codebase-onboarder 0.6.0 → 0.7.0

package/shared/analyzer/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../src/shared/analyzer/scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACnH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,sEAAsE;AACtE,yEAAyE;AACzE,EAAE;AACF,qDAAqD;AACrD,sDAAsD;AACtD,yBAAyB;AACzB,yDAAyD;AAEzD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO;IACtE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;IAClE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM;IACjE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK;CAC/C,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,mBAAmB,EAAE,WAAW,EAAE,gBAAgB,EAAE,eAAe;IACnE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW;CACzD,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACjE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACpE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;IACtE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS;CACjE,CAAC,CAAC;AAGH,SAAS,cAAc,CAAC,IAAI;IAC1B,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,6EAA6E;IAC7E,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAkB,EAAE,OAAO,GAAgB,EAAE;IAC1E,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,KAAgB,EAAE,EAAE,GAAE,CAAC,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IAEnE,yEAAyE;IACzE,uEAAuE;IACvE,2EAA2E;IAC3E,4CAA4C;IAC5C,MAAM,KAAK,GAAG;QACZ,OAAO,EAAE,CAAC,EAAE,4BAA4B;QACxC,SAAS,EAAE,CAAC,EAAE,0CAA0C;QACxD,SAAS,EAAE,CAAC,EAAE,sCAAsC;QACpD,UAAU,EAAE,CAAC,EAAE,+BAA+B;QAC9C,OAAO,EAAE,CAAC,EAAE,sDAAsD;QAClE,UAAU,EAAE,CAAC,EAAE,0BAA0B;QACzC,QAAQ,EAAE,CAAC,EAAE,mBAAmB;QAChC,aAAa,EAAE,CAAC,EAAE,8BAA8B;KACjD,CAAC;IAEF,2EAA2E;IAC3E,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;IACnB,IAAI,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;QAC1B,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,cAAc,CAAC,MAAM,CAAC,CAAC;YACvB,KAAK,CAAC,UAAU,EAAE,CAAC;YACnB,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACvC,sEAAsE;gBACtE,sEAAsE;gBACtE,uDAAuD;gBACvD,SAAS,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;gBACnE,MAAM,IAAI,CAAC;YACb,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,KAAK,CAAC,OAAO,EAAE,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBACzB,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC5D,KAAK,CAAC,SAAS,EAAE,CAAC;oBAClB,SAAS;gBACX,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/B,KAAK,CAAC,SAAS,EAAE,CAAC;oBAClB,SAAS;gBACX,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,UAAU,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,QAAQ,CAAC,IAAI,EAAE,CAAC;IAEhB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACjB,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,MAAM;YACzB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACd,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAEnD,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,kEAAkE;IAClE,EAAE;IACF,4DAA4D;IAC5D,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;YACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEtF,MAAM,OAAO,GAAG;QACd,MAAM;QACN,iBAAiB;QACjB,UAAU;QACV,UAAU,EAAE,MAAM,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAC3D,OAAO,EAAE,MAAM,SAAS,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC5D,CAAC;IAEF,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E,+EAA+E;IAC/E,kEAAkE;IAClE,EAAE;IACF,0EAA0E;IAC1E,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,EAAE;IACF,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IACnD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,KAAK,CAAC,OAAO,EAAE,CAAC;YAChB,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAED,IAAI,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE,CAAC;QACxG,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,IAAI,MAAM,EAAE,CAAC;YACX,KAAK,CAAC,UAAU,EAAE,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,IAAI,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;YAC9B,KAAK,CAAC,QAAQ,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,aAAa,EAAE,CAAC;YACtB,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxG,KAAK,CAAC,IAAI,CAAC;YACT,IAAI;YACJ,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC;YAChB,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;YACpB,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC;YAChB,IAAI,EAAE,IAAI,CAAC,EAAE;YACb,IAAI;YACJ,GAAG,EAAE,EAAE,CAAC,IAAI;YACZ,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,QAAQ;YACR,UAAU,EAAE,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACvC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAChD,GAAG,QAAQ;SACZ,CAAC,CAAC;QACH,MAAM,EAAE,CAAC;QACT,IAAI,MAAM,GAAG,EAAE,KAAK,CAAC;YAAE,UAAU,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,UAAU,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,8EAA8E;IAC9E,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,cAAc;IAC1C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,+BAA+B;IAE5D,2EAA2E;IAC3E,sEAAsE;IACtE,6DAA6D;IAC7D,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IACpE,MAAM,eAAe,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,0BAA0B;IAE7D,+EAA+E;IAC/E,4EAA4E;IAC5E,uEAAuE;IACvE,4EAA4E;IAC5E,4EAA4E;IAC5E,EAAE;IACF,+EAA+E;IAC/E,+EAA+E;IAC/E,oCAAoC;IACpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;;YAC3B,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,IAAI,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC;YAAE,UAAU,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACjG,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YACvE,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBACb,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACjB,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YACxE,CAAC;iBAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;gBAC1B,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACjB,yEAAyE;gBACzE,sEAAsE;gBACtE,wCAAwC;gBACxC,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC1D,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC;iBAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACxB,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACjB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;gBACzE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7C,CAAC;iBAAM,CAAC;gBACN,sEAAsE;gBACtE,qEAAqE;gBACrE,qEAAqE;gBACrE,KAAK,CAAC,UAAU,EAAE,CAAC;gBACnB,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,CAAC;gBACxC,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACvC,IAAI,IAAI;oBAAE,IAAI,CAAC,KAAK,EAAE,CAAC;;oBAClB,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,iEAAiE;IACjE,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK;QAC5B,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;QACrE,CAAC,CAAC,GAAG,CAAC;IACR,MAAM,eAAe,GAAG,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC;SAClD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACjE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEhB,MAAM,YAAY,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;SAC1C,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;SACrE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAErF,4DAA4D;IAC5D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE;YACnB,IAAI;YACJ,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;YACpB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM;YAC7B,SAAS,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YACrC,GAAG,EAAE,CAAC;YACN,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,CAAC;YACR,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,KAAK;gBAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QACpC,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACxB,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;YAChC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;YAC5B,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YAC1B,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;SACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,GAAG,CAAC;QACJ,QAAQ,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;KAC1F,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAErE,MAAM,KAAK,GAAG;QACZ,UAAU,EAAE,QAAQ,CAAC,MAAM;QAC3B,WAAW,