clean-slop 2.0.0

package/dist/cli/index.js

@@ -0,0 +1,3239 @@
+#!/usr/bin/env node
+import { Command } from 'commander';
+import path3 from 'path';
+import process from 'process';
+import { cosmiconfig } from 'cosmiconfig';
+import fg from 'fast-glob';
+import ignore from 'ignore';
+import fs4 from 'fs/promises';
+import isBinaryPath from 'is-binary-path';
+import { parse } from '@typescript-eslint/typescript-estree';
+import fs3 from 'fs';
+import { execSync } from 'child_process';
+
+// src/version.ts
+var PACKAGE_VERSION = "1.0.0";
+var DEFAULT_INCLUDE = [
+  "**/*.js",
+  "**/*.jsx",
+  "**/*.ts",
+  "**/*.tsx",
+  "**/*.mjs",
+  "**/*.cjs"
+];
+var DEFAULT_EXCLUDE = [
+  "**/node_modules/**",
+  "**/dist/**",
+  "**/build/**",
+  "**/.next/**",
+  "**/coverage/**",
+  "**/.turbo/**",
+  "**/*.min.js",
+  "**/*.bundle.js",
+  "**/*.generated.*",
+  "**/__generated__/**"
+];
+var DEFAULT_IGNORE_PATTERNS = [];
+var DEFAULT_CATEGORIES = {
+  "ai-slop": true,
+  "security": true,
+  "reliability": true,
+  "maintainability": true,
+  "production-readiness": true
+};
+var DEFAULT_MAX_ISSUES = {};
+function computeGrade(score) {
+  if (score >= 90) return "A";
+  if (score >= 75) return "B";
+  if (score >= 60) return "C";
+  if (score >= 40) return "D";
+  return "F";
+}
+async function loadConfig(cwd, configPath) {
+  const explorer = cosmiconfig("clean-slop", {
+    searchPlaces: [
+      "clean-slop.config.js",
+      "clean-slop.config.ts",
+      "clean-slop.config.mjs",
+      "clean-slop.config.cjs",
+      ".clean-slop.js",
+      ".clean-slop.json",
+      ".clean-slop.yaml",
+      ".clean-slop.yml",
+      "package.json"
+    ],
+    packageProp: "clean-slop"
+  });
+  let userConfig = {};
+  try {
+    const result = configPath ? await explorer.load(configPath) : await explorer.search(cwd);
+    if (result && !result.isEmpty) {
+      userConfig = result.config;
+    }
+  } catch {
+  }
+  return resolveConfig(userConfig, cwd);
+}
+function resolveConfig(userConfig, cwd) {
+  return {
+    root: path3.resolve(cwd),
+    version: PACKAGE_VERSION,
+    include: userConfig.include ?? DEFAULT_INCLUDE,
+    exclude: userConfig.exclude ?? DEFAULT_EXCLUDE,
+    categories: {
+      ...DEFAULT_CATEGORIES,
+      ...userConfig.categories
+    },
+    rules: userConfig.rules ?? {},
+    failThreshold: userConfig.failThreshold ?? 70,
+    maxIssues: {
+      ...DEFAULT_MAX_ISSUES,
+      ...userConfig.maxIssues
+    },
+    plugins: userConfig.plugins ?? [],
+    reporter: userConfig.reporter ?? "text",
+    output: userConfig.output ?? null,
+    verbose: userConfig.verbose ?? false,
+    ignorePatterns: userConfig.ignorePatterns ?? DEFAULT_IGNORE_PATTERNS,
+    tsConfigPath: userConfig.tsConfigPath ?? null
+  };
+}
+function generateDefaultConfig() {
+  return `/** @type {import('clean-slop').UserConfig} */
+export default {
+  // Files to include in scanning
+  include: [
+    '**/*.js',
+    '**/*.jsx',
+    '**/*.ts',
+    '**/*.tsx',
+    '**/*.mjs',
+    '**/*.cjs',
+  ],
+
+  // Files to exclude from scanning
+  exclude: [
+    '**/node_modules/**',
+    '**/dist/**',
+    '**/build/**',
+    '**/.next/**',
+    '**/coverage/**',
+    '**/*.min.js',
+    '**/*.generated.*',
+    '**/__generated__/**',
+  ],
+
+  // Enable or disable entire rule categories
+  categories: {
+    'ai-slop': true,
+    'security': true,
+    'reliability': true,
+    'maintainability': true,
+    'production-readiness': true,
+  },
+
+  // Per-rule severity overrides or 'off' to disable
+  rules: {
+    // 'security/hardcoded-secrets': 'critical',
+    // 'ai-slop/empty-catch': 'off',
+  },
+
+  // Minimum overall score before CI fails (0-100)
+  failThreshold: 70,
+
+  // Maximum allowed issues per severity
+  maxIssues: {
+    critical: 0,
+    high: 5,
+  },
+
+  // Output reporter: 'text' | 'json' | 'html' | 'markdown' | 'sarif'
+  reporter: 'text',
+
+  // Output file path (null = stdout)
+  // output: './reports/clean-slop-report.html',
+
+  // Additional ignore patterns
+  ignorePatterns: [],
+};
+`;
+}
+var ParseError = class extends Error {
+  constructor(message, filePath, cause) {
+    super(message);
+    this.filePath = filePath;
+    this.cause = cause;
+    this.name = "ParseError";
+  }
+  filePath;
+  cause;
+};
+function detectLanguage(filePath) {
+  const ext = path3.extname(filePath).toLowerCase();
+  switch (ext) {
+    case ".ts":
+      return "typescript";
+    case ".tsx":
+      return "tsx";
+    case ".jsx":
+      return "jsx";
+    default:
+      return "javascript";
+  }
+}
+function isTypeScriptLike(language) {
+  return language === "typescript" || language === "tsx";
+}
+function parseSource(filePath, source) {
+  const language = detectLanguage(filePath);
+  try {
+    const ast = parse(source, {
+      jsx: language === "jsx" || language === "tsx",
+      tsx: language === "tsx",
+      loc: true,
+      range: true,
+      comment: true,
+      tokens: false,
+      errorOnUnknownASTType: false,
+      allowInvalidAST: true,
+      suppressDeprecatedPropertyWarnings: true
+    });
+    return { filePath, source, ast, language };
+  } catch (err) {
+    if (!isTypeScriptLike(language)) {
+      try {
+        const ast = parse(source, {
+          jsx: language === "jsx",
+          loc: true,
+          range: true,
+          comment: true,
+          tokens: false,
+          errorOnUnknownASTType: false,
+          allowInvalidAST: true,
+          suppressDeprecatedPropertyWarnings: true
+        });
+        return { filePath, source, ast, language };
+      } catch {
+      }
+    }
+    const message = err instanceof Error ? err.message : "Unknown parse error";
+    throw new ParseError(
+      `Failed to parse ${filePath}: ${message}`,
+      filePath,
+      err
+    );
+  }
+}
+function extractSnippet(source, line, contextLines = 2) {
+  const lines = source.split("\n");
+  const start = Math.max(0, line - 1 - contextLines);
+  const end = Math.min(lines.length, line + contextLines);
+  return lines.slice(start, end).map((l, i) => {
+    const lineNum = start + i + 1;
+    const marker = lineNum === line ? ">" : " ";
+    return `${marker} ${String(lineNum).padStart(4, " ")} | ${l}`;
+  }).join("\n");
+}
+
+// src/utils/constants.ts
+var DOCS_BASE_URL = "https://clean-slop.dev/docs";
+var SEVERITY_ORDER = {
+  critical: 5,
+  high: 4,
+  medium: 3,
+  low: 2,
+  info: 1
+};
+var SEVERITY_COLORS = {
+  critical: "\x1B[31m",
+  // red
+  high: "\x1B[91m",
+  // bright red
+  medium: "\x1B[33m",
+  // yellow
+  low: "\x1B[36m",
+  // cyan
+  info: "\x1B[37m"
+  // gray
+};
+var RESET = "\x1B[0m";
+var BOLD = "\x1B[1m";
+var DIM = "\x1B[2m";
+var GREEN = "\x1B[32m";
+var YELLOW = "\x1B[33m";
+var RED = "\x1B[31m";
+var CYAN = "\x1B[36m";
+var GRAY = "\x1B[90m";
+
+// src/rules/engine.ts
+var RuleEngine = class {
+  rules = /* @__PURE__ */ new Map();
+  register(rule23) {
+    if (this.rules.has(rule23.meta.id)) {
+      throw new Error(`Rule "${rule23.meta.id}" is already registered.`);
+    }
+    this.rules.set(rule23.meta.id, rule23);
+  }
+  registerAll(rules) {
+    for (const rule23 of rules) {
+      this.register(rule23);
+    }
+  }
+  getRule(id) {
+    return this.rules.get(id);
+  }
+  getRules() {
+    return Array.from(this.rules.values());
+  }
+  getRulesByCategory(category) {
+    return this.getRules().filter((r) => r.meta.category === category);
+  }
+  runOnFile(parsedFile, config) {
+    const issues = [];
+    for (const rule23 of this.rules.values()) {
+      if (!config.categories[rule23.meta.category]) continue;
+      const ruleConfig = config.rules[rule23.meta.id];
+      const severityOverride = this.resolveSeverityOverride(ruleConfig);
+      if (severityOverride === "off") continue;
+      const effectiveSeverity = severityOverride ?? rule23.meta.severity;
+      const ruleIssues = [];
+      const context = {
+        filePath: parsedFile.filePath,
+        source: parsedFile.source,
+        ast: parsedFile.ast,
+        config,
+        report(partial) {
+          const snippet = partial.snippet ?? extractSnippet(parsedFile.source, partial.location.line);
+          ruleIssues.push({
+            ruleId: rule23.meta.id,
+            ruleName: rule23.meta.name,
+            category: rule23.meta.category,
+            severity: effectiveSeverity,
+            confidence: rule23.meta.confidence,
+            docsUrl: rule23.meta.docsUrl ?? `${DOCS_BASE_URL}/rules/${rule23.meta.id}`,
+            snippet,
+            ...partial
+          });
+        }
+      };
+      try {
+        rule23.create(context);
+      } catch {
+      }
+      issues.push(...ruleIssues);
+    }
+    return issues;
+  }
+  resolveSeverityOverride(ruleConfig) {
+    if (ruleConfig === void 0) return null;
+    if (typeof ruleConfig === "string") {
+      return ruleConfig;
+    }
+    if (typeof ruleConfig === "object" && ruleConfig !== null) {
+      if ("severity" in ruleConfig && ruleConfig.severity) {
+        return ruleConfig.severity;
+      }
+    }
+    return null;
+  }
+};
+
+// src/utils/ast.ts
+function traverse(ast, visitor) {
+  if (!ast || typeof ast !== "object") return;
+  const node = ast;
+  if (typeof node.type === "string") {
+    const handler = visitor[node.type];
+    if (handler) handler(node);
+    const wildcard = visitor["*"];
+    if (wildcard) wildcard(node);
+  }
+  for (const key of Object.keys(node)) {
+    if (key === "parent") continue;
+    const child = node[key];
+    if (Array.isArray(child)) {
+      for (const item of child) {
+        traverse(item, visitor);
+      }
+    } else if (child && typeof child === "object" && "type" in child) {
+      traverse(child, visitor);
+    }
+  }
+}
+function findAll(ast, nodeType) {
+  const results = [];
+  traverse(ast, {
+    [nodeType](node) {
+      results.push(node);
+    }
+  });
+  return results;
+}
+function getLocation(node, filePath) {
+  return {
+    file: filePath,
+    line: node.loc?.start.line ?? 1,
+    column: node.loc?.start.column ?? 0
+  };
+}
+function getCalleeName(node) {
+  const callee = node.callee;
+  if (!callee) return null;
+  if (callee.type === "Identifier") {
+    return callee.name;
+  }
+  if (callee.type === "MemberExpression") {
+    const obj = callee.object;
+    const prop = callee.property;
+    if (obj && prop) {
+      const objName = obj.name;
+      const propName = prop.name;
+      if (objName && propName) return `${objName}.${propName}`;
+    }
+  }
+  return null;
+}
+function isFunctionNode(node) {
+  return node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression";
+}
+function countFunctionLines(node) {
+  if (!node.loc) return 0;
+  return node.loc.end.line - node.loc.start.line + 1;
+}
+function cyclomaticComplexity(funcNode) {
+  let complexity = 1;
+  traverse(funcNode, {
+    IfStatement() {
+      complexity++;
+    },
+    SwitchCase(node) {
+      if (node.test !== null) complexity++;
+    },
+    ConditionalExpression() {
+      complexity++;
+    },
+    LogicalExpression(node) {
+      if (node.operator === "&&" || node.operator === "||" || node.operator === "??") {
+        complexity++;
+      }
+    },
+    ForStatement() {
+      complexity++;
+    },
+    ForInStatement() {
+      complexity++;
+    },
+    ForOfStatement() {
+      complexity++;
+    },
+    WhileStatement() {
+      complexity++;
+    },
+    DoWhileStatement() {
+      complexity++;
+    },
+    CatchClause() {
+      complexity++;
+    }
+  });
+  return complexity;
+}
+function maxNestingDepth(ast, startDepth = 0) {
+  if (!ast || typeof ast !== "object") return startDepth;
+  const node = ast;
+  const nestingTypes = /* @__PURE__ */ new Set([
+    "IfStatement",
+    "ForStatement",
+    "ForInStatement",
+    "ForOfStatement",
+    "WhileStatement",
+    "DoWhileStatement",
+    "SwitchStatement",
+    "TryStatement",
+    "WithStatement"
+  ]);
+  let max = startDepth;
+  const walk = (n, depth) => {
+    if (!n || typeof n !== "object") return;
+    const nn = n;
+    const currentDepth = nestingTypes.has(nn.type) ? depth + 1 : depth;
+    if (currentDepth > max) max = currentDepth;
+    for (const key of Object.keys(nn)) {
+      if (key === "parent") continue;
+      const child = nn[key];
+      if (Array.isArray(child)) {
+        for (const item of child) walk(item, currentDepth);
+      } else if (child && typeof child === "object" && "type" in child) {
+        walk(child, currentDepth);
+      }
+    }
+  };
+  walk(node, startDepth);
+  return max;
+}
+
+// src/rules/ai-slop/empty-catch.ts
+var rule = {
+  meta: {
+    id: "ai-slop/empty-catch",
+    name: "Empty Catch Block",
+    category: "ai-slop",
+    severity: "high",
+    confidence: "certain",
+    description: "Detects catch blocks that silently swallow errors.",
+    rationale: "Empty catch blocks are a hallmark of AI-generated code that handles the error path syntactically but not semantically. They hide failures, making bugs invisible in production.",
+    docsUrl: "https://clean-slop.dev/docs/rules/ai-slop/empty-catch",
+    fixable: false
+  },
+  create(context) {
+    traverse(context.ast, {
+      CatchClause(node) {
+        const body = node.body;
+        if (!body) return;
+        const bodyNode = body;
+        const statements = bodyNode.body ?? [];
+        const hasStatements = statements.some((stmt) => {
+          const s = stmt;
+          return s.type !== "EmptyStatement";
+        });
+        if (!hasStatements) {
+          context.report({
+            message: "Catch block is empty and silently swallows errors.",
+            explanation: "This catch block catches exceptions but does nothing with them. Errors are silently discarded, making it impossible to detect or diagnose failures.",
+            impact: "Silent error swallowing causes mysterious failures in production. Debugging becomes extremely difficult because the exception trail disappears.",
+            location: getLocation(node, context.filePath),
+            fix: {
+              description: "At minimum, log the error. Consider re-throwing if the caller should know about the failure.",
+              code: 'catch (err) {\n  console.error("Unexpected error:", err);\n  // or: throw err;\n}'
+            }
+          });
+        }
+      }
+    });
+  }
+};
+var empty_catch_default = rule;
+
+// src/rules/ai-slop/todo-implementation.ts
+var TODO_PATTERN = /\b(TODO|FIXME|HACK|XXX|TEMP|TEMPORARY|PLACEHOLDER|NOT IMPLEMENTED|NOT_IMPLEMENTED)\b/i;
+var THROW_NOT_IMPLEMENTED = /not.?implemented|to.?do|todo/i;
+var rule2 = {
+  meta: {
+    id: "ai-slop/todo-implementation",
+    name: "TODO / Placeholder Implementation",
+    category: "ai-slop",
+    severity: "high",
+    confidence: "high",
+    description: "Detects TODO comments, placeholder implementations, and unfinished code.",
+    rationale: 'AI code generators frequently produce functions with TODO bodies, placeholder returns, or throw new Error("Not implemented"). These skeletons look complete but break at runtime.',
+    docsUrl: "https://clean-slop.dev/docs/rules/ai-slop/todo-implementation",
+    fixable: false
+  },
+  create(context) {
+    const astWithComments = context.ast;
+    const comments = astWithComments.comments ?? [];
+    for (const comment of comments) {
+      const value = comment.value ?? "";
+      if (TODO_PATTERN.test(value)) {
+        context.report({
+          message: `${comment.type === "Line" ? "//" : "/*"} comment contains TODO/FIXME marker.`,
+          explanation: "This comment indicates unfinished work. In production builds, TODO markers represent missing functionality that was never implemented.",
+          impact: "Incomplete implementations cause runtime failures, data corruption, or silent no-ops when the unfinished code path is reached.",
+          location: getLocation(comment, context.filePath),
+          fix: {
+            description: "Implement the described functionality or create a tracked issue and remove the inline marker."
