nestjs-doctor 0.4.27 → 0.4.29

package/README.md

@@ -19,7 +19,7 @@
 </p>
 
 <p align="center">
-  43 built-in rules across <b>security</b>, <b>performance</b>, <b>correctness</b>, <b>architecture</b>, and <b>schema</b>. Outputs a <b>0-100 score</b> with actionable diagnostics. Zero config. Monorepo support. Catches the anti-patterns that AI-generated code introduce (slop code).
+  50 built-in rules across <b>security</b>, <b>performance</b>, <b>correctness</b>, <b>architecture</b>, and <b>schema</b>. Outputs a <b>0-100 score</b> with actionable diagnostics. Zero config. Monorepo support. Catches the anti-patterns that AI-generated code introduce (slop code).
 </p>
 
 ---
@@ -60,7 +60,7 @@ Install [NestJS Doctor](https://marketplace.visualstudio.com/items?itemName=rolo
 npm install -D nestjs-doctor
 ```
 
-Same 43 rules as the CLI, surfaced as inline diagnostics in the editor and in the Problems panel. Files are scanned on open and on save with a configurable debounce.
+Same 50 rules as the CLI, surfaced as inline diagnostics in the editor and in the Problems panel. Files are scanned on open and on save with a configurable debounce.
 
 Use `NestJS Doctor: Scan Project` from the command palette to trigger a full scan manually.
 
@@ -370,9 +370,9 @@ mono.combined;      // Merged DiagnoseResult
 
 ---
 
-## Rules (43)
+## Rules (50)
 
-### Security (9)
+### Security (10)
 
 | Rule | Severity | What it catches |
 |------|----------|-----------------|
@@ -385,8 +385,9 @@ mono.combined;      // Merged DiagnoseResult
 | `no-exposed-env-vars` | warning | Direct `process.env` in Injectable/Controller |
 | `no-exposed-stack-trace` | warning | `error.stack` exposed in responses |
 | `no-raw-entity-in-response` | warning | Returning ORM entities directly from controllers -- leaks internal fields |
+| `require-guards-on-endpoints` | warning | Endpoints without `@UseGuards()` at class or method level |
 
-### Correctness (14)
+### Correctness (20)
 
 | Rule | Severity | What it catches |
 |------|----------|-----------------|
@@ -399,11 +400,17 @@ mono.combined;      // Merged DiagnoseResult
 | `require-inject-decorator` | error | Untyped constructor param without `@Inject()` |
 | `prefer-readonly-injection` | warning | Constructor DI params missing `readonly` |
 | `require-lifecycle-interface` | warning | Lifecycle method without corresponding interface |
-| `no-empty-handlers` | warning | HTTP handler with empty body |
+| `no-empty-handlers` | info | HTTP handler with empty body |
 | `no-async-without-await` | warning | Async function/method with no `await` |
 | `no-duplicate-module-metadata` | warning | Duplicate entries in `@Module()` arrays |
 | `no-missing-module-decorator` | warning | Class named `*Module` without `@Module()` |
 | `no-fire-and-forget-async` | warning | Async call without `await` in non-handler methods |
+| `param-decorator-matches-route` | error | `@Param()` name doesn't match any `:param` in the route path |
+| `factory-inject-matches-params` | error | `useFactory` inject array length mismatches factory parameter count |
+| `no-duplicate-decorators` | warning | Same decorator appears twice on a single target |
+| `validated-non-primitive-needs-type` | warning | Non-primitive DTO property with class-validator decorators missing `@Type()` |
+| `validate-nested-array-each` | warning | `@ValidateNested()` on array property missing `{ each: true }` |
+| `injectable-must-be-provided` | info | `@Injectable()` class not registered in any module's providers |
 
 ### Architecture (10)
 
@@ -414,7 +421,7 @@ mono.combined;      // Merged DiagnoseResult
 | `no-orm-in-controllers` | error | PrismaService / EntityManager / DataSource in controllers |
 | `no-circular-module-deps` | error | Cycles in `@Module()` import graph |
 | `no-manual-instantiation` | error | `new SomeService()` for injectable classes |
-| `no-orm-in-services` | warning | Services using ORM directly (should use repositories) |
+| `no-orm-in-services` | info | Services using ORM directly (should use repositories) |
 | `no-service-locator` | warning | `ModuleRef.get()`/`resolve()` hides dependencies |
 | `prefer-constructor-injection` | warning | `@Inject()` property injection |
 | `require-module-boundaries` | info | Deep imports into other modules' internals |
@@ -425,9 +432,9 @@ mono.combined;      // Merged DiagnoseResult
 | Rule | Severity | What it catches |
 |------|----------|-----------------|
 | `no-sync-io` | warning | `readFileSync`, `writeFileSync`, etc. |
-| `no-blocking-constructor` | warning | Loops/await in Injectable/Controller constructors |
+| `no-blocking-constructor` | warning | Loops in Injectable/Controller constructors |
 | `no-dynamic-require` | warning | `require()` with non-literal argument |
-| `no-unused-providers` | warning | Provider never injected anywhere |
+| `no-unused-providers` | warning | Provider never injected and no self-activating decorators |
 | `no-request-scope-abuse` | warning | `Scope.REQUEST` creates new instance per request |
 | `no-unused-module-exports` | info | Module exports unused by importers |
 | `no-orphan-modules` | info | Module never imported by any other module |

package/dist/api/index.d.mts

@@ -183,6 +183,59 @@ type Diagnostic = CodeDiagnostic | SchemaDiagnostic;
 declare function isCodeDiagnostic(d: Diagnostic): d is CodeDiagnostic;
 declare function isSchemaDiagnostic(d: Diagnostic): d is SchemaDiagnostic;
 //#endregion
+//#region src/common/endpoint.d.ts
+/**
+ * Classifies a dependency's role in the NestJS application.
+ */
+type DependencyType = "service" | "repository" | "guard" | "interceptor" | "pipe" | "filter" | "gateway" | "unknown";
+/**
+ * A per-method dependency node. Each method call becomes its own node
+ * so that call order and conditionality are visible in the graph.
+ */
+interface MethodDependencyNode {
+  className: string;
+  conditional: boolean;
+  dependencies: MethodDependencyNode[];
+  filePath: string;
+  line: number;
+  methodName: string | null;
+  order: number;
+  totalMethods: number;
+  type: DependencyType;
+}
+/**
+ * Represents a single HTTP endpoint in a NestJS controller.
+ * Contains a per-method dependency tree.
+ */
+interface EndpointNode {
+  controllerClass: string;
+  dependencies: MethodDependencyNode[];
+  filePath: string;
+  handlerMethod: string;
+  httpMethod: string;
+  line: number;
+  routePath: string;
+}
+/**
+ * Layer 2: method-level call trace node for deep dependency analysis.
+ * Computed on demand via traceEndpointCalls().
+ */
+interface MethodCallNode {
+  calls: MethodCallNode[];
+  circular?: boolean;
+  className: string;
+  filePath: string;
+  line: number;
+  methodName: string;
+}
+/**
+ * Complete endpoint dependency graph for a NestJS project.
+ * JSON-safe — contains no Maps or AST references.
+ */
+interface EndpointGraph {
+  endpoints: EndpointNode[];
+}
+//#endregion
 //#region src/common/result.d.ts
 interface Score {
   label: string;
@@ -210,6 +263,7 @@ interface RuleErrorInfo {
 interface DiagnoseResult {
   diagnostics: Diagnostic[];
   elapsedMs: number;
+  endpoints?: EndpointGraph;
   project: ProjectInfo;
   ruleErrors: RuleErrorInfo[];
   schema?: SerializedSchemaGraph;
@@ -241,6 +295,15 @@ declare class ValidationError extends NestjsDoctorError {
   constructor(message: string);
 }
 //#endregion
+//#region src/engine/graph/endpoint-graph.d.ts
+declare function buildEndpointGraph(project: Project, files: string[], providers: Map<string, ProviderInfo>): EndpointGraph;
+/**
+ * Layer 2: traces method-level call chains for a specific endpoint.
+ * Returns the full recursive call tree through injected dependencies.
+ */
+declare function traceEndpointCalls(endpoint: EndpointNode, providers: Map<string, ProviderInfo>, project: Project): MethodCallNode[];
+declare function updateEndpointGraphForFile(graph: EndpointGraph, project: Project, filePath: string, providers: Map<string, ProviderInfo>): void;
+//#endregion
 //#region src/engine/rules/index.d.ts
 declare function getRules(): AnyRule[];
 //#endregion
@@ -264,6 +327,7 @@ interface MonorepoInfo {
 interface AnalysisContext {
   astProject: Project;
   config: NestjsDoctorConfig;
+  endpointGraph: EndpointGraph;
   fileRules: Rule[];
   files: string[];
   moduleGraph: ModuleGraph;
@@ -366,4 +430,4 @@ declare function diagnoseMonorepo(path: string, options?: {
   config?: string;
 }): Promise<MonorepoResult>;
 //#endregion
-export { type AnalysisContext, type AnyRule, type AutoScanResult, type BaseDiagnostic, type Category, type CodeDiagnostic, type CodeRuleContext, type CodeRuleContext as RuleContext, ConfigurationError, type DiagnoseResult, type DiagnoseSummary, type Diagnostic, type MonorepoResult, type NestjsDoctorConfig, NestjsDoctorError, type ProjectInfo, type ProjectRule, type ProjectRuleContext, type RawDiagnosticOutput, type Rule, type RuleErrorInfo, type RuleMeta, type ScanConfig, ScanError, type SchemaColumn, type SchemaDiagnostic, type SchemaEntity, type SchemaGraph, type SchemaRelation, type SchemaRule, type SchemaRuleContext, type Score, type SerializedSchemaGraph, type Severity, type SubProjectResult, ValidationError, autoScan, buildAnalysisContext, buildResult, checkAllFiles, checkFile, checkProject, checkSchema, diagnose, diagnoseMonorepo, extractSchema, getRules, isCodeDiagnostic, isSchemaDiagnostic, prepareAnalysis, resolveScanConfig, updateFile, updateModuleGraphForFile, updateProvidersForFile };
+export { type AnalysisContext, type AnyRule, type AutoScanResult, type BaseDiagnostic, type Category, type CodeDiagnostic, type CodeRuleContext, type CodeRuleContext as RuleContext, ConfigurationError, type DependencyType, type DiagnoseResult, type DiagnoseSummary, type Diagnostic, type EndpointGraph, type EndpointNode, type MethodCallNode, type MethodDependencyNode, type MonorepoResult, type NestjsDoctorConfig, NestjsDoctorError, type ProjectInfo, type ProjectRule, type ProjectRuleContext, type RawDiagnosticOutput, type Rule, type RuleErrorInfo, type RuleMeta, type ScanConfig, ScanError, type SchemaColumn, type SchemaDiagnostic, type SchemaEntity, type SchemaGraph, type SchemaRelation, type SchemaRule, type SchemaRuleContext, type Score, type SerializedSchemaGraph, type Severity, type SubProjectResult, ValidationError, autoScan, buildAnalysisContext, buildEndpointGraph, buildResult, checkAllFiles, checkFile, checkProject, checkSchema, diagnose, diagnoseMonorepo, extractSchema, getRules, isCodeDiagnostic, isSchemaDiagnostic, prepareAnalysis, resolveScanConfig, traceEndpointCalls, updateEndpointGraphForFile, updateFile, updateModuleGraphForFile, updateProvidersForFile };

package/dist/api/index.mjs

@@ -1,5 +1,5 @@
 import{existsSync as e,readFileSync as t,readdirSync as n,statSync as r}from"node:fs";import{dirname as i,join as a,relative as o,resolve as s}from"node:path";import{readFile as c}from"node:fs/promises";import{glob as l}from"tinyglobby";import{performance as u}from"node:perf_hooks";import{Project as d,SyntaxKind as f,ts as p}from"ts-morph";import{createJiti as m}from"jiti";import h from"picomatch";var g=class extends Error{constructor(e){super(e),this.name=`NestjsDoctorError`}},ee=class extends g{constructor(e){super(e),this.name=`ConfigurationError`}},te=class extends g{constructor(e){super(e),this.name=`ScanError`}},_=class extends g{constructor(e){super(e),this.name=`ValidationError`}};const ne=/^packages\s*:/,re=/^packages\s*:\s*\[(.+)\]/,ie=/^\S/,ae=/^-\s+['"]?([^'"]+)['"]?\s*$/,oe=/^['"]|['"]$/g;function se(e){let t=[],n=e.split(`