EAAE,MAAM;QACnB,OAAO,EAAE,YAAY;QACrB,KAAK;QACL,SAAS;QACT,SAAS,EAAE,KAAK,CAAC,MAAM;QACvB,OAAO,EAAE;YACP,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,UAAU;YACV,KAAK,EAAE,eAAe;SACvB;QACD,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QAC9B,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACxC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAyB,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;YAC3D,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YAChD,OAAO,GAAG,CAAC;QACb,CAAC,EAAE,EAAE,CAAC;KACP,CAAC;IAEF,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC;QAC7D,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACxC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;KAC/F,CAAC,EAAE,MAAM,CAAC,CAAC;IACZ,cAAc,CAAC,MAAM,CAAC,CAAC;IACvB,UAAU,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAEtE,MAAM,MAAM,GAAG;QACb,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,WAAW;QAChC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,MAAM;QAC1D,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK;QACL,QAAQ;QACR,KAAK;QACL,KAAK;QACL,SAAS,EAAE,YAAY;QACvB,OAAO;QACP,SAAS,EAAE,SAAS,IAAI,EAAE;QAC1B,IAAI,EAAE,aAAa,EAAE,IAAI,IAAI,EAAE;QAC/B,OAAO,EAAE,aAAa,EAAE,cAAc,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;QAC5E,aAAa,EAAE,aAAa,IAAI,SAAS;KAC1C,CAAC;IACF,OAAO,MAA8D,CAAC;AACxE,CAAC;AAED,SAAS,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,GAAG,EAAE;IAC5D,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO;IACxB,MAAM,GAAG,GAAG,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAC9B,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACzE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,4EAA4E;AAC5E,+EAA+E;AAC/E,6EAA6E;AAC7E,2EAA2E;AAC3E,MAAM,UAAU,GAAG,CAAC,CAAC;AAErB,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,yBAAyB;AACzB,KAAK,SAAS,CAAC,CAAC,SAAS,CAAC,MAAkB,EAAE,KAAe,EAAE,KAAK,GAAG,UAAU,EAAE,MAA8B;IAC/G,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CACpB,OAAO,CAAC,OAAO,EAAE;SACd,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;SACjE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAE/F,MAAM,QAAQ,GAAoE,EAAE,CAAC;IACrF,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,KAAK;QAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAE1F,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvB,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1D,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,IAAI,IAAI,GAAG,KAAK,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,OAAO,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAI,KAAU,EAAE,EAAuB;IACrD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,MAAM;IAClC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACzC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,yBAAyB;AACzB,KAAK,UAAU,kBAAkB,CAAC,MAAM;IACtC,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,CAAC;IACjB,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,EAAE,GAAG,IAAI,MAAM,CACnB,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YACxB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACtC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC/D,CAAC,IAAI,CAAC,EAAE,CAAC;YACV,OAAO,CACV,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,QAAQ,CAAC,CAAC;IACjB,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,MAAM;IACrC,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAoH,CAAC;YACtJ,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChH,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACrF,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACxG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,OAAO,IAAI,UAAU,EAAE,CAAC;gBACvD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;YACpD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { parseJsonConfig } from './jsonConfig.js';\nimport type { FileSource, ScanOptions, ImportEdge, ScannedFile, ScannedFolder, LanguageAnalyzer } from '../contracts.js';\nimport { DEFAULT_LIMITS, normalizeScanOptions, throwIfAborted, abortable, utf8ByteLength } from './scanControl.js';\nexport { DEFAULT_LIMITS } from './scanControl.js';\n// The scanner: walks a FileSource, dispatches per-language analyzers,\n// resolves imports into edges, and hands back one big plain-data result.\n//\n// FileSource interface (both adapters implement it):\n//   list(dir) -> [{ name, path, type: 'file'|'dir' }]\n//   read(path) -> string\n// Paths are repo-relative, POSIX style ('' is the root).\n\nimport { languageFor } from './languages/index.js';\nimport { dirOf, baseName, extOf } from './pathUtil.js';\nimport { codeStats, complexityOf } from './metrics.js';\nimport { analyzeSecurityFile } from './security.js';\nimport { analyzeLicenses } from './licenses.js';\nimport { analyzeWorkflows } from './workflows.js';\nimport { detectManifest } from './services.js';\n\nconst SKIP_DIRS = new Set([\n  'node_modules', '.git', '.hg', '.svn', 'dist', 'build', 'out', '.next',\n  '.nuxt', 'target', 'vendor', '__pycache__', '.venv', 'venv', 'env',\n  '.idea', '.vscode', 'coverage', '.cache', '.turbo', 'tmp', 'temp',\n  'DerivedData', 'Pods', '.gradle', 'bin', 'obj',\n]);\n\nconst SKIP_FILES = new Set([\n  'package-lock.json', 'yarn.lock', 'pnpm-lock.yaml', 'composer.lock',\n  'Gemfile.lock', 'Cargo.lock', 'poetry.lock', '.DS_Store',\n]);\n\nconst SKIP_EXTS = new Set([\n  '.png', '.jpg', '.jpeg', '.gif', '.webp', '.ico', '.icns', '.svg',\n  '.woff', '.woff2', '.ttf', '.otf', '.eot', '.mp4', '.mov', '.mp3',\n  '.wav', '.zip', '.gz', '.tar', '.rar', '.7z', '.pdf', '.jar', '.war',\n  '.class', '.o', '.a', '.so', '.dylib', '.dll', '.exe', '.pyc', '.wasm',\n  '.min.js', '.min.css', '.map', '.lock', '.bin', '.db', '.sqlite',\n]);\n\n\nfunction shouldSkipFile(name) {\n  if (SKIP_FILES.has(name)) return true;\n  if (SKIP_EXTS.has(extOf(name))) return true;\n  // extOf() only sees the final suffix, so name the common bundle shapes here.\n  return /\\.min\\.(js|css)$/i.test(name);\n}\n\nexport async function scanRepo(source: FileSource, options: ScanOptions = {}) {\n  const limits = normalizeScanOptions(options);\n  const signal = options.signal;\n  throwIfAborted(signal);\n  const onProgress = options.onProgress || ((..._args: unknown[]) => {});\n  const startedAt = Date.now();\n\n  const ignore = await abortable(buildIgnoreMatcher(source), signal);\n\n  // Every way a file or directory can drop out of the scan, counted apart.\n  // One integer for all of them hid the difference between \"we ignored a\n  // lockfile\" and \"we could not read your source\" — and only one of those is\n  // something the reader needs to know about.\n  const skips = {\n    ignored: 0, // matched a .gitignore rule\n    vendorDir: 0, // node_modules, dist, .git, any dotfolder\n    notSource: 0, // images, lockfiles, minified bundles\n    listFailed: 0, // the directory would not list\n    notCode: 0, // no analyzer for this extension (README.md, .yml, …)\n    readFailed: 0, // the file would not read\n    tooLarge: 0, // over maxFileSize\n    analyzeFailed: 0, // the language analyzer threw\n  };\n\n  // ---- Walk --------------------------------------------------------------\n  const allFiles: string[] = [];\n  let truncated = null;\n  const queue = [''];\n  walk: while (queue.length) {\n    throwIfAborted(signal);\n    const dir = queue.shift();\n    let entries;\n    try {\n      entries = await abortable(source.list(dir), signal);\n    } catch {\n      throwIfAborted(signal);\n      skips.listFailed++;\n      continue;\n    }\n    for (const entry of entries) {\n      if (allFiles.length >= limits.maxFiles) {\n        // Stop the entire walk, not just this directory. A plain `break` here\n        // left every already-queued directory to be listed anyway, so the cap\n        // was both slower and less predictable than it looked.