+          }
+        });
+      }
+    }
+    traverse(context.ast, {
+      ThrowStatement(node) {
+        const argument = node.argument;
+        if (!argument) return;
+        if (argument.type === "NewExpression" || argument.type === "CallExpression") {
+          const callee = argument.callee;
+          if (!callee) return;
+          const calleeName = callee.type === "Identifier" ? callee.name : null;
+          if (calleeName !== "Error") return;
+          const args = argument.arguments ?? [];
+          if (args.length === 0) return;
+          const firstArg = args[0];
+          const msgValue = firstArg.type === "Literal" ? String(firstArg.value) : "";
+          if (THROW_NOT_IMPLEMENTED.test(msgValue)) {
+            context.report({
+              message: `Placeholder implementation: throw new Error("${msgValue}")`,
+              explanation: 'This function throws "Not implemented" or a similar placeholder. It was likely auto-generated and never completed.',
+              impact: "Calling this function in production causes an immediate unhandled exception.",
+              location: getLocation(node, context.filePath),
+              fix: {
+                description: "Implement the function body or remove it from the codebase."
+              }
+            });
+          }
+        }
+      }
+    });
+  }
+};
+var todo_implementation_default = rule2;
+
+// src/rules/ai-slop/giant-function.ts
+var MAX_LINES = 80;
+var rule3 = {
+  meta: {
+    id: "ai-slop/giant-function",
+    name: "Giant Function",
+    category: "ai-slop",
+    severity: "medium",
+    confidence: "certain",
+    description: `Detects functions exceeding ${MAX_LINES} lines, a common sign of AI-generated monoliths.`,
+    rationale: "AI code generators tend to dump entire workflows into single functions without decomposing them. Functions longer than 80 lines are difficult to understand, test, and maintain.",
+    docsUrl: "https://clean-slop.dev/docs/rules/ai-slop/giant-function",
+    fixable: false
+  },
+  create(context) {
+    traverse(context.ast, {
+      FunctionDeclaration: checkFunction,
+      FunctionExpression: checkFunction,
+      ArrowFunctionExpression: checkFunction
+    });
+    function checkFunction(node) {
+      if (!isFunctionNode(node)) return;
+      const lines = countFunctionLines(node);
+      if (lines <= MAX_LINES) return;
+      const idNode = node.id;
+      const name = idNode ? String(idNode.name) : "<anonymous>";
+      context.report({
+        message: `Function "${name}" is ${lines} lines long (limit: ${MAX_LINES}).`,
+        explanation: `This function is ${lines} lines long. Long functions are a strong indicator of AI-generated code that placed all logic in one place without decomposition.`,
+        impact: "Giant functions are untestable, unreadable, and violate the single-responsibility principle. They make bug-fixing and code review slow and error-prone.",
+        location: getLocation(node, context.filePath),
+        fix: {
+          description: "Break the function into smaller, focused functions. Aim for functions under 40 lines that do one thing well."
+        },
+        metadata: {
+          lines
+        }
+      });
+    }
+  }
+};
+var giant_function_default = rule3;
+
+// src/rules/ai-slop/excessive-nesting.ts
+var MAX_DEPTH = 4;
+var rule4 = {
+  meta: {
+    id: "ai-slop/excessive-nesting",
+    name: "Excessive Nesting",
+    category: "ai-slop",
+    severity: "medium",
+    confidence: "certain",
+    description: `Detects functions with control-flow nesting deeper than ${MAX_DEPTH} levels.`,
+    rationale: "Deeply nested code is a strong sign of AI-generated logic that was not refactored. Early returns, guard clauses, and extracted helper functions eliminate deep nesting.",
+    docsUrl: "https://clean-slop.dev/docs/rules/ai-slop/excessive-nesting",
+    fixable: false
+  },
+  create(context) {
+    traverse(context.ast, {
+      FunctionDeclaration: checkFunction,
+      FunctionExpression: checkFunction,
+      ArrowFunctionExpression: checkFunction
+    });
+    function checkFunction(node) {
+      if (!isFunctionNode(node)) return;
+      const depth = maxNestingDepth(node.body, 0);
+      if (depth <= MAX_DEPTH) return;
+      const idNode = node.id;
+      const name = idNode ? String(idNode.name) : "<anonymous>";
+      context.report({
+        message: `Function "${name}" has nesting depth of ${depth} (limit: ${MAX_DEPTH}).`,
+        explanation: `This function contains ${depth} levels of nested blocks. Each additional level of nesting makes logic exponentially harder to follow.`,
+        impact: "Deeply nested code is error-prone, difficult to test, and nearly impossible to review. Bugs introduced in deep nesting often escape code review.",
+        location: getLocation(node, context.filePath),
+        fix: {
+          description: "Use early returns to flatten nesting. Extract deeply-nested logic into named helper functions. Consider inversion of conditions to reduce if/else chains."
+        },
+        metadata: { depth }
+      });
+    }
+  }
+};
+var excessive_nesting_default = rule4;
+
+// src/rules/ai-slop/fake-validation.ts
+var VALIDATION_NAME_PATTERN = /^(validate|isValid|check|verify|sanitize|assert)/i;
+var rule5 = {
+  meta: {
+    id: "ai-slop/fake-validation",
+    name: "Fake Validation",
+    category: "ai-slop",
+    severity: "high",
+    confidence: "medium",
+    description: "Detects validation functions that trivially return true without meaningful checks.",
+    rationale: "AI code generators often produce validation functions with names that imply safety but bodies that unconditionally approve all input. This creates a false sense of security.",
+    docsUrl: "https://clean-slop.dev/docs/rules/ai-slop/fake-validation",
+    fixable: false
+  },
+  create(context) {
+    traverse(context.ast, {
+      FunctionDeclaration: checkFunction,
+      FunctionExpression: checkFunction,
+      ArrowFunctionExpression: checkFunction
+    });
+    function checkFunction(node) {
+      const idNode = node.id ?? node.parent?.id;
+      let name = null;
+      if (idNode?.type === "Identifier") {
+        name = String(idNode.name);
+      }
+      const parent = node.parent;
+      if (!name && parent?.type === "VariableDeclarator") {
+        const idPart = parent.id;
+        if (idPart?.type === "Identifier") {
+          name = String(idPart.name);
+        }
+      }
+      if (!name || !VALIDATION_NAME_PATTERN.test(name)) return;
+      const body = node.body;
+      if (!body) return;
+      if (body.type !== "BlockStatement") {
+        if (body.type === "Literal" && body.value === true) {
+          reportFakeValidation(node, name);
+        }
+        return;
+      }
+      const statements = body.body ?? [];
+      if (statements.length === 1) {
+        const stmt = statements[0];
+        if (stmt.type === "ReturnStatement") {
+          const arg = stmt.argument;
+          if (arg?.type === "Literal" && arg.value === true) {
+            reportFakeValidation(node, name);
+          }
+        }
+      }
+    }
+    function reportFakeValidation(node, name) {
+      context.report({
+        message: `"${name}" appears to be a fake validation function that always returns true.`,
+        explanation: `The function "${name}" has a name suggesting it performs validation, but its body unconditionally returns true. All inputs will pass validation.`,
+        impact: "Fake validation creates false security. Malicious or malformed input bypasses what appears to be a safety check, potentially causing data corruption or security breaches.",
+        location: getLocation(node, context.filePath),
+        fix: {
+          description: "Implement real validation logic that checks the input against expected constraints. Use a validation library such as zod, joi, or yup for complex schemas."
+        }
+      });
+    }
+  }
+};
+var fake_validation_default = rule5;
+
+// src/rules/ai-slop/high-complexity.ts
+var COMPLEXITY_THRESHOLD = 10;
+var COMPLEXITY_HIGH = 20;
+var rule6 = {
+  meta: {
+    id: "ai-slop/high-complexity",
+    name: "High Cyclomatic Complexity",
+    category: "ai-slop",
+    severity: "medium",
+    confidence: "certain",
+    description: `Detects functions with cyclomatic complexity exceeding ${COMPLEXITY_THRESHOLD}.`,
+    rationale: "High complexity is a reliable indicator of AI-generated code that concatenated multiple responsibilities into a single function. Complex functions are difficult to test and almost impossible to reason about correctly.",
+    docsUrl: "https://clean-slop.dev/docs/rules/ai-slop/high-complexity",
+    fixable: false
+  },
+  create(context) {
+    traverse(context.ast, {
+      FunctionDeclaration: checkFunction,
+      FunctionExpression: checkFunction,
+      ArrowFunctionExpression: checkFunction
+    });
+    function checkFunction(node) {
+      if (!isFunctionNode(node)) return;
+      const complexity = cyclomaticComplexity(node);
+      if (complexity <= COMPLEXITY_THRESHOLD) return;
+      const idNode = node.id;
+      const name = idNode ? String(idNode.name) : "<anonymous>";
+      const isHigh = complexity >= COMPLEXITY_HIGH;
+      context.report({
+        message: `Function "${name}" has cyclomatic complexity of ${complexity} (limit: ${COMPLEXITY_THRESHOLD}).`,
+        explanation: `Cyclomatic complexity measures the number of independent paths through code. A complexity of ${complexity} means this function has at least ${complexity} independent execution paths that all need to be understood and tested.`,
+        impact: isHigh ? "Extreme complexity. This function cannot be reliably tested or maintained. Defects introduced here will be very difficult to locate." : "High complexity makes this function difficult to test thoroughly. Each untested path is a potential production defect.",
+        location: getLocation(node, context.filePath),
+        fix: {
+          description: "Extract independent logic branches into well-named helper functions. Aim for functions with complexity under 5. Consider strategy or command patterns for functions that switch on a type discriminant."
+        },
+        metadata: { complexity }
+      });
+    }
+  }
+};
+var high_complexity_default = rule6;
+
+// src/rules/ai-slop/dead-code.ts
+var rule7 = {
+  meta: {
+    id: "ai-slop/dead-code",
+    name: "Dead Code After Return",
+    category: "ai-slop",
+    severity: "medium",
+    confidence: "certain",
+    description: "Detects unreachable code that follows a return, throw, break, or continue statement.",
+    rationale: "Dead code after early exits is a common artifact of AI code generation. It indicates that the generator added logic without tracking control flow, producing code that never executes.",
+    docsUrl: "https://clean-slop.dev/docs/rules/ai-slop/dead-code",
+    fixable: true
+  },
+  create(context) {
+    const terminatingTypes = /* @__PURE__ */ new Set([
+      "ReturnStatement",
+      "ThrowStatement",
+      "BreakStatement",
+      "ContinueStatement"
+    ]);
+    const blocks = findAll(context.ast, "BlockStatement");
+    for (const block of blocks) {
+      const statements = block.body ?? [];
+      for (let i = 0; i < statements.length - 1; i++) {
+        const stmt = statements[i];
+        if (!stmt) continue;
+        if (terminatingTypes.has(stmt.type)) {
+          const nextStmt = statements[i + 1];
+          if (!nextStmt) continue;
+          if (nextStmt.type === "IfStatement") continue;
+          context.report({
+            message: `Unreachable code after ${stmt.type}.`,
+            explanation: `The statement at this line is unreachable because a ${stmt.type} on the previous line will always exit this block before this code can execute.`,
+            impact: "Dead code bloats the bundle, misleads maintainers, and indicates logic errors. Code that was intended to run but is unreachable represents a latent bug.",
+            location: getLocation(nextStmt, context.filePath),
+            fix: {
+              description: "Remove the unreachable code. If it was intended to run, move it before the terminating statement."
+            }
+          });
+          break;
+        }
+      }
+    }
+  }
+};
+var dead_code_default = rule7;
+
+// src/rules/security/unsafe-eval.ts
+var DANGEROUS_EVAL_APIS = /* @__PURE__ */ new Set([
+  "eval",
+  "Function",
+  "execScript"
+]);
+var rule8 = {
+  meta: {
+    id: "security/unsafe-eval",
+    name: "Unsafe eval / Function Constructor",
+    category: "security",
+    severity: "critical",
+    confidence: "high",
+    description: "Detects use of eval() and the Function constructor, which execute arbitrary code.",
+    rationale: "eval() and new Function() execute strings as JavaScript code. When any part of the string comes from user input or external data, this is a code injection vulnerability.",
+    docsUrl: "https://clean-slop.dev/docs/rules/security/unsafe-eval",
+    fixable: false
+  },
+  create(context) {
+    traverse(context.ast, {
+      CallExpression(node) {
+        const name = getCalleeName(node);
+        if (name && DANGEROUS_EVAL_APIS.has(name)) {
+          context.report({
+            message: `Unsafe use of ${name}().`,
+            explanation: `${name}() evaluates its argument as JavaScript code at runtime. If any part of the evaluated string is derived from external data, an attacker can inject and execute arbitrary code.`,
+            impact: "Code injection via eval is one of the highest-severity vulnerabilities in web applications. It allows complete application compromise, data exfiltration, and remote code execution.",
+            location: getLocation(node, context.filePath),
+            fix: {
+              description: "Replace eval() with explicit logic. If you need to parse JSON, use JSON.parse(). If you need dynamic behavior, use a lookup table or strategy pattern."
+            }
+          });
+        }
+      },
+      NewExpression(node) {
+        const callee = node.callee;
+        if (callee?.type === "Identifier" && callee.name === "Function") {
+          context.report({
+            message: "Unsafe use of new Function() constructor.",
+            explanation: "new Function() constructs and executes JavaScript from a string at runtime. This is functionally equivalent to eval() and shares the same injection risks.",
+            impact: "Allows arbitrary code execution if the string argument contains any external data. Bypasses Content Security Policy directives and static analysis.",
+            location: getLocation(node, context.filePath),
+            fix: {
+              description: "Eliminate the dynamic code construction. Use explicit functions, closures, or a sandboxed evaluation library (e.g., vm2) if dynamic execution is genuinely required."
