flamerjs 0.0.0-stage → 0.1.6

package/dist/cli.js

@@ -0,0 +1,3308 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { writeFileSync, existsSync as existsSync3 } from "fs";
+import { resolve, basename } from "path";
+
+// src/util/fs.ts
+import {
+  readdirSync,
+  readFileSync,
+  statSync,
+  lstatSync,
+  existsSync as fsExists,
+  openSync,
+  readSync,
+  closeSync
+} from "fs";
+import { join, relative, extname, sep } from "path";
+var DEFAULT_IGNORE_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  "bower_components",
+  "jspm_packages",
+  ".pnpm-store",
+  ".yarn",
+  ".next",
+  ".nuxt",
+  ".svelte-kit",
+  ".astro",
+  ".docusaurus",
+  ".vercel",
+  ".netlify",
+  ".turbo",
+  ".parcel-cache",
+  ".angular",
+  ".vite",
+  "storybook-static",
+  "dist",
+  "build",
+  "out",
+  ".output",
+  ".git",
+  ".hg",
+  ".svn",
+  ".bzr",
+  "CVS",
+  ".idea",
+  ".vs",
+  ".vscode-test",
+  "coverage",
+  ".nyc_output",
+  "htmlcov",
+  ".tox",
+  ".nox",
+  ".pytest_cache",
+  ".mypy_cache",
+  ".ruff_cache",
+  ".hypothesis",
+  ".gradle",
+  ".m2",
+  ".dart_tool",
+  ".pub-cache",
+  "__pycache__",
+  ".venv",
+  "venv",
+  "env",
+  "virtualenv",
+  ".eggs",
+  "*.egg-info",
+  "site-packages",
+  ".Python",
+  "pip-wheel-metadata",
+  "target",
+  "vendor",
+  "Pods",
+  "DerivedData",
+  "bin",
+  "obj",
+  ".stack-work",
+  "cabal",
+  "_build",
+  "zig-cache",
+  "zig-out",
+  ".ccls-cache",
+  ".clangd",
+  ".terraform",
+  ".terragrunt-cache",
+  ".serverless",
+  ".pulumi",
+  "cdk.out",
+  "tmp",
+  "temp",
+  ".tmp",
+  ".cache",
+  ".sass-cache",
+  ".ipynb_checkpoints",
+  ".history",
+  ".yarn-backups",
+  ".eslintcache",
+  ".DS_Store",
+  "__snapshots__"
+]);
+var ALLOW_HIDDEN_DIRS = /* @__PURE__ */ new Set([
+  ".github",
+  ".gitlab",
+  ".circleci",
+  ".config",
+  ".husky",
+  ".changeset",
+  ".devcontainer",
+  ".claude",
+  ".cursor",
+  ".github-workflows",
+  ".cargo",
+  ".clion"
+]);
+var LOCKFILES = /* @__PURE__ */ new Set([
+  "package-lock.json",
+  "yarn.lock",
+  "pnpm-lock.yaml",
+  "bun.lockb",
+  "bun.lock",
+  "npm-shrinkwrap.json",
+  "deno.lock",
+  "composer.lock",
+  "Gemfile.lock",
+  "poetry.lock",
+  "Pipfile.lock",
+  "uv.lock",
+  "pdm.lock",
+  "Cargo.lock",
+  "go.sum",
+  "Gopkg.lock",
+  "mix.lock",
+  "flake.lock",
+  "gradle.lockfile",
+  "paket.lock",
+  "packages.lock.json",
+  "pubspec.lock",
+  "Podfile.lock",
+  "Package.resolved",
+  "packages.config",
+  "cabal.project.freeze",
+  "conan.lock",
+  ".terraform.lock.hcl",
+  "bun.lockb"
+]);
+var GENERATED_SUFFIXES = [
+  ".min.js",
+  ".min.css",
+  ".bundle.js",
+  ".chunk.js",
+  ".map",
+  ".lock",
+  ".pb.go",
+  "_pb2.py",
+  "_pb2_grpc.py",
+  ".designer.cs",
+  ".g.cs",
+  ".g.dart",
+  ".freezed.dart",
+  "_generated.go",
+  ".generated.ts",
+  ".gen.go",
+  ".d.ts"
+];
+function readText(file) {
+  try {
+    return readFileSync(file, "utf-8");
+  } catch {
+    return "";
+  }
+}
+function readJSON(file) {
+  try {
+    return JSON.parse(readFileSync(file, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function exists(p) {
+  try {
+    return fsExists(p);
+  } catch {
+    return false;
+  }
+}
+var existsSync = exists;
+function isDir(p) {
+  try {
+    return statSync(p).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function looksBinary(buf) {
+  const len = Math.min(buf.length, 4096);
+  if (len === 0) return false;
+  for (let i = 0; i < len; i++) {
+    if (buf[i] === 0) return true;
+  }
+  let control = 0;
+  for (let i = 0; i < len; i++) {
+    const b = buf[i];
+    if (b < 32 && b !== 9 && b !== 10 && b !== 13 && b !== 12) control++;
+  }
+  if (control / len > 0.1) return true;
+  const decoded = utf8Decoder.decode(buf.subarray(0, len));
+  if (!decoded.slice(0, -4).includes("\uFFFD")) return false;
+  let high = 0;
+  for (let i = 0; i < len; i++) {
+    if (buf[i] > 126) high++;
+  }
+  return high / len > 0.3;
+}
+var utf8Decoder = new TextDecoder("utf-8", { fatal: false });
+function readHead(file, bytes = 4096) {
+  let fd;
+  try {
+    fd = openSync(file, "r");
+    const buf = Buffer.alloc(bytes);
+    const read = readSync(fd, buf, 0, bytes, 0);
+    return buf.subarray(0, read);
+  } catch {
+    return Buffer.alloc(0);
+  } finally {
+    if (fd !== void 0) {
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    }
+  }
+}
+function safeStat(p) {
+  try {
+    return lstatSync(p);
+  } catch {
+    return null;
+  }
+}
+function rel(root, abs) {
+  return relative(root, abs).split(sep).join("/");
+}
+function isGeneratedName(name) {
+  const lower = name.toLowerCase();
+  if (GENERATED_SUFFIXES.some((s) => lower.endsWith(s))) return true;
+  if (/\.min\.(js|css)$/.test(lower)) return true;
+  if (/(^|[._-])(generated|gen|autogen|auto_gen|__generated__)([._-]|$)/.test(lower)) return true;
+  return false;
+}
+function walkTree(root, opts = {}) {
+  const {
+    extraIgnores = /* @__PURE__ */ new Set(),
+    followSymlinks = false,
+    onFile = () => {
+    },
+    onDir = () => {
+    }
+  } = opts;
+  const ignoreDirs = /* @__PURE__ */ new Set([...DEFAULT_IGNORE_DIRS, ...extraIgnores]);
+  const files = [];
+  const dirs = [];
+  let skippedBytes = 0;
+  const stack = [{ abs: root, rel: "", depth: 0 }];
+  while (stack.length) {
+    const { abs: dirAbs, rel: dirRel, depth } = stack.pop();
+    let entries;
+    try {
+      entries = readdirSync(dirAbs, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      const name = entry.name;
+      const abs = join(dirAbs, name);
+      const r = rel(root, abs);
+      const isHidden = name.startsWith(".");
+      let isDirectory = entry.isDirectory();
+      let isSymlink = entry.isSymbolicLink();
+      if (isSymlink) {
+        if (!followSymlinks) continue;
+        const st2 = safeStat(abs);
+        if (!st2) continue;
+        isDirectory = st2.isDirectory();
+        isSymlink = false;
+      }
+      if (isDirectory) {
+        if (ignoreDirs.has(name)) continue;
+        if (isHidden && !ALLOW_HIDDEN_DIRS.has(name)) continue;
+        dirs.push(r);
+        onDir(abs, name, r);
+        stack.push({ abs, rel: r, depth: depth + 1 });
+        continue;
+      }
+      if (!entry.isFile() && !isSymlink) continue;
+      if (isHidden && depth > 0 && !ALLOW_HIDDEN_DIRS.has(dirRel.split("/")[0])) {
+        const st2 = safeStat(abs);
+        if (st2) {
+          onFile({
+            abs,
+            path: abs,
+            rel: r,
+            name,
+            ext: extname(name),
+            size: st2.size,
+            depth,
+            hidden: true
+          });
+          files.push({ abs, rel: r, name, ext: extname(name), size: st2.size, depth, hidden: true });
+        }
+        continue;
+      }
+      const st = safeStat(abs);
+      if (!st || !st.isFile()) continue;
+      skippedBytes += st.size;
+      const rec = { abs, rel: r, name, ext: extname(name), size: st.size, depth, hidden: isHidden };
+      onFile(rec);
+      files.push(rec);
+    }
+  }
+  return { files, dirs, truncated: false, skippedBytes };
+}
+function subdirs(dir) {
+  try {
+    return readdirSync(dir, { withFileTypes: true }).filter((e) => (e.isDirectory() || e.isSymbolicLink()) && !e.name.startsWith(".")).map((e) => e.name);
+  } catch {
+    return [];
+  }
+}
+function filesIn(dir) {
+  try {
+    return readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile()).map((e) => e.name);
+  } catch {
+    return [];
+  }
+}
+
+// src/util/findings.ts
+var SEVERITIES = ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"];
+var RANK = Object.fromEntries(SEVERITIES.map((s, i) => [s, i]));
+var CATEGORIES = [
+  "security",
+  "secrets",
+  "deps",
+  "testing",
+  "bloat",
+  "hygiene",
+  "markers",
+  "vcs",
+  "config",
+  "build",
+  "script",
+  "structure",
+  "git",
+  "error",
+  "unfinished"
+];
+function rank(severity) {
+  const r = RANK[String(severity).toUpperCase()];
+  return r === void 0 ? SEVERITIES.length : r;
+}
+function finding(f) {
+  const severity = String(f.severity || "LOW").toUpperCase();
+  if (RANK[severity] === void 0) {
+    throw new Error(`Unknown severity "${f.severity}" (want one of ${SEVERITIES.join(", ")})`);
+  }
+  const category = f.category || "hygiene";
+  if (!CATEGORIES.includes(category)) {
+    throw new Error(`Unknown category "${f.category}" (want one of ${CATEGORIES.join(", ")})`);
+  }
+  return {
+    category,
+    severity,
+    title: f.title || "Untitled finding",
+    detail: f.detail || "",
+    ...f.files && f.files.length ? { files: dedupe(f.files).slice(0, 25) } : {},
+    ...f.count !== void 0 ? { count: f.count } : {},
+    ...f.evidence !== void 0 ? { evidence: f.evidence } : {},
+    ...f.lang ? { lang: f.lang } : {}
+  };
+}
+function dedupe(arr) {
+  return [...new Set(arr)];
+}
+function sortFindings(findings) {
+  return [...findings].sort(
+    (a, b) => rank(a.severity) - rank(b.severity) || a.category.localeCompare(b.category) || a.title.localeCompare(b.title)
+  );
+}
+function severityTally(findings) {
+  const tally = Object.fromEntries(SEVERITIES.map((s) => [s, 0]));
+  for (const f of findings) tally[f.severity] = (tally[f.severity] || 0) + 1;
+  return tally;
+}
+function worstSeverity(findings) {
+  let worst = null;
+  for (const f of findings) {
+    if (worst === null || rank(f.severity) < rank(worst)) worst = f.severity;
+  }
+  return worst;
+}
+
+// src/detect.ts
+import { join as join2 } from "path";
+import { existsSync as existsSync2 } from "fs";
+
+// src/registry.ts
+var LANGUAGES = [
+  {
+    id: "javascript",
+    label: "JavaScript",
+    exts: [".js", ".jsx", ".mjs", ".cjs"],
+    filenames: ["package.json"],
+    comment: { line: "//", block: [["/*", "*/"]] },
+    bloat: { soft: 300, hard: 700 },
+    tests: [/\.(test|spec)\.(js|jsx|mjs|cjs)$/, /(^|\/)__tests__\//, /(^|\/)test(s)?\//],
+    manifests: ["package.json"],
+    linters: [
+      ".eslintrc",
+      ".eslintrc.js",
+      ".eslintrc.json",
+      ".eslintrc.cjs",
+      "eslint.config.js",
+      "eslint.config.mjs",
+      "biome.json"
+    ],
+    lockfiles: ["package-lock.json", "yarn.lock", "pnpm-lock.yaml", "bun.lockb"]
+  },
+  {
+    id: "typescript",
+    label: "TypeScript",
+    exts: [".ts", ".tsx", ".mts", ".cts"],
+    filenames: ["tsconfig.json"],
+    comment: { line: "//", block: [["/*", "*/"]] },
+    bloat: { soft: 300, hard: 700 },
+    tests: [/\.(test|spec)\.(ts|tsx|mts|cts)$/, /(^|\/)__tests__\//],
+    manifests: ["tsconfig.json"],
+    linters: ["tsconfig.json"],
+    lockfiles: ["package-lock.json", "yarn.lock", "pnpm-lock.yaml", "bun.lockb"]
+  },
+  {
+    id: "python",
+    label: "Python",
+    exts: [".py", ".pyi", ".pyw"],
+    filenames: [
+      "pyproject.toml",
+      "setup.py",
+      "setup.cfg",
+      "requirements.txt",
+      "Pipfile",
+      "poetry.lock"
+    ],
+    comment: { line: "#", block: [] },
+    bloat: { soft: 400, hard: 900 },
+    tests: [/(^|\/)tests?\//, /(^|\/)test_.*\.py$/, /_test\.py$/, /(^|\/)conftest\.py$/],
+    manifests: ["pyproject.toml", "setup.py", "requirements.txt", "Pipfile", "setup.cfg"],
+    linters: [".flake8", "ruff.toml", ".ruff.toml", "mypy.ini", ".pylintrc", "pyproject.toml"],
+    lockfiles: ["poetry.lock", "Pipfile.lock", "uv.lock", "requirements.lock", "pdm.lock"]
+  },
+  {
+    id: "rust",
+    label: "Rust",
+    exts: [".rs"],
+    filenames: ["Cargo.toml", "Cargo.lock", "rust-toolchain.toml", "clippy.toml", "rustfmt.toml"],
+    comment: { line: "//", block: [["/*", "*/"]] },
+    bloat: { soft: 450, hard: 1e3 },
+    tests: [/(^|\/)tests?\//, /_test\.rs$/, /\/tests\/.*\.rs$/],
+    manifests: ["Cargo.toml"],
+    linters: ["clippy.toml", "rustfmt.toml", ".rustfmt.toml", "deny.toml"],
+    lockfiles: ["Cargo.lock"]
+  },
+  {
+    id: "go",
+    label: "Go",
+    exts: [".go"],
+    filenames: ["go.mod", "go.sum", "go.work"],
+    comment: { line: "//", block: [["/*", "*/"]] },
+    bloat: { soft: 450, hard: 900 },
+    tests: [/_test\.go$/, /(^|\/)tests?\//],
+    manifests: ["go.mod", "go.work"],
+    linters: [".golangci.yml", ".golangci.yaml", "golangci.yml"],
+    lockfiles: ["go.sum"]
+  },
+  {
+    id: "c",
+    label: "C",
+    exts: [".c", ".h"],
+    filenames: ["Makefile", "makefile", "CMakeLists.txt", "meson.build", "configure.ac"],
+    comment: { line: "//", block: [["/*", "*/"]] },
+    bloat: { soft: 500, hard: 1200 },
+    tests: [/(^|\/)tests?\//, /(^|\/)test_[^/]+\.c$/, /_test\.c$/],
+    manifests: ["Makefile", "CMakeLists.txt", "meson.build", "configure.ac"],
+    linters: [".clang-format", ".clang-tidy", ".editorconfig"],
+    lockfiles: ["conan.lock", "conanfile.txt"]
+  },
+  {
+    id: "cpp",
+    label: "C++",
+    exts: [".cpp", ".cc", ".cxx", ".hpp", ".hh", ".hxx", ".ipp", ".tpp", ".mm"],
+    filenames: ["CMakeLists.txt"],
+    comment: { line: "//", block: [["/*", "*/"]] },
+    bloat: { soft: 500, hard: 1200 },
+    tests: [/(^|\/)tests?\//, /_test\.cc$|test.*\.cpp$/],
+    manifests: ["CMakeLists.txt", "meson.build"],
+    linters: [".clang-format", ".clang-tidy"],
+    lockfiles: ["conan.lock"]
+  },
+  {
+    id: "csharp",
+    label: "C#",
+    exts: [".cs", ".csx", ".vb", ".fs"],
+    // .editorconfig is deliberately absent: it is not tied to one ecosystem and would
+    // make every repo that has one look like a C# project.
