infernoflow 0.32.8 → 0.33.0

package/dist/lib/commands/scan.mjs

@@ -1,231 +1,4 @@
-/**
- * infernoflow scan
- *
- * Deep AST-based code analysis. Reads actual function bodies — not just names.
- * Extracts: external calls, DB operations, HTTP calls, auth patterns, error types,
- * external service usage (Stripe, S3, SendGrid, etc.).
- *
- * Enriches capabilities.json with a `codeAnalysis` block on each capability,
- * and saves the full scan report to inferno/scan.json.
- *
- * Usage:
- *   infernoflow scan                   Scan project, enrich capabilities
- *   infernoflow scan --dir src/        Scan specific directory
- *   infernoflow scan --json            Print scan.json to stdout
- *   infernoflow scan --dry-run         Print without writing files
- *   infernoflow scan --capability auth-login   Scan one capability only
- */
-
-import * as fs   from "node:fs";
-import * as path from "node:path";
-import { createRequire } from "node:module";
-import { execSync }      from "node:child_process";
-import { bold, cyan, gray, green, yellow, red } from "../ui/output.mjs";
-
-const require = createRequire(import.meta.url);
-
-// ── TypeScript compiler API (global install) ──────────────────────────────────
-
-const TS_PATHS = [
-  "/usr/local/lib/node_modules_global/lib/node_modules/typescript",
-  "/usr/lib/node_modules/typescript",
-  path.join(process.env.HOME || "", ".npm-global/lib/node_modules/typescript"),
-];
-
-function loadTypeScript() {
-  for (const p of TS_PATHS) {
-    try { return require(path.join(p, "lib/typescript.js")); } catch {}
-  }
-  try { return require("typescript"); } catch {}
-  return null;
-}
-
-const ts = loadTypeScript();
-
-// ── external service fingerprints ────────────────────────────────────────────
-
-const SERVICE_PATTERNS = [
-  { service: "stripe",    patterns: ["stripe", "Stripe", "createPaymentIntent", "charges.create"] },
-  { service: "sendgrid",  patterns: ["sendgrid", "@sendgrid", "sgMail", "sendgrid.send"] },
-  { service: "ses",       patterns: ["SES", "ses.sendEmail", "aws-sdk/ses", "nodemailer"] },
-  { service: "s3",        patterns: ["S3", "s3.upload", "s3.getObject", "PutObjectCommand", "@aws-sdk/s3"] },
-  { service: "redis",     patterns: ["redis", "Redis", "ioredis", "createClient"] },
-  { service: "jwt",       patterns: ["jwt", "jsonwebtoken", "sign(", "verify(", "decode("] },
-  { service: "bcrypt",    patterns: ["bcrypt", "argon2", "scrypt", "hashSync", "compare("] },
-  { service: "prisma",    patterns: ["prisma.", "PrismaClient", "@prisma/client"] },
-  { service: "mongoose",  patterns: ["mongoose", ".save()", ".findOne(", ".aggregate("] },
-  { service: "postgres",  patterns: ["pg", "Pool(", "Client(", "query(", "postgres("] },
-  { service: "mysql",     patterns: ["mysql", "mysql2", "createConnection"] },
-  { service: "graphql",   patterns: ["graphql", "gql`", "ApolloServer", "GraphQLSchema"] },
-  { service: "firebase",  patterns: ["firebase", "firestore", "initializeApp"] },
-  { service: "twilio",    patterns: ["twilio", "Twilio(", "messages.create"] },
-  { service: "openai",    patterns: ["openai", "OpenAI(", "createCompletion", "chat.completions"] },
-];
-
-function detectServices(text) {
-  const found = new Set();
-  for (const { service, patterns } of SERVICE_PATTERNS) {
-    if (patterns.some(p => text.includes(p))) found.add(service);
-  }
-  return [...found];
-}
-
-// ── DB call patterns ──────────────────────────────────────────────────────────
-
-const DB_PATTERNS = [
-  /\.(find|findOne|findMany|findById|findAll)\s*\(/g,
-  /\.(create|insert|insertOne|insertMany|save)\s*\(/g,
-  /\.(update|updateOne|updateMany|updateById|upsert)\s*\(/g,
-  /\.(delete|deleteOne|deleteMany|remove|destroy)\s*\(/g,
-  /\.(query|execute|raw)\s*\(/g,
-  /\.(aggregate|groupBy|count|sum)\s*\(/g,