+            }
+          });
+        }
+      }
+    });
+  }
+};
+var unsafe_eval_default = rule8;
+
+// src/rules/security/hardcoded-secrets.ts
+var SECRET_PATTERNS = [
+  {
+    name: "API Key",
+    pattern: /(?:api[_-]?key|apikey)\s*[:=]\s*['"][a-zA-Z0-9_-]{20,}['"]/i,
+    description: "hardcoded API key"
+  },
+  {
+    name: "AWS Access Key",
+    pattern: /AKIA[0-9A-Z]{16}/,
+    description: "AWS access key ID"
+  },
+  {
+    name: "AWS Secret",
+    pattern: /aws[_-]?secret[_-]?(?:access[_-]?)?key\s*[:=]\s*['"][^'"]{20,}['"]/i,
+    description: "AWS secret access key"
+  },
+  {
+    name: "Private Key",
+    pattern: /-----BEGIN (?:RSA |EC |DSA )?PRIVATE KEY-----/,
+    description: "PEM private key"
+  },
+  {
+    name: "Password",
+    pattern: /(?:password|passwd|pwd)\s*[:=]\s*['"][^'"]{4,}['"]/i,
+    description: "hardcoded password"
+  },
+  {
+    name: "JWT Secret",
+    pattern: /(?:jwt[_-]?secret|token[_-]?secret)\s*[:=]\s*['"][^'"]{8,}['"]/i,
+    description: "hardcoded JWT signing secret"
+  },
+  {
+    name: "Database URL",
+    pattern: /(?:mongo(?:db)?|postgres(?:ql)?|mysql|redis):\/\/[^:'"]+:[^@'"]+@/i,
+    description: "database connection string with credentials"
+  },
+  {
+    name: "Generic Secret",
+    pattern: /(?:secret|token)\s*[:=]\s*['"][a-zA-Z0-9+/=_-]{20,}['"]/i,
+    description: "hardcoded secret or token"
+  },
+  {
+    name: "GitHub Token",
+    pattern: /ghp_[a-zA-Z0-9]{36}/,
+    description: "GitHub personal access token"
+  },
+  {
+    name: "Stripe Key",
+    pattern: /(?:sk|pk)_(?:live|test)_[a-zA-Z0-9]{24,}/,
+    description: "Stripe API key"
+  }
+];
+var PLACEHOLDER_PATTERNS = [
+  /^(?:your[-_]?)?(?:api[-_]?)?(?:key|secret|token|password)$/i,
+  /^<.+>$/,
+  /^xxx/i,
+  /^placeholder/i,
+  /^\*+$/,
+  /^test$/i,
+  /^example$/i,
+  /^change[-_]?me/i,
+  /process\.env\./
+];
+function isPlaceholder(value) {
+  return PLACEHOLDER_PATTERNS.some((p) => p.test(value));
+}
+var rule9 = {
+  meta: {
+    id: "security/hardcoded-secrets",
+    name: "Hardcoded Secrets",
+    category: "security",
+    severity: "critical",
+    confidence: "high",
+    description: "Detects API keys, passwords, tokens, and secrets hardcoded in source files.",
+    rationale: "Hardcoded credentials are one of the most common causes of security breaches. When code is committed to version control, credentials are permanently exposed in history even if removed later.",
+    docsUrl: "https://clean-slop.dev/docs/rules/security/hardcoded-secrets",
+    fixable: false
+  },
+  create(context) {
+    const lines = context.source.split("\n");
+    lines.forEach((line, index) => {
+      for (const { name, pattern, description } of SECRET_PATTERNS) {
+        if (!pattern.test(line)) continue;
+        const valueMatch = line.match(/[:=]\s*['"]([^'"]+)['"]/);
+        if (valueMatch && valueMatch[1] && isPlaceholder(valueMatch[1])) continue;
+        context.report({
+          message: `Possible hardcoded ${name} detected.`,
+          explanation: `A potential ${description} was found hardcoded in source. Credentials in source files are committed to version control and accessible to anyone with repository access, including in private repositories through history and forks.`,
+          impact: "Exposed credentials can be used to access cloud infrastructure, databases, and third-party services. Even after removal, they remain in git history. Rotation is required immediately.",
+          location: {
+            file: context.filePath,
+            line: index + 1,
+            column: 0
+          },
+          fix: {
+            description: "Remove the credential from source. Store secrets in environment variables (process.env.SECRET_NAME) or a secrets manager (AWS Secrets Manager, HashiCorp Vault, Doppler). Rotate the exposed credential immediately.",
+            code: "const apiKey = process.env.API_KEY;\nif (!apiKey) throw new Error('API_KEY environment variable is required.');"
+          }
+        });
+        break;
+      }
+    });
+    traverse2(context.ast, {
+      Literal(node) {
+        if (typeof node.value !== "string") return;
+        const val = node.value;
+        if (val.length < 20) return;
+        if (isPlaceholder(val)) return;
+        for (const { name, pattern, description } of SECRET_PATTERNS) {
+          if (pattern.test(val)) {
+            context.report({
+              message: `String literal appears to be a hardcoded ${name}.`,
+              explanation: `The string "${val.slice(0, 8)}..." matches a pattern for a ${description}. Hardcoding credentials in string literals exposes them in source control.`,
+              impact: "Immediate rotation of the credential is required. All historical commits containing this value must be treated as compromised.",
+              location: getLocation2(node, context.filePath),
+              fix: {
+                description: "Replace with an environment variable reference: process.env.SECRET_NAME"
+              }
+            });
+            break;
+          }
+        }
+      }
+    });
+    function traverse2(ast, visitor) {
+      if (!ast || typeof ast !== "object") return;
+      const node = ast;
+      if (typeof node.type === "string") {
+        visitor[node.type]?.(node);
+      }
+      for (const key of Object.keys(node)) {
+        if (key === "parent") continue;
+        const child = node[key];
+        if (Array.isArray(child)) {
+          for (const item of child) traverse2(item, visitor);
+        } else if (child && typeof child === "object" && "type" in child) {
+          traverse2(child, visitor);
+        }
+      }
+    }
+    function getLocation2(node, filePath) {
+      return {
+        file: filePath,
+        line: node.loc?.start.line ?? 1,
+        column: node.loc?.start.column ?? 0
+      };
+    }
+  }
+};
+var hardcoded_secrets_default = rule9;
+
+// src/rules/security/sql-injection.ts
+var SQL_KEYWORDS = /\b(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER|TRUNCATE|EXEC|EXECUTE|UNION|FROM|WHERE|JOIN)\b/i;
+var SQL_CALL_PATTERNS = [
+  "query",
+  "execute",
+  "exec",
+  "run",
+  "prepare",
+  "raw",
+  "db.query",
+  "db.execute",
+  "pool.query",
+  "connection.query",
+  "knex.raw",
+  "sequelize.query"
+];
+function looksLikeSqlCall(node) {
+  const callee = node.callee;
+  if (!callee) return false;
+  if (callee.type === "Identifier") {
+    return SQL_CALL_PATTERNS.includes(String(callee.name));
+  }
+  if (callee.type === "MemberExpression") {
+    const prop = callee.property;
+    if (prop?.type === "Identifier") {
+      return SQL_CALL_PATTERNS.some((p) => p.endsWith(`.${prop.name}`) || p === prop.name);
+    }
+  }
+  return false;
+}
+function containsSqlKeywords(str) {
+  return SQL_KEYWORDS.test(str);
+}
+function getTemplateRawContent(node) {
+  const quasis = node.quasis ?? [];
+  return quasis.map((q) => {
+    const val = q.value;
+    return String(val?.cooked ?? val?.raw ?? "");
+  }).join("...");
+}
+var rule10 = {
+  meta: {
+    id: "security/sql-injection",
+    name: "SQL Injection",
+    category: "security",
+    severity: "critical",
+    confidence: "high",
+    description: "Detects SQL queries built with string concatenation or template literals containing variables.",
+    rationale: "SQL injection remains the most prevalent web application vulnerability. Embedding JavaScript variables directly into SQL strings gives attackers control over query structure.",
+    docsUrl: "https://clean-slop.dev/docs/rules/security/sql-injection",
+    fixable: false
+  },
+  create(context) {
+    traverse(context.ast, {
+      CallExpression(node) {
+        if (!looksLikeSqlCall(node)) return;
+        const args = node.arguments ?? [];
+        const firstArg = args[0];
+        if (!firstArg) return;
+        if (firstArg.type === "TemplateLiteral") {
+          const expressions = firstArg.expressions ?? [];
+          if (expressions.length === 0) return;
+          const rawContent = getTemplateRawContent(firstArg);
+          if (!containsSqlKeywords(rawContent)) return;
+          context.report({
+            message: "Possible SQL injection: template literal with expressions passed to query function.",
+            explanation: "This SQL query is built using a template literal that embeds JavaScript variables. If any of the interpolated values derive from user input, an attacker can alter the query structure by injecting SQL syntax.",
+            impact: "SQL injection can lead to unauthorized data access, data modification, authentication bypass, and in some configurations, remote code execution on the database server.",
+            location: getLocation(node, context.filePath),
+            fix: {
+              description: "Use parameterized queries or prepared statements. Pass user-controlled values as parameters, never as part of the SQL string.",
+              code: '// Instead of:\n// db.query(`SELECT * FROM users WHERE id = ${userId}`)\n\n// Use parameterized queries:\ndb.query("SELECT * FROM users WHERE id = ?", [userId])'
+            }
+          });
+        }
+        if (firstArg.type === "BinaryExpression" && firstArg.operator === "+") {
+          const leftStr = extractLeftmostString(firstArg);
+          if (leftStr && containsSqlKeywords(leftStr)) {
+            context.report({
+              message: "Possible SQL injection: string concatenation in SQL query.",
+              explanation: "This SQL query is constructed by concatenating strings and variables. Variables injected into a SQL string allow attackers to manipulate the query.",
+              impact: "SQL injection can expose the entire database, bypass authentication, and enable destructive operations (DROP TABLE, etc.).",
+              location: getLocation(node, context.filePath),
+              fix: {
+                description: "Replace string concatenation with parameterized queries. Never construct SQL from variables.",
+                code: 'db.query(\n  "SELECT * FROM users WHERE name = ? AND role = ?",\n  [userName, userRole]\n)'
+              }
+            });
+          }
+        }
+      }
+    });
+    function extractLeftmostString(node) {
+      if (node.type === "Literal" && typeof node.value === "string") {
+        return node.value;
+      }
+      if (node.type === "BinaryExpression" && node.operator === "+") {
+        return extractLeftmostString(node.left);
+      }
+      return null;
+    }
+  }
+};
+var sql_injection_default = rule10;
+
+// src/rules/security/command-injection.ts
+var DANGEROUS_CHILD_PROCESS = /* @__PURE__ */ new Set([
+  "exec",
+  "execSync",
+  "spawn",
+  "spawnSync",
+  "execFile",
+  "execFileSync"
+]);
+function looksLikeChildProcessCall(node) {
+  const callee = node.callee;
+  if (!callee) return false;
+  if (callee.type === "MemberExpression") {
+    const prop = callee.property;
+    if (prop?.type === "Identifier") {
+      return DANGEROUS_CHILD_PROCESS.has(String(prop.name));
+    }
+  }
+  if (callee.type === "Identifier") {
+    return DANGEROUS_CHILD_PROCESS.has(String(callee.name));
+  }
+  return false;
+}
+function firstArgIsDynamic(node) {
+  const args = node.arguments ?? [];
+  const first = args[0];
+  if (!first) return false;
+  if (first.type === "Literal") return false;
+  if (first.type === "TemplateLiteral") {
+    const expressions = first.expressions ?? [];
+    return expressions.length > 0;
+  }
+  return true;
+}
+var rule11 = {
+  meta: {
+    id: "security/command-injection",
+    name: "Command Injection",
+    category: "security",
+    severity: "critical",
+    confidence: "high",
+    description: "Detects child_process calls that build shell commands from variables, enabling command injection.",
+    rationale: "Passing user-controlled data to exec(), spawn(), or similar APIs allows an attacker to inject shell metacharacters that execute arbitrary system commands.",
+    docsUrl: "https://clean-slop.dev/docs/rules/security/command-injection",
+    fixable: false
+  },
+  create(context) {
+    traverse(context.ast, {
+      CallExpression(node) {
+        if (!looksLikeChildProcessCall(node)) return;
+        if (!firstArgIsDynamic(node)) return;
+        const callee = node.callee;
+        const prop = callee.type === "MemberExpression" ? callee.property.name : callee.name;
+        context.report({
+          message: `Possible command injection: dynamic argument passed to child_process.${prop}().`,
+          explanation: `The first argument to ${prop}() appears to be dynamically constructed. If any part of this argument derives from external input, an attacker can inject shell metacharacters (e.g. ; rm -rf /) to execute arbitrary commands on the server.`,
+          impact: "Command injection on a server results in full system compromise: data theft, ransomware deployment, lateral movement, and persistent access.",
+          location: getLocation(node, context.filePath),
+          fix: {
+            description: "Use execFile() or spawn() with an argument array instead of exec() with a shell string. Never pass user input to a shell command. Validate and whitelist all inputs.",
+            code: "// Dangerous:\n// exec(`ls ${userInput}`)\n\n// Safe:\nimport { execFile } from 'child_process';\nexecFile('ls', [sanitizedPath], callback);"
+          }
+        });
+      }
+    });
+  }
+};
+var command_injection_default = rule11;
+
+// src/rules/security/path-traversal.ts
+var FS_WRITE_METHODS = /* @__PURE__ */ new Set([
+  "readFile",
+  "readFileSync",
+  "writeFile",
+  "writeFileSync",
+  "readdir",
+  "readdirSync",
+  "createReadStream",
+  "createWriteStream",
+  "unlink",
+  "unlinkSync",
+  "stat",
+  "statSync",
+  "access",
+  "accessSync",
+  "open",
+  "openSync"
+]);
+function isFsCallWithDynamicPath(node) {
+  const callee = node.callee;
+  if (!callee) return false;
+  let methodName = null;
+  if (callee.type === "MemberExpression") {
+    const prop = callee.property;
+    if (prop?.type === "Identifier") methodName = String(prop.name);
+  } else if (callee.type === "Identifier") {
+    methodName = String(callee.name);
+  }
+  if (!methodName || !FS_WRITE_METHODS.has(methodName)) return false;
+  const args = node.arguments ?? [];
+  const first = args[0];
+  if (!first) return false;
+  return first.type !== "Literal";
+}
+var rule12 = {
+  meta: {
+    id: "security/path-traversal",
+    name: "Path Traversal",
+    category: "security",
+    severity: "critical",
+    confidence: "medium",
+    description: "Detects file system operations with dynamic paths that may allow path traversal attacks.",
+    rationale: 'Path traversal occurs when an attacker uses "../" sequences in user-controlled input to escape the intended directory and access arbitrary files.',
+    docsUrl: "https://clean-slop.dev/docs/rules/security/path-traversal",
+    fixable: false
+  },
+  create(context) {
+    traverse(context.ast, {
+      CallExpression(node) {
+        if (isFsCallWithDynamicPath(node)) {
+          const callee = node.callee;
+          const prop = callee.type === "MemberExpression" ? String(callee.property.name) : String(callee.name);
+          context.report({
+            message: `Possible path traversal: dynamic path passed to fs.${prop}().`,
+            explanation: `${prop}() is called with a non-literal path argument. If this path is influenced by user input without sanitization, an attacker can use "../" sequences to escape the intended directory.`,
+            impact: "Successful path traversal allows reading sensitive system files (/etc/passwd, .env, private keys), writing malicious content to arbitrary locations, or deleting critical files.",
+            location: getLocation(node, context.filePath),
+            fix: {
+              description: "Resolve the path and verify it begins with the intended base directory before use.",
+              code: "import path from 'path';\n\nconst baseDir = path.resolve('./uploads');\nconst safePath = path.resolve(baseDir, userInput);\n\nif (!safePath.startsWith(baseDir + path.sep)) {\n  throw new Error('Path traversal detected');\n}\n\nfs.readFile(safePath, 'utf-8');"
+            }
+          });
+        }
+      }
+    });
+  }
+};
+var path_traversal_default = rule12;
+
+// src/rules/security/prototype-pollution.ts
+var MERGE_FUNCTIONS = /* @__PURE__ */ new Set([
+  "Object.assign",
+  "_.merge",
+  "_.extend",
+  "_.defaultsDeep",
+  "merge",
+  "deepMerge",
+  "deepExtend"
+]);
+function getFullCalleeName(node) {
+  const callee = node.callee;
+  if (!callee) return null;
+  if (callee.type === "Identifier") return String(callee.name);
+  if (callee.type === "MemberExpression") {
+    const obj = callee.object;
+    const prop = callee.property;
+    if (obj?.type === "Identifier" && prop?.type === "Identifier") {
+      return `${obj.name}.${prop.name}`;
+    }
+  }
+  return null;
+}
+var rule13 = {
+  meta: {
+    id: "security/prototype-pollution",
+    name: "Prototype Pollution",
+    category: "security",
+    severity: "high",
+    confidence: "medium",
+    description: "Detects patterns that may allow attackers to pollute Object.prototype.",
+    rationale: "Prototype pollution allows an attacker to inject properties into Object.prototype, affecting all objects in the application. This can bypass security checks, cause denial of service, or enable remote code execution.",
+    docsUrl: "https://clean-slop.dev/docs/rules/security/prototype-pollution",
+    fixable: false
+  },
+  create(context) {
+    traverse(context.ast, {
+      // Detect: obj[variable] = value where variable could be __proto__
+      AssignmentExpression(node) {
+        const left = node.left;
+        if (!left) return;
+        if (left.type !== "MemberExpression") return;
+        if (!left.computed) return;
+        const prop = left.property;
+        if (!prop) return;
+        if (prop.type === "Literal") {
+          const key = String(prop.value);
+          if (key === "__proto__" || key === "constructor" || key === "prototype") {
+            context.report({
+              message: `Assignment to dangerous property "${key}" may cause prototype pollution.`,
+              explanation: `Assigning to obj["${key}"] can modify Object.prototype when "obj" is a user-controlled JSON payload or when the key is not validated.`,
+              impact: "Prototype pollution can override security checks that compare against default values, corrupt application state, and in some environments enable code execution.",
+              location: getLocation(node, context.filePath),
+              fix: {
+                description: "Never assign to __proto__, constructor, or prototype from external input. Validate object keys against an allowlist before assignment."
