JSON.stringify(data, null, 2));
+}
+function normalizePath(filePath) {
+  return filePath.replace(/\\/g, "/");
+}
+function relativePath(rootDir, filePath) {
+  return normalizePath(path8__namespace.relative(rootDir, filePath));
+}
+
+// src/ast/parser.ts
+function createTSProgram(rootDir, tsconfigPath) {
+  const configPath = path8__namespace.resolve(rootDir, tsconfigPath);
+  const configFile = ts2__default.default.readConfigFile(configPath, (p) => readFileSync2(p));
+  if (configFile.error) {
+    throw new ParseError(`Failed to read tsconfig: ${configFile.error.messageText}`, {
+      file: configPath
+    });
+  }
+  const parsed = ts2__default.default.parseJsonConfigFileContent(
+    configFile.config,
+    ts2__default.default.sys,
+    rootDir
+  );
+  if (parsed.errors.length > 0) {
+    const messages = parsed.errors.map((e) => typeof e.messageText === "string" ? e.messageText : e.messageText.messageText).join(", ");
+    throw new ParseError(`tsconfig parse errors: ${messages}`, { file: configPath });
+  }
+  return ts2__default.default.createProgram({
+    rootNames: parsed.fileNames,
+    options: parsed.options
+  });
+}
+function parseFile(filePath, content) {
+  const source = readFileSync2(filePath);
+  const sourceFile = ts2__default.default.createSourceFile(
+    filePath,
+    source,
+    ts2__default.default.ScriptTarget.ES2022,
+    true,
+    ts2__default.default.ScriptKind.TS
+  );
+  return sourceFile;
+}
+function getSourceFiles(program) {
+  return program.getSourceFiles().filter((sf) => !sf.isDeclarationFile && !sf.fileName.includes("node_modules")).map((sf) => sf.fileName);
+}
+function isCallTo(node, name) {
+  const expr = node.expression;
+  if (ts2__default.default.isIdentifier(expr)) {
+    return expr.text === name;
+  }
+  if (ts2__default.default.isPropertyAccessExpression(expr)) {
+    return expr.name.text === name;
+  }
+  return false;
+}
+function isConsoleCall(node, method) {
+  const expr = node.expression;
+  if (ts2__default.default.isPropertyAccessExpression(expr)) {
+    if (ts2__default.default.isIdentifier(expr.expression) && expr.expression.text === "console") {
+      if (method) {
+        return expr.name.text === method;
+      }
+      return true;
+    }
+  }
+  return false;
+}
+function getTypeString(node, checker) {
+  try {
+    const type = checker.getTypeAtLocation(node);
+    return checker.typeToString(type);
+  } catch {
+    return "unknown";
+  }
+}
+function hasStringConcat(node) {
+  if (ts2__default.default.isTemplateExpression(node)) {
+    return true;
+  }
+  if (ts2__default.default.isBinaryExpression(node) && node.operatorToken.kind === ts2__default.default.SyntaxKind.PlusToken) {
+    if (ts2__default.default.isStringLiteral(node.left) || ts2__default.default.isStringLiteral(node.right)) {
+      return true;
+    }
+    if (ts2__default.default.isTemplateExpression(node.left) || ts2__default.default.isTemplateExpression(node.right)) {
+      return true;
+    }
+  }
+  let found = false;
+  ts2__default.default.forEachChild(node, (child) => {
+    if (!found && hasStringConcat(child)) {
+      found = true;
+    }
+  });
+  return found;
+}
+function extractImports(sourceFile) {
+  const imports = [];
+  for (const stmt of sourceFile.statements) {
+    if (ts2__default.default.isImportDeclaration(stmt)) {
+      const moduleSpecifier = stmt.moduleSpecifier;
+      if (!ts2__default.default.isStringLiteral(moduleSpecifier)) continue;
+      const source = moduleSpecifier.text;
+      const isTypeOnly = stmt.importClause?.isTypeOnly ?? false;
+      const specifiers = [];
+      if (stmt.importClause) {
+        if (stmt.importClause.name) {
+          specifiers.push(stmt.importClause.name.text);
+        }
+        const namedBindings = stmt.importClause.namedBindings;
+        if (namedBindings) {
+          if (ts2__default.default.isNamedImports(namedBindings)) {
+            for (const element of namedBindings.elements) {
+              specifiers.push(element.name.text);
+            }
+          } else if (ts2__default.default.isNamespaceImport(namedBindings)) {
+            specifiers.push(namedBindings.name.text);
+          }
+        }
+      }
+      imports.push({ source, specifiers, isTypeOnly });
+    }
+  }
+  return imports;
+}
+function extractExports(sourceFile) {
+  const exports$1 = [];
+  for (const stmt of sourceFile.statements) {
+    if (hasExportModifier(stmt)) {
+      if (ts2__default.default.isFunctionDeclaration(stmt) && stmt.name) {
+        exports$1.push(stmt.name.text);
+      } else if (ts2__default.default.isClassDeclaration(stmt) && stmt.name) {
+        exports$1.push(stmt.name.text);
+      } else if (ts2__default.default.isInterfaceDeclaration(stmt)) {
+        exports$1.push(stmt.name.text);
+      } else if (ts2__default.default.isTypeAliasDeclaration(stmt)) {
+        exports$1.push(stmt.name.text);
+      } else if (ts2__default.default.isEnumDeclaration(stmt)) {
+        exports$1.push(stmt.name.text);
+      } else if (ts2__default.default.isVariableStatement(stmt)) {
+        for (const decl of stmt.declarationList.declarations) {
+          if (ts2__default.default.isIdentifier(decl.name)) {
+            exports$1.push(decl.name.text);
+          }
+        }
+      }
+    }
+    if (ts2__default.default.isExportDeclaration(stmt) && stmt.exportClause && ts2__default.default.isNamedExports(stmt.exportClause)) {
+      for (const element of stmt.exportClause.elements) {
+        exports$1.push(element.name.text);
+      }
+    }
+    if (ts2__default.default.isExportAssignment(stmt)) {
+      exports$1.push("default");
+    }
+  }
+  return exports$1;
+}
+function hasExportModifier(node) {
+  const modifiers = ts2__default.default.canHaveModifiers(node) ? ts2__default.default.getModifiers(node) : void 0;
+  return modifiers?.some((m) => m.kind === ts2__default.default.SyntaxKind.ExportKeyword) ?? false;
+}
+function extractFunctions(sourceFile, filePath) {
+  const functions = [];
+  const visit = (node) => {
+    if (ts2__default.default.isFunctionDeclaration(node) && node.name) {
+      functions.push(buildFunctionInfo(node, node.name.text, sourceFile));
+    } else if (ts2__default.default.isMethodDeclaration(node) && ts2__default.default.isIdentifier(node.name)) {
+      functions.push(buildFunctionInfo(node, node.name.text, sourceFile));
+    } else if (ts2__default.default.isArrowFunction(node)) {
+      const parent = node.parent;
+      if (ts2__default.default.isVariableDeclaration(parent) && ts2__default.default.isIdentifier(parent.name)) {
+        functions.push(buildFunctionInfo(node, parent.name.text, sourceFile));
+      }
+    } else if (ts2__default.default.isFunctionExpression(node)) {
+      const parent = node.parent;
+      if (ts2__default.default.isVariableDeclaration(parent) && ts2__default.default.isIdentifier(parent.name)) {
+        functions.push(buildFunctionInfo(node, parent.name.text, sourceFile));
+      }
+    }
+    ts2__default.default.forEachChild(node, visit);
+  };
+  ts2__default.default.forEachChild(sourceFile, visit);
+  return functions;
+}
+function buildFunctionInfo(node, name, sourceFile, _filePath) {
+  const startLine = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
+  const endLine = sourceFile.getLineAndCharacterOfPosition(node.getEnd()).line + 1;
+  const params = node.parameters.map((p) => ({
+    name: ts2__default.default.isIdentifier(p.name) ? p.name.text : p.name.getText(sourceFile),
+    type: p.type ? p.type.getText(sourceFile) : "any",
+    optional: !!p.questionToken || !!p.initializer
+  }));
+  const returnType = node.type ? node.type.getText(sourceFile) : "void";
+  const modifiers = ts2__default.default.canHaveModifiers(node) ? ts2__default.default.getModifiers(node) : void 0;
+  const isAsync = modifiers?.some((m) => m.kind === ts2__default.default.SyntaxKind.AsyncKeyword) ?? false;
+  return {
+    name,
+    startLine,
+    endLine,
+    params,
+    returnType,
+    isAsync,
+    node
+  };
+}
+function walkAST(node, visitors) {
+  const kindName = ts2__default.default.SyntaxKind[node.kind];
+  let visitor = kindName !== void 0 ? visitors[kindName] : void 0;
+  if (!visitor) {
+    for (const key of Object.keys(visitors)) {
+      if (ts2__default.default.SyntaxKind[key] === node.kind) {
+        visitor = visitors[key];
+        break;
+      }
+    }
+  }
+  if (visitor) {
+    visitor(node);
+  }
+  ts2__default.default.forEachChild(node, (child) => walkAST(child, visitors));
+}
+function calculateComplexity(node) {
+  let complexity = 1;
+  const visit = (child) => {
+    switch (child.kind) {
+      case ts2__default.default.SyntaxKind.IfStatement:
+      case ts2__default.default.SyntaxKind.ForStatement:
+      case ts2__default.default.SyntaxKind.ForInStatement:
+      case ts2__default.default.SyntaxKind.ForOfStatement:
+      case ts2__default.default.SyntaxKind.WhileStatement:
+      case ts2__default.default.SyntaxKind.DoStatement:
+      case ts2__default.default.SyntaxKind.CatchClause:
+      case ts2__default.default.SyntaxKind.ConditionalExpression:
+        complexity++;
+        break;
+      case ts2__default.default.SyntaxKind.CaseClause:
+        complexity++;
+        break;
+      case ts2__default.default.SyntaxKind.BinaryExpression: {
+        const binExpr = child;
+        if (binExpr.operatorToken.kind === ts2__default.default.SyntaxKind.AmpersandAmpersandToken || binExpr.operatorToken.kind === ts2__default.default.SyntaxKind.BarBarToken || binExpr.operatorToken.kind === ts2__default.default.SyntaxKind.QuestionQuestionToken) {
+          complexity++;
+        }
+        break;
+      }
+    }
+    ts2__default.default.forEachChild(child, visit);
+  };
+  ts2__default.default.forEachChild(node, visit);
+  return complexity;
+}
+function countLOC(sourceFile) {
+  const text = sourceFile.getFullText();
+  const lines = text.split("\n");
+  let count = 0;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (trimmed.length > 0 && !trimmed.startsWith("//") && !trimmed.startsWith("/*") && !trimmed.startsWith("*")) {
+      count++;
+    }
+  }
+  return count;
+}
+
+// src/utils/glob.ts
+function globToRegex(pattern) {
+  let result = "";
+  let i = 0;
+  const len = pattern.length;
+  while (i < len) {
+    const c = pattern[i];
+    if (c === "*") {
+      if (pattern[i + 1] === "*") {
+        if (pattern[i + 2] === "/") {
+          result += "(?:.+/)?";
+          i += 3;
+        } else {
+          result += ".*";
+          i += 2;
+        }
+      } else {
+        result += "[^/]*";
+        i++;
+      }
+    } else if (c === "?") {
+      result += "[^/]";
+      i++;
+    } else if (c === "." || c === "(" || c === ")" || c === "{" || c === "}" || c === "[" || c === "]" || c === "+" || c === "^" || c === "$" || c === "|" || c === "\\") {
+      result += "\\" + c;
+      i++;
+    } else {
+      result += c;
+      i++;
+    }
+  }
+  return new RegExp(`^${result}$`);
+}
+function globMatch(filePath, pattern) {
+  const normalized = filePath.replace(/\\/g, "/");
+  const normalizedPattern = pattern.replace(/\\/g, "/");
+  const regex = globToRegex(normalizedPattern);
+  return regex.test(normalized);
+}
+function globMatchAny(filePath, patterns) {
+  return patterns.some((p) => globMatch(filePath, p));
+}
+
+// src/graph/builder.ts
+function buildGraph(rootDir, tsconfigPath, include, exclude, layers = ["controller", "service", "repository", "util"]) {
+  const program = createTSProgram(rootDir, tsconfigPath);
+  program.getTypeChecker();
+  const sourceFilePaths = getSourceFiles(program);
+  const graph = {
+    files: /* @__PURE__ */ new Map(),
+    symbols: /* @__PURE__ */ new Map(),
+    edges: [],
+    layers: buildLayerDefinitions(layers),
+    patterns: [],
+    dependencies: { adjacency: /* @__PURE__ */ new Map() }
+  };
+  const filteredPaths = sourceFilePaths.filter((fp) => {
+    const rel = relativePath(rootDir, fp);
+    const included = include.length === 0 || globMatchAny(rel, include);
+    const excluded = exclude.length > 0 && globMatchAny(rel, exclude);
+    return included && !excluded;
+  });
+  for (const filePath of filteredPaths) {
+    const sourceFile = program.getSourceFile(filePath);
+    if (!sourceFile) continue;
+    const relPath = relativePath(rootDir, filePath);
+    processFile(graph, sourceFile, relPath);
+  }
+  buildDependencyGraph(graph);
+  return graph;
+}
+function processFile(graph, sourceFile, relPath, rootDir, _checker) {
+  const imports = extractImports(sourceFile);
+  const exports$1 = extractExports(sourceFile);
+  const rawFunctions = extractFunctions(sourceFile);