-  /db\.\w+\s*\(/g,
-  /prisma\.\w+\.\w+\s*\(/g,
-];
-
-function detectDbCalls(text) {
-  const calls = new Set();
-  for (const re of DB_PATTERNS) {
-    const r = new RegExp(re.source, "g");
-    let m;
-    while ((m = r.exec(text)) !== null) calls.add(m[0].replace(/\s*\($/, "()"));
-  }
-  return [...calls].slice(0, 10);
-}
-
-// ── HTTP call patterns ────────────────────────────────────────────────────────
-
-const HTTP_PATTERNS = [
-  /fetch\s*\(/g,
-  /axios\.(get|post|put|patch|delete)\s*\(/g,
-  /http\.(get|post|request)\s*\(/g,
-  /got\.(get|post|put|delete)\s*\(/g,
-  /request\.(get|post|put|delete)\s*\(/g,
-  /\$http\.(get|post|put|delete)\s*\(/g,
-];
-
-function detectHttpCalls(text) {
-  const calls = new Set();
-  for (const re of HTTP_PATTERNS) {
-    const r = new RegExp(re.source, "g");
-    let m;
-    while ((m = r.exec(text)) !== null) calls.add(m[0].replace(/\s*\($/, "()"));
-  }
-  return [...calls].slice(0, 8);
-}
-
-// ── TypeScript / JavaScript AST analysis ─────────────────────────────────────
-
-function getNodeName(node) {
-  if (!ts) return null;
-  if (node.name && ts.isIdentifier(node.name)) return node.name.text;
-  return null;
-}
-
-/**
- * Walk all descendants of root using node.forEachChild (instance method).
- * Collects all call expressions and throw statements globally,
- * then assigns them to containing functions by source position range.
- */
-function collectAllNodes(root) {
-  const calls  = []; // { pos, end, name }
-  const throws = []; // { pos, end, name }
-
-  function walk(node) {
-    if (ts.isCallExpression(node)) {
-      const expr = node.expression;
-      if (ts.isIdentifier(expr)) {
-        calls.push({ pos: node.pos, end: node.end, name: expr.text + "()" });
-      } else if (ts.isPropertyAccessExpression(expr)) {
-        calls.push({ pos: node.pos, end: node.end, name: expr.name.text + "()" });
-      }
-    }
-    if (ts.isThrowStatement(node) && node.expression) {
-      if (ts.isNewExpression(node.expression) && ts.isIdentifier(node.expression.expression)) {
-        throws.push({ pos: node.pos, end: node.end, name: node.expression.expression.text });
-      }
-    }
-    node.forEachChild?.(walk);
-  }
-  walk(root);
-  return { calls, throws };
-}
-
-function callsInRange(allCalls, pos, end) {
-  return [...new Set(
-    allCalls.filter(c => c.pos >= pos && c.end <= end).map(c => c.name)
-  )].slice(0, 20);
-}
-
-function throwsInRange(allThrows, pos, end) {
-  return [...new Set(
-    allThrows.filter(t => t.pos >= pos && t.end <= end).map(t => t.name)
-  )];
-}
-
-function isFunctionNode(node) {
-  if (!ts) return false;
-  return (
-    ts.isFunctionDeclaration(node) ||
-    ts.isFunctionExpression(node) ||
-    ts.isArrowFunction(node) ||
-    ts.isMethodDeclaration(node)
-  );
-}
-
-function getParentVariableName(node) {
-  // For arrow functions assigned to const: const foo = () => {}
-  if (!ts) return null;
-  if (node.parent && ts.isVariableDeclaration(node.parent)) {
-    return getNodeName(node.parent);
-  }
-  if (node.parent && ts.isPropertyAssignment(node.parent)) {
-    return getNodeName(node.parent);
-  }
-  return null;
-}
-
-function analyzeJsTs(filePath, code) {
-  if (!ts) return null;
-
-  let srcFile;
-  try {
-    srcFile = ts.createSourceFile(filePath, code, ts.ScriptTarget.Latest, /*setParentNodes*/ true);
-  } catch {
-    return null;
-  }
-
-  // Collect ALL call/throw nodes in one pass from root
-  const { calls: allCalls, throws: allThrows } = collectAllNodes(srcFile);
-
-  const functions = [];
-
-  function visit(node) {
-    if (isFunctionNode(node)) {
-      const name  = getNodeName(node) || getParentVariableName(node) || "<anonymous>";
-      const text  = code.slice(node.pos, node.end);
-      const calls = callsInRange(allCalls, node.pos, node.end);
