@planu/cli 0.89.0 → 0.90.1

package/dist/engine/auditor.test.js

@@ -0,0 +1,2075 @@
+// SpecForge — Auditor Engine Tests
+// Comprehensive tests for auditCode and auditFile, exercising all internal
+// check functions (checkCleanCode, checkSolid, checkArchitecture, checkSecurity,
+// checkErrorHandling, checkPerformance, checkTestingPractices, checkDry,
+// checkCustomRule) via the public API surface plus helpers
+// (findFunctionBoundaries, findCodeFiles, buildSummary, calculateScore).
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+// ── Module-level mocks ──────────────────────────────────────────────────────
+vi.mock('node:fs/promises', () => ({
+    readFile: vi.fn(),
+    stat: vi.fn(),
+}));
+vi.mock('glob', () => ({
+    glob: vi.fn().mockResolvedValue([]),
+}));
+import { readFile } from 'node:fs/promises';
+import { glob } from 'glob';
+import { auditCode, auditFile } from './auditor.js';
+const mockReadFile = vi.mocked(readFile);
+const mockGlob = vi.mocked(glob);
+beforeEach(() => {
+    vi.clearAllMocks();
+    mockGlob.mockResolvedValue([]);
+});
+// ── Helpers ─────────────────────────────────────────────────────────────────
+function findFinding(findings, rule) {
+    return findings.find((f) => f.rule === rule);
+}
+function findFindings(findings, rule) {
+    return findings.filter((f) => f.rule === rule);
+}
+// ════════════════════════════════════════════════════════════════════════════
+// auditFile — lightweight single-file auditing
+// ════════════════════════════════════════════════════════════════════════════
+describe('auditFile', () => {
+    it('returns empty array when readFile throws', async () => {
+        mockReadFile.mockRejectedValue(new Error('ENOENT'));
+        const findings = await auditFile('/missing.ts');
+        expect(findings).toEqual([]);
+    });
+    it('uses default categories [clean-code, security] when none provided', async () => {
+        const content = [
+            `const api_key = "realSecretKeyValue1234";`,
+            `// TODO: fix this`,
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/defaults.ts');
+        const cats = new Set(findings.map((f) => f.category));
+        // Should include both clean-code and security
+        expect(cats.has('clean-code')).toBe(true);
+        expect(cats.has('security')).toBe(true);
+        // Should NOT include error-handling (not in defaults)
+        expect(cats.has('error-handling')).toBe(false);
+    });
+    it('runs error-handling checks when explicitly requested', async () => {
+        const content = `try { doSomething(); } catch (e) {}`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/err.ts', ['error-handling']);
+        expect(findFinding(findings, 'empty-catch')).toBeDefined();
+    });
+    it('only runs requested category', async () => {
+        const content = `const api_key = "superSecretValue12345"; eval("bad"); // TODO: fix`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/only-sec.ts', ['security']);
+        for (const f of findings) {
+            expect(f.category).toBe('security');
+        }
+    });
+});
+// ════════════════════════════════════════════════════════════════════════════
+// auditCode — full project audit
+// ════════════════════════════════════════════════════════════════════════════
+describe('auditCode', () => {
+    // -- findCodeFiles --
+    it('returns result with zero files when glob returns empty', async () => {
+        mockGlob.mockResolvedValue([]);
+        const result = await auditCode('src', '/project');
+        expect(result.filesAnalyzed).toBe(0);
+        expect(result.findings).toEqual([]);
+        expect(result.score).toBe(100);
+    });
+    it('filters by code extensions from glob results', async () => {
+        mockGlob.mockResolvedValue(['app.ts', 'readme.md', 'logo.png', 'util.js']);
+        mockReadFile.mockResolvedValue('const x = 1;');
+        const result = await auditCode('src', '/project');
+        // Only .ts and .js should pass
+        expect(result.filesAnalyzed).toBe(2);
+    });
+    it('handles glob failure gracefully (returns empty files)', async () => {
+        mockGlob.mockRejectedValue(new Error('permission denied'));
+        const result = await auditCode('src', '/project');
+        expect(result.filesAnalyzed).toBe(0);
+        expect(result.score).toBe(100);
+    });
+    it('skips files that fail to read and continues', async () => {
+        mockGlob.mockResolvedValue(['good.ts', 'bad.ts']);
+        mockReadFile
+            .mockResolvedValueOnce('const x = 1;')
+            .mockRejectedValueOnce(new Error('ENOENT'));
+        const result = await auditCode('src', '/project');
+        expect(result.filesAnalyzed).toBe(2);
+        // Should not throw
+    });
+    it('resolves absolute path when path starts with /', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        mockReadFile.mockResolvedValue('const x = 1;');
+        await auditCode('/absolute/src', '/project');
+        // glob should be called with the absolute path as cwd
+        expect(mockGlob).toHaveBeenCalledWith('**/*', expect.objectContaining({ cwd: '/absolute/src' }));
+    });
+    it('resolves relative path by joining with projectPath', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        mockReadFile.mockResolvedValue('const x = 1;');
+        await auditCode('src', '/project');
+        expect(mockGlob).toHaveBeenCalledWith('**/*', expect.objectContaining({ cwd: '/project/src' }));
+    });
+    // -- Default categories --
+    it('uses all default categories when none provided', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        // Content that triggers multiple categories
+        const content = [
+            '// TODO: fix',
+            'try { x(); } catch (e) {}',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project');
+        const cats = new Set(result.findings.map((f) => f.category));
+        // Default categories include clean-code and error-handling
+        expect(cats.has('clean-code')).toBe(true);
+        expect(cats.has('error-handling')).toBe(true);
+    });
+    // -- Profile overrides --
+    it('uses enabledCategories from profile when provided', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = `const api_key = "realSecretKeyValue1234"; // TODO: fix`;
+        mockReadFile.mockResolvedValue(content);
+        const profile = {
+            enabledCategories: ['security'],
+            customRules: [],
+            principles: [],
+            strictness: 'standard',
+        };
+        const result = await auditCode('src', '/project', ['clean-code'], profile);
+        // Should ONLY have security findings (profile overrides passed categories)
+        for (const f of result.findings) {
+            expect(f.category).toBe('security');
+        }
+    });
+    // -- Custom rules via profile --
+    it('runs custom rules that match enabled categories', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = `const DEBUG_MODE = true; console.log("debug");`;
+        mockReadFile.mockResolvedValue(content);
+        const customRule = {
+            id: 'no-debug-mode',
+            description: 'DEBUG_MODE should not be true in production',
+            category: 'clean-code',
+            severity: 'warning',
+            source: 'team-rules',
+            pattern: 'DEBUG_MODE\\s*=\\s*true',
+        };
+        const profile = {
+            enabledCategories: ['clean-code'],
+            customRules: [customRule],
+            principles: [],
+            strictness: 'standard',
+        };
+        const result = await auditCode('src', '/project', [], profile);
+        const finding = findFinding(result.findings, 'no-debug-mode');
+        expect(finding).toBeDefined();
+        expect(finding.message).toBe('DEBUG_MODE should not be true in production');
+        expect(finding.suggestion).toContain('team-rules');
+    });
+    it('skips custom rules whose category is not enabled', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = `const DEBUG_MODE = true;`;
+        mockReadFile.mockResolvedValue(content);
+        const customRule = {
+            id: 'no-debug-mode',
+            description: 'No debug mode',
+            category: 'security', // Not in enabledCategories
+            severity: 'warning',
+            source: 'team-rules',
+            pattern: 'DEBUG_MODE',
+        };
+        const profile = {
+            enabledCategories: ['clean-code'],
+            customRules: [customRule],
+            principles: [],
+            strictness: 'standard',
+        };
+        const result = await auditCode('src', '/project', [], profile);
+        expect(findFinding(result.findings, 'no-debug-mode')).toBeUndefined();
+    });
+    it('handles custom rule with no pattern (returns null)', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        mockReadFile.mockResolvedValue('const x = 1;');
+        const customRule = {
+            id: 'no-pattern-rule',
+            description: 'Rule without pattern',
+            category: 'clean-code',
+            severity: 'info',
+            source: 'team',
+            // no pattern property
+        };
+        const profile = {
+            enabledCategories: ['clean-code'],
+            customRules: [customRule],
+            principles: [],
+            strictness: 'standard',
+        };
+        const result = await auditCode('src', '/project', [], profile);
+        expect(findFinding(result.findings, 'no-pattern-rule')).toBeUndefined();
+    });
+    it('handles custom rule with invalid regex pattern gracefully', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        mockReadFile.mockResolvedValue('const x = 1;');
+        const customRule = {
+            id: 'bad-regex-rule',
+            description: 'Rule with broken regex',
+            category: 'clean-code',
+            severity: 'error',
+            source: 'team',
+            pattern: '[invalid(regex',
+        };
+        const profile = {
+            enabledCategories: ['clean-code'],
+            customRules: [customRule],
+            principles: [],
+            strictness: 'standard',
+        };
+        const result = await auditCode('src', '/project', [], profile);
+        // Should not throw and finding should not appear
+        expect(findFinding(result.findings, 'bad-regex-rule')).toBeUndefined();
+    });
+    it('handles custom rule whose pattern does not match', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        mockReadFile.mockResolvedValue('const x = 1;');
+        const customRule = {
+            id: 'never-matches',
+            description: 'Never triggers',
+            category: 'clean-code',
+            severity: 'info',
+            source: 'team',
+            pattern: 'NEVER_MATCH_THIS_PATTERN_ABCXYZ',
+        };
+        const profile = {
+            enabledCategories: ['clean-code'],
+            customRules: [customRule],
+            principles: [],
+            strictness: 'standard',
+        };
+        const result = await auditCode('src', '/project', [], profile);
+        expect(findFinding(result.findings, 'never-matches')).toBeUndefined();
+    });
+    // -- Summary & Score --
+    it('returns summary with byCategory, topIssues, strengths, score', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = `// TODO: fix\n// FIXME: broken`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['clean-code', 'security']);
+        expect(result.summary).toBeDefined();
+        expect(result.summary.byCategory).toBeDefined();
+        expect(result.summary.topIssues).toBeInstanceOf(Array);
+        expect(result.summary.strengths).toBeInstanceOf(Array);
+        expect(typeof result.summary.score).toBe('number');
+    });
+    it('summary includes strengths for categories with zero findings', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = `function add(a: number, b: number) { return a + b; }`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['clean-code', 'security']);
+        // security should have zero findings for clean code
+        const securityStrength = result.summary.strengths.find((s) => s.includes('security'));
+        expect(securityStrength).toBeDefined();
+    });
+    it('summary topIssues lists up to 5 most frequent rules', async () => {
+        mockGlob.mockResolvedValue(['a.ts', 'b.ts', 'c.ts', 'd.ts', 'e.ts', 'f.ts']);
+        // Each file has a TODO
+        mockReadFile.mockResolvedValue('// TODO: fixme\n// HACK: workaround');