+    filenames: ["global.json", "Directory.Build.props"],
+    comment: { line: "//", block: [["/*", "*/"]] },
+    bloat: { soft: 400, hard: 900 },
+    tests: [/\.Tests?\/.*\.cs$/, /(^|\/)tests?\//, /Tests\.cs$/],
+    manifests: [".sln", "global.json"],
+    linters: [".editorconfig", "stylecop.json", ".globalconfig"],
+    lockfiles: ["packages.lock.json"]
+  },
+  {
+    id: "java",
+    label: "Java / JVM",
+    exts: [".java", ".kt", ".kts", ".scala", ".sc", ".groovy", ".clj", ".cljs"],
+    filenames: ["pom.xml", "build.gradle", "build.gradle.kts", "settings.gradle"],
+    comment: { line: "//", block: [["/*", "*/"]] },
+    bloat: { soft: 450, hard: 1e3 },
+    tests: [/(^|\/)src\/test\//, /(^|\/)tests?\//, /Test\.java$|Tests\.kt$/],
+    manifests: ["pom.xml", "build.gradle", "build.gradle.kts"],
+    linters: ["checkstyle.xml", "spotbugs-exclude.xml", "ktlint", ".editorconfig"],
+    lockfiles: ["gradle.lockfile", "pom.xml"]
+  },
+  {
+    id: "ruby",
+    label: "Ruby",
+    exts: [".rb", ".rake", ".gemspec"],
+    filenames: ["Gemfile", "Gemfile.lock", "Rakefile", ".ruby-version"],
+    comment: { line: "#", block: [] },
+    bloat: { soft: 350, hard: 800 },
+    tests: [/(^|\/)spec\//, /_spec\.rb$/, /(^|\/)test(s)?\//],
+    manifests: ["Gemfile", "*.gemspec"],
+    linters: [".rubocop.yml", ".standard.yml"],
+    lockfiles: ["Gemfile.lock"]
+  },
+  {
+    id: "php",
+    label: "PHP",
+    exts: [".php", ".phtml"],
+    filenames: ["composer.json", "composer.lock", "artisan", "phpunit.xml"],
+    comment: {
+      line: "//",
+      block: [
+        ["/*", "*/"],
+        ["#", "#"]
+      ]
+    },
+    bloat: { soft: 450, hard: 1e3 },
+    tests: [/(^|\/)tests?\//, /Test\.php$/],
+    manifests: ["composer.json"],
+    linters: ["phpcs.xml", "phpcs.xml.dist", ".php-cs-fixer.php", "phpstan.neon"],
+    lockfiles: ["composer.lock"]
+  },
+  {
+    id: "shell",
+    label: "Shell",
+    exts: [".sh", ".bash", ".zsh", ".fish", ".ksh"],
+    filenames: [],
+    comment: { line: "#", block: [] },
+    bloat: { soft: 250, hard: 600 },
+    tests: [/(^|\/)tests?\//, /\.bats$/, /\.shspec$/],
+    manifests: [],
+    linters: [".shellcheckrc", ".editorconfig"],
+    lockfiles: []
+  },
+  {
+    id: "powershell",
+    label: "PowerShell",
+    exts: [".ps1", ".psm1", ".psd1"],
+    filenames: [],
+    comment: { line: "#", block: [["<#", "#>"]] },
+    bloat: { soft: 300, hard: 700 },
+    tests: [/\.Tests\.ps1$/, /(^|\/)tests?\//],
+    manifests: [],
+    linters: ["PSScriptAnalyzerSettings.psd1", ".editorconfig"],
+    lockfiles: []
+  },
+  {
+    id: "sql",
+    label: "SQL",
+    exts: [".sql", ".ddl", ".dml"],
+    filenames: [],
+    comment: { line: "--", block: [["/*", "*/"]] },
+    bloat: { soft: 600, hard: 1500 },
+    tests: [/(^|\/)tests?\//, /_test\.sql$/],
+    manifests: [],
+    linters: [".sqlfluff", ".editorconfig"],
+    lockfiles: []
+  },
+  {
+    id: "terraform",
+    label: "Terraform / HCL",
+    exts: [".tf", ".tfvars", ".hcl"],
+    filenames: [".terraformrc", "terragrunt.hcl", "Chart.yaml", "values.yaml"],
+    comment: { line: "#", block: [["/*", "*/"]] },
+    bloat: { soft: 300, hard: 700 },
+    tests: [/(^|\/)tests?\//, /_test\.go$/, /\.tftest\.hcl$/],
+    manifests: ["main.tf", "versions.tf", "providers.tf"],
+    linters: [".tflint.hcl", ".checkov.yaml", ".pre-commit-config.yaml"],
+    lockfiles: [".terraform.lock.hcl"]
+  },
+  {
+    id: "docker",
+    label: "Docker",
+    exts: [".dockerfile"],
+    filenames: ["Dockerfile", "docker-compose.yml", "docker-compose.yaml", ".dockerignore"],
+    comment: { line: "#", block: [] },
+    bloat: { soft: 120, hard: 300 },
+    tests: [],
+    manifests: ["Dockerfile", "docker-compose.yml", "docker-compose.yaml"],
+    linters: [".hadolint.yaml", ".dockerignore"],
+    lockfiles: []
+  },
+  {
+    id: "notebook",
+    label: "Jupyter Notebook",
+    exts: [".ipynb"],
+    filenames: [],
+    comment: { line: "#", block: [] },
+    bloat: { soft: 400, hard: 1200 },
+    tests: [],
+    manifests: [],
+    linters: [],
+    lockfiles: []
+  },
+  {
+    id: "swift",
+    label: "Swift / Apple",
+    exts: [".swift"],
+    filenames: ["Package.swift", "Podfile"],
+    comment: { line: "//", block: [["/*", "*/"]] },
+    bloat: { soft: 400, hard: 900 },
+    tests: [/(^|\/)Tests?\//, /Tests\.swift$/],
+    manifests: ["Package.swift", "Podfile"],
+    linters: [".swiftlint.yml", ".swiftformat"],
+    lockfiles: ["Podfile.lock", "Package.resolved"]
+  },
+  {
+    id: "dart",
+    label: "Dart / Flutter",
+    exts: [".dart"],
+    filenames: ["pubspec.yaml", "analysis_options.yaml"],
+    comment: { line: "//", block: [["/*", "*/"]] },
+    bloat: { soft: 400, hard: 900 },
+    tests: [/(^|\/)test\//, /_test\.dart$/],
+    manifests: ["pubspec.yaml"],
+    linters: ["analysis_options.yaml"],
+    lockfiles: ["pubspec.lock"]
+  },
+  {
+    id: "haskell",
+    label: "Haskell",
+    exts: [".hs", ".lhs"],
+    filenames: ["stack.yaml", "*.cabal", "cabal.project"],
+    comment: { line: "--", block: [["{-", "-}"]] },
+    bloat: { soft: 300, hard: 700 },
+    tests: [/(^|\/)test(s)?\//, /Spec\.hs$/, /\/test\/.*\.hs$/],
+    manifests: ["stack.yaml", "cabal.project", "*.cabal"],
+    linters: [".hlint.yaml", "fourmolu.yaml"],
+    lockfiles: ["cabal.project.freeze", "flake.lock"]
+  },
+  {
+    id: "elixir",
+    label: "Elixir",
+    exts: [".ex", ".exs", ".eex", ".heex"],
+    filenames: ["mix.exs", "mix.lock"],
+    comment: { line: "#", block: [] },
+    bloat: { soft: 300, hard: 700 },
+    tests: [/(^|\/)test\//, /_test\.exs?$/],
+    manifests: ["mix.exs"],
+    linters: [".credo.exs", ".formatter.exs"],
+    lockfiles: ["mix.lock"]
+  },
+  {
+    id: "lua",
+    label: "Lua",
+    exts: [".lua"],
+    filenames: [".luacheckrc", "*.rockspec"],
+    comment: { line: "--", block: [["--[[", "]]"]] },
+    bloat: { soft: 300, hard: 700 },
+    tests: [/(^|\/)spec\//, /_spec\.lua$/],
+    manifests: ["*.rockspec"],
+    linters: [".luacheckrc"],
+    lockfiles: []
+  },
+  {
+    id: "r",
+    label: "R",
+    exts: [".r", ".rmd"],
+    filenames: ["DESCRIPTION", "renv.lock"],
+    comment: { line: "#", block: [] },
+    bloat: { soft: 400, hard: 900 },
+    tests: [/(^|\/)tests?\//, /testthat\.R$/, /_test\.R$/],
+    manifests: ["DESCRIPTION"],
+    linters: [".lintr", "renv.lock"],
+    lockfiles: ["renv.lock"]
+  },
+  {
+    id: "solidity",
+    label: "Solidity",
+    exts: [".sol"],
+    filenames: ["hardhat.config.js", "hardhat.config.ts", "foundry.toml"],
+    comment: { line: "//", block: [["/*", "*/"]] },
+    bloat: { soft: 400, hard: 900 },
+    tests: [/\.t\.sol$/, /(^|\/)test\//],
+    manifests: ["foundry.toml", "hardhat.config.js"],
+    linters: ["solhint.json", ".solhint.json"],
+    lockfiles: ["pnpm-lock.yaml", "package-lock.json"]
+  },
+  {
+    id: "zig",
+    label: "Zig",
+    exts: [".zig"],
+    filenames: ["build.zig", "build.zig.zon"],
+    comment: { line: "//", block: [] },
+    bloat: { soft: 400, hard: 900 },
+    tests: [/(^|\/)test\//],
+    manifests: ["build.zig"],
+    linters: [],
+    lockfiles: ["build.zig.zon"]
+  }
+];
+var EXT_MAP = (() => {
+  const map = /* @__PURE__ */ new Map();
+  for (const lang of LANGUAGES) {
+    for (const ext of lang.exts) {
+      if (!map.has(ext)) map.set(ext, lang.id);
+    }
+  }
+  return map;
+})();
+var FILENAME_MAP = (() => {
+  const map = /* @__PURE__ */ new Map();
+  for (const lang of LANGUAGES) {
+    for (const name of lang.filenames) {
+      const key = name.toLowerCase();
+      if (!map.has(key)) map.set(key, lang.id);
+    }
+  }
+  return map;
+})();
+function matchLang(relPath) {
+  const dot = relPath.lastIndexOf(".");
+  const slash = relPath.lastIndexOf("/");
+  if (dot > slash && dot !== -1) {
+    const ext = relPath.slice(dot).toLowerCase();
+    const id2 = EXT_MAP.get(ext);
+    if (id2) return { lang: LANGUAGES.find((l) => l.id === id2), via: "ext" };
+  }
+  const base = relPath.slice(relPath.lastIndexOf("/") + 1).toLowerCase();
+  const id = FILENAME_MAP.get(base);
+  if (id) return { lang: LANGUAGES.find((l) => l.id === id), via: "filename" };
+  return { lang: null, via: null };
+}
+function languageById(id) {
+  return LANGUAGES.find((l) => l.id === id) || null;
+}
+function allExtensions() {
+  return [...EXT_MAP.keys()].sort();
+}
+
+// src/detect.ts
+var MONOREPO_DIRS = [
+  "packages",
+  "apps",
+  "services",
+  "libs",
+  "modules",
+  "crates",
+  "cmd",
+  "internal",
+  "projects",
+  "components",
+  "plugins",
+  "extensions",
+  "workers"
+];
+var WORKSPACE_MARKERS = [
+  "pnpm-workspace.yaml",
+  "lerna.json",
+  "nx.json",
+  "turbo.json",
+  "rush.json",
+  "go.work",
+  "Cargo.toml",
+  "package.json",
+  "pom.xml",
+  "settings.gradle",
+  "build.gradle",
+  "build.gradle.kts",
+  "pyproject.toml",
+  "mix.exs",
+  "flake.nix",
+  "stack.yaml",
+  "dune-project",
+  "melange.yaml",
+  "pubspec.yaml",
+  "Package.swift"
+];
+var SCOPE_MANIFESTS = /* @__PURE__ */ new Set([
+  "package.json",
+  "Cargo.toml",
+  "go.mod",
+  "pyproject.toml",
+  "setup.py",
+  "requirements.txt",
+  "Pipfile",
+  "composer.json",
+  "Gemfile",
+  "pom.xml",
+  "build.gradle",
+  "build.gradle.kts",
+  "mix.exs",
+  "pubspec.yaml",
+  "Package.swift",
+  "CMakeLists.txt",
+  "Makefile",
+  "deno.json",
+  "build.zig",
+  "Package.resolved"
+]);
+function isScopeDir(abs) {
+  const names = filesIn(abs);
+  for (const n of names) {
+    if (SCOPE_MANIFESTS.has(n)) return true;
+    if (n === ".csproj" || n === ".sln") return true;
+    if (n.endsWith(".csproj") || n.endsWith(".fsproj") || n.endsWith(".vbproj")) return true;
+  }
+  return false;
+}
