entkapp 5.2.4 → 5.3.1

package/README.md

@@ -1,75 +1,68 @@
-# 🕸️ entkapp Ultimate v5.2.4
+# 🕸️ entkapp Ultimate v5.3.1
 
-> **The Ultimate Enterprise Codebase Janitor.** Faster than Knip with OXC integration, type-aware analysis, and automated structural healing. Fully standalone - solving what Knip cannot.
+> **The Ultimate Enterprise Codebase Janitor.** High-speed OXC integration, type-aware analysis, and automated structural healing. Fully standalone architectural orchestrator.
 
 ![Version](https://img.shields.io/npm/v/entkapp) ![License](https://img.shields.io/badge/license-Apache--2.0-green.svg) ![Performance](https://img.shields.io/badge/performance-OXC--Inside-blueviolet.svg)
 
 ---
 
-`entkapp` ist eine next-generation Engine zur statischen Code-Analyse, die die Stabilität der bewährten Version 7 mit den Hochleistungs-Features der Version 9 kombiniert. Sie findet ungenutzte Dateien, tote Exports, zirkuläre Abhängigkeiten und Sicherheitsrisiken schneller als jedes andere Tool im Ökosystem.
+`entkapp` is a next-generation static code analysis engine. It identifies unused files, dead exports, circular dependencies, and security risks faster than any other tool in the ecosystem..
 
-## 🚀 Warum entkapp?
+## 🚀 Why entkapp?
 
-*   **⚡ Blazing Fast:** Nutzt den Rust-basierten `oxc-parser` für extrem schnelle AST-Traversierung, kombiniert mit der TypeScript Compiler API für tiefe semantische Analysen.
-*   **🔌 Massives Plugin-System:** Über 80+ integrierte Plugins (React, Vue, Svelte, Angular, Next.js, Nuxt, SvelteKit, Astro, Vite, Webpack, Turbo, Nx, Tailwind, ESLint, Prettier und viele mehr).
-*   **💀 True Dead Code Detection:** Fortschrittliche graphbasierte Analyse zur Identifizierung von wirklich verwaistem Code.
-*   **🔄 Circular Dependency Detection:** Hochperformante Erkennung von zirkulären Abhängigkeiten mittels Tarjan's Algorithmus.
-*   **🔐 Secrets Scanning:** Automatische Erkennung von hartkodierten API-Keys, Tokens und Anmeldedaten.
-*   **🛠️ Automated Structural Healing:** Repariert Abhängigkeitsprobleme und strukturelle Fehler automatisch mit Git-basiertem Rollback-Schutz.
+*   **⚡ Blazing Fast:** Leverages the Rust-based `oxc-parser` for ultra-fast AST traversal, combined with the TypeScript Compiler API for deep semantic analysis.
+*   **🔌 Massive Plugin System:** Over 98 built-in plugins (React, Vue, Svelte, Angular, Next.js, Nuxt, SvelteKit, Astro, Vite, Webpack, Turbo, Nx, Tailwind, ESLint, Prettier, and many more).
+*   **💀 True Dead Code Detection:** Advanced graph-based analysis to identify genuinely orphaned code.
+*   **🔄 Circular Dependency Detection:** High-performance detection of circular dependencies using Tarjan's algorithm.
+*   **🔐 Secrets Scanning:** Automatic detection of hardcoded API keys, tokens, and credentials.
+*   **🛠️ Automated Structural Healing:** Automatically fixes dependency issues and structural errors with Git-based rollback protection.
 
 ## 📦 Installation
 
 ```bash
-# Direkt ausführen ohne Installation (empfohlen)
+# Run directly without installation (recommended)
 npx entkapp
 
-# Oder global installieren
+# Or install it globally
 npm install -g entkapp
 ```
 
-## 🛠️ Nutzung
+## 🛠️ Usage
 
-### Interaktiver Modus (Standard)
-Startet den interaktiven Analyse- und Scaffolding-Workflow:
+### Interactive Mode (Default)
+Starts the interactive analysis:
 ```bash
-npx entkapp
+npx entkapp -r
 ```
 
-### Headless Analyse-Modus
-Ideal für CI/CD-Pipelines. Führt die Analyse ohne Prompts durch und gibt JSON aus:
+### Headless Analysis Mode
+Ideal for CI/CD pipelines. Performs analysis without prompts and outputs JSON:
 ```bash
 npx entkapp --analyze
 ```
 