-`),r=!1;for(let e of n){let n=e.trim();if(ne.test(n)){let e=n.match(re);if(e){for(let n of e[1].split(`,`)){let e=n.trim().replace(oe,``);e&&t.push(e)}return t}r=!0;continue}if(r){if(ie.test(e)&&n!==``)break;let r=n.match(ae);r&&t.push(r[1])}}return t}async function ce(e){let t=a(e,`nest-cli.json`);try{let e=await c(t,`utf-8`),n=JSON.parse(e);if(!(n.monorepo&&n.projects))return null;let r=new Map;for(let[e,t]of Object.entries(n.projects)){let n=t.root??e;r.set(e,n)}return r.size===0?null:{projects:r}}catch{return null}}function le(e){let t={...e.dependencies,...e.devDependencies,...e.peerDependencies};return!!(t[`@nestjs/core`]||t[`@nestjs/common`])}async function v(e,t){let n=await l(t.map(e=>`${e}/package.json`),{cwd:e,absolute:!0,ignore:[`**/node_modules/**`]}),r=new Map;for(let t of n)try{let n=await c(t,`utf-8`),a=JSON.parse(n);if(le(a)){let n=o(e,i(t)),s=a.name??n;r.set(s,n)}}catch{}return r.size===0?null:{projects:r}}async function ue(e){let t=a(e,`pnpm-workspace.yaml`),n;try{n=await c(t,`utf-8`)}catch{return null}let r=se(n);return r.length===0?null:v(e,r)}function de(e){let t=e.workspaces;if(!t)return[];if(Array.isArray(t))return t.filter(e=>typeof e==`string`);if(typeof t==`object`&&t){let e=t;if(Array.isArray(e.packages))return e.packages.filter(e=>typeof e==`string`)}return[]}async function fe(e){let t=a(e,`package.json`),n;try{n=await c(t,`utf-8`)}catch{return null}let r=de(JSON.parse(n));return r.length===0?null:v(e,r)}async function pe(e){let t=a(e,`lerna.json`),n;try{n=await c(t,`utf-8`)}catch{return null}let r=JSON.parse(n);if(r.useWorkspaces)return null;let i=r.packages??[`packages/*`];return i.length===0?null:v(e,i)}async function me(e){let t=a(e,`nx.json`);try{await c(t,`utf-8`)}catch{return null}let n=await l([`**/project.json`],{cwd:e,absolute:!0,ignore:[`node_modules/**`]}),r=new Map;for(let t of n){let n=i(t),s=o(e,n);if(s===``)continue;let l=a(n,`package.json`);try{let e=await c(l,`utf-8`),t=JSON.parse(e);if(le(t)){let e=t.name??s;r.set(e,s)}}catch{}}return r.size===0?null:{projects:r}}async function he(e){try{return await c(a(e,`pnpm-workspace.yaml`),`utf-8`),!0}catch{return!1}}async function ge(e){let t=await ce(e);if(t)return t;let n=await ue(e);if(n)return n;if(!await he(e)){let t=await fe(e);if(t)return t}return await me(e)||pe(e)}async function _e(e){let t=a(e,`package.json`),n={};try{let e=await c(t,`utf-8`);n=JSON.parse(e)}catch{}let r={...n.dependencies,...n.devDependencies},i=ve(r[`@nestjs/core`]),o=ye(r),s=be(r);return{name:n.name??`unknown`,nestVersion:i,orm:o,framework:s,moduleCount:0,fileCount:0}}function ve(e){return e?e.replace(/[\^~>=<]/g,``):null}function ye(e){return e[`@prisma/client`]?`prisma`:e.typeorm?`typeorm`:e[`@mikro-orm/core`]?`mikro-orm`:e.sequelize?`sequelize`:e.mongoose?`mongoose`:e[`drizzle-orm`]?`drizzle`:null}function be(e){return e[`@nestjs/platform-fastify`]?`fastify`:e[`@nestjs/platform-express`]||e[`@nestjs/core`]?`express`:null}const y={include:[`**/*.ts`],exclude:`**/node_modules/**,**/dist/**,**/build/**,**/coverage/**,**/*.spec.ts,**/*.test.ts,**/*.e2e-spec.ts,**/*.e2e-test.ts,**/*.d.ts,**/test/**,**/tests/**,**/__tests__/**,**/__mocks__/**,**/__fixtures__/**,**/mock/**,**/mocks/**,**/*.mock.ts,**/seeder/**,**/seeders/**,**/*.seed.ts,**/*.seeder.ts,*.config.ts,*.config.js,*.config.mjs,*.config.cjs,*.config.mts,*.config.cts`.split(`,`)},xe=[`nestjs-doctor.config.json`,`.nestjs-doctor.json`];async function b(e,t){if(t)return x(t);for(let t of xe)try{return await x(a(e,t))}catch{}try{let t=await c(a(e,`package.json`),`utf-8`),n=JSON.parse(t);if(n[`nestjs-doctor`]&&typeof n[`nestjs-doctor`]==`object`)return Se(n[`nestjs-doctor`])}catch{}return{...y}}async function x(e){let t=await c(e,`utf-8`);return Se(JSON.parse(t))}function Se(e){return{...y,...e,exclude:[...y.exclude??[],...e.exclude??[]]}}async function Ce(e,t){try{return await b(e)}catch{return t}}const we=[/Repository$/,/\.repository$/,/\.entity$/,/\.schema$/,/\.guard$/,/\.interceptor$/,/\.pipe$/,/\.filter$/,/\.strategy$/],Te={meta:{id:`architecture/no-barrel-export-internals`,category:`architecture`,severity:`info`,description:`Don't re-export internal implementation details from barrel files`,help:`Only export the module's public API (services, DTOs, interfaces) from index.ts files.`},check(e){if(e.filePath.endsWith(`/index.ts`))for(let t of e.sourceFile.getExportDeclarations()){let n=t.getModuleSpecifierValue();if(n){we.some(e=>e.test(n))&&e.report({filePath:e.filePath,message:`Barrel file re-exports internal module '${n}'.`,help:this.meta.help,line:t.getStartLineNumber(),column:1});for(let n of t.getNamedExports()){let t=n.getName();(t.endsWith(`Repository`)||t.endsWith(`Entity`)||t.endsWith(`Schema`))&&e.report({filePath:e.filePath,message:`Barrel file re-exports internal type '${t}'.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}}}},S=new Set([`Get`,`Post`,`Put`,`Patch`,`Delete`,`Head`,`Options`,`All`]);function C(e,t){return e.getDecorator(t)!==void 0}function w(e){return C(e,`Controller`)}function Ee(e){return C(e,`Injectable`)}function De(e){return C(e,`Injectable`)||C(e,`Controller`)||C(e,`Resolver`)||C(e,`WebSocketGateway`)}function Oe(e){return C(e,`Module`)}function T(e){return e.getDecorators().some(e=>S.has(e.getName()))}const ke=new Set([`TsRestHandler`,`GrpcMethod`,`GrpcStreamMethod`]);function Ae(e){return e.getDecorators().some(e=>ke.has(e.getName()))}const je={meta:{id:`architecture/no-business-logic-in-controllers`,category:`architecture`,severity:`error`,description:`Controllers should only handle HTTP concerns — move business logic to services`,help:`Extract branches, loops, and complex calculations into a service method.`},check(e){for(let t of e.sourceFile.getClasses())if(w(t))for(let n of t.getMethods()){if(!n.getDecorators().some(e=>S.has(e.getName())))continue;let t=n.getBody();if(!t)continue;let r=t.getDescendantsOfKind(f.IfStatement),i=t.getDescendantsOfKind(f.ForStatement),a=t.getDescendantsOfKind(f.ForInStatement),o=t.getDescendantsOfKind(f.ForOfStatement),s=t.getDescendantsOfKind(f.WhileStatement),c=t.getDescendantsOfKind(f.SwitchStatement),l=i.length+a.length+o.length+s.length;(r.length>1||l>0||c.length>0)&&e.report({filePath:e.filePath,message:`Controller method '${n.getName()}' contains business logic (${r.length} if, ${l} loops, ${c.length} switch). Move to a service.`,help:this.meta.help,line:n.getStartLineNumber(),column:1});let u=t.getDescendantsOfKind(f.CallExpression).filter(e=>{let t=e.getExpression();if(t.getKind()===f.PropertyAccessExpression){let e=t.asKind(f.PropertyAccessExpression)?.getName();return e===`map`||e===`filter`||e===`reduce`||e===`sort`||e===`flatMap`}return!1});u.length>1&&e.report({filePath:e.filePath,message:`Controller method '${n.getName()}' contains data transformation logic (${u.length} array operations). Move to a service.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}};function Me(e){let t=new Map;try{let n=p.findConfigFile(e,p.sys.fileExists,`tsconfig.json`);if(!n)return t;let{config:r,error:a}=p.readConfigFile(n,p.sys.readFile);if(a||!r)return t;let o=i(n),c=p.parseJsonConfigFileContent(r,p.sys,o),l=c.options.paths;if(!l)return t;let u=c.options.baseUrl??o;for(let[e,n]of Object.entries(l)){let r=n.map(e=>s(u,e));t.set(e,r)}}catch{return t}return t}function Ne(e,t){for(let[n,r]of t){if(r.length===0)continue;let t=n.indexOf(`*`);if(t===-1){if(e===n)return r[0];continue}let i=n.slice(0,t),a=n.slice(t+1);if(e.startsWith(i)&&e.endsWith(a)&&e.length>=i.length+a.length){let t=e.slice(i.length,e.length-a.length),n=r[0],o=n.indexOf(`*`);return o===-1?n:n.slice(0,o)+t+n.slice(o+1)}}}const Pe=/=>\s*(\w+)/,Fe=/\.js$/;function Ie(e,t,n){let r=[];for(let i of e.getClasses()){let e=i.getDecorator(`Module`);if(!e)continue;let a=i.getName()??`AnonymousModule`,o=e.getArguments()[0],s={name:a,filePath:t,classDeclaration:i,imports:[],exports:[],providers:[],controllers:[]};if(o&&o.getKind()===f.ObjectLiteralExpression){let e=o.asKind(f.ObjectLiteralExpression);e&&(s.imports=D(e,`imports`,n),s.exports=D(e,`exports`,n),s.providers=D(e,`providers`,n),s.controllers=D(e,`controllers`,n))}r.push(s)}return r}function E(e,t,n=new Map){let r=new Map,i=new Map;for(let i of t){let t=e.getSourceFile(i);if(t)for(let e of Ie(t,i,n))r.set(e.name,e)}for(let[e,t]of r){let n=new Set;for(let e of t.imports)r.has(e)&&n.add(e);i.set(e,n)}let a=new Map;for(let e of r.values())for(let t of e.providers)a.set(t,e);return{modules:r,edges:i,providerToModule:a}}const Le=new Set([`forRoot`,`forRootAsync`,`forFeature`,`forFeatureAsync`,`forChild`,`forChildAsync`,`register`,`registerAsync`]);function D(e,t,n){let r=e.getProperty(t);if(!r)return[];let i=r.asKind(f.PropertyAssignment);if(!i)return[];let a=i.getInitializer();return a?O(a,e.getSourceFile(),0,n):[]}function O(e,t,n,r){if(n>5)return[];let i=e.getKind();if(i===f.ArrayLiteralExpression){let i=e.asKindOrThrow(f.ArrayLiteralExpression),a=[];for(let e of i.getElements())a.push(...Re(e,t,n,r));return a}return i===f.CallExpression?k(e.asKindOrThrow(f.CallExpression),t,n,r):i===f.Identifier?M(e.getText(),t,n+1,r):[]}function Re(e,t,n,r){let i=e.getText();if(i.startsWith(`forwardRef`)){let e=i.match(Pe);return e?[e[1]]:[i]}let a=e.getKind();return a===f.SpreadElement?O(e.asKindOrThrow(f.SpreadElement).getExpression(),t,n,r):a===f.CallExpression?k(e.asKindOrThrow(f.CallExpression),t,n,r):a===f.PropertyAccessExpression?[e.asKindOrThrow(f.PropertyAccessExpression).getExpression().getText()]:(f.Identifier,[i])}function k(e,t,n,r){let i=e.getExpression();if(i.getKind()===f.PropertyAccessExpression){let a=i.asKindOrThrow(f.PropertyAccessExpression),o=a.getName();if(o===`concat`){let i=O(a.getExpression(),t,n,r),o=[];for(let i of e.getArguments())o.push(...O(i,t,n,r));return[...i,...o]}return Le.has(o),[a.getExpression().getText()]}return i.getKind()===f.Identifier?N(i.getText(),t,n+1,r):[]}function A(e,t,n){if(!e.startsWith(`.`)){let r=Ne(e,n);if(!r)return;let i=t.getProject(),a=[`${r}.ts`,`${r}/index.ts`,r,r.replace(Fe,`.ts`)];for(let e of a){let t=i.getSourceFile(e);if(t)return t}return}let r=s(i(t.getFilePath()),e),a=t.getProject(),o=[`${r}.ts`,`${r}/index.ts`,r,r.replace(Fe,`.ts`)];for(let e of o){let t=a.getSourceFile(e);if(t)return t}}function j(e,t,n){for(let r of t.getImportDeclarations())for(let i of r.getNamedImports())if((i.getAliasNode()?i.getAliasNode().getText():i.getName())===e){let e=A(r.getModuleSpecifierValue(),t,n);return e?{sourceFile:e,localName:i.getName()}:void 0}for(let r of t.getExportDeclarations())if(r.getModuleSpecifierValue()){for(let i of r.getNamedExports())if((i.getAliasNode()?i.getAliasNode().getText():i.getName())===e){let e=A(r.getModuleSpecifierValue(),t,n);return e?{sourceFile:e,localName:i.getName()}:void 0}}}function M(e,t,n,r){if(n>5)return[];for(let i of t.getStatements()){if(i.getKind()!==f.VariableStatement)continue;let a=i.asKindOrThrow(f.VariableStatement);for(let i of a.getDeclarations())if(i.getName()===e){let e=i.getInitializer();if(e)return O(e,t,n,r)}}let i=j(e,t,r);return i?M(i.localName,i.sourceFile,n+1,r):[]}function ze(e,t,n,r){for(let i of t.getStatements()){if(i.getKind()!==f.VariableStatement)continue;let a=i.asKindOrThrow(f.VariableStatement);for(let i of a.getDeclarations()){if(i.getName()!==e)continue;let a=i.getInitializer();if(!a||a.getKind()!==f.ArrowFunction)continue;let o=a.asKindOrThrow(f.ArrowFunction).getBody();if(o.getKind()!==f.Block)return O(o,t,n,r);let s=[];for(let e of o.getDescendantsOfKind(f.ReturnStatement)){let i=e.getExpression();i&&s.push(...O(i,t,n,r))}return s}}}function N(e,t,n,r){if(n>5)return[];for(let i of t.getStatements()){if(i.getKind()!==f.FunctionDeclaration)continue;let a=i.asKindOrThrow(f.FunctionDeclaration);if(a.getName()!==e)continue;let o=[];for(let e of a.getDescendantsOfKind(f.ReturnStatement)){let i=e.getExpression();i&&o.push(...O(i,t,n,r))}return o}let i=ze(e,t,n,r);if(i)return i;let a=j(e,t,r);return a?N(a.localName,a.sourceFile,n+1,r):[]}function P(e,t,n,r=new Map){for(let[t,r]of e.modules)if(r.filePath===n){e.modules.delete(t),e.edges.delete(t);for(let t of r.providers)e.providerToModule.get(t)===r&&e.providerToModule.delete(t);for(let n of e.edges.values())n.delete(t)}let i=t.getSourceFile(n);if(!i)return;let a=Ie(i,n,r);for(let t of a)e.modules.set(t.name,t);for(let t of a){let n=new Set;for(let r of t.imports)e.modules.has(r)&&n.add(r);e.edges.set(t.name,n);for(let n of t.providers)e.providerToModule.set(n,t)}for(let[t,r]of e.modules){if(r.filePath===n)continue;let i=new Set;for(let t of r.imports)e.modules.has(t)&&i.add(t);e.edges.set(t,i)}}function Be(e){let t=[],n=new Set,r=new Set;function i(a,o){n.add(a),r.add(a);let s=e.edges.get(a)??new Set;for(let e of s)if(!n.has(e))i(e,[...o,e]);else if(r.has(e)){let n=o.indexOf(e);n===-1?t.push([...o,e]):t.push(o.slice(n))}r.delete(a)}for(let t of e.modules.keys())n.has(t)||i(t,[t]);return t}function F(e,t,n,r,i,a){let o=[];for(let i of e.providers){let e=n.get(i);if(e)for(let n of e.dependencies){let e=r.get(n);e&&e.name===t.name&&o.push({consumer:i,dependency:n})}}for(let n of e.controllers)for(let e of a){let a=i.getSourceFile(e);if(a)for(let e of a.getClasses()){if(e.getName()!==n)continue;let i=e.getConstructors()[0];if(i)for(let e of i.getParameters()){let i=e.getTypeNode(),a=i?i.getText():e.getType().getText(),s=a.split(`.`).pop()?.split(`<`)[0]??a,c=r.get(s);c&&c.name===t.name&&o.push({consumer:n,dependency:s})}}}return o}const I=`Break the cycle by extracting shared logic into a separate module or using forwardRef().`;function Ve(e,t){let{moduleGraph:n,providers:r,project:i,files:a}=t,o=[],s;for(let t=0;t<e.length;t++){let c=e[t],l=e[(t+1)%e.length],u=n.modules.get(c),d=n.modules.get(l);if(!(u&&d))continue;let f=F(u,d,r,n.providerToModule,i,a);if(f.length===0)continue;let p=new Map;for(let e of f){let t=p.get(e.consumer);t?t.push(e.dependency):p.set(e.consumer,[e.dependency])}let m=[];for(let[e,t]of p){let n=t.map(e=>`${e} (from ${l})`).join(`, `);m.push(`${e} (in ${c}) injects ${n}`)}let h=`${c} -> ${l}: ${m.join(`; `)}`;o.push(h),(!s||f.length<s.count)&&(s={description:`${c} -> ${l}`,count:f.length})}if(o.length===0)return I;let c=o.join(`