+function describeScope(name, relPath, abs) {
+  const names = filesIn(abs);
+  const manifests2 = names.filter(
+    (n) => SCOPE_MANIFESTS.has(n) || /\.(csproj|sln|fsproj|vbproj)$/.test(n)
+  );
+  const lockfiles = names.filter((n) => LOCKFILES.has(n));
+  return {
+    name,
+    path: relPath,
+    abs,
+    isRoot: relPath === "",
+    manifests: manifests2,
+    lockfiles
+  };
+}
+function detectScopes(root) {
+  const scopes = [describeScope("", "", root)];
+  const found = /* @__PURE__ */ new Map();
+  for (const dir of MONOREPO_DIRS) {
+    const abs = join2(root, dir);
+    if (!isDir(abs)) continue;
+    for (const child of subdirs(abs)) {
+      const childAbs = join2(abs, child);
+      if (!isScopeDir(childAbs)) continue;
+      const relPath = `${dir}/${child}`;
+      if (!found.has(relPath)) {
+        found.set(relPath, describeScope(child, relPath, childAbs));
+      }
+    }
+  }
+  for (const child of subdirs(root)) {
+    if (MONOREPO_DIRS.includes(child)) continue;
+    const childAbs = join2(root, child);
+    if (isScopeDir(childAbs)) {
+      const relPath = child;
+      if (!found.has(relPath)) found.set(relPath, describeScope(child, relPath, childAbs));
+    }
+  }
+  const nonRoot = [...found.values()];
+  const workspaceMarker = WORKSPACE_MARKERS.some((m) => existsSync2(join2(root, m)));
+  const all = [scopes[0], ...nonRoot];
+  let layout = "flat";
+  if (nonRoot.length > 0) layout = "monorepo";
+  else if (workspaceMarker) layout = "single";
+  return { layout, scopes: all };
+}
+function langsFromManifest(name) {
+  const switchName = name;
+  if (switchName === "package.json") return ["javascript"];
+  if (switchName === "tsconfig.json") return ["typescript"];
+  if (switchName === "Cargo.toml") return ["rust"];
+  if (switchName === "go.mod" || switchName === "go.work") return ["go"];
+  if (["pyproject.toml", "setup.py", "requirements.txt", "Pipfile", "setup.cfg"].includes(switchName))
+    return ["python"];
+  if (["composer.json"].includes(switchName)) return ["php"];
+  if (["Gemfile"].includes(switchName)) return ["ruby"];
+  if (["pom.xml", "build.gradle", "build.gradle.kts", "settings.gradle"].includes(switchName))
+    return ["java"];
+  if (["mix.exs"].includes(switchName)) return ["elixir"];
+  if (["pubspec.yaml"].includes(switchName)) return ["dart"];
+  if (["Package.swift"].includes(switchName)) return ["swift"];
+  if (["build.zig"].includes(switchName)) return ["zig"];
+  if (["CMakeLists.txt"].includes(switchName)) return ["c", "cpp"];
+  if (["Makefile", "makefile"].includes(switchName)) return ["c", "cpp"];
+  if (["Dockerfile", "docker-compose.yml", "docker-compose.yaml"].includes(switchName))
+    return ["docker"];
+  if (name.endsWith(".csproj") || name.endsWith(".sln") || name.endsWith(".fsproj") || name.endsWith(".vbproj"))
+    return ["csharp"];
+  if (name.endsWith(".cabal") || name === "stack.yaml") return ["haskell"];
+  if (name === "DESCRIPTION") return ["r"];
+  if (name.endsWith(".rockspec")) return ["ruby"];
+  if (name === "meson.build" || name === "configure.ac") return ["c", "cpp"];
+  if (name === "foundry.toml" || name === "hardhat.config.js" || name === "hardhat.config.ts")
+    return ["solidity"];
+  return [];
+}
+function buildProfile(root, detected, files = []) {
+  const ecosystemLangs = /* @__PURE__ */ new Set();
+  for (const scope of detected.scopes) {
+    for (const manifest of scope.manifests) {
+      for (const id of langsFromManifest(manifest)) ecosystemLangs.add(id);
+    }
+    for (const lock of scope.lockfiles) {
+      const id = langsFromManifest(lock);
+      if (id.length) ecosystemLangs.add(id[0]);
+    }
+  }
+  const counts = /* @__PURE__ */ new Map();
+  for (const f of files) {
+    if (!f.lang) continue;
+    if (f.langVia && f.langVia !== "ext") continue;
+    counts.set(f.lang, (counts.get(f.lang) || 0) + 1);
+  }
+  const sourceLangs = new Set(counts.keys());
+  const allLangs = /* @__PURE__ */ new Set([...ecosystemLangs, ...sourceLangs]);
+  const languages = [...allLangs].map((id) => languageById(id)).filter(Boolean).map((l) => ({ id: l.id, label: l.label }));
+  let dominant = null;
+  let best = 0;
+  for (const [id, n] of counts) {
+    if (n > best) {
+      best = n;
+      dominant = id;
+    }
+  }
+  const tooling = {
+    hasGitignore: existsSync2(join2(root, ".gitignore")),
+    hasReadme: filesIn(root).some((f) => /^readme(\.|$)/i.test(f)),
+    hasLicense: filesIn(root).some((f) => /^(licen[sc]e|copying)(\.|$)/i.test(f)),
+    hasEditorconfig: existsSync2(join2(root, ".editorconfig")),
+    hasPreCommit: existsSync2(join2(root, ".pre-commit-config.yaml")) || isDir(join2(root, ".husky")),
+    hasCi: isDir(join2(root, ".github", "workflows")) || existsSync2(join2(root, ".gitlab-ci.yml")) || isDir(join2(root, ".circleci")),
+    hasDocker: existsSync2(join2(root, "Dockerfile")) || filesIn(root).some((f) => /^Dockerfile\./.test(f)) || existsSync2(join2(root, "docker-compose.yml")),
+    hasEnvExample: filesIn(root).some(
+      (f) => f === ".env.example" || f === ".env.sample" || f === ".env.template"
+    ),
+    hasEnv: existsSync2(join2(root, ".env")),
+    isPython: ecosystemLangs.has("python"),
+    isNode: ecosystemLangs.has("javascript") || ecosystemLangs.has("typescript"),
+    isRust: ecosystemLangs.has("rust"),
+    isGo: ecosystemLangs.has("go"),
+    isDotnet: ecosystemLangs.has("csharp"),
+    isTerraform: ecosystemLangs.has("terraform")
+  };
+  return {
+    layout: detected.layout,
+    scopes: detected.scopes,
+    languages,
+    dominantLanguage: dominant,
+    ecosystemLangs: [...ecosystemLangs],
+    tooling
+  };
+}
+function projectKind(profile) {
+  const t = profile.tooling;
+  const kinds = [];
+  if (t.isNode) kinds.push("node");
+  if (t.isPython) kinds.push("python");
+  if (t.isRust) kinds.push("rust");
+  if (t.isGo) kinds.push("go");
+  if (t.isDotnet) kinds.push("dotnet");
+  if (t.isTerraform) kinds.push("terraform");
+  if (profile.dominantLanguage === "notebook") kinds.push("notebook");
+  if (kinds.length === 0 && profile.dominantLanguage) kinds.push(profile.dominantLanguage);
+  if (kinds.length === 0) kinds.push("unknown");
+  return kinds;
+}
+
+// src/scan.ts
+var MAX_CONTENT_BYTES = 2 * 1024 * 1024;
+var MAX_SCAN_BYTES = 512 * 1024;
+var MARKER_KEYWORDS = ["TODO", "FIXME", "HACK", "XXX", "BUG", "OPTIMIZE", "REVIEW"];
+var MARKER_RE = /\b(TODO|FIXME|HACK|XXX|BUG|OPTIMIZE|REVIEW)\b/g;
+var SECRET_ASSIGNMENT_NAMES = [
+  "api[_-]?key",
+  "apikey",
+  "secret",
+  "passwd",
+  "password",
+  "token",
+  "access[_-]?key",
+  "private[_-]?key",
+  "client[_-]?secret",
+  "auth[_-]?token"
+];
+var SECRET_ASSIGNMENT_RE = new RegExp(
+  "\\b(?:" + SECRET_ASSIGNMENT_NAMES.join("|") + ")\\b\\s*[:=]\\s*[\"'`]([^\"'`\\s]{12,})[\"'`]",
+  "gi"
+);
+var SECRET_PATTERNS = [
+  {
+    kind: "AWS access key id",
+    re: /\b(A3T[A-Z0-9]|AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ABIA|ACCA)[A-Z0-9]{16}\b/g,
+    group: 0,
+    prefilter: [
+      "A3T",
+      "AKIA",
+      "ASIA",
+      "AGPA",
+      "AIDA",
+      "AROA",
+      "AIPA",
+      "ANPA",
+      "ANVA",
+      "ABIA",
+      "ACCA"
+    ]
+  },
+  {
+    kind: "private key block",
+    re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----/g,
+    group: 0,
+    prefilter: ["-----BEGIN"]
+  },
+  {
+    kind: "GitHub token",
+    re: /\bgh[pousr]_[A-Za-z0-9]{36,255}\b/g,
+    group: 0,
+    prefilter: ["ghp_", "gho_", "ghu_", "ghs_", "ghr_"]
+  },
+  { kind: "Slack token", re: /\bxox[abposr]-[A-Za-z0-9-]{10,}\b/g, group: 0, prefilter: ["xox"] },
+  {
+    kind: "Stripe key",
+    re: /\b[sr]k_(?:live|test)_[A-Za-z0-9]{20,}\b/g,
+    group: 0,
+    prefilter: ["_live_", "_test_"]
+  },
+  { kind: "Google API key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g, group: 0, prefilter: ["AIza"] },
+  {
+    kind: "OpenAI-style key",
+    re: /\bsk-(?:proj-)?[A-Za-z0-9_-]{32,}\b/g,
+    group: 0,
+    prefilter: ["sk-"]
+  },
+  {
+    kind: "Anthropic API key",
+    re: /\bsk-ant-[A-Za-z0-9_-]{32,}\b/g,
+    group: 0,
+    prefilter: ["sk-ant-"]
+  },
+  { kind: "npm token", re: /\bnpm_[A-Za-z0-9]{36}\b/g, group: 0, prefilter: ["npm_"] },
+  { kind: "PyPI token", re: /\bpypi-[A-Za-z0-9_-]{16,}\b/g, group: 0, prefilter: ["pypi-"] },
+  {
+    kind: "JSON Web Token",
+    re: /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g,
+    group: 0,
+    prefilter: ["eyJ"]
+  },
+  {
+    kind: "connection string with password",
+    re: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|mssql):\/\/[^\s:@/]+:[^\s:@/]{3,}@/g,
+    group: 0,
+    prefilter: ["://"]
+  },
+  { kind: "hardcoded secret assignment", re: SECRET_ASSIGNMENT_RE, group: 1 },
+  {
+    kind: "bearer token",
+    re: /\bBearer\s+[A-Za-z0-9._~+/-]{24,}={0,2}\b/g,
+    group: 0,
+    prefilter: ["Bearer"]
+  }
+];
+var PLACEHOLDERS = /* @__PURE__ */ new Set([
+  "your_api_key",
+  "yourapikey",
+  "api_key_here",
+  "changeme",
+  "change_me",
+  "replace_me",
+  "xxxxxxxxxxxx",
+  "your-token-here",
+  "placeholder",
+  "example",
+  "dummy",
+  "todo",
+  "insert_key_here",
+  "your-secret-here",
+  "none",
+  "null",
+  "test",
+  "fake",
+  "your_password",
+  "password_here",
+  "not_a_real_key"
+]);
+var SECRET_EXEMPT_PATHS = [
+  /(^|\/)(test|tests|spec|specs|__tests__|__mocks__|fixtures?|mocks?|examples?|samples?|e2e|testdata|golden)(\/|$)/i,
+  // A test file that sits alongside the source: foo.test.ts, foo.spec.js,
+  // foo_test.go, test_foo.py. These are not under a tests/ directory, so the
+  // rule above misses them. A secret scanner is exactly the kind of tool whose
+  // fixtures hold fake credentials, and reporting those trains people to
+  // ignore the real findings.