-### Auto-Fix Modus
-Behebt automatisch Abhängigkeitskonflikte und strukturelle Probleme:
+### Auto-Fix Mode
+Automatically resolves dependency conflicts and structural issues:
 ```bash
 npx entkapp --fix
 ```
 
-### Zusätzliche Optionen
+### Additional Options
 ```bash
-npx entkapp --cwd ./mein-projekt   # Analysiert ein spezifisches Verzeichnis
-npx entkapp --verbose              # Aktiviert detailliertes Logging
-npx entkapp --version              # Zeigt die Versionsnummer
-npx entkapp --help                 # Zeigt das Hilfe-Panel
+npx entkapp --cwd ./my-project  -r    # Analyzes a specific directory
+npx entkapp --verbose -r              # Enables detailed logging
+npx entkapp --version                 # Displays the version number
+npx entkapp --help                    # Displays the help panel
 ```
 
-## 🧠 Fortgeschrittene Architektur
+## 🧠 Advanced Architecture
 
 ### Incremental Caching
-`entkapp` verwendet eine persistente Graph-Status-Schicht (`.entkapp-cache`). Es berechnet SHA-256 Hashes von Dateipuffern, um das AST-Parsing für unveränderte Dateien zu überspringen.
+`entkapp` uses a persistent graph state layer (`.entkapp-cache`). It calculates SHA-256 hashes of file buffers to skip AST parsing for unchanged files.
 
 ### Parallel Analysis
-Bei größeren Codebasen verteilt `entkapp` die Arbeitslast automatisch auf mehrere CPU-Threads mittels Node.js Worker Threads.
-
-### Pluggable Architecture
-Die Engine ist modular aufgebaut:
-- **`EntkappEngine`**: Der zentrale Orchestrator.
-- **`PluginRegistry`**: Verwaltet den Lebenszyklus der Framework-Plugins.
-- **`ASTAnalyzer` / `OxcAnalyzer`**: Multi-pass AST-Walker für tiefgehende Analysen.
-- **`SelfHealer`**: Transaktionales Refactoring mit Git-State-Capture und Rollback.
+For larger codebases, `entkapp` automatically distributes the workload across multiple CPU threads using Node.js Worker Threads.
 
-## 📄 Lizenz
+## 📄 License
 
-Apache-2.0
+Apache-2.0

package/bin/cli.js

@@ -28,7 +28,7 @@ async function bootstrap() {
     program
       .name('entkapp')
       .description(ansis.cyan('The Ultimate Enterprise Codebase Janitor with OXC integration, type-aware analysis, and automated structural healing.'))
-      .version(packageJsonContent.version || '5.1.0');
+      .version(packageJsonContent.version || '5.3.1');
 
     program
       .option('-c, --cwd <path>', 'Specify the execution context root directory', process.cwd())
@@ -109,7 +109,7 @@ async function bootstrap() {
     try {
       const { ConfigLoader } = await import('../src/resolution/ConfigLoader.js');
       const loader = new ConfigLoader(targetCwd);
-      localConfig = await loader.loadConfig(targetCwd);
+      localConfig = await loader.loadConfig();
     } catch (e) {}
 
     // Merge options with local config
@@ -132,7 +132,7 @@ async function bootstrap() {
     }, timeoutMs);
     timeoutTimer.unref(); // Allow process to exit if work finishes
 
-    console.log(ansis.bold.green(`\n📦 entkapp v${packageJsonContent.version || '5.1.0'} Engine Activation`));
+    console.log(ansis.bold.green(`\n📦 entkapp v${packageJsonContent.version || '5.3.1'} Engine Activation`));
     console.log(ansis.dim('------------------------------------------------------------'));
     console.log(`${ansis.bold('Target Workspace Root :')} ${ansis.blue(targetCwd)}`);
     console.log(`${ansis.bold('Refactoring Mode     :')} ${options.fix ? ansis.yellow('Active Fixing & Self-Healing Enabled') : ansis.gray('Dry-Run Reporting Only')}`);