+        const result = await auditCode('src', '/project', ['clean-code']);
+        expect(result.summary.topIssues.length).toBeLessThanOrEqual(5);
+        if (result.summary.topIssues.length > 0) {
+            expect(result.summary.topIssues[0]).toContain('occurrences');
+        }
+    });
+    it('score is 100 when no findings exist', async () => {
+        mockGlob.mockResolvedValue([]);
+        const result = await auditCode('src', '/project');
+        expect(result.score).toBe(100);
+    });
+    it('score decreases with critical findings', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = `const api_key = "realSecretKeyValue1234";`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['security']);
+        expect(result.score).toBeLessThan(100);
+    });
+    it('score is non-negative even with many findings', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        // Create content with many critical findings
+        const lines = [];
+        for (let i = 0; i < 20; i++) {
+            lines.push(`const secret${i} = "realApiKeyValue${i}pad_pad";`);
+            lines.push(`eval("code${i}");`);
+        }
+        mockReadFile.mockResolvedValue(lines.join('\n'));
+        const result = await auditCode('src', '/project', ['security']);
+        expect(result.score).toBeGreaterThanOrEqual(0);
+    });
+    // -- All category branches in auditCode --
+    it('runs performance checks when category is performance', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = `for (let i = 0; i < items.length; i++) {\n  await fetch("/api/" + items[i]);\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['performance']);
+        const finding = findFinding(result.findings, 'n-plus-one');
+        expect(finding).toBeDefined();
+    });
+    it('runs testing checks when category is testing', async () => {
+        mockGlob.mockResolvedValue(['app.test.ts']);
+        const content = `it.skip('broken test', () => { expect(true).toBe(true); });`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['testing']);
+        const finding = findFinding(result.findings, 'test-skip');
+        expect(finding).toBeDefined();
+    });
+    it('runs dry checks when category is dry', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const dupLine = 'const result = processItem(item, config, options);';
+        const content = Array.from({ length: 5 }, () => dupLine).join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['dry']);
+        const finding = findFinding(result.findings, 'duplicate-code');
+        expect(finding).toBeDefined();
+    });
+    it('runs solid checks when category is solid', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        // 3 classes => SRP violation
+        const content = `class A {}\nclass B {}\nclass C {}`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['solid']);
+        const finding = findFinding(result.findings, 'srp-multiple-classes');
+        expect(finding).toBeDefined();
+    });
+    it('runs architecture checks when category is architecture', async () => {
+        mockGlob.mockResolvedValue(['repositories/user.ts']);
+        const content = `import { useState } from 'react';`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('.', '/project');
+        expect(findFinding(result.findings, 'layer-violation-ui-in-data')).toBeDefined();
+    });
+});
+// ════════════════════════════════════════════════════════════════════════════
+// checkCleanCode — detailed branch coverage
+// ════════════════════════════════════════════════════════════════════════════
+describe('checkCleanCode', () => {
+    // -- file-too-long --
+    it('flags files exceeding 500 lines', async () => {
+        const longContent = Array.from({ length: 550 }, (_, i) => `const x${i} = ${i};`).join('\n');
+        mockReadFile.mockResolvedValue(longContent);
+        const findings = await auditFile('/test/long.ts', ['clean-code']);
+        const finding = findFinding(findings, 'file-too-long');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('warning');
+        expect(finding.message).toContain('550');
+        expect(finding.message).toContain('500');
+    });
+    it('does not flag file with exactly 500 lines', async () => {
+        const content = Array.from({ length: 500 }, (_, i) => `const x${i} = ${i};`).join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/exact.ts', ['clean-code']);
+        expect(findFinding(findings, 'file-too-long')).toBeUndefined();
+    });
+    // -- function-too-long --
+    it('flags functions exceeding 50 lines', async () => {
+        const body = Array.from({ length: 55 }, (_, i) => `  const v${i} = ${i};`).join('\n');
+        const content = `function longFunction() {\n${body}\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/long-fn.ts', ['clean-code']);
+        const finding = findFinding(findings, 'function-too-long');
+        expect(finding).toBeDefined();
+        expect(finding.message).toContain('longFunction');
+    });
+    it('does not flag functions within 50 lines', async () => {
+        const body = Array.from({ length: 10 }, (_, i) => `  const v${i} = ${i};`).join('\n');
+        const content = `function shortFunction() {\n${body}\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/short-fn.ts', ['clean-code']);
+        expect(findFinding(findings, 'function-too-long')).toBeUndefined();
+    });
+    it('detects arrow function declarations', async () => {
+        const body = Array.from({ length: 55 }, (_, i) => `  const v${i} = ${i};`).join('\n');
+        const content = `const myArrowFn = () => {\n${body}\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/arrow-fn.ts', ['clean-code']);
+        const finding = findFinding(findings, 'function-too-long');
+        expect(finding).toBeDefined();
+        expect(finding.message).toContain('myArrowFn');
+    });
+    it('detects python def functions', async () => {
+        // Python-style function detection
+        const body = Array.from({ length: 55 }, (_, i) => `  v${i} = ${i}`).join('\n');
+        const content = `def long_function():\n${body}\n`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/long-fn.py', ['clean-code']);
+        const finding = findFinding(findings, 'function-too-long');
+        expect(finding).toBeDefined();
+        expect(finding.message).toContain('long_function');
+    });
+    it('detects Go func functions', async () => {
+        const body = Array.from({ length: 55 }, (_, i) => `  v${i} := ${i}`).join('\n');
+        const content = `func longGoFunction() {\n${body}\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/long-fn.go', ['clean-code']);
+        const finding = findFinding(findings, 'function-too-long');
+        expect(finding).toBeDefined();
+        expect(finding.message).toContain('longGoFunction');
+    });
+    it('detects Rust fn functions', async () => {
+        const body = Array.from({ length: 55 }, (_, i) => `  let v${i} = ${i};`).join('\n');
+        const content = `fn long_rust_function() {\n${body}\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/long-fn.rs', ['clean-code']);
+        const finding = findFinding(findings, 'function-too-long');
+        expect(finding).toBeDefined();
+        expect(finding.message).toContain('long_rust_function');
+    });
+    it('detects Kotlin fun functions', async () => {
+        const body = Array.from({ length: 55 }, (_, i) => `  val v${i} = ${i}`).join('\n');
+        const content = `fun longKotlinFunction() {\n${body}\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/long-fn.kt', ['clean-code']);
+        const finding = findFinding(findings, 'function-too-long');
+        expect(finding).toBeDefined();
+        expect(finding.message).toContain('longKotlinFunction');
+    });
+    it('detects async function declarations', async () => {
+        const body = Array.from({ length: 55 }, (_, i) => `  const v${i} = ${i};`).join('\n');
+        const content = `async function asyncLongFn() {\n${body}\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/async-long.ts', ['clean-code']);
+        const finding = findFinding(findings, 'function-too-long');
+        expect(finding).toBeDefined();
+        expect(finding.message).toContain('asyncLongFn');
+    });
+    it('detects export function declarations', async () => {
+        const body = Array.from({ length: 55 }, (_, i) => `  const v${i} = ${i};`).join('\n');
+        const content = `export function exportedLongFn() {\n${body}\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/exported-long.ts', ['clean-code']);
+        const finding = findFinding(findings, 'function-too-long');
+        expect(finding).toBeDefined();
+        expect(finding.message).toContain('exportedLongFn');
+    });
+    it('detects export async function declarations', async () => {
+        const body = Array.from({ length: 55 }, (_, i) => `  const v${i} = ${i};`).join('\n');
+        const content = `export async function exportAsyncLongFn() {\n${body}\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/export-async-long.ts', ['clean-code']);
+        const finding = findFinding(findings, 'function-too-long');
+        expect(finding).toBeDefined();
+        expect(finding.message).toContain('exportAsyncLongFn');
+    });
+    // -- too-many-params --
+    it('flags functions with more than 4 parameters', async () => {
+        // Must be 80+ chars inside parens AND more than 4 params
+        const content = `function bigFn(paramAlpha: string, paramBeta: number, paramGamma: boolean, paramDelta: object, paramEpsilon: any) { return 1; }`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/params.ts', ['clean-code']);
+        const finding = findFinding(findings, 'too-many-params');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('warning');
+        expect(finding.message).toContain('5');
+    });
+    it('does not flag functions with 4 or fewer parameters', async () => {
+        const content = `function smallFn(a: string, b: number, c: boolean, d: object) { return 1; }`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/few-params.ts', ['clean-code']);
+        expect(findFinding(findings, 'too-many-params')).toBeUndefined();
+    });
+    it('does not flag function params under 80 chars (short signature)', async () => {
+        // Even with 5 params, if they're short enough not to exceed 80 chars, regex won't match
+        const content = `function fn(a, b, c, d, e) { return 1; }`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/short-sig.ts', ['clean-code']);
+        expect(findFinding(findings, 'too-many-params')).toBeUndefined();
+    });
+    it('detects def with many params (Python)', async () => {
+        const content = `def big_fn(param_alpha, param_beta, param_gamma, param_delta, param_epsilon, param_zeta_extra) :\n  pass`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/params.py', ['clean-code']);
+        const finding = findFinding(findings, 'too-many-params');
+        expect(finding).toBeDefined();
+    });
+    // -- pending-marker --
+    it('detects TODO markers', async () => {
+        const content = `function foo() {\n  // TODO: fix this later\n  return 42;\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/todo.ts', ['clean-code']);
+        const finding = findFinding(findings, 'pending-marker');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('info');
+        expect(finding.message).toContain('TODO');
+        expect(finding.line).toBe(2);
+    });
+    it('detects FIXME markers', async () => {
+        const content = `// FIXME: memory leak here`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/fixme.ts', ['clean-code']);
+        expect(findFinding(findings, 'pending-marker').message).toContain('FIXME');
+    });
+    it('detects HACK markers', async () => {
+        const content = `const x = 1; // HACK: workaround for issue`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/hack.ts', ['clean-code']);
+        expect(findFinding(findings, 'pending-marker').message).toContain('HACK');
+    });
+    it('detects XXX markers', async () => {
+        const content = `// XXX: needs review`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/xxx.ts', ['clean-code']);
+        expect(findFinding(findings, 'pending-marker').message).toContain('XXX');
+    });
+    it('handles TODO with no description (empty match group)', async () => {