\n        truncated = { atFiles: allFiles.length, dirsQueued: queue.length };\n        break walk;\n      }\n      if (ignore(entry.path)) {\n        skips.ignored++;\n        continue;\n      }\n      if (entry.type === 'dir') {\n        if (SKIP_DIRS.has(entry.name) || entry.name.startsWith('.')) {\n          skips.vendorDir++;\n          continue;\n        }\n        queue.push(entry.path);\n      } else {\n        if (shouldSkipFile(entry.name)) {\n          skips.notSource++;\n          continue;\n        }\n        allFiles.push(entry.path);\n      }\n    }\n    onProgress({ phase: 'walk', found: allFiles.length });\n  }\n  allFiles.sort();\n\n  const fileSet = new Set(allFiles);\n  const dirSet = new Set(['']);\n  for (const p of allFiles) {\n    let d = dirOf(p);\n    while (true) {\n      if (dirSet.has(d)) break;\n      dirSet.add(d);\n      d = dirOf(d);\n    }\n  }\n  const has = (p) => fileSet.has(p);\n  const hasDir = (d) => dirSet.has(d);\n  const nameIndex = new Map();\n  for (const p of allFiles) {\n    const n = baseName(p);\n    if (!nameIndex.has(n)) nameIndex.set(n, p);\n  }\n  const findByName = (n) => nameIndex.get(n) || null;\n\n  // Find a directory whose path *ends with* a run of segments. This is what C#\n  // needs and Java does not: a C# file's folder mirrors the namespace, but the\n  // root namespace (the company or project name) is normally not a directory,\n  // so `namespace Acme.Services` lives in `src/Services/`. Matching on a path\n  // suffix is the only thing that finds it — stripping the whole namespace, the\n  // Java approach, matches nothing and silently drops every import.\n  //\n  // Keyed by the last three segments, which is enough to tell\n  // `Acme/Models/Entities` apart from a bare `Entities` elsewhere while staying\n  // O(1) per lookup. A collision at the shortest key keeps the first match, and\n  // callers query longest-first, so the most specific answer is tried first.\n  const dirByTail = new Map();\n  for (const d of dirSet) {\n    if (!d) continue;\n    const segments = d.split('/');\n    for (let take = 1; take <= 3 && take <= segments.length; take += 1) {\n      const key = segments.slice(segments.length - take).join('/');\n      if (!dirByTail.has(key)) dirByTail.set(key, d);\n    }\n  }\n  const findDirEndingWith = (suffix) => (suffix ? dirByTail.get(suffix) || null : null);\n\n  const context = {\n    hasDir,\n    findDirEndingWith,\n    findByName,\n    modulePath: await abortable(readModulePath(source), signal),\n    tsPaths: await abortable(readTsConfigPaths(source), signal),\n  };\n\n  // ---- Parse ---------------------------------------------------------------\n  // Reads run a window ahead of the analysis; the analysis stays strictly in\n  // path order. Waiting for one `read` to land before starting the next was the\n  // largest wall-clock cost of a scan and the one with the least to show for\n  // it — every adapter behind `FileSource` is I/O, and neither `node:fs` nor the\n  // File System Access API cares how many requests are outstanding.\n  //\n  // Order matters more than it looks: `files`, `edges` and every skip count\n  // have to come out identical no matter how the reads interleave, or two scans\n  // of one repo would disagree. So the window only prefetches — the loop below\n  // consumes it one file at a time, in the order `allFiles` was sorted into.\n  //\n  // The language is resolved here and kept. The resolve phase needs the same\n  // answer per file and used to ask `languageFor` for it a second time.\n  const files: ScannedFile[] = [];\n  const langOf = new Map<string, LanguageAnalyzer>();\n  let parsed = 0;\n  const codeFiles = [];\n  for (const path of allFiles) {\n    const lang = languageFor(path);\n    if (!lang) {\n      skips.notCode++;\n      continue;\n    }\n    langOf.set(path, lang);\n    codeFiles.push(path);\n  }\n\n  for await (const { path, text, failed } of readAhead(source, codeFiles, limits.readConcurrency, signal)) {\n    throwIfAborted(signal);\n    if (failed) {\n      skips.readFailed++;\n      continue;\n    }\n    const size = utf8ByteLength(text);\n    if (size > limits.maxFileSize) {\n      skips.tooLarge++;\n      continue;\n    }\n    const lang = langOf.get(path);\n    let analysis;\n    try {\n      analysis = lang.analyze(text, path);\n    } catch {\n      skips.analyzeFailed++;\n      continue;\n    }\n    const cs = codeStats(text, lang.id);\n    const findings = analyzeSecurityFile(text, lang.id);\n    const docRatio = cs.code + cs.comment > 0 ? Math.round((cs.comment / (cs.code + cs.comment)) * 100) : 0;\n    files.push({\n      path,\n      dir: dirOf(path),\n      name: baseName(path),\n      ext: extOf(path),\n      lang: lang.id,\n      size,\n      loc: cs.code,\n      comment: cs.comment,\n      blank: cs.blank,\n      lines: cs.lines,\n      docRatio,\n      complexity: complexityOf(text, lang.id),\n      findings: findings.length ? findings : undefined,\n      ...analysis,\n    });\n    parsed++;\n    if (parsed % 25 === 0) onProgress({ phase: 'parse', done: parsed, total: codeFiles.length });\n  }\n  onProgress({ phase: 'parse', done: parsed, total: codeFiles.length });\n  // ---- Resolve imports into edges -------------------------------------------\n  const edges: ImportEdge[] = [];\n  const edgeKeys = new Map(); // key -> edge\n  const externals = new Map(); // package name -> Set of files\n\n  // What share of the imports we found did we manage to place? A regex-based\n  // analyzer owes its reader this number more than any other: it is the\n  // engine's own estimate of how much of the graph is missing.\n  const tally = { total: 0, internal: 0, external: 0, unresolved: 0 };\n  const unresolvedSpecs = new Map(); // spec -> { count, from }\n\n  // A resolver may answer with a *directory* instead of a file: Go's import is a\n  // package, and a C# `using Acme.Models;` names a namespace whose classes we\n  // cannot know from the import alone. Every file in that directory is a\n  // target. Indexed once here rather than scanned per import — a Go repo with\n  // 1,000 files and 8,000 imports was doing eight million comparisons for it.\n  //\n  // Language-neutral on purpose: this used to be `goFilesByDir`, built only from\n  // Go files, which meant no other language could use the mechanism that already\n  // existed for exactly this problem.\n  const filesByDir = new Map();\n  for (const f of files) {\n    const bucket = filesByDir.get(f.dir);\n    if (bucket) bucket.push(f.path);\n    else filesByDir.set(f.dir, [f.path]);\n  }\n\n  let resolved = 0;\n  for (const file of files) {\n    throwIfAborted(signal);\n    if (resolved++ % 25 === 0) onProgress({ phase: 'resolve', done: resolved, total: files.length });\n    const lang = langOf.get(file.path);\n    for (const imp of file.imports) {\n      tally.total++;\n      const res = lang.resolveImport(imp.spec, file.path, has, context, imp);\n      if (res.path) {\n        tally.internal++;\n        addEdge(edges, edgeKeys, file.path, res.path, 'imports', imp.symbols);\n      } else if (res.packageDir) {\n        tally.internal++;\n        // A directory import means \"everything in there\". addEdge de-duplicates,\n        // so a package with fifty files yields fifty honest edges rather than\n        // one edge standing in for all of them.\n        for (const target of filesByDir.get(res.packageDir) || []) {\n          addEdge(edges, edgeKeys, file.path, target, 'imports', imp.symbols);\n        }\n      } else if (res.external) {\n        tally.external++;\n        if (!externals.has(res.external)) externals.set(res.external, new Set());\n        externals.get(res.external).add(file.path);\n      } else {\n        // Every resolver ends with `return { unresolved: spec }`. This branch\n        // is where that used to disappear for want of an `else` — the import\n        // was counted nowhere and the graph simply came up short in silence.\n        tally.unresolved++;\n        const spec = res.unresolved || imp.spec;\n        const seen = unresolvedSpecs.get(spec);\n        if (seen) seen.count++;\n        else unresolvedSpecs.set(spec, { spec, count: 1, from: file.path });\n      }\n    }\n  }\n\n  // Resolved-or-correctly-external over everything we saw. An external package\n  // counts as a success: the resolver knew what it was looking at.