+  const role = detectFileRole(relPath);
+  const layer = detectLayer(relPath);
+  const loc = countLOC(sourceFile);
+  const functions = rawFunctions.map((fn) => ({
+    name: fn.name,
+    file: relPath,
+    startLine: fn.startLine,
+    endLine: fn.endLine,
+    params: fn.params,
+    returnType: fn.returnType,
+    complexity: calculateComplexity(fn.node),
+    isAsync: fn.isAsync,
+    hasSideEffects: false,
+    issues: []
+  }));
+  const fileComplexity = functions.reduce((sum, fn) => sum + fn.complexity, 0);
+  const fileNode = {
+    path: relPath,
+    role,
+    layer,
+    exports: exports$1,
+    imports,
+    complexity: fileComplexity,
+    loc,
+    functions
+  };
+  graph.files.set(relPath, fileNode);
+  for (const exportName of exports$1) {
+    const symbolNode = {
+      name: exportName,
+      kind: "variable",
+      file: relPath,
+      usedBy: [],
+      dependsOn: [],
+      isPublicAPI: false
+    };
+    graph.symbols.set(`${relPath}:${exportName}`, symbolNode);
+  }
+  for (const imp of imports) {
+    const resolvedPath = resolveImportPath(relPath, imp.source);
+    if (resolvedPath) {
+      graph.edges.push({
+        from: relPath,
+        to: resolvedPath,
+        specifiers: imp.specifiers,
+        isTypeOnly: imp.isTypeOnly
+      });
+    }
+  }
+}
+function detectFileRole(filePath) {
+  const lower = filePath.toLowerCase();
+  if (/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(lower) || lower.includes("/tests/") || lower.includes("/__tests__/")) {
+    return "test";
+  }
+  if (lower.includes("/controller") || lower.includes(".controller.")) return "controller";
+  if (lower.includes("/service") || lower.includes(".service.")) return "service";
+  if (lower.includes("/repositor") || lower.includes(".repository.") || lower.includes(".repo.")) return "repository";
+  if (lower.includes("/util") || lower.includes("/helper") || lower.includes(".util.") || lower.includes(".helper.")) return "util";
+  if (lower.includes("/type") || lower.endsWith(".d.ts") || lower.includes(".types.")) return "type";
+  if (lower.includes("/config") || lower.includes(".config.")) return "config";
+  return "unknown";
+}
+function detectLayer(filePath) {
+  const lower = filePath.toLowerCase();
+  if (lower.includes("/controller")) return "controller";
+  if (lower.includes("/service")) return "service";
+  if (lower.includes("/repositor")) return "repository";
+  if (lower.includes("/util") || lower.includes("/helper")) return "util";
+  if (lower.includes("/middleware")) return "middleware";
+  if (lower.includes("/model")) return "model";
+  return "unknown";
+}
+function buildLayerDefinitions(layers) {
+  return layers.map((name, index) => ({
+    name,
+    order: index,
+    patterns: [`**/${name}s/**`, `**/${name}/**`, `**/*.${name}.*`]
+  }));
+}
+function resolveImportPath(fromFile, importSource, _rootDir) {
+  if (!importSource.startsWith(".") && !importSource.startsWith("/")) {
+    return void 0;
+  }
+  const fromDir = path8__namespace.dirname(fromFile);
+  let resolved = path8__namespace.posix.join(fromDir, importSource);
+  if (!resolved.endsWith(".ts") && !resolved.endsWith(".tsx") && !resolved.endsWith(".js")) {
+    resolved = resolved + ".ts";
+  }
+  return resolved.replace(/\\/g, "/");
+}
+function buildDependencyGraph(graph) {
+  const adjacency = /* @__PURE__ */ new Map();
+  for (const filePath of graph.files.keys()) {
+    adjacency.set(filePath, /* @__PURE__ */ new Set());
+  }
+  for (const edge of graph.edges) {
+    const deps = adjacency.get(edge.from);
+    if (deps) {
+      deps.add(edge.to);
+    }
+  }
+  for (const edge of graph.edges) {
+    for (const spec of edge.specifiers) {
+      const symbolKey = `${edge.to}:${spec}`;
+      const symbol = graph.symbols.get(symbolKey);
+      if (symbol) {
+        symbol.usedBy.push(edge.from);
+      }
+    }
+  }
+  graph.dependencies = { adjacency };
+}
+var GRAPH_VERSION = "1.0.0";
+function serializeGraph(graph) {
+  return {
+    version: GRAPH_VERSION,
+    timestamp: Date.now(),
+    files: Array.from(graph.files.entries()),
+    symbols: Array.from(graph.symbols.entries()),
+    edges: graph.edges,
+    layers: graph.layers,
+    patterns: graph.patterns,
+    adjacency: Array.from(graph.dependencies.adjacency.entries()).map(
+      ([key, value]) => [key, Array.from(value)]
+    )
+  };
+}
+function deserializeGraph(data) {
+  if (data.version !== GRAPH_VERSION) {
+    throw new GraphError(`Graph cache version mismatch: expected ${GRAPH_VERSION}, got ${data.version}`);
+  }
+  const adjacency = /* @__PURE__ */ new Map();
+  for (const [key, values] of data.adjacency) {
+    adjacency.set(key, new Set(values));
+  }
+  return {
+    files: new Map(data.files),
+    symbols: new Map(data.symbols),
+    edges: data.edges,
+    layers: data.layers,
+    patterns: data.patterns,
+    dependencies: { adjacency }
+  };
+}
+function saveGraphCache(rootDir, graph) {
+  const cachePath = path8__namespace.join(rootDir, ".codeguardian", "graph.json");
+  const serialized = serializeGraph(graph);
+  writeJsonSync(cachePath, serialized);
+}
+function loadGraphCache(rootDir) {
+  const cachePath = path8__namespace.join(rootDir, ".codeguardian", "graph.json");
+  if (!fileExists(cachePath)) {
+    return null;
+  }
+  try {
+    const data = readJsonSync(cachePath);
+    return deserializeGraph(data);
+  } catch {
+    return null;
+  }
+}
+function updateGraphIncremental(graph, changedFiles, rootDir, program) {
+  const checker = program.getTypeChecker();
+  const affectedFiles = /* @__PURE__ */ new Set();
+  for (const filePath of changedFiles) {
+    const relPath = filePath.startsWith(rootDir) ? relativePath(rootDir, filePath) : filePath;
+    const dependents = findDependents(graph, relPath);
+    for (const dep of dependents) {
+      affectedFiles.add(dep);
+    }
+    removeFileFromGraph(graph, relPath);
+    const absolutePath = path8__namespace.resolve(rootDir, relPath);
+    try {
+      const sourceFile = program.getSourceFile(absolutePath) ?? parseFile(absolutePath);
+      processFile(graph, sourceFile, relPath, rootDir, checker);
+    } catch {
+      continue;
+    }
+    affectedFiles.add(relPath);
+  }
+  rebuildAdjacency(graph);
+  return {
+    changedFiles,
+    affectedFiles: Array.from(affectedFiles),
+    graph
+  };
+}
+function removeFileFromGraph(graph, filePath) {
+  graph.files.delete(filePath);
+  const symbolKeysToDelete = [];
+  for (const [key, symbol] of graph.symbols) {
+    if (symbol.file === filePath) {
+      symbolKeysToDelete.push(key);
+    }
+  }
+  for (const key of symbolKeysToDelete) {
+    graph.symbols.delete(key);
+  }
+  graph.edges = graph.edges.filter(
+    (edge) => edge.from !== filePath && edge.to !== filePath
+  );
+  graph.dependencies.adjacency.delete(filePath);
+  for (const deps of graph.dependencies.adjacency.values()) {
+    deps.delete(filePath);
+  }
+}
+function findDependents(graph, filePath) {
+  const dependents = [];
+  for (const [file, deps] of graph.dependencies.adjacency) {
+    if (deps.has(filePath)) {
+      dependents.push(file);
+    }
+  }
+  return dependents;
+}
+function rebuildAdjacency(graph) {
+  const adjacency = /* @__PURE__ */ new Map();
+  for (const filePath of graph.files.keys()) {
+    adjacency.set(filePath, /* @__PURE__ */ new Set());
+  }
+  for (const edge of graph.edges) {
+    const deps = adjacency.get(edge.from);
+    if (deps) {
+      deps.add(edge.to);
+    }
+  }
+  graph.dependencies.adjacency = adjacency;
+}
+
+// src/graph/query.ts
+function getFile(graph, filePath) {
+  return graph.files.get(filePath);
+}
+function getSymbol(graph, name) {
+  for (const [, symbol] of graph.symbols) {
+    if (symbol.name === name) {
+      return symbol;
+    }
+  }
+  return void 0;
+}
+function getDependencies(graph, filePath) {
+  const deps = graph.dependencies.adjacency.get(filePath);
+  return deps ? Array.from(deps) : [];
+}
+function getDependents(graph, filePath) {
+  const dependents = [];
+  for (const [file, deps] of graph.dependencies.adjacency) {
+    if (deps.has(filePath)) {
+      dependents.push(file);
+    }
+  }
+  return dependents;
+}
+function findCircularDeps(graph) {
+  const cycles = [];
+  const visited = /* @__PURE__ */ new Set();
+  const inStack = /* @__PURE__ */ new Set();
+  const stack = [];
+  const dfs = (node) => {
+    if (inStack.has(node)) {
+      const cycleStart = stack.indexOf(node);
+      if (cycleStart !== -1) {
+        const cycle = [...stack.slice(cycleStart), node];
+        cycles.push(cycle);
+      }
+      return;
+    }
+    if (visited.has(node)) return;
+    visited.add(node);
+    inStack.add(node);
+    stack.push(node);
+    const deps = graph.dependencies.adjacency.get(node);
+    if (deps) {
+      for (const dep of deps) {
+        dfs(dep);
+      }
+    }
+    stack.pop();
+    inStack.delete(node);
+  };
+  for (const node of graph.dependencies.adjacency.keys()) {
+    dfs(node);
+  }
+  return cycles;
+}
+function getGraphStats(graph) {
+  let totalFunctions = 0;
+  let totalLOC = 0;
+  let totalComplexity = 0;
+  const filesByRole = {};
+  const filesByLayer = {};
+  for (const file of graph.files.values()) {
+    totalFunctions += file.functions.length;
+    totalLOC += file.loc;
+    totalComplexity += file.complexity;
+    filesByRole[file.role] = (filesByRole[file.role] ?? 0) + 1;
+    filesByLayer[file.layer] = (filesByLayer[file.layer] ?? 0) + 1;
+  }
+  const fileCount = graph.files.size;
+  return {
+    totalFiles: fileCount,
+    totalSymbols: graph.symbols.size,
+    totalEdges: graph.edges.length,
+    totalFunctions,
+    totalLOC,
+    avgComplexity: fileCount > 0 ? totalComplexity / fileCount : 0,
+    filesByRole,
+    filesByLayer
+  };
+}
+
+// src/rules/context.ts
+function createRuleContext(file, ast, graph, program, checker, pluginConfig = {}) {
+  return {
+    file,
+    ast,
+    graph,
+    program,
+    checker,
+    walk(node, visitors) {
+      walkAST(node, visitors);
+    },
+    isCallTo(node, name) {
+      return isCallTo(node, name);
+    },
+    isConsoleCall(node, method) {
+      return isConsoleCall(node, method);
+    },
+    getTypeString(node) {
+      return getTypeString(node, checker);
+    },
+    hasStringConcat(node) {
+      return hasStringConcat(node);
+    },
+    getImports() {
+      return extractImports(ast);
+    },
+    isExternallyUsed(symbolName) {
+      const symbolKey = `${file.path}:${symbolName}`;
+      const symbol = graph.symbols.get(symbolKey);
+      if (!symbol) return false;
+      return symbol.usedBy.length > 0;
+    },
+    config: pluginConfig
+  };
+}
+
+// src/rules/suppression.ts
+function parseSuppressions(sourceFile) {
+  const directives = [];
+  const text = sourceFile.getFullText();
+  const lines = text.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i].trim();
+    const match = line.match(
+      /\/\/\s*codeguardian-(disable-next-line|disable|enable)\s+(.*)/
+    );
+    if (!match) continue;
+    const type = match[1];
+    const rest = match[2].trim();
+    const reasonSplit = rest.split("--");
+    const rulesPart = reasonSplit[0].trim();
+    const reason = reasonSplit[1]?.trim();
+    const rules = rulesPart.split(/\s+/).filter((r) => r.length > 0);
+    if (rules.length > 0) {
+      directives.push({
+        type,
+        rules,
+        reason,
+        line: i + 1
+      });
+    }
+  }
+  return directives;
+}
+function isRuleSuppressed(directives, ruleName, line) {
+  let disabled = false;
+  for (const directive of directives) {
+    if (!directive.rules.includes(ruleName)) continue;
+    if (directive.type === "disable-next-line") {
+      if (directive.line + 1 === line) {
+        return true;
+      }
+    } else if (directive.type === "disable") {
+      if (directive.line <= line) {
+        disabled = true;
+      }
+    } else if (directive.type === "enable") {
+      if (directive.line <= line) {
+        disabled = false;
+      }
+    }
+  }
+  return disabled;
+}
+
+// src/rules/engine.ts
+async function executeRules(graph, rules, targetFiles, program, config, ignoredRules, ignoredFiles, blockOn = ["critical", "error"], rootDir) {
+  const startTime = Date.now();
+  const parseStart = Date.now();
+  const allFindings = [];
+  let rulesExecuted = 0;
+  const checker = program.getTypeChecker();
+  const parseTime = Date.now() - parseStart;
+  const analysisStart = Date.now();
+  const activeRules = rules.filter((r) => !ignoredRules.includes(r.name));
+  for (const filePath of targetFiles) {
+    if (ignoredFiles.includes(filePath)) continue;