+              }
+            });
+          }
+        } else {
+          context.report({
+            message: "Dynamic bracket assignment may allow prototype pollution if key is not validated.",
+            explanation: "Writing to obj[dynamicKey] with an unvalidated key allows an attacker to set __proto__ or constructor, polluting Object.prototype for all objects.",
+            impact: "If the key comes from user-controlled input (query params, JSON body, headers), this is an exploitable prototype pollution vulnerability.",
+            location: getLocation(node, context.filePath),
+            fix: {
+              description: "Validate the key against an allowlist before assignment: if (ALLOWED_KEYS.has(key)) obj[key] = value; Or use Object.create(null) for dictionary objects."
+            }
+          });
+        }
+      },
+      // Detect Object.assign(target, untrustedSource) and lodash merge
+      CallExpression(node) {
+        const name = getFullCalleeName(node);
+        if (!name || !MERGE_FUNCTIONS.has(name)) return;
+        const args = node.arguments ?? [];
+        if (args.length < 2) return;
+        const source = args[1];
+        if (source.type !== "ObjectExpression") {
+          context.report({
+            message: `${name}() with a non-literal source may introduce prototype pollution.`,
+            explanation: `${name}() recursively copies properties from the source object. If the source derives from user input and contains __proto__ or constructor keys, it will pollute the target object's prototype chain.`,
+            impact: "All objects in the application share Object.prototype. Polluting it can override security-relevant default values and cause widespread application misbehavior.",
+            location: getLocation(node, context.filePath),
+            fix: {
+              description: `Sanitize the source before passing it to ${name}(). Use a library like defu or structuredClone with property filtering, or validate the source against a schema before merging.`
+            }
+          });
+        }
+      }
+    });
+  }
+};
+var prototype_pollution_default = rule13;
+
+// src/rules/security/weak-crypto.ts
+var WEAK_HASH_ALGORITHMS = /* @__PURE__ */ new Set(["md5", "sha1", "sha-1", "md4", "rc4", "des", "3des"]);
+var WEAK_CIPHER_MODES = /* @__PURE__ */ new Set(["ecb", "cbc"]);
+var MATH_RANDOM_DESC = "Math.random() is a pseudo-random number generator not suitable for cryptographic use.";
+var rule14 = {
+  meta: {
+    id: "security/weak-crypto",
+    name: "Weak Cryptography",
+    category: "security",
+    severity: "high",
+    confidence: "high",
+    description: "Detects use of weak or broken cryptographic algorithms (MD5, SHA1, ECB mode, Math.random).",
+    rationale: "MD5 and SHA1 are cryptographically broken. Using them for password hashing or data integrity provides no real security. Math.random() is predictable and must not be used for tokens, keys, or any security-sensitive value.",
+    docsUrl: "https://clean-slop.dev/docs/rules/security/weak-crypto",
+    fixable: false
+  },
+  create(context) {
+    traverse(context.ast, {
+      CallExpression(node) {
+        const callee = node.callee;
+        if (!callee) return;
+        if (callee.type === "MemberExpression" && callee.object?.type === "Identifier" && String(callee.object.name) === "Math" && callee.property?.type === "Identifier" && String(callee.property.name) === "random") {
+          context.report({
+            message: "Math.random() is not cryptographically secure.",
+            explanation: MATH_RANDOM_DESC,
+            impact: "Using Math.random() for security tokens, session IDs, or passwords produces predictable values that attackers can guess or enumerate.",
+            location: getLocation(node, context.filePath),
+            fix: {
+              description: "Use the Web Crypto API or Node.js crypto module for secure random values.",
+              code: "// Node.js:\nimport { randomBytes } from 'crypto';\nconst token = randomBytes(32).toString('hex');\n\n// Browser:\nconst array = new Uint8Array(32);\ncrypto.getRandomValues(array);"
+            }
+          });
+        }
+        if (callee.type === "MemberExpression" && callee.property?.type === "Identifier" && String(callee.property.name) === "createHash") {
+          const args = node.arguments ?? [];
+          const algoArg = args[0];
+          if (algoArg?.type === "Literal") {
+            const algo = String(algoArg.value).toLowerCase();
+            if (WEAK_HASH_ALGORITHMS.has(algo)) {
+              context.report({
+                message: `Weak hash algorithm "${algoArg.value}" used in createHash().`,
+                explanation: `${algoArg.value} is a broken hash algorithm. It is vulnerable to collision attacks and should not be used for data integrity checks, password hashing, or digital signatures.`,
+                impact: "Broken hash algorithms allow attackers to forge hashes, bypass integrity checks, and crack password hashes rapidly using precomputed tables.",
+                location: getLocation(node, context.filePath),
+                fix: {
+                  description: "Replace with SHA-256 or SHA-3 for general hashing: crypto.createHash('sha256'). For password hashing, use bcrypt, argon2, or scrypt instead of any raw hash."
+                }
+              });
+            }
+          }
+        }
+        if (callee.type === "MemberExpression" && callee.property?.type === "Identifier" && String(callee.property.name) === "createCipheriv") {
+          const args = node.arguments ?? [];
+          const algoArg = args[0];
+          if (algoArg?.type === "Literal") {
+            const algo = String(algoArg.value).toLowerCase();
+            if ([...WEAK_CIPHER_MODES].some((m) => algo.includes(m))) {
+              context.report({
+                message: `Insecure cipher mode detected: "${algoArg.value}".`,
+                explanation: `AES-ECB produces identical ciphertext for identical plaintext blocks, revealing patterns in encrypted data. AES-CBC is also prone to padding oracle attacks.`,
+                impact: "Insecure cipher modes can expose plaintext structure to passive observers and may be fully decryptable by an active attacker.",
+                location: getLocation(node, context.filePath),
+                fix: {
+                  description: "Use AES-GCM (Authenticated Encryption): crypto.createCipheriv('aes-256-gcm', key, iv). Always use a unique IV per encryption operation."
+                }
+              });
+            }
+          }
+        }
+      }
+    });
+  }
+};
+var weak_crypto_default = rule14;
+
+// src/rules/security/dangerous-cors.ts
+function getPropertyValue(props, keyName) {
+  for (const prop of props) {
+    if (prop.type !== "Property") continue;
+    const key = prop.key;
+    const keyStr = key?.type === "Identifier" ? String(key.name) : key?.type === "Literal" ? String(key.value) : null;
+    if (keyStr === keyName) {
+      return prop.value;
+    }
+  }
+  return void 0;
+}
+function getLiteralString(node) {
+  if (!node) return null;
+  if (node.type === "Literal" && typeof node.value === "string") return node.value;
+  return null;
+}
+function getLiteralBool(node) {
+  if (!node) return null;
+  if (node.type === "Literal" && typeof node.value === "boolean") return node.value;
+  return null;
+}
+var rule15 = {
+  meta: {
+    id: "security/dangerous-cors",
+    name: "Dangerous CORS / Cookie Configuration",
+    category: "security",
+    severity: "high",
+    confidence: "high",
+    description: "Detects wildcard CORS origins, insecure cookie settings, and overly permissive configurations.",
+    rationale: "CORS misconfiguration and insecure cookie attributes are among the most common security mistakes in Node.js backends. They enable CSRF, session hijacking, and cross-origin data leakage.",
+    docsUrl: "https://clean-slop.dev/docs/rules/security/dangerous-cors",
+    fixable: false
+  },
+  create(context) {
+    traverse(context.ast, {
+      CallExpression(node) {
+        const callee = node.callee;
+        if (!callee) return;
+        const isCorsCall = callee.type === "Identifier" && String(callee.name) === "cors" || callee.type === "MemberExpression" && String(callee.property.name) === "cors";
+        if (isCorsCall) {
+          const args = node.arguments ?? [];
+          const configArg = args[0];
+          if (!configArg || configArg.type !== "ObjectExpression") return;
+          const props = configArg.properties ?? [];
+          const originNode = getPropertyValue(props, "origin");
+          if (!originNode) return;
+          const originStr = getLiteralString(originNode);
+          const originBool = getLiteralBool(originNode);
+          if (originStr === "*" || originBool === true) {
+            context.report({
+              message: `CORS configured with permissive origin: ${JSON.stringify(originStr ?? originBool)}.`,
+              explanation: 'Setting CORS origin to "*" or true allows any website to make cross-origin requests to this API. When combined with cookies or Authorization headers, this enables cross-site request forgery (CSRF) attacks.',
+              impact: "Malicious websites can make authenticated requests on behalf of logged-in users, read sensitive API responses, and exfiltrate data.",
+              location: getLocation(originNode, context.filePath),
+              fix: {
+                description: "Specify an explicit allowlist of trusted origins. Use an environment variable to configure origins per deployment environment.",
+                code: "cors({\n  origin: process.env.ALLOWED_ORIGINS?.split(',') ?? [],\n  credentials: true,\n})"
+              }
+            });
+          }
+        }
+      },
+      ObjectExpression(node) {
+        const props = node.properties ?? [];
+        const httpOnlyNode = getPropertyValue(props, "httpOnly");
+        if (httpOnlyNode && getLiteralBool(httpOnlyNode) === false) {
+          context.report({
+            message: "Cookie configured with httpOnly: false.",
+            explanation: "Setting httpOnly: false makes cookies accessible to JavaScript via document.cookie. This allows cross-site scripting (XSS) attacks to steal session cookies.",
+            impact: "A single XSS vulnerability in your application can lead to session hijacking for all users if cookies are not protected with httpOnly.",
+            location: getLocation(httpOnlyNode, context.filePath),
+            fix: {
+              description: "Set httpOnly: true for all session and authentication cookies. Never set httpOnly: false unless the cookie is explicitly intended for JavaScript access."
+            }
+          });
+        }
+        const secureNode = getPropertyValue(props, "secure");
+        if (secureNode && getLiteralBool(secureNode) === false) {
+          context.report({
+            message: "Cookie configured with secure: false.",
+            explanation: "Setting secure: false allows cookies to be transmitted over unencrypted HTTP connections. This exposes session tokens to network interception.",
+            impact: "Cookies sent over HTTP can be captured by network observers, enabling session hijacking and man-in-the-middle attacks.",
+            location: getLocation(secureNode, context.filePath),
+            fix: {
+              description: "Set secure: true for all session and authentication cookies. Use a conditional based on NODE_ENV only in local development.",
+              code: "secure: process.env.NODE_ENV === 'production'"
+            }
+          });
+        }
+        const sameSiteNode = getPropertyValue(props, "sameSite");
+        if (sameSiteNode && getLiteralString(sameSiteNode)?.toLowerCase() === "none") {
+          const secureValue = getPropertyValue(props, "secure");
+          if (!secureValue || getLiteralBool(secureValue) !== true) {
+            context.report({
+              message: "Cookie has sameSite: 'none' without secure: true.",
+              explanation: "sameSite: 'none' is required for cross-site cookies but is only valid when combined with secure: true. Without it, the cookie is rejected by modern browsers.",
+              impact: "Cross-origin requests will fail in production because the browser will reject the cookie. This may also enable CSRF if the application is served over HTTP.",
+              location: getLocation(sameSiteNode, context.filePath),
+              fix: {
+                description: "Add secure: true when using sameSite: 'none'. Cross-site cookies require HTTPS."
+              }
+            });
+          }
+        }
+      }
+    });
+  }
+};
+var dangerous_cors_default = rule15;
+
+// src/rules/reliability/unhandled-promise.ts
+var KNOWN_ASYNC_APIS = /* @__PURE__ */ new Set([
+  "fetch",
+  "axios",
+  "mongoose.connect",
+  "connect",
+  "disconnect",
+  "save",
+  "create",
+  "find",
+  "findOne",
+  "findById",
+  "update",
+  "updateOne",
+  "deleteOne",
+  "remove",
+  "sendMail",
+  "publish",
+  "subscribe",
+  "emit",
+  "send",
+  "write",
+  "close",
+  "end",
+  "open",
+  "connect",
+  "mkdir",
+  "unlink",
+  "copyFile",
+  "rename",
+  "readFile",
+  "writeFile",
+  "appendFile"
+]);
+function getCallName(node) {
+  const callee = node.callee;
+  if (!callee) return null;
+  if (callee.type === "Identifier") return String(callee.name);
+  if (callee.type === "MemberExpression") {
+    const prop = callee.property;
+    if (prop?.type === "Identifier") return String(prop.name);
+  }
+  return null;
+}
+function isPromiseChained(node) {
+  const parent = node.parent;
+  if (!parent) return false;
+  if (parent.type === "MemberExpression" || parent.type === "CallExpression") {
+    return true;
+  }
+  if (parent.type === "AwaitExpression") return true;
+  if (parent.type === "ReturnStatement") return true;
+  if (parent.type === "VariableDeclarator") return true;
+  if (parent.type === "AssignmentExpression") return true;
+  return false;
+}
+var rule16 = {
+  meta: {
+    id: "reliability/unhandled-promise",
+    name: "Unhandled Promise",
+    category: "reliability",
+    severity: "high",
+    confidence: "medium",
+    description: "Detects Promise-returning function calls that are not awaited, returned, or error-handled.",
+    rationale: "Unhandled Promise rejections crash Node.js processes in versions >= 15 and cause silent failures in older versions. Fire-and-forget async calls hide errors that should be surfaced to callers.",
+    docsUrl: "https://clean-slop.dev/docs/rules/reliability/unhandled-promise",
+    fixable: false
+  },
+  create(context) {
+    traverse(context.ast, {
+      ExpressionStatement(node) {
+        const expr = node.expression;
+        if (!expr || expr.type !== "CallExpression") return;
+        const name = getCallName(expr);
+        if (!name) return;
+        if (!KNOWN_ASYNC_APIS.has(name)) return;
+        if (isPromiseChained(expr)) return;
+        context.report({
+          message: `Possible unhandled Promise: result of ${name}() is not awaited or handled.`,
+          explanation: `${name}() likely returns a Promise, but the result is discarded. If this Promise rejects, the error will be swallowed or crash the process.`,
+          impact: "Unhandled rejections in production cause process crashes (Node.js >= 15) or silent data loss. Operations you expect to complete may silently fail.",
+          location: getLocation(expr, context.filePath),
+          fix: {
+            description: "Await the Promise inside an async function, or add .catch() to handle rejection explicitly.",
+            code: '// Option 1: await in an async function\nawait someAsyncFn();\n\n// Option 2: explicit catch\nsomeAsyncFn().catch((err) => {\n  logger.error("Operation failed:", err);\n});'
+          }
+        });
+      }
+    });
+  }
+};
+var unhandled_promise_default = rule16;
+
+// src/rules/reliability/missing-await.ts
+function isAsyncFunction(node) {
+  return (node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression") && node.async === true;
+}
+var LIKELY_ASYNC = /* @__PURE__ */ new Set([
+  "fetch",
+  "readFile",
+  "writeFile",
+  "connect",
+  "query",
+  "execute",
+  "findOne",
+  "find",
+  "save",
+  "create",
+  "update",
+  "delete",
+  "sendMail",
+  "publish",
+  "subscribe"
+]);
+function looksAsync(node) {
+  if (node.type !== "CallExpression") return false;
+  const callee = node.callee;
+  if (!callee) return false;
+  if (callee.type === "Identifier" && LIKELY_ASYNC.has(String(callee.name))) return true;
+  if (callee.type === "MemberExpression") {
+    const prop = callee.property;
+    if (prop?.type === "Identifier" && LIKELY_ASYNC.has(String(prop.name))) return true;
+  }
+  return false;
+}
+var rule17 = {
+  meta: {
+    id: "reliability/missing-await",
+    name: "Missing Await",
+    category: "reliability",
+    severity: "high",
+    confidence: "medium",
+    description: "Detects async functions that return un-awaited Promises or call async APIs without await.",
+    rationale: "Forgetting await is one of the most common async bugs in JavaScript. The function appears to return a value but actually returns a Promise, causing unexpected behavior in callers that expect a resolved value.",
+    docsUrl: "https://clean-slop.dev/docs/rules/reliability/missing-await",
+    fixable: true
+  },
+  create(context) {
+    traverse(context.ast, {
+      FunctionDeclaration: checkAsyncFn,
+      FunctionExpression: checkAsyncFn,
+      ArrowFunctionExpression: checkAsyncFn
+    });
+    function checkAsyncFn(fn) {
+      if (!isAsyncFunction(fn)) return;
+      const body = fn.body;
+      if (!body) return;
+      if (body.type !== "BlockStatement") {
+        if (looksAsync(body)) {
+          context.report({
+            message: "Async arrow function returns a Promise without await.",
+            explanation: "The expression body of this async arrow function appears to return a Promise directly. The outer async function wraps this in another Promise, which may not be what was intended.",
+            impact: "Callers awaiting this function will receive a resolved Promise<Promise<T>> rather than T. This causes subtle type errors and may result in unhandled rejections.",
+            location: getLocation(fn, context.filePath),
+            fix: {
+              description: "Add await to the expression body: async () => await fetch(...)",
+              code: 'const getData = async () => await fetch("/api/data");'
+            }
+          });
+        }
+        return;
+      }
+      const statements = body.body ?? [];
+      for (const stmt of statements) {
+        if (stmt.type !== "ReturnStatement") continue;
+        const returnArg = stmt.argument;
+        if (!returnArg) continue;
+        if (looksAsync(returnArg)) {
+          context.report({
+            message: "Async function returns a Promise without await.",
+            explanation: "This async function returns a likely-async call without awaiting it. While this compiles correctly, it loses error context and may cause confusing stack traces. In try/catch blocks, the catch will not trigger for the returned Promise.",
+            impact: "In a try/catch block, exceptions from the returned Promise will not be caught by the surrounding catch clause. This creates invisible error-handling gaps.",
+            location: getLocation(stmt, context.filePath),
+            fix: {
+              description: "Add await before the return value to ensure errors are caught properly.",
+              code: "return await someAsyncOperation();"
+            }
+          });
+        }
+      }
+    }
+  }
+};
+var missing_await_default = rule17;
+
+// src/rules/reliability/infinite-loop.ts
+function hasExitStatement(body) {
+  const exits = findAll(body, "BreakStatement");
+  if (exits.length > 0) return true;
+  const returns = findAll(body, "ReturnStatement");
+  if (returns.length > 0) return true;
+  const throws = findAll(body, "ThrowStatement");
+  if (throws.length > 0) return true;
+  return false;
+}
+function isLiteralTrue(node) {
+  if (!node) return false;
+  return node.type === "Literal" && node.value === true;
+}
+var rule18 = {
+  meta: {
+    id: "reliability/infinite-loop",
+    name: "Potential Infinite Loop",
+    category: "reliability",
+    severity: "high",
+    confidence: "medium",
+    description: "Detects while(true) and for(;;) loops without reachable exit conditions.",
+    rationale: "Infinite loops without an exit condition hang server processes, exhaust CPU, and cause denial of service. They are commonly introduced by AI-generated code that models polling or retry logic incorrectly.",
+    docsUrl: "https://clean-slop.dev/docs/rules/reliability/infinite-loop",
+    fixable: false
+  },
+  create(context) {
+    traverse(context.ast, {
+      WhileStatement(node) {
+        const test = node.test;
+        if (!isLiteralTrue(test)) return;
+        const body = node.body;
+        if (!body) return;
+        if (!hasExitStatement(body)) {
+          context.report({
+            message: "while(true) loop with no break, return, or throw detected.",
+            explanation: "This while(true) loop has no reachable exit statement (break, return, or throw). It will run indefinitely, blocking the event loop or hanging a thread.",
+            impact: "An infinite loop blocks the Node.js event loop, rendering the server completely unresponsive. This is an exploitable denial-of-service condition.",
+            location: getLocation(node, context.filePath),
+            fix: {
+              description: "Add an explicit exit condition or convert to a recursive function with a base case. For polling, use setInterval() instead of an infinite loop."