package/entkapp/config.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://unpkg.com/entkapp@5.2.4/schema.json"
+  "$schema": "https://unpkg.com/entkapp@latest/schema.json",
   "interface": "CLI",
   "useBuiltinPlugins": true,
   "useCustomPlugins": true,
@@ -26,5 +26,21 @@
     "dist",
     "build",
     "coverage"
-  ]
+  ],
+  "entryPoints": [],
+  "workspace": {
+    "enabled": false,
+    "enforcePackageBoundaries": true,
+    "checkVersionMismatches": true
+  },
+  "tsconfig": {
+    "filename": "tsconfig.json",
+    "followProjectReferences": true,
+    "resolveAliases": true
+  },
+  "buildScripts": {
+    "scanWorkspaceScripts": true,
+    "scanCIWorkflows": true,
+    "scanConfigFiles": true
+  }
 }

package/entkapp/plugins/README.md

@@ -1,19 +1,59 @@
-# entkapp Plugins
+# 🔌 entkapp Plugins (v5.3.0)
 
-This directory is for your custom plugins. entkapp will automatically load any `.js` or `.mjs` files placed here if `useCustomPlugins` is set to `true` in your `config.json`.
+Dieses Verzeichnis dient für deine benutzerdefinierten Plugins. entkapp lädt automatisch alle `.js` oder `.mjs` Dateien aus diesem Ordner, wenn `useCustomPlugins` in deiner `config.json` auf `true` gesetzt ist.
 
-## Supported Ecosystems (Built-in)
+## 📦 Integrierte Framework- & Tool-Plugins (98 Gesamt)
 
-- **Next.js**: Handles pages, API routes, and App Router conventions.
-- **Nuxt**: Supports auto-imports and server routes.
-- **Remix**: Maps loaders, actions, and root exports.
-- **SvelteKit**: Tracks `+page`, `+layout`, and server-side scripts.
-- **Astro**: Analyzes `.astro` files and static paths.
+entkapp verfügt über eine massive Bibliothek von 98 integrierten Plugins, die automatisch die Architektur deiner Codebase erkennen und analysieren.
 
-## Knip Compatibility
+### 🖼️ Frontend Frameworks & Meta-Frameworks
+- **Next.js** (App Router, Pages Router)
+- **React**, **Preact**, **Solid**, **Qwik**, **Lit**, **Angular**, **Vue**, **Svelte**
+- **Nuxt**, **Remix**, **SvelteKit**, **Astro**, **Vitepress**, **Gatsby**, **RedwoodJS**
 
-entkapp supports Knip-style plugins. You can drop Knip plugins into this folder, and the engine will attempt to wrap them for use within the entkapp ecosystem.
+### 🌐 State Management & Routing
+- **Redux**, **Zustand**, **Jotai**, **Recoil**, **MobX**, **Pinia**, **TanStack Query**
+- **React Router**, **TanStack Router**, **Vue Router**
 
-## Documentation
+### 🛠️ Build Tools & Monorepo
+- **Vite**, **Esbuild**, **Rollup**, **Webpack**, **Parcel**, **TypeScript**, **Babel**, **SWC**
+- **Turbo**, **Nx**, **Lerna**, **Rush**, **Moon**, **Bazel**
 
-For a detailed guide on how to build your own plugins, please refer to the [Plugin Development Guide](../../docs/guide.md#plugin-development).
+### 🎨 Styling & UI Components
+- **Tailwind CSS**, **PostCSS**, **UnoCSS**, **Stylelint**, **RTLCSS**
+- **Ant Design (Antd)**, **Material UI (Mui)**, **Shadcn/UI**, **Radix UI**, **Chakra UI**
+- **Framer Motion**, **GSAP**
+
+### 🧪 Testing & Quality
+- **Jest**, **Vitest**, **Playwright**, **Cypress**, **Storybook**, **MSW**
+- **ESLint**, **Prettier**, **Biome**, **Oxlint**, **Husky**, **Lint-Staged**, **Commitlint**, **Changesets**
+
+### ☁️ Backend, API & Database
+- **Express**, **Fastify**, **NestJS**, **Hono**, **Koa**, **Elysia**, **Hapi**, **Grammy**
+- **GraphQL**, **Apollo**, **TRPC**, **Socket.io**
+- **Prisma**, **Drizzle**, **Mongoose**, **TypeORM**, **Supabase**, **Firebase**, **Clerk**
+
+### 🔧 Infrastructure & Dev Tools
+- **GitHub Actions**, **Docker**, **Terraform**, **EditorConfig**, **Dotenv**
+- **Nvm**, **Volta**, **Pnpm**, **Yarn**, **Bun**
+- **Swiper**, **Quill**, **Envelop**, **Nitro Modules**, **CKEditor Engine**
+
+---
+
+## 🛠️ Eigene Plugins erstellen
+
+Du kannst die Funktionalität von entkapp erweitern, indem du eine Plugin-Klasse erstellst:
+
+```javascript
+export default class MyCustomPlugin {
+  name = 'my-custom-plugin';
+  
+  async onAnalyze(context) {
+    // Deine Logik hier
+  }
+}
+```
+
+## 📜 Dokumentation
+
+Für eine detaillierte Anleitung zur Plugin-Entwicklung besuche bitte den [Plugin Development Guide](https://dreamlongyt.github.io/entkapp/).