+    const fileNode = graph.files.get(filePath);
+    if (!fileNode) continue;
+    const absPath = rootDir ? path8__namespace.resolve(rootDir, filePath) : filePath;
+    const sourceFile = program.getSourceFile(absPath);
+    if (!sourceFile) continue;
+    const suppressions = parseSuppressions(sourceFile);
+    for (const rule of activeRules) {
+      const pluginName = rule.name.split("/")[0] ?? "";
+      const pluginConfig = config[pluginName] ?? {};
+      const context = createRuleContext(
+        fileNode,
+        sourceFile,
+        graph,
+        program,
+        checker,
+        pluginConfig
+      );
+      try {
+        const findings = await rule.check(context);
+        rulesExecuted++;
+        for (const finding of findings) {
+          if (isRuleSuppressed(suppressions, rule.name, finding.line)) {
+            continue;
+          }
+          allFindings.push({
+            ...finding,
+            rule: finding.rule ?? rule.name,
+            severity: finding.severity ?? rule.severity
+          });
+        }
+      } catch (err) {
+        allFindings.push({
+          message: `Rule ${rule.name} failed: ${err instanceof Error ? err.message : String(err)}`,
+          file: filePath,
+          line: 0,
+          column: 0,
+          rule: rule.name,
+          severity: "warning"
+        });
+      }
+    }
+  }
+  const analysisTime = Date.now() - analysisStart;
+  const duration = Date.now() - startTime;
+  const bySeverity = {
+    critical: [],
+    error: [],
+    warning: [],
+    info: []
+  };
+  const byFile = {};
+  for (const finding of allFindings) {
+    const sev = finding.severity ?? "info";
+    bySeverity[sev].push(finding);
+    if (!byFile[finding.file]) {
+      byFile[finding.file] = [];
+    }
+    byFile[finding.file].push(finding);
+  }
+  const blocked = allFindings.some(
+    (f) => f.severity && blockOn.includes(f.severity)
+  );
+  const stats = {
+    filesAnalyzed: targetFiles.length,
+    rulesExecuted,
+    duration,
+    parseTime,
+    analysisTime
+  };
+  return {
+    findings: allFindings,
+    stats,
+    blocked,
+    bySeverity,
+    byFile
+  };
+}
+
+// src/config/defaults.ts
+var DEFAULT_CONFIG = {
+  rootDir: ".",
+  tsconfig: "./tsconfig.json",
+  include: ["src/**/*.ts"],
+  exclude: ["**/*.test.ts", "**/*.spec.ts", "**/node_modules/**", "**/dist/**"],
+  severity: {
+    blockOn: ["critical", "error"],
+    warnOn: ["warning"],
+    ignoreBelow: "info"
+  },
+  plugins: {
+    architecture: {
+      enabled: true,
+      layers: ["controller", "service", "repository", "util"],
+      enforceDirection: true,
+      maxFileLines: 300,
+      maxFunctionLines: 50,
+      maxFunctionComplexity: 15
+    },
+    security: {
+      enabled: true,
+      checkInjection: true,
+      checkAuth: true,
+      checkSecrets: true,
+      checkXSS: true,
+      checkCSRF: true
+    },
+    performance: {
+      enabled: true,
+      checkN1Queries: true,
+      checkMemoryLeaks: true,
+      checkAsyncPatterns: true,
+      checkBundleSize: false
+    },
+    quality: {
+      enabled: true,
+      checkDeadCode: true,
+      checkNaming: true,
+      checkComplexity: true,
+      maxCyclomaticComplexity: 15
+    }
+  },
+  ignore: {
+    rules: [],
+    files: [],
+    lines: {}
+  }
+};
+function getDefaultConfigJSON() {
+  const { rootDir: _r, tsconfig: _t, ...rest } = DEFAULT_CONFIG;
+  return JSON.stringify(rest, null, 2);
+}
+
+// src/types.ts
+var SEVERITY_ORDER = [
+  "critical",
+  "error",
+  "warning",
+  "info"
+];
+
+// src/config/validator.ts
+var VALID_SEVERITIES = new Set(SEVERITY_ORDER);
+function validateConfig(config) {
+  if (config.severity) {
+    if (config.severity.blockOn) {
+      for (const s of config.severity.blockOn) {
+        if (!VALID_SEVERITIES.has(s)) {
+          throw new ConfigError(`Invalid severity in blockOn: "${s}"`, {
+            field: "severity.blockOn",
+            validValues: [...SEVERITY_ORDER]
+          });
+        }
+      }
+    }
+    if (config.severity.warnOn) {
+      for (const s of config.severity.warnOn) {
+        if (!VALID_SEVERITIES.has(s)) {
+          throw new ConfigError(`Invalid severity in warnOn: "${s}"`, {
+            field: "severity.warnOn",
+            validValues: [...SEVERITY_ORDER]
+          });
+        }
+      }
+    }
+    if (config.severity.ignoreBelow !== void 0) {
+      if (!VALID_SEVERITIES.has(config.severity.ignoreBelow)) {
+        throw new ConfigError(`Invalid severity in ignoreBelow: "${config.severity.ignoreBelow}"`, {
+          field: "severity.ignoreBelow",
+          validValues: [...SEVERITY_ORDER]
+        });
+      }
+    }
+  }
+  if (config.include) {
+    if (!Array.isArray(config.include)) {
+      throw new ConfigError('"include" must be an array of glob patterns', {
+        field: "include"
+      });
+    }
+  }
+  if (config.exclude) {
+    if (!Array.isArray(config.exclude)) {
+      throw new ConfigError('"exclude" must be an array of glob patterns', {
+        field: "exclude"
+      });
+    }
+  }
+  if (config.plugins) {
+    if (config.plugins.architecture) {
+      const arch = config.plugins.architecture;
+      if (arch.maxFileLines !== void 0 && (typeof arch.maxFileLines !== "number" || arch.maxFileLines < 1)) {
+        throw new ConfigError("maxFileLines must be a positive number", {
+          field: "plugins.architecture.maxFileLines"
+        });
+      }
+      if (arch.maxFunctionLines !== void 0 && (typeof arch.maxFunctionLines !== "number" || arch.maxFunctionLines < 1)) {
+        throw new ConfigError("maxFunctionLines must be a positive number", {
+          field: "plugins.architecture.maxFunctionLines"
+        });
+      }
+      if (arch.maxFunctionComplexity !== void 0 && (typeof arch.maxFunctionComplexity !== "number" || arch.maxFunctionComplexity < 1)) {
+        throw new ConfigError("maxFunctionComplexity must be a positive number", {
+          field: "plugins.architecture.maxFunctionComplexity"
+        });
+      }
+    }
+    if (config.plugins.quality) {
+      const q = config.plugins.quality;
+      if (q.maxCyclomaticComplexity !== void 0 && (typeof q.maxCyclomaticComplexity !== "number" || q.maxCyclomaticComplexity < 1)) {
+        throw new ConfigError("maxCyclomaticComplexity must be a positive number", {
+          field: "plugins.quality.maxCyclomaticComplexity"
+        });
+      }
+    }
+  }
+}
+
+// src/config/loader.ts
+function loadConfig(rootDir, configPathOrInline) {
+  let fileConfig = {};
+  if (typeof configPathOrInline === "object") {
+    fileConfig = configPathOrInline;
+  } else if (typeof configPathOrInline === "string") {
+    const fullPath = path8__namespace.resolve(rootDir, configPathOrInline);
+    if (fileExists(fullPath)) {
+      fileConfig = readJsonSync(fullPath);
+    } else {
+      throw new ConfigError(`Config file not found: ${configPathOrInline}`, {
+        path: fullPath
+      });
+    }
+  } else {
+    const codeguardianPath = path8__namespace.resolve(rootDir, ".codeguardian.json");
+    const packageJsonPath = path8__namespace.resolve(rootDir, "package.json");
+    if (fileExists(codeguardianPath)) {
+      fileConfig = readJsonSync(codeguardianPath);
+    } else if (fileExists(packageJsonPath)) {
+      const pkg = readJsonSync(packageJsonPath);
+      if (pkg["codeguardian"] && typeof pkg["codeguardian"] === "object") {
+        fileConfig = pkg["codeguardian"];
+      }
+    }
+  }
+  const config = mergeConfig(DEFAULT_CONFIG, fileConfig, rootDir);
+  validateConfig(config);
+  return config;
+}
+function mergeConfig(defaults, overrides, rootDir) {
+  return {
+    rootDir,
+    tsconfig: overrides.tsconfig ?? defaults.tsconfig,
+    include: overrides.include ?? defaults.include,
+    exclude: overrides.exclude ?? defaults.exclude,
+    severity: {
+      ...defaults.severity,
+      ...overrides.severity
+    },
+    plugins: {
+      architecture: {
+        ...defaults.plugins.architecture,
+        ...overrides.plugins?.architecture
+      },
+      security: {
+        ...defaults.plugins.security,
+        ...overrides.plugins?.security
+      },
+      performance: {
+        ...defaults.plugins.performance,
+        ...overrides.plugins?.performance
+      },
+      quality: {
+        ...defaults.plugins.quality,
+        ...overrides.plugins?.quality
+      },
+      naming: overrides.plugins?.naming,
+      api: overrides.plugins?.api,
+      testGuard: overrides.plugins?.testGuard,
+      depAudit: overrides.plugins?.depAudit
+    },
+    ignore: {
+      rules: overrides.ignore?.rules ?? defaults.ignore.rules,
+      files: overrides.ignore?.files ?? defaults.ignore.files,
+      lines: overrides.ignore?.lines ?? defaults.ignore.lines
+    }
+  };
+}
+function getStagedFiles(rootDir) {
+  try {
+    const output = child_process.execSync("git diff --cached --name-only", {
+      cwd: rootDir,
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    return output.trim().split("\n").filter((line) => line.trim().length > 0);
+  } catch (err) {
+    throw new GitError("Failed to get staged files. Is this a git repository?", {
+      rootDir,
+      error: String(err)
+    });
+  }
+}
+function isGitRepo(rootDir) {
+  try {
+    child_process.execSync("git rev-parse --is-inside-work-tree", {
+      cwd: rootDir,
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/reporter/terminal.ts
+function formatTerminal(result, verbose = false) {
+  const lines = [];
+  lines.push("");
+  lines.push(color.bold("  @oxog/codeguardian"));
+  lines.push(color.dim(`  Analyzed ${result.stats.filesAnalyzed} files in ${result.stats.duration}ms`));
+  lines.push("");
+  const findings = verbose ? result.findings : result.findings.filter((f) => f.severity !== "info");
+  if (findings.length === 0) {
+    lines.push(color.green("  \u2713 No issues found"));
+    lines.push("");
+    return lines.join("\n");
+  }
+  const sorted = [...findings].sort((a, b) => {
+    const order = { critical: 0, error: 1, warning: 2, info: 3 };
+    return (order[a.severity ?? "info"] ?? 3) - (order[b.severity ?? "info"] ?? 3);
+  });
+  for (const finding of sorted) {
+    lines.push(formatFinding(finding));
+  }
+  lines.push("");
+  lines.push(formatSummaryLine(result));
+  lines.push("");
+  return lines.join("\n");
+}
+function formatFinding(finding) {
+  const lines = [];
+  const sev = finding.severity ?? "info";
+  const icon = getIcon(sev);
+  const label = getSeverityLabel(sev);
+  const location = `${finding.file}:${finding.line}`;
+  lines.push(`${icon} ${label}  ${color.white(location)}`);
+  lines.push(`  ${color.dim(`[${finding.rule ?? "unknown"}]`)} ${finding.message}`);
+  if (finding.fix?.suggestion) {
+    lines.push(`  ${color.dim("\u2192")} ${color.dim(finding.fix.suggestion)}`);
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+function getIcon(severity) {
+  switch (severity) {
+    case "critical":
+    case "error":
+      return color.red("\u2717");
+    case "warning":
+      return color.yellow("\u26A0");
+    case "info":
+      return color.blue("\u2139");
+  }
+}
+function getSeverityLabel(severity) {
+  switch (severity) {
+    case "critical":
+      return color.red(color.bold("CRITICAL"));
+    case "error":
+      return color.red(color.bold("ERROR   "));
+    case "warning":
+      return color.yellow("WARNING ");
+    case "info":
+      return color.blue("INFO    ");
+  }
+}
+function formatSummaryLine(result) {
+  const criticalCount = result.bySeverity.critical.length;
+  const errorCount = result.bySeverity.error.length;
+  const warningCount = result.bySeverity.warning.length;
+  const infoCount = result.bySeverity.info.length;
+  const blockCount = criticalCount + errorCount;
+  const parts = [];
+  if (blockCount > 0) {
+    parts.push(color.red(`  ${blockCount} critical/error (commit blocked)`));
+  }
+  if (warningCount > 0) {
+    parts.push(color.yellow(`${warningCount} warnings`));
+  }
+  if (infoCount > 0) {
+    parts.push(color.dim(`${infoCount} info`));
+  }
+  const line = "\u2500".repeat(50);
+  if (result.blocked) {
+    return `${color.dim(line)}
+${parts.join("  \u2502  ")}
+${color.dim(line)}`;
+  }
+  if (parts.length === 0) {
+    return `${color.dim(line)}
+${color.green("  \u2713 All clear")}
+${color.dim(line)}`;
+  }
+  return `${color.dim(line)}
+${parts.join("  \u2502  ")}
+${color.dim(line)}`;
+}
+
+// src/reporter/json.ts
+function formatJSON(result) {
+  return JSON.stringify(
+    {
+      blocked: result.blocked,
+      stats: result.stats,
+      findings: result.findings.map((f) => ({
+        rule: f.rule,