+            }
+          });
+        }
+      },
+      ForStatement(node) {
+        const test = node.test;
+        if (test !== null && test !== void 0) return;
+        const body = node.body;
+        if (!body) return;
+        if (!hasExitStatement(body)) {
+          context.report({
+            message: "for(;;) loop with no break, return, or throw detected.",
+            explanation: "This for(;;) loop has no termination condition and no exit statement. It will run indefinitely.",
+            impact: "Blocks the Node.js event loop and causes complete server unresponsiveness.",
+            location: getLocation(node, context.filePath),
+            fix: {
+              description: "Add a break condition or convert to a while loop with an explicit termination check."
+            }
+          });
+        }
+      }
+    });
+  }
+};
+var infinite_loop_default = rule18;
+
+// src/rules/maintainability/giant-file.ts
+var MAX_LINES2 = 400;
+var EXTREME_LINES = 1e3;
+var rule19 = {
+  meta: {
+    id: "maintainability/giant-file",
+    name: "Giant File",
+    category: "maintainability",
+    severity: "medium",
+    confidence: "certain",
+    description: `Detects source files exceeding ${MAX_LINES2} lines.`,
+    rationale: "Large files concentrate unrelated logic, creating merge conflicts, slow code review, and unclear ownership. They are a common artifact of AI code generation that did not decompose responsibilities into modules.",
+    docsUrl: "https://clean-slop.dev/docs/rules/maintainability/giant-file",
+    fixable: false
+  },
+  create(context) {
+    const lineCount = context.source.split("\n").length;
+    if (lineCount <= MAX_LINES2) return;
+    const isExtreme = lineCount > EXTREME_LINES;
+    context.report({
+      message: `File is ${lineCount} lines long (limit: ${MAX_LINES2}).`,
+      explanation: `This file contains ${lineCount} lines. Files this large violate the single-responsibility principle and make it difficult for contributors to understand the module boundaries.`,
+      impact: isExtreme ? "Extremely large files cause slow IDE performance, painful code reviews, and high cognitive load. They are effectively unmaintainable." : "Large files slow code review and increase the chance that related changes land in the wrong file, leading to tangled responsibility.",
+      location: {
+        file: context.filePath,
+        line: 1,
+        column: 0
+      },
+      fix: {
+        description: "Split the file into focused modules. Group related functions into a dedicated file. A file should do one thing and export a cohesive set of related functionality."
+      },
+      metadata: { lineCount }
+    });
+  }
+};
+var giant_file_default = rule19;
+var rule20 = {
+  meta: {
+    id: "maintainability/circular-imports",
+    name: "Potential Circular Import",
+    category: "maintainability",
+    severity: "medium",
+    confidence: "low",
+    description: "Identifies import patterns that commonly cause circular dependency cycles.",
+    rationale: "Circular imports cause initialization order issues, undefined module exports at runtime, and confusing bugs that differ between bundlers. They are a sign of poor module boundary design.",
+    docsUrl: "https://clean-slop.dev/docs/rules/maintainability/circular-imports",
+    fixable: false
+  },
+  create(context) {
+    const dir = path3.dirname(context.filePath);
+    const base = path3.basename(context.filePath, path3.extname(context.filePath));
+    const imports = findAll(context.ast, "ImportDeclaration");
+    for (const imp of imports) {
+      const src = imp.source;
+      if (!src || src.type !== "Literal") continue;
+      const importPath = String(src.value);
+      if (!importPath.startsWith(".")) continue;
+      const resolved = path3.resolve(dir, importPath);
+      const resolvedBase = path3.basename(resolved);
+      if (resolvedBase === "index" && path3.dirname(resolved) === dir && base !== "index") {
+        context.report({
+          message: `Import from "${importPath}" may create a circular dependency.`,
+          explanation: `This file imports from "${importPath}", which is the index barrel of the same directory. If the index file re-exports this module, a circular dependency exists.`,
+          impact: "Circular dependencies can cause modules to initialize with undefined exports, leading to hard-to-debug runtime errors that only appear in specific import orders.",
+          location: {
+            file: context.filePath,
+            line: imp.loc?.start.line ?? 1,
+            column: imp.loc?.start.column ?? 0
+          },
+          fix: {
+            description: "Import directly from the source module rather than through the barrel index. Instead of `import { foo } from './index'`, use `import { foo } from './foo'`."
+          }
+        });
+      }
+    }
+  }
+};
+var circular_imports_default = rule20;
+
+// src/rules/production-readiness/no-console-log.ts
+var DEBUG_METHODS = /* @__PURE__ */ new Set([
+  "console.log",
+  "console.debug",
+  "console.dir",
+  "console.trace",
+  "console.table"
+]);
+var ALLOWED_CONSOLE = /* @__PURE__ */ new Set([
+  "console.error",
+  "console.warn",
+  "console.info"
+]);
+var rule21 = {
+  meta: {
+    id: "production-readiness/no-console-log",
+    name: "Console Debug Statement",
+    category: "production-readiness",
+    severity: "low",
+    confidence: "certain",
+    description: "Detects console.log and other debug console methods left in production code.",
+    rationale: "Debug console statements leak internal application data, degrade performance, and indicate code that was not reviewed before shipping.",
+    docsUrl: "https://clean-slop.dev/docs/rules/production-readiness/no-console-log",
+    fixable: true
+  },
+  create(context) {
+    traverse(context.ast, {
+      CallExpression(node) {
+        const callee = node.callee;
+        if (!callee || callee.type !== "MemberExpression") return;
+        const obj = callee.object;
+        const prop = callee.property;
+        if (obj?.type !== "Identifier" || String(obj.name) !== "console" || prop?.type !== "Identifier") {
+          return;
+        }
+        const method = String(prop.name);
+        const fullName = `console.${method}`;
+        if (ALLOWED_CONSOLE.has(fullName)) return;
+        if (DEBUG_METHODS.has(fullName)) {
+          context.report({
+            message: `${fullName}() should not be present in production code.`,
+            explanation: `${fullName}() is a debug statement that was likely left over during development. Console output pollutes server logs, leaks internal state, and can expose sensitive data (tokens, user objects, query results) to log aggregation systems.`,
+            impact: "Debug logs appearing in production obscure real errors, violate data handling requirements, and may trigger compliance alerts for PII exposure.",
+            location: getLocation(node, context.filePath),
+            fix: {
+              description: "Remove the console statement. For intentional logging, use a structured logger (pino, winston, bunyan) that supports log levels and structured output.",
+              code: "import pino from 'pino';\n\nconst logger = pino();\nlogger.debug({ userId }, 'User lookup completed');"
+            }
+          });
+        }
+      }
+    });
+  }
+};
+var no_console_log_default = rule21;
+
+// src/rules/production-readiness/no-localhost-urls.ts
+var LOCALHOST_PATTERN = /https?:\/\/(?:localhost|127\.0\.0\.1|0\.0\.0\.0)(?::\d+)?/i;
+var DEBUG_FLAG_NAMES = /^(?:debug|DEBUG|isDebug|IS_DEBUG|debugMode|DEBUG_MODE|devMode|DEV_MODE|testMode|TEST_MODE)$/;
+var MOCK_FUNCTION_NAMES = /^(?:mock|fake|stub|dummy|placeholder)[\w_]*/i;
+var TEST_CREDENTIAL_PATTERNS = [
+  /test[_-]?(password|secret|token|key)/i,
+  /password\s*[:=]\s*['"](?:test|password|1234|admin|secret)['"]/i,
+  /secret\s*[:=]\s*['"](?:test|secret|dev|development)['"]/i
+];
+var rule22 = {
+  meta: {
+    id: "production-readiness/no-localhost-urls",
+    name: "Localhost URL / Debug Flag / Mock Implementation",
+    category: "production-readiness",
+    severity: "medium",
+    confidence: "high",
+    description: "Detects hardcoded localhost URLs, debug flags set to true, and mock/stub implementations.",
+    rationale: "Localhost URLs, active debug flags, and mock implementations in source code are telltale signs that development shortcuts were committed to production.",
+    docsUrl: "https://clean-slop.dev/docs/rules/production-readiness/no-localhost-urls",
+    fixable: false
+  },
+  create(context) {
+    const lines = context.source.split("\n");
+    lines.forEach((line, index) => {
+      if (LOCALHOST_PATTERN.test(line)) {
+        context.report({
+          message: "Hardcoded localhost URL detected.",
+          explanation: "This line contains a localhost URL. In production, this will fail to connect to the intended service because localhost resolves to the server itself.",
+          impact: "API calls to localhost in production silently fail or hit incorrect services, causing user-facing errors and data integrity issues.",
+          location: { file: context.filePath, line: index + 1, column: 0 },
+          fix: {
+            description: "Replace with an environment variable: process.env.API_BASE_URL or similar.",
+            code: "const apiUrl = process.env.API_BASE_URL ?? 'https://api.yourdomain.com';"
+          }
+        });
+      }
+      for (const pattern of TEST_CREDENTIAL_PATTERNS) {
+        if (pattern.test(line)) {
+          context.report({
+            message: "Test or placeholder credential detected.",
+            explanation: 'This line appears to contain a test credential with an obvious value (e.g., "password", "secret"). Test credentials committed to source indicate authentication logic that was never hardened.',
+            impact: 'Test credentials in production allow unauthorized access. Obvious values like "test" or "1234" are among the first tried in credential stuffing attacks.',
+            location: { file: context.filePath, line: index + 1, column: 0 },
+            fix: {
+              description: "Use environment variables for all credentials. Rotate any credential that has been committed."
+            }
+          });
+          break;
+        }
+      }
+    });
+    traverse2(context.ast, {
+      // debug = true or DEBUG_MODE = true
+      AssignmentExpression(node) {
+        const left = node.left;
+        const right = node.right;
+        if (left?.type !== "Identifier") return;
+        if (!DEBUG_FLAG_NAMES.test(String(left.name))) return;
+        if (right?.type !== "Literal" || right.value !== true) return;
+        context.report({
+          message: `Debug flag "${left.name}" is set to true.`,
+          explanation: `The variable "${left.name}" suggests a debug mode toggle that is hardcoded to true. Debug mode typically enables verbose logging, disables security checks, and activates development-only code paths.`,
+          impact: "Active debug flags in production expose internal state, disable security controls, and degrade performance through excessive logging.",
+          location: getLocation2(node, context.filePath),
+          fix: {
+            description: 'Drive debug mode from an environment variable: const debug = process.env.DEBUG === "true";'
+          }
+        });
+      },
+      // Variable initializer: const debug = true
+      VariableDeclarator(node) {
+        const id = node.id;
+        const init = node.init;
+        if (id?.type !== "Identifier") return;
+        if (!DEBUG_FLAG_NAMES.test(String(id.name))) return;
+        if (init?.type !== "Literal" || init.value !== true) return;
+        context.report({
+          message: `Debug flag "${id.name}" initialized to true.`,
+          explanation: `"${id.name}" is a debug flag initialized with true. This likely enables a development-only code path.`,
+          impact: "Debug mode active in production may disable security checks, expose stack traces to end users, or generate excessive log output.",
+          location: getLocation2(node, context.filePath),
+          fix: {
+            description: 'Use an environment variable: const debug = process.env.NODE_ENV !== "production";'
+          }
+        });
+      },
+      // Function named mockX, fakeX, stubX
+      FunctionDeclaration(node) {
+        const id = node.id;
+        if (!id || !MOCK_FUNCTION_NAMES.test(String(id.name))) return;
+        context.report({
+          message: `Function "${id.name}" appears to be a mock or stub implementation.`,
+          explanation: `The name "${id.name}" suggests this is a placeholder implementation that was never replaced with a real one.`,
+          impact: "Mock implementations in production return fabricated data, bypassing real logic and producing incorrect results for end users.",
+          location: getLocation2(node, context.filePath),
+          fix: {
+            description: "Implement the real function or remove it entirely. Mock functions belong in test files only."