-`);if(s){let e=s.count===1?`dependency`:`dependencies`,t=s.description.split(` -> `)[0],o=s.description.split(` -> `)[1],l=n.modules.get(t),u=n.modules.get(o);if(l&&u){let t=F(l,u,r,n.providerToModule,i,a),o=[...new Set(t.map(e=>e.dependency))].join(`, `);c+=`\nConsider extracting ${o} into a shared module — it would break the ${s.description} edge (${s.count} ${e}).`}}return c}const He={meta:{id:`architecture/no-circular-module-deps`,category:`architecture`,severity:`error`,description:`Circular dependencies in @Module() import graph`,help:I,scope:`project`},check(e){let t=Be(e.moduleGraph);for(let n of t){let t=n.join(` -> `),r=e.moduleGraph.modules.get(n[0]),i=Ve(n,e);e.report({filePath:r?.filePath??`unknown`,message:`Circular module dependency detected: ${t}`,help:i,line:r?.classDeclaration.getStartLineNumber()??1,column:1})}}},Ue=[`Service`,`Repository`,`Gateway`,`Resolver`],We=[`Guard`,`Interceptor`,`Pipe`,`Filter`];function L(e){return typeof e==`object`&&!!e}function Ge(e){if(!L(e))return new Set;let t=e.excludeClasses;if(Array.isArray(t))return new Set(t.filter(e=>typeof e==`string`));let n=e.options;if(!L(n))return new Set;let r=n.excludeClasses;return Array.isArray(r)?new Set(r.filter(e=>typeof e==`string`)):new Set}const Ke={meta:{id:`architecture/no-manual-instantiation`,category:`architecture`,severity:`error`,description:`Do not manually instantiate @Injectable classes — use NestJS dependency injection`,help:`Register the class as a provider in a module and inject it via the constructor.`},check(e){let t=Ge(e.config?.rules?.[this.meta.id]),n=e.sourceFile.getDescendantsOfKind(f.NewExpression);for(let r of n){let n=r.getExpression().getText(),i=n.split(`.`).pop()??n;if(t.has(n)||t.has(i))continue;let a=Ue.some(e=>n.endsWith(e)),o=We.some(e=>n.endsWith(e));if(a||o){if(o){if(r.getFirstAncestorByKind(f.Decorator))continue;let e=r.getFirstAncestorByKind(f.MethodDeclaration),t=r.getFirstAncestorByKind(f.Constructor);if(!(e||t))continue}e.report({filePath:e.filePath,message:`Manual instantiation of '${n}' detected. Use dependency injection instead.`,help:this.meta.help,line:r.getStartLineNumber(),column:1})}}}},qe=/\.(\w+)$/,Je=/^(\w+)</,Ye=new Set([`PrismaService`,`PrismaClient`,`EntityManager`,`DataSource`,`Repository`,`Connection`,`MongooseModel`,`InjectModel`,`InjectRepository`,`MikroORM`,`DrizzleService`]),Xe={meta:{id:`architecture/no-orm-in-controllers`,category:`architecture`,severity:`error`,description:`Controllers must not inject ORM services directly — use a service layer`,help:`Inject a service that wraps the ORM instead of using the ORM directly in controllers.`},check(e){for(let t of e.sourceFile.getClasses()){if(!w(t))continue;let n=t.getConstructors()[0];if(n){for(let t of n.getParameters()){let n=Ze(t.getType().getText());if(Ye.has(n)){let r=t.getNameNode();e.report({filePath:e.filePath,message:`Controller injects ORM type '${n}' directly. Use a service layer.`,help:this.meta.help,line:r.getStartLineNumber(),column:r.getStartLinePos()+1})}}for(let n of t.getConstructors()[0]?.getParameters()??[])for(let t of n.getDecorators()){let n=t.getName();(n===`InjectRepository`||n===`InjectModel`)&&e.report({filePath:e.filePath,message:`Controller uses @${n}() decorator. Move data access to a service.`,help:this.meta.help,line:t.getStartLineNumber(),column:1})}}}}};function Ze(e){let t=e.match(qe);if(t)return t[1];let n=e.match(Je);return n?n[1]:e}const Qe=/\.(\w+)$/,$e=/^(\w+)</,et=new Set([`PrismaService`,`PrismaClient`,`EntityManager`,`DataSource`,`Connection`,`MikroORM`]),tt={meta:{id:`architecture/no-orm-in-services`,category:`architecture`,severity:`warning`,description:`Services should use repository abstractions instead of ORM directly`,help:`Create a repository class that wraps ORM calls and inject that instead.`},check(e){for(let t of e.sourceFile.getClasses()){if(!Ee(t))continue;let n=t.getName()??``;if(n.endsWith(`Repository`)||n.endsWith(`Repo`))continue;let r=t.getConstructors()[0];if(r)for(let t of r.getParameters()){let n=nt(t.getType().getText());if(et.has(n)){let r=t.getNameNode();e.report({filePath:e.filePath,message:`Service injects ORM type '${n}' directly. Consider using a repository abstraction.`,help:this.meta.help,line:r.getStartLineNumber(),column:r.getStartLinePos()+1})}for(let n of t.getDecorators()){let t=n.getName();(t===`InjectRepository`||t===`InjectModel`)&&e.report({filePath:e.filePath,message:`Service uses @${t}() directly. Consider wrapping in a repository class.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}}}};function nt(e){let t=e.match(Qe);if(t)return t[1];let n=e.match($e);return n?n[1]:e}const rt=/\.(\w+)$/,it=/^(\w+)</,at=[/Repository$/,/Repo$/],ot={meta:{id:`architecture/no-repository-in-controllers`,category:`architecture`,severity:`error`,description:`Controllers must not inject repositories directly — use the service layer`,help:`Move database access to a service and inject the service into the controller instead.`},check(e){for(let t of e.sourceFile.getClasses()){if(!w(t))continue;let n=t.getConstructors()[0];if(n){for(let t of n.getParameters()){let n=st(t.getType().getText());if(at.some(e=>e.test(n))){let r=t.getNameNode();e.report({filePath:e.filePath,message:`Controller injects repository '${n}' directly. Use a service layer instead.`,help:this.meta.help,line:r.getStartLineNumber(),column:r.getStartLinePos()+1})}}for(let t of e.sourceFile.getImportDeclarations()){let n=t.getModuleSpecifierValue();(n.includes(`/repositories/`)||n.includes(`/repositories`))&&e.report({filePath:e.filePath,message:`Controller imports from repository path '${n}'.`,help:this.meta.help,line:t.getStartLineNumber(),column:1})}}}}};function st(e){let t=e.match(rt);if(t)return t[1];let n=e.match(it);return n?n[1]:e}const ct={meta:{id:`architecture/no-service-locator`,category:`architecture`,severity:`warning`,description:`Avoid using ModuleRef.get() or ModuleRef.resolve() — prefer explicit constructor injection`,help:`Replace ModuleRef.get()/resolve() with constructor injection for explicit, testable dependencies.`},check(e){let t=e.sourceFile.getDescendantsOfKind(f.CallExpression);for(let n of t){let t=n.getExpression();if(t.getKind()!==f.PropertyAccessExpression)continue;let r=t.asKind(f.PropertyAccessExpression);if(!r)continue;let i=r.getName();if(i!==`get`&&i!==`resolve`)continue;let a=r.getExpression().getText();(a===`moduleRef`||a===`this.moduleRef`)&&e.report({filePath:e.filePath,message:`Service locator pattern: '${a}.${i}()' hides dependencies. Use constructor injection instead.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}},lt={meta:{id:`architecture/prefer-constructor-injection`,category:`architecture`,severity:`warning`,description:`Prefer constructor injection over @Inject() property injection`,help:`Move the dependency to a constructor parameter instead of using property injection.`},check(e){for(let t of e.sourceFile.getClasses())if(De(t))for(let n of t.getProperties())n.getDecorator(`Inject`)&&e.report({filePath:e.filePath,message:`Property '${n.getName()}' uses @Inject() decorator. Prefer constructor injection.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}},ut=[`/repositories/`,`/entities/`,`/dto/`,`/guards/`,`/interceptors/`,`/pipes/`,`/strategies/`],dt={meta:{id:`architecture/require-module-boundaries`,category:`architecture`,severity:`info`,description:`Avoid deep imports into other feature modules' internals`,help:`Import from the module's public API (barrel export) instead of reaching into its internals.`},check(e){for(let t of e.sourceFile.getImportDeclarations()){let n=t.getModuleSpecifierValue();n.startsWith(`.`)&&n.includes(`../`)&&ut.some(e=>n.includes(e))&&e.report({filePath:e.filePath,message:`Import '${n}' reaches into another module's internals.`,help:this.meta.help,line:t.getStartLineNumber(),column:1})}}};function R(e){return e.getDescendantsOfKind(f.ReturnStatement).some(e=>{let t=e.getExpression();return!t||t.getKind()!==f.NewExpression?!1:t.asKindOrThrow(f.NewExpression).getExpression().getText()===`Promise`})}const ft={meta:{id:`correctness/no-async-without-await`,category:`correctness`,severity:`warning`,description:`Async functions/methods should contain at least one await expression`,help:`Either add an await expression or remove the async keyword.`},check(e){for(let t of e.sourceFile.getClasses())for(let n of t.getMethods()){if(!n.isAsync()||w(t)&&T(n)||Ae(n))continue;let r=n.getBody();if(r&&r.getDescendantsOfKind(f.AwaitExpression).filter(e=>{let t=e.getParent();for(;t&&t!==r;){if(t.getKind()===f.ArrowFunction||t.getKind()===f.FunctionExpression||t.getKind()===f.FunctionDeclaration)return!1;t=t.getParent()}return!0}).length===0){let t=n.getName();R(r)?e.report({filePath:e.filePath,message:`Async method '${t}()' returns a Promise directly — remove the async keyword.`,help:`The async keyword is unnecessary when you are already constructing a Promise manually. Remove async to avoid double-wrapping.`,line:n.getStartLineNumber(),column:1}):e.report({filePath:e.filePath,message:`Async method '${t}()' has no await expression.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}for(let t of e.sourceFile.getFunctions()){if(!t.isAsync())continue;let n=t.getBody();if(n&&n.getDescendantsOfKind(f.AwaitExpression).filter(e=>{let t=e.getParent();for(;t&&t!==n;){if(t.getKind()===f.ArrowFunction||t.getKind()===f.FunctionExpression||t.getKind()===f.FunctionDeclaration)return!1;t=t.getParent()}return!0}).length===0){let r=t.getName()??`anonymous`;R(n)?e.report({filePath:e.filePath,message:`Async function '${r}()' returns a Promise directly — remove the async keyword.`,help:`The async keyword is unnecessary when you are already constructing a Promise manually. Remove async to avoid double-wrapping.`,line:t.getStartLineNumber(),column:1}):e.report({filePath:e.filePath,message:`Async function '${r}()' has no await expression.`,help:this.meta.help,line:t.getStartLineNumber(),column:1})}}}},pt=[`providers`,`controllers`,`imports`,`exports`],mt={meta:{id:`correctness/no-duplicate-module-metadata`,category:`correctness`,severity:`warning`,description:`Same identifier should not appear twice in a module metadata array`,help:`Remove the duplicate entry from the module metadata.`},check(e){for(let t of e.sourceFile.getClasses()){if(!Oe(t))continue;let n=t.getDecorator(`Module`);if(!n)continue;let r=n.getArguments()[0];if(!r||r.getKind()!==f.ObjectLiteralExpression)continue;let i=r.asKind(f.ObjectLiteralExpression);if(i)for(let t of pt){let n=i.getProperty(t);if(!n)continue;let r=n.getChildrenOfKind(f.ArrayLiteralExpression)[0];if(!r)continue;let a=new Set;for(let n of r.getElements()){let r=n.getText();a.has(r)?e.report({filePath:e.filePath,message:`Duplicate '${r}' in @Module() ${t} array.`,help:this.meta.help,line:n.getStartLineNumber(),column:1}):a.add(r)}}}}},ht=new Set([`Get`,`Post`,`Put`,`Delete`,`Patch`,`All`,`Head`,`Options`]),gt={meta:{id:`correctness/no-duplicate-routes`,category:`correctness`,severity:`error`,description:`Same HTTP method + route path + version should not appear twice in a single controller`,help:`Remove or rename one of the duplicate route handlers.`},check(e){for(let t of e.sourceFile.getClasses()){if(!w(t))continue;let n=new Map;for(let r of t.getMethods())for(let t of r.getDecorators()){let i=t.getName();if(!ht.has(i))continue;let a=t.getArguments(),o=a.length>0?a[0].getText():`""`,s=r.getDecorator(`Version`),c=`${i}:${o}:${s?s.getArguments()[0]?.getText()??``:``}`,l=n.get(c);l?e.report({filePath:e.filePath,message:`Duplicate route: @${i}(${o}) is already defined in '${l}()'.`,help:this.meta.help,line:r.getStartLineNumber(),column:1}):n.set(c,r.getName())}}}},_t={meta:{id:`correctness/no-empty-handlers`,category:`correctness`,severity:`warning`,description:`Controller HTTP handlers should not have empty bodies`,help:`Add implementation to the handler method or remove it if unnecessary.`},check(e){for(let t of e.sourceFile.getClasses())if(w(t))for(let n of t.getMethods()){if(!n.getDecorators().some(e=>S.has(e.getName())))continue;let t=n.getBody();if(!t)continue;let r=t.asKind(f.Block);r&&r.getStatements().length===0&&e.report({filePath:e.filePath,message:`Handler '${n.getName()}()' has an empty body.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}};function vt(e){let t=e.getReturnType().getText();return t.startsWith(`Promise<`)||t===`Promise`?!0:t===`any`||t===`error`?`unknown`:!1}const z=new Set([`save`,`create`,`insert`,`update`,`delete`,`remove`,`send`,`emit`,`publish`,`dispatch`,`execute`,`fetch`,`load`,`upload`,`download`,`process`]),yt={meta:{id:`correctness/no-fire-and-forget-async`,category:`correctness`,severity:`warning`,description:`Calling async functions without await leads to unhandled promise rejections`,help:`Add await before the async call, or use void with explicit error handling if fire-and-forget is intentional.`},check(e){for(let t of e.sourceFile.getClasses())for(let n of t.getMethods()){if(T(n))continue;let t=n.getBody();if(!t)continue;let r=t.getDescendantsOfKind(f.ExpressionStatement);for(let t of r){let r=t.getExpression();if(r.getKind()===f.VoidExpression||r.getKind()===f.AwaitExpression||r.getKind()!==f.CallExpression)continue;let i=r.asKind(f.CallExpression);if(!i)continue;let a=i.getExpression().getText().split(`.`).pop()??``,o=vt(i);if(o!==!1){if(o===`unknown`){let e=a.toLowerCase();if(!(z.has(e)||[...z].some(t=>e.startsWith(t)&&e!==t)))continue}t.getFirstAncestorByKind(f.MethodDeclaration)===n&&e.report({filePath:e.filePath,message:`Async call '${a}()' is not awaited — unhandled rejections will crash the process.`,help:this.meta.help,line:t.getStartLineNumber(),column:1})}}}}},bt={meta:{id:`correctness/no-missing-filter-catch`,category:`correctness`,severity:`error`,description:`Exception filter classes decorated with @Catch() must implement the catch() method`,help:`Add a catch(exception, host: ArgumentsHost) method to the filter class.`},check(e){for(let t of e.sourceFile.getClasses())C(t,`Catch`)&&(t.getExtends()||t.getMethods().some(e=>e.getName()===`catch`)||e.report({filePath:e.filePath,message:`Exception filter '${t.getName()}' has @Catch() but is missing the 'catch()' method.`,help:this.meta.help,line:t.getStartLineNumber(),column:1}))}},xt={meta:{id:`correctness/no-missing-guard-method`,category:`correctness`,severity:`error`,description:`Guard classes must implement the canActivate() method`,help:`Add a canActivate(context: ExecutionContext) method to the guard class.`},check(e){for(let t of e.sourceFile.getClasses()){let n=t.getName()??``;n.endsWith(`Guard`)&&C(t,`Injectable`)&&(t.getExtends()||t.getMethods().some(e=>e.getName()===`canActivate`)||e.report({filePath:e.filePath,message:`Guard '${n}' is missing the 'canActivate()' method.