+  /\.(test|spec)\.[a-z0-9]+$/i,
+  /(^|\/)(test_[^/]+|[^/]+_test)\.[a-z0-9]+$/i,
+  /\.(example|sample|template|dist)$/i,
+  /(^|\/)(seed|seeds|dev-?seed)\w*\.[a-z0-9]+$/i,
+  /\.lock$/i,
+  /(^|\/)(CHANGELOG|HISTORY|NEWS|README|CONTRIBUTING)(\.|$)/i
+];
+var CONFLICT_RE = /^(<{7}|={7}|>{7})(?: |$)/;
+var SHEBANG_RE = /^#!\s*\/[^\n]*/;
+var UNFINISHED_PATTERNS = [
+  {
+    kind: "not-implemented error",
+    re: /\b(?:throw\s+new\s+Error|raise\s+NotImplementedError)\s*\(\s*["'`](?:not implemented|not implemented yet|todo|coming soon)[^"'`]*["'`]\s*\)/i
+  },
+  {
+    kind: "empty error handler",
+    re: /\bcatch\s*(?:\([^)]*\))?\s*\{\s*\}/
+  }
+];
+function isSecretExempt(rel2) {
+  return SECRET_EXEMPT_PATHS.some((re) => re.test(rel2));
+}
+function extractMarkers(text, spec) {
+  const out = [];
+  if (!spec || !spec.line) return out;
+  const linePrefix = spec.line;
+  const n = text.length;
+  let i = 0;
+  let lineNo = 1;
+  let inLine = false;
+  let inBlock = -1;
+  let inString = null;
+  let blockStartLine = 0;
+  let commentText = "";
+  const emit = (body, baseLine) => {
+    MARKER_RE.lastIndex = 0;
+    let m;
+    while ((m = MARKER_RE.exec(body)) !== null) {
+      let line = baseLine;
+      for (let k = 0; k < m.index; k++) if (body.charCodeAt(k) === 10) line++;
+      out.push({ type: m[1], line, text: body.slice(m.index, m.index + 80).trim() });
+    }
+  };
+  while (i < n) {
+    const ch = text[i];
+    if (ch === "\n") {
+      if (inLine) {
+        emit(commentText, lineNo);
+        inLine = false;
+        commentText = "";
+      } else if (inBlock !== -1) {
+        commentText += "\n";
+      }
+      lineNo++;
+      i++;
+      continue;
+    }
+    if (inLine) {
+      commentText += ch;
+      i++;
+      continue;
+    }
+    if (inBlock !== -1) {
+      const [, close] = spec.block[inBlock];
+      if (text.startsWith(close, i)) {
+        emit(commentText, blockStartLine);
+        commentText = "";
+        inBlock = -1;
+        i += close.length;
+        continue;
+      }
+      commentText += ch;
+      i++;
+      continue;
+    }
+    if (inString) {
+      if (ch === "\\") {
+        i += 2;
+        continue;
+      }
+      if (ch === inString) inString = null;
+      i++;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      inString = ch;
+      i++;
+      continue;
+    }
+    if (text.startsWith(linePrefix, i)) {
+      inLine = true;
+      commentText = linePrefix;
+      i += linePrefix.length;
+      continue;
+    }
+    if (ch !== " " && ch !== "	") {
+      const idx = (spec.block || []).findIndex((b) => text.startsWith(b[0], i));
+      if (idx !== -1) {
+        const open = spec.block[idx][0];
+        inBlock = idx;
+        blockStartLine = lineNo;
+        commentText = open;
+        i += open.length;
+        continue;
+      }
+    }
+    i++;
+  }
+  if (inLine) emit(commentText, lineNo);
+  else if (inBlock !== -1) emit(commentText, blockStartLine);
+  return out;
+}
+function redact(match) {
+  if (match.length <= 8) return "*".repeat(match.length);
+  return `${match.slice(0, 4)}${"*".repeat(Math.min(match.length - 8, 12))}${match.slice(-4)}`;
+}
+function lineStarts(text) {
+  const starts = [0];
+  let nl = text.indexOf("\n");
+  while (nl !== -1) {
+    starts.push(nl + 1);
+    nl = text.indexOf("\n", nl + 1);
+  }
+  return starts;
+}
+function lineOf(starts, index) {
+  let lo = 0;
+  let hi = starts.length - 1;
+  while (lo < hi) {
+    const mid = lo + hi + 1 >> 1;
+    if (starts[mid] <= index) lo = mid;
+    else hi = mid - 1;
+  }
+  return lo + 1;
+}
+function extractSecrets(text, starts) {
+  const out = [];
+  let lineIndex = starts || null;
+  for (const { kind, re, group, prefilter } of SECRET_PATTERNS) {
+    if (prefilter && !prefilter.some((needle) => text.includes(needle))) continue;
+    re.lastIndex = 0;
+    let m;
+    let guard = 0;
+    while ((m = re.exec(text)) !== null && guard++ < 20) {
+      const value = m[group];
+      if (!value) continue;
+      if (PLACEHOLDERS.has(value.toLowerCase())) continue;
+      if (lineIndex === null) lineIndex = lineStarts(text);
+      out.push({ kind, line: lineOf(lineIndex, m.index), preview: redact(value) });
+      if (m.index === re.lastIndex) re.lastIndex++;
+    }
+  }
+  return out;
+}
+function extractUnfinished(text) {
+  const out = [];
+  const lines = text.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("//") || trimmed.startsWith("#") || trimmed.startsWith("--")) {
+      continue;
+    }
+    for (const { kind, re } of UNFINISHED_PATTERNS) {
+      if (re.test(line)) {
+        out.push({ kind, line: i + 1 });
+        break;
+      }
+    }
+  }
+  return out;
+}
+function scanFile(rec) {
+  const match = matchLang(rec.rel);
+  const lang = match.lang;
+  rec.lang = lang ? lang.id : null;
+  rec.langLabel = lang ? lang.label : null;
+  rec.commentSpec = lang ? lang.comment : null;
+  rec.langVia = match.via;
+  rec.isGenerated = isGeneratedName(rec.name);
+  rec.isLockfile = LOCKFILES.has(rec.name);
+  rec.isTest = lang ? lang.tests.some((re) => re.test(rec.rel)) : /(^|\/)(test|tests|spec|specs|__tests__)(\/|$)/i.test(rec.rel);
+  rec.isBinary = false;
+  rec.lines = 0;
+  rec.maxLine = 0;
+  rec.longLines = 0;
+  rec.crlf = false;
+  rec.noTrailingNewline = false;
+  rec.hasShebang = false;
+  rec.markers = [];
+  rec.secrets = [];
+  rec.unfinished = [];
+  rec.conflictLines = [];
+  if (rec.size === 0) {
+    rec.empty = true;
+    return rec;
+  }
+  rec.empty = false;
+  if (rec.size > MAX_CONTENT_BYTES) {
+    rec.skippedContent = true;
+    return rec;
+  }
+  const head = readHead(rec.abs, 4096);
+  if (looksBinary(head)) {
+    rec.isBinary = true;
+    return rec;
+  }
+  const text = readText(rec.abs);
+  if (!text) {
+    rec.unreadable = true;
+    return rec;
+  }
+  rec.hasShebang = SHEBANG_RE.test(head);
+  let lines = 0;
+  let maxLine = 0;
+  let longLines = 0;
+  let start = 0;
+  let nl = text.indexOf("\n");
+  while (nl !== -1) {
+    lines++;
+    const len = nl - start;
+    if (len > maxLine) maxLine = len;
+    if (len > 200) longLines++;
+    start = nl + 1;
+    nl = text.indexOf("\n", start);
+  }
+  if (start < text.length) {
+    lines++;
+    const len = text.length - start;
+    if (len > maxLine) maxLine = len;
+    if (len > 200) longLines++;
+  }
+  rec.lines = lines;
+  rec.maxLine = maxLine;
+  rec.longLines = longLines;
+  rec.crlf = text.includes("\r\n");
+  rec.noTrailingNewline = text.length > 0 && !text.endsWith("\n");
+  if (text.includes("<<<<<<<") || text.includes("=======") || text.includes(">>>>>>>")) {
+    const linesArr = text.split("\n");
+    for (let i = 0; i < linesArr.length; i++) {
+      if (CONFLICT_RE.test(linesArr[i])) rec.conflictLines.push(i + 1);
+    }
+  }
+  rec.unfinished = extractUnfinished(text).slice(0, 20);
+  const hasMarkerKeyword = MARKER_KEYWORDS.some((k) => text.includes(k));
+  if (hasMarkerKeyword && rec.commentSpec) {
+    rec.markers = extractMarkers(text, rec.commentSpec).slice(0, 20);
+  }
+  if (!isSecretExempt(rec.rel)) {
+    const slice = text.length > MAX_SCAN_BYTES ? text.slice(0, MAX_SCAN_BYTES) : text;
+    rec.secrets = extractSecrets(slice).slice(0, 10);
+  }
+  return rec;
+}
+function isSource(rec) {
+  if (!rec.lang) return false;
+  if (rec.langVia !== "ext") return false;
+  if (rec.isBinary || rec.isGenerated || rec.isLockfile) return false;
+  return true;
+}
+function isLineStructured(rec) {
+  return isSource(rec) && rec.lang !== "notebook";
+}
+
+// src/analyzers/universal.ts
+function percentile(sorted, p) {
+  if (sorted.length === 0) return 0;
+  const idx = Math.min(sorted.length - 1, Math.max(0, Math.ceil(p / 100 * sorted.length) - 1));
+  return sorted[idx];
+}
+function median(sorted) {
+  if (sorted.length === 0) return 0;
+  const mid = Math.floor(sorted.length / 2);
+  return sorted.length % 2 ? sorted[mid] : Math.round((sorted[mid - 1] + sorted[mid]) / 2);
+}
+var fmt = (n) => n.toLocaleString("en-US");
+function analyzeBloat(ctx) {
+  const out = [];
+  const byLang = /* @__PURE__ */ new Map();
+  for (const f of ctx.sourceFiles) {
+    if (!byLang.has(f.lang)) byLang.set(f.lang, []);
+    byLang.get(f.lang).push(f);
+  }
+  for (const [langId, group] of byLang) {
+    const lang = languageById(langId);
+    const soft = lang?.bloat?.soft ?? 300;
+    const hard = lang?.bloat?.hard ?? 700;
+    const lines = group.map((f) => f.lines).sort((a, b) => a - b);
+    const p90 = percentile(lines, 90);
+    const med = median(lines);
+    const adaptive = Math.max(soft, Math.round(med * 3));
+    const offenders = group.filter((f) => f.lines > adaptive).sort((a, b) => b.lines - a.lines);
+    if (p90 > hard) {
+      out.push(
+        finding({
+          category: "bloat",
+          severity: "MEDIUM",
+          title: `${lang?.label ?? langId} codebase is structurally oversized`,
+          detail: `p90 line count is ${fmt(p90)}, above the ${fmt(hard)}-line guideline, so the norm itself is the problem rather than a few outliers. Median is ${fmt(med)} across ${fmt(group.length)} file(s). Consider a module-boundary pass.`,
+          lang: langId
+        })
+      );
+    }
+    if (offenders.length === 0) continue;
+    const severe = offenders.filter((f) => f.lines > hard);
+    const totalLines = offenders.reduce((s, f) => s + f.lines, 0);
+    if (severe.length > 0) {
+      out.push(
+        finding({
+          category: "bloat",
+          severity: "HIGH",
+          title: `${severe.length} oversized ${lang?.label ?? langId} file(s) over ${fmt(hard)} lines`,
+          detail: `${severe.length} file(s) exceed the ${lang?.label ?? langId} hard limit of ${fmt(hard)} lines. Language median is ${fmt(med)} lines, p90 is ${fmt(p90)}. Consider splitting by responsibility.`,
+          files: severe.slice(0, 10).map((f) => f.rel),
+          count: severe.length,
+          lang: langId
+        })
+      );
+    }
+    const rest = offenders.filter((f) => f.lines <= hard);
+    if (rest.length > 0) {
+      out.push(
+        finding({
+          category: "bloat",
+          severity: "MEDIUM",
+          title: `${offenders.length} ${lang?.label ?? langId} file(s) above the ${fmt(adaptive)}-line adaptive threshold`,
+          detail: `Threshold derived from this repo's own median (${fmt(med)} lines, 3x = ${fmt(adaptive)}), floored at the ${lang?.label ?? langId} baseline of ${fmt(soft)}. These files total ${fmt(totalLines)} lines.`,
+          files: offenders.slice(0, 10).map((f) => f.rel),
+          count: offenders.length,
+          lang: langId
+        })
+      );
+    }
+  }
+  return out;
+}
+function analyzeEmpty(ctx) {
+  const out = [];
+  const empties = ctx.sourceFiles.filter((f) => f.size === 0);
+  const structured = ctx.structuredFiles;
+  const langHasSubstantial = new Set(structured.filter((f) => f.lines > 20).map((f) => f.lang));
+  const stubs = structured.filter(
+    (f) => f.size > 0 && f.lines <= 2 && langHasSubstantial.has(f.lang)
+  );
+  if (empties.length > 0) {
+    out.push(
+      finding({
+        category: "bloat",
+        severity: empties.length > 5 ? "MEDIUM" : "LOW",
+        title: `${empties.length} completely empty source file(s)`,
+        detail: "Zero-byte source files. Either a placeholder that was committed by accident, or a file whose contents were lost.",
+        files: empties.slice(0, 10).map((f) => f.rel),
+        count: empties.length
+      })
+    );
+  }
+  if (stubs.length > 0) {
+    out.push(
+      finding({
+        category: "bloat",
+        severity: "LOW",
+        title: `${stubs.length} stub source file(s) of 2 lines or fewer`,
+        detail: "Files with almost no content. Verify these are intentional scaffolding and not abandoned work.",
+        files: stubs.slice(0, 10).map((f) => f.rel),
+        count: stubs.length
+      })
+    );
+  }
+  return out;
+}
+function analyzeMarkers(ctx) {
+  const out = [];
+  const byType = /* @__PURE__ */ new Map();
+  for (const f of ctx.sourceFiles) {
+    for (const m of f.markers || []) {
+      if (!byType.has(m.type)) byType.set(m.type, { count: 0, files: /* @__PURE__ */ new Set(), stale: 0 });
+      const entry = byType.get(m.type);
+      entry.count++;
+      entry.files.add(f.rel);
+    }
+  }
+  const total = [...byType.values()].reduce((s, e) => s + e.count, 0);
+  if (total === 0) return out;
+  for (const [type, entry] of byType) {
+    const severity = type === "FIXME" || type === "BUG" || type === "HACK" ? "HIGH" : type === "XXX" ? "HIGH" : "MEDIUM";
+    out.push(
+      finding({
+        category: "markers",
+        severity: entry.count > 20 ? severity === "MEDIUM" ? "HIGH" : severity : severity,
+        title: `${entry.count} ${type} marker(s) across ${entry.files.size} file(s)`,
+        detail: `Extracted from comments only (string literals excluded), so these are real annotations. A ${type} is a promise to future-you with no due date.`,
+        files: [...entry.files].slice(0, 10),
+        count: entry.count
+      })
+    );
+  }
+  if (total > 50) {
+    out.push(
+      finding({
+        category: "markers",
+        severity: "HIGH",
+        title: `${fmt(total)} unresolved markers repo-wide`,
+        detail: "Marker count is high enough to be a tracking-system failure rather than a set of individual notes.",
+        count: total
+      })
+    );
+  }
+  return out;
+}
+function analyzeSecrets(ctx) {
+  const out = [];
+  const GENERIC = /* @__PURE__ */ new Set(["hardcoded secret assignment", "bearer token"]);
+  const unique = /* @__PURE__ */ new Map();
+  for (const f of ctx.sourceFiles) {
+    for (const s of f.secrets || []) {
+      const key = `${f.rel}:${s.line}`;
+      const prev = unique.get(key);
+      if (!prev) {
+        unique.set(key, { ...s, rel: f.rel });
+      } else if (GENERIC.has(prev.kind) && !GENERIC.has(s.kind)) {
+        unique.set(key, { ...s, rel: f.rel });
+      }
+    }
+  }
+  if (unique.size === 0) return out;
+  const byKind = /* @__PURE__ */ new Map();
+  for (const s of unique.values()) {
+    if (!byKind.has(s.kind)) byKind.set(s.kind, { files: /* @__PURE__ */ new Set(), samples: [] });
+    const e = byKind.get(s.kind);
+    e.files.add(s.rel);
+    if (e.samples.length < 3) e.samples.push(`${s.rel}:${s.line} (${s.preview})`);