+          }
+        });
+      }
+    });
+    function traverse2(ast, visitor) {
+      if (!ast || typeof ast !== "object") return;
+      const node = ast;
+      if (typeof node.type === "string") visitor[node.type]?.(node);
+      for (const key of Object.keys(node)) {
+        if (key === "parent") continue;
+        const child = node[key];
+        if (Array.isArray(child)) {
+          for (const item of child) traverse2(item, visitor);
+        } else if (child && typeof child === "object" && "type" in child) {
+          traverse2(child, visitor);
+        }
+      }
+    }
+    function getLocation2(node, filePath) {
+      return { file: filePath, line: node.loc?.start.line ?? 1, column: node.loc?.start.column ?? 0 };
+    }
+  }
+};
+var no_localhost_urls_default = rule22;
+
+// src/rules/index.ts
+var BUILT_IN_RULES = [
+  // AI Slop
+  empty_catch_default,
+  todo_implementation_default,
+  giant_function_default,
+  excessive_nesting_default,
+  fake_validation_default,
+  high_complexity_default,
+  dead_code_default,
+  // Security
+  unsafe_eval_default,
+  hardcoded_secrets_default,
+  sql_injection_default,
+  command_injection_default,
+  path_traversal_default,
+  prototype_pollution_default,
+  weak_crypto_default,
+  dangerous_cors_default,
+  // Reliability
+  unhandled_promise_default,
+  missing_await_default,
+  infinite_loop_default,
+  // Maintainability
+  giant_file_default,
+  circular_imports_default,
+  // Production Readiness
+  no_console_log_default,
+  no_localhost_urls_default
+];
+
+// src/scanners/scanner.ts
+async function loadGitignore(root) {
+  const ig = ignore();
+  const gitignorePath = path3.join(root, ".gitignore");
+  try {
+    const content = await fs4.readFile(gitignorePath, "utf-8");
+    ig.add(content);
+  } catch {
+  }
+  return ig;
+}
+async function discoverFiles(config) {
+  const files = await fg(config.include, {
+    cwd: config.root,
+    ignore: config.exclude,
+    absolute: true,
+    followSymbolicLinks: false,
+    onlyFiles: true
+  });
+  const ig = await loadGitignore(config.root);
+  if (config.ignorePatterns.length > 0) {
+    ig.add(config.ignorePatterns);
+  }
+  return files.filter((f) => {
+    if (isBinaryPath(f)) return false;
+    const relative = path3.relative(config.root, f);
+    try {
+      return !ig.ignores(relative);
+    } catch {
+      return true;
+    }
+  });
+}
+function buildEngine(_config) {
+  const engine = new RuleEngine();
+  engine.registerAll(BUILT_IN_RULES);
+  return engine;
+}
+function computeScore(issues, config) {
+  const categories = [
+    "ai-slop",
+    "security",
+    "reliability",
+    "maintainability",
+    "production-readiness"
+  ];
+  const categoryScores = categories.map((cat) => {
+    const catIssues = issues.filter((i) => i.category === cat);
+    const deductions = {
+      critical: 20,
+      high: 10,
+      medium: 4,
+      low: 1,
+      info: 0
+    };
+    const totalDeduction = catIssues.reduce(
+      (sum, i) => sum + (deductions[i.severity] ?? 0),
+      0
+    );
+    const raw = Math.max(0, 100 - totalDeduction);
+    return {
+      category: cat,
+      score: raw,
+      issueCount: catIssues.length,
+      criticalCount: catIssues.filter((i) => i.severity === "critical").length,
+      highCount: catIssues.filter((i) => i.severity === "high").length,
+      mediumCount: catIssues.filter((i) => i.severity === "medium").length,
+      lowCount: catIssues.filter((i) => i.severity === "low").length
+    };
+  });
+  const overall = categoryScores.reduce((sum, c) => sum + c.score, 0) / categoryScores.length;
+  const grade = computeGrade(overall);
+  return {
+    overall: Math.round(overall),
+    categories: categoryScores,
+    grade,
+    productionReady: overall >= config.failThreshold && issues.filter((i) => i.severity === "critical").length === 0
+  };
+}
+async function scan(options) {
+  const { config, onFile } = options;
+  const startTime = Date.now();
+  const engine = buildEngine();
+  const files = await discoverFiles(config);
+  const fileResults = [];
+  const allIssues = [];
+  for (let i = 0; i < files.length; i++) {
+    const filePath = files[i];
+    if (!filePath) continue;
+    onFile?.(filePath, i, files.length);
+    let parsed;
+    let source;
+    try {
+      source = await fs4.readFile(filePath, "utf-8");
+      if (!source.trim()) {
+        fileResults.push({ file: filePath, issues: [], skipped: true, skipReason: "empty file" });
+        continue;
+      }
+      if (source.length > 2e6) {
+        fileResults.push({ file: filePath, issues: [], skipped: true, skipReason: "file too large" });
+        continue;
+      }
+      parsed = parseSource(filePath, source);
+    } catch (err) {
+      const parseError = err instanceof ParseError ? err.message : String(err);
+      fileResults.push({ file: filePath, issues: [], parseError });
+      continue;
+    }
+    const issues = engine.runOnFile(parsed, config);
+    const sortedIssues = issues.sort((a, b) => {
+      return (SEVERITY_ORDER[b.severity] ?? 0) - (SEVERITY_ORDER[a.severity] ?? 0);
+    });
+    fileResults.push({ file: filePath, issues: sortedIssues });
+    allIssues.push(...sortedIssues);
+    options.onIssue && sortedIssues.forEach(options.onIssue);
+  }
+  const score = computeScore(allIssues, config);
+  return {
+    root: config.root,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    version: PACKAGE_VERSION,
+    files: fileResults,
+    issues: allIssues.sort(
+      (a, b) => (SEVERITY_ORDER[b.severity] ?? 0) - (SEVERITY_ORDER[a.severity] ?? 0)
+    ),
+    score,
+    durationMs: Date.now() - startTime,
+    config
+  };
+}
+function pad(str, width) {
+  return str.padEnd(width);
+}
+function formatSeverity(severity) {
+  const color = SEVERITY_COLORS[severity] ?? "";
+  const label = severity.toUpperCase().padEnd(8);
+  return `${color}${label}${RESET}`;
+}
+function formatScore(score) {
+  if (score >= 90) return `${GREEN}${score}${RESET}`;
+  if (score >= 70) return `${YELLOW}${score}${RESET}`;
+  return `${RED}${score}${RESET}`;
+}
+function formatGrade(grade) {
+  if (grade === "A") return `${GREEN}${grade}${RESET}`;
+  if (grade === "B") return `${GREEN}${grade}${RESET}`;
+  if (grade === "C") return `${YELLOW}${grade}${RESET}`;
+  if (grade === "D") return `${YELLOW}${grade}${RESET}`;
+  return `${RED}${grade}${RESET}`;
+}
+function formatDuration(ms) {
+  if (ms < 1e3) return `${ms}ms`;
+  return `${(ms / 1e3).toFixed(2)}s`;
+}
+function formatRelativePath(root, filePath) {
+  return path3.relative(root, filePath);
+}
+function renderSeparator(char = "-", width = 80) {
+  return GRAY + char.repeat(width) + RESET;
+}
+function renderIssue(issue, root, verbose) {
+  const lines = [];
+  const relPath2 = formatRelativePath(root, issue.location.file);
+  const loc = `${relPath2}:${issue.location.line}:${issue.location.column}`;
+  lines.push(
+    `  ${formatSeverity(issue.severity)} ${BOLD}${issue.message}${RESET}`
+  );
+  lines.push(`  ${DIM}${loc}${RESET}  ${GRAY}[${issue.ruleId}]${RESET}`);
+  if (verbose) {
+    lines.push("");
+    lines.push(`  ${DIM}${issue.explanation}${RESET}`);
+    if (issue.impact) {
+      lines.push("");
+      lines.push(`  ${YELLOW}Impact:${RESET} ${issue.impact}`);
+    }
+    if (issue.snippet) {
+      lines.push("");
+      lines.push(
+        issue.snippet.split("\n").map((l) => `  ${GRAY}${l}${RESET}`).join("\n")
+      );
+    }
+    if (issue.fix) {
+      lines.push("");
+      lines.push(`  ${CYAN}Fix:${RESET} ${issue.fix.description}`);
+      if (issue.fix.code) {
+        lines.push("");
+        lines.push(
+          issue.fix.code.split("\n").map((l) => `    ${DIM}${l}${RESET}`).join("\n")
+        );
+      }
+    }
+    if (issue.docsUrl) {
+      lines.push("");
+      lines.push(`  ${DIM}${issue.docsUrl}${RESET}`);
+    }
+  }
+  return lines.join("\n");
+}
+function generateTextReport(result) {
+  const { score, issues, files, durationMs, config, root, version } = result;
+  const verbose = config.verbose;
+  const lines = [];
+  lines.push("");
+  lines.push(`${BOLD}clean-slop v${version}${RESET}  ${DIM}Production Readiness Engine${RESET}`);
+  lines.push(renderSeparator("=", 80));
+  lines.push("");
+  const fileGroups = /* @__PURE__ */ new Map();
+  for (const issue of issues) {
+    const key = issue.location.file;
+    if (!fileGroups.has(key)) fileGroups.set(key, []);
+    fileGroups.get(key).push(issue);
+  }
+  if (issues.length === 0) {
+    lines.push(`${GREEN}No issues found.${RESET}`);
+  } else {
+    for (const [filePath, fileIssues] of fileGroups) {
+      const relPath2 = formatRelativePath(root, filePath);
+      lines.push(`${BOLD}${relPath2}${RESET}`);
+      lines.push(renderSeparator("-", 80));
+      for (const issue of fileIssues) {
+        lines.push(renderIssue(issue, root, verbose));
+        lines.push("");
+      }
+    }
+  }
+  lines.push(renderSeparator("=", 80));
+  lines.push(`${BOLD}Score Card${RESET}`);
+  lines.push(renderSeparator("-", 80));
+  for (const cat of score.categories) {
+    const label = pad(cat.category, 24);
+    const catScore = formatScore(cat.score);
+    const counts = DIM + (cat.criticalCount > 0 ? `  ${cat.criticalCount} critical` : "") + (cat.highCount > 0 ? `  ${cat.highCount} high` : "") + (cat.mediumCount > 0 ? `  ${cat.mediumCount} medium` : "") + (cat.lowCount > 0 ? `  ${cat.lowCount} low` : "") + RESET;
+    lines.push(`  ${label} ${catScore}/100${counts}`);
+  }
+  lines.push("");
+  lines.push(
+    `  ${pad("Overall Score", 24)} ${formatScore(score.overall)}/100   Grade: ${formatGrade(score.grade)}`
+  );
+  lines.push("");
+  const criticalCount = issues.filter((i) => i.severity === "critical").length;
+  const highCount = issues.filter((i) => i.severity === "high").length;
+  const mediumCount = issues.filter((i) => i.severity === "medium").length;
+  const lowCount = issues.filter((i) => i.severity === "low").length;
+  lines.push(renderSeparator("-", 80));
+  lines.push(
+    `  ${issues.length} issue${issues.length !== 1 ? "s" : ""} found across ${files.filter((f) => !f.skipped && !f.parseError).length} files  (${formatDuration(durationMs)})`
+  );
+  if (criticalCount > 0) lines.push(`  ${RED}${criticalCount} critical${RESET}`);
+  if (highCount > 0) lines.push(`  ${YELLOW}${highCount} high${RESET}`);
+  if (mediumCount > 0) lines.push(`  ${YELLOW}${mediumCount} medium${RESET}`);
+  if (lowCount > 0) lines.push(`  ${DIM}${lowCount} low${RESET}`);
+  lines.push("");
+  if (score.productionReady) {
+    lines.push(`  ${GREEN}PRODUCTION READY${RESET}  Score above threshold (${config.failThreshold})`);
+  } else {
+    lines.push(
+      `  ${RED}NOT PRODUCTION READY${RESET}  Score ${score.overall} below threshold (${config.failThreshold})`
+    );
+  }
+  lines.push("");
+  const parseErrors = files.filter((f) => f.parseError);
+  if (parseErrors.length > 0) {
+    lines.push(`${YELLOW}Parse errors in ${parseErrors.length} file(s):${RESET}`);
+    for (const f of parseErrors) {
+      lines.push(`  ${DIM}${f.file}: ${f.parseError}${RESET}`);
+    }
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+
+// src/reporters/json-reporter.ts
+function generateJsonReport(result) {
+  return JSON.stringify(result, null, 2);
+}
+var SEVERITY_EMOJI = {
+  critical: "CRITICAL",
+  high: "HIGH",
+  medium: "MEDIUM",
+  low: "LOW",
+  info: "INFO"
+};
+function scoreBadge(score) {
+  const color = score >= 90 ? "brightgreen" : score >= 70 ? "yellow" : "red";
+  return `![score](https://img.shields.io/badge/score-${score}%2F100-${color})`;
+}
+function gradeBadge(grade) {
+  const color = grade === "A" || grade === "B" ? "brightgreen" : grade === "C" ? "yellow" : "red";
+  return `![grade](https://img.shields.io/badge/grade-${grade}-${color})`;
+}
+function formatDuration2(ms) {
+  if (ms < 1e3) return `${ms}ms`;
+  return `${(ms / 1e3).toFixed(2)}s`;
+}
+function relPath(root, filePath) {
+  return path3.relative(root, filePath);
+}
+function renderIssueMd(issue, root) {
+  const lines = [];
+  const loc = `${relPath(root, issue.location.file)}:${issue.location.line}`;
+  lines.push(`#### ${SEVERITY_EMOJI[issue.severity]}: ${issue.message}`);
+  lines.push("");
+  lines.push(`- **Rule:** \`${issue.ruleId}\``);
+  lines.push(`- **Location:** \`${loc}\``);
+  lines.push(`- **Confidence:** ${issue.confidence}`);
+  lines.push("");
+  lines.push(issue.explanation);
+  if (issue.impact) {
+    lines.push("");
+    lines.push(`**Impact:** ${issue.impact}`);
+  }
+  if (issue.snippet) {
+    lines.push("");
+    lines.push("```");
+    lines.push(issue.snippet);
+    lines.push("```");
+  }
+  if (issue.fix) {
+    lines.push("");
+    lines.push(`**Fix:** ${issue.fix.description}`);
+    if (issue.fix.code) {
+      lines.push("");
+      lines.push("```javascript");
+      lines.push(issue.fix.code);
+      lines.push("```");
+    }
+  }
+  if (issue.docsUrl) {
+    lines.push("");
+    lines.push(`[Documentation](${issue.docsUrl})`);
+  }
+  lines.push("");
+  lines.push("---");
+  return lines.join("\n");
+}
+function generateMarkdownReport(result) {
+  const { score, issues, files, durationMs, config, root, version, timestamp } = result;
+  const lines = [];
+  lines.push("# clean-slop Report");
+  lines.push("");
+  lines.push(`> Generated by clean-slop v${version} on ${new Date(timestamp).toUTCString()}`);
+  lines.push("");
+  lines.push("## Score Summary");
+  lines.push("");
+  lines.push(`${scoreBadge(score.overall)} ${gradeBadge(score.grade)}`);
+  lines.push("");
+  lines.push("| Category | Score | Issues |");
+  lines.push("|----------|-------|--------|");
+  for (const cat of score.categories) {
+    const emoji = cat.score >= 90 ? "\u2705" : cat.score >= 70 ? "\u26A0\uFE0F" : "\u274C";
+    lines.push(
+      `| ${cat.category} | ${emoji} ${cat.score}/100 | ${cat.issueCount} |`
+    );
+  }
+  lines.push("");
+  lines.push(`**Overall Score:** ${score.overall}/100 &nbsp; **Grade:** ${score.grade}`);
+  lines.push("");
+  const productionStatus = score.productionReady ? "\u2705 **PRODUCTION READY**" : "\u274C **NOT PRODUCTION READY**";
+  lines.push(productionStatus);
+  lines.push("");
+  const criticalIssues = issues.filter((i) => i.severity === "critical");
+  const highIssues = issues.filter((i) => i.severity === "high");
+  const mediumIssues = issues.filter((i) => i.severity === "medium");
+  const lowIssues = issues.filter((i) => i.severity === "low");
+  lines.push("## Issue Breakdown");
+  lines.push("");
+  lines.push(`| Severity | Count |`);
+  lines.push(`|----------|-------|`);
+  lines.push(`| Critical | ${criticalIssues.length} |`);
+  lines.push(`| High | ${highIssues.length} |`);
+  lines.push(`| Medium | ${mediumIssues.length} |`);
+  lines.push(`| Low | ${lowIssues.length} |`);
+  lines.push(`| **Total** | **${issues.length}** |`);
+  lines.push("");
+  if (criticalIssues.length > 0) {
+    lines.push("## Critical Issues");
+    lines.push("");
+    for (const issue of criticalIssues) {
+      lines.push(renderIssueMd(issue, root));
+    }
+  }
+  if (highIssues.length > 0) {
+    lines.push("## High Severity Issues");
+    lines.push("");
+    for (const issue of highIssues) {
+      lines.push(renderIssueMd(issue, root));
+    }
+  }
+  if (mediumIssues.length > 0) {
+    lines.push("<details>");
+    lines.push("<summary>Medium Severity Issues</summary>");
+    lines.push("");
+    for (const issue of mediumIssues) {
+      lines.push(renderIssueMd(issue, root));
+    }
+    lines.push("</details>");
+    lines.push("");
+  }
+  if (lowIssues.length > 0) {
+    lines.push("<details>");
+    lines.push("<summary>Low Severity Issues</summary>");
+    lines.push("");
+    for (const issue of lowIssues) {
+      lines.push(renderIssueMd(issue, root));
+    }
+    lines.push("</details>");
+    lines.push("");
+  }
+  lines.push("## Scan Statistics");
+  lines.push("");
+  lines.push(`- **Files scanned:** ${files.filter((f) => !f.skipped && !f.parseError).length}`);
+  lines.push(`- **Files skipped:** ${files.filter((f) => f.skipped).length}`);
+  lines.push(`- **Parse errors:** ${files.filter((f) => f.parseError).length}`);
+  lines.push(`- **Duration:** ${formatDuration2(durationMs)}`);
+  lines.push(`- **Fail threshold:** ${config.failThreshold}/100`);
+  lines.push("");
+  const parseErrors = files.filter((f) => f.parseError);
+  if (parseErrors.length > 0) {
+    lines.push("### Parse Errors");
+    lines.push("");
+    for (const f of parseErrors) {
+      lines.push(`- \`${relPath(root, f.file)}\`: ${f.parseError}`);
+    }
+    lines.push("");
+  }
+  lines.push("---");
+  lines.push("");
+  lines.push("*Generated by [clean-slop](https://github.com/clean-slop/clean-slop)*");
+  return lines.join("\n");
+}
+function severityToSarifLevel(severity) {
+  switch (severity) {
+    case "critical":
+    case "high":
+      return "error";
+    case "medium":
+      return "warning";
+    case "low":
+      return "note";
+    case "info":
+      return "none";
+  }
+}
+function toSarifSecuritySeverity(severity) {
+  switch (severity) {
+    case "critical":
+      return "9.5";
+    case "high":
+      return "7.5";
+    case "medium":
+      return "5.0";
+    case "low":
+      return "2.5";
+    case "info":
+      return "0.0";
+  }
+}
+function fileUri(filePath) {
+  const normalized = filePath.replace(/\\/g, "/");
+  return normalized.startsWith("/") ? `file://${normalized}` : `file:///${normalized}`;
+}
+function generateSarifReport(result) {
+  const { issues, root } = result;
+  const ruleMap = /* @__PURE__ */ new Map();
+  for (const issue of issues) {
+    if (!ruleMap.has(issue.ruleId)) {
+      ruleMap.set(issue.ruleId, issue);
+    }
+  }
+  const sarifRules = Array.from(ruleMap.values()).map((issue) => ({
+    id: issue.ruleId,
+    name: issue.ruleName.replace(/\s+/g, ""),
+    shortDescription: {
+      text: issue.message
+    },
+    fullDescription: {
+      text: issue.explanation
+    },
+    help: {
+      text: issue.fix?.description ?? "See documentation for details.",
+      markdown: issue.fix?.code ? `${issue.fix.description}
+
+\`\`\`javascript
+${issue.fix.code}
+\`\`\`` : issue.fix?.description ?? "See documentation for details."