\n  const confidence = tally.total\n    ? Math.round(((tally.internal + tally.external) / tally.total) * 100)\n    : 100;\n  const worstUnresolved = [...unresolvedSpecs.values()]\n    .sort((a, b) => b.count - a.count || a.spec.localeCompare(b.spec))\n    .slice(0, 12);\n\n  const externalList = [...externals.entries()]\n    .map(([name, usedBySet]) => ({ name, usedBy: [...usedBySet].sort() }))\n    .sort((a, b) => b.usedBy.length - a.usedBy.length || a.name.localeCompare(b.name));\n\n  // Folder rollups with full size/LOC/documentation breakdown\n  const filesPerDir = new Map();\n  const folderData = new Map<string, ScannedFolder>();\n  for (const p of allFiles) {\n    const d = dirOf(p);\n    filesPerDir.set(d, (filesPerDir.get(d) || 0) + 1);\n  }\n  for (const path of dirSet) {\n    if (!path) continue;\n    folderData.set(path, {\n      path,\n      name: baseName(path),\n      depth: path.split('/').length,\n      fileCount: filesPerDir.get(path) || 0,\n      loc: 0,\n      comment: 0,\n      blank: 0,\n      size: 0,\n      langs: {},\n      hasReadme: false,\n    });\n  }\n  for (const p of allFiles) {\n    const d = dirOf(p);\n    const bn = baseName(p).toLowerCase();\n    if (bn.startsWith('readme.') || bn === 'readme') {\n      const entry = folderData.get(d);\n      if (entry) entry.hasReadme = true;\n    }\n  }\n  for (const f of files) {\n    const entry = folderData.get(f.dir);\n    if (entry) {\n      entry.loc += f.loc || 0;\n      entry.comment += f.comment || 0;\n      entry.blank += f.blank || 0;\n      entry.size += f.size || 0;\n      entry.langs[f.lang] = (entry.langs[f.lang] || 0) + (f.loc || 0);\n    }\n  }\n  const folders = [...folderData.values()]\n    .map((f) => ({\n      ...f,\n      docRatio: f.loc + f.comment > 0 ? Math.round((f.comment / (f.loc + f.comment)) * 100) : 0,\n    }))\n    .sort((a, b) => a.path.localeCompare(b.path));\n\n  const skippedTotal = Object.values(skips).reduce((a, b) => a + b, 0);\n\n  const stats = {\n    filesTotal: allFiles.length,\n    filesParsed: parsed,\n    skipped: skippedTotal,\n    skips,\n    truncated,\n    edgeCount: edges.length,\n    imports: {\n      total: tally.total,\n      internal: tally.internal,\n      external: tally.external,\n      unresolved: tally.unresolved,\n      confidence,\n      worst: worstUnresolved,\n    },\n    tookMs: Date.now() - startedAt,\n    languages: countBy(files, (f) => f.lang),\n    languageLoc: files.reduce<Record<string, number>>((acc, f) => {\n      acc[f.lang] = (acc[f.lang] || 0) + (f.loc || 0);\n      return acc;\n    }, {}),\n  };\n\n  const [workflows, licenseReport] = await abortable(Promise.all([\n    analyzeWorkflows(source).catch(() => []),\n    detectManifest(source).then((manifest) => analyzeLicenses(source, manifest)).catch(() => null),\n  ]), signal);\n  throwIfAborted(signal);\n  onProgress({ phase: 'complete', files: parsed, edges: edges.length });\n\n  const result = {\n    root: source.root || '(unknown)',\n    name: source.name || baseName(source.root || '') || 'repo',\n    scannedAt: new Date().toISOString(),\n    stats,\n    allFiles,\n    files,\n    edges,\n    externals: externalList,\n    folders,\n    workflows: workflows || [],\n    sbom: licenseReport?.sbom || [],\n    license: licenseReport?.projectLicense || { id: 'UNKNOWN', name: 'Unknown' },\n    licenseReport: licenseReport || undefined,\n  };\n  return result as typeof result & { tempId?: string; gitUrl?: string };\n}\n\nfunction addEdge(edges, edgeKeys, from, to, kind, symbols = []) {\n  if (from === to) return;\n  const key = from + '->' + to;\n  const existing = edgeKeys.get(key);\n  if (existing) {\n    if (symbols && symbols.length) {\n      existing.symbols = Array.from(new Set([...(existing.symbols || []), ...symbols]));\n    }\n    return;\n  }\n  const edge = { from, to, kind, symbols: symbols ? symbols.slice() : [] };\n  edgeKeys.set(key, edge);\n  edges.push(edge);\n}\n\n// How many reads may be in flight at once. Small on purpose: a file is read\n// whole before its size can be checked (a `FileSource` has no `stat`), so this\n// is also a multiplier on peak memory. Eight is enough to keep a disk or the\n// browser's file layer busy without holding a heap of large files at once.\nconst READ_AHEAD = 8;\n\n// Yields `{ path, text, failed }` for each path, in the order given, while\n// keeping up to READ_AHEAD reads in flight. Failures are yielded rather than\n// thrown so the caller can count them and keep going — one unreadable file\n// should not end a scan.\nasync function* readAhead(source: FileSource, paths: string[], width = READ_AHEAD, signal?: ScanOptions['signal']) {\n  const read = (path) =>\n    Promise.resolve()\n      .then(() => { throwIfAborted(signal); return source.read(path); })\n      .then((text) => ({ path, text, failed: false }), () => ({ path, text: '', failed: true }));\n\n  const inFlight: Array<Promise<{ path: string; text: string; failed: boolean }>> = [];\n  let next = 0;\n  while (next < paths.length && inFlight.length < width) inFlight.push(read(paths[next++]));\n\n  while (inFlight.length) {\n    throwIfAborted(signal);\n    // Refill only after this read settles: refilling before awaiting it made\n    // the configured window run one extra read. The next read still starts\n    // before this file is analyzed, while the total stays within the limit.\n    const settled = await abortable(inFlight.shift(), signal);\n    throwIfAborted(signal);\n    if (next < paths.length) inFlight.push(read(paths[next++]));\n    yield settled;\n  }\n}\n\nfunction countBy<T>(items: T[], fn: (item: T) => string): Record<string, number> {\n  const out: Record<string, number> = {};\n  for (const item of items) {\n    const k = fn(item);\n    out[k] = (out[k] || 0) + 1;\n  }\n  return out;\n}\n\nasync function readModulePath(source) {\n  try {\n    const text = await source.read('go.mod');\n    const m = text.match(/^module\\s+(\\S+)/m);\n    return m ? m[1] : '';\n  } catch {\n    return '';\n  }\n}\n\n// Simplified .gitignore: plain names, dir/, *.ext, /anchored. No negation —\n// documented limitation.\nasync function buildIgnoreMatcher(source) {\n  let text = '';\n  try {\n    text = await source.read('.gitignore');\n  } catch {\n    return () => false;\n  }\n  const rules = [];\n  for (let line of text.split('\\n')) {\n    line = line.trim();\n    if (!line || line.startsWith('#') || line.startsWith('!')) continue;\n    const anchored = line.startsWith('/');\n    const pattern = line.replace(/^\\//, '').replace(/\\/$/, '');\n    if (!pattern) continue;\n    const re = new RegExp(\n      (anchored ? '^' : '(^|/)') +\n        pattern.split(/(\\*\\*|\\*)/).map((part) =>\n          part === '**' ? '.*' : part === '*' ? '[^/]*' : escapeRe(part)\n        ).join('') +\n        '($|/)'\n    );\n    rules.push({ re });\n  }\n  return (path) => rules.some((r) => r.re.test(path));\n}\n\nfunction escapeRe(s) {\n  return s.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n}\n\nasync function readTsConfigPaths(source) {\n  for (const name of ['tsconfig.json', 'jsconfig.json']) {\n    try {\n      const text = await source.read(name);\n      const json = parseJsonConfig(text) as { compilerOptions?: { baseUrl?: string; paths?: Record<string, string[]>; rootDir?: string; outDir?: string } };\n      const compilerOptions = json.compilerOptions || {};\n      const baseUrl = compilerOptions.baseUrl ? compilerOptions.baseUrl.replace(/^\\.?\\//, '').replace(/\\/$/, '') : '';\n      const paths = compilerOptions.paths || {};\n      const sourceRoot = compilerOptions.rootDir?.replace(/^\\.?\\//, '').replace(/\\/$/, '');\n      const outputRoot = compilerOptions.outDir?.replace(/^\\.?\\//, '').replace(/\\/$/, '').replace(/^\\.$/, '');\n      if (Object.keys(paths).length || baseUrl || sourceRoot) {\n        return { baseUrl, paths, sourceRoot, outputRoot };\n      }\n    } catch {}\n  }\n  return null;\n}\n"]}