package/package.json

@@ -1,8 +1,8 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
   "name": "entkapp",
-  "version": "5.2.4",
-  "description": "The Ultimate Enterprise Codebase Janitor. Faster than Knip with OXC integration, type-aware analysis, and automated structural healing. Fully standalone - solving what Knip cannot.",
+  "version": "5.3.1",
+  "description": "The Ultimate Enterprise Codebase Janitor. High-speed OXC integration, type-aware analysis, and automated structural healing. Fully standalone architectural orchestrator.",
   "type": "module",
   "main": "index.js",
   "bin": {

package/schema.json

@@ -1,4 +1,3 @@
-
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
   "title": "entkapp Configuration Schema",
@@ -46,11 +45,15 @@
       "type": "array",
       "items": {
         "type": "string",
-        "enum": ["nextjs", "nuxt", "remix", "sveltekit", "astro", "typescript", "vite", "webpack", "react", "vue", "angular"]
+        "enum": [
+          "nextjs", "nuxt", "remix", "sveltekit", "astro",
+          "typescript", "vite", "webpack", "react", "vue", "angular",
+          "turbo", "nx", "lerna"
+        ]
       }
     },
     "ignoreDependencies": {
-      "description": "Dependencies that should never be reported as unused.",
+      "description": "Dependencies that should never be reported as unused. Supports glob patterns like '@types/*'.",
       "type": "array",
       "items": {
         "type": "string"
@@ -64,6 +67,87 @@
         "type": "string"
       },
       "default": ["node_modules", ".git", "dist", "build", "coverage"]
+    },
+    "entryPoints": {
+      "description": "Explicit entry point files to protect from orphan detection. Supports glob patterns.",
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "default": []
+    },
+    "workspace": {
+      "description": "Monorepo workspace configuration.",
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "description": "Force-enable monorepo workspace mode (auto-detected from package.json workspaces or pnpm-workspace.yaml).",
+          "type": "boolean",
+          "default": false
+        },
+        "packages": {
+          "description": "Override workspace package glob patterns (e.g. ['packages/*', 'apps/*']).",
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "ignoredPackages": {
+          "description": "Workspace packages to exclude from analysis.",
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "enforcePackageBoundaries": {
+          "description": "Report errors when a workspace package imports another without declaring it as a dependency.",
+          "type": "boolean",
+          "default": true
+        },
+        "checkVersionMismatches": {
+          "description": "Report warnings when the same dependency has different versions across workspace packages.",
+          "type": "boolean",
+          "default": true
+        }
+      }
+    },
+    "tsconfig": {
+      "description": "TypeScript configuration options.",
+      "type": "object",
+      "properties": {
+        "filename": {
+          "description": "Path to the root tsconfig.json file.",
+          "type": "string",
+          "default": "tsconfig.json"
+        },
+        "followProjectReferences": {
+          "description": "Follow TypeScript project references to discover workspace packages.",
+          "type": "boolean",
+          "default": true
+        },
+        "resolveAliases": {
+          "description": "Use tsconfig paths/baseUrl to resolve module aliases.",
+          "type": "boolean",
+          "default": true
+        }
+      }
+    },
+    "buildScripts": {
+      "description": "Build script analysis configuration.",
+      "type": "object",
+      "properties": {
+        "scanWorkspaceScripts": {
+          "description": "Also scan package.json scripts in all workspace packages (not just root).",
+          "type": "boolean",
+          "default": true
+        },
+        "scanCIWorkflows": {
+          "description": "Scan .github/workflows YAML files for tool usage.",
+          "type": "boolean",
+          "default": true
+        },
+        "scanConfigFiles": {
+          "description": "Detect tool usage from config files (vite.config.ts, jest.config.js, etc.).",
+          "type": "boolean",
+          "default": true
+        }
+      }
     }
   }
 }