-      const throws = throwsInRange(allThrows, node.pos, node.end);
-      functions.push({
-        name,
-        calls,
-        throws,
-        services:  detectServices(text),
-        dbCalls:   detectDbCalls(text),
-        httpCalls: detectHttpCalls(text),
-        loc: srcFile.getLineAndCharacterOfPosition(node.pos).line + 1,
-      });
-    }
-    node.forEachChild?.(visit);
-  }
-
-  visit(srcFile);
-  return functions;
-}
-
-// ── Python AST analysis via child_process ─────────────────────────────────────
-
-const PYTHON_SCRIPT = `
+import*as w from"node:fs";import*as g from"node:path";import{createRequire as V}from"node:module";import{execSync as G}from"node:child_process";import{bold as P,cyan as K,gray as u,green as k,yellow as j,red as F}from"../ui/output.mjs";const z=V(import.meta.url),Q=["/usr/local/lib/node_modules_global/lib/node_modules/typescript","/usr/lib/node_modules/typescript",g.join(process.env.HOME||"",".npm-global/lib/node_modules/typescript")];function X(){for(const e of Q)try{return z(g.join(e,"lib/typescript.js"))}catch{}try{return z("typescript")}catch{}return null}const l=X(),Y=[{service:"stripe",patterns:["stripe","Stripe","createPaymentIntent","charges.create"]},{service:"sendgrid",patterns:["sendgrid","@sendgrid","sgMail","sendgrid.send"]},{service:"ses",patterns:["SES","ses.sendEmail","aws-sdk/ses","nodemailer"]},{service:"s3",patterns:["S3","s3.upload","s3.getObject","PutObjectCommand","@aws-sdk/s3"]},{service:"redis",patterns:["redis","Redis","ioredis","createClient"]},{service:"jwt",patterns:["jwt","jsonwebtoken","sign(","verify(","decode("]},{service:"bcrypt",patterns:["bcrypt","argon2","scrypt","hashSync","compare("]},{service:"prisma",patterns:["prisma.","PrismaClient","@prisma/client"]},{service:"mongoose",patterns:["mongoose",".save()",".findOne(",".aggregate("]},{service:"postgres",patterns:["pg","Pool(","Client(","query(","postgres("]},{service:"mysql",patterns:["mysql","mysql2","createConnection"]},{service:"graphql",patterns:["graphql","gql`","ApolloServer","GraphQLSchema"]},{service:"firebase",patterns:["firebase","firestore","initializeApp"]},{service:"twilio",patterns:["twilio","Twilio(","messages.create"]},{service:"openai",patterns:["openai","OpenAI(","createCompletion","chat.completions"]}];function O(e){const t=new Set;for(const{service:n,patterns:s}of Y)s.some(i=>e.includes(i))&&t.add(n);return[...t]}const Z=[/\.(find|findOne|findMany|findById|findAll)\s*\(/g,/\.(create|insert|insertOne|insertMany|save)\s*\(/g,/\.(update|updateOne|updateMany|updateById|upsert)\s*\(/g,/\.(delete|deleteOne|deleteMany|remove|destroy)\s*\(/g,/\.(query|execute|raw)\s*\(/g,/\.(aggregate|groupBy|count|sum)\s*\(/g,/db\.\w+\s*\(/g,/prisma\.\w+\.\w+\s*\(/g];function T(e){const t=new Set;for(const n of Z){const s=new RegExp(n.source,"g");let i;for(;(i=s.exec(e))!==null;)t.add(i[0].replace(/\s*\($/,"()"))}return[...t].slice(0,10)}const ee=[/fetch\s*\(/g,/axios\.(get|post|put|patch|delete)\s*\(/g,/http\.(get|post|request)\s*\(/g,/got\.(get|post|put|delete)\s*\(/g,/request\.(get|post|put|delete)\s*\(/g,/\$http\.(get|post|put|delete)\s*\(/g];function _(e){const t=new Set;for(const n of ee){const s=new RegExp(n.source,"g");let i;for(;(i=s.exec(e))!==null;)t.add(i[0].replace(/\s*\($/,"()"))}return[...t].slice(0,8)}function N(e){return l&&e.name&&l.isIdentifier(e.name)?e.name.text:null}function se(e){const t=[],n=[];function s(i){if(l.isCallExpression(i)){const r=i.expression;l.isIdentifier(r)?t.push({pos:i.pos,end:i.end,name:r.text+"()"}):l.isPropertyAccessExpression(r)&&t.push({pos:i.pos,end:i.end,name:r.name.text+"()"})}l.isThrowStatement(i)&&i.expression&&l.isNewExpression(i.expression)&&l.isIdentifier(i.expression.expression)&&n.push({pos:i.pos,end:i.end,name:i.expression.expression.text}),i.forEachChild?.