`,help:this.meta.help,line:t.getStartLineNumber(),column:1}))}}},St={meta:{id:`correctness/no-missing-injectable`,category:`correctness`,severity:`error`,description:`Provider classes with constructor dependencies must have the @Injectable() decorator`,help:`Add @Injectable() to providers that inject constructor dependencies.`,scope:`project`},check(e){let t=new Set([...e.providers.values()].map(e=>e.name)),n=new Map;for(let t of e.files){let r=e.project.getSourceFile(t);if(r)for(let e of r.getClasses()){let r=e.getName();if(r){let i=n.get(r)??[];i.push({cls:e,filePath:t}),n.set(r,i)}}}for(let r of e.moduleGraph.modules.values())for(let i of r.providers){if(t.has(i))continue;let a=n.get(i);if(a)for(let{cls:t,filePath:n}of a){let a=(t.getConstructors()[0]?.getParameters().length??0)>0;!(t.getDecorator(`Injectable`)||t.getDecorator(`Resolver`)||t.getDecorator(`WebSocketGateway`))&&a&&e.report({filePath:n,message:`Class '${i}' is listed in '${r.name}' providers but is missing @Injectable() decorator.`,help:this.meta.help,line:t.getStartLineNumber(),column:1})}}}},Ct={meta:{id:`correctness/no-missing-interceptor-method`,category:`correctness`,severity:`error`,description:`Interceptor classes must implement the intercept() method`,help:`Add an intercept(context: ExecutionContext, next: CallHandler) method to the interceptor class.`},check(e){for(let t of e.sourceFile.getClasses()){let n=t.getName()??``;n.endsWith(`Interceptor`)&&C(t,`Injectable`)&&(t.getExtends()||t.getMethods().some(e=>e.getName()===`intercept`)||e.report({filePath:e.filePath,message:`Interceptor '${n}' is missing the 'intercept()' method.`,help:this.meta.help,line:t.getStartLineNumber(),column:1}))}}},wt={meta:{id:`correctness/no-missing-module-decorator`,category:`correctness`,severity:`warning`,description:`Classes named *Module should have a @Module() decorator`,help:`Add @Module({}) decorator to the class, or rename it if it is not a NestJS module.`},check(e){for(let t of e.sourceFile.getClasses()){let n=t.getName()??``;n.endsWith(`Module`)&&(n===`Module`||n===`DynamicModule`||C(t,`Module`)||e.report({filePath:e.filePath,message:`Class '${n}' is named like a module but is missing the @Module() decorator.`,help:this.meta.help,line:t.getStartLineNumber(),column:1}))}}},Tt={meta:{id:`correctness/no-missing-pipe-method`,category:`correctness`,severity:`error`,description:`Pipe classes must implement the transform() method`,help:`Add a transform(value: any, metadata: ArgumentMetadata) method to the pipe class.`},check(e){for(let t of e.sourceFile.getClasses()){let n=t.getName()??``;n.endsWith(`Pipe`)&&C(t,`Injectable`)&&(t.getExtends()||t.getMethods().some(e=>e.getName()===`transform`)||e.report({filePath:e.filePath,message:`Pipe '${n}' is missing the 'transform()' method.`,help:this.meta.help,line:t.getStartLineNumber(),column:1}))}}},Et={meta:{id:`correctness/prefer-readonly-injection`,category:`correctness`,severity:`warning`,description:`Constructor DI parameters should be readonly to prevent accidental reassignment`,help:`Add the 'readonly' modifier to the constructor parameter.`},check(e){for(let t of e.sourceFile.getClasses()){if(!(Ee(t)||w(t)))continue;let n=t.getConstructors()[0];if(n){for(let t of n.getParameters())if((t.hasModifier(`private`)||t.hasModifier(`protected`)||t.hasModifier(`public`))&&!t.isReadonly()){let n=t.getNameNode();e.report({filePath:e.filePath,message:`Constructor parameter '${t.getName()}' should be readonly.`,help:this.meta.help,line:n.getStartLineNumber(),column:n.getStartLinePos()+1})}}}}},Dt={meta:{id:`correctness/require-inject-decorator`,category:`correctness`,severity:`error`,description:`Constructor parameters without type annotations must have @Inject() decorator for NestJS DI to resolve them`,help:`Add a type annotation or @Inject() decorator to the constructor parameter.`},check(e){for(let t of e.sourceFile.getClasses()){if(!De(t))continue;let n=t.getConstructors()[0];if(n)for(let r of n.getParameters()){let n=r.getTypeNode(),i=r.getDecorators().some(e=>e.getName()===`Inject`);n||i||e.report({filePath:e.filePath,message:`Constructor parameter '${r.getName()}' in '${t.getName()}' has no type annotation and no @Inject() decorator — NestJS cannot resolve it.`,help:this.meta.help,line:r.getStartLineNumber(),column:1})}}}},Ot={onModuleInit:`OnModuleInit`,onModuleDestroy:`OnModuleDestroy`,onApplicationBootstrap:`OnApplicationBootstrap`,onApplicationShutdown:`OnApplicationShutdown`,beforeApplicationShutdown:`BeforeApplicationShutdown`},kt={meta:{id:`correctness/require-lifecycle-interface`,category:`correctness`,severity:`warning`,description:`Classes with lifecycle methods should implement the corresponding NestJS interface`,help:`Add 'implements OnModuleInit' (or the appropriate interface) to the class declaration.`},check(e){for(let t of e.sourceFile.getClasses()){let n=t.getImplements().map(e=>e.getText());for(let r of t.getMethods()){let i=r.getName(),a=Ot[i];a&&(n.some(e=>e.includes(a))||e.report({filePath:e.filePath,message:`Class '${t.getName()}' has '${i}()' but does not implement '${a}'.`,help:this.meta.help,line:r.getStartLineNumber(),column:1}))}}}},At=new Set([f.ForStatement,f.ForOfStatement,f.ForInStatement,f.WhileStatement,f.DoStatement,f.AwaitExpression]),jt={meta:{id:`performance/no-blocking-constructor`,category:`performance`,severity:`warning`,description:`Constructors in Injectable/Controller classes should not contain heavy operations`,help:`Move complex initialization logic to onModuleInit() lifecycle method instead.`},check(e){for(let t of e.sourceFile.getClasses()){if(!(C(t,`Injectable`)||C(t,`Controller`)))continue;let n=t.getConstructors()[0];if(!n)continue;let r=n.getBody();if(r){for(let i of r.getDescendants())if(At.has(i.getKind())){e.report({filePath:e.filePath,message:`Constructor in '${t.getName()}' contains blocking operation — use onModuleInit() instead.`,help:this.meta.help,line:n.getStartLineNumber(),column:1});break}}}}},Mt={meta:{id:`performance/no-dynamic-require`,category:`performance`,severity:`warning`,description:`Dynamic require() with variable arguments prevents bundler optimization`,help:`Use static import statements or dynamic import() with string literals.`},check(e){let t=e.sourceFile.getDescendantsOfKind(f.CallExpression);for(let n of t){if(n.getExpression().getText()!==`require`)continue;let t=n.getArguments();t.length!==0&&t[0].getKind()!==f.StringLiteral&&e.report({filePath:e.filePath,message:`Dynamic require() with non-literal argument prevents bundler optimization.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}},Nt={meta:{id:`performance/no-orphan-modules`,category:`performance`,severity:`info`,description:`Module is never imported by any other module and may be dead code`,help:`Import this module in another module or remove it if it is unused.`,scope:`project`},check(e){let t=new Set;for(let n of e.moduleGraph.modules.values())for(let e of n.imports)t.add(e);for(let n of e.moduleGraph.modules.values())n.name!==`AppModule`&&(t.has(n.name)||e.report({filePath:n.filePath,message:`Module '${n.name}' is never imported by any other module.`,help:this.meta.help,line:n.classDeclaration.getStartLineNumber(),column:1}))}},Pt={meta:{id:`performance/no-request-scope-abuse`,category:`performance`,severity:`warning`,description:`Scope.REQUEST creates a new provider instance per request — use only when necessary`,help:`Remove Scope.REQUEST unless the provider genuinely needs per-request state (e.g., request-scoped context). Consider Scope.DEFAULT or Scope.TRANSIENT instead.`},check(e){let t=e.sourceFile.getDescendantsOfKind(f.PropertyAccessExpression);for(let n of t)n.getName()===`REQUEST`&&n.getExpression().getText()===`Scope`&&e.report({filePath:e.filePath,message:`Scope.REQUEST creates a new instance per request, which impacts performance and propagates request scope to all dependents.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}},Ft=new Set([`readFileSync`,`writeFileSync`,`existsSync`,`mkdirSync`,`readdirSync`,`statSync`,`accessSync`,`appendFileSync`,`copyFileSync`,`renameSync`,`unlinkSync`]),It={meta:{id:`performance/no-sync-io`,category:`performance`,severity:`warning`,description:`Synchronous I/O calls block the event loop and should be avoided in NestJS applications`,help:`Use the async variant (e.g., readFile instead of readFileSync) with await.`},check(e){let t=e.sourceFile.getDescendantsOfKind(f.CallExpression);for(let n of t){let t=n.getExpression().getText().split(`.`).pop()??``;Ft.has(t)&&e.report({filePath:e.filePath,message:`Synchronous I/O call '${t}()' blocks the event loop.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}},Lt={meta:{id:`performance/no-unused-module-exports`,category:`performance`,severity:`info`,description:`Module exports a provider that no importing module actually uses`,help:`Remove the unused export or use the provider in an importing module.`,scope:`project`},check(e){for(let t of e.moduleGraph.modules.values()){if(t.exports.length===0)continue;let n=[];for(let r of e.moduleGraph.modules.values())r.name!==t.name&&r.imports.includes(t.name)&&n.push(r.name);if(n.length===0)continue;let r=new Set;for(let i of n){let n=e.moduleGraph.modules.get(i);if(n){for(let t of n.providers){let n=e.providers.get(t);if(n)for(let e of n.dependencies)r.add(e)}if(n.exports.includes(t.name))for(let e of t.exports)r.add(e);for(let t of n.controllers)for(let n of e.files){let i=e.project.getSourceFile(n);if(i)for(let e of i.getClasses()){if(e.getName()!==t)continue;let n=e.getConstructors()[0];if(n)for(let e of n.getParameters()){let t=e.getTypeNode(),n=t?t.getText():e.getType().getText(),i=n.split(`.`).pop()?.split(`<`)[0]??n;r.add(i)}}}}}for(let n of t.exports)e.moduleGraph.modules.has(n)||r.has(n)||e.report({filePath:t.filePath,message:`Module '${t.name}' exports '${n}' but no importing module uses it.`,help:this.meta.help,line:t.classDeclaration.getStartLineNumber(),column:1})}}},Rt=[`Guard`,`Interceptor`,`Filter`,`Middleware`,`Strategy`],zt={meta:{id:`performance/no-unused-providers`,category:`performance`,severity:`warning`,description:`Injectable providers that are never injected by any other provider may be dead code`,help:`Remove the unused provider or inject it where needed.`,scope:`project`},check(e){let t=new Set;for(let n of e.providers.values())for(let e of n.dependencies)t.add(e);let n=[`Controller`,`Resolver`,`WebSocketGateway`];for(let r of e.files){let i=e.project.getSourceFile(r);if(i)for(let e of i.getClasses()){if(!n.some(t=>e.getDecorator(t)!==void 0))continue;let r=e.getConstructors()[0];if(r)for(let e of r.getParameters()){let n=e.getTypeNode(),r=n?n.getText():e.getType().getText(),i=r.split(`.`).pop()?.split(`<`)[0]??r;t.add(i)}}}for(let n of e.providers.values()){let r=n.name;if(Rt.some(e=>r.endsWith(e))||t.has(r))continue;let i=!1;for(let t of e.moduleGraph.modules.values())if(t.exports.includes(r)){i=!0;break}i||e.report({filePath:n.filePath,message:`Provider '${r}' is never injected by any other provider or controller.`,help:this.meta.help,line:n.classDeclaration.getStartLineNumber(),column:1})}}},Bt={meta:{id:`schema/require-cascade-rule`,category:`schema`,scope:`schema`,severity:`info`,description:`Relations should have explicit onDelete/cascade behavior defined`,help:`Add an explicit onDelete option (e.g. CASCADE, SET NULL) to avoid relying on database defaults.`},check(e){for(let t of e.schemaGraph.relations)if(!(t.type!==`many-to-one`&&t.type!==`one-to-one`)&&!t.onDelete){let n=e.schemaGraph.entities.get(t.fromEntity);if(!n)continue;e.report({filePath:n.filePath,entity:n.name,message:`Relation '${t.propertyName}' on '${t.fromEntity}' has no explicit onDelete behavior.`,help:this.meta.help})}}},Vt={meta:{id:`schema/require-primary-key`,category:`schema`,scope:`schema`,severity:`error`,description:`Every entity must have at least one primary key column`,help:`Add a primary key column (e.g. @id in Prisma, @PrimaryColumn/@PrimaryGeneratedColumn in TypeORM).`},check(e){for(let t of e.schemaGraph.entities.values())t.columns.some(e=>e.isPrimary)||e.report({filePath:t.filePath,entity:t.name,message:`Entity '${t.name}' has no primary key column.`,help:this.meta.help})}},Ht=/delete/i;function Ut(e,t){let n=new Set(e.columns.map(e=>e.name.toLowerCase()));return n.has(`createdat`)||n.has(`created_at`)?!0:t===`typeorm`?e.columns.some(e=>e.type===`timestamp`&&e.isGenerated&&!Ht.test(e.name)):t===`prisma`?e.columns.some(e=>e.type===`DateTime`&&e.defaultValue!==void 0&&e.defaultValue.includes(`now()`)):t===`drizzle`?e.columns.some(e=>(e.type===`timestamp`||e.type===`date`||e.type===`datetime`)&&e.defaultValue!==void 0&&e.defaultValue.includes(`now()`)):!1}const Wt={meta:{id:`schema/require-timestamps`,category:`schema`,scope:`schema`,severity:`warning`,description:`Entities should have timestamp columns (createdAt/updatedAt)`,help:`Add createdAt/updatedAt columns to track when records are created and modified.`},check(e){for(let t of e.schemaGraph.entities.values())Ut(t,e.orm)||e.report({filePath:t.filePath,entity:t.name,message:`Entity '${t.name}' has no timestamp columns (createdAt/updatedAt).`,help:this.meta.help})}},Gt={meta:{id:`security/no-csrf-disabled`,category:`security`,severity:`error`,description:`CSRF protection should not be explicitly disabled`,help:`Enable CSRF protection or remove the explicit disabling of it.`},check(e){let t=e.sourceFile.getDescendantsOfKind(f.PropertyAssignment);for(let n of t){let t=n.getName();if(t!==`csrf`&&t!==`csrfProtection`)continue;let r=n.getInitializer();r&&r.getText()===`false`&&e.report({filePath:e.filePath,message:`CSRF protection explicitly disabled (${t}: false).