package/shared/analyzer/scanControl.d.ts

@@ -0,0 +1,11 @@
+import type { ScanLimits, ScanOptions, ScanSignal } from '../contracts.js';
+export declare const DEFAULT_LIMITS: Readonly<ScanLimits>;
+export declare function normalizeScanOptions(options?: ScanOptions): ScanLimits;
+export declare class ScanAbortedError extends Error {
+    constructor();
+}
+export declare function throwIfAborted(signal?: ScanSignal): void;
+/** Stops waiting promptly, while still observing the underlying I/O promise. */
+export declare function abortable<T>(promise: Promise<T>, signal?: ScanSignal): Promise<T>;
+/** Exact UTF-8 size, including replacement bytes for unpaired surrogates. */
+export declare function utf8ByteLength(text: string): number;

package/shared/analyzer/scanControl.js

@@ -0,0 +1,62 @@
+export const DEFAULT_LIMITS = Object.freeze({
+    maxFiles: 4000,
+    maxFileSize: 200 * 1024,
+    readConcurrency: 8,
+});
+export function normalizeScanOptions(options = {}) {
+    const whole = (key, maximum) => {
+        const value = options[key] ?? DEFAULT_LIMITS[key];
+        if (!Number.isInteger(value) || value < 1 || value > maximum) {
+            throw new RangeError(`${key} must be a whole number from 1 to ${maximum}.`);
+        }
+        return value;
+    };
+    return {
+        maxFiles: whole('maxFiles', 100_000),
+        maxFileSize: whole('maxFileSize', 10 * 1024 * 1024),
+        readConcurrency: whole('readConcurrency', 32),
+    };
+}
+export class ScanAbortedError extends Error {
+    constructor() {
+        super('The scan was cancelled.');
+        this.name = 'AbortError';
+    }
+}
+export function throwIfAborted(signal) {
+    if (signal?.aborted)
+        throw new ScanAbortedError();
+}
+/** Stops waiting promptly, while still observing the underlying I/O promise. */
+export function abortable(promise, signal) {
+    if (!signal)
+        return promise;
+    return new Promise((resolve, reject) => {
+        const aborted = () => { cleanup(); reject(new ScanAbortedError()); };
+        const cleanup = () => signal.removeEventListener('abort', aborted);
+        signal.addEventListener('abort', aborted, { once: true });
+        promise.then((value) => { cleanup(); resolve(value); }, (error) => { cleanup(); reject(error); });
+        if (signal.aborted)
+            aborted();
+    });
+}
+/** Exact UTF-8 size, including replacement bytes for unpaired surrogates. */
+export function utf8ByteLength(text) {
+    let bytes = 0;
+    for (let i = 0; i < text.length; i++) {
+        const unit = text.charCodeAt(i);
+        if (unit < 0x80)
+            bytes += 1;
+        else if (unit < 0x800)
+            bytes += 2;
+        else if (unit >= 0xd800 && unit <= 0xdbff && i + 1 < text.length &&
+            text.charCodeAt(i + 1) >= 0xdc00 && text.charCodeAt(i + 1) <= 0xdfff) {
+            bytes += 4;
+            i++;
+        }
+        else
+            bytes += 3;
+    }
+    return bytes;
+}
+//# sourceMappingURL=scanControl.js.map

package/shared/analyzer/scanControl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanControl.js","sourceRoot":"","sources":["../../src/shared/analyzer/scanControl.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,cAAc,GAAyB,MAAM,CAAC,MAAM,CAAC;IAChE,QAAQ,EAAE,IAAI;IACd,WAAW,EAAE,GAAG,GAAG,IAAI;IACvB,eAAe,EAAE,CAAC;CACnB,CAAC,CAAC;AAEH,MAAM,UAAU,oBAAoB,CAAC,OAAO,GAAgB,EAAE;IAC5D,MAAM,KAAK,GAAG,CAAC,GAAqB,EAAE,OAAe,EAAU,EAAE;QAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,OAAO,EAAE,CAAC;YAC7D,MAAM,IAAI,UAAU,CAAC,GAAG,GAAG,qCAAqC,OAAO,GAAG,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC;QACpC,WAAW,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;QACnD,eAAe,EAAE,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC;QACE,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAAC,MAAmB;IAChD,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;AACpD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,SAAS,CAAI,OAAmB,EAAE,MAAmB;IACnE,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAC5B,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,GAAS,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzE,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EACzC,CAAC,KAAc,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAClD,CAAC;QACF,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,IAAI,GAAG,IAAI;YAAE,KAAK,IAAI,CAAC,CAAC;aACvB,IAAI,IAAI,GAAG,KAAK;YAAE,KAAK,IAAI,CAAC,CAAC;aAC7B,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;YAC9D,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;YACvE,KAAK,IAAI,CAAC,CAAC;YACX,CAAC,EAAE,CAAC;QACN,CAAC;;YAAM,KAAK,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import type { ScanLimits, ScanOptions, ScanSignal } from '../contracts.js';\n\nexport const DEFAULT_LIMITS: Readonly<ScanLimits> = Object.freeze({\n  maxFiles: 4000,\n  maxFileSize: 200 * 1024,\n  readConcurrency: 8,\n});\n\nexport function normalizeScanOptions(options: ScanOptions = {}): ScanLimits {\n  const whole = (key: keyof ScanLimits, maximum: number): number => {\n    const value = options[key] ?? DEFAULT_LIMITS[key];\n    if (!Number.isInteger(value) || value < 1 || value > maximum) {\n      throw new RangeError(`${key} must be a whole number from 1 to ${maximum}.`);\n    }\n    return value;\n  };\n  return {\n    maxFiles: whole('maxFiles', 100_000),\n    maxFileSize: whole('maxFileSize', 10 * 1024 * 1024),\n    readConcurrency: whole('readConcurrency', 32),\n  };\n}\n\nexport class ScanAbortedError extends Error {\n  constructor() {\n    super('The scan was cancelled.');\n    this.name = 'AbortError';\n  }\n}\n\nexport function throwIfAborted(signal?: ScanSignal): void {\n  if (signal?.aborted) throw new ScanAbortedError();\n}\n\n/** Stops waiting promptly, while still observing the underlying I/O promise. */\nexport function abortable<T>(promise: Promise<T>, signal?: ScanSignal): Promise<T> {\n  if (!signal) return promise;\n  return new Promise<T>((resolve, reject) => {\n    const aborted = (): void => { cleanup(); reject(new ScanAbortedError()); };\n    const cleanup = (): void => signal.removeEventListener('abort', aborted);\n    signal.addEventListener('abort', aborted, { once: true });\n    promise.then(\n      (value) => { cleanup(); resolve(value); },\n      (error: unknown) => { cleanup(); reject(error); },\n    );\n    if (signal.aborted) aborted();\n  });\n}\n\n/** Exact UTF-8 size, including replacement bytes for unpaired surrogates. */\nexport function utf8ByteLength(text: string): number {\n  let bytes = 0;\n  for (let i = 0; i < text.length; i++) {\n    const unit = text.charCodeAt(i);\n    if (unit < 0x80) bytes += 1;\n    else if (unit < 0x800) bytes += 2;\n    else if (unit >= 0xd800 && unit <= 0xdbff && i + 1 < text.length &&\n      text.charCodeAt(i + 1) >= 0xdc00 && text.charCodeAt(i + 1) <= 0xdfff) {\n      bytes += 4;\n      i++;\n    } else bytes += 3;\n  }\n  return bytes;\n}\n"]}

package/shared/analyzer/security.d.ts

@@ -0,0 +1,18 @@
+export declare const SEVERITIES: string[];
+export declare const sevRank: (s: any) => number;
+export declare function analyzeSecurityFile(source: any, lang: any): any[];
+export declare function summarizeSecurity(scan: any): {
+    counts: {
+        critical: number;
+        high: number;
+        medium: number;
+        low: number;
+        info: number;
+    };
+    byCat: Record<string, any>;
+    files: any[];
+    score: number;
+    grade: string;
+    total: any;
+};
+export declare function mergeFindingsIntoScan(scan: any, external: any): number;

package/shared/analyzer/security.js

@@ -2,186 +2,186 @@
 // runs entirely locally, no external binary. Rules are regex/line based,
 // language-scoped, each with a severity and a category. Per-file findings are
 // attached during the scan; summarizeSecurity rolls them into a repo grade.