+  }
+  for (const [kind, e] of byKind) {
+    out.push(
+      finding({
+        category: "secrets",
+        severity: "CRITICAL",
+        title: `Possible ${kind} committed to the repository`,
+        detail: `Found in ${e.files.size} file(s). Values are redacted in this report. Examples: ${e.samples.join("; ")}. Treat as compromised: rotate the credential, then purge it from history.`,
+        files: [...e.files].slice(0, 10),
+        count: e.files.size
+      })
+    );
+  }
+  return out;
+}
+function analyzeConflicts(ctx) {
+  const out = [];
+  const conflicted = ctx.sourceFiles.filter((f) => f.conflictLines && f.conflictLines.length > 0);
+  if (conflicted.length === 0) return out;
+  out.push(
+    finding({
+      category: "hygiene",
+      severity: "CRITICAL",
+      title: `Unresolved merge conflict markers in ${conflicted.length} file(s)`,
+      detail: `Conflict markers are still present in the working tree. Files: ${conflicted.slice(0, 8).map((f) => f.rel).join(", ")}.` + (conflicted.length > 8 ? ` (+${conflicted.length - 8} more)` : ""),
+      files: conflicted.slice(0, 10).map((f) => f.rel),
+      count: conflicted.length
+    })
+  );
+  return out;
+}
+function analyzeUnfinished(ctx) {
+  const unfinished = ctx.sourceFiles.filter(
+    (f) => !f.isTest && f.unfinished && f.unfinished.length > 0
+  );
+  if (unfinished.length === 0) return [];
+  const notImplemented = unfinished.reduce(
+    (count, file) => count + file.unfinished.filter((item) => item.kind === "not-implemented error").length,
+    0
+  );
+  const emptyHandlers = unfinished.reduce(
+    (count, file) => count + file.unfinished.filter((item) => item.kind === "empty error handler").length,
+    0
+  );
+  const kinds = [];
+  if (notImplemented > 0) kinds.push(`${notImplemented} not-implemented error(s)`);
+  if (emptyHandlers > 0) kinds.push(`${emptyHandlers} empty error handler(s)`);
+  return [
+    finding({
+      category: "unfinished",
+      severity: "HIGH",
+      title: `${unfinished.length} source file(s) contain unfinished implementation`,
+      detail: `${kinds.join(" and ")} detected. These paths either fail at runtime or silently discard errors; replace the placeholder with working behavior or an explicit, documented fallback.`,
+      files: unfinished.slice(0, 10).map((f) => f.rel),
+      count: unfinished.length
+    })
+  ];
+}
+function analyzeFormatting(ctx) {
+  const out = [];
+  const structured = ctx.structuredFiles;
+  const long = structured.filter((f) => f.longLines > 0);
+  if (long.length > 0) {
+    out.push(
+      finding({
+        category: "hygiene",
+        severity: "MEDIUM",
+        title: `${long.length} file(s) contain lines over 200 characters`,
+        detail: `${fmt(long.reduce((s, f) => s + f.longLines, 0))} overlong line(s) in total. Longest offenders: ${long.sort((a, b) => b.maxLine - a.maxLine).slice(0, 5).map((f) => `${f.rel} (${f.maxLine} cols)`).join(", ")}.`,
+        files: long.slice(0, 10).map((f) => f.rel),
+        count: long.length
+      })
+    );
+  }
+  const crlf = structured.filter((f) => f.crlf);
+  const lf = structured.filter((f) => !f.crlf);
+  if (crlf.length > 0 && lf.length > 0) {
+    const crlfPct = Math.round(crlf.length / (crlf.length + lf.length) * 100);
+    if (crlfPct > 3 && crlfPct < 97) {
+      out.push(
+        finding({
+          category: "hygiene",
+          severity: "LOW",
+          title: `Mixed line endings (${crlfPct}% CRLF, ${100 - crlfPct}% LF)`,
+          detail: `${crlf.length} CRLF file(s) and ${lf.length} LF file(s) coexist. A .gitattributes with * text=auto eol=lf removes the whole category of bug.`,
+          files: crlf.slice(0, 8).map((f) => f.rel),
+          count: crlf.length
+        })
+      );
+    }
+  }
+  const noNl = structured.filter((f) => f.noTrailingNewline);
+  if (noNl.length > 0) {
+    out.push(
+      finding({
+        category: "hygiene",
+        severity: "LOW",
+        title: `${noNl.length} file(s) missing a trailing newline`,
+        detail: "POSIX convention: text files end with a newline. Causes noisy diffs.",
+        files: noNl.slice(0, 10).map((f) => f.rel),
+        count: noNl.length
+      })
+    );
+  }
+  return out;
+}
+function analyzeStructure(ctx) {
+  const out = [];
+  const deep = ctx.structuredFiles.filter((f) => f.depth > 8);
+  if (deep.length > 0) {
+    out.push(
+      finding({
+        category: "structure",
+        severity: "LOW",
+        title: `${deep.length} file(s) nested more than 8 directories deep`,
+        detail: `Deepest: ${deep.sort((a, b) => b.depth - a.depth).slice(0, 5).map((f) => `${f.rel} (depth ${f.depth})`).join(", ")}.`,
+        files: deep.slice(0, 8).map((f) => f.rel),
+        count: deep.length
+      })
+    );
+  }
+  const vendored = ctx.structuredFiles.filter(
+    (f) => f.isGenerated || /(^|\/)(vendor|third[_-]?party|extern|external|deps|generated)([_/-]|$)/i.test(f.rel)
+  );
+  if (vendored.length > 20) {
+    out.push(
+      finding({
+        category: "structure",
+        severity: "MEDIUM",
+        title: `${fmt(vendored.length)} vendored or generated source file(s) checked into the tree`,
+        detail: "Generated and third-party sources are committed alongside first-party code, which inflates search results, language statistics, and review surface.",
+        files: vendored.slice(0, 10).map((f) => f.rel),
+        count: vendored.length
+      })
+    );
+  }
+  return out;
+}
+function analyzeShebangs(ctx) {
+  const out = [];
+  const scripts = ctx.sourceFiles.filter(
+    (f) => ["shell", "python", "ruby", "perl"].includes(f.lang)
+  );
+  const noShebang = scripts.filter((f) => !f.hasShebang && f.size > 0);
+  if (noShebang.length > 0) {
+    out.push(
+      finding({
+        category: "hygiene",
+        severity: "LOW",
+        title: `${noShebang.length} script file(s) with no shebang`,
+        detail: `Scripts without an interpreter line depend on however they are invoked. Files: ${noShebang.slice(0, 6).map((f) => f.rel).join(", ")}.`,
+        files: noShebang.slice(0, 10).map((f) => f.rel),
+        count: noShebang.length
+      })
+    );
+  }
+  return out;
+}
+function analyze(ctx) {
+  return [
+    ...analyzeSecrets(ctx),
+    ...analyzeConflicts(ctx),
+    ...analyzeUnfinished(ctx),
+    ...analyzeBloat(ctx),
+    ...analyzeEmpty(ctx),
+    ...analyzeMarkers(ctx),
+    ...analyzeFormatting(ctx),
+    ...analyzeStructure(ctx),
+    ...analyzeShebangs(ctx)
+  ];
+}
+
+// src/analyzers/testing.ts
+var fmt2 = (n) => n.toLocaleString("en-US");
+var BANDS = [
+  {
+    min: 0,
+    max: 1e-4,
+    severity: "CRITICAL",
+    title: "No tests at all",
+    note: "This is a house with no smoke detectors."
+  },
+  {
+    min: 1e-4,
+    max: 0.05,
+    severity: "HIGH",
+    title: "Effectively untested",
+    note: "A rounding error is not a test suite."
+  },
+  {
+    min: 0.05,
+    max: 0.15,
+    severity: "MEDIUM",
+    title: "Sparse test coverage",
+    note: "Token coverage. The risky paths stay untested."
+  },
+  {
+    min: 0.15,
+    max: 0.35,
+    severity: "LOW",
+    title: "Thin but present test coverage",
+    note: "Real tests, but a low ratio against production code."
+  },
+  {
+    min: 0.35,
+    max: 1,
+    severity: "INFO",
+    title: "Reasonable test coverage",
+    note: "Solid ratio. The main gap will be in the untestable edges."
+  }
+];
+function analyzeTestRatio(ctx) {
+  const out = [];
+  const byLang = /* @__PURE__ */ new Map();
+  for (const f of ctx.sourceFiles) {
+    if (!byLang.has(f.lang)) byLang.set(f.lang, { src: 0, test: 0, testFiles: [] });
+    const e = byLang.get(f.lang);
+    if (f.isTest) {
+      e.test++;
+      e.testFiles.push(f.rel);
+    } else {
+      e.src++;
+    }
+  }
+  for (const [langId, e] of byLang) {
+    if (["docker", "terraform", "notebook", "sql"].includes(langId)) continue;
+    const lang = languageById(langId);
+    const total = e.src + e.test;
+    if (total === 0 || e.src === 0) continue;
+    const ratio = e.test / total;
+    const pct = Math.round(ratio * 100);
+    const band = BANDS.find((b) => ratio >= b.min && ratio < b.max) || BANDS[BANDS.length - 1];
+    const repoIsTiny = (ctx.repoSourceFileCount ?? ctx.sourceFiles.length) < 3;
+    if (e.test === 0 && repoIsTiny) continue;
+    if (e.test === 0) {
+      out.push(
+        finding({
+          category: "testing",
+          severity: "CRITICAL",
+          title: `Zero ${lang?.label ?? langId} tests against ${fmt2(e.src)} source file(s)`,
+          detail: `No test files matched the ${lang?.label ?? langId} test patterns (${lang?.tests?.slice(0, 3).join(", ")}) across ${fmt2(e.src)} source file(s).`,
+          lang: langId
+        })
+      );
+      continue;
+    }
+    out.push(
+      finding({
+        category: "testing",
+        severity: band.severity,
+        title: `${lang?.label ?? langId} test ratio ${pct}% (${fmt2(e.test)} test / ${fmt2(e.src)} source)`,
+        detail: `${band.note}`,
+        count: e.test,
+        lang: langId
+      })
+    );
+  }
+  return out;
+}
+function analyzeTestFramework(ctx) {
+  const out = [];
+  const has = (name) => ctx.rootFileNames.has(name);
+  const anyOf = (names) => names.some((n) => has(n));
+  const claimsTests = ctx.profile.dominantLanguage === "javascript" || ctx.profile.dominantLanguage === "typescript";
+  const testFilesExist = ctx.sourceFiles.some((f) => f.isTest);
+  if (claimsTests && testFilesExist) {
+    const hasRunner = anyOf([
+      "vitest.config.ts",
+      "vitest.config.js",
+      "jest.config.js",
+      "jest.config.ts",
+      "jest.config.mjs"
+    ]);
+    if (!hasRunner && !ctx.sourceFiles.some(
+      (f) => /\.test\.[cm]?[jt]sx?$/.test(f.rel) || /\.spec\.[cm]?[jt]sx?$/.test(f.rel)
+    )) {
+      out.push(
+        finding({
+          category: "testing",
+          severity: "LOW",
+          title: "Test files present but no runner configuration found",
+          detail: "No jest/vitest/mocha config and no conventionally-named spec files were detected."
+        })
+      );
+    }
+  }
+  return out;
+}
+function analyze2(ctx) {
+  return [...analyzeTestRatio(ctx), ...analyzeTestFramework(ctx)];
+}
+
+// src/util/git.ts
+import { execFileSync } from "child_process";
+var cachedAvailability = null;
+function gitDir(cwd) {
+  if (cachedAvailability === false) return null;
+  try {
+    const out = execFileSync("git", ["rev-parse", "--git-dir"], {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 1e4
+    }).trim();
+    if (out) cachedAvailability = true;
+    return out || null;
+  } catch {
+    cachedAvailability = false;
+    return null;
+  }
+}
+function isRepo(cwd) {
+  return gitDir(cwd) !== null;
+}
+function run(args, cwd, { timeout = 2e4 } = {}) {
+  try {
+    return execFileSync("git", args, {
+      cwd,
+      encoding: "utf-8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout,
+      maxBuffer: 64 * 1024 * 1024
+    });
+  } catch {
+    return null;
+  }
+}
+function trackedFiles(cwd) {
+  const out = run(["ls-files", "-z"], cwd);
+  if (out === null) return /* @__PURE__ */ new Set();
+  return new Set(out.split("\0").filter(Boolean));
+}
+function commits(cwd, { limit = 0, all = true } = {}) {
+  const sep2 = "";
+  const rec = "";
+  const args = ["log", `--format=%h${sep2}%an${sep2}%ae${sep2}%aI${sep2}%s${rec}`];
+  if (all) args.push("--all");
+  if (limit > 0) args.push(`-n${limit}`);
+  const out = run(args, cwd, { timeout: 6e4 });
+  if (out === null) return null;
+  return out.split(rec).map((chunk) => chunk.replace(/^\n+/, "")).filter(Boolean).map((chunk) => {
+    const [hash, author, email, date, ...rest] = chunk.split(sep2);
+    return {
+      hash: (hash || "").trim(),
+      author: (author || "").trim(),
+      email: (email || "").trim(),
+      date: (date || "").trim(),
+      subject: rest.join(sep2).trim()
+    };
+  }).filter((c) => c.hash);
+}
+function largestTrackedFiles(cwd, limit = 10) {
+  const out = run(["ls-tree", "-r", "-l", "HEAD"], cwd, { timeout: 3e4 });
+  if (out === null) return [];
+  return out.split("\n").map((line) => {
+    const tabIdx = line.indexOf("	");
+    if (tabIdx === -1) return null;
+    const meta = line.slice(0, tabIdx).split(/\s+/);
+    const path = line.slice(tabIdx + 1);
+    const size = Number.parseInt(meta[3], 10);
+    if (!Number.isFinite(size) || size < 200 * 1024) return null;
+    return { path, kb: Math.round(size / 1024) };
+  }).filter(Boolean).sort((a, b) => b.kb - a.kb).slice(0, limit);
+}
+
+// src/analyzers/git.ts
+var GENERIC_MSG_SUBJECTS = /* @__PURE__ */ new Set([
+  "fix",
+  "fixed",
+  "fixes",
+  "update",
+  "updates",
+  "updated",
+  "change",
+  "changes",
+  "changed",
+  "remove",
+  "removed",
+  "test",
+  "tests",
+  "refactor",
+  "cleanup",
+  "minor",
+  "tweak",
+  "adjust",
+  "patch",
+  "typo",
+  "rename",
+  "move",
+  "edit",
+  "add",
+  "added",
+  "new",
+  "old",
+  "initial",
+  "first",
+  "start",
+  "wip",
+  "todo",
+  "done",
+  "progress",
+  "working",
+  "checkpoint",
+  "save",
+  "commit",
+  "wip2",
+  "final",
+  "final2",
+  "stuff",
+  "things",
+  "misc",
+  "more",
+  "whatever",
+  "meh",
+  "idk",
+  "ok",
+  "nice",
+  "foo",
+  "bar",
+  "baz",
+  "qux",
+  "asdf",
+  "oops",
+  "hmm",
+  "tmp",
+  "temp",
+  "scratch",
+  "hack",
+  "fixup",
+  "squash"
+]);
+var MIN_MSG_LENGTH = 10;
+function isGenericMessage(subject) {
+  const s = subject.trim().toLowerCase();
+  return GENERIC_MSG_SUBJECTS.has(s) || s.length < MIN_MSG_LENGTH;
+}
+var fmt3 = (n) => n.toLocaleString("en-US");
+function analyze3(ctx) {
+  const out = [];
+  const hasRepo = isRepo(ctx.root);
+  if (!hasRepo) {
+    out.push(
+      finding({
+        category: "git",
+        severity: "LOW",
+        title: "No git repository detected",
+        detail: "Version control history is unavailable, so history-based findings were skipped."
+      })
+    );
+  }
+  const log = hasRepo ? commits(ctx.root, { limit: ctx.options.commitLimit }) : null;
+  if (log && log.length === 0) {
+    out.push(
+      finding({
+        category: "git",
+        severity: "LOW",
+        title: "Git repository has no commits",
+        detail: "The repo is initialized but empty."