`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}},Kt={meta:{id:`security/no-dangerous-redirects`,category:`security`,severity:`error`,description:`Redirects using user-controlled input (from @Query/@Param) are an open redirect vulnerability`,help:`Validate redirect URLs against an allowlist of safe destinations.`},check(e){for(let t of e.sourceFile.getClasses())if(w(t))for(let n of t.getMethods()){let t=new Set;for(let e of n.getParameters())e.getDecorators().some(e=>e.getName()===`Query`||e.getName()===`Param`)&&t.add(e.getName());if(t.size===0)continue;let r=n.getDescendantsOfKind(f.CallExpression);for(let n of r)if(n.getExpression().getText().endsWith(`redirect`))for(let r of n.getArguments()){let i=r.getText();t.has(i)&&e.report({filePath:e.filePath,message:`Redirect uses user-controlled parameter '${i}' — open redirect risk.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}let i=n.getDecorators().find(e=>e.getName()===`Redirect`);if(i)for(let n of i.getArguments()){let r=n.getText();t.has(r)&&e.report({filePath:e.filePath,message:`@Redirect() uses user-controlled parameter '${r}' — open redirect risk.`,help:this.meta.help,line:i.getStartLineNumber(),column:1})}}}},qt={meta:{id:`security/no-eval`,category:`security`,severity:`error`,description:`Usage of eval() or new Function() is a security risk and should be avoided`,help:`Refactor to avoid eval() and new Function(). Use safer alternatives like JSON.parse() or a sandboxed interpreter.`},check(e){let t=e.sourceFile.getDescendantsOfKind(f.CallExpression);for(let n of t)n.getExpression().getText()===`eval`&&e.report({filePath:e.filePath,message:`Usage of eval() is a security risk.`,help:this.meta.help,line:n.getStartLineNumber(),column:1});let n=e.sourceFile.getDescendantsOfKind(f.NewExpression);for(let t of n)t.getExpression().getText()===`Function`&&e.report({filePath:e.filePath,message:`Usage of new Function() is a security risk.`,help:this.meta.help,line:t.getStartLineNumber(),column:1})}},Jt={meta:{id:`security/no-exposed-env-vars`,category:`security`,severity:`warning`,description:`Use NestJS ConfigService instead of direct process.env access in Injectable/Controller classes`,help:`Inject ConfigService and use configService.get('VAR_NAME') instead of process.env.VAR_NAME.`},check(e){for(let t of e.sourceFile.getClasses()){if(!(C(t,`Injectable`)||C(t,`Controller`)))continue;let n=t.getDescendantsOfKind(f.PropertyAccessExpression);for(let r of n)r.getExpression().getText()===`process.env`&&e.report({filePath:e.filePath,message:`Direct 'process.env.${r.getName()}' access in '${t.getName()}'. Use ConfigService instead.`,help:this.meta.help,line:r.getStartLineNumber(),column:1})}}},Yt=/^(error|err|e|ex|exception)$/,Xt={meta:{id:`security/no-exposed-stack-trace`,category:`security`,severity:`warning`,description:`Stack traces should not be exposed in responses — they leak internal implementation details`,help:`Log the stack trace internally and return a generic error message to the client.`},check(e){let t=e.sourceFile.getDescendantsOfKind(f.PropertyAccessExpression);for(let n of t){if(n.getName()!==`stack`)continue;let t=n.getExpression().getText();if(!(Yt.test(t)||t.endsWith(`.error`)||t.endsWith(`.err`)))continue;let r=n.getParent();if(!r)continue;let i=r.getKind();(i===f.ReturnStatement||i===f.PropertyAssignment||i===f.ShorthandPropertyAssignment||i===f.CallExpression)&&e.report({filePath:e.filePath,message:`Stack trace '${t}.stack' may be exposed in response — leaks implementation details.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}},Zt=[{pattern:/^(?=.*\d)[A-Za-z0-9+/]{40,}={0,2}$/,name:`Base64 key`},{pattern:/^sk[-_][a-zA-Z0-9]{20,}$/,name:`Secret key`},{pattern:/^pk[-_][a-zA-Z0-9]{20,}$/,name:`Public key (in source)`},{pattern:/^ghp_[a-zA-Z0-9]{36,}$/,name:`GitHub personal access token`},{pattern:/^github_pat_[a-zA-Z0-9_]{22,}$/,name:`GitHub fine-grained PAT`},{pattern:/^gho_[a-zA-Z0-9]{36,}$/,name:`GitHub OAuth token`},{pattern:/^xox[bpras]-[a-zA-Z0-9-]+$/,name:`Slack token`},{pattern:/^eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\./,name:`JWT token`},{pattern:/^AKIA[0-9A-Z]{16}$/,name:`AWS Access Key ID`},{pattern:/^[a-f0-9]{64}$/,name:`Hex-encoded secret (64 chars)`}],Qt=[/secret/i,/password/i,/passwd/i,/api[_-]?key/i,/auth[_-]?token/i,/private[_-]?key/i,/access[_-]?key/i,/client[_-]?secret/i],$t=new Set([`your-secret-here`,`changeme`,`password`]),en=/^[A-Za-z][A-Za-z0-9_]*(\.[A-Za-z][A-Za-z0-9_]*)+$/,B=new Set([`cursor`,`nextCursor`,`prevCursor`,`previousCursor`,`startCursor`,`endCursor`,`pageToken`,`nextPageToken`,`continuationToken`,`continuation`,`nextPage`,`afterCursor`,`beforeCursor`]);function V(e){return!(e.length<8||e.includes("${")||e.startsWith(`process.env`)||$t.has(e)||e.includes(` `)||en.test(e))}function H(e){return Qt.some(t=>t.test(e))}function tn(e){try{let t=Buffer.from(e,`base64`).toString(`utf-8`);return JSON.parse(t),!0}catch{return!1}}function nn(e){let t=new Map;for(let n of e)t.set(n,(t.get(n)??0)+1);let n=0;for(let r of t.values()){let t=r/e.length;n-=t*Math.log2(t)}return n}const U=new Set([...`aeiouyAEIOUY`]),rn=/^[A-Z]{2,4}_/,an=/(?<=[a-z])(?=[A-Z])|(?<=[A-Za-z])(?=\d)|(?<=\d)(?=[A-Za-z])|_/,on=/[a-zA-Z]/;function sn(e){let t=e.includes(`_`),n=e.split(an).filter(e=>e.length>0).filter(e=>on.test(e)),r=n.filter(e=>e.length>=4&&[...e].some(e=>U.has(e)));return n.slice(0,6).filter(e=>e.length>=4&&[...e].some(e=>U.has(e))).length>=2||t&&e.split(`_`).filter(e=>e.length>=3).length>=2||rn.test(e)?!0:(nn(e)>4.9&&!t&&r.length,!1)}function cn(e){let t=e.getParent();if(!t)return!1;let n=t.asKind(f.PropertyAssignment);if(n)return B.has(n.getName());let r=t.asKind(f.VariableDeclaration);return r?B.has(r.getName()):!1}const ln={meta:{id:`security/no-hardcoded-secrets`,category:`security`,severity:`error`,description:`Detect hardcoded secrets, API keys, and tokens in source code`,help:`Move secrets to environment variables and access them via ConfigService.`},check(e){let t=e.sourceFile.getDescendantsOfKind(f.StringLiteral);for(let n of t){let t=n.getLiteralValue();if(!(t.length<16)&&n.getParent()?.getKind()!==f.ImportDeclaration){for(let{pattern:r,name:i}of Zt)if(r.test(t)){if(i===`Base64 key`&&(tn(t)||cn(n)||sn(t)))break;e.report({filePath:e.filePath,message:`Possible hardcoded ${i} detected.`,help:this.meta.help,line:n.getStartLineNumber(),column:1});break}}}let n=e.sourceFile.getDescendantsOfKind(f.VariableDeclaration);for(let t of n){let n=t.getName(),r=t.getInitializer();!r||r.getKind()!==f.StringLiteral||H(n)&&V(r.getText().slice(1,-1))&&e.report({filePath:e.filePath,message:`Variable '${n}' appears to contain a hardcoded secret.`,help:this.meta.help,line:t.getStartLineNumber(),column:1})}let r=e.sourceFile.getDescendantsOfKind(f.PropertyAssignment);for(let t of r){let n=t.getName(),r=t.getInitializer();!r||r.getKind()!==f.StringLiteral||H(n)&&V(r.getText().slice(1,-1))&&e.report({filePath:e.filePath,message:`Property '${n}' appears to contain a hardcoded secret.`,help:this.meta.help,line:t.getStartLineNumber(),column:1})}}},un=RegExp(`(?:^|[^a-zA-Z])\\w*(?:${[`Entity`,`Model`].join(`|`)})(?:[^a-zA-Z]|$)`),dn={meta:{id:`security/no-raw-entity-in-response`,category:`security`,severity:`warning`,description:`Returning ORM entities directly from controllers can leak internal fields like passwords or IDs`,help:`Map entities to DTOs or use class-transformer's @Exclude()/@Expose() decorators before returning. This rule detects classes with Entity/Model suffix in return types.`},check(e){for(let t of e.sourceFile.getClasses())if(w(t))for(let n of t.getMethods()){if(!T(n))continue;let t=n.getReturnType().getText();un.test(t)&&!t.includes(`DTO`)&&!t.includes(`Dto`)&&!t.includes(`Response`)&&e.report({filePath:e.filePath,message:`Controller method '${n.getName()}' returns a raw entity type. This may leak internal fields.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}},fn={meta:{id:`security/no-synchronize-in-production`,category:`security`,severity:`error`,description:`TypeORM synchronize: true auto-syncs schema and can drop columns or tables in production`,help:`Set synchronize: false and use migrations for production schema changes.`},check(e){let t=e.sourceFile.getDescendantsOfKind(f.PropertyAssignment);for(let n of t){if(n.getName()!==`synchronize`)continue;let t=n.getInitializer();t&&t.getText()===`true`&&e.report({filePath:e.filePath,message:`TypeORM 'synchronize: true' can auto-drop columns and tables in production.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}},pn=new Set([`md5`,`sha1`]),W=[je,ot,Xe,tt,Ke,ct,lt,dt,Te,He,Et,kt,_t,gt,xt,Tt,bt,Ct,ft,mt,wt,Dt,yt,St,ln,qt,{meta:{id:`security/no-weak-crypto`,category:`security`,severity:`warning`,description:`Weak hashing algorithms (MD5, SHA1) should not be used for security purposes`,help:`Use a stronger algorithm like SHA-256 or bcrypt for password hashing.`},check(e){let t=e.sourceFile.getDescendantsOfKind(f.CallExpression);for(let n of t){if(!n.getExpression().getText().endsWith(`createHash`))continue;let t=n.getArguments();if(t.length===0)continue;let r=t[0];if(r.getKind()!==f.StringLiteral)continue;let i=r.getText().slice(1,-1).toLowerCase();pn.has(i)&&e.report({filePath:e.filePath,message:`Weak hashing algorithm '${i}' used in createHash().`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}},Jt,Gt,Xt,Kt,fn,dn,It,jt,Mt,Pt,zt,Lt,Nt,Vt,Wt,Bt];function mn(){return[...W]}function hn(e){return e.meta.scope===`project`}function gn(e){return e.meta.scope===`schema`}function _n(e,t,n){if(t.length===0)return e;let r=new Set(e.map(e=>e.meta.id)),i=[...e];for(let e of t){if(r.has(e.meta.id)){n.push(`Custom rule "${e.meta.id}" conflicts with a built-in rule and was skipped`);continue}i.push(e)}return i}function G(e,t){return t.filter(t=>{let n=e.rules?.[t.meta.id];return!(n===!1||typeof n==`object`&&n.enabled===!1||e.categories?.[t.meta.category]===!1)})}function vn(e){let t=[],n=[],r=[];for(let i of e)gn(i)?r.push(i):hn(i)?n.push(i):t.push(i);return{fileRules:t,projectRules:n,schemaRules:r}}const yn=new Set([`security`,`performance`,`correctness`,`architecture`]),bn=new Set([`error`,`warning`,`info`]),xn=new Set([`file`,`project`]),Sn=`custom/`;function Cn(e){if(typeof e!=`object`||!e)return!1;let t=e;if(typeof t.check!=`function`||typeof t.meta!=`object`||t.meta===null)return!1;let n=t.meta;return!(typeof n.id!=`string`||n.id.trim()===``||typeof n.description!=`string`||typeof n.help!=`string`||!yn.has(n.category)||!bn.has(n.severity)||n.scope!==void 0&&!xn.has(n.scope))}function wn(e){return e.meta.id.startsWith(Sn)?e:{...e,meta:{...e.meta,id:`${Sn}${e.meta.id}`}}}async function Tn(t,i){let a=[],o=[],c=s(i,t);if(!e(c))return o.push(`Custom rules directory not found: ${c}`),{rules:a,warnings:o};if(!r(c).isDirectory())return o.push(`Custom rules path is not a directory: ${c}`),{rules:a,warnings:o};let l;try{l=n(c)}catch(e){return o.push(`Failed to read custom rules directory: ${e instanceof Error?e.message:String(e)}`),{rules:a,warnings:o}}let u=l.filter(e=>e.endsWith(`.ts`));if(u.length===0)return o.push(`No rule files (.ts) found in: ${c}`),{rules:a,warnings:o};let d=m(c,{interopDefault:!0});for(let e of u){let t=s(c,e),n;try{n=await d.import(t)}catch(t){o.push(`Failed to load custom rule file "${e}": ${t instanceof Error?t.message:String(t)}`);continue}let r=!1;for(let[t,i]of Object.entries(n))Cn(i)?(a.push(wn(i)),r=!0):t!==`__esModule`&&typeof i==`object`&&i&&`meta`in i&&o.push(`Invalid rule export "${t}" in "${e}": missing or invalid required fields (check, meta.id, meta.description, meta.help, meta.category, meta.severity)`);!r&&Object.keys(n).length>0&&(Object.values(n).some(e=>typeof e==`object`&&!!e&&(`meta`in e||`check`in e))||o.push(`No valid rule exports found in "${e}"`))}return{rules:a,warnings:o}}function En(e,t){return e.customRulesDir?Tn(e.customRulesDir,t):Promise.resolve({rules:[],warnings:[]})}async function K(e,t){let n=await b(e,t),{rules:r,warnings:i}=await En(n,e),a=_n(W,r,i),{fileRules:o,projectRules:s,schemaRules:c}=vn(G(n,a));return{combinedRules:a,config:n,customRuleWarnings:i,fileRules:o,projectRules:s,schemaRules:c}}async function Dn(e,t={}){return(await l(t.include??y.include,{cwd:e,absolute:!0,ignore:t.exclude??y.exclude})).sort()}async function On(e,t,n={}){let r=await Promise.all([...t.projects.entries()].map(async([t,r])=>[t,await Dn(a(e,r),n)])),i=new Map;for(let[e,t]of r)i.set(e,t);return i}function kn(e){let t=new d({compilerOptions:{strict:!0,target:99,module:99,skipFileDependencyResolution:!0},skipAddingFilesFromTsConfig:!0});for(let n of e)t.addSourceFileAtPath(n);return t}const An=/import\([^)]+\)\.