-
 import { lineCounter } from './util.js';
-
 export const SEVERITIES = ['info', 'low', 'medium', 'high', 'critical'];
 export const sevRank = (s) => SEVERITIES.indexOf(s);
-
 // Each rule: id, severity, category, message, rx. `byLine` rules test each
 // line (and report the line number); others test the whole source once.
 const RULES = [
-  { id: 'hardcoded-secret', severity: 'critical', category: 'secret',
-    message: 'Hardcoded credential — move it to env/config.',
-    rx: /\b(api[_-]?key|apikey|secret|client[_-]?secret|password|passwd|access[_-]?token|auth[_-]?token|private[_-]?key)\b\s*[:=]\s*['"`][^'"`\s]{8,}['"`]/i, byLine: true },
-  { id: 'aws-key', severity: 'critical', category: 'secret',
-    message: 'Looks like an AWS access key id.',
-    rx: /\b(AKIA|ASIA)[0-9A-Z]{16}\b/, byLine: true },
-  { id: 'private-key-block', severity: 'critical', category: 'secret',
-    message: 'A private key is committed to the source.',
-    rx: /-----BEGIN (RSA|EC|DSA|OPENSSH|PGP) PRIVATE KEY-----/ },
-  { id: 'eval', severity: 'high', category: 'injection', langs: ['javascript'],
-    message: 'eval() executes strings as code — classic injection sink.',
-    rx: /\beval\s*\(/, byLine: true },
-  { id: 'new-function', severity: 'high', category: 'injection', langs: ['javascript'],
-    message: 'new Function() is eval in a trench coat.',
-    rx: /\bnew Function\s*\(/, byLine: true },
-  { id: 'child-exec', severity: 'high', category: 'injection', langs: ['javascript'],
-    message: 'Shelling out — if any argument is user input, this is command injection.',
-    rx: /\b(child_process\.(exec|spawn)|execSync|spawnSync)\s*\(/, byLine: true },
-  { id: 'os-system', severity: 'high', category: 'injection', langs: ['python'],
-    message: 'os.system / shell=True runs a shell — sanitize any input reaching it.',
-    rx: /\bos\.system\s*\(|shell\s*=\s*True/, byLine: true },
-  { id: 'sql-concat', severity: 'high', category: 'injection',
-    message: 'SQL built by string concatenation/formatting — use parameterized queries.',
-    rx: /\b(execute|query|exec|raw)\s*\(\s*[^)]*(\+|\$\{|\.format\(|f["'])/, byLine: true },
-  { id: 'innerhtml', severity: 'medium', category: 'xss', langs: ['javascript'],
-    message: 'Writing raw HTML — if the value is user-controlled, this is XSS.',
-    rx: /\b(innerHTML|outerHTML)\s*=|dangerouslySetInnerHTML|document\.write\s*\(/, byLine: true,
-    ignore: /\b(innerHTML|outerHTML)\s*=\s*(['"`])\2\s*;?\s*$/ },
-  { id: 'weak-hash', severity: 'medium', category: 'crypto',
-    message: 'MD5/SHA-1 are broken — use SHA-256+, and bcrypt/argon2 for passwords.',
-    rx: /\b(md5|sha1)\s*\(|createHash\(\s*['"](md5|sha1)['"]/, byLine: true },
-  { id: 'math-random', severity: 'low', category: 'crypto', langs: ['javascript'],
-    message: 'Math.random() is not cryptographically secure.',
-    rx: /\bMath\.random\s*\(/, byLine: true },
-  { id: 'insecure-deser', severity: 'high', category: 'deserialization',
-    message: 'Insecure deserialization — untrusted data here is remote code execution.',
-    rx: /\b(pickle\.loads?|yaml\.load\s*\((?![^)]*SafeLoader)|unserialize\s*\(|ObjectInputStream)/, byLine: true },
-  { id: 'open-redirect', severity: 'medium', category: 'redirect',
-    message: 'Redirect target comes from the request — open-redirect risk.',
-    rx: /\b(res\.redirect|redirect)\s*\(\s*(req\.|request\.)/, byLine: true },
-  { id: 'localhost-url', severity: 'low', category: 'config',
-    message: 'Hardcoded localhost/127.0.0.1 — will break outside this machine.',
-    rx: /['"`](https?:\/\/(localhost|127\.0\.0\.1)|localhost:\d|127\.0\.0\.1)/, byLine: true },
-  { id: 'debugger', severity: 'low', category: 'debug', langs: ['javascript'],
-    message: 'A debugger statement is left in.',
-    rx: /\bdebugger\s*;?/, byLine: true },
-  { id: 'console-log', severity: 'info', category: 'debug', langs: ['javascript'],
-    message: 'console.log — fine locally, noise in production.',
-    rx: /\bconsole\.(log|debug|info)\s*\(/, byLine: true },
-  { id: 'print-stmt', severity: 'info', category: 'debug', langs: ['python'],
-    message: 'print() — use the logger in production code.',
-    rx: /^\s*print\s*\(/, byLine: true },
-  { id: 'todo', severity: 'info', category: 'quality',
-    message: 'TODO/FIXME left in the source.',
-    rx: /\b(TODO|FIXME|XXX|HACK)\b/, byLine: true },
-  { id: 'loose-eq', severity: 'low', category: 'quality', langs: ['javascript'],
-    message: 'Loose equality (==) coerces types — prefer ===.',
-    rx: /[^=!<>]==[^=]/, byLine: true },
-  { id: 'var-keyword', severity: 'low', category: 'quality', langs: ['javascript'],
-    message: 'var is function-scoped and hoisted — prefer let/const.',
-    rx: /\bvar\s+[A-Za-z_$]/, byLine: true },
-  { id: 'empty-catch', severity: 'medium', category: 'quality',
-    message: 'Swallowed exception — errors vanish silently here.',
-    rx: /(catch\s*\([^)]*\)\s*\{\s*\}|except\s*\w*\s*:\s*pass\b)/, byLine: true },
-  // JSON Web Tokens start with a base64-encoded header that is always
-  // `eyJ…` ("{"). A line that contains one and treats it as a literal
-  // string — rather than reading it from a vault — is the same shape of
-  // mistake as a hardcoded API key. Three base64 segments separated by
-  // dots is the JWT signature; we only require the first segment to keep
-  // the rule cheap.
-  { id: 'jwt-secret', severity: 'critical', category: 'secret',
-    message: 'Looks like a hardcoded JWT — treat it like a credential, not a string.',
-    rx: /['"`](eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,})['"`]/, byLine: true },
-  // The `os-system` rule already catches `os.system` and `shell=True` on
-  // subprocess calls, but `subprocess.Popen(..., shell=True)` and
-  // `subprocess.run(..., shell=True)` are the modern Python way to do
-  // the same thing, and a regex on `shell=True` alone matches both
-  // without the false-positive rate. A separate rule for Popen keeps the
-  // message specific and the langs filter honest.