+        severity: f.severity,
+        message: f.message,
+        file: f.file,
+        line: f.line,
+        column: f.column,
+        fix: f.fix
+      })),
+      summary: {
+        critical: result.bySeverity.critical.length,
+        error: result.bySeverity.error.length,
+        warning: result.bySeverity.warning.length,
+        info: result.bySeverity.info.length,
+        total: result.findings.length
+      }
+    },
+    null,
+    2
+  );
+}
+
+// src/reporter/sarif.ts
+function toSarifLevel(severity) {
+  switch (severity) {
+    case "critical":
+    case "error":
+      return "error";
+    case "warning":
+      return "warning";
+    case "info":
+      return "note";
+  }
+}
+function formatSARIF(result) {
+  const rules = /* @__PURE__ */ new Map();
+  for (const finding of result.findings) {
+    if (finding.rule && !rules.has(finding.rule)) {
+      rules.set(finding.rule, {
+        name: finding.rule,
+        description: finding.message,
+        severity: finding.severity ?? "info"
+      });
+    }
+  }
+  const sarif = {
+    $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "@oxog/codeguardian",
+            version: "1.0.0",
+            informationUri: "https://codeguardian.oxog.dev",
+            rules: Array.from(rules.values()).map((r) => ({
+              id: r.name,
+              shortDescription: { text: r.description },
+              defaultConfiguration: {
+                level: toSarifLevel(r.severity)
+              }
+            }))
+          }
+        },
+        results: result.findings.map((f) => ({
+          ruleId: f.rule ?? "unknown",
+          level: toSarifLevel(f.severity ?? "info"),
+          message: { text: f.message },
+          locations: [
+            {
+              physicalLocation: {
+                artifactLocation: { uri: f.file },
+                region: {
+                  startLine: f.line,
+                  startColumn: f.column
+                }
+              }
+            }
+          ],
+          ...f.fix ? {
+            fixes: [
+              {
+                description: { text: f.fix.suggestion }
+              }
+            ]
+          } : {}
+        }))
+      }
+    ]
+  };
+  return JSON.stringify(sarif, null, 2);
+}
+
+// src/discovery/conventions.ts
+function discoverConventions(graph) {
+  const patterns = [];
+  patterns.push(...detectFileNamingPatterns(graph));
+  patterns.push(...detectExportPatterns(graph));
+  patterns.push(...detectImportDirectionPatterns(graph));
+  patterns.push(...detectNamingConventions(graph));
+  return patterns;
+}
+function detectFileNamingPatterns(graph) {
+  const patterns = [];
+  const dirFiles = /* @__PURE__ */ new Map();
+  for (const [filePath] of graph.files) {
+    const parts = filePath.split("/");
+    const dir = parts.slice(0, -1).join("/");
+    const file = parts[parts.length - 1] ?? "";
+    if (!dirFiles.has(dir)) {
+      dirFiles.set(dir, []);
+    }
+    dirFiles.get(dir).push(file);
+  }
+  for (const [dir, files] of dirFiles) {
+    if (files.length < 2) continue;
+    const suffixes = /* @__PURE__ */ new Map();
+    for (const file of files) {
+      const parts = file.split(".");
+      if (parts.length >= 3) {
+        const suffix = parts.slice(-2).join(".");
+        if (!suffixes.has(suffix)) {
+          suffixes.set(suffix, []);
+        }
+        suffixes.get(suffix).push(file);
+      }
+    }
+    for (const [suffix, matchingFiles] of suffixes) {
+      const ratio = matchingFiles.length / files.length;
+      if (ratio >= 0.5 && matchingFiles.length >= 2) {
+        patterns.push({
+          type: "file-naming",
+          description: `Files in ${dir}/ follow *.${suffix} naming pattern`,
+          files: matchingFiles.map((f) => `${dir}/${f}`),
+          confidence: Math.round(ratio * 100)
+        });
+      }
+    }
+  }
+  return patterns;
+}
+function detectExportPatterns(graph) {
+  const patterns = [];
+  const roleExports = /* @__PURE__ */ new Map();
+  for (const [filePath, fileNode] of graph.files) {
+    if (fileNode.role === "unknown" || fileNode.role === "test") continue;
+    if (!roleExports.has(fileNode.role)) {
+      roleExports.set(fileNode.role, { classes: 0, functions: 0, files: [] });
+    }
+    const entry = roleExports.get(fileNode.role);
+    entry.files.push(filePath);
+    for (const exp of fileNode.exports) {
+      const symbol = graph.symbols.get(`${filePath}:${exp}`);
+      if (symbol) {
+        if (symbol.kind === "class") entry.classes++;
+        if (symbol.kind === "function") entry.functions++;
+      }
+    }
+  }
+  for (const [role, data] of roleExports) {
+    if (data.files.length < 2) continue;
+    if (data.classes > data.functions && data.classes >= 2) {
+      patterns.push({
+        type: "export-pattern",
+        description: `${role} files primarily export classes`,
+        files: data.files,
+        confidence: Math.round(data.classes / (data.classes + data.functions) * 100)
+      });
+    } else if (data.functions > data.classes && data.functions >= 2) {
+      patterns.push({
+        type: "export-pattern",
+        description: `${role} files primarily export functions`,
+        files: data.files,
+        confidence: Math.round(data.functions / (data.classes + data.functions) * 100)
+      });
+    }
+  }
+  return patterns;
+}
+function detectImportDirectionPatterns(graph) {
+  const patterns = [];
+  const layerImports = /* @__PURE__ */ new Map();
+  for (const edge of graph.edges) {
+    const fromFile = graph.files.get(edge.from);
+    const toFile = graph.files.get(edge.to);
+    if (!fromFile || !toFile) continue;
+    const fromLayer = fromFile.layer;
+    const toLayer = toFile.layer;
+    if (fromLayer === "unknown" || toLayer === "unknown") continue;
+    if (!layerImports.has(fromLayer)) {
+      layerImports.set(fromLayer, /* @__PURE__ */ new Map());
+    }
+    const targets = layerImports.get(fromLayer);
+    targets.set(toLayer, (targets.get(toLayer) ?? 0) + 1);
+  }
+  for (const [fromLayer, targets] of layerImports) {
+    for (const [toLayer, count] of targets) {
+      if (count >= 2) {
+        patterns.push({
+          type: "import-direction",
+          description: `${fromLayer} \u2192 ${toLayer} (${count} imports)`,
+          files: [],
+          confidence: Math.min(100, count * 20)
+        });
+      }
+    }
+  }
+  return patterns;
+}
+function detectNamingConventions(graph) {
+  const patterns = [];
+  let camelCase = 0;
+  let pascalCase = 0;
+  let snakeCase = 0;
+  for (const file of graph.files.values()) {
+    for (const fn of file.functions) {
+      if (/^[a-z][a-zA-Z0-9]*$/.test(fn.name)) camelCase++;
+      else if (/^[A-Z][a-zA-Z0-9]*$/.test(fn.name)) pascalCase++;
+      else if (/^[a-z][a-z0-9_]*$/.test(fn.name)) snakeCase++;
+    }
+  }
+  const total = camelCase + pascalCase + snakeCase;
+  if (total >= 5) {
+    if (camelCase / total >= 0.7) {
+      patterns.push({
+        type: "naming-convention",
+        description: "Functions use camelCase naming",
+        files: [],
+        confidence: Math.round(camelCase / total * 100)
+      });
+    }
+  }
+  return patterns;
+}
+
+// src/plugins/core/architecture.ts
+function architecturePlugin(config = {}) {
+  const fullConfig = {
+    layers: ["controller", "service", "repository", "util"],
+    enforceDirection: true,
+    maxFileLines: 300,
+    maxFunctionLines: 50,
+    ...config
+  };
+  return {
+    name: "architecture",
+    version: "1.0.0",
+    install(kernel) {
+      kernel.registerRule({
+        name: "architecture/layer-violation",
+        severity: "error",
+        description: "Detects when a lower layer imports from a higher layer",
+        category: "architecture",
+        check(context) {
+          const findings = [];
+          const layers = fullConfig.layers;
+          if (!fullConfig.enforceDirection || layers.length === 0) return findings;
+          const fileLayer = context.file.layer;
+          const fileLayerIndex = layers.indexOf(fileLayer);
+          if (fileLayerIndex === -1) return findings;
+          for (const imp of context.file.imports) {
+            const targetFile = context.graph.files.get(resolveImport(context.file.path, imp.source));
+            if (!targetFile) continue;
+            const targetLayerIndex = layers.indexOf(targetFile.layer);
+            if (targetLayerIndex === -1) continue;
+            if (fileLayerIndex <= targetLayerIndex) ; else {
+              findings.push({
+                message: `${fileLayer} layer importing from ${targetFile.layer} layer (violates layer direction)`,
+                file: context.file.path,
+                line: 1,
+                column: 1,
+                fix: {
+                  suggestion: `${capitalize(fileLayer)}s should not depend on ${targetFile.layer}s. Invert the dependency.`
+                }
+              });
+            }
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "architecture/circular-dependency",
+        severity: "error",
+        description: "Detects circular import chains",
+        category: "architecture",
+        check(context) {
+          const findings = [];
+          const cycles = findCircularDeps(context.graph);
+          for (const cycle of cycles) {
+            if (cycle.includes(context.file.path)) {
+              findings.push({
+                message: `Circular dependency detected: ${cycle.join(" \u2192 ")}`,
+                file: context.file.path,
+                line: 1,
+                column: 1,
+                fix: {
+                  suggestion: "Break the cycle by extracting shared types or using dependency injection."
+                }
+              });
+            }
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "architecture/file-role-mismatch",
+        severity: "warning",
+        description: "Detects when file content does not match directory role",
+        category: "architecture",
+        check(context) {
+          const findings = [];
+          const path10 = context.file.path.toLowerCase();
+          const role = context.file.role;
+          if (path10.includes("/service") && role !== "service" && role !== "unknown") {
+            findings.push({
+              message: `File is in services directory but detected role is "${role}"`,
+              file: context.file.path,
+              line: 1,
+              column: 1,
+              fix: {
+                suggestion: "Move this file to the appropriate directory or rename it."
+              }
+            });
+          }
+          if (path10.includes("/controller") && role !== "controller" && role !== "unknown") {
+            findings.push({
+              message: `File is in controllers directory but detected role is "${role}"`,
+              file: context.file.path,
+              line: 1,
+              column: 1,
+              fix: {
+                suggestion: "Move this file to the appropriate directory or rename it."
+              }
+            });
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "architecture/god-file",
+        severity: "warning",
+        description: "Detects files exceeding maximum line count",
+        category: "architecture",
+        check(context) {
+          const maxLines = fullConfig.maxFileLines ?? 300;
+          if (context.file.loc > maxLines) {
+            return [
+              {
+                message: `File has ${context.file.loc} lines (max: ${maxLines})`,
+                file: context.file.path,
+                line: 1,
+                column: 1,
+                fix: {
+                  suggestion: "Split this file into smaller, focused modules."
+                }
+              }
+            ];
+          }
+          return [];
+        }
+      });
+      kernel.registerRule({
+        name: "architecture/god-function",
+        severity: "warning",
+        description: "Detects functions exceeding maximum line count",
+        category: "architecture",
+        check(context) {
+          const findings = [];
+          const maxLines = fullConfig.maxFunctionLines ?? 50;
+          for (const fn of context.file.functions) {
+            const fnLines = fn.endLine - fn.startLine + 1;
+            if (fnLines > maxLines) {
+              findings.push({
+                message: `Function "${fn.name}" has ${fnLines} lines (max: ${maxLines})`,
+                file: context.file.path,
+                line: fn.startLine,
+                column: 1,
+                fix: {
+                  suggestion: "Extract logic into smaller helper functions."