+        const content = `// TODO:`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/todo-empty.ts', ['clean-code']);
+        const finding = findFinding(findings, 'pending-marker');
+        expect(finding).toBeDefined();
+        // message should include "(no description)" or empty string
+        expect(finding.message).toContain('TODO');
+    });
+    // -- deep-nesting --
+    it('flags deeply nested code (more than 5 indentation levels)', async () => {
+        const content = [
+            'function deep() {',
+            '  if (true) {',
+            '    if (true) {',
+            '      if (true) {',
+            '        if (true) {',
+            '          if (true) {',
+            '            const x = 1;', // 12 spaces = 6 levels
+            '          }',
+            '        }',
+            '      }',
+            '    }',
+            '  }',
+            '}',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/deep.ts', ['clean-code']);
+        const finding = findFinding(findings, 'deep-nesting');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('warning');
+    });
+    it('does not flag moderately nested code', async () => {
+        const content = [
+            'function shallow() {',
+            '  if (true) {',
+            '    if (true) {',
+            '      const x = 1;', // 6 spaces = 3 levels
+            '    }',
+            '  }',
+            '}',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/shallow.ts', ['clean-code']);
+        expect(findFinding(findings, 'deep-nesting')).toBeUndefined();
+    });
+    it('reports only first deep nesting occurrence per file (break)', async () => {
+        const content = [
+            '            const x = 1;', // deep
+            '            const y = 2;', // also deep
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/multi-deep.ts', ['clean-code']);
+        const deepFindings = findFindings(findings, 'deep-nesting');
+        expect(deepFindings).toHaveLength(1);
+    });
+    it('skips blank deeply indented lines', async () => {
+        const content = [
+            '            ', // deep but empty (trim().length === 0)
+            '  const x = 1;',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/blank-deep.ts', ['clean-code']);
+        expect(findFinding(findings, 'deep-nesting')).toBeUndefined();
+    });
+    // -- magic-number --
+    it('detects magic numbers in code', async () => {
+        const content = `function calc(x: number) {\n  return x * 42;\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/magic.ts', ['clean-code']);
+        const finding = findFinding(findings, 'magic-number');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('info');
+        expect(finding.message).toContain('42');
+    });
+    it('does not flag common HTTP status codes', async () => {
+        const content = `if (status === 404) { return; }`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/status.ts', ['clean-code']);
+        expect(findFinding(findings, 'magic-number')).toBeUndefined();
+    });
+    it('does not flag 0 or 1', async () => {
+        // 0 and 1 are single digit, so the regex won't match (needs 2+ digits)
+        const content = `const x = 0; const y = 1;`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/zero-one.ts', ['clean-code']);
+        expect(findFinding(findings, 'magic-number')).toBeUndefined();
+    });
+    it('does not flag numbers on lines with "port" or "PORT"', async () => {
+        const content = `const port = 3000;`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/port.ts', ['clean-code']);
+        expect(findFinding(findings, 'magic-number')).toBeUndefined();
+    });
+    it('does not flag numbers on lines with "timeout"', async () => {
+        const content = `const timeout = 5000;`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/timeout.ts', ['clean-code']);
+        expect(findFinding(findings, 'magic-number')).toBeUndefined();
+    });
+    it('skips comment lines starting with //', async () => {
+        const content = `  // Magic number 42 in comment`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/comment.ts', ['clean-code']);
+        expect(findFinding(findings, 'magic-number')).toBeUndefined();
+    });
+    it('skips comment lines starting with #', async () => {
+        const content = `  # Magic number 42 in comment`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/hash-comment.ts', ['clean-code']);
+        expect(findFinding(findings, 'magic-number')).toBeUndefined();
+    });
+    it('skips comment lines starting with *', async () => {
+        const content = `  * Magic number 42 in JSDoc`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/jsdoc.ts', ['clean-code']);
+        expect(findFinding(findings, 'magic-number')).toBeUndefined();
+    });
+    it('skips import lines', async () => {
+        const content = `import { something42 } from 'module';`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/import.ts', ['clean-code']);
+        expect(findFinding(findings, 'magic-number')).toBeUndefined();
+    });
+    it('skips require lines', async () => {
+        const content = `const mod = require('module42');`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/require.ts', ['clean-code']);
+        expect(findFinding(findings, 'magic-number')).toBeUndefined();
+    });
+    it('reports only one magic number per file (break)', async () => {
+        const content = [
+            'const a = 42;',
+            'const b = 99;',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/multi-magic.ts', ['clean-code']);
+        const magicFindings = findFindings(findings, 'magic-number');
+        expect(magicFindings).toHaveLength(1);
+    });
+    it('does not flag common non-magic numbers like 100, 200, etc.', async () => {
+        const content = `const pct = 100; const ok = 200; const created = 201;`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/common-nums.ts', ['clean-code']);
+        expect(findFinding(findings, 'magic-number')).toBeUndefined();
+    });
+});
+// ════════════════════════════════════════════════════════════════════════════
+// checkSolid — SOLID principle checks
+// ════════════════════════════════════════════════════════════════════════════
+describe('checkSolid', () => {
+    // -- srp-multiple-classes --
+    it('flags files with more than 2 classes', async () => {
+        mockGlob.mockResolvedValue(['multi-class.ts']);
+        const content = `class A {}\nclass B {}\nclass C {}`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['solid']);
+        const finding = findFinding(result.findings, 'srp-multiple-classes');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('warning');
+        expect(finding.message).toContain('3');
+        expect(finding.reference).toContain('Single Responsibility');
+    });
+    it('does not flag files with 2 or fewer classes', async () => {
+        mockGlob.mockResolvedValue(['two-class.ts']);
+        const content = `class A {}\nclass B {}`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['solid']);
+        expect(findFinding(result.findings, 'srp-multiple-classes')).toBeUndefined();
+    });
+    // -- srp-too-many-exports --
+    it('flags files with more than 15 exports', async () => {
+        mockGlob.mockResolvedValue(['exports.ts']);
+        const exports = Array.from({ length: 16 }, (_, i) => `export const x${i} = ${i};`).join('\n');
+        mockReadFile.mockResolvedValue(exports);
+        const result = await auditCode('src', '/project', ['solid']);
+        const finding = findFinding(result.findings, 'srp-too-many-exports');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('info');
+    });
+    it('does not flag files with 15 or fewer exports', async () => {
+        mockGlob.mockResolvedValue(['exports.ts']);
+        const exports = Array.from({ length: 15 }, (_, i) => `export const x${i} = ${i};`).join('\n');
+        mockReadFile.mockResolvedValue(exports);
+        const result = await auditCode('src', '/project', ['solid']);
+        expect(findFinding(result.findings, 'srp-too-many-exports')).toBeUndefined();
+    });
+    // -- ocp-long-switch --
+    it('flags switch statements with more than 7 cases', async () => {
+        mockGlob.mockResolvedValue(['switch.ts']);
+        const cases = Array.from({ length: 8 }, (_, i) => `  case ${i}: return ${i};`).join('\n');
+        const content = `function handler(x: number) {\n  switch (x) {\n${cases}\n  }\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['solid']);
+        const finding = findFinding(result.findings, 'ocp-long-switch');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('warning');
+        expect(finding.message).toContain('8');
+        expect(finding.reference).toContain('Open/Closed');
+    });
+    it('does not flag switch with 7 or fewer cases', async () => {
+        mockGlob.mockResolvedValue(['switch.ts']);
+        const cases = Array.from({ length: 7 }, (_, i) => `  case ${i}: return ${i};`).join('\n');
+        const content = `switch (x) {\n${cases}\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['solid']);
+        expect(findFinding(result.findings, 'ocp-long-switch')).toBeUndefined();
+    });
+    it('does not flag when no switch exists', async () => {
+        mockGlob.mockResolvedValue(['no-switch.ts']);
+        const content = `if (x === 1) { return 1; } else if (x === 2) { return 2; }`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['solid']);
+        expect(findFinding(result.findings, 'ocp-long-switch')).toBeUndefined();
+    });
+    // -- isp-large-interface --
+    it('flags interfaces with more than 8 members (TypeScript files)', async () => {
+        mockGlob.mockResolvedValue(['types.ts']);
+        const members = Array.from({ length: 10 }, (_, i) => `  field${i}: string;`).join('\n');
+        const content = `interface BigInterface {\n${members}\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['solid']);
+        const finding = findFinding(result.findings, 'isp-large-interface');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('info');
+        expect(finding.message).toContain('BigInterface');
+        expect(finding.message).toContain('10');
+        expect(finding.reference).toContain('Interface Segregation');
+    });
+    it('does not flag interfaces with 8 or fewer members', async () => {
+        mockGlob.mockResolvedValue(['types.ts']);
+        const members = Array.from({ length: 8 }, (_, i) => `  field${i}: string;`).join('\n');
+        const content = `interface SmallInterface {\n${members}\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['solid']);
+        expect(findFinding(result.findings, 'isp-large-interface')).toBeUndefined();
+    });
+    it('does not check interfaces in non-TS files', async () => {
+        mockGlob.mockResolvedValue(['types.js']);
+        const members = Array.from({ length: 10 }, (_, i) => `  field${i}: string;`).join('\n');
+        const content = `interface BigInterface {\n${members}\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['solid']);
+        expect(findFinding(result.findings, 'isp-large-interface')).toBeUndefined();
+    });
+    it('checks interfaces in .tsx files too', async () => {
+        mockGlob.mockResolvedValue(['types.tsx']);
+        const members = Array.from({ length: 10 }, (_, i) => `  field${i}: string;`).join('\n');
+        const content = `interface BigTsxInterface {\n${members}\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['solid']);
+        const finding = findFinding(result.findings, 'isp-large-interface');
+        expect(finding).toBeDefined();
+        expect(finding.message).toContain('BigTsxInterface');
+    });
+    // -- dip-direct-instantiation --
+    it('flags direct instantiation of infrastructure classes', async () => {
+        mockGlob.mockResolvedValue(['service.ts']);
+        const content = `const db = new DatabaseConnection("localhost");`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['solid']);
+        const finding = findFinding(result.findings, 'dip-direct-instantiation');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('warning');
+        expect(finding.message).toContain('Database');
+        expect(finding.reference).toContain('Dependency Inversion');
+    });
+    it('flags new HttpClient', async () => {
+        mockGlob.mockResolvedValue(['service.ts']);