-  { id: 'subprocess-shell', severity: 'high', category: 'injection', langs: ['python'],
-    message: 'subprocess.* with shell=True runs a shell — sanitize any input reaching it.',
-    rx: /\bsubprocess\.(Popen|run|call|check_output|check_call)\s*\([^)]*shell\s*=\s*True/, byLine: true },
-  // Go's `http.ListenAndServe` defaults to binding all interfaces when
-  // given a `":port"` address (the colon makes it a wildcard), and a
-  // literal `0.0.0.0` does the same. That is fine inside a container with
-  // a tight network policy and a bug everywhere else: the dev box, the
-  // staging cluster, the CI runner, the laptop on coffee-shop Wi-Fi. The
-  // rule does not distinguish "0.0.0.0" from "127.0.0.1" because the
-  // safer pattern is always `127.0.0.1:<port>`, so the finding is a
-  // nudge rather than an alarm.
-  { id: 'go-public-listen', severity: 'medium', category: 'config', langs: ['go'],
-    message: 'Go listener binds all interfaces (":port" or "0.0.0.0") — bind 127.0.0.1 explicitly.',
-    rx: /(ListenAndServe|Listen|TLS\s*\.\s*Listen|ListenAndServeTLS)\s*\(\s*["'](:[0-9]+|0\.0\.0\.0(?::[0-9]+)?|::)["']/, byLine: true },
+    { id: 'hardcoded-secret', severity: 'critical', category: 'secret',
+        message: 'Hardcoded credential — move it to env/config.',
+        rx: /\b(api[_-]?key|apikey|secret|client[_-]?secret|password|passwd|access[_-]?token|auth[_-]?token|private[_-]?key)\b\s*[:=]\s*['"`][^'"`\s]{8,}['"`]/i, byLine: true },
+    { id: 'aws-key', severity: 'critical', category: 'secret',
+        message: 'Looks like an AWS access key id.',
+        rx: /\b(AKIA|ASIA)[0-9A-Z]{16}\b/, byLine: true },
+    { id: 'private-key-block', severity: 'critical', category: 'secret',
+        message: 'A private key is committed to the source.',
+        rx: /-----BEGIN (RSA|EC|DSA|OPENSSH|PGP) PRIVATE KEY-----/ },
+    { id: 'eval', severity: 'high', category: 'injection', langs: ['javascript'],
+        message: 'eval() executes strings as code — classic injection sink.',
+        rx: /\beval\s*\(/, byLine: true },
+    { id: 'new-function', severity: 'high', category: 'injection', langs: ['javascript'],
+        message: 'new Function() is eval in a trench coat.',
+        rx: /\bnew Function\s*\(/, byLine: true },
+    { id: 'child-exec', severity: 'high', category: 'injection', langs: ['javascript'],
+        message: 'Shelling out — if any argument is user input, this is command injection.',
+        rx: /\b(child_process\.(exec|spawn)|execSync|spawnSync)\s*\(/, byLine: true },
+    { id: 'os-system', severity: 'high', category: 'injection', langs: ['python'],
+        message: 'os.system / shell=True runs a shell — sanitize any input reaching it.',
+        rx: /\bos\.system\s*\(|shell\s*=\s*True/, byLine: true },
+    { id: 'sql-concat', severity: 'high', category: 'injection',
+        message: 'SQL built by string concatenation/formatting — use parameterized queries.',
+        rx: /\b(execute|query|exec|raw)\s*\(\s*[^)]*(\+|\$\{|\.format\(|f["'])/, byLine: true },
+    { id: 'innerhtml', severity: 'medium', category: 'xss', langs: ['javascript'],
+        message: 'Writing raw HTML — if the value is user-controlled, this is XSS.',
+        rx: /\b(innerHTML|outerHTML)\s*=|dangerouslySetInnerHTML|document\.write\s*\(/, byLine: true,
+        ignore: /\b(innerHTML|outerHTML)\s*=\s*(['"`])\2\s*;?\s*$/ },
+    { id: 'weak-hash', severity: 'medium', category: 'crypto',
+        message: 'MD5/SHA-1 are broken — use SHA-256+, and bcrypt/argon2 for passwords.',
+        rx: /\b(md5|sha1)\s*\(|createHash\(\s*['"](md5|sha1)['"]/, byLine: true },
+    { id: 'math-random', severity: 'low', category: 'crypto', langs: ['javascript'],
+        message: 'Math.random() is not cryptographically secure.',
+        rx: /\bMath\.random\s*\(/, byLine: true },
+    { id: 'insecure-deser', severity: 'high', category: 'deserialization',
+        message: 'Insecure deserialization — untrusted data here is remote code execution.',
+        rx: /\b(pickle\.loads?|yaml\.load\s*\((?![^)]*SafeLoader)|unserialize\s*\(|ObjectInputStream)/, byLine: true },
+    { id: 'open-redirect', severity: 'medium', category: 'redirect',
+        message: 'Redirect target comes from the request — open-redirect risk.',
+        rx: /\b(res\.redirect|redirect)\s*\(\s*(req\.|request\.)/, byLine: true },
+    { id: 'localhost-url', severity: 'low', category: 'config',
+        message: 'Hardcoded localhost/127.0.0.1 — will break outside this machine.',
+        rx: /['"`](https?:\/\/(localhost|127\.0\.0\.1)|localhost:\d|127\.0\.0\.1)/, byLine: true },
+    { id: 'debugger', severity: 'low', category: 'debug', langs: ['javascript'],
+        message: 'A debugger statement is left in.',
+        rx: /\bdebugger\s*;?/, byLine: true },
+    { id: 'console-log', severity: 'info', category: 'debug', langs: ['javascript'],
+        message: 'console.log — fine locally, noise in production.',
+        rx: /\bconsole\.(log|debug|info)\s*\(/, byLine: true },
+    { id: 'print-stmt', severity: 'info', category: 'debug', langs: ['python'],
+        message: 'print() — use the logger in production code.',
+        rx: /^\s*print\s*\(/, byLine: true },
+    { id: 'todo', severity: 'info', category: 'quality',
+        message: 'TODO/FIXME left in the source.',
+        rx: /\b(TODO|FIXME|XXX|HACK)\b/, byLine: true },
+    { id: 'loose-eq', severity: 'low', category: 'quality', langs: ['javascript'],
+        message: 'Loose equality (==) coerces types — prefer ===.',
+        rx: /[^=!<>]==[^=]/, byLine: true },
+    { id: 'var-keyword', severity: 'low', category: 'quality', langs: ['javascript'],
+        message: 'var is function-scoped and hoisted — prefer let/const.',
+        rx: /\bvar\s+[A-Za-z_$]/, byLine: true },
+    { id: 'empty-catch', severity: 'medium', category: 'quality',
+        message: 'Swallowed exception — errors vanish silently here.',
+        rx: /(catch\s*\([^)]*\)\s*\{\s*\}|except\s*\w*\s*:\s*pass\b)/, byLine: true },
+    // JSON Web Tokens start with a base64-encoded header that is always
+    // `eyJ…` ("{"). A line that contains one and treats it as a literal
+    // string — rather than reading it from a vault — is the same shape of
+    // mistake as a hardcoded API key. Three base64 segments separated by
+    // dots is the JWT signature; we only require the first segment to keep
+    // the rule cheap.
+    { id: 'jwt-secret', severity: 'critical', category: 'secret',
+        message: 'Looks like a hardcoded JWT — treat it like a credential, not a string.',
+        rx: /['"`](eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,})['"`]/, byLine: true },
+    // The `os-system` rule already catches `os.system` and `shell=True` on
+    // subprocess calls, but `subprocess.Popen(..., shell=True)` and
+    // `subprocess.run(..., shell=True)` are the modern Python way to do
+    // the same thing, and a regex on `shell=True` alone matches both
+    // without the false-positive rate. A separate rule for Popen keeps the
+    // message specific and the langs filter honest.