+                }
+              });
+            }
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "architecture/barrel-explosion",
+        severity: "info",
+        description: "Detects barrel files (index.ts) that re-export everything",
+        category: "architecture",
+        check(context) {
+          const findings = [];
+          const fileName = context.file.path.split("/").pop() ?? "";
+          if (fileName === "index.ts" || fileName === "index.tsx") {
+            const exportCount = context.file.exports.length;
+            if (exportCount > 10) {
+              findings.push({
+                message: `Barrel file re-exports ${exportCount} symbols (may cause bundle size issues)`,
+                file: context.file.path,
+                line: 1,
+                column: 1,
+                fix: {
+                  suggestion: "Consider using direct imports instead of barrel files for tree-shaking."
+                }
+              });
+            }
+          }
+          return findings;
+        }
+      });
+    }
+  };
+}
+function resolveImport(fromFile, source) {
+  if (!source.startsWith(".")) return source;
+  const fromDir = fromFile.split("/").slice(0, -1).join("/");
+  const parts = [...fromDir.split("/"), ...source.split("/")];
+  const resolved = [];
+  for (const part of parts) {
+    if (part === "..") resolved.pop();
+    else if (part !== ".") resolved.push(part);
+  }
+  let result = resolved.join("/");
+  if (!result.endsWith(".ts") && !result.endsWith(".tsx")) {
+    result += ".ts";
+  }
+  return result;
+}
+function capitalize(str) {
+  return str.charAt(0).toUpperCase() + str.slice(1);
+}
+var DB_METHODS = ["query", "execute", "raw", "prepare", "exec"];
+var SECRET_PATTERNS = [
+  /^(sk_|pk_|api_|token_|secret_|password|auth_)/i,
+  /^(AKIA[0-9A-Z]{16})/,
+  // AWS access key
+  /^eyJ[A-Za-z0-9-_]+\.eyJ/,
+  // JWT token
+  /^(ghp_|gho_|ghu_|ghs_|ghr_)/,
+  // GitHub tokens
+  /(mongodb(\+srv)?:\/\/|postgres(ql)?:\/\/|mysql:\/\/|redis:\/\/)/i
+  // Connection strings
+];
+function securityPlugin(config = {}) {
+  const fullConfig = {
+    checkInjection: true,
+    checkAuth: true,
+    checkSecrets: true,
+    checkXSS: true,
+    ...config
+  };
+  return {
+    name: "security",
+    version: "1.0.0",
+    install(kernel) {
+      kernel.registerRule({
+        name: "security/sql-injection",
+        severity: "critical",
+        description: "Detects string concatenation in SQL queries",
+        category: "security",
+        check(context) {
+          if (!fullConfig.checkInjection) return [];
+          const findings = [];
+          context.walk(context.ast, {
+            CallExpression(node) {
+              const call = node;
+              const expr = call.expression;
+              let methodName = "";
+              if (ts2__default.default.isPropertyAccessExpression(expr)) {
+                methodName = expr.name.text;
+              } else if (ts2__default.default.isIdentifier(expr)) {
+                methodName = expr.text;
+              }
+              if (DB_METHODS.includes(methodName)) {
+                for (const arg of call.arguments) {
+                  if (ts2__default.default.isTemplateExpression(arg) || context.hasStringConcat(arg)) {
+                    const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                    findings.push({
+                      message: "Raw string concatenation in SQL query \u2014 potential SQL injection",
+                      file: context.file.path,
+                      line: pos.line + 1,
+                      column: pos.character + 1,
+                      fix: {
+                        suggestion: "Use parameterized queries instead of string templates."
+                      }
+                    });
+                  }
+                }
+              }
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "security/hardcoded-secret",
+        severity: "critical",
+        description: "Detects hardcoded API keys, tokens, and passwords",
+        category: "security",
+        check(context) {
+          if (!fullConfig.checkSecrets) return [];
+          if (context.file.role === "test") return [];
+          const findings = [];
+          context.walk(context.ast, {
+            StringLiteral(node) {
+              const str = node;
+              const value = str.text;
+              if (value.length < 8) return;
+              for (const pattern of SECRET_PATTERNS) {
+                if (pattern.test(value)) {
+                  const pos = context.ast.getLineAndCharacterOfPosition(str.getStart(context.ast));
+                  findings.push({
+                    message: "Possible hardcoded secret detected",
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: "Move secrets to environment variables or a secure vault."
+                    }
+                  });
+                  break;
+                }
+              }
+            },
+            NoSubstitutionTemplateLiteral(node) {
+              const tmpl = node;
+              const value = tmpl.text;
+              if (value.length < 8) return;
+              for (const pattern of SECRET_PATTERNS) {
+                if (pattern.test(value)) {
+                  const pos = context.ast.getLineAndCharacterOfPosition(tmpl.getStart(context.ast));
+                  findings.push({
+                    message: "Possible hardcoded secret detected",
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: "Move secrets to environment variables or a secure vault."
+                    }
+                  });
+                  break;
+                }
+              }
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "security/eval-usage",
+        severity: "critical",
+        description: "Detects eval(), Function(), and similar unsafe patterns",
+        category: "security",
+        check(context) {
+          const findings = [];
+          context.walk(context.ast, {
+            CallExpression(node) {
+              const call = node;
+              let name = "";
+              if (ts2__default.default.isIdentifier(call.expression)) {
+                name = call.expression.text;
+              }
+              if (name === "eval" || name === "Function") {
+                const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                findings.push({
+                  message: `Unsafe ${name}() call \u2014 potential code injection`,
+                  file: context.file.path,
+                  line: pos.line + 1,
+                  column: pos.character + 1,
+                  fix: {
+                    suggestion: `Avoid ${name}(). Use safe alternatives like JSON.parse() or structured data.`
+                  }
+                });
+              }
+              if ((name === "setTimeout" || name === "setInterval") && call.arguments.length > 0) {
+                const firstArg = call.arguments[0];
+                if (ts2__default.default.isStringLiteral(firstArg)) {
+                  const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                  findings.push({
+                    message: `${name}() with string argument is equivalent to eval()`,
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: "Pass a function reference instead of a string."
+                    }
+                  });
+                }
+              }
+            },
+            NewExpression(node) {
+              const newExpr = node;
+              if (ts2__default.default.isIdentifier(newExpr.expression) && newExpr.expression.text === "Function") {
+                const pos = context.ast.getLineAndCharacterOfPosition(newExpr.getStart(context.ast));
+                findings.push({
+                  message: "new Function() is equivalent to eval() \u2014 potential code injection",
+                  file: context.file.path,
+                  line: pos.line + 1,
+                  column: pos.character + 1,
+                  fix: {
+                    suggestion: "Avoid new Function(). Use safe alternatives."
+                  }
+                });
+              }
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "security/prototype-pollution",
+        severity: "error",
+        description: "Detects potential prototype pollution",
+        category: "security",
+        check(context) {
+          const findings = [];
+          context.walk(context.ast, {
+            PropertyAccessExpression(node) {
+              const propAccess = node;
+              if (propAccess.name.text === "__proto__" || propAccess.name.text === "prototype") {
+                const parent = propAccess.parent;
+                if (ts2__default.default.isBinaryExpression(parent) && parent.operatorToken.kind === ts2__default.default.SyntaxKind.EqualsToken) {
+                  const pos = context.ast.getLineAndCharacterOfPosition(propAccess.getStart(context.ast));
+                  findings.push({
+                    message: "Direct prototype assignment \u2014 potential prototype pollution",
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: "Use Object.create(null) or Map for dynamic key-value stores."
+                    }
+                  });
+                }
+              }
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "security/xss-risk",
+        severity: "error",
+        description: "Detects innerHTML and similar XSS-prone patterns",
+        category: "security",
+        check(context) {
+          if (!fullConfig.checkXSS) return [];
+          const findings = [];
+          const xssProps = ["innerHTML", "outerHTML", "dangerouslySetInnerHTML"];
+          context.walk(context.ast, {
+            PropertyAccessExpression(node) {
+              const propAccess = node;
+              if (xssProps.includes(propAccess.name.text)) {
+                const pos = context.ast.getLineAndCharacterOfPosition(propAccess.getStart(context.ast));
+                findings.push({
+                  message: `Use of ${propAccess.name.text} \u2014 potential XSS vulnerability`,
+                  file: context.file.path,
+                  line: pos.line + 1,
+                  column: pos.character + 1,
+                  fix: {
+                    suggestion: "Sanitize HTML content before insertion or use safe alternatives."
+                  }
+                });
+              }
+            },
+            CallExpression(node) {
+              const call = node;
+              if (ts2__default.default.isPropertyAccessExpression(call.expression)) {
+                const name = call.expression.name.text;
+                if (name === "write" || name === "writeln") {
+                  if (ts2__default.default.isIdentifier(call.expression.expression) && call.expression.expression.text === "document") {
+                    const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                    findings.push({
+                      message: "document.write() is an XSS risk",
+                      file: context.file.path,
+                      line: pos.line + 1,
+                      column: pos.character + 1,
+                      fix: {
+                        suggestion: "Use DOM manipulation methods instead of document.write()."
+                      }
+                    });
+                  }
+                }
+              }
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "security/missing-auth-check",
+        severity: "warning",
+        description: "Detects route handlers without auth checks",
+        category: "security",
+        check(context) {
+          if (!fullConfig.checkAuth) return [];
+          if (context.file.role !== "controller") return [];
+          const findings = [];
+          const fileText = context.ast.getFullText();
+          const hasAuthReference = fileText.includes("auth") || fileText.includes("Auth") || fileText.includes("authenticate") || fileText.includes("authorize") || fileText.includes("guard") || fileText.includes("middleware") || fileText.includes("jwt") || fileText.includes("token");
+          if (!hasAuthReference && context.file.functions.length > 0) {
+            findings.push({
+              message: "Controller has no authentication/authorization references",
+              file: context.file.path,
+              line: 1,
+              column: 1,
+              fix: {
+                suggestion: "Add authentication middleware or auth checks to route handlers."
+              }
+            });
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "security/insecure-random",
+        severity: "warning",
+        description: "Detects Math.random() in security-sensitive contexts",
+        category: "security",
+        check(context) {
+          const findings = [];
+          context.walk(context.ast, {
+            CallExpression(node) {
+              const call = node;
+              if (ts2__default.default.isPropertyAccessExpression(call.expression)) {
+                if (ts2__default.default.isIdentifier(call.expression.expression) && call.expression.expression.text === "Math" && call.expression.name.text === "random") {
+                  const fileText = context.ast.getFullText();
+                  const isSecurityContext = fileText.includes("token") || fileText.includes("secret") || fileText.includes("password") || fileText.includes("hash") || fileText.includes("crypto") || fileText.includes("session");
+                  if (isSecurityContext) {
+                    const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                    findings.push({
+                      message: "Math.random() is not cryptographically secure",
+                      file: context.file.path,
+                      line: pos.line + 1,
+                      column: pos.character + 1,
+                      fix: {
+                        suggestion: "Use crypto.randomBytes() or crypto.randomUUID() for security-sensitive values."
+                      }
+                    });
+                  }
+                }
+              }
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "security/path-traversal",
+        severity: "error",
+        description: "Detects file operations with potential path traversal",
+        category: "security",
+        check(context) {
+          const findings = [];
+          const fsOps = ["readFile", "readFileSync", "writeFile", "writeFileSync", "createReadStream", "createWriteStream", "access", "open"];
+          context.walk(context.ast, {
+            CallExpression(node) {
+              const call = node;
+              let methodName = "";
+              if (ts2__default.default.isPropertyAccessExpression(call.expression)) {
+                methodName = call.expression.name.text;
+              } else if (ts2__default.default.isIdentifier(call.expression)) {
+                methodName = call.expression.text;
+              }
+              if (fsOps.includes(methodName) && call.arguments.length > 0) {
+                const firstArg = call.arguments[0];
+                if (ts2__default.default.isTemplateExpression(firstArg) || context.hasStringConcat(firstArg)) {
+                  const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                  findings.push({
+                    message: `File operation "${methodName}" with dynamic path \u2014 potential path traversal`,
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: "Validate and sanitize file paths. Use path.resolve() and check against a whitelist."
+                    }
+                  });
+                }
+              }
+            }
+          });
+          return findings;
+        }
+      });
+    }
+  };
+}
+var DB_CALL_PATTERNS = ["find", "findOne", "findAll", "findById", "query", "execute", "fetch", "get", "select"];
+var SYNC_FS_METHODS = ["readFileSync", "writeFileSync", "appendFileSync", "mkdirSync", "readdirSync", "statSync", "existsSync", "unlinkSync", "copyFileSync"];
+function performancePlugin(config = {}) {
+  const fullConfig = {
+    checkN1Queries: true,
+    checkMemoryLeaks: true,
+    checkAsyncPatterns: true,
+    checkBundleSize: false,
+    ...config
+  };
+  return {
+    name: "performance",
+    version: "1.0.0",
+    install(kernel) {
+      kernel.registerRule({
+        name: "performance/n1-query",
+        severity: "warning",
+        description: "Detects database calls inside loops (potential N+1 query)",
+        category: "performance",
+        check(context) {
+          if (!fullConfig.checkN1Queries) return [];
+          const findings = [];
+          const checkForDbCallsInLoop = (loopNode) => {
+            ts2__default.default.forEachChild(loopNode, function visitChild(child) {
+              if (ts2__default.default.isCallExpression(child)) {
+                let methodName = "";
+                if (ts2__default.default.isPropertyAccessExpression(child.expression)) {
+                  methodName = child.expression.name.text;
+                }
+                if (DB_CALL_PATTERNS.includes(methodName)) {
+                  const pos = context.ast.getLineAndCharacterOfPosition(child.getStart(context.ast));
+                  findings.push({
+                    message: `Potential N+1 query: "${methodName}" called inside a loop`,
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: "Batch queries using Promise.all() or a single query with IN clause."