+    },
+    helpUri: issue.docsUrl ?? `https://clean-slop.dev/docs/rules/${issue.ruleId}`,
+    properties: {
+      tags: [issue.category],
+      "security-severity": toSarifSecuritySeverity(issue.severity),
+      precision: issue.confidence === "certain" ? "very-high" : issue.confidence,
+      "problem.severity": issue.severity
+    }
+  }));
+  const sarifResults = issues.map((issue) => ({
+    ruleId: issue.ruleId,
+    level: severityToSarifLevel(issue.severity),
+    message: {
+      text: `${issue.message}
+
+${issue.explanation}${issue.impact ? `
+
+Impact: ${issue.impact}` : ""}`
+    },
+    locations: [
+      {
+        physicalLocation: {
+          artifactLocation: {
+            uri: path3.relative(root, issue.location.file).replace(/\\/g, "/"),
+            uriBaseId: "%SRCROOT%"
+          },
+          region: {
+            startLine: issue.location.line,
+            startColumn: issue.location.column + 1,
+            endLine: issue.location.endLine ?? issue.location.line,
+            endColumn: (issue.location.endColumn ?? issue.location.column) + 1
+          }
+        }
+      }
+    ],
+    partialFingerprints: {
+      primaryLocationLineHash: Buffer.from(
+        `${issue.ruleId}:${issue.location.file}:${issue.location.line}`
+      ).toString("base64")
+    },
+    properties: {
+      confidence: issue.confidence,
+      category: issue.category
+    }
+  }));
+  const sarif = {
+    $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "clean-slop",
+            version: PACKAGE_VERSION,
+            informationUri: "https://github.com/clean-slop/clean-slop",
+            semanticVersion: PACKAGE_VERSION,
+            rules: sarifRules
+          }
+        },
+        originalUriBaseIds: {
+          "%SRCROOT%": {
+            uri: fileUri(root) + "/"
+          }
+        },
+        results: sarifResults,
+        columnKind: "utf16CodeUnits"
+      }
+    ]
+  };
+  return JSON.stringify(sarif, null, 2);
+}
+function escapeHtml(str) {
+  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#039;");
+}
+function severityColor(severity) {
+  switch (severity) {
+    case "critical":
+      return "#dc2626";
+    case "high":
+      return "#ea580c";
+    case "medium":
+      return "#d97706";
+    case "low":
+      return "#2563eb";
+    case "info":
+      return "#6b7280";
+  }
+}
+function scoreColor(score) {
+  if (score >= 90) return "#16a34a";
+  if (score >= 70) return "#d97706";
+  return "#dc2626";
+}
+function renderIssueCard(issue, root) {
+  const relPath2 = path3.relative(root, issue.location.file).replace(/\\/g, "/");
+  const color = severityColor(issue.severity);
+  return `
+    <div class="issue-card" data-severity="${issue.severity}" data-category="${issue.category}">
+      <div class="issue-header">
+        <span class="severity-badge" style="background:${color}">${issue.severity.toUpperCase()}</span>
+        <span class="issue-rule">${escapeHtml(issue.ruleId)}</span>
+        <span class="issue-confidence">${escapeHtml(issue.confidence)} confidence</span>
+      </div>
+      <div class="issue-message">${escapeHtml(issue.message)}</div>
+      <div class="issue-location">${escapeHtml(relPath2)}:${issue.location.line}</div>
+      <div class="issue-explanation">${escapeHtml(issue.explanation)}</div>
+      ${issue.impact ? `<div class="issue-impact"><strong>Impact:</strong> ${escapeHtml(issue.impact)}</div>` : ""}
+      ${issue.snippet ? `<pre class="issue-snippet"><code>${escapeHtml(issue.snippet)}</code></pre>` : ""}
+      ${issue.fix ? `
+        <div class="issue-fix">
+          <strong>Fix:</strong> ${escapeHtml(issue.fix.description)}
+          ${issue.fix.code ? `<pre class="fix-code"><code>${escapeHtml(issue.fix.code)}</code></pre>` : ""}
+        </div>
+      ` : ""}
+      ${issue.docsUrl ? `<a class="docs-link" href="${escapeHtml(issue.docsUrl)}" target="_blank" rel="noopener">Documentation</a>` : ""}
+    </div>`;
+}
+function generateHtmlReport(result) {
+  const { score, issues, files, durationMs, root, version, timestamp } = result;
+  const criticalCount = issues.filter((i) => i.severity === "critical").length;
+  const highCount = issues.filter((i) => i.severity === "high").length;
+  const mediumCount = issues.filter((i) => i.severity === "medium").length;
+  const lowCount = issues.filter((i) => i.severity === "low").length;
+  const scannedCount = files.filter((f) => !f.skipped && !f.parseError).length;
+  const issueCards = issues.map((i) => renderIssueCard(i, root)).join("\n");
+  const categoryRows = score.categories.map((cat) => {
+    const color = scoreColor(cat.score);
+    return `
+      <tr>
+        <td>${escapeHtml(cat.category)}</td>
+        <td><span style="color:${color};font-weight:600">${cat.score}/100</span></td>
+        <td>${cat.issueCount}</td>
+        <td>${cat.criticalCount}</td>
+        <td>${cat.highCount}</td>
+        <td>${cat.mediumCount}</td>
+        <td>${cat.lowCount}</td>
+      </tr>`;
+  }).join("\n");
+  const durationStr = durationMs < 1e3 ? `${durationMs}ms` : `${(durationMs / 1e3).toFixed(2)}s`;
+  const overallColor = scoreColor(score.overall);
+  const readyBg = score.productionReady ? "#16a34a" : "#dc2626";
+  const readyText = score.productionReady ? "PRODUCTION READY" : "NOT PRODUCTION READY";
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>clean-slop Report</title>
+  <style>
+    *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+    body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; background: #0f172a; color: #e2e8f0; line-height: 1.6; }
+    .container { max-width: 1200px; margin: 0 auto; padding: 2rem; }
+    header { border-bottom: 1px solid #1e293b; padding-bottom: 2rem; margin-bottom: 2rem; }
+    header h1 { font-size: 1.75rem; font-weight: 700; color: #f8fafc; letter-spacing: -0.025em; }
+    header p { color: #64748b; margin-top: 0.25rem; font-size: 0.875rem; }
+    .score-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(180px, 1fr)); gap: 1rem; margin-bottom: 2rem; }
+    .score-card { background: #1e293b; border: 1px solid #334155; border-radius: 8px; padding: 1.25rem; }
+    .score-card .label { font-size: 0.75rem; color: #94a3b8; text-transform: uppercase; letter-spacing: 0.05em; }
+    .score-card .value { font-size: 2rem; font-weight: 700; margin-top: 0.25rem; }
+    .ready-badge { display: inline-block; background: ${readyBg}; color: #fff; font-size: 0.8rem; font-weight: 600; padding: 0.35rem 0.9rem; border-radius: 9999px; margin-bottom: 2rem; letter-spacing: 0.05em; }
+    table { width: 100%; border-collapse: collapse; background: #1e293b; border-radius: 8px; overflow: hidden; margin-bottom: 2rem; font-size: 0.875rem; }
+    th { background: #0f172a; text-align: left; padding: 0.75rem 1rem; color: #94a3b8; font-weight: 500; font-size: 0.75rem; text-transform: uppercase; letter-spacing: 0.05em; }
+    td { padding: 0.75rem 1rem; border-top: 1px solid #334155; }
+    .filters { display: flex; gap: 0.5rem; flex-wrap: wrap; margin-bottom: 1.5rem; }
+    .filter-btn { background: #1e293b; border: 1px solid #334155; color: #94a3b8; padding: 0.35rem 0.9rem; border-radius: 6px; cursor: pointer; font-size: 0.8rem; transition: all 0.15s; }
+    .filter-btn:hover, .filter-btn.active { background: #334155; color: #f1f5f9; border-color: #475569; }
+    .issue-card { background: #1e293b; border: 1px solid #334155; border-radius: 8px; padding: 1.25rem; margin-bottom: 1rem; }
+    .issue-header { display: flex; align-items: center; gap: 0.75rem; margin-bottom: 0.75rem; flex-wrap: wrap; }
+    .severity-badge { font-size: 0.7rem; font-weight: 700; color: #fff; padding: 0.2rem 0.6rem; border-radius: 4px; letter-spacing: 0.05em; }
+    .issue-rule { font-family: monospace; font-size: 0.8rem; color: #64748b; }
+    .issue-confidence { font-size: 0.75rem; color: #475569; margin-left: auto; }
+    .issue-message { font-weight: 600; color: #f1f5f9; margin-bottom: 0.5rem; }
+    .issue-location { font-family: monospace; font-size: 0.8rem; color: #64748b; margin-bottom: 0.75rem; }
+    .issue-explanation { font-size: 0.875rem; color: #94a3b8; margin-bottom: 0.75rem; }
+    .issue-impact { font-size: 0.875rem; color: #fbbf24; margin-bottom: 0.75rem; }
+    .issue-snippet { background: #0f172a; border: 1px solid #334155; border-radius: 6px; padding: 1rem; margin-bottom: 0.75rem; overflow-x: auto; }
+    .issue-snippet code, .fix-code code { font-family: 'SF Mono', 'Fira Code', monospace; font-size: 0.8rem; color: #94a3b8; white-space: pre; }
+    .issue-fix { font-size: 0.875rem; color: #86efac; margin-bottom: 0.75rem; }
+    .fix-code { background: #0f172a; border: 1px solid #334155; border-radius: 6px; padding: 1rem; margin-top: 0.5rem; overflow-x: auto; }
+    .docs-link { font-size: 0.8rem; color: #60a5fa; text-decoration: none; }
+    .docs-link:hover { text-decoration: underline; }
+    .section-title { font-size: 1.1rem; font-weight: 600; color: #f8fafc; margin-bottom: 1rem; border-bottom: 1px solid #1e293b; padding-bottom: 0.5rem; }
+    .empty-state { text-align: center; padding: 3rem; color: #64748b; }
+    .stat-row { display: flex; gap: 2rem; flex-wrap: wrap; color: #64748b; font-size: 0.875rem; margin-bottom: 2rem; }
+    .hidden { display: none; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <header>
+      <h1>clean-slop Report</h1>
+      <p>v${escapeHtml(version)} &nbsp;\xB7&nbsp; ${escapeHtml(new Date(timestamp).toUTCString())} &nbsp;\xB7&nbsp; ${escapeHtml(root)}</p>
+    </header>
+
+    <div class="score-grid">
+      <div class="score-card">
+        <div class="label">Overall Score</div>
+        <div class="value" style="color:${overallColor}">${score.overall}<span style="font-size:1rem;color:#64748b">/100</span></div>
+      </div>
+      <div class="score-card">
+        <div class="label">Grade</div>
+        <div class="value" style="color:${overallColor}">${escapeHtml(score.grade)}</div>
+      </div>
+      <div class="score-card">
+        <div class="label">Total Issues</div>
+        <div class="value" style="color:#f1f5f9">${issues.length}</div>
+      </div>
+      <div class="score-card">
+        <div class="label">Critical</div>
+        <div class="value" style="color:#dc2626">${criticalCount}</div>
+      </div>
+      <div class="score-card">
+        <div class="label">High</div>
+        <div class="value" style="color:#ea580c">${highCount}</div>
+      </div>
+      <div class="score-card">
+        <div class="label">Files Scanned</div>
+        <div class="value" style="color:#f1f5f9">${scannedCount}</div>
+      </div>
+    </div>
+
+    <div class="ready-badge">${readyText}</div>
+
+    <div class="section-title">Category Scores</div>
+    <table>
+      <thead>
+        <tr>
+          <th>Category</th><th>Score</th><th>Total</th><th>Critical</th><th>High</th><th>Medium</th><th>Low</th>
+        </tr>
+      </thead>
+      <tbody>${categoryRows}</tbody>
+    </table>
+
+    <div class="section-title">Issues</div>
+    <div class="stat-row">
+      <span>${issues.length} issue${issues.length !== 1 ? "s" : ""} &nbsp;\xB7&nbsp; ${scannedCount} files &nbsp;\xB7&nbsp; ${durationStr}</span>
+    </div>
+
+    <div class="filters">
+      <button class="filter-btn active" onclick="filterIssues('all')">All (${issues.length})</button>
+      <button class="filter-btn" onclick="filterIssues('critical')">Critical (${criticalCount})</button>
+      <button class="filter-btn" onclick="filterIssues('high')">High (${highCount})</button>
+      <button class="filter-btn" onclick="filterIssues('medium')">Medium (${mediumCount})</button>
+      <button class="filter-btn" onclick="filterIssues('low')">Low (${lowCount})</button>
+    </div>
+
+    <div id="issues-container">
+      ${issues.length === 0 ? '<div class="empty-state">No issues found.</div>' : issueCards}
+    </div>
+  </div>
+
+  <script>
+    function filterIssues(severity) {
+      document.querySelectorAll('.filter-btn').forEach(b => b.classList.remove('active'));
+      event.target.classList.add('active');
+      document.querySelectorAll('.issue-card').forEach(card => {
+        if (severity === 'all' || card.dataset.severity === severity) {
+          card.classList.remove('hidden');
+        } else {
+          card.classList.add('hidden');
+        }
+      });
+    }
+  </script>
+</body>
+</html>`;
+}
+
+// src/reporters/index.ts
+function generate(result, reporter = "text") {
+  switch (reporter) {
+    case "json":
+      return generateJsonReport(result);
+    case "html":
+      return generateHtmlReport(result);
+    case "markdown":
+      return generateMarkdownReport(result);
+    case "sarif":
+      return generateSarifReport(result);
+    case "text":
+    default:
+      return generateTextReport(result);
+  }
+}
+async function writeReport(content, outputPath) {
+  const dir = path3.dirname(outputPath);
+  await fs4.mkdir(dir, { recursive: true });
+  await fs4.writeFile(outputPath, content, "utf-8");
+}
+
+// src/cli/commands/scan.ts
+function clearLine() {
+  if (process.stdout.isTTY) {
+    process.stdout.write("\r\x1B[K");
+  }
+}
+function printProgress(filePath, index, total) {
+  if (!process.stdout.isTTY) return;
+  const pct = Math.round((index + 1) / total * 100);
+  const short = filePath.length > 60 ? "..." + filePath.slice(-57) : filePath;
+  process.stdout.write(`\r${DIM}Scanning [${pct}%] ${short}${RESET}`);
+}
+async function runScan(directory, options) {
+  const ci = options.ci ?? !process.stdout.isTTY;
+  const cwd = directory ? path3.resolve(directory) : process.cwd();
+  const baseConfig = await loadConfig(cwd, options.config);
+  const config = {
+    ...baseConfig,
+    verbose: options.verbose ?? baseConfig.verbose,
+    reporter: options.reporter ?? baseConfig.reporter,
+    output: options.output ?? baseConfig.output,
+    failThreshold: options.failThreshold ? parseInt(options.failThreshold, 10) : baseConfig.failThreshold,
+    categories: {
+      "ai-slop": options.aiSlop === false ? false : baseConfig.categories["ai-slop"] ?? true,
+      "security": options.security === false ? false : baseConfig.categories["security"] ?? true,
+      "reliability": options.reliability === false ? false : baseConfig.categories["reliability"] ?? true,