(s)}return s(e),{calls:t,throws:n}}function te(e,t,n){return[...new Set(e.filter(s=>s.pos>=t&&s.end<=n).map(s=>s.name))].slice(0,20)}function ne(e,t,n){return[...new Set(e.filter(s=>s.pos>=t&&s.end<=n).map(s=>s.name))]}function ie(e){return l?l.isFunctionDeclaration(e)||l.isFunctionExpression(e)||l.isArrowFunction(e)||l.isMethodDeclaration(e):!1}function oe(e){return l&&(e.parent&&l.isVariableDeclaration(e.parent)||e.parent&&l.isPropertyAssignment(e.parent))?N(e.parent):null}function re(e,t){if(!l)return null;let n;try{n=l.createSourceFile(e,t,l.ScriptTarget.Latest,!0)}catch{return null}const{calls:s,throws:i}=se(n),r=[];function a(c){if(ie(c)){const b=N(c)||oe(c)||"<anonymous>",f=t.slice(c.pos,c.end),d=te(s,c.pos,c.end),x=ne(i,c.pos,c.end);r.push({name:b,calls:d,throws:x,services:O(f),dbCalls:T(f),httpCalls:_(f),loc:n.getLineAndCharacterOfPosition(c.pos).line+1})}c.forEachChild?.(a)}return a(n),r}const ce=`
 import ast, json, sys
 
 def get_calls(node):
@@ -263,333 +36,7 @@ try:
     print(json.dumps(functions))
 except Exception as e:
     print(json.dumps([]))
-`;
-
-function analyzePython(filePath) {
-  try {
-    const result = execSync(
-      `python3 -c ${JSON.stringify(PYTHON_SCRIPT)} ${JSON.stringify(filePath)}`,
-      { timeout: 8000, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }
-    );
-    const fns = JSON.parse(result.trim() || "[]");
-    // add service/db/http detection from raw file text
-    const code = fs.readFileSync(filePath, "utf8");
-    return fns.map(f => ({
-      ...f,
-      services:  detectServices(code),
-      dbCalls:   detectDbCalls(code),
-      httpCalls: detectHttpCalls(code),
-    }));
-  } catch {
-    return null;
-  }
-}
-
-// ── regex fallback (Go, Ruby, Java, other) ────────────────────────────────────
-
-const FUNC_PATTERNS = [
-  { re: /^func\s+(?:\(\w+\s+\*?\w+\)\s+)?(\w+)\s*\(/gm,  lang: "go"   },
-  { re: /^\s*(?:def|async def)\s+(\w+)\s*\(/gm,          lang: "py"   },
-  { re: /^\s*(?:public|private|protected)?\s*(?:static\s+)?(?:\w+\s+)?(\w+)\s*\(/gm, lang: "java" },
-  { re: /^\s*def\s+(\w+)\s*[\(\|]/gm,                    lang: "rb"   },
-];
-
-function analyzeWithRegex(filePath, code) {
-  const ext = path.extname(filePath).slice(1);
-  const pattern = FUNC_PATTERNS.find(p => p.lang === ext);
-  if (!pattern) return null;
-
-  const functions = [];
-  const r = new RegExp(pattern.re.source, "gm");
-  let m;
-  while ((m = r.exec(code)) !== null) {
-    // grab up to 60 lines after the match for context
-    const start  = m.index;
-    const end    = Math.min(start + 2000, code.length);
-    const chunk  = code.slice(start, end);
-    functions.push({
-      name:      m[1],
-      calls:     [],
-      throws:    [],
-      services:  detectServices(chunk),
-      dbCalls:   detectDbCalls(chunk),
-      httpCalls: detectHttpCalls(chunk),
-      loc:       code.slice(0, start).split("\n").length,
-    });
-  }
-  return functions.length > 0 ? functions : null;
-}
-
-// ── file walker ───────────────────────────────────────────────────────────────
-
-const SKIP_DIRS = new Set([
-  "node_modules", ".git", "dist", "build", "out", ".next", ".nuxt",
-  "coverage", "__pycache__", ".pytest_cache", "vendor", "tmp", ".turbo",
-  "target", ".gradle", "public", "static", "assets",
-]);
-
-const SUPPORTED_EXTS = new Set([
-  ".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs",
-  ".py", ".go", ".rb", ".java",
-]);
-
-const TEST_FILE = /\.(test|spec)\.[jt]sx?$|_test\.(go|py|rb)|spec\.(rb|js|ts)$/;
-
-function* walkFiles(dir) {
-  let entries;
-  try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
-  catch { return; }
-  for (const e of entries) {
-    if (e.isDirectory()) {
-      if (!SKIP_DIRS.has(e.name)) yield* walkFiles(path.join(dir, e.name));
-    } else if (e.isFile()) {
-      const ext = path.extname(e.name);