+        const content = `const client = new HttpClient();`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['solid']);
+        expect(findFinding(result.findings, 'dip-direct-instantiation')).toBeDefined();
+    });
+    it('flags new RedisClient', async () => {
+        mockGlob.mockResolvedValue(['service.ts']);
+        const content = `const cache = new RedisClient();`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['solid']);
+        expect(findFinding(result.findings, 'dip-direct-instantiation')).toBeDefined();
+    });
+    it('flags new MongoClient', async () => {
+        mockGlob.mockResolvedValue(['service.ts']);
+        const content = `const mongo = new MongoClient("uri");`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['solid']);
+        expect(findFinding(result.findings, 'dip-direct-instantiation')).toBeDefined();
+    });
+    it('flags new PrismaClient', async () => {
+        mockGlob.mockResolvedValue(['service.ts']);
+        const content = `const prisma = new PrismaClient();`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['solid']);
+        expect(findFinding(result.findings, 'dip-direct-instantiation')).toBeDefined();
+    });
+    it('flags new SequelizeConnection', async () => {
+        mockGlob.mockResolvedValue(['service.ts']);
+        const content = `const seq = new SequelizeConnection();`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['solid']);
+        expect(findFinding(result.findings, 'dip-direct-instantiation')).toBeDefined();
+    });
+    it('flags new MongooseModel', async () => {
+        mockGlob.mockResolvedValue(['service.ts']);
+        const content = `const model = new MongooseModel();`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['solid']);
+        expect(findFinding(result.findings, 'dip-direct-instantiation')).toBeDefined();
+    });
+    it('does not flag new for non-infrastructure classes', async () => {
+        mockGlob.mockResolvedValue(['service.ts']);
+        const content = `const user = new User("John");`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['solid']);
+        expect(findFinding(result.findings, 'dip-direct-instantiation')).toBeUndefined();
+    });
+});
+// ════════════════════════════════════════════════════════════════════════════
+// checkArchitecture — layer violation and dependency checks
+// ════════════════════════════════════════════════════════════════════════════
+describe('checkArchitecture', () => {
+    // -- layer-violation-ui-in-data --
+    it('flags UI logic in data/repository layer', async () => {
+        mockGlob.mockResolvedValue(['repositories/user-repo.ts']);
+        const content = `import { useState } from 'react';`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('.', '/project', ['architecture']);
+        const finding = findFinding(result.findings, 'layer-violation-ui-in-data');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('error');
+        expect(finding.reference).toContain('Separation of Concerns');
+    });
+    it('flags UI logic in models directory', async () => {
+        mockGlob.mockResolvedValue(['models/user.ts']);
+        const content = `const el = createElement('div');`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('.', '/project', ['architecture']);
+        expect(findFinding(result.findings, 'layer-violation-ui-in-data')).toBeDefined();
+    });
+    it('flags UI logic in db directory', async () => {
+        mockGlob.mockResolvedValue(['db/connection.ts']);
+        const content = `useEffect(() => { fetchData(); }, []);`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('.', '/project', ['architecture']);
+        expect(findFinding(result.findings, 'layer-violation-ui-in-data')).toBeDefined();
+    });
+    it('flags component render in data layer', async () => {
+        mockGlob.mockResolvedValue(['data/store.tsx']);
+        const content = `function render() { return <div>Hello</div>; }`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('.', '/project', ['architecture']);
+        expect(findFinding(result.findings, 'layer-violation-ui-in-data')).toBeDefined();
+    });
+    it('does not flag non-data-layer files with UI logic', async () => {
+        mockGlob.mockResolvedValue(['utils/helper.ts']);
+        const content = `import { useState } from 'react';`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('.', '/project', ['architecture']);
+        expect(findFinding(result.findings, 'layer-violation-ui-in-data')).toBeUndefined();
+    });
+    // -- layer-violation-data-in-ui --
+    it('flags data access in presentation layer', async () => {
+        mockGlob.mockResolvedValue(['components/UserList.ts']);
+        const content = `const users = await db.query("SELECT * FROM users");`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('.', '/project', ['architecture']);
+        const finding = findFinding(result.findings, 'layer-violation-data-in-ui');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('warning');
+    });
+    it('flags prisma in pages directory', async () => {
+        mockGlob.mockResolvedValue(['pages/index.ts']);
+        const content = `const data = await prisma.user.findMany();`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('.', '/project', ['architecture']);
+        expect(findFinding(result.findings, 'layer-violation-data-in-ui')).toBeDefined();
+    });
+    it('flags SQL keywords in views directory', async () => {
+        mockGlob.mockResolvedValue(['views/dashboard.ts']);
+        const content = `const result = execute("INSERT INTO logs VALUES (1)");`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('.', '/project', ['architecture']);
+        expect(findFinding(result.findings, 'layer-violation-data-in-ui')).toBeDefined();
+    });
+    it('flags mongoose in screens directory', async () => {
+        mockGlob.mockResolvedValue(['screens/Home.ts']);
+        const content = `const users = await mongoose.model('User').find();`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('.', '/project', ['architecture']);
+        expect(findFinding(result.findings, 'layer-violation-data-in-ui')).toBeDefined();
+    });
+    it('does not flag react-query (false positive exclusion)', async () => {
+        mockGlob.mockResolvedValue(['components/UserList.ts']);
+        const content = `import { useQuery } from 'react-query';\nconst data = query({ key: 'users' });`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('.', '/project', ['architecture']);
+        expect(findFinding(result.findings, 'layer-violation-data-in-ui')).toBeUndefined();
+    });
+    it('does not flag tanstack (false positive exclusion)', async () => {
+        mockGlob.mockResolvedValue(['components/UserList.ts']);
+        const content = `import { useQuery } from '@tanstack/react-query';\nconst data = query({ key: 'users' });`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('.', '/project', ['architecture']);
+        expect(findFinding(result.findings, 'layer-violation-data-in-ui')).toBeUndefined();
+    });
+    // -- too-many-dependencies --
+    it('flags files with more than 20 imports', async () => {
+        mockGlob.mockResolvedValue(['god-module.ts']);
+        const imports = Array.from({ length: 21 }, (_, i) => `import { mod${i} } from './mod${i}';`).join('\n');
+        const content = imports + '\n\nexport function main() { return 1; }';
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('.', '/project', ['architecture']);
+        const finding = findFinding(result.findings, 'too-many-dependencies');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('warning');
+        expect(finding.message).toContain('21');
+        expect(finding.reference).toContain('High Cohesion');
+    });
+    it('does not flag files with 20 or fewer imports', async () => {
+        mockGlob.mockResolvedValue(['normal.ts']);
+        const imports = Array.from({ length: 20 }, (_, i) => `import { mod${i} } from './mod${i}';`).join('\n');
+        mockReadFile.mockResolvedValue(imports);
+        const result = await auditCode('.', '/project', ['architecture']);
+        expect(findFinding(result.findings, 'too-many-dependencies')).toBeUndefined();
+    });
+    it('counts require-style imports', async () => {
+        mockGlob.mockResolvedValue(['old-module.js']);
+        const requires = Array.from({ length: 21 }, (_, i) => `  const mod${i} = require('./mod${i}');`).join('\n');
+        mockReadFile.mockResolvedValue(requires);
+        const result = await auditCode('.', '/project', ['architecture']);
+        expect(findFinding(result.findings, 'too-many-dependencies')).toBeDefined();
+    });
+});
+// ════════════════════════════════════════════════════════════════════════════
+// checkSecurity — security vulnerability detection
+// ════════════════════════════════════════════════════════════════════════════
+describe('checkSecurity', () => {
+    // -- hardcoded-secret --
+    it('flags hardcoded API keys', async () => {
+        const content = `const api_key = "sk-abc123defghijklmno";`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/secrets.ts', ['security']);
+        const finding = findFinding(findings, 'hardcoded-secret');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('critical');
+        expect(finding.reference).toContain('OWASP');
+    });
+    it('flags hardcoded passwords', async () => {
+        const content = `const password = "superSecret123!";`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/pass.ts', ['security']);
+        expect(findFinding(findings, 'hardcoded-secret')).toBeDefined();
+    });
+    it('flags hardcoded tokens', async () => {
+        const content = `const token = "eyJhbGciOiJIUzI1NiIs";`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/token.ts', ['security']);
+        expect(findFinding(findings, 'hardcoded-secret')).toBeDefined();
+    });
+    it('flags hardcoded private keys', async () => {
+        const content = `const private_key = "MIIEvgIBADANBgkqhkiG9w0BAQ";`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/pk.ts', ['security']);
+        expect(findFinding(findings, 'hardcoded-secret')).toBeDefined();
+    });
+    it('flags hardcoded secret values', async () => {
+        const content = `const secret = "my-super-secret-value-123";`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/secret.ts', ['security']);
+        expect(findFinding(findings, 'hardcoded-secret')).toBeDefined();
+    });
+    it('does not flag placeholder secrets (your-)', async () => {
+        const content = `const api_key = "your-api-key-here";`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/placeholder.ts', ['security']);
+        expect(findFinding(findings, 'hardcoded-secret')).toBeUndefined();
+    });
+    it('does not flag placeholder secrets (example)', async () => {
+        const content = `const api_key = "example-api-key-value";`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/example.ts', ['security']);
+        expect(findFinding(findings, 'hardcoded-secret')).toBeUndefined();
+    });
+    it('does not flag placeholder secrets (TODO)', async () => {
+        const content = `const api_key = "TODO_replace_me_12345";`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/todo.ts', ['security']);
+        expect(findFinding(findings, 'hardcoded-secret')).toBeUndefined();
+    });
+    it('does not flag placeholder secrets (change-me)', async () => {
+        const content = `const api_key = "change-me-placeholder_val";`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/change-me.ts', ['security']);
+        expect(findFinding(findings, 'hardcoded-secret')).toBeUndefined();
+    });
+    it('does not flag placeholder secrets (xxx)', async () => {
+        const content = `const api_key = "xxx-xxx-xxx-placeholder";`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/xxx-secret.ts', ['security']);
+        expect(findFinding(findings, 'hardcoded-secret')).toBeUndefined();
+    });
+    it('does not flag short values (under 8 chars)', async () => {
+        const content = `const api_key = "short";`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/short-secret.ts', ['security']);
+        expect(findFinding(findings, 'hardcoded-secret')).toBeUndefined();
+    });
+    // -- sql-injection-risk --
+    it('flags SQL injection with template literals', async () => {
+        const content = 'const result = query(`SELECT * FROM users WHERE id = ${userId}`);';