(\w+)/,jn=/^(\w+)</;function Mn(e,t){let n=[];for(let r of e.getClasses()){if(!r.getDecorator(`Injectable`))continue;let e=r.getName();if(!e)continue;let i=r.getConstructors()[0],a=i?i.getParameters().map(e=>{let t=e.getTypeNode();return Fn(t?t.getText():e.getType().getText())}):[],o=r.getMethods().filter(e=>{let t=e.getScope();return!t||t===`public`}).length;n.push({name:e,filePath:t,classDeclaration:r,dependencies:a,publicMethodCount:o})}return n}function Nn(e,t){let n=new Map;for(let r of t){let t=e.getSourceFile(r);if(t)for(let e of Mn(t,r))n.set(e.name,e)}return n}function Pn(e,t,n){for(let[t,r]of e)r.filePath===n&&e.delete(t);let r=t.getSourceFile(n);if(r)for(let t of Mn(r,n))e.set(t.name,t)}function Fn(e){let t=e.match(An);if(t)return t[1];let n=e.match(jn);return n?n[1]:e}const In=new Set([`pgTable`,`mysqlTable`,`sqliteTable`]),Ln=new Set([`serial`,`bigserial`,`smallserial`]),Rn=/=>\s*(\w+)/;function zn(e){let t={type:`unknown`,isPrimary:!1,isNullable:!0,isGenerated:!1,isUnique:!1};function n(e){if(e.getKind()===f.CallExpression){let r=e.asKindOrThrow(f.CallExpression),i=r.getExpression();if(i.getKind()===f.PropertyAccessExpression){let e=i.asKindOrThrow(f.PropertyAccessExpression);switch(e.getName()){case`primaryKey`:t.isPrimary=!0;break;case`notNull`:t.isNullable=!1;break;case`unique`:t.isUnique=!0;break;case`default`:{let e=r.getArguments();e.length>0&&(t.defaultValue=e[0].getText().replace(/['"]/g,``));break}case`defaultNow`:t.defaultValue=`now()`;break;case`generatedAlwaysAsIdentity`:case`autoincrement`:t.isGenerated=!0;break;case`references`:{let e=r.getArguments();if(e.length>0){let n=e[0].getText(),r=Rn.exec(n);if(r&&(t.reference={toEntity:r[1]}),e.length>1){let n=e[1];if(n.getKind()===f.ObjectLiteralExpression){let e=n.asKindOrThrow(f.ObjectLiteralExpression);for(let n of e.getProperties())if(n.getKind()===f.PropertyAssignment){let e=n.asKindOrThrow(f.PropertyAssignment);if(e.getName()===`onDelete`){let n=e.getInitializer()?.getText();n&&(t.reference.onDelete=n.replace(/['"]/g,``))}}}}}break}default:break}n(e.getExpression())}else if(i.getKind()===f.Identifier){let e=i.getText();t.type=e,Ln.has(e)&&(t.isGenerated=!0)}}}return n(e),t}function Bn(e){let t=[];for(let n of e.getProperties()){if(n.getKind()!==f.PropertyAssignment)continue;let e=n.asKindOrThrow(f.PropertyAssignment),r=e.getName(),i=e.getInitializer();if(!i)continue;let a=zn(i);t.push({name:r,type:a.type,isPrimary:a.isPrimary,isNullable:a.isNullable,isGenerated:a.isGenerated,isUnique:a.isUnique,defaultValue:a.defaultValue})}return t}function Vn(e,t){let n=[];for(let r of e.getProperties()){if(r.getKind()!==f.PropertyAssignment)continue;let e=r.asKindOrThrow(f.PropertyAssignment),i=e.getName(),a=e.getInitializer();if(!a)continue;let o=zn(a);o.reference&&n.push({type:`many-to-one`,fromEntity:t,toEntity:o.reference.toEntity,propertyName:i,isNullable:o.isNullable,...o.reference.onDelete?{onDelete:o.reference.onDelete}:{}})}return n}function Hn(e){let t=[],n=e.getDescendantsOfKind(f.CallExpression);for(let e of n){let n=e.getExpression();if(n.getKind()!==f.PropertyAccessExpression||n.asKindOrThrow(f.PropertyAccessExpression).getName()!==`on`)continue;let r=[];for(let t of e.getArguments())if(t.getKind()===f.PropertyAccessExpression){let e=t.asKindOrThrow(f.PropertyAccessExpression);r.push(e.getName())}if(r.length===0)continue;let i=e.getText().includes(`uniqueIndex`);t.push({columns:r,isUnique:i})}return t}function Un(e){let t=[],n=e.getFilePath();for(let r of e.getDescendantsOfKind(f.VariableDeclaration)){let e=r.getInitializer();if(!e||e.getKind()!==f.CallExpression)continue;let i=e.asKindOrThrow(f.CallExpression),a=i.getExpression();if(a.getKind()!==f.Identifier)continue;let o=a.getText();if(!In.has(o))continue;let s=i.getArguments();if(s.length<2)continue;let c=s[0],l=r.getName();c.getKind()===f.StringLiteral&&(l=c.asKindOrThrow(f.StringLiteral).getLiteralValue());let u=s[1];if(u.getKind()!==f.ObjectLiteralExpression)continue;let d=u.asKindOrThrow(f.ObjectLiteralExpression),p=r.getName(),m=Bn(d),h=Vn(d,p),g;if(s.length>=3&&(g=Hn(s[2]),g))for(let e of g)for(let t of e.columns){let e=m.find(e=>e.name===t);e&&(e.hasIndex=!0)}t.push({name:p,tableName:l,filePath:n,columns:m,relations:h,indexes:g})}return t}const Wn={supportsIncrementalUpdate:!0,extract(e,t){let n=[];for(let r of t){let t=e.getSourceFile(r);t&&n.push(...Un(t))}return n}},Gn=/^model\s+(\w+)\s*\{/,Kn=/^enum\s+(\w+)\s*\{/,qn=/^(\w+)\s+(\w+)(\?)?(\[\])?(.*)$/,Jn=/@(\w+)(\((?:[^()]*|\([^()]*\))*\))?/g,Yn=/@default\(((?:[^()]*|\([^()]*\))*)\)/,Xn=/^@@map\(\s*"([^"]+)"\s*\)/;function Zn(r){let i=a(r,`prisma`,`schema.prisma`);if(e(i)){let e=a(r,`prisma`),t=n(e).filter(e=>e.endsWith(`.prisma`));return t.length>1?t.map(t=>a(e,t)):[i]}let o=a(r,`schema.prisma`);if(e(o))return[o];try{let n=a(r,`package.json`),i=JSON.parse(t(n,`utf-8`)).prisma?.schema;if(i){let t=a(r,i);if(e(t))return[t]}}catch{}return[]}function Qn(e){let n=[],r=new Set;for(let i of e){let e;try{e=t(i,`utf-8`)}catch{continue}let a=e.split(`
-`),o=null,s=[],c=[],l=[],u;for(let e of a){let t=e.trim(),a=Gn.exec(t);if(a){o={type:`model`,name:a[1]},s=[],c=[],l=[],u=void 0;continue}let d=Kn.exec(t);if(d){o={type:`enum`,name:d[1]},r.add(d[1]);continue}if(t===`}`){o?.type===`model`&&n.push({name:o.name,fields:s,indexes:c,compositeIdColumns:l,filePath:i,tableName:u}),o=null,s=[],c=[],l=[],u=void 0;continue}if(o?.type===`model`&&t&&!t.startsWith(`//`)){if(t.startsWith(`@@`)){let e=er.exec(t);e&&(l=e[1].split(`,`).map(e=>e.trim()));let n=tr(t);n&&c.push(n);let r=Xn.exec(t);r&&(u=r[1]);continue}let e=nr(t);e&&s.push(e)}}}return{models:n,enums:r}}const $n=/^@@(index|unique)\(\[([^\]]*)\]\)/,er=/^@@id\(\[([^\]]*)\]\)/;function tr(e){let t=$n.exec(e);if(!t)return null;let n=t[1]===`unique`,r=t[2].split(`,`).map(e=>e.trim()).filter(Boolean);return r.length===0?null:{columns:r,isUnique:n}}function nr(e){let t=qn.exec(e);if(!t)return null;let n=t[1],r=t[2],i=t[3]===`?`,a=t[4]===`[]`,o=t[5]??``,s=[],c=new RegExp(Jn.source,Jn.flags),l=c.exec(o);for(;l!==null;)s.push(`@${l[1]}${l[2]??``}`),l=c.exec(o);return{name:n,type:r,isOptional:i,isList:a,attributes:s}}function rr(e){let t=e.attributes.some(e=>e.startsWith(`@id`)),n=e.attributes.some(e=>e.startsWith(`@unique`)),r=e.attributes.find(e=>e.startsWith(`@default(`)),i=!1,a;if(r){let e=Yn.exec(r);if(e){let t=e[1];a=t,(t===`autoincrement()`||t===`uuid()`||t===`cuid()`||t===`dbgenerated()`)&&(i=!0)}}return{name:e.name,type:e.type,isPrimary:t,isNullable:e.isOptional,isGenerated:i,isUnique:n,defaultValue:a}}const ir=/onDelete:\s*(\w+)/;function ar(e){let t=e.attributes.find(e=>e.startsWith(`@relation`));if(!t)return;let n=ir.exec(t);return n?n[1]:void 0}function or(e,t){let n=new Set(e.map(e=>e.name));return e.map(r=>{let i=[],a=[],o=new Set;for(let e of r.indexes)for(let t of e.columns)o.add(t);let s=new Set(r.compositeIdColumns);for(let c of r.fields)if(n.has(c.type)&&!t.has(c.type)){let t;t=c.isList?`one-to-many`:`many-to-one`;let n=c.isOptional;c.isList&&e.find(e=>e.name===c.type)?.fields.find(e=>e!==c&&e.type===r.name&&e.isList)&&(t=`many-to-many`);let i=ar(c);a.push({type:t,fromEntity:r.name,toEntity:c.type,propertyName:c.name,isNullable:n??!1,...i?{onDelete:i}:{}})}else if(!c.attributes.some(e=>e.startsWith(`@relation`))){let e=rr(c);s.has(c.name)&&(e.isPrimary=!0),(o.has(c.name)||c.attributes.some(e=>e.startsWith(`@unique`)))&&(e.hasIndex=!0),i.push(e)}return{name:r.name,tableName:r.tableName??r.name,filePath:r.filePath,columns:i,relations:a,indexes:r.indexes}})}const sr={supportsIncrementalUpdate:!1,extract(e,t,n){let r=Zn(n);if(r.length===0)return[];let{models:i,enums:a}=Qn(r);return or(i,a)}},cr=/=>\s*(\w+)/,lr=new Set([`Column`,`PrimaryColumn`,`PrimaryGeneratedColumn`,`CreateDateColumn`,`UpdateDateColumn`,`DeleteDateColumn`,`VersionColumn`]),ur={OneToOne:`one-to-one`,OneToMany:`one-to-many`,ManyToOne:`many-to-one`,ManyToMany:`many-to-many`};function q(e){let t=e.getArguments();for(let e of t)if(e.getKind()===f.ObjectLiteralExpression){let t={},n=e.asKind(f.ObjectLiteralExpression);if(!n)continue;for(let e of n.getProperties())if(e.getKind()===f.PropertyAssignment){let n=e.asKind(f.PropertyAssignment);n&&(t[n.getName()]=n.getInitializer()?.getText()??``)}return t}return null}function dr(e){let t=e.getArguments();if(t.length===0)return null;let n=t[0];return n.getKind()===f.StringLiteral?n.asKind(f.StringLiteral)?.getLiteralValue()??null:null}function fr(e){let t=e.getDecorator(`Entity`);if(!t)return e.getName()??`UnknownEntity`;let n=dr(t);if(n)return n;let r=q(t);return r?.name?r.name.replace(/['"]/g,``):e.getName()??`UnknownEntity`}function pr(e,t){let n=t.getName(),r=n===`PrimaryColumn`||n===`PrimaryGeneratedColumn`,i=n===`PrimaryGeneratedColumn`||n===`CreateDateColumn`||n===`UpdateDateColumn`||n===`DeleteDateColumn`||n===`VersionColumn`,a=`unknown`,o=!1,s=!1,c,l=dr(t);l&&(a=l);let u=q(t);return u&&(u.type&&(a=u.type.replace(/['"]/g,``)),u.nullable===`true`&&(o=!0),u.unique===`true`&&(s=!0),u.default!==void 0&&(c=u.default)),a===`unknown`&&(n===`PrimaryGeneratedColumn`?a=`integer`:n===`CreateDateColumn`||n===`UpdateDateColumn`||n===`DeleteDateColumn`?a=`timestamp`:n===`VersionColumn`&&(a=`integer`)),{name:e,type:a,isPrimary:r,isNullable:o,isGenerated:i,isUnique:s,defaultValue:c}}function mr(e,t,n){let r=ur[n.getName()];if(!r)return null;let i=n.getArguments();if(i.length===0)return null;let a=i[0].getText(),o=cr.exec(a);if(!o)return null;let s=o[1],c=q(n),l=c?.nullable===`true`,u=c?.onDelete?.replace(/['"]/g,``);return{type:r,fromEntity:e,toEntity:s,propertyName:t,isNullable:l,...u?{onDelete:u}:{}}}function hr(e){if(!C(e,`Entity`))return null;let t=e.getName();if(!t)return null;let n=fr(e),r=e.getSourceFile().getFilePath(),i=[],a=[],o=[];for(let t of e.getDecorators())if(t.getName()===`Index`){let e=t.getArguments();for(let n of e)if(n.getKind()===f.ArrayLiteralExpression){let e=n.asKind(f.ArrayLiteralExpression);if(e){let n=e.getElements().map(e=>e.getKind()===f.StringLiteral?e.asKind(f.StringLiteral)?.getLiteralValue()??``:``).filter(Boolean);if(n.length>0){let e=q(t);o.push({columns:n,isUnique:e?.unique===`true`})}}}}let s=new Set;for(let n of e.getProperties()){let e=n.getName(),r=n.getDecorators(),c=r.some(e=>e.getName()===`Index`);c&&(s.add(e),o.push({columns:[e],isUnique:!1}));for(let n of r){let r=n.getName();if(lr.has(r)){let t=pr(e,n);c&&(t.hasIndex=!0),i.push(t);break}if(r in ur){let r=mr(t,e,n);r&&a.push(r);break}}}for(let e of o)for(let t of e.columns){let e=i.find(e=>e.name===t);e&&(e.hasIndex=!0)}return{name:t,tableName:n,filePath:r,columns:i,relations:a,indexes:o}}const gr={prisma:sr,typeorm:{supportsIncrementalUpdate:!0,extract(e,t){let n=[];for(let r of t){let t=e.getSourceFile(r);if(t)for(let e of t.getClasses()){let t=hr(e);t&&n.push(t)}}return n}},drizzle:Wn};function J(e,t,n,r){let i={entities:new Map,relations:[],orm:n??`unknown`};if(!n)return i;let a=gr[n];if(!a)return i;let o=a.extract(e,t,r),s=new Map,c=[];for(let e of o)s.set(e.name,e),c.push(...e.relations);return{entities:s,relations:c,orm:n}}function _r(e){return{entities:[...e.entities.values()],relations:e.relations,orm:e.orm}}function vr(e,t,n,r){for(let[t,r]of e.entities)r.filePath===n&&e.entities.delete(t);let i=gr[e.orm];if(!i?.supportsIncrementalUpdate){yr(e);return}let a=i.extract(t,[n],r);for(let t of a)e.entities.set(t.name,t);yr(e)}function yr(e){let t=[];for(let n of e.entities.values())t.push(...n.relations);e.relations=t}async function Y(e,t){let{config:n,fileRules:r,projectRules:i,schemaRules:a}=t,[o,s]=await Promise.all([Dn(e,n),_e(e)]),c=kn(o),l=Me(e);return{astProject:c,config:n,fileRules:r,files:o,moduleGraph:E(c,o,l),pathAliases:l,project:s,projectRules:i,providers:Nn(c,o),schemaGraph:J(c,o,s.orm,e),schemaRules:a,targetPath:e}}async function br(e,t={}){let n=await K(e,t.config);return{context:await Y(e,n),customRuleWarnings:n.customRuleWarnings}}function xr(e,t){let n=e.astProject.getSourceFile(t);n&&e.astProject.removeSourceFile(n),e.astProject.addSourceFileAtPath(t),e.files.includes(t)||e.files.push(t),P(e.moduleGraph,e.astProject,t,e.pathAliases),Pn(e.providers,e.astProject,t),e.schemaGraph&&vr(e.schemaGraph,e.astProject,t,e.targetPath)}async function Sr(e,t,n){let{config:r,combinedRules:i}=t,o=await On(e,n,r),s=await Promise.all([...o.entries()].filter(([,e])=>e.length>0).map(async([t,o])=>{let s=a(e,n.projects.get(t)),[c,l]=await Promise.all([_e(s),Ce(s,r)]),u=kn(o),d=Me(s),f=E(u,o,d),p=Nn(u,o),m=J(u,o,c.orm,s),{fileRules:h,projectRules:g,schemaRules:ee}=vn(G(l,i));return[t,{astProject:u,config:l,fileRules:h,files:o,moduleGraph:f,pathAliases:d,project:c,projectRules:g,providers:p,schemaGraph:m,schemaRules:ee,targetPath:s}]}));return{subProjects:new Map(s)}}const Cr=e=>h.makeRe(e,{windows:!1}),wr=/\\/g,Tr=/\/$/,Er=(e,t,n)=>{let r=new Set(Array.isArray(t.ignore?.rules)?t.ignore.rules:[]),i=Array.isArray(t.ignore?.files)?t.ignore.files.map(Cr):[];if(r.size===0&&i.length===0)return e;let a=n.replace(wr,`/`).replace(Tr,``);return e.filter(e=>{if(r.has(e.rule))return!1;let t=e.filePath.replace(wr,`/`),n=t.startsWith(`${a}/`)?t.slice(a.length+1):t;return!i.some(e=>e.test(n))})};function Dr(e,t,n,r){let i=[],a=[],o=e.getSourceFile(t);if(!o)return{diagnostics:i,errors:a};let s=o.getFullText().split(`