-      if (SUPPORTED_EXTS.has(ext) && !TEST_FILE.test(e.name)) {
-        yield path.join(dir, e.name);
-      }
-    }
-  }
-}
-
-// ── per-file analyzer ─────────────────────────────────────────────────────────
-
-function analyzeFile(filePath) {
-  let code;
-  try { code = fs.readFileSync(filePath, "utf8"); }
-  catch { return []; }
-
-  const ext = path.extname(filePath);
-
-  if ([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"].includes(ext)) {
-    return analyzeJsTs(filePath, code) || analyzeWithRegex(filePath, code) || [];
-  }
-  if (ext === ".py") {
-    return analyzePython(filePath) || analyzeWithRegex(filePath, code) || [];
-  }
-  return analyzeWithRegex(filePath, code) || [];
-}
-
-// ── capability matcher ────────────────────────────────────────────────────────
-
-function tokenise(str) {
-  return str.replace(/([a-z])([A-Z])/g, "$1 $2")
-    .toLowerCase().split(/[\s_\-/.]+/).filter(t => t.length > 1);
-}
-
-function overlap(a, b) {
-  const sa = new Set(a), sb = new Set(b);
-  let n = 0;
-  for (const t of sa) if (sb.has(t)) n++;
-  const u = sa.size + sb.size - n;
-  return u === 0 ? 0 : n / u;
-}
-
-function matchFunctionToCapability(fn, capabilities) {
-  const fnTokens = tokenise(fn.name);
-  let best = null, bestScore = 0;
-  for (const cap of capabilities) {
-    const score = Math.max(
-      overlap(fnTokens, tokenise(cap.id || "")),
-      overlap(fnTokens, tokenise(cap.name || cap.title || "")),
-    );
-    if (score > bestScore) { bestScore = score; best = cap; }
-  }
-  return bestScore >= 0.2 ? { cap: best, score: bestScore } : null;
-}
-
-// ── merge analysis into capability ────────────────────────────────────────────
-
-function mergeAnalysis(existing = {}, fn, filePath, cwd) {
-  const rel = path.relative(cwd, filePath);
-
-  // merge arrays without duplicates
-  const merge = (a = [], b = []) => [...new Set([...a, ...b])];
-
-  return {
-    functions:    merge(existing.functions,    [fn.name]),
-    sourceFiles:  merge(existing.sourceFiles,  [rel]),
-    calls:        merge(existing.calls,        fn.calls),
-    throws:       merge(existing.throws,       fn.throws),
-    services:     merge(existing.services,     fn.services),
-    dbCalls:      merge(existing.dbCalls,      fn.dbCalls),
-    httpCalls:    merge(existing.httpCalls,    fn.httpCalls),
-    scannedAt:    new Date().toISOString(),
-  };
-}
-
-// ── reporters ─────────────────────────────────────────────────────────────────
-
-function printReport(enriched) {
-  console.log();
-  console.log(bold("  Scan Results"));
-  console.log(gray("  ─────────────────────────────────────────────────────────────────"));
-
-  for (const [capId, analysis] of Object.entries(enriched)) {
-    const { codeAnalysis: a } = analysis;
-    if (!a) continue;
-
-    console.log();
-    console.log(`  ${green("●")} ${bold(capId)}`);
-    if (a.sourceFiles?.length)  console.log(gray(`    files:    `) + a.sourceFiles.join(", "));
-    if (a.functions?.length)    console.log(gray(`    funcs:    `) + a.functions.join(", "));
-    if (a.services?.length)     console.log(gray(`    services: `) + cyan(a.services.join(", ")));
-    if (a.dbCalls?.length)      console.log(gray(`    db:       `) + a.dbCalls.slice(0, 4).join(", "));
-    if (a.httpCalls?.length)    console.log(gray(`    http:     `) + a.httpCalls.slice(0, 4).join(", "));
-    if (a.throws?.length)       console.log(gray(`    throws:   `) + yellow(a.throws.join(", ")));
-  }
-
-  console.log();
-  console.log(gray("  ─────────────────────────────────────────────────────────────────"));
-}
-
-// ── entry point ───────────────────────────────────────────────────────────────
-
-export async function scanCommand(rawArgs) {
-  const args       = rawArgs || [];
-  const dryRun     = args.includes("--dry-run");
-  const jsonMode   = args.includes("--json");