package/src/ast/SecretScanner.js

@@ -35,45 +35,89 @@ const SENSITIVE_NAME_PATTERNS = [
   /private[_-]?key/i,
   /client[_-]?secret/i,
   /app[_-]?secret/i,
+  /security[_-]?token/i,
+  /master[_-]?key/i,
+  /root[_-]?password/i,
+
   // Database credentials
   /db[_-]?pass(word)?/i,
   /database[_-]?pass(word)?/i,
   /db[_-]?url/i,
   /database[_-]?url/i,
   /connection[_-]?string/i,
-  // Passwords
+  /postgres(ql)?[_-]?url/i,
+  /mongo(db)?[_-]?url/i,
+  /redis[_-]?url/i,
+
+  // Passwords & Pins
   /^password$/i,
   /^passwd$/i,
   /^pwd$/i,
   /[_-]password$/i,
-  // Tokens
+  /[_-]pass$/i,
+  /pass(phrase|code)/i,
+  /admin[_-]?pass/i,
+  /pin[_-]?number/i,
+
+  // Tokens & Sessions
   /[_-]token$/i,
   /^token$/i,
-  /jwt[_-]?secret/i,
-  /session[_-]?secret/i,
+  /jwt[_-]?(secret|token)/i,
+  /session[_-]?(secret|token|id)/i,
   /cookie[_-]?secret/i,
-  // Cloud provider keys
-  /aws[_-]?(access[_-]?key|secret|session[_-]?token)/i,
-  /gcp[_-]?key/i,
-  /azure[_-]?(key|secret|connection)/i,
-  // Service-specific
-  /stripe[_-]?(key|secret)/i,
-  /twilio[_-]?(auth|token|sid)/i,
-  /sendgrid[_-]?key/i,
-  /github[_-]?token/i,
-  /slack[_-]?(token|webhook)/i,
-  /discord[_-]?(token|secret)/i,
-  /openai[_-]?(key|token)/i,
+  /oauth[_-]?(token|secret|client)/i,
+  /refresh[_-]?token/i,
+  /csrf[_-]?token/i,
+
+  // Cloud Provider Keys (AWS, GCP, Azure)
+  /aws[_-]?(access[_-]?key|secret|session[_-]?token|key[_-]?id)/i,
+  /gcp[_-]?(key|secret|token|sa[_-]?key)/i,
+  /google[_-]?(api[_-]?key|credentials|client[_-]?secret)/i,
+  /azure[_-]?(key|secret|connection|token|tenant[_-]?id)/i,
+
+  // AI & Machine Learning Platforms
+  /openai[_-]?(key|token|secret)/i,
   /anthropic[_-]?key/i,
-  /webhook[_-]?(url|secret)/i,
-  /encryption[_-]?key/i,
+  /cohere[_-]?key/i,
+  /huggingface[_-]?token/i,
+  /replicate[_-]?api/i,
+  /langchain[_-]?api/i,
+  /pinecone[_-]?api/i,
+  /gemini[_-]?key/i,
+
+  // Service-Specific (CI/CD, Dev Tools, Payment, Comms)
+  /stripe[_-]?(key|secret|webhook)/i,
+  /twilio[_-]?(auth|token|sid)/i,
+  /sendgrid[_-]?(key|api)/i,
+  /github[_-]?(token|pat|secret|app[_-]?id)/i,
+  /gitlab[_-]?(token|pat|secret)/i,
+  /slack[_-]?(token|webhook|secret)/i,
+  /discord[_-]?(token|secret|webhook)/i,
+  /pagerduty[_-]?(token|key)/i,
+  /datadog[_-]?(api[_-]?key|app[_-]?key)/i,
+  /sentry[_-]?(dsn|auth[_-]?token)/i,
+  /heroku[_-]?(api[_-]?key|oauth)/i,
+  /atlassian[_-]?(token|secret)/i,
+  /jira[_-]?(token|password)/i,
+  /npm[_-]?auth[_-]?token/i,
+  /jfrog[_-]?(token|password|api)/i,
+  /firebase[_-]?(key|secret|token)/i,
+  /supabase[_-]?(key|secret|service[_-]?role)/i,
+
+  // Webhooks, Crypto, and Infrastructure
+  /webhook[_-]?(url|secret|token)/i,
+  /encryption[_-]?(key|secret|iv)/i,
   /signing[_-]?key/i,
-  /hmac[_-]?key/i,
+  /hmac[_-]?(key|secret)/i,
   /salt$/i,
-  /ssh[_-]?key/i,
-  /private[_-]?key/i,
-  /cert(ificate)?/i,
-  /credential/i,
+  /ssh[_-]?(key|private|public)/i,
+  /cert(ificate)?(s)?/i,
+  /credential(s)?/i,
+  /tls[_-]?(key|cert)/i,
+  /ssl[_-]?(key|cert)/i,
+  /kube(config)?[_-]?(token|secret)/i,
+  /vault[_-]?(token|secret|key)/i,
+  /bitcoind?[_-]?(rpc)?password/i,
 ];
 