+      })
+    );
+  }
+  if (log && log.length > 0) {
+    const authors = new Set(log.map((c) => c.author || c.email));
+    const generic = log.filter((c) => isGenericMessage(c.subject));
+    if (log.length < 10) {
+      out.push(
+        finding({
+          category: "git",
+          severity: "MEDIUM",
+          title: `Sparse git history (${log.length} commit(s))`,
+          detail: `Only ${log.length} commit(s) across ${authors.size} author(s). Most recent: ${log.slice(0, 3).map((c) => `"${c.subject}"`).join(", ")}.`,
+          count: log.length
+        })
+      );
+    }
+    const genericPct = Math.round(generic.length / log.length * 100);
+    if (generic.length > 0 && generic.length / log.length > 0.25) {
+      out.push(
+        finding({
+          category: "git",
+          severity: "MEDIUM",
+          title: `${generic.length}/${log.length} (${genericPct}%) commit messages are generic or too short`,
+          detail: `Examples: ${generic.slice(0, 5).map((c) => `"${c.subject}"`).join(", ")}. Uninformative messages make bisect and blame archaeology painful.`,
+          count: generic.length
+        })
+      );
+    }
+    if (authors.size === 1 && log.length > 3) {
+      out.push(
+        finding({
+          category: "git",
+          severity: "LOW",
+          title: `Solo project (${log.length} commits, 1 author)`,
+          detail: "A single author across the whole history. Either a solo project or teammates are not committing.",
+          count: log.length
+        })
+      );
+    }
+  }
+  const big = hasRepo ? largestTrackedFiles(ctx.root, 10) : [];
+  if (big.length > 0) {
+    out.push(
+      finding({
+        category: "git",
+        severity: "LOW",
+        title: `${big.length} large blob(s) tracked in git (>200KB)`,
+        detail: `Largest: ${big.slice(0, 5).map((b) => `${b.path} (${fmt3(b.kb)}KB)`).join(", ")}. Large binaries bloat clone time forever.`,
+        files: big.slice(0, 6).map((b) => b.path),
+        count: big.length
+      })
+    );
+  }
+  return out;
+}
+
+// src/analyzers/node.ts
+import { join as join3 } from "path";
+var SCRIPT_CHECKS = [
+  { name: "test", severity: "HIGH", alt: ["test:run", "tests", "test:unit"] },
+  { name: "build", severity: "HIGH", alt: ["build:prod", "compile"] },
+  { name: "lint", severity: "MEDIUM", alt: ["lint:js", "eslint"] },
+  { name: "typecheck", severity: "MEDIUM", alt: ["type-check", "typecheck:ci", "tsc"] }
+];
+var FIELDS = [
+  { key: "name", severity: "HIGH", msg: 'missing "name"' },
+  { key: "version", severity: "MEDIUM", msg: 'missing "version"' },
+  { key: "license", severity: "MEDIUM", msg: 'missing "license"' },
+  { key: "description", severity: "LOW", msg: 'missing "description"' },
+  { key: "repository", severity: "LOW", msg: 'missing "repository"' }
+];
+var DEP_TYPES = ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"];
+function collectManifests(ctx) {
+  const manifests2 = [];
+  for (const scope of ctx.profile.scopes) {
+    const pkgPath = scope.isRoot ? join3(ctx.root, "package.json") : join3(ctx.root, scope.path, "package.json");
+    if (!existsSync(pkgPath)) continue;
+    const pkg = readJSON(pkgPath);
+    if (!pkg) {
+      manifests2.push({
+        scope,
+        pkg: null,
+        relPath: scope.isRoot ? "package.json" : `${scope.path}/package.json`,
+        invalid: true
+      });
+      continue;
+    }
+    manifests2.push({
+      scope,
+      pkg,
+      relPath: scope.isRoot ? "package.json" : `${scope.path}/package.json`,
+      invalid: false
+    });
+  }
+  return manifests2;
+}
+function analyze4(ctx) {
+  const out = [];
+  const manifests2 = collectManifests(ctx);
+  if (manifests2.length === 0) return out;
+  for (const m of manifests2.filter((x) => x.invalid)) {
+    out.push(
+      finding({
+        category: "config",
+        severity: "HIGH",
+        title: `Invalid JSON in ${m.relPath}`,
+        detail: "The manifest could not be parsed. This will break installs and most tooling.",
+        files: [m.relPath]
+      })
+    );
+  }
+  const valid = manifests2.filter((m) => !m.invalid);
+  const depIndex = /* @__PURE__ */ new Map();
+  for (const m of valid) {
+    for (const type of DEP_TYPES) {
+      const deps = m.pkg[type];
+      if (!deps || typeof deps !== "object") continue;
+      for (const [name, range] of Object.entries(deps)) {
+        if (!depIndex.has(name)) depIndex.set(name, /* @__PURE__ */ new Map());
+        depIndex.get(name).set(m.scope.name || "root", { range, type });
+      }
+    }
+  }
+  for (const [dep, byPkg] of depIndex) {
+    if (byPkg.size < 2) continue;
+    const ranges = [...byPkg.values()].map((v) => String(v.range));
+    const unique = [...new Set(ranges)];
+    if (unique.length > 1) {
+      out.push(
+        finding({
+          category: "deps",
+          severity: "CRITICAL",
+          title: `Dependency "${dep}" has ${unique.length} different version ranges across packages`,
+          detail: [...byPkg.entries()].map(([pkg, v]) => `${pkg}: ${v.range} (${v.type})`).join(", ") + ". Pin one version and use workspace protocol / overrides.",
+          count: byPkg.size
+        })
+      );
+    }
+  }
+  for (const m of valid) {
+    const name = m.scope.name || "root";
+    const scripts = m.pkg.scripts || {};
+    for (const check of SCRIPT_CHECKS) {
+      const present = scripts[check.name] || (check.alt || []).some((a) => scripts[a]);
+      const hasSource = m.scope.isRoot ? ctx.sourceFiles.some((f) => ["javascript", "typescript"].includes(f.lang)) : ctx.sourceFiles.some(
+        (f) => f.rel.startsWith(`${m.scope.path}/`) && ["javascript", "typescript"].includes(f.lang)
+      );
+      if (!present && hasSource) {
+        out.push(
+          finding({
+            category: "script",
+            severity: check.severity,
+            title: `Package "${name}" has no "${check.name}" script`,
+            detail: `No ${check.name} script in ${m.relPath}.${check.alt?.length ? ` (also checked: ${check.alt.join(", ")})` : ""}`,
+            files: [m.relPath]
+          })
+        );
+      }
+    }
+    for (const f of FIELDS) {
+      if (m.pkg[f.key] === void 0) {
+        out.push(
+          finding({
+            category: "config",
+            severity: f.severity,
+            title: `Package "${name}" ${f.msg}`,
+            detail: `${m.relPath} has no "${f.key}" field.`,
+            files: [m.relPath]
+          })
+        );
+      }
+    }
+    const unpinned = Object.entries(m.pkg.dependencies || {}).filter(
+      ([, r]) => /^[~^*]|\|\||\bx\b|\*$/i.test(String(r)) && !/^(npm|file|link|workspace|git|http)/.test(String(r))
+    );
+    if (unpinned.length > 0) {
+      out.push(
+        finding({
+          category: "deps",
+          severity: "MEDIUM",
+          title: `Package "${name}" has ${unpinned.length} loosely-pinned runtime dependenc(ies)`,
+          detail: unpinned.map(([d, r]) => `${d}@${r}`).join(", "),
+          files: [m.relPath],
+          count: unpinned.length
+        })
+      );
+    }
+    const wildcards = Object.entries(m.pkg.dependencies || {}).filter(
+      ([, r]) => String(r).trim() === "*" || String(r).trim() === ""
+    );
+    if (wildcards.length > 0) {
+      out.push(
+        finding({
+          category: "deps",
+          severity: "HIGH",
+          title: `Package "${name}" uses wildcard version(s) in dependencies`,
+          detail: wildcards.map(([d]) => d).join(", ") + ". Wildcards make builds non-reproducible.",
+          files: [m.relPath]
+        })
+      );
+    }
+  }
+  const rootPkg = valid.find((m) => m.scope.isRoot);
+  if (rootPkg) {
+    const hasTsconfig = existsSync(join3(ctx.root, "tsconfig.json"));
+    const declaresTs = Boolean(
+      rootPkg.pkg.devDependencies?.typescript || rootPkg.pkg.dependencies?.typescript
+    );
+    const usesTsExt = ctx.sourceFiles.some((f) => f.lang === "typescript");
+    if (usesTsExt && !declaresTs) {
+      out.push(
+        finding({
+          category: "deps",
+          severity: "HIGH",
+          title: 'TypeScript sources present but "typescript" is not a declared dependency',
+          detail: "No typescript in dependencies/devDependencies. Editor and CI type-checking will silently do nothing.",
+          files: ["package.json"]
+        })
+      );
+    }
+    if (!hasTsconfig && usesTsExt) {
+      out.push(
+        finding({
+          category: "config",
+          severity: "HIGH",
+          title: "TypeScript sources but no tsconfig.json",
+          detail: "Without a tsconfig, there is no configured target, module resolution, or strictness."
+        })
+      );
+    }
+    const lockPresent = filesIn(ctx.root).some(
+      (f) => [
+        "package-lock.json",
+        "yarn.lock",
+        "pnpm-lock.yaml",
+        "bun.lockb",
+        "bun.lock",
+        "npm-shrinkwrap.json"
+      ].includes(f)
+    );
+    if (!lockPresent && !ctx.options.noLockfileWarning) {
+      out.push(
+        finding({
+          category: "deps",
+          severity: "MEDIUM",
+          title: "No JavaScript lockfile at the repository root",
+          detail: "No package-lock.json / yarn.lock / pnpm-lock.yaml / bun.lock. Dependency resolution is not reproducible."
+        })
+      );
+    }
+    if (!rootPkg.pkg.engines?.node) {
+      out.push(
+        finding({
+          category: "config",
+          severity: "LOW",
+          title: 'Root package.json has no "engines.node" constraint',
+          detail: "Node version is unpinned, so local and CI runtimes can drift silently.",
+          files: ["package.json"]
+        })
+      );
+    }
+  }
+  const tsconfigs = ctx.sourceFiles.filter((f) => f.name === "tsconfig.json");
+  for (const tsc of tsconfigs) {
+    const raw = readJSON(join3(ctx.root, tsc.rel));
+    if (!raw) continue;
+    const compiler = raw.compilerOptions || {};
+    const strict = compiler.strict === true || compiler.strictNullChecks === true && compiler.noImplicitAny === true;
+    if (!strict) {
+      out.push(
+        finding({
+          category: "config",
+          severity: "MEDIUM",
+          title: `${tsc.rel} does not enable TypeScript strict mode`,
+          detail: 'Without "strict": true, null/undefined and implicit-any bugs pass the compiler silently.',
+          files: [tsc.rel]
+        })
+      );
+    }
+  }
+  return out;
+}
+
+// src/analyzers/python.ts
+import { join as join4 } from "path";
+var PY_MANIFESTS = [
+  "pyproject.toml",
+  "setup.py",
+  "setup.cfg",
+  "requirements.txt",
+  "Pipfile",
+  "environment.yml"
+];
+function analyze5(ctx) {
+  const out = [];
+  if (!ctx.profile.tooling.isPython && !ctx.sourceFiles.some((f) => f.lang === "python"))
+    return out;
+  const foundManifests = [];
+  for (const name of PY_MANIFESTS) {
+    if (filesIn(ctx.root).includes(name)) foundManifests.push(name);
+  }
+  if (foundManifests.length === 0 && ctx.sourceFiles.some((f) => f.lang === "python")) {
+    out.push(
+      finding({
+        category: "config",
+        severity: "MEDIUM",
+        title: "Python code with no dependency manifest",
+        detail: `None of ${PY_MANIFESTS.join(", ")} present. Dependencies are undeclared and not reproducible.`
+      })
+    );
+  }
+  for (const req of ["requirements.txt", "requirements-dev.txt"]) {
+    const rec = ctx.files.find((f) => f.rel === req);
+    if (!rec) continue;
+    const text = readText(rec.abs);
+    if (!text) continue;
+    const lines = text.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#") && !l.startsWith("-"));
+    const unpinned = lines.filter((l) => !/[=><~!]|\bgit\+|@|file:/.test(l));
+    if (unpinned.length > 0) {
+      out.push(
+        finding({
+          category: "deps",
+          severity: "MEDIUM",
+          title: `${unpinned.length} unpinned requirement(s) in ${req}`,
+          detail: unpinned.slice(0, 12).join(", ") + ". Unpinned requirements make installs non-reproducible.",
+          files: [req],
+          count: unpinned.length
+        })
+      );
+    }
+  }
+  const venvDirs = [".venv", "venv", "env", "virtualenv"];
+  const trackedVenv = [];
+  for (const d of venvDirs) {
+    if (ctx.gitTracked && ctx.gitTracked.size > 0) {
+      for (const p of ctx.gitTracked) {
+        if (p.startsWith(`${d}/`) || p.includes(`/${d}/`)) trackedVenv.push(p);
+      }
+    } else if (isDir(join4(ctx.root, d))) {
+      trackedVenv.push(d);
+    }
+  }
+  if (trackedVenv.length > 0) {
+    out.push(
+      finding({
+        category: "vcs",
+        severity: "HIGH",
+        title: "Python virtualenv committed to the repository",
+        detail: `Virtualenv directories (${venvDirs.join(", ")}) contain thousands of absolute-path-bound files. Files: ${[...new Set(trackedVenv)].slice(0, 5).join(", ")}.`,
+        files: [...new Set(trackedVenv)].slice(0, 5),
+        count: new Set(trackedVenv).size
+      })
+    );
+  }
+  const pycache = ctx.sourceFiles.filter((f) => /__pycache__|\.pyc$/.test(f.rel));
+  if (pycache.length > 0) {
+    out.push(
+      finding({
+        category: "vcs",
+        severity: "LOW",
+        title: `${pycache.length} Python bytecode file(s) present in the tree`,