+                    }
+                  });
+                }
+              }
+              ts2__default.default.forEachChild(child, visitChild);
+            });
+          };
+          context.walk(context.ast, {
+            ForStatement(node) {
+              checkForDbCallsInLoop(node);
+            },
+            ForInStatement(node) {
+              checkForDbCallsInLoop(node);
+            },
+            ForOfStatement(node) {
+              checkForDbCallsInLoop(node);
+            },
+            WhileStatement(node) {
+              checkForDbCallsInLoop(node);
+            },
+            DoStatement(node) {
+              checkForDbCallsInLoop(node);
+            }
+          });
+          context.walk(context.ast, {
+            CallExpression(node) {
+              const call = node;
+              if (ts2__default.default.isPropertyAccessExpression(call.expression)) {
+                const name = call.expression.name.text;
+                if (name === "forEach" || name === "map") {
+                  if (call.arguments.length > 0) {
+                    checkForDbCallsInLoop(call.arguments[0]);
+                  }
+                }
+              }
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "performance/sync-in-async",
+        severity: "warning",
+        description: "Detects synchronous file operations in async functions",
+        category: "performance",
+        check(context) {
+          if (!fullConfig.checkAsyncPatterns) return [];
+          const findings = [];
+          for (const fn of context.file.functions) {
+            if (!fn.isAsync) continue;
+            context.walk(context.ast, {
+              CallExpression(node) {
+                const call = node;
+                const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                const callLine = pos.line + 1;
+                if (callLine < fn.startLine || callLine > fn.endLine) return;
+                let methodName = "";
+                if (ts2__default.default.isPropertyAccessExpression(call.expression)) {
+                  methodName = call.expression.name.text;
+                } else if (ts2__default.default.isIdentifier(call.expression)) {
+                  methodName = call.expression.text;
+                }
+                if (SYNC_FS_METHODS.includes(methodName)) {
+                  findings.push({
+                    message: `Synchronous "${methodName}" in async function "${fn.name}"`,
+                    file: context.file.path,
+                    line: callLine,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: `Use the async version instead (e.g., fs.promises.${methodName.replace("Sync", "")}).`
+                    }
+                  });
+                }
+              }
+            });
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "performance/memory-leak-risk",
+        severity: "warning",
+        description: "Detects addEventListener without removeEventListener, setInterval without clearInterval",
+        category: "performance",
+        check(context) {
+          if (!fullConfig.checkMemoryLeaks) return [];
+          const findings = [];
+          const fileText = context.ast.getFullText();
+          if (fileText.includes("addEventListener") && !fileText.includes("removeEventListener")) {
+            context.walk(context.ast, {
+              CallExpression(node) {
+                const call = node;
+                if (ts2__default.default.isPropertyAccessExpression(call.expression) && call.expression.name.text === "addEventListener") {
+                  const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                  findings.push({
+                    message: "addEventListener without corresponding removeEventListener \u2014 potential memory leak",
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: "Add a cleanup function that calls removeEventListener."
+                    }
+                  });
+                }
+              }
+            });
+          }
+          if (fileText.includes("setInterval") && !fileText.includes("clearInterval")) {
+            context.walk(context.ast, {
+              CallExpression(node) {
+                const call = node;
+                if (ts2__default.default.isIdentifier(call.expression) && call.expression.text === "setInterval") {
+                  const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                  findings.push({
+                    message: "setInterval without clearInterval \u2014 potential memory leak",
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: "Store the interval ID and clear it when no longer needed."
+                    }
+                  });
+                }
+              }
+            });
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "performance/unbounded-query",
+        severity: "warning",
+        description: "Detects database queries without LIMIT or pagination",
+        category: "performance",
+        check(context) {
+          const findings = [];
+          context.walk(context.ast, {
+            CallExpression(node) {
+              const call = node;
+              let methodName = "";
+              if (ts2__default.default.isPropertyAccessExpression(call.expression)) {
+                methodName = call.expression.name.text;
+              }
+              if (methodName === "findAll" || methodName === "find") {
+                const argText = call.arguments.map((a) => a.getText(context.ast)).join(" ");
+                if (!argText.includes("limit") && !argText.includes("take") && !argText.includes("LIMIT")) {
+                  const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                  findings.push({
+                    message: `"${methodName}" without limit \u2014 could return unbounded results`,
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: "Add a LIMIT clause or pagination to prevent loading too many records."
+                    }
+                  });
+                }
+              }
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "performance/missing-index-hint",
+        severity: "info",
+        description: "Detects queries that may need database indexes",
+        category: "performance",
+        check(_context) {
+          return [];
+        }
+      });
+      kernel.registerRule({
+        name: "performance/heavy-import",
+        severity: "info",
+        description: "Detects importing entire libraries when a smaller import is available",
+        category: "performance",
+        check(context) {
+          if (!fullConfig.checkBundleSize) return [];
+          const findings = [];
+          const heavyLibs = ["lodash", "moment", "rxjs"];
+          for (const imp of context.file.imports) {
+            for (const lib of heavyLibs) {
+              if (imp.source === lib && imp.specifiers.length <= 2) {
+                findings.push({
+                  /* v8 ignore next */
+                  message: `Importing from "${lib}" \u2014 consider using "${lib}/${imp.specifiers[0] ?? ""}" for smaller bundle`,
+                  file: context.file.path,
+                  line: 1,
+                  column: 1,
+                  fix: {
+                    suggestion: `Use deep imports (e.g., "${lib}/functionName") for tree-shaking.`
+                  }
+                });
+              }
+            }
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "performance/blocking-operation",
+        severity: "warning",
+        description: "Detects CPU-intensive operations in request handlers",
+        category: "performance",
+        check(context) {
+          if (context.file.role !== "controller") return [];
+          const findings = [];
+          context.walk(context.ast, {
+            CallExpression(node) {
+              const call = node;
+              let methodName = "";
+              if (ts2__default.default.isPropertyAccessExpression(call.expression)) {
+                methodName = call.expression.name.text;
+              } else if (ts2__default.default.isIdentifier(call.expression)) {
+                methodName = call.expression.text;
+              }
+              if (methodName === "parse" && ts2__default.default.isPropertyAccessExpression(call.expression)) {
+                if (ts2__default.default.isIdentifier(call.expression.expression) && call.expression.expression.text === "JSON") {
+                  const pos = context.ast.getLineAndCharacterOfPosition(call.getStart(context.ast));
+                  findings.push({
+                    message: "JSON.parse() in request handler may block event loop for large payloads",
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: {
+                      suggestion: "Consider streaming JSON parsing or limiting request body size."
+                    }
+                  });
+                }
+              }
+            }
+          });
+          return findings;
+        }
+      });
+    }
+  };
+}
+function qualityPlugin(config = {}) {
+  const fullConfig = {
+    checkDeadCode: true,
+    checkNaming: true,
+    checkComplexity: true,
+    maxCyclomaticComplexity: 15,
+    ...config
+  };
+  return {
+    name: "quality",
+    version: "1.0.0",
+    install(kernel) {
+      kernel.registerRule({
+        name: "quality/cyclomatic-complexity",
+        severity: "warning",
+        description: "Detects functions with high cyclomatic complexity",
+        category: "quality",
+        check(context) {
+          if (!fullConfig.checkComplexity) return [];
+          const findings = [];
+          const maxComplexity = fullConfig.maxCyclomaticComplexity ?? 15;
+          for (const fn of context.file.functions) {
+            if (fn.complexity > maxComplexity) {
+              findings.push({
+                message: `Function "${fn.name}" has cyclomatic complexity ${fn.complexity} (max: ${maxComplexity})`,
+                file: context.file.path,
+                line: fn.startLine,
+                column: 1,
+                fix: {
+                  suggestion: "Simplify by extracting conditions into named functions or using early returns."
+                }
+              });
+            }
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "quality/dead-code",
+        severity: "warning",
+        description: "Detects exported symbols never imported by other files",
+        category: "quality",
+        check(context) {
+          if (!fullConfig.checkDeadCode) return [];
+          if (context.file.role === "test") return [];
+          const findings = [];
+          for (const exportName of context.file.exports) {
+            if (exportName === "default") continue;
+            const fileName = context.file.path.split("/").pop() ?? "";
+            if (fileName === "index.ts" || fileName === "index.tsx") continue;
+            const isUsed = context.isExternallyUsed(exportName);
+            if (!isUsed) {
+              findings.push({
+                message: `Exported symbol "${exportName}" is never imported by other files`,
+                file: context.file.path,
+                line: 1,
+                column: 1,
+                fix: {
+                  suggestion: "Remove unused export or add an import if intentional."
+                }
+              });
+            }
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "quality/any-type",
+        severity: "warning",
+        description: "Detects usage of `any` type annotation",
+        category: "quality",
+        check(context) {
+          const findings = [];
+          context.walk(context.ast, {
+            // TypeReference for explicit 'any' annotations
+            AnyKeyword(node) {
+              const pos = context.ast.getLineAndCharacterOfPosition(node.getStart(context.ast));
+              findings.push({
+                message: "Usage of `any` type \u2014 use a specific type instead",
+                file: context.file.path,
+                line: pos.line + 1,
+                column: pos.character + 1,
+                fix: {
+                  suggestion: "Replace `any` with a specific type or `unknown`."
+                }
+              });
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "quality/no-error-handling",
+        severity: "warning",
+        description: "Detects async functions without error handling",
+        category: "quality",
+        check(context) {
+          const findings = [];
+          for (const fn of context.file.functions) {
+            if (!fn.isAsync) continue;
+            const fileText = context.ast.getFullText();
+            const fnText = fileText.slice(
+              getLineOffset(fileText, fn.startLine),
+              getLineOffset(fileText, fn.endLine + 1)
+            );
+            const hasTryCatch = fnText.includes("try") && fnText.includes("catch");
+            const hasDotCatch = fnText.includes(".catch(");
+            const hasThrow = fnText.includes("throw ");
+            if (!hasTryCatch && !hasDotCatch && !hasThrow) {
+              findings.push({
+                message: `Async function "${fn.name}" has no error handling (try-catch or .catch())`,
+                file: context.file.path,
+                line: fn.startLine,
+                column: 1,
+                fix: {
+                  suggestion: "Add try-catch around async operations or use .catch() on promises."
+                }
+              });
+            }
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "quality/inconsistent-naming",
+        severity: "info",
+        description: "Detects naming that does not follow project conventions",
+        category: "quality",
+        check(context) {
+          if (!fullConfig.checkNaming) return [];
+          const findings = [];
+          for (const fn of context.file.functions) {
+            if (fn.name && !/^[a-z_$]/.test(fn.name) && !/^[A-Z][A-Z_]+$/.test(fn.name)) {
+              if (context.file.role !== "unknown") {
+                findings.push({
+                  message: `Function "${fn.name}" does not follow camelCase naming convention`,
+                  file: context.file.path,
+                  line: fn.startLine,
+                  column: 1,
+                  fix: {
+                    suggestion: "Use camelCase for function names (e.g., getUser, handleRequest)."
+                  }
+                });
+              }
+            }
+          }
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "quality/magic-number",
+        severity: "info",
+        description: "Detects numeric literals used directly in logic",
+        category: "quality",
+        check(context) {
+          const findings = [];
+          const allowedNumbers = /* @__PURE__ */ new Set([0, 1, -1, 2, 100, 200, 201, 204, 301, 302, 400, 401, 403, 404, 500]);
+          context.walk(context.ast, {
+            NumericLiteral(node) {
+              const num = node;
+              const value = parseFloat(num.text);
+              if (allowedNumbers.has(value)) return;
+              let parent = num.parent;
+              while (parent) {
+                if (ts2__default.default.isVariableDeclaration(parent) || ts2__default.default.isEnumMember(parent) || ts2__default.default.isPropertyAssignment(parent)) {
+                  return;
+                }
+                parent = parent.parent;
+              }
+              const pos = context.ast.getLineAndCharacterOfPosition(num.getStart(context.ast));
+              findings.push({
+                message: `Magic number ${num.text} \u2014 extract to a named constant`,
+                file: context.file.path,
+                line: pos.line + 1,
+                column: pos.character + 1,
+                fix: {
+                  suggestion: "Extract numeric literal to a named constant for clarity."
+                }
+              });
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "quality/empty-catch",
+        severity: "warning",
+        description: "Detects empty catch blocks",
+        category: "quality",
+        check(context) {
+          const findings = [];
+          context.walk(context.ast, {
+            CatchClause(node) {
+              const catchClause = node;
+              const block = catchClause.block;
+              if (block.statements.length === 0) {
+                const pos = context.ast.getLineAndCharacterOfPosition(catchClause.getStart(context.ast));
+                findings.push({
+                  message: "Empty catch block \u2014 errors are silently swallowed",
+                  file: context.file.path,
+                  line: pos.line + 1,
+                  column: pos.character + 1,
+                  fix: {
+                    suggestion: "Handle the error, log it, or re-throw if appropriate."