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/sqli.ts', ['security']);
+        const finding = findFinding(findings, 'sql-injection-risk');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('critical');
+        expect(finding.reference).toContain('SQL Injection');
+    });
+    // -- no-eval --
+    it('flags eval() usage', async () => {
+        const content = `const result = eval("1 + 2");`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/eval.ts', ['security']);
+        const finding = findFinding(findings, 'no-eval');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('critical');
+        expect(finding.reference).toContain('Code Injection');
+    });
+    it('does not flag evaluate or evaluation (not eval())', async () => {
+        const content = `const evaluate = (x: number) => x * 2; evaluate(5);`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/evaluate.ts', ['security']);
+        expect(findFinding(findings, 'no-eval')).toBeUndefined();
+    });
+    // -- xss-risk --
+    it('flags innerHTML assignment', async () => {
+        const content = `element.innerHTML = userInput;`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/xss.ts', ['security']);
+        const finding = findFinding(findings, 'xss-risk');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('error');
+        expect(finding.reference).toContain('XSS');
+    });
+    it('flags dangerouslySetInnerHTML', async () => {
+        const content = `<div dangerouslySetInnerHTML={{ __html: data }} />`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/react-xss.tsx', ['security']);
+        expect(findFinding(findings, 'xss-risk')).toBeDefined();
+    });
+    // -- cors-wildcard --
+    it('flags CORS wildcard configuration', async () => {
+        const content = `const cors = "*";`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/cors.ts', ['security']);
+        const finding = findFinding(findings, 'cors-wildcard');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('warning');
+        expect(finding.reference).toContain('OWASP');
+    });
+    it('flags access-control-allow-origin wildcard', async () => {
+        const content = `access-control-allow-origin: "*"`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/cors2.ts', ['security']);
+        expect(findFinding(findings, 'cors-wildcard')).toBeDefined();
+    });
+    it('does not flag non-wildcard CORS', async () => {
+        const content = `cors = "https://example.com";`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/cors-safe.ts', ['security']);
+        expect(findFinding(findings, 'cors-wildcard')).toBeUndefined();
+    });
+});
+// ════════════════════════════════════════════════════════════════════════════
+// checkErrorHandling — error handling patterns
+// ════════════════════════════════════════════════════════════════════════════
+describe('checkErrorHandling', () => {
+    // -- empty-catch --
+    it('flags empty catch blocks', async () => {
+        const content = `try { doSomething(); } catch (e) {}`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/empty-catch.ts', ['error-handling']);
+        const finding = findFinding(findings, 'empty-catch');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('error');
+        expect(finding.line).toBeDefined();
+    });
+    it('does not flag catch blocks with code', async () => {
+        const content = `try { doSomething(); } catch (e) { throw e; }`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/good-catch.ts', ['error-handling']);
+        expect(findFinding(findings, 'empty-catch')).toBeUndefined();
+    });
+    // -- catch-only-logs --
+    it('flags catch blocks that only log (console.log)', async () => {
+        const content = [
+            'try {',
+            '  doSomething();',
+            '} catch (e) {',
+            '  console.log(e);',
+            '}',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/log-catch.ts', ['error-handling']);
+        expect(findFinding(findings, 'catch-only-logs')).toBeDefined();
+    });
+    it('flags catch blocks that only log (console.error)', async () => {
+        const content = [
+            'try {',
+            '  doSomething();',
+            '} catch (e) {',
+            '  console.error(e);',
+            '}',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/error-log-catch.ts', ['error-handling']);
+        expect(findFinding(findings, 'catch-only-logs')).toBeDefined();
+    });
+    it('does not flag catch blocks that log and throw', async () => {
+        const content = [
+            'try {',
+            '  doSomething();',
+            '}',
+            'catch (e) {',
+            '  console.error(e);',
+            '  throw e;',
+            '}',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/log-throw.ts', ['error-handling']);
+        expect(findFinding(findings, 'catch-only-logs')).toBeUndefined();
+    });
+    it('does not flag catch blocks that log and return', async () => {
+        const content = [
+            'try {',
+            '  doSomething();',
+            '}',
+            'catch (e) {',
+            '  console.error(e);',
+            '  return null;',
+            '}',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/log-return.ts', ['error-handling']);
+        expect(findFinding(findings, 'catch-only-logs')).toBeUndefined();
+    });
+    it('does not flag catch blocks that log and reject', async () => {
+        const content = [
+            'try {',
+            '  doSomething();',
+            '}',
+            'catch (e) {',
+            '  console.error(e);',
+            '  reject(e);',
+            '}',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/log-reject.ts', ['error-handling']);
+        expect(findFinding(findings, 'catch-only-logs')).toBeUndefined();
+    });
+    it('does not flag catch blocks without console.log/error', async () => {
+        const content = [
+            'try {',
+            '  doSomething();',
+            '} catch (e) {',
+            '  logger.warn(e);',
+            '}',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/custom-logger.ts', ['error-handling']);
+        expect(findFinding(findings, 'catch-only-logs')).toBeUndefined();
+    });
+    // -- unhandled-async --
+    it('flags async functions without try-catch', async () => {
+        const content = [
+            'async function fetchData() {',
+            '  const res = await fetch("/api/data");',
+            '  return res.json();',
+            '}',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/unhandled.ts', ['error-handling']);
+        const finding = findFinding(findings, 'unhandled-async');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('info');
+        expect(finding.message).toContain('fetchData');
+    });
+    it('does not flag async functions with try-catch', async () => {
+        const content = [
+            'async function fetchData() {',
+            '  try {',
+            '    const res = await fetch("/api/data");',
+            '    return res.json();',
+            '  } catch (e) {',
+            '    throw new Error("failed");',
+            '  }',
+            '}',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/handled.ts', ['error-handling']);
+        expect(findFinding(findings, 'unhandled-async')).toBeUndefined();
+    });
+    it('does not flag async functions with .catch', async () => {
+        const content = [
+            'async function fetchData() {',
+            '  const res = await fetch("/api/data").catch(handleError);',
+            '  return res;',
+            '}',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/catch-chain.ts', ['error-handling']);
+        expect(findFinding(findings, 'unhandled-async')).toBeUndefined();
+    });
+    it('only checks async for JS/TS extensions', async () => {
+        const content = [
+            'async function fetchData() {',
+            '  const res = await fetch("/api/data");',
+            '  return res;',
+            '}',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        // .py extension, should not check for unhandled-async
+        const findings = await auditFile('/test/async.py', ['error-handling']);
+        expect(findFinding(findings, 'unhandled-async')).toBeUndefined();
+    });
+    it('checks async in .jsx files', async () => {
+        const content = [
+            'async function fetchData() {',
+            '  const res = await fetch("/api/data");',
+            '  return res;',
+            '}',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/async.jsx', ['error-handling']);
+        expect(findFinding(findings, 'unhandled-async')).toBeDefined();
+    });
+});
+// ════════════════════════════════════════════════════════════════════════════
+// checkPerformance — performance pattern detection
+// ════════════════════════════════════════════════════════════════════════════
+describe('checkPerformance', () => {
+    // -- n-plus-one --
+    it('flags N+1 query patterns (await in loop)', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = `for (const item of items) {\n  const data = await fetch("/api/" + item.id);\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['performance']);
+        const finding = findFinding(result.findings, 'n-plus-one');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('warning');
+    });
+    it('flags N+1 with query in loop', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = `for (let i = 0; i < users.length; i++) {\n  const user = query(users[i]);\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['performance']);
+        expect(findFinding(result.findings, 'n-plus-one')).toBeDefined();
+    });
+    it('does not flag when no loop+query pattern', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = `const data = await fetchAll(ids);`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['performance']);
+        expect(findFinding(result.findings, 'n-plus-one')).toBeUndefined();
+    });
+    // -- sync-io --
+    it('flags synchronous file reads in TS/JS files', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = `const data = readFileSync("/path/to/file", "utf-8");`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['performance']);
+        const finding = findFinding(result.findings, 'sync-io');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('warning');
+    });
+    it('flags writeFileSync', async () => {
+        mockGlob.mockResolvedValue(['app.js']);
+        const content = `writeFileSync("/path", data);`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['performance']);
+        expect(findFinding(result.findings, 'sync-io')).toBeDefined();
+    });
+    it('flags readdirSync', async () => {
+        mockGlob.mockResolvedValue(['app.mjs']);
+        const content = `const files = readdirSync("/path");`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['performance']);
+        expect(findFinding(result.findings, 'sync-io')).toBeDefined();
+    });
+    it('flags statSync', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = `const stats = statSync("/path");`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['performance']);
+        expect(findFinding(result.findings, 'sync-io')).toBeDefined();
+    });
+    it('flags existsSync', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = `if (existsSync("/path")) { }`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['performance']);
+        expect(findFinding(result.findings, 'sync-io')).toBeDefined();
+    });
+    it('does not flag sync I/O in config files', async () => {
+        mockGlob.mockResolvedValue(['config/settings.ts']);
+        const content = `const data = readFileSync("config.json", "utf-8");`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['performance']);
+        expect(findFinding(result.findings, 'sync-io')).toBeUndefined();
+    });
+    it('does not flag sync I/O in setup files', async () => {
+        mockGlob.mockResolvedValue(['setup/init.ts']);
+        const content = `const data = readFileSync("setup.json", "utf-8");`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['performance']);
+        expect(findFinding(result.findings, 'sync-io')).toBeUndefined();
+    });
+    it('does not flag sync I/O in init files', async () => {
+        mockGlob.mockResolvedValue(['init/bootstrap.ts']);
+        const content = `const data = readFileSync("init.json", "utf-8");`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['performance']);