-  const dirIdx     = args.indexOf("--dir");
-  const extraDirs  = dirIdx !== -1 ? [args[dirIdx + 1]] : [];
-  const capFilter  = (() => { const i = args.indexOf("--capability"); return i !== -1 ? args[i + 1] : null; })();
-
-  const cwd        = process.cwd();
-  const infernoDir = path.join(cwd, "inferno");
-
-  // Load capabilities
-  const capsPath = path.join(infernoDir, "capabilities.json");
-  if (!fs.existsSync(capsPath)) {
-    console.error(red("✗ inferno/capabilities.json not found — run `infernoflow init` first."));
-    process.exit(1);
-  }
-  let capabilities;
-  let capsFileIsObject = false; // track original format so we can write it back correctly
-  let capsFileWrapper = null;
-  try { capabilities = JSON.parse(fs.readFileSync(capsPath, "utf8")); }
-  catch (e) { console.error(red("✗ Failed to parse capabilities.json: " + e.message)); process.exit(1); }
-
-  if (!Array.isArray(capabilities)) {
-    // handle object format { capabilities: [...] }
-    if (capabilities.capabilities) {
-      capsFileIsObject = true;
-      capsFileWrapper = capabilities; // preserve other top-level keys
-      capabilities = capabilities.capabilities;
-    }
-    else { console.error(red("✗ Unexpected capabilities.json format.")); process.exit(1); }
-  }
-
-  // Filter by --capability flag
-  const targetCaps = capFilter
-    ? capabilities.filter(c => c.id === capFilter || (c.name || "").toLowerCase() === capFilter.toLowerCase())
-    : capabilities;
-
-  if (targetCaps.length === 0) {
-    console.log(yellow(capFilter ? `No capability matched: ${capFilter}` : "No capabilities found."));
-    process.exit(0);
-  }
-
-  // Walk source files
-  const scanDirs = [cwd, ...extraDirs];
-  if (!jsonMode) process.stdout.write(gray("  Walking source files…"));
-  const files = [];
-  for (const dir of scanDirs) {
-    for (const f of walkFiles(dir)) files.push(f);
-  }
-  if (!jsonMode) process.stdout.write(`\r  Found ${files.length} source files.          \n`);
-
-  // Analyze files
-  if (!jsonMode) process.stdout.write(gray("  Analyzing…"));
-  const allFunctions = []; // { fn, filePath }
-  let analyzed = 0;
-  for (const filePath of files) {
-    const fns = analyzeFile(filePath);
-    for (const fn of fns) allFunctions.push({ fn, filePath });
-    analyzed++;
-    if (!jsonMode && analyzed % 20 === 0) {
-      process.stdout.write(`\r  Analyzed ${analyzed}/${files.length} files…`);
-    }
-  }
-  if (!jsonMode) process.stdout.write(`\r  Analyzed ${files.length} files, found ${allFunctions.length} functions.          \n`);
-
-  // Map functions to capabilities
-  const enriched = {}; // capId → { ...cap, codeAnalysis: {...} }
-
-  for (const cap of targetCaps) {
-    enriched[cap.id] = { ...cap, codeAnalysis: null };
-  }
-
-  for (const { fn, filePath } of allFunctions) {
-    const match = matchFunctionToCapability(fn, targetCaps);
-    if (!match) continue;
-    const { cap } = match;
-    const existing = enriched[cap.id]?.codeAnalysis || {};
-    enriched[cap.id].codeAnalysis = mergeAnalysis(existing, fn, filePath, cwd);
-  }
-
-  // Compute stats
-  const total   = Object.keys(enriched).length;
-  const matched = Object.values(enriched).filter(e => e.codeAnalysis).length;
-
-  if (jsonMode) {
-    const out = {
-      scannedAt: new Date().toISOString(),
-      files:     files.length,
-      functions: allFunctions.length,
-      capabilities: Object.entries(enriched).map(([id, data]) => ({
-        id,
-        name:         data.name || data.title,
-        codeAnalysis: data.codeAnalysis,
-      })),
-    };
-    console.log(JSON.stringify(out, null, 2));
-    return;
-  }
-
-  printReport(enriched);
-  console.log(`  ${green("✔")} Matched ${matched}/${total} capabilities to source functions`);
-  console.log();
-
-  if (dryRun) {