 /**
@@ -84,37 +128,55 @@ const SENSITIVE_VALUE_PATTERNS = [
   // AWS Access Key IDs
   { pattern: /AKIA[0-9A-Z]{16}/, label: 'AWS_ACCESS_KEY_ID', severity: SecretSeverity.CRITICAL },
   // AWS Secret Access Keys (40-char base64-ish)
-  { pattern: /[A-Za-z0-9/+=]{40}/, label: 'AWS_SECRET_KEY_CANDIDATE', severity: SecretSeverity.MEDIUM },
-  // Generic high-entropy hex strings (32+ chars)
-  { pattern: /^[0-9a-f]{32,}$/i, label: 'HEX_SECRET', severity: SecretSeverity.HIGH },
-  // Generic high-entropy base64 strings (32+ chars)
-  { pattern: /^[A-Za-z0-9+/]{32,}={0,2}$/, label: 'BASE64_SECRET', severity: SecretSeverity.MEDIUM },
+  { pattern: /(?<![A-Za-z0-9/+=])[A-Za-z0-9/+=]{40}(?![A-Za-z0-9/+=])/, label: 'AWS_SECRET_KEY_CANDIDATE', severity: SecretSeverity.MEDIUM },
+  
+  // Generic high-entropy hex strings (32+ chars) - Added word boundaries to reduce false positives
+  { pattern: /\b[0-9a-f]{32,}\b/i, label: 'HEX_SECRET', severity: SecretSeverity.HIGH },
+  // Generic high-entropy base64 strings (32+ chars) - Replaced rigid anchors with lookarounds
+  { pattern: /(?<![A-Za-z0-9+/])[A-Za-z0-9+/]{32,}={0,2}(?![A-Za-z0-9+/])/, label: 'BASE64_SECRET', severity: SecretSeverity.MEDIUM },
+  
   // JWT tokens
-  { pattern: /^ey[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/, label: 'JWT_TOKEN', severity: SecretSeverity.CRITICAL },
-  // GitHub personal access tokens
-  { pattern: /ghp_[A-Za-z0-9]{36}/, label: 'GITHUB_PAT', severity: SecretSeverity.CRITICAL },
-  { pattern: /github_pat_[A-Za-z0-9_]{82}/, label: 'GITHUB_PAT_FINE', severity: SecretSeverity.CRITICAL },
+  { pattern: /\bey[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/, label: 'JWT_TOKEN', severity: SecretSeverity.CRITICAL },
+  
+  // GitHub access tokens (Updated for all token formats: ghp, gho, ghu, ghs, ghr, fine-grained)
+  { pattern: /\bgh[pousr]_[A-Za-z0-9]{36}\b/, label: 'GITHUB_TOKEN_CLASSIC', severity: SecretSeverity.CRITICAL },
+  { pattern: /\bgithub_pat_[A-Za-z0-9_]{82}\b/, label: 'GITHUB_PAT_FINE', severity: SecretSeverity.CRITICAL },
+  { pattern: /\bghs_[A-Za-z0-9\.\-_]{36,}\b/, label: 'GITHUB_APP_STATELESS_TOKEN', severity: SecretSeverity.CRITICAL }, // Supports the modern 2026 ghs_ JWT format
+
   // Stripe keys
-  { pattern: /sk_(live|test)_[A-Za-z0-9]{24,}/, label: 'STRIPE_SECRET_KEY', severity: SecretSeverity.CRITICAL },
-  { pattern: /pk_(live|test)_[A-Za-z0-9]{24,}/, label: 'STRIPE_PUBLIC_KEY', severity: SecretSeverity.HIGH },
-  // Slack tokens
-  { pattern: /xox[baprs]-[A-Za-z0-9-]{10,}/, label: 'SLACK_TOKEN', severity: SecretSeverity.CRITICAL },
-  // Discord tokens
-  { pattern: /[MN][A-Za-z0-9]{23}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27}/, label: 'DISCORD_TOKEN', severity: SecretSeverity.CRITICAL },