+        expect(findFinding(result.findings, 'sync-io')).toBeUndefined();
+    });
+    it('does not flag sync I/O in non-JS files', async () => {
+        mockGlob.mockResolvedValue(['app.py']);
+        const content = `readFileSync("/path")`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['performance']);
+        expect(findFinding(result.findings, 'sync-io')).toBeUndefined();
+    });
+    // -- spread-in-loop --
+    it('flags spread in for loop', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = [
+            'for (const item of items) {',
+            '  result = { ...result, [item.id]: item };',
+            '}',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['performance']);
+        const finding = findFinding(result.findings, 'spread-in-loop');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('info');
+    });
+    it('flags spread in forEach', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = [
+            'items.forEach((item) => {',
+            '  result = [...result, item];',
+            '});',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['performance']);
+        expect(findFinding(result.findings, 'spread-in-loop')).toBeDefined();
+    });
+    it('does not flag spread outside loops', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = `const merged = { ...defaults, ...options };`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['performance']);
+        expect(findFinding(result.findings, 'spread-in-loop')).toBeUndefined();
+    });
+});
+// ════════════════════════════════════════════════════════════════════════════
+// checkTestingPractices — test file quality checks
+// ════════════════════════════════════════════════════════════════════════════
+describe('checkTestingPractices', () => {
+    it('flags it.skip() in test files', async () => {
+        mockGlob.mockResolvedValue(['app.test.ts']);
+        const content = `it.skip('broken test', () => { expect(true).toBe(true); });`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['testing']);
+        const finding = findFinding(result.findings, 'test-skip');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('warning');
+        expect(finding.message).toContain('.skip()');
+    });
+    it('flags test.skip() in test files', async () => {
+        mockGlob.mockResolvedValue(['app.spec.ts']);
+        const content = `test.skip('broken test', () => { expect(true).toBe(true); });`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['testing']);
+        expect(findFinding(result.findings, 'test-skip')).toBeDefined();
+    });
+    it('flags describe.skip() in test files', async () => {
+        mockGlob.mockResolvedValue(['app.test.ts']);
+        const content = `describe.skip('suite', () => { it('test', () => {}); });`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['testing']);
+        expect(findFinding(result.findings, 'test-skip')).toBeDefined();
+    });
+    it('flags it.only() with error severity', async () => {
+        mockGlob.mockResolvedValue(['app.test.ts']);
+        const content = `it.only('focused test', () => { expect(true).toBe(true); });`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['testing']);
+        const finding = findFinding(result.findings, 'test-only');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('error');
+        expect(finding.message).toContain('.only()');
+        expect(finding.suggestion).toContain('Remove .only()');
+    });
+    it('flags test.only() in test files', async () => {
+        mockGlob.mockResolvedValue(['app.test.ts']);
+        const content = `test.only('focused test', () => { expect(true).toBe(true); });`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['testing']);
+        expect(findFinding(result.findings, 'test-only')).toBeDefined();
+    });
+    it('flags describe.only() in test files', async () => {
+        mockGlob.mockResolvedValue(['app.test.ts']);
+        const content = `describe.only('focused suite', () => { it('test', () => {}); });`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['testing']);
+        expect(findFinding(result.findings, 'test-only')).toBeDefined();
+    });
+    it('returns no testing findings for non-test files', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = `it.skip('not a test file', () => {});`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['testing']);
+        expect(findFinding(result.findings, 'test-skip')).toBeUndefined();
+    });
+    it('returns no testing findings for .spec. files without skip/only', async () => {
+        mockGlob.mockResolvedValue(['app.spec.ts']);
+        const content = `it('normal test', () => { expect(1).toBe(1); });`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['testing']);
+        expect(result.findings).toHaveLength(0);
+    });
+});
+// ════════════════════════════════════════════════════════════════════════════
+// checkDry — duplicate code detection
+// ════════════════════════════════════════════════════════════════════════════
+describe('checkDry', () => {
+    it('flags lines duplicated 4+ times', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const dupLine = 'const result = processItem(item, config, options);';
+        // 4 identical lines
+        const content = Array.from({ length: 4 }, () => dupLine).join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['dry']);
+        const finding = findFinding(result.findings, 'duplicate-code');
+        expect(finding).toBeDefined();
+        expect(finding.severity).toBe('info');
+        expect(finding.message).toContain('4 times');
+    });
+    it('does not flag lines duplicated 3 times (threshold is 4)', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const dupLine = 'const result = processItem(item, config, options);';
+        const content = Array.from({ length: 3 }, () => dupLine).join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['dry']);
+        expect(findFinding(result.findings, 'duplicate-code')).toBeUndefined();
+    });
+    it('skips short lines (under 10 chars)', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = Array.from({ length: 10 }, () => 'x = 1;').join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['dry']);
+        expect(findFinding(result.findings, 'duplicate-code')).toBeUndefined();
+    });
+    it('skips comment lines starting with //', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const dupLine = '// This is a long comment line that repeats';
+        const content = Array.from({ length: 5 }, () => dupLine).join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['dry']);
+        expect(findFinding(result.findings, 'duplicate-code')).toBeUndefined();
+    });
+    it('skips comment lines starting with #', async () => {
+        mockGlob.mockResolvedValue(['app.py']);
+        const dupLine = '# This is a long comment line that repeats';
+        const content = Array.from({ length: 5 }, () => dupLine).join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['dry']);
+        expect(findFinding(result.findings, 'duplicate-code')).toBeUndefined();
+    });
+    it('skips comment lines starting with *', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const dupLine = '* @param something long description here';
+        const content = Array.from({ length: 5 }, () => dupLine).join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['dry']);
+        expect(findFinding(result.findings, 'duplicate-code')).toBeUndefined();
+    });
+    it('skips common patterns like closing braces', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        // Single closing brace is < 10 chars, but closing patterns are also explicitly filtered
+        // Let's use a pattern that would reach the filter: return statements
+        const content = Array.from({ length: 5 }, () => 'return undefined;').join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['dry']);
+        expect(findFinding(result.findings, 'duplicate-code')).toBeUndefined();
+    });
+    it('skips break statements', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = Array.from({ length: 5 }, () => '  break;    ').join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['dry']);
+        expect(findFinding(result.findings, 'duplicate-code')).toBeUndefined();
+    });
+    it('reports only first duplicate per file (break)', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const dup1 = 'const alpha = processAlpha(item, config, options);';
+        const dup2 = 'const beta = processBeta(item, config, options);;';
+        // Both appear 4+ times
+        const content = [
+            ...Array.from({ length: 4 }, () => dup1),
+            ...Array.from({ length: 4 }, () => dup2),
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['dry']);
+        const dupFindings = findFindings(result.findings, 'duplicate-code');
+        expect(dupFindings).toHaveLength(1);
+    });
+    it('truncates long duplicate lines in message to 60 chars with ellipsis', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const longLine = 'const result = processItemWithVeryLongFunctionNameThatExceedsSixtyCharactersInLength(item, config, options);';
+        const content = Array.from({ length: 4 }, () => longLine).join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['dry']);
+        const finding = findFinding(result.findings, 'duplicate-code');
+        expect(finding).toBeDefined();
+        expect(finding.message).toContain('...');
+    });
+    it('does not add ellipsis for lines under 60 chars', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const shortLine = 'const result = processItem(item, config);';
+        const content = Array.from({ length: 4 }, () => shortLine).join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['dry']);
+        const finding = findFinding(result.findings, 'duplicate-code');
+        expect(finding).toBeDefined();
+        expect(finding.message).not.toContain('...');
+    });
+});
+// ════════════════════════════════════════════════════════════════════════════
+// buildSummary & calculateScore — scoring and summary logic
+// ════════════════════════════════════════════════════════════════════════════
+describe('buildSummary and calculateScore', () => {
+    it('calculates score 100 when no findings', async () => {
+        mockGlob.mockResolvedValue([]);
+        const result = await auditCode('src', '/project');
+        expect(result.score).toBe(100);
+        expect(result.summary.score).toBe(100);
+    });
+    it('calculates score with weighted severity penalties', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        // Critical finding: penalty = 10
+        const content = `const api_key = "realSecretKeyAbcde123";`;
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['security']);
+        // score should be penalized
+        expect(result.score).toBeLessThan(100);
+        expect(result.score).toBeGreaterThanOrEqual(0);
+    });
+    it('normalizes score by file count (more files = more lenient)', async () => {
+        // Single file with many issues
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = [
+            `const api_key = "realSecretKeyAbcde123";`,
+            `eval("bad");`,
+            `element.innerHTML = data;`,
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result1 = await auditCode('src', '/project', ['security']);
+        // Reset and test with more files
+        vi.clearAllMocks();
+        const files = Array.from({ length: 10 }, (_, i) => `app${i}.ts`);
+        mockGlob.mockResolvedValue(files);
+        mockReadFile
+            .mockResolvedValueOnce(content) // First file has issues
+            .mockResolvedValue('const x = 1;'); // Rest are clean
+        const result2 = await auditCode('src', '/project', ['security']);
+        // More files = higher score for same findings
+        expect(result2.score).toBeGreaterThan(result1.score);
+    });
+    it('summary.byCategory includes all requested categories', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        mockReadFile.mockResolvedValue('const x = 1;');
+        const categories = ['clean-code', 'security', 'solid'];
+        const result = await auditCode('src', '/project', categories);
+        for (const cat of categories) {
+            expect(result.summary.byCategory[cat]).toBeDefined();
+            expect(result.summary.byCategory[cat].count).toBeDefined();