-    console.log(yellow("  --dry-run: no files written."));
-    return;
-  }
-
-  // Write scan.json
-  const scanData = {
-    scannedAt:    new Date().toISOString(),
-    files:        files.length,
-    functions:    allFunctions.length,
-    capabilities: Object.entries(enriched).map(([id, data]) => ({
-      id,
-      name:         data.name || data.title,
-      codeAnalysis: data.codeAnalysis,
-    })),
-  };
-  const scanPath = path.join(infernoDir, "scan.json");
-  fs.writeFileSync(scanPath, JSON.stringify(scanData, null, 2));
-  console.log(gray(`  Saved → inferno/scan.json`));
-
-  // Enrich capabilities.json
-  let changed = 0;
-  const updatedCaps = capabilities.map(cap => {
-    const analysis = enriched[cap.id]?.codeAnalysis;
-    if (!analysis) return cap;
-    changed++;
-    return { ...cap, codeAnalysis: analysis };
-  });
-
-  if (changed > 0) {
-    // Preserve the original file format: object wrapper or bare array
-    const toWrite = capsFileIsObject
-      ? { ...capsFileWrapper, capabilities: updatedCaps }
-      : updatedCaps;
-    fs.writeFileSync(capsPath, JSON.stringify(toWrite, null, 2));
-    console.log(gray(`  Updated ${changed} capability entries in capabilities.json`));
-  }
-
-  console.log();
-  if (!ts) {
-    console.log(yellow("  ⚠  TypeScript compiler not found — JS/TS analyzed with regex fallback."));
-    console.log(gray(`     For deeper analysis: npm install -g typescript`));
-    console.log();
-  }
-}
+`;function le(e){try{const t=G(`python3 -c ${JSON.stringify(ce)} ${JSON.stringify(e)}`,{timeout:8e3,encoding:"utf8",stdio:["pipe","pipe","pipe"]}),n=JSON.parse(t.trim()||"[]"),s=w.readFileSync(e,"utf8");return n.map(i=>({...i,services:O(s),dbCalls:T(s),httpCalls:_(s)}))}catch{return null}}const ae=[{re:/^func\s+(?:\(\w+\s+\*?\w+\)\s+)?(\w+)\s*\(/gm,lang:"go"},{re:/^\s*(?:def|async def)\s+(\w+)\s*\(/gm,lang:"py"},{re:/^\s*(?:public|private|protected)?\s*(?:static\s+)?(?:\w+\s+)?(\w+)\s*\(/gm,lang:"java"},{re:/^\s*def\s+(\w+)\s*[\(\|]/gm,lang:"rb"}];function E(e,t){const n=g.extname(e).slice(1),s=ae.find(c=>c.lang===n);if(!s)return null;const i=[],r=new RegExp(s.re.source,"gm");let a;for(;(a=r.exec(t))!==null;){const c=a.index,b=Math.min(c+2e3,t.length),f=t.slice(c,b);i.push({name:a[1],calls:[],throws:[],services:O(f),dbCalls:T(f),httpCalls:_(f),loc:t.slice(0,c).split(`
+`).length})}return i.length>0?i:null}const pe=new Set(["node_modules",".git","dist","build","out",".next",".nuxt","coverage","__pycache__",".pytest_cache","vendor","tmp",".turbo","target",".gradle","public","static","assets"]),ue=new Set([".ts",".tsx",".js",".jsx",".mjs",".cjs",".py",".go",".rb",".java"]),fe=/\.(test|spec)\.[jt]sx?$|_test\.(go|py|rb)|spec\.(rb|js|ts)$/;function*q(e){let t;try{t=w.readdirSync(e,{withFileTypes:!0})}catch{return}for(const n of t)if(n.isDirectory())pe.has(n.name)||(yield*q(g.join(e,n.name)));else if(n.isFile()){const s=g.extname(n.name);ue.has(s)&&!fe.test(n.name)&&(yield g.join(e,n.name))}}function de(e){let t;try{t=w.readFileSync(e,"utf8")}catch{return[]}const n=g.extname(e);return[".ts",".tsx",".js",".jsx",".mjs",".cjs"].includes(n)?re(e,t)||E(e,t)||[]:n===".py"?le(e)||E(e,t)||[]:E(e,t)||[]}function $(e){return e.replace(/([a-z])([A-Z])/g,"$1 $2").toLowerCase().split(/[\s_\-/.]+/).filter(t=>t.length>1)}function M(e,t){const n=new Set(e),s=new Set(t);let i=0;for(const a of n)s.has(a)&&i++;const r=n.size+s.size-i;return r===0?0:i/r}function ge(e,t){const n=$(e.name);let s=null,i=0;for(const r of t){const a=Math.max(M(n,$(r.id||"")),M(n,$(r.name||r.title||"")));a>i&&(i=a,s=r)}return i>=.2?