+                  }
+                });
+              }
+            }
+          });
+          return findings;
+        }
+      });
+      kernel.registerRule({
+        name: "quality/nested-callbacks",
+        severity: "warning",
+        description: "Detects deeply nested callbacks (> 3 levels)",
+        category: "quality",
+        check(context) {
+          const findings = [];
+          const maxNesting = 3;
+          const checkNesting = (node, depth) => {
+            if (ts2__default.default.isArrowFunction(node) || ts2__default.default.isFunctionExpression(node)) {
+              if (depth > maxNesting) {
+                const pos = context.ast.getLineAndCharacterOfPosition(node.getStart(context.ast));
+                findings.push({
+                  message: `Callback nested ${depth} levels deep (max: ${maxNesting})`,
+                  file: context.file.path,
+                  line: pos.line + 1,
+                  column: pos.character + 1,
+                  fix: {
+                    suggestion: "Use async/await or extract nested callbacks into named functions."
+                  }
+                });
+                return;
+              }
+              ts2__default.default.forEachChild(node, (child) => checkNesting(child, depth + 1));
+            } else {
+              ts2__default.default.forEachChild(node, (child) => checkNesting(child, depth));
+            }
+          };
+          ts2__default.default.forEachChild(context.ast, (child) => checkNesting(child, 0));
+          return findings;
+        }
+      });
+    }
+  };
+}
+function getLineOffset(text, line) {
+  let offset = 0;
+  let currentLine = 1;
+  for (let i = 0; i < text.length; i++) {
+    if (currentLine === line) return offset;
+    if (text[i] === "\n") {
+      currentLine++;
+    }
+    offset++;
+  }
+  return offset;
+}
+
+// src/plugins/optional/naming.ts
+function namingPlugin(_config = {}) {
+  return {
+    name: "naming-convention",
+    version: "1.0.0",
+    install(kernel) {
+      kernel.registerRule({
+        name: "naming-convention/file-naming",
+        severity: "warning",
+        description: "Enforces consistent file naming patterns based on directory",
+        category: "quality",
+        check(context) {
+          const findings = [];
+          const path10 = context.file.path;
+          const fileName = path10.split("/").pop() ?? "";
+          if (path10.includes("/services/") && !fileName.endsWith(".service.ts") && !fileName.endsWith(".test.ts")) {
+            findings.push({
+              message: `File in services/ should follow *.service.ts naming: "${fileName}"`,
+              file: context.file.path,
+              line: 1,
+              column: 1,
+              fix: { suggestion: "Rename file to follow *.service.ts convention." }
+            });
+          }
+          if (path10.includes("/controllers/") && !fileName.endsWith(".controller.ts") && !fileName.endsWith(".test.ts")) {
+            findings.push({
+              message: `File in controllers/ should follow *.controller.ts naming: "${fileName}"`,
+              file: context.file.path,
+              line: 1,
+              column: 1,
+              fix: { suggestion: "Rename file to follow *.controller.ts convention." }
+            });
+          }
+          if (path10.includes("/repositories/") && !fileName.endsWith(".repository.ts") && !fileName.endsWith(".test.ts")) {
+            findings.push({
+              message: `File in repositories/ should follow *.repository.ts naming: "${fileName}"`,
+              file: context.file.path,
+              line: 1,
+              column: 1,
+              fix: { suggestion: "Rename file to follow *.repository.ts convention." }
+            });
+          }
+          return findings;
+        }
+      });
+    }
+  };
+}
+
+// src/plugins/optional/api.ts
+function apiPlugin(_config = {}) {
+  return {
+    name: "api-consistency",
+    version: "1.0.0",
+    install(kernel) {
+      kernel.registerRule({
+        name: "api-consistency/endpoint-naming",
+        severity: "info",
+        description: "Checks REST API endpoint naming conventions",
+        category: "quality",
+        check(context) {
+          if (context.file.role !== "controller") return [];
+          const findings = [];
+          context.walk(context.ast, {
+            StringLiteral(node) {
+              const str = node;
+              const value = str.text;
+              if (value.startsWith("/") && value.length > 1) {
+                if (/\/[a-z]+[A-Z]/.test(value)) {
+                  const pos = context.ast.getLineAndCharacterOfPosition(str.getStart(context.ast));
+                  findings.push({
+                    message: `API endpoint "${value}" uses camelCase \u2014 prefer kebab-case`,
+                    file: context.file.path,
+                    line: pos.line + 1,
+                    column: pos.character + 1,
+                    fix: { suggestion: "Use kebab-case for URL paths (e.g., /user-profiles instead of /userProfiles)." }
+                  });
+                }
+              }
+            }
+          });
+          return findings;
+        }
+      });
+    }
+  };
+}
+
+// src/plugins/optional/test-guard.ts
+function testGuardPlugin(_config = {}) {
+  return {
+    name: "test-coverage-guard",
+    version: "1.0.0",
+    install(kernel) {
+      kernel.registerRule({
+        name: "test-coverage-guard/missing-tests",
+        severity: "warning",
+        description: "Ensures source files have corresponding test files",
+        category: "quality",
+        check(context) {
+          if (context.file.role === "test" || context.file.role === "type" || context.file.role === "config") {
+            return [];
+          }
+          const findings = [];
+          const filePath = context.file.path;
+          const testPaths = getExpectedTestPaths(filePath);
+          const hasTest = testPaths.some((tp) => context.graph.files.has(tp));
+          if (!hasTest) {
+            findings.push({
+              message: `No test file found for "${filePath}"`,
+              file: context.file.path,
+              line: 1,
+              column: 1,
+              fix: {
+                /* v8 ignore next */
+                suggestion: `Create a test file (e.g., ${testPaths[0] ?? filePath.replace(".ts", ".test.ts")}).`
+              }
+            });
+          }
+          return findings;
+        }
+      });
+    }
+  };
+}
+function getExpectedTestPaths(filePath) {
+  const base = filePath.replace(/\.ts$/, "");
+  return [
+    `${base}.test.ts`,
+    `${base}.spec.ts`,
+    filePath.replace("src/", "tests/").replace(".ts", ".test.ts"),
+    filePath.replace("src/", "tests/unit/").replace(".ts", ".test.ts")
+  ];
+}
+
+// src/plugins/optional/dep-audit.ts
+function depAuditPlugin(config = {}) {
+  const fullConfig = {
+    maxDepth: 5,
+    ...config
+  };
+  return {
+    name: "dependency-audit",
+    version: "1.0.0",
+    install(kernel) {
+      kernel.registerRule({
+        name: "dependency-audit/deep-imports",
+        severity: "info",
+        description: "Detects deeply nested import chains",
+        category: "architecture",
+        check(context) {
+          const findings = [];
+          const maxDepth = fullConfig.maxDepth ?? 5;
+          const depth = calculateImportDepth(
+            context.file.path,
+            context.graph.dependencies.adjacency,
+            /* @__PURE__ */ new Set()
+          );
+          if (depth > maxDepth) {
+            findings.push({
+              message: `File has import depth of ${depth} (max: ${maxDepth})`,
+              file: context.file.path,
+              line: 1,
+              column: 1,
+              fix: {
+                suggestion: "Consider restructuring imports to reduce dependency depth."
+              }
+            });
+          }
+          return findings;
+        }
+      });
+    }
+  };
+}
+function calculateImportDepth(file, adjacency, visited) {
+  if (visited.has(file)) return 0;
+  visited.add(file);
+  const deps = adjacency.get(file);
+  if (!deps || deps.size === 0) return 0;
+  let maxDepth = 0;
+  for (const dep of deps) {
+    const depth = calculateImportDepth(dep, adjacency, visited);
+    maxDepth = Math.max(maxDepth, depth);
+  }
+  return maxDepth + 1;
+}
+
+// src/index.ts
+function createGuardian(config) {
+  const projectConfig = loadConfig(config.rootDir, config.config);
+  const kernel = createKernel();
+  let _graph = null;
+  let _program = null;
+  const pluginCfg = projectConfig.plugins;
+  if (pluginCfg.architecture?.enabled !== false) {
+    kernel.installPlugin(architecturePlugin(pluginCfg.architecture));
+  }
+  if (pluginCfg.security?.enabled !== false) {
+    kernel.installPlugin(securityPlugin(pluginCfg.security));
+  }
+  if (pluginCfg.performance?.enabled !== false) {
+    kernel.installPlugin(performancePlugin(pluginCfg.performance));
+  }
+  if (pluginCfg.quality?.enabled !== false) {
+    kernel.installPlugin(qualityPlugin(pluginCfg.quality));
+  }
+  if (pluginCfg.naming?.enabled) {
+    kernel.installPlugin(namingPlugin(pluginCfg.naming));
+  }
+  if (pluginCfg.api?.enabled) {
+    kernel.installPlugin(apiPlugin(pluginCfg.api));
+  }
+  if (pluginCfg.testGuard?.enabled) {
+    kernel.installPlugin(testGuardPlugin(pluginCfg.testGuard));
+  }
+  if (pluginCfg.depAudit?.enabled) {
+    kernel.installPlugin(depAuditPlugin(pluginCfg.depAudit));
+  }
+  function getProgram() {
+    if (!_program) {
+      _program = createTSProgram(config.rootDir, projectConfig.tsconfig);
+    }
+    return _program;
+  }
+  const guardian = {
+    /** The project configuration. */
+    config: projectConfig,
+    /** The codebase knowledge graph (available after scan). */
+    get graph() {
+      if (!_graph) {
+        throw new Error("Graph not available. Call scan() first.");
+      }
+      return _graph;
+    },
+    /**
+     * Perform a full codebase scan and build the knowledge graph.
+     *
+     * @returns The complete codebase graph
+     *
+     * @example
+     * ```typescript
+     * const graph = await guardian.scan();
+     * console.log(`${graph.files.size} files, ${graph.symbols.size} symbols`);
+     * ```
+     */
+    async scan() {
+      _graph = buildGraph(
+        config.rootDir,
+        projectConfig.tsconfig,
+        projectConfig.include,
+        projectConfig.exclude,
+        projectConfig.plugins.architecture?.layers
+      );
+      await kernel.initPlugins(_graph);
+      saveGraphCache(config.rootDir, _graph);
+      return _graph;
+    },
+    /**
+     * Perform an incremental scan based on git staged files.
+     *
+     * @returns Incremental result with changed and affected files
+     *
+     * @example
+     * ```typescript
+     * const result = await guardian.scanIncremental();
+     * console.log(`Updated ${result.changedFiles.length} files`);
+     * ```
+     */
+    async scanIncremental() {
+      if (!_graph) {
+        _graph = loadGraphCache(config.rootDir);
+      }
+      if (!_graph) {
+        await guardian.scan();
+      }
+      const program = getProgram();
+      const stagedFiles = getStagedFiles(config.rootDir);
+      const tsFiles = stagedFiles.filter((f) => f.endsWith(".ts") || f.endsWith(".tsx"));
+      const result = updateGraphIncremental(_graph, tsFiles, config.rootDir, program);
+      saveGraphCache(config.rootDir, _graph);
+      return result;
+    },
+    /**
+     * Run analysis rules on the codebase.
+     *
+     * @param options - Run options (staged, verbose, plugins, format)
+     * @returns Run result with findings, stats, and blocked status
+     *
+     * @example
+     * ```typescript
+     * const result = await guardian.run({ staged: true });
+     * if (result.blocked) {
+     *   console.error('Commit blocked!');
+     *   process.exit(1);
+     * }
+     * ```
+     */
+    async run(options = {}) {
+      if (!_graph) {
+        if (options.staged) {
+          await guardian.scanIncremental();
+        } else {
+          await guardian.scan();
+        }
+      }
+      const program = getProgram();
+      let targetFiles;
+      if (options.staged) {
+        const stagedFiles = getStagedFiles(config.rootDir);
+        targetFiles = stagedFiles.filter(
+          (f) => (f.endsWith(".ts") || f.endsWith(".tsx")) && _graph.files.has(f)
+        );
+      } else {
+        targetFiles = Array.from(_graph.files.keys());
+      }
+      let rules = kernel.getRules();
+      if (options.plugins && options.plugins.length > 0) {
+        rules = rules.filter((r) => {
+          const pluginName = r.name.split("/")[0];
+          return pluginName && options.plugins.includes(pluginName);
+        });
+      }
+      const pluginConfigMap = {};
+      if (projectConfig.plugins.architecture) {
+        pluginConfigMap["architecture"] = projectConfig.plugins.architecture;
+      }
+      if (projectConfig.plugins.security) {
+        pluginConfigMap["security"] = projectConfig.plugins.security;
+      }
+      if (projectConfig.plugins.performance) {
+        pluginConfigMap["performance"] = projectConfig.plugins.performance;
+      }
+      if (projectConfig.plugins.quality) {
+        pluginConfigMap["quality"] = projectConfig.plugins.quality;
+      }
+      const result = await executeRules(
+        _graph,
+        rules,
+        targetFiles,
+        program,
+        pluginConfigMap,
+        projectConfig.ignore.rules,
+        projectConfig.ignore.files,
+        projectConfig.severity.blockOn,
+        config.rootDir
+      );
+      return result;
+    },
+    /**
+     * Register a plugin with the guardian.