+            expect(result.summary.byCategory[cat].severity).toBeDefined();
+        }
+    });
+    it('summary.byCategory has worst severity per category', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = [
+            `const api_key = "realSecretKeyAbcde123";`, // critical
+            `element.innerHTML = data;`, // error
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['security']);
+        // Security should have "critical" as worst severity
+        expect(result.summary.byCategory.security?.severity).toBe('critical');
+    });
+    it('summary includes strengths for categories with no findings', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        mockReadFile.mockResolvedValue('function add(a: number, b: number) { return a + b; }');
+        const result = await auditCode('src', '/project', ['clean-code', 'security', 'solid']);
+        // At least some categories should have no findings
+        expect(result.summary.strengths.length).toBeGreaterThan(0);
+        for (const s of result.summary.strengths) {
+            expect(s).toContain('No issues found');
+        }
+    });
+    it('handles unknown severity in calculateScore using default weight', async () => {
+        // This tests the fallback `?? 1` in the weights lookup
+        // We can't directly trigger unknown severity through normal flow,
+        // but we can verify the score handles it through custom rules
+        mockGlob.mockResolvedValue(['app.ts']);
+        mockReadFile.mockResolvedValue('const x = 1;');
+        const result = await auditCode('src', '/project', ['clean-code']);
+        expect(typeof result.score).toBe('number');
+    });
+});
+// ════════════════════════════════════════════════════════════════════════════
+// findFunctionBoundaries — function detection across languages
+// ════════════════════════════════════════════════════════════════════════════
+describe('findFunctionBoundaries', () => {
+    it('detects standard JS/TS function declarations', async () => {
+        const body = Array.from({ length: 55 }, (_, i) => `  const v${i} = ${i};`).join('\n');
+        const content = `function myFunction() {\n${body}\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/fn.ts', ['clean-code']);
+        const finding = findFinding(findings, 'function-too-long');
+        expect(finding).toBeDefined();
+        expect(finding.message).toContain('myFunction');
+    });
+    it('detects const arrow functions', async () => {
+        const body = Array.from({ length: 55 }, (_, i) => `  const v${i} = ${i};`).join('\n');
+        const content = `const myArrow = (x: number) => {\n${body}\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/arrow.ts', ['clean-code']);
+        const finding = findFinding(findings, 'function-too-long');
+        expect(finding).toBeDefined();
+        expect(finding.message).toContain('myArrow');
+    });
+    it('detects let arrow functions', async () => {
+        const body = Array.from({ length: 55 }, (_, i) => `  const v${i} = ${i};`).join('\n');
+        const content = `let myLetFn = (x: number) => {\n${body}\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/let-arrow.ts', ['clean-code']);
+        const finding = findFinding(findings, 'function-too-long');
+        expect(finding).toBeDefined();
+        expect(finding.message).toContain('myLetFn');
+    });
+    it('detects Python def', async () => {
+        // Python function detection is indent-based
+        const body = Array.from({ length: 55 }, (_, i) => `  v${i} = ${i}`).join('\n');
+        const content = `def my_python_fn():\n${body}\n`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/fn.py', ['clean-code']);
+        const finding = findFinding(findings, 'function-too-long');
+        expect(finding).toBeDefined();
+        expect(finding.message).toContain('my_python_fn');
+    });
+    it('detects Python def and ends at de-indent', async () => {
+        // Python function with next function at same indent level
+        const body = Array.from({ length: 55 }, (_, i) => `  v${i} = ${i}`).join('\n');
+        const content = [
+            `def long_fn():`,
+            body,
+            `def next_fn():`,
+            `  pass`,
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/py-indent.py', ['clean-code']);
+        const finding = findFinding(findings, 'function-too-long');
+        expect(finding).toBeDefined();
+        expect(finding.message).toContain('long_fn');
+    });
+    it('handles functions without braces (fallback to endLine = j)', async () => {
+        // A function where braceCount never reaches 0 - single-line function
+        const content = `function foo() { return 1; }`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/oneliner.ts', ['clean-code']);
+        // Should not crash, function is short
+        expect(findFinding(findings, 'function-too-long')).toBeUndefined();
+    });
+    it('assigns "anonymous" when no name group matches', async () => {
+        // var arrow function
+        const body = Array.from({ length: 55 }, (_, i) => `  const v${i} = ${i};`).join('\n');
+        const content = `var myVarFn = (x: number) => {\n${body}\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/var-arrow.ts', ['clean-code']);
+        const finding = findFinding(findings, 'function-too-long');
+        expect(finding).toBeDefined();
+        expect(finding.message).toContain('myVarFn');
+    });
+});
+// ════════════════════════════════════════════════════════════════════════════
+// Edge cases and integration scenarios
+// ════════════════════════════════════════════════════════════════════════════
+describe('edge cases', () => {
+    it('handles empty file content gracefully', async () => {
+        mockReadFile.mockResolvedValue('');
+        const findings = await auditFile('/test/empty.ts', ['clean-code', 'security', 'error-handling']);
+        // Should not crash, should have no findings
+        expect(findings).toEqual([]);
+    });
+    it('handles file with only whitespace', async () => {
+        mockReadFile.mockResolvedValue('   \n  \n   \n');
+        const findings = await auditFile('/test/whitespace.ts', ['clean-code']);
+        expect(findings).toEqual([]);
+    });
+    it('handles file with only comments', async () => {
+        const content = [
+            '// This is a comment',
+            '// Another comment',
+            '# Python comment',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/comments.ts', ['clean-code']);
+        // Should not flag magic numbers in comments
+        expect(findFinding(findings, 'magic-number')).toBeUndefined();
+    });
+    it('auditCode runs all 8 categories when specified', async () => {
+        mockGlob.mockResolvedValue(['app.test.ts']);
+        const content = [
+            '// TODO: fix this',
+            'class A {}',
+            'class B {}',
+            'class C {}',
+            `const secret = "realSecretKeyAbcde123";`,
+            'try { x(); } catch (e) {}',
+            'for (const i of arr) { await fetch(i); }',
+            'it.skip("broken", () => {});',
+            'const result = processItem(item, config, options);',
+            'const result = processItem(item, config, options);',
+            'const result = processItem(item, config, options);',
+            'const result = processItem(item, config, options);',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const allCategories = [
+            'solid',
+            'clean-code',
+            'architecture',
+            'security',
+            'error-handling',
+            'performance',
+            'testing',
+            'dry',
+        ];
+        const result = await auditCode('.', '/project', allCategories);
+        // Should have findings from multiple categories
+        const cats = new Set(result.findings.map((f) => f.category));
+        expect(cats.size).toBeGreaterThanOrEqual(3);
+    });
+    it('handles files with all supported code extensions', async () => {
+        const exts = [
+            '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs',
+            '.py', '.go', '.rs', '.java', '.kt', '.kts',
+            '.rb', '.php', '.cs', '.swift', '.dart',
+            '.ex', '.exs', '.scala', '.clj',
+        ];
+        const files = exts.map((ext) => `app${ext}`);
+        mockGlob.mockResolvedValue(files);
+        mockReadFile.mockResolvedValue('const x = 1;');
+        const result = await auditCode('src', '/project', ['clean-code']);
+        expect(result.filesAnalyzed).toBe(exts.length);
+    });
+    it('limits glob results to 200 files', async () => {
+        const files = Array.from({ length: 250 }, (_, i) => `file${i}.ts`);
+        mockGlob.mockResolvedValue(files);
+        mockReadFile.mockResolvedValue('const x = 1;');
+        const result = await auditCode('src', '/project', ['clean-code']);
+        expect(result.filesAnalyzed).toBe(200);
+    });
+    it('all findings have required fields: file, category, severity, rule, message, suggestion', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        const content = [
+            `const api_key = "realSecretKeyAbcde123";`,
+            `eval("bad");`,
+            '// TODO: fix this',
+            'try { x(); } catch (e) {}',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', [
+            'clean-code',
+            'security',
+            'error-handling',
+        ]);
+        for (const finding of result.findings) {
+            expect(finding.file).toBeDefined();
+            expect(finding.category).toBeDefined();
+            expect(finding.severity).toBeDefined();
+            expect(finding.rule).toBeDefined();
+            expect(finding.message).toBeTruthy();
+            expect(finding.suggestion).toBeTruthy();
+            expect(['info', 'warning', 'error', 'critical']).toContain(finding.severity);
+        }
+    });
+    it('catch-only-logs handles body lines at end of file', async () => {
+        // Catch block near end of file (Math.min boundary)
+        const content = [
+            'try { x(); }',
+            'catch (e) {',
+            '  console.log(e);',
+            '}',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/eof-catch.ts', ['error-handling']);
+        expect(findFinding(findings, 'catch-only-logs')).toBeDefined();
+    });
+    it('async function detection uses 500-char window', async () => {
+        // Create a long async function body (>500 chars) with a try far away
+        const longBody = Array.from({ length: 60 }, (_, i) => `  const longVarName${i} = ${i};`).join('\n');
+        const content = [
+            'async function farTry() {',
+            longBody,
+            '  try {',
+            '    return 1;',
+            '  } catch (e) { throw e; }',
+            '}',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/far-try.ts', ['error-handling']);
+        // The try is beyond the 500-char window, so it might still detect unhandled-async
+        findFinding(findings, 'unhandled-async');
+        // Depending on whether "try" falls within the 500-char window
+        // The heuristic only looks at 500 chars after the async keyword
+        // This test just ensures it doesn't crash
+        expect(Array.isArray(findings)).toBe(true);
+    });
+    it('multiple files produce aggregated findings and summary', async () => {
+        mockGlob.mockResolvedValue(['a.ts', 'b.ts']);
+        mockReadFile
+            .mockResolvedValueOnce('// TODO: fix a')
+            .mockResolvedValueOnce('// TODO: fix b');
+        const result = await auditCode('src', '/project', ['clean-code']);
+        expect(result.filesAnalyzed).toBe(2);
+        const todoFindings = findFindings(result.findings, 'pending-marker');
+        expect(todoFindings.length).toBe(2);
+    });
+    it('summary.byCategory.severity defaults to info when no findings', async () => {
+        mockGlob.mockResolvedValue(['app.ts']);
+        mockReadFile.mockResolvedValue('function add(a: number, b: number) { return a + b; }');
+        const result = await auditCode('src', '/project', ['security']);
+        expect(result.summary.byCategory.security?.severity).toBe('info');
+        expect(result.summary.byCategory.security?.count).toBe(0);
+    });
+});
+// ════════════════════════════════════════════════════════════════════════════
+// Sparse/undefined array element guards — defensive coverage
+// Lines 719, 781, 856, 883: continue when lines[i] is undefined.