-`);for(let e of n){let n={config:r,sourceFile:o,filePath:t,report(t){let n=[],r=Math.max(0,t.line-6),a=Math.min(s.length,t.line+5);for(let e=r;e<a;e++)n.push({line:e+1,text:s[e]});i.push({...t,rule:e.meta.id,category:e.meta.category,scope:`file`,severity:e.meta.severity,sourceLines:n})}};try{e.check(n)}catch(t){a.push({ruleId:e.meta.id,error:t})}}return{diagnostics:i,errors:a}}function Or(e,t,n,r){let i=[],a=[];for(let o of t){let t=Dr(e,o,n,r);i.push(...t.diagnostics),a.push(...t.errors)}return{diagnostics:i,errors:a}}function kr(e,t,n,r){let i=[],a=[];for(let o of n){let n={project:e,files:t,moduleGraph:r.moduleGraph,providers:r.providers,config:r.config,report(e){i.push({...e,rule:o.meta.id,category:o.meta.category,scope:`project`,severity:o.meta.severity})}};try{o.check(n)}catch(e){a.push({ruleId:o.meta.id,error:e})}}return{diagnostics:i,errors:a}}function Ar(e,t){let n=[],r=[];for(let i of t){let t={schemaGraph:e,orm:e.orm,report(e){n.push({...e,rule:i.meta.id,category:i.meta.category,scope:`schema`,severity:i.meta.severity})}};try{i.check(t)}catch(e){r.push({ruleId:i.meta.id,error:e})}}return{diagnostics:n,errors:r}}function jr(e){return e instanceof Error?e.message:String(e)}function X(e,t,n){return{diagnostics:Er(e,n.config,n.targetPath),errors:t.map(e=>({ruleId:e.ruleId,error:jr(e.error)}))}}function Mr(e,t){let n=Or(e.astProject,[t],e.fileRules,e.config);return X(n.diagnostics,n.errors,e)}function Nr(e){let t=Or(e.astProject,e.files,e.fileRules,e.config);return X(t.diagnostics,t.errors,e)}function Z(e){let t={moduleGraph:e.moduleGraph,providers:e.providers,config:e.config},n=kr(e.astProject,e.files,e.projectRules,t),{diagnostics:r,errors:i}=X(n.diagnostics,n.errors,e),a=Pr(e);return r.push(...a.diagnostics),i.push(...a.errors),{diagnostics:r,errors:i}}function Pr(e){if(!e.schemaGraph||e.schemaRules.length===0||e.schemaGraph.entities.size===0)return{diagnostics:[],errors:[]};let t=Ar(e.schemaGraph,e.schemaRules);return X(t.diagnostics,t.errors,e)}function Q(e){let t=u.now(),n=Nr(e),r=Z(e),i=u.now()-t;return{diagnostics:[...n.diagnostics,...r.diagnostics],elapsedMs:i,ruleErrors:[...n.errors,...r.errors]}}function Fr(e){return e>=90?`Excellent`:e>=75?`Good`:e>=50?`Fair`:e>=25?`Poor`:`Critical`}const Ir={error:3,warning:1.5,info:.5},Lr={security:1.5,correctness:1.3,schema:1.1,architecture:1,performance:.8};function Rr(e,t){if(t===0)return{value:100,label:Fr(100)};let n=0;for(let t of e){let e=Ir[t.severity],r=Lr[t.category];n+=e*r}let r=n/t,i=Math.max(0,Math.min(100,Math.round(100-r*10)));return{value:i,label:Fr(i)}}function zr(e){let t={total:0,errors:0,warnings:0,info:0,byCategory:{security:0,performance:0,correctness:0,architecture:0,schema:0}};for(let n of e)t.total++,n.severity===`error`?t.errors++:n.severity===`warning`?t.warnings++:t.info++,t.byCategory[n.category]++;return t}function $(e,t,n=[]){let{diagnostics:r,ruleErrors:i,elapsedMs:a}=t,o=e.schemaGraph??J(e.astProject,e.files,e.project.orm,e.targetPath),s=Rr(r,e.files.length),c=zr(r);return{result:{score:s,diagnostics:r,project:{...e.project,fileCount:e.files.length,moduleCount:e.moduleGraph.modules.size},summary:c,ruleErrors:i,elapsedMs:a,schema:_r(o)},moduleGraph:e.moduleGraph,schemaGraph:o,customRuleWarnings:n,files:e.files,providers:e.providers}}function Br(e,t,n,r){let i=[],a=[],o=[],s=new Map,c=0,l=[],u=[],d=``;for(let[n,r]of e.subProjects){let e=$(r,t.get(n));i.push({name:n,result:e.result}),s.set(n,e.moduleGraph),a.push(...e.result.diagnostics),o.push(...e.result.ruleErrors),c+=e.result.project.fileCount,e.result.schema&&(l.push(...e.result.schema.entities),u.push(...e.result.schema.relations),e.result.schema.orm&&e.result.schema.orm!==`unknown`&&(d=e.result.schema.orm))}let f=Rr(a,c),p=zr(a);return{moduleGraphs:s,customRuleWarnings:n,result:{isMonorepo:!0,subProjects:i,combined:{score:f,diagnostics:a,project:{name:`monorepo`,nestVersion:i[0]?.result.project.nestVersion??null,orm:d||(i[0]?.result.project.orm??null),framework:i[0]?.result.project.framework??null,fileCount:c,moduleCount:i.reduce((e,t)=>e+t.result.project.moduleCount,0)},summary:p,ruleErrors:o,elapsedMs:r,schema:l.length>0?{entities:l,relations:u,orm:d||`unknown`}:void 0},elapsedMs:r}}}async function Vr(e,t,n){let r=u.now(),i=await Sr(e,t,n),a=new Map;for(let[e,t]of i.subProjects)a.set(e,Q(t));let o=u.now()-r;return Br(i,a,t.customRuleWarnings,o)}async function Hr(e,t={}){let n=await K(e,t.config),r=await ge(e);if(r)return{isMonorepo:!0,monorepo:await Vr(e,n,r)};let i=await Y(e,n);return{isMonorepo:!1,single:$(i,Q(i),n.customRuleWarnings)}}function Ur(e){return`line`in e}function Wr(e){return`entity`in e}function Gr(t){if(!t||t.trim()===``)throw new _(`Path must be a non-empty string. Received an empty path.`);let n=s(t);if(!e(n))throw new _(`Path does not exist: ${n}`);if(!r(n).isDirectory())throw new _(`Path must be a directory, not a file: ${n}`);return n}async function Kr(e,t={}){let n=Gr(e),r=await K(n,t.config),i=await Y(n,r),{result:a}=$(i,Q(i),r.customRuleWarnings);return a}async function qr(e,t={}){let n=Gr(e),r=await K(n,t.config),i=await ge(n);if(!i){let e=await Y(n,r),{result:t}=$(e,Q(e),r.customRuleWarnings);return{isMonorepo:!1,subProjects:[{name:`default`,result:t}],combined:t,elapsedMs:t.elapsedMs}}let{result:a}=await Vr(n,r,i);return a}export{ee as ConfigurationError,g as NestjsDoctorError,te as ScanError,_ as ValidationError,Hr as autoScan,Y as buildAnalysisContext,$ as buildResult,Nr as checkAllFiles,Mr as checkFile,Z as checkProject,Pr as checkSchema,Kr as diagnose,qr as diagnoseMonorepo,J as extractSchema,mn as getRules,Ur as isCodeDiagnostic,Wr as isSchemaDiagnostic,br as prepareAnalysis,K as resolveScanConfig,xr as updateFile,P as updateModuleGraphForFile,Pn as updateProvidersForFile};
+`),r=!1;for(let e of n){let n=e.trim();if(ne.test(n)){let e=n.match(re);if(e){for(let n of e[1].split(`,`)){let e=n.trim().replace(oe,``);e&&t.push(e)}return t}r=!0;continue}if(r){if(ie.test(e)&&n!==``)break;let r=n.match(ae);r&&t.push(r[1])}}return t}async function ce(e){let t=a(e,`nest-cli.json`);try{let e=await c(t,`utf-8`),n=JSON.parse(e);if(!(n.monorepo&&n.projects))return null;let r=new Map;for(let[e,t]of Object.entries(n.projects)){let n=t.root??e;r.set(e,n)}return r.size===0?null:{projects:r}}catch{return null}}function le(e){let t={...e.dependencies,...e.devDependencies,...e.peerDependencies};return!!(t[`@nestjs/core`]||t[`@nestjs/common`])}async function v(e,t){let n=await l(t.map(e=>`${e}/package.json`),{cwd:e,absolute:!0,ignore:[`**/node_modules/**`]}),r=new Map;for(let t of n)try{let n=await c(t,`utf-8`),a=JSON.parse(n);if(le(a)){let n=o(e,i(t)),s=a.name??n;r.set(s,n)}}catch{}return r.size===0?null:{projects:r}}async function ue(e){let t=a(e,`pnpm-workspace.yaml`),n;try{n=await c(t,`utf-8`)}catch{return null}let r=se(n);return r.length===0?null:v(e,r)}function de(e){let t=e.workspaces;if(!t)return[];if(Array.isArray(t))return t.filter(e=>typeof e==`string`);if(typeof t==`object`&&t){let e=t;if(Array.isArray(e.packages))return e.packages.filter(e=>typeof e==`string`)}return[]}async function fe(e){let t=a(e,`package.json`),n;try{n=await c(t,`utf-8`)}catch{return null}let r=de(JSON.parse(n));return r.length===0?null:v(e,r)}async function pe(e){let t=a(e,`lerna.json`),n;try{n=await c(t,`utf-8`)}catch{return null}let r=JSON.parse(n);if(r.useWorkspaces)return null;let i=r.packages??[`packages/*`];return i.length===0?null:v(e,i)}async function me(e){let t=a(e,`nx.json`);try{await c(t,`utf-8`)}catch{return null}let n=await l([`**/project.json`],{cwd:e,absolute:!0,ignore:[`node_modules/**`]}),r=new Map;for(let t of n){let n=i(t),s=o(e,n);if(s===``)continue;let l=a(n,`package.json`);try{let e=await c(l,`utf-8`),t=JSON.parse(e);if(le(t)){let e=t.name??s;r.set(e,s)}}catch{}}return r.size===0?null:{projects:r}}async function he(e){try{return await c(a(e,`pnpm-workspace.yaml`),`utf-8`),!0}catch{return!1}}async function ge(e){let t=await ce(e);if(t)return t;let n=await ue(e);if(n)return n;if(!await he(e)){let t=await fe(e);if(t)return t}return await me(e)||pe(e)}async function _e(e){let t=a(e,`package.json`),n={};try{let e=await c(t,`utf-8`);n=JSON.parse(e)}catch{}let r={...n.dependencies,...n.devDependencies},i=ve(r[`@nestjs/core`]),o=ye(r),s=be(r);return{name:n.name??`unknown`,nestVersion:i,orm:o,framework:s,moduleCount:0,fileCount:0}}function ve(e){return e?e.replace(/[\^~>=<]/g,``):null}function ye(e){return e[`@prisma/client`]?`prisma`:e.typeorm?`typeorm`:e[`@mikro-orm/core`]?`mikro-orm`:e.sequelize?`sequelize`:e.mongoose?`mongoose`:e[`drizzle-orm`]?`drizzle`:null}function be(e){return e[`@nestjs/platform-fastify`]?`fastify`:e[`@nestjs/platform-express`]||e[`@nestjs/core`]?`express`:null}const y={include:[`**/*.ts`],exclude:`**/node_modules/**,**/dist/**,**/build/**,**/coverage/**,**/*.spec.ts,**/*.test.ts,**/*.e2e-spec.ts,**/*.e2e-test.ts,**/*.d.ts,**/test/**,**/tests/**,**/__tests__/**,**/__mocks__/**,**/__fixtures__/**,**/mock/**,**/mocks/**,**/*.mock.ts,**/seeder/**,**/seeders/**,**/*.seed.ts,**/*.seeder.ts,*.config.ts,*.config.js,*.config.mjs,*.config.cjs,*.config.mts,*.config.cts`.split(`,`)},xe=[`nestjs-doctor.config.json`,`.nestjs-doctor.json`];async function b(e,t){if(t)return x(t);for(let t of xe)try{return await x(a(e,t))}catch{}try{let t=await c(a(e,`package.json`),`utf-8`),n=JSON.parse(t);if(n[`nestjs-doctor`]&&typeof n[`nestjs-doctor`]==`object`)return S(n[`nestjs-doctor`])}catch{}return{...y}}async function x(e){let t=await c(e,`utf-8`);return S(JSON.parse(t))}function S(e){return{...y,...e,exclude:[...y.exclude??[],...e.exclude??[]]}}async function Se(e,t){try{return await b(e)}catch{return t}}const Ce=[/Repository$/,/\.repository$/,/\.entity$/,/\.schema$/,/\.guard$/,/\.interceptor$/,/\.pipe$/,/\.filter$/,/\.strategy$/],we={meta:{id:`architecture/no-barrel-export-internals`,category:`architecture`,severity:`info`,description:`Don't re-export internal implementation details from barrel files`,help:`Only export the module's public API (services, DTOs, interfaces) from index.ts files.`},check(e){if(e.filePath.endsWith(`/index.ts`))for(let t of e.sourceFile.getExportDeclarations()){let n=t.getModuleSpecifierValue();if(n){Ce.some(e=>e.test(n))&&e.report({filePath:e.filePath,message:`Barrel file re-exports internal module '${n}'.`,help:this.meta.help,line:t.getStartLineNumber(),column:1});for(let n of t.getNamedExports()){let t=n.getName();(t.endsWith(`Repository`)||t.endsWith(`Entity`)||t.endsWith(`Schema`))&&e.report({filePath:e.filePath,message:`Barrel file re-exports internal type '${t}'.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}}}},C=new Set([`Get`,`Post`,`Put`,`Patch`,`Delete`,`Head`,`Options`,`All`]);function w(e,t){return e.getDecorator(t)!==void 0}function T(e){return w(e,`Controller`)}function E(e){return w(e,`Injectable`)}function D(e){return w(e,`Injectable`)||w(e,`Controller`)||w(e,`Resolver`)||w(e,`WebSocketGateway`)}function O(e){return w(e,`Module`)}function k(e){return e.getDecorators().some(e=>C.has(e.getName()))}const Te=new Set([`TsRestHandler`,`GrpcMethod`,`GrpcStreamMethod`]);function Ee(e){return e.getDecorators().some(e=>Te.has(e.getName()))}const De={meta:{id:`architecture/no-business-logic-in-controllers`,category:`architecture`,severity:`error`,description:`Controllers should only handle HTTP concerns — move business logic to services`,help:`Extract branches, loops, and complex calculations into a service method.`},check(e){for(let t of e.sourceFile.getClasses())if(T(t))for(let n of t.getMethods()){if(!n.getDecorators().some(e=>C.has(e.getName())))continue;let t=n.getBody();if(!t)continue;let r=t.getDescendantsOfKind(f.IfStatement),i=t.getDescendantsOfKind(f.ForStatement),a=t.getDescendantsOfKind(f.ForInStatement),o=t.getDescendantsOfKind(f.ForOfStatement),s=t.getDescendantsOfKind(f.WhileStatement),c=t.getDescendantsOfKind(f.SwitchStatement),l=i.length+a.length+o.length+s.length;(r.length>1||l>0||c.length>0)&&e.report({filePath:e.filePath,message:`Controller method '${n.getName()}' contains business logic (${r.length} if, ${l} loops, ${c.length} switch). Move to a service.`,help:this.meta.help,line:n.getStartLineNumber(),column:1});let u=t.getDescendantsOfKind(f.CallExpression).filter(e=>{let t=e.getExpression();if(t.getKind()===f.PropertyAccessExpression){let e=t.asKind(f.PropertyAccessExpression)?.getName();return e===`map`||e===`filter`||e===`reduce`||e===`sort`||e===`flatMap`}return!1});u.length>1&&e.report({filePath:e.filePath,message:`Controller method '${n.getName()}' contains data transformation logic (${u.length} array operations). Move to a service.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}};function Oe(e){let t=new Map;try{let n=p.findConfigFile(e,p.sys.fileExists,`tsconfig.json`);if(!n)return t;let{config:r,error:a}=p.readConfigFile(n,p.sys.readFile);if(a||!r)return t;let o=i(n),c=p.parseJsonConfigFileContent(r,p.sys,o),l=c.options.paths;if(!l)return t;let u=c.options.baseUrl??o;for(let[e,n]of Object.entries(l)){let r=n.map(e=>s(u,e));t.set(e,r)}}catch{return t}return t}function ke(e,t){for(let[n,r]of t){if(r.length===0)continue;let t=n.indexOf(`*`);if(t===-1){if(e===n)return r[0];continue}let i=n.slice(0,t),a=n.slice(t+1);if(e.startsWith(i)&&e.endsWith(a)&&e.length>=i.length+a.length){let t=e.slice(i.length,e.length-a.length),n=r[0],o=n.indexOf(`*`);return o===-1?n:n.slice(0,o)+t+n.slice(o+1)}}}const Ae=/=>\s*(\w+)/,A=/\.js$/;function j(e,t,n){let r=[];for(let i of e.getClasses()){let e=i.getDecorator(`Module`);if(!e)continue;let a=i.getName()??`AnonymousModule`,o=e.getArguments()[0],s={name:a,filePath:t,classDeclaration:i,imports:[],exports:[],providers:[],controllers:[]};if(o&&o.getKind()===f.ObjectLiteralExpression){let e=o.asKind(f.ObjectLiteralExpression);e&&(s.imports=N(e,`imports`,n),s.exports=N(e,`exports`,n),s.providers=N(e,`providers`,n),s.controllers=N(e,`controllers`,n))}r.push(s)}return r}function M(e,t,n=new Map){let r=new Map,i=new Map;for(let i of t){let t=e.getSourceFile(i);if(t)for(let e of j(t,i,n))r.set(e.name,e)}for(let[e,t]of r){let n=new Set;for(let e of t.imports)r.has(e)&&n.add(e);i.set(e,n)}let a=new Map;for(let e of r.values())for(let t of e.providers)a.set(t,e);return{modules:r,edges:i,providerToModule:a}}const je=new Set([`forRoot`,`forRootAsync`,`forFeature`,`forFeatureAsync`,`forChild`,`forChildAsync`,`register`,`registerAsync`]);function N(e,t,n){let r=e.getProperty(t);if(!r)return[];let i=r.asKind(f.PropertyAssignment);if(!i)return[];let a=i.getInitializer();return a?P(a,e.getSourceFile(),0,n):[]}function P(e,t,n,r){if(n>5)return[];let i=e.getKind();if(i===f.ArrayLiteralExpression){let i=e.asKindOrThrow(f.ArrayLiteralExpression),a=[];for(let e of i.getElements())a.push(...Me(e,t,n,r));return a}return i===f.CallExpression?F(e.asKindOrThrow(f.CallExpression),t,n,r):i===f.Identifier?R(e.getText(),t,n+1,r):[]}function Me(e,t,n,r){let i=e.getText();if(i.startsWith(`forwardRef`)){let e=i.match(Ae);return e?