+     *
+     * @param plugin - Plugin to register
+     *
+     * @example
+     * ```typescript
+     * import { definePlugin } from '@oxog/codeguardian';
+     * guardian.use(myPlugin);
+     * ```
+     */
+    use(plugin) {
+      kernel.installPlugin(plugin);
+    },
+    /**
+     * Auto-discover project conventions.
+     *
+     * @returns Detected patterns
+     *
+     * @example
+     * ```typescript
+     * const conventions = await guardian.discover();
+     * ```
+     */
+    async discover() {
+      if (!_graph) {
+        await guardian.scan();
+      }
+      return discoverConventions(_graph);
+    },
+    /**
+     * Format run results for output.
+     *
+     * @param result - Run result
+     * @param format - Output format
+     * @param verbose - Include info-level findings
+     * @returns Formatted string
+     */
+    format(result, format = "terminal", verbose = false) {
+      switch (format) {
+        case "json":
+          return formatJSON(result);
+        case "sarif":
+          return formatSARIF(result);
+        default:
+          return formatTerminal(result, verbose);
+      }
+    },
+    /**
+     * Get graph query helpers.
+     */
+    query: {
+      getFile: (path10) => _graph ? getFile(_graph, path10) : void 0,
+      getSymbol: (name) => _graph ? getSymbol(_graph, name) : void 0,
+      getDependencies: (path10) => _graph ? getDependencies(_graph, path10) : [],
+      getDependents: (path10) => _graph ? getDependents(_graph, path10) : [],
+      findCircularDeps: () => _graph ? findCircularDeps(_graph) : [],
+      getStats: () => _graph ? getGraphStats(_graph) : null
+    },
+    /**
+     * Get all registered rules.
+     */
+    getRules() {
+      return kernel.getRules();
+    },
+    /**
+     * Get all installed plugin names.
+     */
+    getPlugins() {
+      return kernel.getPluginNames();
+    }
+  };
+  return guardian;
+}
+var HOOK_CONTENT = `#!/bin/sh
+# codeguardian pre-commit hook
+npx codeguardian run --staged
+`;
+function installHook(rootDir) {
+  const gitDir = path8__namespace.join(rootDir, ".git");
+  if (!fs2__namespace.existsSync(gitDir)) {
+    throw new GitError("Not a git repository. Run `git init` first.", { rootDir });
+  }
+  const hooksDir = path8__namespace.join(gitDir, "hooks");
+  if (!fs2__namespace.existsSync(hooksDir)) {
+    fs2__namespace.mkdirSync(hooksDir, { recursive: true });
+  }
+  const hookPath = path8__namespace.join(hooksDir, "pre-commit");
+  if (fs2__namespace.existsSync(hookPath)) {
+    const existing = fs2__namespace.readFileSync(hookPath, "utf-8");
+    if (!existing.includes("codeguardian")) {
+      const backupPath = path8__namespace.join(hooksDir, "pre-commit.backup");
+      fs2__namespace.writeFileSync(backupPath, existing, "utf-8");
+    }
+  }
+  fs2__namespace.writeFileSync(hookPath, HOOK_CONTENT, { mode: 493, encoding: "utf-8" });
+  return true;
+}
+function uninstallHook(rootDir) {
+  const hookPath = path8__namespace.join(rootDir, ".git", "hooks", "pre-commit");
+  if (!fs2__namespace.existsSync(hookPath)) {
+    return false;
+  }
+  const content = fs2__namespace.readFileSync(hookPath, "utf-8");
+  if (!content.includes("codeguardian")) {
+    return false;
+  }
+  const backupPath = path8__namespace.join(rootDir, ".git", "hooks", "pre-commit.backup");
+  if (fs2__namespace.existsSync(backupPath)) {
+    const backup = fs2__namespace.readFileSync(backupPath, "utf-8");
+    fs2__namespace.writeFileSync(hookPath, backup, { mode: 493, encoding: "utf-8" });
+    fs2__namespace.unlinkSync(backupPath);
+  } else {
+    fs2__namespace.unlinkSync(hookPath);
+  }
+  return true;
+}
+var VERSION = "1.0.0";
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.flags["version"] || args.flags["v"]) {
+    console.log(`@oxog/codeguardian v${VERSION}`);
+    return;
+  }
+  if (args.flags["help"] || args.flags["h"] || !args.command) {
+    printHelp();
+    return;
+  }
+  const rootDir = process.cwd();
+  switch (args.command) {
+    case "init":
+      await runInit(rootDir);
+      break;
+    case "run":
+      await runAnalysis(rootDir, args.flags);
+      break;
+    case "stats":
+      await runStats(rootDir);
+      break;
+    case "rules":
+      await runRules(rootDir);
+      break;
+    case "conventions":
+      await runConventions(rootDir);
+      break;
+    case "scan":
+      await runScan(rootDir, args.flags);
+      break;
+    case "uninstall":
+      runUninstall(rootDir);
+      break;
+    default:
+      console.error(color.red(`Unknown command: ${args.command}`));
+      printHelp();
+      process.exit(1);
+  }
+}
+function printHelp() {
+  console.log(`
+${color.bold("@oxog/codeguardian")} v${VERSION}
+Zero-dependency TypeScript codebase guardian
+
+${color.bold("Usage:")}
+  codeguardian <command> [options]
+
+${color.bold("Commands:")}
+  init          Initialize codeguardian in a project
+  run           Run analysis on all or staged files
+  stats         Show codebase graph statistics
+  rules         List all registered rules
+  conventions   List detected project conventions
+  scan          Rebuild the full codebase graph
+  uninstall     Remove pre-commit hook
+
+${color.bold("Run Options:")}
+  --staged      Analyze staged files only (pre-commit mode)
+  --verbose     Include info-level findings
+  --format      Output format: terminal (default), json, sarif
+  --plugin      Run specific plugin(s) only
+
+${color.bold("Global Options:")}
+  --version, -v Show version
+  --help, -h    Show help
+`);
+}
+async function runInit(rootDir) {
+  console.log(color.bold("\n  @oxog/codeguardian \u2014 Init\n"));
+  if (!isGitRepo(rootDir)) {
+    console.log(color.yellow("  \u26A0 Not a git repository. Pre-commit hook will not be installed."));
+    console.log(color.dim("    Run `git init` first if you want hook integration.\n"));
+  } else {
+    try {
+      installHook(rootDir);
+      console.log(color.green("  \u2713 Pre-commit hook installed"));
+    } catch (err) {
+      console.log(color.yellow(`  \u26A0 Could not install hook: ${err instanceof Error ? err.message : String(err)}`));
+    }
+  }
+  const configPath = path8__namespace.join(rootDir, ".codeguardian.json");
+  try {
+    writeFileSync2(configPath, getDefaultConfigJSON());
+    console.log(color.green("  \u2713 Configuration file created (.codeguardian.json)"));
+  } catch (err) {
+    console.log(color.yellow(`  \u26A0 Could not create config: ${err instanceof Error ? err.message : String(err)}`));
+  }
+  try {
+    console.log(color.dim("  Scanning project..."));
+    const guardian = createGuardian({ rootDir });
+    const graph = await guardian.scan();
+    console.log(color.green(`  \u2713 Scanned ${graph.files.size} files, ${graph.symbols.size} symbols`));
+    console.log(color.green("  \u2713 Graph cached to .codeguardian/graph.json"));
+  } catch (err) {
+    console.log(color.yellow(`  \u26A0 Scan failed: ${err instanceof Error ? err.message : String(err)}`));
+    console.log(color.dim("    You can try running `codeguardian scan --full` later."));
+  }
+  console.log(color.bold("\n  Done! codeguardian is ready.\n"));
+}
+async function runAnalysis(rootDir, flags) {
+  const staged = flags["staged"] === true;
+  const verbose = flags["verbose"] === true;
+  const format = typeof flags["format"] === "string" ? flags["format"] : "terminal";
+  const pluginFilter = typeof flags["plugin"] === "string" ? [flags["plugin"]] : void 0;
+  try {
+    const guardian = createGuardian({ rootDir });
+    const result = await guardian.run({
+      staged,
+      verbose,
+      plugins: pluginFilter,
+      format
+    });
+    const output = guardian.format(result, format, verbose);
+    console.log(output);
+    if (result.blocked) {
+      process.exit(1);
+    }
+  } catch (err) {
+    console.error(color.red(`
+  Error: ${err instanceof Error ? err.message : String(err)}
+`));
+    process.exit(1);
+  }
+}
+async function runStats(rootDir) {
+  try {
+    const guardian = createGuardian({ rootDir });
+    await guardian.scan();
+    const stats = guardian.query.getStats();
+    if (!stats) {
+      console.log(color.yellow("  No graph available. Run scan first."));
+      return;
+    }
+    console.log(`
+${color.bold("  @oxog/codeguardian \u2014 Stats")}
+
+  Files:      ${stats.totalFiles}
+  Symbols:    ${stats.totalSymbols}
+  Edges:      ${stats.totalEdges}
+  Functions:  ${stats.totalFunctions}
+  Total LOC:  ${stats.totalLOC}
+  Avg Complexity: ${stats.avgComplexity.toFixed(1)}
+
+  ${color.bold("By Role:")}
+${Object.entries(stats.filesByRole).map(([role, count]) => `    ${role}: ${count}`).join("\n")}
+
+  ${color.bold("By Layer:")}
+${Object.entries(stats.filesByLayer).map(([layer, count]) => `    ${layer}: ${count}`).join("\n")}
+`);
+  } catch (err) {
+    console.error(color.red(`  Error: ${err instanceof Error ? err.message : String(err)}`));
+    process.exit(1);
+  }
+}
+async function runRules(rootDir) {
+  try {
+    const guardian = createGuardian({ rootDir });
+    const rules = guardian.getRules();
+    console.log(`
+${color.bold("  @oxog/codeguardian \u2014 Rules")} (${rules.length} total)
+`);
+    const byCategory = /* @__PURE__ */ new Map();
+    for (const rule of rules) {
+      if (!byCategory.has(rule.category)) {
+        byCategory.set(rule.category, []);
+      }
+      byCategory.get(rule.category).push(rule);
+    }
+    for (const [category, categoryRules] of byCategory) {
+      console.log(`  ${color.bold(category.toUpperCase())}`);
+      for (const rule of categoryRules) {
+        const sevColor = rule.severity === "critical" || rule.severity === "error" ? color.red : rule.severity === "warning" ? color.yellow : color.dim;
+        console.log(`    ${sevColor(rule.severity.padEnd(8))} ${rule.name}`);
+        console.log(`    ${color.dim(rule.description)}`);
+      }
+      console.log("");
+    }
+  } catch (err) {
+    console.error(color.red(`  Error: ${err instanceof Error ? err.message : String(err)}`));
+    process.exit(1);
+  }
+}
+async function runConventions(rootDir) {
+  try {
+    const guardian = createGuardian({ rootDir });
+    const conventions = await guardian.discover();
+    console.log(`
+${color.bold("  @oxog/codeguardian \u2014 Conventions")} (${conventions.length} detected)
+`);
+    for (const conv of conventions) {
+      console.log(`  ${color.bold(conv.type)} (${conv.confidence}% confidence)`);
+      console.log(`    ${conv.description}`);
+      if (conv.files.length > 0) {
+        console.log(`    Files: ${conv.files.slice(0, 3).join(", ")}${conv.files.length > 3 ? ` +${conv.files.length - 3} more` : ""}`);
+      }
+      console.log("");
+    }
+  } catch (err) {
+    console.error(color.red(`  Error: ${err instanceof Error ? err.message : String(err)}`));
+    process.exit(1);
+  }
+}
+async function runScan(rootDir, flags) {
+  const full = flags["full"] === true;
+  console.log(color.dim(`
+  ${full ? "Full" : "Incremental"} scan...
+`));
+  try {
+    const guardian = createGuardian({ rootDir });
+    const graph = await guardian.scan();
+    console.log(color.green(`  \u2713 Scanned ${graph.files.size} files, ${graph.symbols.size} symbols`));
+    console.log(color.green("  \u2713 Graph cached to .codeguardian/graph.json\n"));
+  } catch (err) {
+    console.error(color.red(`  Error: ${err instanceof Error ? err.message : String(err)}`));
+    process.exit(1);
+  }
+}
+function runUninstall(rootDir) {
+  try {
+    const removed = uninstallHook(rootDir);
+    if (removed) {
+      console.log(color.green("\n  \u2713 Pre-commit hook removed\n"));
+    } else {
+      console.log(color.yellow("\n  \u26A0 No codeguardian hook found\n"));
+    }
+  } catch (err) {
+    console.error(color.red(`  Error: ${err instanceof Error ? err.message : String(err)}`));
+    process.exit(1);
+  }
+}
+main().catch((err) => {
+  console.error(color.red(`Fatal error: ${err instanceof Error ? err.message : String(err)}`));
+  process.exit(1);
+});
+//# sourceMappingURL=cli.cjs.map
+//# sourceMappingURL=cli.cjs.map