+// These guards protect against sparse arrays. Since content.split('\n')
+// never produces holes, we exercise the surrounding code paths thoroughly.
+// ════════════════════════════════════════════════════════════════════════════
+describe('checkPerformance — spread-in-loop detection with edge-case line patterns', () => {
+    it('detects spread in a for-loop at the boundary of the 10-line window', async () => {
+        mockGlob.mockResolvedValue(['spread-boundary.ts']);
+        // Spread appears at line i+9 (last line within the 10-line window)
+        const lines = [
+            'for (let i = 0; i < items.length; i++) {',
+            '  const a = 1;',
+            '  const b = 2;',
+            '  const c = 3;',
+            '  const d = 4;',
+            '  const e = 5;',
+            '  const f = 6;',
+            '  const g = 7;',
+            '  const h = 8;',
+            '  const merged = { ...items[i] };',
+            '}',
+        ];
+        mockReadFile.mockResolvedValue(lines.join('\n'));
+        const result = await auditCode('src', '/project', ['performance']);
+        expect(findFinding(result.findings, 'spread-in-loop')).toBeDefined();
+    });
+    it('does not detect spread beyond the 10-line window', async () => {
+        mockGlob.mockResolvedValue(['spread-far.ts']);
+        const lines = [
+            'for (let i = 0; i < items.length; i++) {',
+            '  const a = 1;',
+            '  const b = 2;',
+            '  const c = 3;',
+            '  const d = 4;',
+            '  const e = 5;',
+            '  const f = 6;',
+            '  const g = 7;',
+            '  const h = 8;',
+            '  const j = 9;',
+            '  const k = 10;',
+            '  const merged = { ...items[i] };', // line i+11, beyond window
+            '}',
+        ];
+        mockReadFile.mockResolvedValue(lines.join('\n'));
+        const result = await auditCode('src', '/project', ['performance']);
+        expect(findFinding(result.findings, 'spread-in-loop')).toBeUndefined();
+    });
+    it('detects spread inside forEach callback', async () => {
+        mockGlob.mockResolvedValue(['spread-foreach.ts']);
+        const content = [
+            'items.forEach((item) => {',
+            '  const result = { ...item, extra: true };',
+            '});',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['performance']);
+        expect(findFinding(result.findings, 'spread-in-loop')).toBeDefined();
+    });
+    it('handles for-loop at the very end of a file (window extends past EOF)', async () => {
+        mockGlob.mockResolvedValue(['spread-eof.ts']);
+        // Only 2 lines total; the 10-line window clips to lines.length
+        const content = [
+            'for (let i = 0; i < arr.length; i++) {',
+            '  const copy = { ...arr[i] };',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['performance']);
+        expect(findFinding(result.findings, 'spread-in-loop')).toBeDefined();
+    });
+    it('handles empty lines within the for-loop 10-line window', async () => {
+        mockGlob.mockResolvedValue(['spread-empty.ts']);
+        const content = [
+            'for (let i = 0; i < items.length; i++) {',
+            '',
+            '',
+            '',
+            '',
+            '',
+            '',
+            '',
+            '',
+            '  const merged = { ...items[i] };',
+            '}',
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['performance']);
+        expect(findFinding(result.findings, 'spread-in-loop')).toBeDefined();
+    });
+});
+describe('checkDry — duplicate code detection edge cases', () => {
+    it('detects duplicates with many identical long lines', async () => {
+        mockGlob.mockResolvedValue(['dup-lines.ts']);
+        const duplicateLine = 'const result = processItem(item, config, options, extra);';
+        const content = Array.from({ length: 5 }, () => duplicateLine).join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['dry']);
+        expect(findFinding(result.findings, 'duplicate-code')).toBeDefined();
+    });
+    it('does not flag short lines (under 10 chars) as duplicates', async () => {
+        mockGlob.mockResolvedValue(['short-dup.ts']);
+        const content = Array.from({ length: 10 }, () => 'x = 1;').join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['dry']);
+        expect(findFinding(result.findings, 'duplicate-code')).toBeUndefined();
+    });
+    it('skips comment lines starting with // in duplicate detection', async () => {
+        mockGlob.mockResolvedValue(['comment-dup.ts']);
+        const comment = '// This is a long comment line that repeats many times in the code';
+        const content = Array.from({ length: 10 }, () => comment).join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['dry']);
+        expect(findFinding(result.findings, 'duplicate-code')).toBeUndefined();
+    });
+    it('skips comment lines starting with # in duplicate detection', async () => {
+        mockGlob.mockResolvedValue(['hash-comment-dup.py']);
+        const comment = '# This is a long Python comment line that repeats many times';
+        const content = Array.from({ length: 10 }, () => comment).join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['dry']);
+        expect(findFinding(result.findings, 'duplicate-code')).toBeUndefined();
+    });
+    it('skips comment lines starting with * in duplicate detection', async () => {
+        mockGlob.mockResolvedValue(['jsdoc-dup.ts']);
+        const comment = ' * This is a long JSDoc comment line that appears many times';
+        const content = Array.from({ length: 10 }, () => comment).join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['dry']);
+        expect(findFinding(result.findings, 'duplicate-code')).toBeUndefined();
+    });
+    it('handles content with only empty lines', async () => {
+        mockGlob.mockResolvedValue(['empty-lines.ts']);
+        const content = '\n\n\n\n\n\n\n\n\n\n';
+        mockReadFile.mockResolvedValue(content);
+        const result = await auditCode('src', '/project', ['dry']);
+        expect(findFinding(result.findings, 'duplicate-code')).toBeUndefined();
+    });
+});
+describe('findFunctionBoundaries — edge cases for function detection', () => {
+    it('handles content with no functions at all', async () => {
+        const content = 'const x = 1;\nconst y = 2;\nconst z = 3;';
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/no-fn.ts', ['clean-code']);
+        expect(findFinding(findings, 'function-too-long')).toBeUndefined();
+    });
+    it('handles function with empty body (no brace counting needed)', async () => {
+        const content = 'function empty() {}';
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/empty-fn.ts', ['clean-code']);
+        expect(findFinding(findings, 'function-too-long')).toBeUndefined();
+    });
+    it('handles multiple functions where only one exceeds the line limit', async () => {
+        const shortBody = Array.from({ length: 5 }, (_, i) => `  const v${i} = ${i};`).join('\n');
+        const longBody = Array.from({ length: 55 }, (_, i) => `  const v${i} = ${i};`).join('\n');
+        const content = [
+            `function shortOne() {`,
+            shortBody,
+            `}`,
+            `function longOne() {`,
+            longBody,
+            `}`,
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/mixed-fn.ts', ['clean-code']);
+        const longFindings = findFindings(findings, 'function-too-long');
+        expect(longFindings).toHaveLength(1);
+        expect(longFindings[0]?.message).toContain('longOne');
+    });
+    it('handles deeply nested braces within a function', async () => {
+        const body = [
+            '  if (true) {',
+            '    if (true) {',
+            '      if (true) {',
+            ...Array.from({ length: 50 }, (_, i) => `        const v${i} = ${i};`),
+            '      }',
+            '    }',
+            '  }',
+        ].join('\n');
+        const content = `function deepBraces() {\n${body}\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/deep-braces.ts', ['clean-code']);
+        expect(findFinding(findings, 'function-too-long')).toBeDefined();
+    });
+    it('handles function followed immediately by another function', async () => {
+        const body = Array.from({ length: 55 }, (_, i) => `  const v${i} = ${i};`).join('\n');
+        const content = [
+            `function first() {\n${body}\n}`,
+            `function second() {\n${body}\n}`,
+        ].join('\n');
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/back-to-back.ts', ['clean-code']);
+        const longFindings = findFindings(findings, 'function-too-long');
+        expect(longFindings.length).toBeGreaterThanOrEqual(2);
+    });
+    it('handles content with many empty lines between code lines', async () => {
+        const body = Array.from({ length: 55 }, (_, i) => `  const v${i} = ${i};\n`).join('\n');
+        const content = `function spacey() {\n${body}\n}`;
+        mockReadFile.mockResolvedValue(content);
+        const findings = await auditFile('/test/spacey-fn.ts', ['clean-code']);
+        // Function is long due to empty lines counted
+        expect(findFinding(findings, 'function-too-long')).toBeDefined();
+    });
+});
+//# sourceMappingURL=auditor.test.js.map