+      "maintainability": options.maintainability === false ? false : baseConfig.categories["maintainability"] ?? true,
+      "production-readiness": options.productionReadiness === false ? false : baseConfig.categories["production-readiness"] ?? true
+    }
+  };
+  if (options.maxCritical !== void 0) {
+    config.maxIssues = { ...config.maxIssues, critical: parseInt(options.maxCritical, 10) };
+  }
+  if (options.maxHigh !== void 0) {
+    config.maxIssues = { ...config.maxIssues, high: parseInt(options.maxHigh, 10) };
+  }
+  if (!ci && !options.quiet) {
+    console.log(`
+${BOLD}clean-slop${RESET}  ${DIM}Production Readiness Engine${RESET}`);
+    console.log(`${DIM}Scanning ${cwd}${RESET}
+`);
+  }
+  const scanOptions = { config };
+  if (!options.quiet && !ci) scanOptions.onFile = printProgress;
+  const result = await scan(scanOptions);
+  if (!ci && !options.quiet && process.stdout.isTTY) {
+    clearLine();
+  }
+  const reporterName = config.reporter;
+  const reportContent = generate(result, reporterName);
+  if (config.output) {
+    await writeReport(reportContent, config.output);
+    if (!options.quiet) {
+      console.log(`${GREEN}Report written to ${config.output}${RESET}`);
+    }
+  } else {
+    process.stdout.write(reportContent);
+  }
+  let shouldFail = false;
+  if (result.score.overall < config.failThreshold) {
+    shouldFail = true;
+  }
+  for (const [sev, max] of Object.entries(config.maxIssues)) {
+    if (max === void 0) continue;
+    const count = result.issues.filter((i) => i.severity === sev).length;
+    if (count > max) {
+      shouldFail = true;
+      if (!options.quiet && !ci) {
+        console.error(
+          `${RED}${count} ${sev} issue${count !== 1 ? "s" : ""} found (max allowed: ${max})${RESET}`
+        );
+      }
+    }
+  }
+  if (shouldFail) {
+    process.exit(1);
+  }
+}
+async function runCheck(directory, options) {
+  const cwd = directory ? path3.resolve(directory) : process.cwd();
+  const baseConfig = await loadConfig(cwd, options.config);
+  const config = {
+    ...baseConfig,
+    failThreshold: options.failThreshold ? parseInt(options.failThreshold, 10) : baseConfig.failThreshold,
+    verbose: false
+  };
+  if (options.maxCritical !== void 0) {
+    config.maxIssues = {
+      ...config.maxIssues,
+      critical: parseInt(options.maxCritical, 10)
+    };
+  }
+  const result = await scan({ config });
+  const criticalCount = result.issues.filter((i) => i.severity === "critical").length;
+  const maxCritical = config.maxIssues.critical ?? 0;
+  const criticalExceeded = criticalCount > maxCritical;
+  const scorePassed = result.score.overall >= config.failThreshold;
+  const passed = scorePassed && !criticalExceeded;
+  if (passed) {
+    console.log(
+      `${GREEN}${BOLD}PASS${RESET}  Score: ${result.score.overall}/100  Grade: ${result.score.grade}  ${DIM}(threshold: ${config.failThreshold})${RESET}`
+    );
+    process.exit(0);
+  } else {
+    const reasons = [];
+    if (!scorePassed) {
+      reasons.push(
+        `score ${result.score.overall} below threshold ${config.failThreshold}`
+      );
+    }
+    if (criticalExceeded) {
+      reasons.push(
+        `${criticalCount} critical issue${criticalCount !== 1 ? "s" : ""} (max: ${maxCritical})`
+      );
+    }
+    console.error(
+      `${RED}${BOLD}FAIL${RESET}  Score: ${result.score.overall}/100  Grade: ${result.score.grade}`
+    );
+    for (const reason of reasons) {
+      console.error(`  ${RED}${reason}${RESET}`);
+    }
+    process.exit(1);
+  }
+}
+var DEBOUNCE_MS = 500;
+async function runWatch(directory, options) {
+  const cwd = directory ? path3.resolve(directory) : process.cwd();
+  const config = await loadConfig(cwd, options.config);
+  if (options.verbose) config.verbose = true;
+  console.log(
+    `
+${BOLD}clean-slop watch${RESET}  ${DIM}Watching ${cwd}${RESET}`
+  );
+  console.log(`${DIM}Press Ctrl+C to stop.${RESET}
+`);
+  let debounceTimer = null;
+  let running = false;
+  async function runScanCycle(changedFile) {
+    if (running) return;
+    running = true;
+    if (changedFile) {
+      const rel = path3.relative(cwd, changedFile);
+      console.log(`${CYAN}Changed:${RESET} ${rel}`);
+    }
+    const startMsg = `${DIM}Scanning...${RESET}`;
+    process.stdout.write(startMsg);
+    try {
+      const result = await scan({ config });
+      process.stdout.write("\r\x1B[K");
+      const report = generateTextReport(result);
+      console.log(report);
+      if (result.score.productionReady) {
+        console.log(`${GREEN}Score: ${result.score.overall}/100${RESET}
+`);
+      } else {
+        console.log(`${RED}Score: ${result.score.overall}/100${RESET}
+`);
+      }
+    } catch (err) {
+      process.stdout.write("\r\x1B[K");
+      console.error(
+        `${RED}Scan error:${RESET} ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    running = false;
+  }
+  await runScanCycle();
+  const watcher = fs3.watch(
+    cwd,
+    { recursive: true },
+    (event, filename) => {
+      if (!filename) return;
+      if (!/\.(js|jsx|ts|tsx|mjs|cjs)$/.test(filename)) return;
+      if (filename.includes("node_modules") || filename.includes("dist") || filename.includes(".next")) return;
+      if (debounceTimer) clearTimeout(debounceTimer);
+      debounceTimer = setTimeout(() => {
+        void runScanCycle(path3.join(cwd, filename));
+      }, DEBOUNCE_MS);
+    }
+  );
+  process.on("SIGINT", () => {
+    watcher.close();
+    console.log(`
+${DIM}Watch stopped.${RESET}
+`);
+    process.exit(0);
+  });
+  await new Promise(() => {
+  });
+}
+function check(label, ok, detail) {
+  const icon = ok ? `${GREEN}\u2713${RESET}` : `${RED}\u2717${RESET}`;
+  const msg = detail ? `  ${icon}  ${label}  ${DIM}${detail}${RESET}` : `  ${icon}  ${label}`;
+  console.log(msg);
+}
+function warn(label, detail) {
+  const msg = detail ? `  ${YELLOW}!${RESET}  ${label}  ${DIM}${detail}${RESET}` : `  ${YELLOW}!${RESET}  ${label}`;
+  console.log(msg);
+}
+function info(label, detail) {
+  const msg = detail ? `  ${CYAN}i${RESET}  ${label}  ${DIM}${detail}${RESET}` : `  ${CYAN}i${RESET}  ${label}`;
+  console.log(msg);
+}
+function getNodeVersion() {
+  return process.version;
+}
+function meetsNodeMinimum() {
+  const [major] = process.version.replace("v", "").split(".").map(Number);
+  return (major ?? 0) >= 18;
+}
+function getNpmVersion() {
+  try {
+    return execSync("npm --version", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+  } catch {
+    return null;
+  }
+}
+async function runDoctor() {
+  const cwd = process.cwd();
+  console.log(`
+${BOLD}clean-slop doctor${RESET}
+`);
+  console.log(`${DIM}Diagnosing environment and configuration...${RESET}
+`);
+  console.log(`${BOLD}Environment${RESET}`);
+  const nodeVersion = getNodeVersion();
+  const nodeOk = meetsNodeMinimum();
+  check("Node.js version", nodeOk, `${nodeVersion} (requires >= 18)`);
+  const npmVersion = getNpmVersion();
+  check("npm available", npmVersion !== null, npmVersion ?? "not found");
+  info("Platform", process.platform);
+  info("Architecture", process.arch);
+  info("clean-slop version", PACKAGE_VERSION);
+  console.log();
+  console.log(`${BOLD}Configuration${RESET}`);
+  let config;
+  try {
+    config = await loadConfig(cwd);
+    check("Configuration loaded", true, `root: ${config.root}`);
+    info("Fail threshold", `${config.failThreshold}/100`);
+    info("Reporter", config.reporter);
+    info("Output", config.output ?? "stdout");
+    const enabledCategories = Object.entries(config.categories).filter(([, v]) => v).map(([k]) => k);
+    info("Enabled categories", enabledCategories.join(", "));
+    const ruleOverrides = Object.keys(config.rules).length;
+    info("Rule overrides", `${ruleOverrides}`);
+  } catch (err) {
+    check("Configuration loaded", false, err instanceof Error ? err.message : String(err));
+  }
+  console.log();
+  console.log(`${BOLD}Project${RESET}`);
+  const pkgPath = path3.join(cwd, "package.json");
+  try {
+    const raw = await fs4.readFile(pkgPath, "utf-8");
+    const pkg = JSON.parse(raw);
+    check("package.json found", true, String(pkg.name ?? "(no name)"));
+    const allDeps = {
+      ...pkg.dependencies,
+      ...pkg.devDependencies
+    };
+    const hasTs = "typescript" in allDeps;
+    info("TypeScript project", String(hasTs));
+  } catch {
+    check("package.json found", false, "Could not read package.json");
+  }
+  const tsconfigPath = path3.join(cwd, "tsconfig.json");
+  try {
+    await fs4.access(tsconfigPath);
+    check("tsconfig.json found", true);
+  } catch {
+    warn("tsconfig.json not found", "TypeScript projects should include tsconfig.json");
+  }
+  const gitPath = path3.join(cwd, ".git");
+  try {
+    await fs4.access(gitPath);
+    check("Git repository", true);
+  } catch {
+    warn("Not a git repository", "clean-slop works best in a git repository");
+  }
+  const gitignorePath = path3.join(cwd, ".gitignore");
+  try {
+    await fs4.access(gitignorePath);
+    check(".gitignore found", true);
+  } catch {
+    warn(".gitignore not found", "Add a .gitignore to exclude build artifacts");
+  }
+  console.log();
+  console.log(`${BOLD}Rules${RESET}`);
+  info("Built-in rules loaded", `${BUILT_IN_RULES.length}`);
+  const byCategory = /* @__PURE__ */ new Map();
+  for (const rule23 of BUILT_IN_RULES) {
+    byCategory.set(rule23.meta.category, (byCategory.get(rule23.meta.category) ?? 0) + 1);
+  }
+  for (const [cat, count] of byCategory) {
+    info(`  ${cat}`, `${count} rules`);
+  }
+  console.log();
+  if (!meetsNodeMinimum()) {
+    console.log(
+      `${RED}Node.js >= 18 is required. Please upgrade your Node.js installation.${RESET}
+`
+    );
+    process.exit(1);
+  }
+  console.log(`${GREEN}Environment looks good.${RESET}
+`);
+}
+async function runInit(options) {
+  const cwd = process.cwd();
+  const configPath = path3.join(cwd, "clean-slop.config.js");
+  try {
+    await fs4.access(configPath);
+    if (!options.force) {
+      console.log(
+        `${YELLOW}clean-slop.config.js already exists.${RESET} Use ${BOLD}--force${RESET} to overwrite it.`
+      );
+      process.exit(1);
+    }
+  } catch {
+  }
+  const content = generateDefaultConfig();
+  try {
+    await fs4.writeFile(configPath, content, "utf-8");
+    console.log(`${GREEN}Created clean-slop.config.js${RESET}`);
+    console.log(`${RESET}Edit it to customize rules, categories, and thresholds.
+`);
+  } catch (err) {
+    console.error(
+      `${RED}Failed to write config file: ${err instanceof Error ? err.message : String(err)}${RESET}`
+    );
+    process.exit(1);
+  }
+}
+async function runReport(directory, options) {
+  const cwd = directory ? path3.resolve(directory) : process.cwd();
+  const baseConfig = await loadConfig(cwd, options.config);
+  const reporterName = options.reporter ?? baseConfig.reporter;
+  const outputPath = options.output ?? baseConfig.output;
+  if (!outputPath && reporterName === "html") {
+    const defaultOut = path3.join(cwd, "clean-slop-report.html");
+    baseConfig.output = defaultOut;
+  } else if (outputPath) {
+    baseConfig.output = outputPath;
+  }
+  const config = { ...baseConfig, reporter: reporterName };
+  console.log(`Scanning ${cwd}...`);
+  const result = await scan({ config });
+  const content = generate(result, reporterName);
+  if (config.output) {
+    await writeReport(content, config.output);
+    console.log(`${GREEN}Report written to ${config.output}${RESET}`);
+  } else {
+    process.stdout.write(content);
+  }
+}
+
+// src/cli/index.ts
+function createCLI() {
+  const program = new Command();
+  program.name("clean-slop").description(
+    "Production Readiness Engine for JavaScript and TypeScript projects.\nPrevents low-quality, insecure, and AI-generated code from reaching production."
+  ).version(PACKAGE_VERSION, "-v, --version", "Print the current version").helpOption("-h, --help", "Display help information");
+  program.command("scan [directory]", { isDefault: true }).description("Scan a directory for issues (default command)").option("-c, --config <path>", "Path to configuration file").option("--reporter <name>", "Reporter to use: text, json, html, markdown, sarif", "text").option("-o, --output <file>", "Write report to a file instead of stdout").option("--fail-threshold <score>", "Minimum score before exiting with code 1", "70").option("--max-critical <n>", "Maximum allowed critical issues (0 = none)", "0").option("--max-high <n>", "Maximum allowed high issues").option("--no-ai-slop", "Disable AI slop rules").option("--no-security", "Disable security rules").option("--no-reliability", "Disable reliability rules").option("--no-maintainability", "Disable maintainability rules").option("--no-production-readiness", "Disable production readiness rules").option("--verbose", "Print full issue details including snippets and fixes").option("--quiet", "Only print the score summary, suppress issue list").option("--ci", "CI mode: machine-readable exit codes, no color").action(runScan);
+  program.command("check [directory]").description("Quick check: exit 0 if production ready, 1 if not").option("-c, --config <path>", "Path to configuration file").option("--fail-threshold <score>", "Minimum passing score", "70").option("--max-critical <n>", "Maximum critical issues allowed", "0").action(runCheck);
+  program.command("watch [directory]").description("Watch for file changes and re-scan automatically").option("-c, --config <path>", "Path to configuration file").option("--verbose", "Print full issue details").action(runWatch);
+  program.command("report [directory]").description("Generate a report from the last scan or run a fresh scan").option("-c, --config <path>", "Path to configuration file").option("--reporter <name>", "Reporter: text, json, html, markdown, sarif", "html").option("-o, --output <file>", "Output file path").action(runReport);
+  program.command("doctor").description("Diagnose the current environment, config, and installation").action(runDoctor);
+  program.command("init").description("Create a clean-slop.config.js in the current directory").option("--force", "Overwrite existing config file").action(runInit);
+  return program;
+}
+
+export { createCLI };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map