+    { id: 'subprocess-shell', severity: 'high', category: 'injection', langs: ['python'],
+        message: 'subprocess.* with shell=True runs a shell — sanitize any input reaching it.',
+        rx: /\bsubprocess\.(Popen|run|call|check_output|check_call)\s*\([^)]*shell\s*=\s*True/, byLine: true },
+    // Go's `http.ListenAndServe` defaults to binding all interfaces when
+    // given a `":port"` address (the colon makes it a wildcard), and a
+    // literal `0.0.0.0` does the same. That is fine inside a container with
+    // a tight network policy and a bug everywhere else: the dev box, the
+    // staging cluster, the CI runner, the laptop on coffee-shop Wi-Fi. The
+    // rule does not distinguish "0.0.0.0" from "127.0.0.1" because the
+    // safer pattern is always `127.0.0.1:<port>`, so the finding is a
+    // nudge rather than an alarm.
+    { id: 'go-public-listen', severity: 'medium', category: 'config', langs: ['go'],
+        message: 'Go listener binds all interfaces (":port" or "0.0.0.0") — bind 127.0.0.1 explicitly.',
+        rx: /(ListenAndServe|Listen|TLS\s*\.\s*Listen|ListenAndServeTLS)\s*\(\s*["'](:[0-9]+|0\.0\.0\.0(?::[0-9]+)?|::)["']/, byLine: true },
 ];
-
 // Findings for one file, run at scan time while the source is in hand.
 export function analyzeSecurityFile(source, lang) {
-  const findings = [];
-  const text = String(source);
-  const lines = text.split('\n');
-  // Whole-file rules report a byte offset and need it as a line number. Built
-  // once and lazily: most files trip none of these rules and never build it.
-  const lineAt = lineCounter(text);
-  for (const rule of RULES) {
-    if (rule.langs && !rule.langs.includes(lang)) continue;
-    if (rule.byLine) {
-      for (let i = 0; i < lines.length; i++) {
-        if (rule.ignore && rule.ignore.test(lines[i])) continue;
-        const m = lines[i].match(rule.rx);
-        if (m) {
-          findings.push({ rule: rule.id, severity: rule.severity, category: rule.category, message: rule.message, line: i + 1, excerpt: lines[i].trim().slice(0, 90) });
+    const findings = [];
+    const text = String(source);
+    const lines = text.split('\n');
+    // Whole-file rules report a byte offset and need it as a line number. Built
+    // once and lazily: most files trip none of these rules and never build it.
+    const lineAt = lineCounter(text);
+    for (const rule of RULES) {
+        if (rule.langs && !rule.langs.includes(lang))
+            continue;
+        if (rule.byLine) {
+            for (let i = 0; i < lines.length; i++) {
+                if (rule.ignore && rule.ignore.test(lines[i]))
+                    continue;
+                const m = lines[i].match(rule.rx);
+                if (m) {
+                    findings.push({ rule: rule.id, severity: rule.severity, category: rule.category, message: rule.message, line: i + 1, excerpt: lines[i].trim().slice(0, 90) });
+                }
+            }
+        }
+        else {
+            const m = text.match(rule.rx);
+            if (m) {
+                findings.push({ rule: rule.id, severity: rule.severity, category: rule.category, message: rule.message, line: lineAt(m.index), excerpt: (m[0] || '').slice(0, 90) });
+            }
         }
-      }
-    } else {
-      const m = text.match(rule.rx);
-      if (m) {
-        findings.push({ rule: rule.id, severity: rule.severity, category: rule.category, message: rule.message, line: lineAt(m.index), excerpt: (m[0] || '').slice(0, 90) });
-      }
     }
-  }
-  return findings;
+    return findings;
 }
-
 // Repo-level roll-up: counts by severity and category, the files carrying
 // findings (worst-first), and a 0–100 score + grade.
 export function summarizeSecurity(scan) {
-  const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
-  const byCat = {};
-  const files = [];
-  for (const f of scan.files) {
-    const finds = f.findings || [];
-    if (!finds.length) continue;
-    let worst = 'info';
-    for (const x of finds) {
-      counts[x.severity]++;
-      byCat[x.category] = (byCat[x.category] || 0) + 1;
-      if (sevRank(x.severity) > sevRank(worst)) worst = x.severity;
+    const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+    const byCat = {};
+    const files = [];
+    for (const f of scan.files) {
+        const finds = f.findings || [];
+        if (!finds.length)
+            continue;
+        let worst = 'info';
+        for (const x of finds) {
+            counts[x.severity]++;
+            byCat[x.category] = (byCat[x.category] || 0) + 1;
+            if (sevRank(x.severity) > sevRank(worst))
+                worst = x.severity;
+        }
+        files.push({ path: f.path, name: f.name, findings: finds, worst, count: finds.length });
     }
-    files.push({ path: f.path, name: f.name, findings: finds, worst, count: finds.length });
-  }
-  files.sort((a, b) => sevRank(b.worst) - sevRank(a.worst) || b.count - a.count);
-
-  let score = 100;
-  score -= counts.critical * 15;
-  score -= counts.high * 6;
-  score -= counts.medium * 2;
-  score -= Math.min(10, counts.low);
-  score = Math.max(0, Math.round(score));
-  const grade = score >= 90 ? 'A' : score >= 75 ? 'B' : score >= 60 ? 'C' : score >= 45 ? 'D' : 'F';
-
-  return { counts, byCat, files, score, grade, total: files.reduce((s, f) => s + f.count, 0) };
+    files.sort((a, b) => sevRank(b.worst) - sevRank(a.worst) || b.count - a.count);
+    let score = 100;
+    score -= counts.critical * 15;
+    score -= counts.high * 6;
+    score -= counts.medium * 2;
+    score -= Math.min(10, counts.low);
+    score = Math.max(0, Math.round(score));
+    const grade = score >= 90 ? 'A' : score >= 75 ? 'B' : score >= 60 ? 'C' : score >= 45 ? 'D' : 'F';
+    return { counts, byCat, files, score, grade, total: files.reduce((s, f) => s + f.count, 0) };
 }
-
 // Fold an external engine's findings into the scan, in place, so the security
 // view — which reads `scan.files[].findings` and re-summarizes — sees one list.
 // Dedup is on (path, line, rule): two engines flagging the same line for the
 // same reason are one problem. This is the shared, pure half of the merge; the
 // fetching and spawning live on the server.
 export function mergeFindingsIntoScan(scan, external) {
-  if (!scan || !Array.isArray(external) || !external.length) return 0;
-  const byPath = new Map(scan.files.map((f) => [f.path, f]));
-  let added = 0;
-  for (const finding of external) {
-    const file = byPath.get(finding.path);
-    if (!file) continue; // a path the scanner never accepted is not ours to show
-    const list = file.findings || (file.findings = []);
-    const dupe = list.some((x) => x.line === finding.line && x.rule === finding.rule);
-    if (dupe) continue;
-    list.push(finding);
-    added++;
-  }
-  return added;
+    if (!scan || !Array.isArray(external) || !external.length)
+        return 0;
+    const byPath = new Map(scan.files.map((f) => [f.path, f]));
+    let added = 0;
+    for (const finding of external) {
+        const file = byPath.get(finding.path);
+        if (!file)
+            continue; // a path the scanner never accepted is not ours to show
+        const list = file.findings || (file.findings = []);
+        const dupe = list.some((x) => x.line === finding.line && x.rule === finding.rule);
+        if (dupe)
+            continue;
+        list.push(finding);
+        added++;
+    }
+    return added;
 }
-
+//# sourceMappingURL=security.js.map