-  // Twilio SID
-  { pattern: /AC[a-f0-9]{32}/, label: 'TWILIO_SID', severity: SecretSeverity.HIGH },
+  { pattern: /\bsk_(live|test)_[A-Za-z0-9]{24,}\b/, label: 'STRIPE_SECRET_KEY', severity: SecretSeverity.CRITICAL },
+  { pattern: /\bpk_(live|test)_[A-Za-z0-9]{24,}\b/, label: 'STRIPE_PUBLIC_KEY', severity: SecretSeverity.HIGH },
+  
+  // Slack tokens & Webhooks
+  { pattern: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/, label: 'SLACK_TOKEN', severity: SecretSeverity.CRITICAL },
+  { pattern: /https:\/\/hooks\.slack\.com\/services\/T[A-Z0-9_]{8}\/B[A-Z0-9_]{8}\/[A-Za-z0-9_]{24}/, label: 'SLACK_WEBHOOK', severity: SecretSeverity.CRITICAL },
+
+  // Discord tokens & Webhooks
+  { pattern: /\b[MN][A-Za-z0-9]{23}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27}\b/, label: 'DISCORD_TOKEN', severity: SecretSeverity.CRITICAL },
+  { pattern: /https:\/\/discord\.com\/api\/webhooks\/[0-9]{18,20}\/[A-Za-z0-9_-]{68,}/, label: 'DISCORD_WEBHOOK', severity: SecretSeverity.CRITICAL },
+
+  // Twilio SID & Auth Token
+  { pattern: /\bAC[a-f0-9]{32}\b/, label: 'TWILIO_SID', severity: SecretSeverity.HIGH },
+  { pattern: /\b[a-f0-9]{32}\b/, label: 'TWILIO_AUTH_TOKEN_CANDIDATE', severity: SecretSeverity.MEDIUM }, // Twilio tokens are raw 32-char hex strings often found near SIDs
+
   // SendGrid API key
-  { pattern: /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/, label: 'SENDGRID_KEY', severity: SecretSeverity.CRITICAL },
-  // OpenAI API key
-  { pattern: /sk-[A-Za-z0-9]{32,}/, label: 'OPENAI_KEY', severity: SecretSeverity.CRITICAL },
-  // Generic UUID-like tokens that look like secrets (not just any UUID)
-  { pattern: /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/, label: 'UUID_SECRET_CANDIDATE', severity: SecretSeverity.MEDIUM },
-  // Google API Key
-  { pattern: /AIza[0-9A-Za-z\\-_]{35}/, label: 'GOOGLE_API_KEY', severity: SecretSeverity.CRITICAL },
-  // Firebase Web API Key
-  { pattern: /AIzaSy[0-9A-Za-z\\-_]{33}/, label: 'FIREBASE_API_KEY', severity: SecretSeverity.CRITICAL },
-];
+  { pattern: /\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b/, label: 'SENDGRID_KEY', severity: SecretSeverity.CRITICAL },
+  
+  // OpenAI & Anthropic API keys (Updated for Legacy, Project, and Claude token formats)
+  { pattern: /\bsk-[A-Za-z0-9]{32,}\b/, label: 'OPENAI_KEY_LEGACY', severity: SecretSeverity.CRITICAL },
+  { pattern: /\bsk-proj-[A-Za-z0-9-_]{40,}\b/, label: 'OPENAI_PROJECT_KEY', severity: SecretSeverity.CRITICAL },
+  { pattern: /\bsk-ant-sid01-[A-Za-z0-9-_]{93}\b/, label: 'ANTHROPIC_CLAUDE_KEY', severity: SecretSeverity.CRITICAL },
 