{cap:s,score:i}:null}function me(e={},t,n,s){const i=g.relative(s,n),r=(a=[],c=[])=>[...new Set([...a,...c])];return{functions:r(e.functions,[t.name]),sourceFiles:r(e.sourceFiles,[i]),calls:r(e.calls,t.calls),throws:r(e.throws,t.throws),services:r(e.services,t.services),dbCalls:r(e.dbCalls,t.dbCalls),httpCalls:r(e.httpCalls,t.httpCalls),scannedAt:new Date().toISOString()}}function ye(e){console.log(),console.log(P("  Scan Results")),console.log(u("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));for(const[t,n]of Object.entries(e)){const{codeAnalysis:s}=n;s&&(console.log(),console.log(`  ${k("\u25CF")} ${P(t)}`),s.sourceFiles?.length&&console.log(u("    files:    ")+s.sourceFiles.join(", ")),s.functions?.length&&console.log(u("    funcs:    ")+s.functions.join(", ")),s.services?.length&&console.log(u("    services: ")+K(s.services.join(", "))),s.dbCalls?.length&&console.log(u("    db:       ")+s.dbCalls.slice(0,4).join(", ")),s.httpCalls?.length&&console.log(u("    http:     ")+s.httpCalls.slice(0,4).join(", ")),s.throws?.length&&console.log(u("    throws:   ")+j(s.throws.join(", "))))}console.log(),console.log(u("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"))}async function Se(e){const t=e||[],n=t.includes("--dry-run"),s=t.includes("--json"),i=t.indexOf("--dir"),r=i!==-1?[t[i+1]]:[],a=(()=>{const o=t.indexOf("--capability");return o!==-1?t[o+1]:null})(),c=process.cwd(),b=g.join(c,"inferno"),f=g.join(b,"capabilities.json");w.existsSync(f)||(console.error(F("\u2717 inferno/capabilities.json not found \u2014 run `infernoflow init` first.")),process.exit(1));let d,x=!1,I=null;try{d=JSON.parse(w.readFileSync(f,"utf8"))}catch(o){console.error(F("\u2717 Failed to parse capabilities.json: "+o.message)),process.exit(1)}Array.isArray(d)||(d.capabilities?(x=!0,I=d,d=d.capabilities):(console.error(F("\u2717 Unexpected capabilities.json format.")),process.exit(1)));const v=a?d.filter(o=>o.id===a||(o.name||"").toLowerCase()===a.toLowerCase()):d;v.length===0&&(console.log(j(a?`No capability matched: ${a}`:"No capabilities found.")),process.exit(0));const J=[c,...r];s||process.stdout.write(u("  Walking source files\u2026"));const h=[];for(const o of J)for(const p of q(o))h.push(p);s||process.stdout.write(`\r  Found ${h.length} source files.          
+`),s||process.stdout.write(u("  Analyzing\u2026"));const S=[];let C=0;for(const o of h){const p=de(o);for(const y of p)S.push({fn:y,filePath:o});C++,!s&&C%20===0&&process.stdout.write(`\r  Analyzed ${C}/${h.length} files\u2026`)}s||process.stdout.write(`\r  Analyzed ${h.length} files, found ${S.length} functions.          
+`);const m={};for(const o of v)m[o.id]={...o,codeAnalysis:null};for(const{fn:o,filePath:p}of S){const y=ge(o,v);if(!y)continue;const{cap:D}=y,W=m[D.id]?.codeAnalysis||{};m[D.id].codeAnalysis=me(W,o,p,c)}const L=Object.keys(m).length,H=Object.values(m).filter(o=>o.codeAnalysis).length;if(s){const o={scannedAt:new Date().toISOString(),files:h.length,functions:S.length,capabilities:Object.entries(m).map(([p,y])=>({id:p,name:y.name||y.title,codeAnalysis:y.codeAnalysis}))};console.log(JSON.stringify(o,null,2));return}if(ye(m),console.log(`  ${k("\u2714")} Matched ${H}/${L} capabilities to source functions`),console.log(),n){console.log(j("  --dry-run: no files written."));return}const B={scannedAt:new Date().toISOString(),files:h.length,functions:S.length,capabilities:Object.entries(m).map(([o,p])=>({id:o,name:p.name||p.title,codeAnalysis:p.codeAnalysis}))},U=g.join(b,"scan.json");w.writeFileSync(U,JSON.stringify(B,null,2)),console.log(u("  Saved \u2192 inferno/scan.json"));let A=0;const R=d.map(o=>{const p=m[o.id]?.codeAnalysis;return p?(A++,{...o,codeAnalysis:p}):o});if(A>0){const o=x?{...I,capabilities:R}:R;w.writeFileSync(f,JSON.stringify(o,null,2)),console.log(u(`  Updated ${A} capability entries in capabilities.json`))}console.log(),l||(console.log(j("  \u26A0  TypeScript compiler not found \u2014 JS/TS analyzed with regex fallback.")),console.log(u("     For deeper analysis: npm install -g typescript")),console.log())}export{Se as scanCommand};