+        detail: "__pycache__/*.pyc should be gitignored. They are machine-specific build artifacts.",
+        files: pycache.slice(0, 5).map((f) => f.rel),
+        count: pycache.length
+      })
+    );
+  }
+  const pyFiles = ctx.sourceFiles.filter((f) => f.lang === "python");
+  if (pyFiles.length > 5) {
+    const hasMypy = filesIn(ctx.root).some(
+      (f) => ["mypy.ini", ".mypy.ini", "setup.cfg", "pyproject.toml"].includes(f)
+    );
+    const hasPyrightCfg = filesIn(ctx.root).includes("pyrightconfig.json");
+    if (!hasMypy && !hasPyrightCfg) {
+      out.push(
+        finding({
+          category: "config",
+          severity: "LOW",
+          title: "No Python type checker configured",
+          detail: `${pyFiles.length} Python source file(s) but no mypy/pyright configuration. Type errors go unnoticed.`
+        })
+      );
+    }
+  }
+  return out;
+}
+
+// src/analyzers/systems.ts
+var fmt4 = (n) => n.toLocaleString("en-US");
+function rust(ctx) {
+  const out = [];
+  const files = ctx.sourceFiles.filter((f) => f.lang === "rust");
+  if (files.length === 0) return out;
+  const hasCargo = filesIn(ctx.root).includes("Cargo.toml");
+  if (!hasCargo) {
+    out.push(
+      finding({
+        category: "build",
+        severity: "HIGH",
+        title: "Rust sources present but no Cargo.toml at the root",
+        detail: "These .rs files are not part of a Cargo build.",
+        lang: "rust"
+      })
+    );
+  }
+  const lockPresent = filesIn(ctx.root).includes("Cargo.lock");
+  if (hasCargo && !lockPresent) {
+    out.push(
+      finding({
+        category: "deps",
+        severity: "MEDIUM",
+        title: "Cargo.lock not committed",
+        detail: "For a binary crate, committing Cargo.lock pins reproducible builds. (Libraries may omit it.)",
+        files: ["Cargo.toml"],
+        lang: "rust"
+      })
+    );
+  }
+  const unwrapFiles = [];
+  let unwrapCount = 0;
+  for (const f of files) {
+    const text = readText(f.abs);
+    if (!text) continue;
+    const n = (text.match(/\.unwrap\(\)/g) || []).length + (text.match(/\.expect\(/g) || []).length;
+    if (n > 0) {
+      unwrapCount += n;
+      unwrapFiles.push({ rel: f.rel, n });
+    }
+  }
+  if (unwrapCount > 0) {
+    out.push(
+      finding({
+        category: "bloat",
+        severity: unwrapCount > 30 ? "MEDIUM" : "LOW",
+        title: `${fmt4(unwrapCount)} unwrap()/expect() call(s) across ${unwrapFiles.length} Rust file(s)`,
+        detail: "These panic on failure. Concentrated use in library code turns bad input into a process crash. " + unwrapFiles.sort((a, b) => b.n - a.n).slice(0, 5).map((f) => `${f.rel} (${f.n})`).join(", "),
+        files: unwrapFiles.slice(0, 6).map((f) => f.rel),
+        count: unwrapCount,
+        lang: "rust"
+      })
+    );
+  }
+  return out;
+}
+function go(ctx) {
+  const out = [];
+  const files = ctx.sourceFiles.filter((f) => f.lang === "go");
+  if (files.length === 0) return out;
+  const hasMod = filesIn(ctx.root).includes("go.mod");
+  if (!hasMod) {
+    out.push(
+      finding({
+        category: "build",
+        severity: "HIGH",
+        title: "Go sources present but no go.mod",
+        detail: "Go requires go.mod for module resolution and reproducible builds.",
+        lang: "go"
+      })
+    );
+  } else if (!filesIn(ctx.root).includes("go.sum")) {
+    out.push(
+      finding({
+        category: "deps",
+        severity: "MEDIUM",
+        title: "go.mod present but no go.sum",
+        detail: "go.sum pins module checksums. Without it, dependency integrity is not verified.",
+        files: ["go.mod"],
+        lang: "go"
+      })
+    );
+  }
+  const ignored = [];
+  for (const f of files) {
+    if (f.name.endsWith("_test.go")) continue;
+    const text = readText(f.abs);
+    if (!text) continue;
+    const n = (text.match(/^\s*_\s*=\s*\w+\([^)]*\)\s*$/gm) || []).length;
+    if (n > 0) ignored.push({ rel: f.rel, n });
+  }
+  if (ignored.length > 0) {
+    const total = ignored.reduce((s, f) => s + f.n, 0);
+    out.push(
+      finding({
+        category: "hygiene",
+        severity: total > 20 ? "MEDIUM" : "LOW",
+        title: `${total} discarded error value(s) assigned to _ in Go`,
+        detail: "Explicitly ignoring returned errors. Some is correct at boundaries, but volume like this usually hides real failures. " + ignored.slice(0, 5).map((f) => `${f.rel} (${f.n})`).join(", "),
+        files: ignored.slice(0, 6).map((f) => f.rel),
+        count: total,
+        lang: "go"
+      })
+    );
+  }
+  return out;
+}
+function dotnet(ctx) {
+  const out = [];
+  const cs = ctx.sourceFiles.filter((f) => f.lang === "csharp");
+  const projects = ctx.files.filter((f) => /\.csproj$|\.sln$|\.fsproj$|\.vbproj$/.test(f.rel));
+  if (cs.length === 0 && projects.length === 0) return out;
+  if (projects.length === 0 && cs.length > 0) {
+    out.push(
+      finding({
+        category: "build",
+        severity: "HIGH",
+        title: "C# sources present but no .csproj or .sln",
+        detail: "No project file found. dotnet build will not discover these sources.",
+        lang: "csharp"
+      })
+    );
+  }
+  const csprojNoNullable = [];
+  for (const p of projects.filter((x) => /\.csproj$/.test(x.rel))) {
+    const raw = readText(p.abs);
+    if (/<Nullable>/.test(raw) && /<Nullable>disable<\/Nullable>/.test(raw))
+      csprojNoNullable.push(p.rel);
+  }
+  if (cs.length > 3 && csprojNoNullable.length > 0) {
+    out.push(
+      finding({
+        category: "config",
+        severity: "MEDIUM",
+        title: `${csprojNoNullable.length} C# project(s) with nullable reference types disabled`,
+        detail: `<Nullable>disable</Nullable> in ${csprojNoNullable.join(", ")}. NullReferenceException risks stay invisible to the compiler.`,
+        files: csprojNoNullable,
+        lang: "csharp"
+      })
+    );
+  }
+  if (projects.length > 0 && !filesIn(ctx.root).includes("global.json")) {
+    out.push(
+      finding({
+        category: "build",
+        severity: "LOW",
+        title: "No global.json pinning the .NET SDK version",
+        detail: "Different machines/CI runners may build against different SDKs.",
+        lang: "csharp"
+      })
+    );
+  }
+  return out;
+}
+function zig(ctx) {
+  const out = [];
+  const files = ctx.sourceFiles.filter((f) => f.lang === "zig");
+  if (files.length === 0) return out;
+  if (!filesIn(ctx.root).includes("build.zig")) {
+    out.push(
+      finding({
+        category: "build",
+        severity: "MEDIUM",
+        title: "Zig sources present but no build.zig",
+        detail: "No build script. Zig projects are conventionally driven by build.zig.",
+        lang: "zig"
+      })
+    );
+  }
+  return out;
+}
+function analyze6(ctx) {
+  return [...rust(ctx), ...go(ctx), ...dotnet(ctx), ...zig(ctx)];
+}
+
+// src/analyzers/notebooks.ts
+var fmtKB = (bytes) => `${Math.round(bytes / 1024)}KB`;
+function outputText(output) {
+  if (typeof output?.text === "string") return output.text;
+  if (Array.isArray(output?.text)) return output.text.join("");
+  if (output?.data) {
+    const d = output.data;
+    return [...d["text/plain"] || [], ...d["text/html"] || []].join(" ");
+  }
+  return "";
+}
+function analyze7(ctx) {
+  const out = [];
+  const notebooks = ctx.files.filter((f) => f.rel.endsWith(".ipynb"));
+  if (notebooks.length === 0) return out;
+  let withOutputs = 0;
+  let runInOrder = 0;
+  let embeddedImages = 0;
+  let secretOutputs = 0;
+  const bigNotebooks = [];
+  const outputFiles = [];
+  for (const nb of notebooks) {
+    const raw = readText(nb.abs);
+    let json;
+    try {
+      json = JSON.parse(raw);
+    } catch {
+      out.push(
+        finding({
+          category: "config",
+          severity: "HIGH",
+          title: `Invalid JSON in notebook ${nb.rel}`,
+          detail: "The .ipynb could not be parsed. It is likely corrupt or was hand-edited.",
+          files: [nb.rel]
+        })
+      );
+      continue;
+    }
+    const cells = Array.isArray(json.cells) ? json.cells : [];
+    let nbOutputs = 0;
+    let nbImages = 0;
+    let nbSecrets = 0;
+    let nbRun = false;
+    for (const cell of cells) {
+      if (cell.execution_count != null) nbRun = true;
+      for (const output of cell.outputs || []) {
+        nbOutputs++;
+        if (output.data?.["image/png"] || output.data?.["image/jpeg"] || output.data?.["application/octet-stream"]) {
+          nbImages++;
+        }
+        const text = outputText(output);
+        if (/AKIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9]{36}|-----BEGIN [A-Z ]*PRIVATE KEY|sk-[A-Za-z0-9]{32}/.test(
+          text
+        )) {
+          nbSecrets++;
+        }
+        if (output.output_type === "error") {
+          nbOutputs++;
+        }
+      }
+    }
+    if (nbOutputs > 0) withOutputs++;
+    if (nbRun) runInOrder++;
+    if (nbImages > 0) embeddedImages++;
+    if (nbSecrets > 0) secretOutputs++;
+    if (nb.size > 300 * 1024) bigNotebooks.push({ rel: nb.rel, size: nb.size });
+    if (nbOutputs > 0) outputFiles.push(nb.rel);
+  }
+  if (withOutputs > 0) {
+    out.push(
+      finding({
+        category: "bloat",
+        severity: withOutputs / notebooks.length > 0.5 ? "MEDIUM" : "LOW",
+        title: `${withOutputs}/${notebooks.length} notebook(s) committed with cell outputs`,
+        detail: "Stored outputs (including base64 images) bloat the repo and can leak data that was printed during the run. Clear outputs before committing, or use nbstripout / a pre-commit hook.",
+        files: outputFiles.slice(0, 8),
+        count: withOutputs,
+        lang: "notebook"
+      })
+    );
+  }
+  if (embeddedImages > 0) {
+    out.push(
+      finding({
+        category: "bloat",
+        severity: "LOW",
+        title: `${embeddedImages} notebook(s) contain embedded base64 image data`,
+        detail: "Plots stored as base64 PNGs. Each one is a permanent, uncompressible blob in git history.",
+        count: embeddedImages,
+        lang: "notebook"
+      })
+    );
+  }
+  if (secretOutputs > 0) {
+    out.push(
+      finding({
+        category: "bloat",
+        severity: "CRITICAL",
+        title: `Credential-looking data in ${secretOutputs} notebook output(s)`,
+        detail: "A cell printed something matching a credential pattern. Outputs are committed and shared. Rotate anything real.",
+        count: secretOutputs,
+        lang: "notebook"
+      })
+    );
+  }
+  if (runInOrder > 0) {
+    out.push(
+      finding({
+        category: "hygiene",
+        severity: "LOW",
+        title: `${runInOrder} notebook(s) saved with execution order intact`,
+        detail: "Non-null execution_count means cells were run top-to-bottom. Restart-and-run-all before sharing to prove the notebook is self-contained.",
+        count: runInOrder,
+        lang: "notebook"
+      })
+    );
+  }
+  for (const b of bigNotebooks) {
+    out.push(
+      finding({
+        category: "bloat",
+        severity: "LOW",
+        title: `Large notebook ${b.rel} (${fmtKB(b.size)})`,
+        detail: "Notebook over 300KB. Split exploratory work from the narrative, or push the data out and keep the notebook as a thin driver.",
+        files: [b.rel],
+        lang: "notebook"
+      })
+    );
+  }
+  return out;
+}
+
+// src/analyzers/scaffolding.ts
+import { join as join5 } from "path";
+function scaffolding(ctx) {
+  const out = [];
+  const t = ctx.profile.tooling;
+  if (!t.hasReadme && ctx.sourceFiles.length > 0) {
+    out.push(
+      finding({
+        category: "vcs",
+        severity: "MEDIUM",
+        title: "No README found",
+        detail: "A repository with no README forces every new contributor to reverse-engineer how to run it."
+      })
+    );
+  }
+  if (!t.hasLicense) {
+    out.push(
+      finding({
+        category: "vcs",
+        severity: "MEDIUM",
+        title: "No LICENSE file",
+        detail: "No license means nobody may legally use, modify, or redistribute this code."
+      })
+    );
+  }
+  if (!t.hasGitignore && (t.isNode || t.isPython || t.isRust || t.isGo)) {
+    out.push(
+      finding({
+        category: "vcs",
+        severity: "HIGH",
+        title: "No .gitignore",
+        detail: "A code project with no .gitignore will accumulate build output, virtualenvs, and node_modules as untracked noise."
+      })
+    );
+  }
+  if (!t.hasEditorconfig) {
+    out.push(
+      finding({
+        category: "hygiene",
+        severity: "LOW",
+        title: "No .editorconfig",
+        detail: "No shared whitespace/encoding standard. Formatting churns between contributors."
+      })
+    );
+  }
+  if (t.hasEnv && !t.hasEnvExample && (t.isNode || t.isPython)) {
+    out.push(
+      finding({
+        category: "vcs",
+        severity: "MEDIUM",
+        title: ".env present but no .env.example",
+        detail: "Documenting required variables (without values) is the cheapest onboarding win available."
+      })
+    );
+  }
+  if (t.isNode && !t.hasCi) {
+    out.push(
+      finding({
+        category: "build",
+        severity: "MEDIUM",
+        title: "No CI configuration detected",
+        detail: "No .github/workflows, .gitlab-ci.yml, or .circleci. Nothing runs the tests automatically."