+  // Generic UUID-like tokens
+  { pattern: /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/i, label: 'UUID_SECRET_CANDIDATE', severity: SecretSeverity.MEDIUM },
+  
+  // Google & Firebase Key
+  { pattern: /\bAIza[0-9A-Za-z\\-_]{35}\b/, label: 'GOOGLE_API_KEY', severity: SecretSeverity.CRITICAL },
+  { pattern: /\bAIzaSy[0-9A-Za-z\\-_]{33}\b/, label: 'FIREBASE_API_KEY', severity: SecretSeverity.CRITICAL },
+
+  // Private Key Files (Detects multi-line PEM blocks often found inside JSON/Env variables)
+  { pattern: /-----BEGIN [A-Z ]+ PRIVATE KEY-----/, label: 'PRIVATE_KEY_BLOCK', severity: SecretSeverity.CRITICAL },
+];
 /**
  * Minimum length a string value must have to be considered a potential secret.
  * Short strings like "test", "dev", "localhost" are excluded.

package/src/index.js

@@ -7,7 +7,7 @@ import { CodeSmellAnalyzer } from './analyzers/CodeSmellAnalyzer.js';
 
 /**
  * ============================================================================
- * 📦 entkapp v4.6.0: Unified Architectural Refactoring Orchestrator
+ * 📦 entkapp v5.3.0: Unified Architectural Refactoring Orchestrator
  * ============================================================================
  * Main execution bridge managing multi-pass compilation cycles, semantic cross-linking,
  * supply-chain validation audits, and automated structural healing rollbacks.
@@ -64,6 +64,11 @@ export class RefactoringEngine {
     this.resolver = new DependencyResolver(this.context, this.pathMapper, this.workspaceGraph);
     this.circularDetector = new CircularDetector(this.context);
     
+    // Lazy import DependencyProfiler
+    import('./resolution/DependencyProfiler.js').then(({ DependencyProfiler }) => {
+      this.dependencyProfiler = new DependencyProfiler(this.context);
+    }).catch(() => {});
+    
     // Stage 3: Wire official AST Syntax parsers and framework processors
     this.analyzer = new ASTAnalyzer(this.context);
     this.oxcAnalyzer = new OxcAnalyzer(this.context);
@@ -115,6 +120,16 @@ export class RefactoringEngine {
       await this.workspaceGraph.initializeWorkspaceMesh();
       if (this.context.isWorkspaceEnabled) {
         console.log(ansis.dim('🌐 Monorepo workspace detected – mapping package mesh layers...'));
+        // Expose workspaceGraph on context for WorkspaceDiagnostic and other components
+        this.context.workspaceGraph = this.workspaceGraph;
+        // Reload PathMapper aliases now that workspace roots are known
+        await this.pathMapper.loadMappings(this.context.tsconfigFilename);
+        if (this.context.verbose) {
+          console.log(`[Workspace] Found ${this.workspaceGraph.packageManifests.size} workspace packages:`);
+          for (const [dir, manifest] of this.workspaceGraph.packageManifests.entries()) {
+            console.log(ansis.dim(`  • ${manifest.name || dir}`));
+          }
+        }
       }
 
       // UPGRADE: Always clear cache for fresh analysis run
@@ -141,6 +156,12 @@ export class RefactoringEngine {
       this.context.metrics.totalFilesScanned = fileList.length;
 
       // Identify meta-framework setups (Next.js, Remix, Nuxt, etc.)
+      if (this.dependencyProfiler) {
+        const usedDeps = await this.dependencyProfiler.traceImplicitInvocations(this.context.cwd);
+        for (const dep of usedDeps) {
+          this.context.usedExternalPackages.add(dep);
+        }
+      }
       const activeFrameworkEcosystems = await this.magicDetector.identifyActiveProjectEcosystems(this.context.cwd);
 
       // Separate explicit configuration packages out for targeted supply chain security checks
@@ -985,6 +1006,20 @@ export class RefactoringEngine {
         peerDependencies: Object.keys(data.peerDependencies || {}),
         optionalDependencies: Object.keys(data.optionalDependencies || {})
       });
+      
+      // Also register workspace manifests if not already done
+      if (this.context.isWorkspaceEnabled && this.workspaceGraph) {
+        for (const [dir, manifest] of this.workspaceGraph.packageManifests.entries()) {
+          if (!this.context.manifestDependencies.has(manifest.manifestPath)) {
+            this.context.manifestDependencies.set(manifest.manifestPath, {
+              dependencies: Object.keys(manifest.dependencies || {}),
+              devDependencies: Object.keys(manifest.devDependencies || {}),
+              peerDependencies: Object.keys(manifest.peerDependencies || {}),
+              optionalDependencies: Object.keys(manifest.optionalDependencies || {})
+            });
+          }
+        }
+      }
     } catch (e) {}
   }