+      })
+    );
+  }
+  return out;
+}
+function manifests(ctx) {
+  const out = [];
+  const has = (f) => ctx.rootFileNames.has(f);
+  if (has("Gemfile") && !has("Gemfile.lock")) {
+    out.push(
+      finding({
+        category: "deps",
+        severity: "MEDIUM",
+        title: "Gemfile present but no Gemfile.lock",
+        detail: "Without the lockfile, gem versions drift between installs.",
+        files: ["Gemfile"],
+        lang: "ruby"
+      })
+    );
+  }
+  if (has("Gemfile") && !has(".ruby-version")) {
+    out.push(
+      finding({
+        category: "build",
+        severity: "LOW",
+        title: "No .ruby-version",
+        detail: "Ruby version unpinned.",
+        lang: "ruby"
+      })
+    );
+  }
+  if (has("composer.json") && !has("composer.lock")) {
+    out.push(
+      finding({
+        category: "deps",
+        severity: "MEDIUM",
+        title: "composer.json present but no composer.lock",
+        detail: "No lockfile means dependency versions are not pinned.",
+        files: ["composer.json"],
+        lang: "php"
+      })
+    );
+  }
+  if (has("composer.json")) {
+    const pkg = readJSON(join5(ctx.root, "composer.json"));
+    if (pkg && !pkg.require) {
+      out.push(
+        finding({
+          category: "config",
+          severity: "MEDIUM",
+          title: 'composer.json has no "require" section',
+          detail: "A PHP project with no runtime requirements declared.",
+          files: ["composer.json"],
+          lang: "php"
+        })
+      );
+    }
+  }
+  const gradleFiles = ["build.gradle", "build.gradle.kts"].filter((f) => has(f));
+  if (gradleFiles.length > 0 && !has("gradle.lockfile") && !has("gradle/verification-metadata.xml")) {
+    out.push(
+      finding({
+        category: "deps",
+        severity: "LOW",
+        title: "Gradle build with no dependency locking or verification",
+        detail: "gradle.lockfile or dependency verification metadata pins and checksums your dependencies.",
+        files: gradleFiles,
+        lang: "java"
+      })
+    );
+  }
+  if (has("Package.swift") && !has("Package.resolved")) {
+    out.push(
+      finding({
+        category: "deps",
+        severity: "LOW",
+        title: "Swift package with no Package.resolved",
+        detail: "Commit Package.resolved to pin exact dependency versions for apps.",
+        files: ["Package.swift"],
+        lang: "swift"
+      })
+    );
+  }
+  if (has("mix.exs") && !has("mix.lock")) {
+    out.push(
+      finding({
+        category: "deps",
+        severity: "MEDIUM",
+        title: "mix.exs present but no mix.lock",
+        detail: "No lockfile for hex dependencies.",
+        files: ["mix.exs"],
+        lang: "elixir"
+      })
+    );
+  }
+  if (has("pubspec.yaml") && !has("pubspec.lock")) {
+    out.push(
+      finding({
+        category: "deps",
+        severity: "LOW",
+        title: "pubspec.yaml present but no pubspec.lock",
+        detail: "Applications should commit pubspec.lock to pin package versions.",
+        files: ["pubspec.yaml"],
+        lang: "dart"
+      })
+    );
+  }
+  return out;
+}
+function sql(ctx) {
+  const out = [];
+  const files = ctx.sourceFiles.filter((f) => f.lang === "sql");
+  if (files.length === 0) return out;
+  const starFiles = files.filter((f) => /\bSELECT\s+\*/i.test(readText(f.abs)));
+  if (starFiles.length > 0) {
+    out.push(
+      finding({
+        category: "structure",
+        severity: "LOW",
+        title: `SELECT * in ${starFiles.length} SQL file(s)`,
+        detail: "Column-list-independent queries break silently when the schema changes. Enumerate columns.",
+        files: starFiles.slice(0, 8).map((f) => f.rel),
+        count: starFiles.length,
+        lang: "sql"
+      })
+    );
+  }
+  return out;
+}
+function analyze8(ctx) {
+  return [...scaffolding(ctx), ...manifests(ctx), ...sql(ctx)];
+}
+
+// src/analyzers/index.ts
+var ANALYZERS = [
+  { id: "universal", label: "Universal (secrets, bloat, markers, hygiene)", fn: analyze },
+  { id: "notebooks", label: "Jupyter notebooks", fn: analyze7 },
+  { id: "scaffolding", label: "Project scaffolding & manifests", fn: analyze8 },
+  { id: "testing", label: "Test coverage ratio", fn: analyze2 },
+  { id: "git", label: "Git history & tracked files", fn: analyze3 },
+  { id: "node", label: "JavaScript / TypeScript", fn: analyze4 },
+  { id: "python", label: "Python", fn: analyze5 },
+  { id: "systems", label: "Rust / Go / C / C++ / C# / Zig", fn: analyze6 }
+];
+
+// src/cli.ts
+var SPEC_VERSION = 1;
+function parseArgs(argv) {
+  const opts = {
+    root: process.cwd(),
+    format: "summary",
+    out: null,
+    failOn: null,
+    maxFiles: 6e4,
+    commitLimit: 1e3,
+    noGit: false,
+    noLockfileWarning: false,
+    quiet: false,
+    scope: null,
+    listLanguages: false,
+    help: false,
+    color: null,
+    ignoreDirs: []
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    switch (a) {
+      case "--package":
+      case "--scope":
+        opts.scope = argv[++i];
+        break;
+      case "--ignore-dir":
+        if (argv[i + 1]) opts.ignoreDirs.push(argv[++i]);
+        break;
+      case "--path":
+        opts.root = resolve(argv[++i] || ".");
+        break;
+      case "--format":
+        opts.format = (argv[++i] || "json").toLowerCase();
+        break;
+      case "--out":
+        opts.out = argv[++i];
+        break;
+      case "--fail-on":
+        opts.failOn = (argv[++i] || "").toUpperCase();
+        break;
+      case "--max-files":
+        opts.maxFiles = Number.parseInt(argv[++i] || "", 10) || opts.maxFiles;
+        break;
+      case "--commit-limit":
+        opts.commitLimit = Number.parseInt(argv[++i] || "", 10) || opts.commitLimit;
+        break;
+      case "--no-git":
+        opts.noGit = true;
+        break;
+      case "--no-lockfile-warning":
+        opts.noLockfileWarning = true;
+        break;
+      case "--quiet":
+        opts.quiet = true;
+        break;
+      case "--color":
+        opts.color = true;
+        break;
+      case "--no-color":
+        opts.color = false;
+        break;
+      case "--list-languages":
+        opts.listLanguages = true;
+        break;
+      case "-h":
+      case "--help":
+        opts.help = true;
+        break;
+      default:
+        if (a.startsWith("-")) {
+          process.stderr.write(`unknown option: ${a}
+Run with --help for the option list.
+`);
+          process.exit(2);
+        }
+        if (a !== ".") opts.root = resolve(a);
+        break;
+    }
+  }
+  return opts;
+}
+function printHelp() {
+  process.stdout.write(`flamer, language-agnostic code health auditor
+
+Usage:
+  flamer [path] [options]
+
+Options:
+  --package, --scope <name>  analyze only the named sub-project
+  --path <dir>               repository root (default: cwd)
+  --format <json|summary>    output format (default: summary)
+  --out <file>               also write the JSON report to a file
+  --fail-on <SEVERITY>       exit 1 if a finding is at/above this severity
+                            (${SEVERITIES.join(" | ")})
+  --max-files <n>            stop walking after n files (default ${6e4})
+  --commit-limit <n>         commits to inspect for git analysis (default 1000)
+  --no-git                   skip git analysis entirely
+  --no-lockfile-warning      skip the "no lockfile" suggestion
+  --ignore-dir <name>        also skip this directory name (repeatable)
+  --quiet                    suppress the human summary
+  --color                    force ANSI colors
+  --no-color                 disable ANSI colors
+  --list-languages           print the supported language table
+  -h, --help                 show this help
+`);
+}
+function printLanguages() {
+  process.stdout.write(`flamer understands ${LANGUAGES.length} language/ecosystem profiles:
+
+`);
+  for (const l of LANGUAGES) {
+    process.stdout.write(`  ${l.id.padEnd(12)} ${l.label.padEnd(22)} ${l.exts.join(" ")}
+`);
+  }
+  process.stdout.write(`
+${allExtensions().length} file extensions recognized.
+`);
+}
+function run2(opts) {
+  const started = Date.now();
+  const root = opts.root;
+  if (!existsSync3(root) || !isDir(root)) {
+    const err = {
+      specVersion: SPEC_VERSION,
+      tool: "flamer",
+      version: 2,
+      project: { name: basename(root), kind: [], languages: [], root, scopes: [] },
+      findings: [
+        finding({
+          category: "error",
+          severity: "CRITICAL",
+          title: `Path not found or not a directory: ${root}`,
+          detail: "Point flamer at an existing repository directory."
+        })
+      ],
+      metadata: { generatedAt: (/* @__PURE__ */ new Date()).toISOString(), durationSeconds: 0 }
+    };
+    return { report: err, exitCode: 2 };
+  }
+  const detected = detectScopes(root);
+  const walkStart = Date.now();
+  let truncated = false;
+  const collected = [];
+  walkTree(root, {
+    extraIgnores: new Set(opts.ignoreDirs),
+    onFile: (rec) => {
+      if (collected.length >= opts.maxFiles) {
+        truncated = true;
+        return;
+      }
+      collected.push(scanFile(rec));
+    }
+  });
+  const files = collected;
+  const walkMs = Date.now() - walkStart;
+  const profile = buildProfile(root, detected, files);
+  let scopes = profile.scopes;
+  let scopedFiles = files;
+  if (opts.scope) {
+    const match = scopes.find((s) => s.name === opts.scope);
+    if (!match) {
+      const available = scopes.map((s) => s.name || "root").join(", ") || "none";
+      const rep = emptyReport(root, profile, started);
+      rep.findings.push(
+        finding({
+          category: "error",
+          severity: "LOW",
+          title: `Scope "${opts.scope}" not found`,
+          detail: `Available scopes: ${available}.`
+        })
+      );
+      return { report: rep, exitCode: 0 };
+    }
+    scopes = [match];
+    if (match.path) {
+      const prefix = `${match.path}/`;
+      scopedFiles = files.filter((f) => f.rel === match.path || f.rel.startsWith(prefix));
+    }
+  }
+  const sourceFiles = scopedFiles.filter(isSource);
+  const structuredFiles = scopedFiles.filter(isLineStructured);
+  const rootFileNames = new Set(filesIn(root));
+  const repoSourceFileCount = files.filter(isSource).length;
+  let gitTracked = null;
+  if (!opts.noGit) gitTracked = isRepo(root) ? trackedFiles(root) : /* @__PURE__ */ new Set();
+  const ctx = {
+    root,
+    options: opts,
+    files: scopedFiles,
+    sourceFiles,
+    structuredFiles,
+    repoSourceFileCount,
+    rootFileNames,
+    profile: { ...profile, scopes },
+    scopes,
+    gitTracked
+  };
+  const findings = [];
+  const analyzerResults = [];
+  for (const a of ANALYZERS) {
+    const t0 = Date.now();
+    try {
+      const res = a.fn(ctx) || [];
+      findings.push(...res);
+      analyzerResults.push({
+        id: a.id,
+        label: a.label,
+        findings: res.length,
+        ms: Date.now() - t0,
+        error: null
+      });
+    } catch (e) {
+      const msg = e && e.message ? e.message : String(e);
+      findings.push(
+        finding({
+          category: "error",
+          severity: "LOW",
+          title: `Analyzer "${a.id}" failed`,
+          detail: msg
+        })
+      );
+      analyzerResults.push({
+        id: a.id,
+        label: a.label,
+        findings: 0,
+        ms: Date.now() - t0,
+        error: msg
+      });
+    }
+  }
+  const sorted = sortFindings(findings);
+  const report = {
+    specVersion: SPEC_VERSION,
+    tool: "flamer",
+    version: 2,
+    project: {
+      name: basename(root),
+      root,
+      kind: projectKind(profile),
+      layout: profile.layout,
+      languages: profile.languages,
+      dominantLanguage: profile.dominantLanguage,
+      packages: scopes.map((s) => s.name || "root"),
+      totalFiles: scopedFiles.length,
+      totalSourceFiles: sourceFiles.length,
+      totalLines: sourceFiles.reduce((s, f) => s + (f.lines || 0), 0),
+      tooling: profile.tooling
+    },
+    findings: sorted,
+    metadata: {
+      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      durationSeconds: (Date.now() - started) / 1e3,
+      walkMs,
+      truncated,
+      severities: severityTally(sorted),
+      worst: worstSeverity(sorted),
+      analyzers: analyzerResults
+    }
+  };
+  let exitCode = 0;
+  if (opts.failOn && report.metadata.worst && rank(report.metadata.worst) <= rank(opts.failOn)) {
+    exitCode = 1;
+  }
+  return { report, exitCode };
+}
+function emptyReport(root, profile, started) {
+  return {
+    specVersion: SPEC_VERSION,
+    tool: "flamer",
+    version: 2,
+    project: {
+      name: basename(root),
+      kind: projectKind(profile),
+      languages: profile.languages,
+      packages: []
+    },
+    findings: [],
+    metadata: {
+      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      durationSeconds: (Date.now() - started) / 1e3
+    }
+  };
+}
+var ANSI = {
+  reset: "\x1B[0m",
+  bold: "\x1B[1m",
+  dim: "\x1B[2m",
+  red: "\x1B[31m",
+  yellow: "\x1B[33m",
+  magenta: "\x1B[35m",
+  cyan: "\x1B[36m",
+  green: "\x1B[32m",
+  gray: "\x1B[90m"
+};
+function colorEnabled(force) {
+  if (force !== null) return force;
+  return Boolean(process.stdout.isTTY) && !process.env.NO_COLOR;
+}
+function paint(text, color, enabled) {
+  return enabled ? `${color}${text}${ANSI.reset}` : text;
+}
+function severityColor(severity) {
+  switch (severity) {
+    case "CRITICAL":
+      return ANSI.red;
+    case "HIGH":
+      return ANSI.yellow;
+    case "MEDIUM":
+      return ANSI.magenta;
+    case "LOW":
+      return ANSI.gray;
+    default:
+      return ANSI.cyan;
+  }
+}
+function severityIcon(severity) {
+  return severity === "LOW" ? "\xB7" : severity === "INFO" ? "i" : "!";
+}
+function printSummary(report, forceColor) {
+  const enabled = colorEnabled(forceColor);
+  const p = report.project;
+  const out = [];
+  const width = 62;
+  const duration = report.metadata.durationSeconds;
+  out.push("");
+  out.push(
+    ` ${paint("FLAMER", ANSI.bold + ANSI.cyan, enabled)}  ${paint(p.name, ANSI.bold, enabled)}`
+  );
+  out.push(paint(` ${"\u2500".repeat(width)}`, ANSI.dim, enabled));
+  if (p.languages?.length) {
+    out.push(
+      ` ${p.languages.map((l) => l.label).join(", ")} ${paint("\xB7", ANSI.dim, enabled)} ${(p.totalFiles || 0).toLocaleString()} files ${paint("\xB7", ANSI.dim, enabled)} ${(p.totalLines || 0).toLocaleString()} lines ${paint("\xB7", ANSI.dim, enabled)} ${duration.toFixed(2)}s`
+    );
+  } else {
+    out.push(
+      ` ${p.kind?.join(", ") || "unknown"} ${paint("\xB7", ANSI.dim, enabled)} ${duration.toFixed(2)}s`
+    );
+  }
+  out.push("");
+  const sev = report.metadata.severities || {};
+  for (const s of SEVERITIES) {
+    if (sev[s]) {
+      const label = `${severityIcon(s)} ${sev[s]} ${s.toLowerCase()}`;
+      out.push(` ${paint(label, severityColor(s), enabled)}`);
+    }
+  }
+  if (report.findings.length > 0) {
+    out.push("");
+    for (const severity of SEVERITIES) {
+      const findings = report.findings.filter((f) => f.severity === severity);
+      if (findings.length === 0) continue;
+      out.push(` ${paint(severity, severityColor(severity), enabled)}`);
+      for (const f of findings) {
+        out.push(
+          `  ${paint(severityIcon(f.severity), severityColor(f.severity), enabled)} ${f.title}`
+        );
+        if (f.detail) out.push(`    ${paint(f.detail, ANSI.dim, enabled)}`);
+        if (f.files?.length) {
+          out.push(
+            `    ${paint(f.files.slice(0, 5).join(", ") + (f.files.length > 5 ? " ..." : ""), ANSI.gray, enabled)}`
+          );
+        }
+      }
+    }
+  }
+  out.push("");
+  out.push(paint(` ${"\u2500".repeat(width)}`, ANSI.dim, enabled));
+  if (report.findings.length === 0) {
+    out.push(` ${paint("\u2713 No findings \xB7 scan completed", ANSI.green, enabled)}`);
+  } else {
+    out.push(
+      ` ${paint(`${report.findings.length} finding${report.findings.length === 1 ? "" : "s"} \xB7 scan completed`, ANSI.bold, enabled)}`
+    );
+  }
+  process.stdout.write(out.join("\n") + "\n");
+}
+for (const stream of [process.stdout, process.stderr]) {
+  stream.on("error", (err) => {
+    if (err && err.code === "EPIPE") process.exit(0);
+    throw err;
+  });
+}
+function main() {
+  const opts = parseArgs(process.argv.slice(2));
+  if (opts.help) return printHelp();
+  if (opts.listLanguages) return printLanguages();
+  const { report, exitCode } = run2(opts);
+  const json = JSON.stringify(report, null, 2);
+  if (opts.out) {
+    try {
+      writeFileSync(opts.out, json + "\n");
+    } catch (e) {
+      process.stderr.write(`warning: could not write ${opts.out}: ${e.message}
+`);
+    }
+  }
+  if (opts.format === "summary") {
+    if (!opts.quiet) printSummary(report, opts.color);
+  } else {
+    process.stdout.write(json + "\n");
+  }
+  process.exitCode = exitCode;
+}
+main();