[e[1]]:[i]}let a=e.getKind();return a===f.SpreadElement?P(e.asKindOrThrow(f.SpreadElement).getExpression(),t,n,r):a===f.CallExpression?F(e.asKindOrThrow(f.CallExpression),t,n,r):a===f.PropertyAccessExpression?[e.asKindOrThrow(f.PropertyAccessExpression).getExpression().getText()]:(f.Identifier,[i])}function F(e,t,n,r){let i=e.getExpression();if(i.getKind()===f.PropertyAccessExpression){let a=i.asKindOrThrow(f.PropertyAccessExpression),o=a.getName();if(o===`concat`){let i=P(a.getExpression(),t,n,r),o=[];for(let i of e.getArguments())o.push(...P(i,t,n,r));return[...i,...o]}return je.has(o),[a.getExpression().getText()]}return i.getKind()===f.Identifier?Pe(i.getText(),t,n+1,r):[]}function I(e,t,n){if(!e.startsWith(`.`)){let r=ke(e,n);if(!r)return;let i=t.getProject(),a=[`${r}.ts`,`${r}/index.ts`,r,r.replace(A,`.ts`)];for(let e of a){let t=i.getSourceFile(e);if(t)return t}return}let r=s(i(t.getFilePath()),e),a=t.getProject(),o=[`${r}.ts`,`${r}/index.ts`,r,r.replace(A,`.ts`)];for(let e of o){let t=a.getSourceFile(e);if(t)return t}}function L(e,t,n){for(let r of t.getImportDeclarations())for(let i of r.getNamedImports())if((i.getAliasNode()?i.getAliasNode().getText():i.getName())===e){let e=I(r.getModuleSpecifierValue(),t,n);return e?{sourceFile:e,localName:i.getName()}:void 0}for(let r of t.getExportDeclarations())if(r.getModuleSpecifierValue()){for(let i of r.getNamedExports())if((i.getAliasNode()?i.getAliasNode().getText():i.getName())===e){let e=I(r.getModuleSpecifierValue(),t,n);return e?{sourceFile:e,localName:i.getName()}:void 0}}}function R(e,t,n,r){if(n>5)return[];for(let i of t.getStatements()){if(i.getKind()!==f.VariableStatement)continue;let a=i.asKindOrThrow(f.VariableStatement);for(let i of a.getDeclarations())if(i.getName()===e){let e=i.getInitializer();if(e)return P(e,t,n,r)}}let i=L(e,t,r);return i?R(i.localName,i.sourceFile,n+1,r):[]}function Ne(e,t,n,r){for(let i of t.getStatements()){if(i.getKind()!==f.VariableStatement)continue;let a=i.asKindOrThrow(f.VariableStatement);for(let i of a.getDeclarations()){if(i.getName()!==e)continue;let a=i.getInitializer();if(!a||a.getKind()!==f.ArrowFunction)continue;let o=a.asKindOrThrow(f.ArrowFunction).getBody();if(o.getKind()!==f.Block)return P(o,t,n,r);let s=[];for(let e of o.getDescendantsOfKind(f.ReturnStatement)){let i=e.getExpression();i&&s.push(...P(i,t,n,r))}return s}}}function Pe(e,t,n,r){if(n>5)return[];for(let i of t.getStatements()){if(i.getKind()!==f.FunctionDeclaration)continue;let a=i.asKindOrThrow(f.FunctionDeclaration);if(a.getName()!==e)continue;let o=[];for(let e of a.getDescendantsOfKind(f.ReturnStatement)){let i=e.getExpression();i&&o.push(...P(i,t,n,r))}return o}let i=Ne(e,t,n,r);if(i)return i;let a=L(e,t,r);return a?Pe(a.localName,a.sourceFile,n+1,r):[]}function Fe(e,t,n,r=new Map){for(let[t,r]of e.modules)if(r.filePath===n){e.modules.delete(t),e.edges.delete(t);for(let t of r.providers)e.providerToModule.get(t)===r&&e.providerToModule.delete(t);for(let n of e.edges.values())n.delete(t)}let i=t.getSourceFile(n);if(!i)return;let a=j(i,n,r);for(let t of a)e.modules.set(t.name,t);for(let t of a){let n=new Set;for(let r of t.imports)e.modules.has(r)&&n.add(r);e.edges.set(t.name,n);for(let n of t.providers)e.providerToModule.set(n,t)}for(let[t,r]of e.modules){if(r.filePath===n)continue;let i=new Set;for(let t of r.imports)e.modules.has(t)&&i.add(t);e.edges.set(t,i)}}function Ie(e){let t=[],n=new Set,r=new Set;function i(a,o){n.add(a),r.add(a);let s=e.edges.get(a)??new Set;for(let e of s)if(!n.has(e))i(e,[...o,e]);else if(r.has(e)){let n=o.indexOf(e);n===-1?t.push([...o,e]):t.push(o.slice(n))}r.delete(a)}for(let t of e.modules.keys())n.has(t)||i(t,[t]);return t}function Le(e,t,n,r,i,a){let o=[];for(let i of e.providers){let e=n.get(i);if(e)for(let n of e.dependencies){let e=r.get(n);e&&e.name===t.name&&o.push({consumer:i,dependency:n})}}for(let n of e.controllers)for(let e of a){let a=i.getSourceFile(e);if(a)for(let e of a.getClasses()){if(e.getName()!==n)continue;let i=e.getConstructors()[0];if(i)for(let e of i.getParameters()){let i=e.getTypeNode(),a=i?i.getText():e.getType().getText(),s=a.split(`.`).pop()?.split(`<`)[0]??a,c=r.get(s);c&&c.name===t.name&&o.push({consumer:n,dependency:s})}}}return o}const Re=`Break the cycle by extracting shared logic into a separate module or using forwardRef().`;function ze(e,t){let{moduleGraph:n,providers:r,project:i,files:a}=t,o=[],s;for(let t=0;t<e.length;t++){let c=e[t],l=e[(t+1)%e.length],u=n.modules.get(c),d=n.modules.get(l);if(!(u&&d))continue;let f=Le(u,d,r,n.providerToModule,i,a);if(f.length===0)continue;let p=new Map;for(let e of f){let t=p.get(e.consumer);t?t.push(e.dependency):p.set(e.consumer,[e.dependency])}let m=[];for(let[e,t]of p){let n=t.map(e=>`${e} (from ${l})`).join(`, `);m.push(`${e} (in ${c}) injects ${n}`)}let h=`${c} -> ${l}: ${m.join(`; `)}`;o.push(h),(!s||f.length<s.count)&&(s={description:`${c} -> ${l}`,count:f.length})}if(o.length===0)return Re;let c=o.join(`
+`);if(s){let e=s.count===1?`dependency`:`dependencies`,t=s.description.split(` -> `)[0],o=s.description.split(` -> `)[1],l=n.modules.get(t),u=n.modules.get(o);if(l&&u){let t=Le(l,u,r,n.providerToModule,i,a),o=[...new Set(t.map(e=>e.dependency))].join(`, `);c+=`\nConsider extracting ${o} into a shared module — it would break the ${s.description} edge (${s.count} ${e}).`}}return c}const Be={meta:{id:`architecture/no-circular-module-deps`,category:`architecture`,severity:`error`,description:`Module import graph must not contain circular dependencies`,help:Re,scope:`project`},check(e){let t=Ie(e.moduleGraph);for(let n of t){let t=n.join(` -> `),r=e.moduleGraph.modules.get(n[0]),i=ze(n,e);e.report({filePath:r?.filePath??`unknown`,message:`Circular module dependency detected: ${t}`,help:i,line:r?.classDeclaration.getStartLineNumber()??1,column:1})}}},Ve=[`Service`,`Repository`,`Gateway`,`Resolver`],He=[`Guard`,`Interceptor`,`Pipe`,`Filter`];function Ue(e){return typeof e==`object`&&!!e}function We(e){if(!Ue(e))return new Set;let t=e.excludeClasses;if(Array.isArray(t))return new Set(t.filter(e=>typeof e==`string`));let n=e.options;if(!Ue(n))return new Set;let r=n.excludeClasses;return Array.isArray(r)?new Set(r.filter(e=>typeof e==`string`)):new Set}const Ge={meta:{id:`architecture/no-manual-instantiation`,category:`architecture`,severity:`error`,description:`Do not manually instantiate @Injectable classes — use NestJS dependency injection`,help:`Register the class as a provider in a module and inject it via the constructor.`},check(e){let t=We(e.config?.rules?.[this.meta.id]),n=e.sourceFile.getDescendantsOfKind(f.NewExpression);for(let r of n){let n=r.getExpression().getText(),i=n.split(`.`).pop()??n;if(t.has(n)||t.has(i))continue;let a=Ve.some(e=>n.endsWith(e)),o=He.some(e=>n.endsWith(e));if(a||o){if(o){if(r.getFirstAncestorByKind(f.Decorator))continue;let e=r.getFirstAncestorByKind(f.MethodDeclaration),t=r.getFirstAncestorByKind(f.Constructor);if(!(e||t))continue}e.report({filePath:e.filePath,message:`Manual instantiation of '${n}' detected. Use dependency injection instead.`,help:this.meta.help,line:r.getStartLineNumber(),column:1})}}}},Ke=/\.(\w+)$/,qe=/^(\w+)</,Je=new Set([`PrismaService`,`PrismaClient`,`EntityManager`,`DataSource`,`Repository`,`Connection`,`MongooseModel`,`InjectModel`,`InjectRepository`,`MikroORM`,`DrizzleService`]),Ye={meta:{id:`architecture/no-orm-in-controllers`,category:`architecture`,severity:`error`,description:`Controllers must not inject ORM services directly — use a service layer`,help:`Inject a service that wraps the ORM instead of using the ORM directly in controllers.`},check(e){for(let t of e.sourceFile.getClasses()){if(!T(t))continue;let n=t.getConstructors()[0];if(n){for(let t of n.getParameters()){let n=Xe(t.getType().getText());if(Je.has(n)){let r=t.getNameNode();e.report({filePath:e.filePath,message:`Controller injects ORM type '${n}' directly. Use a service layer.`,help:this.meta.help,line:r.getStartLineNumber(),column:r.getStartLinePos()+1})}}for(let n of t.getConstructors()[0]?.getParameters()??[])for(let t of n.getDecorators()){let n=t.getName();(n===`InjectRepository`||n===`InjectModel`)&&e.report({filePath:e.filePath,message:`Controller uses @${n}() decorator. Move data access to a service.`,help:this.meta.help,line:t.getStartLineNumber(),column:1})}}}}};function Xe(e){let t=e.match(Ke);if(t)return t[1];let n=e.match(qe);return n?n[1]:e}const Ze=/\.(\w+)$/,Qe=/^(\w+)</,$e=new Set([`PrismaService`,`PrismaClient`,`EntityManager`,`DataSource`,`Connection`,`MikroORM`]),et={meta:{id:`architecture/no-orm-in-services`,category:`architecture`,severity:`info`,description:`Services should use repository abstractions instead of ORM directly`,help:`Create a repository class that wraps ORM calls and inject that instead. Note: If your project follows the official NestJS Prisma recipe (injecting PrismaService directly), you can disable this rule.`},check(e){for(let t of e.sourceFile.getClasses()){if(!E(t))continue;let n=t.getName()??``;if(n.endsWith(`Repository`)||n.endsWith(`Repo`))continue;let r=t.getConstructors()[0];if(r)for(let t of r.getParameters()){let n=tt(t.getType().getText());if($e.has(n)){let r=t.getNameNode();e.report({filePath:e.filePath,message:`Service injects ORM type '${n}' directly. Consider using a repository abstraction.`,help:this.meta.help,line:r.getStartLineNumber(),column:r.getStartLinePos()+1})}for(let n of t.getDecorators()){let t=n.getName();(t===`InjectRepository`||t===`InjectModel`)&&e.report({filePath:e.filePath,message:`Service uses @${t}() directly. Consider wrapping in a repository class.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}}}};function tt(e){let t=e.match(Ze);if(t)return t[1];let n=e.match(Qe);return n?n[1]:e}const nt=/\.(\w+)$/,rt=/^(\w+)</,it=[/Repository$/,/Repo$/],at={meta:{id:`architecture/no-repository-in-controllers`,category:`architecture`,severity:`error`,description:`Controllers must not inject repositories directly — use the service layer`,help:`Move database access to a service and inject the service into the controller instead.`},check(e){for(let t of e.sourceFile.getClasses()){if(!T(t))continue;let n=t.getConstructors()[0];if(n){for(let t of n.getParameters()){let n=ot(t.getType().getText());if(it.some(e=>e.test(n))){let r=t.getNameNode();e.report({filePath:e.filePath,message:`Controller injects repository '${n}' directly. Use a service layer instead.`,help:this.meta.help,line:r.getStartLineNumber(),column:r.getStartLinePos()+1})}}for(let t of e.sourceFile.getImportDeclarations()){let n=t.getModuleSpecifierValue();(n.includes(`/repositories/`)||n.includes(`/repositories`))&&e.report({filePath:e.filePath,message:`Controller imports from repository path '${n}'.`,help:this.meta.help,line:t.getStartLineNumber(),column:1})}}}}};function ot(e){let t=e.match(nt);if(t)return t[1];let n=e.match(rt);return n?n[1]:e}const st={meta:{id:`architecture/no-service-locator`,category:`architecture`,severity:`warning`,description:`Avoid using ModuleRef.get() or ModuleRef.resolve() — prefer explicit constructor injection`,help:`Replace ModuleRef.get()/resolve() with constructor injection for explicit, testable dependencies.`},check(e){let t=e.sourceFile.getDescendantsOfKind(f.CallExpression);for(let n of t){let t=n.getExpression();if(t.getKind()!==f.PropertyAccessExpression)continue;let r=t.asKind(f.PropertyAccessExpression);if(!r)continue;let i=r.getName();if(i!==`get`&&i!==`resolve`)continue;let a=r.getExpression().getText();(a===`moduleRef`||a===`this.moduleRef`)&&e.report({filePath:e.filePath,message:`Service locator pattern: '${a}.${i}()' hides dependencies. Use constructor injection instead.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}},ct={meta:{id:`architecture/prefer-constructor-injection`,category:`architecture`,severity:`warning`,description:`Prefer constructor injection over @Inject() property injection`,help:`Move the dependency to a constructor parameter instead of using property injection.`},check(e){for(let t of e.sourceFile.getClasses())if(D(t))for(let n of t.getProperties())n.getDecorator(`Inject`)&&e.report({filePath:e.filePath,message:`Property '${n.getName()}' uses @Inject() decorator. Prefer constructor injection.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}},lt=[`/repositories/`,`/entities/`,`/dto/`,`/guards/`,`/interceptors/`,`/pipes/`,`/strategies/`],ut={meta:{id:`architecture/require-module-boundaries`,category:`architecture`,severity:`info`,description:`Avoid deep imports into other feature modules' internals`,help:`Import from the module's public API (barrel export) instead of reaching into its internals.`},check(e){for(let t of e.sourceFile.getImportDeclarations()){let n=t.getModuleSpecifierValue();n.startsWith(`.`)&&n.includes(`../`)&&lt.some(e=>n.includes(e))&&e.report({filePath:e.filePath,message:`Import '${n}' reaches into another module's internals.`,help:this.meta.help,line:t.getStartLineNumber(),column:1})}}},dt={meta:{id:`correctness/factory-inject-matches-params`,category:`correctness`,severity:`error`,description:`useFactory inject array length must match the factory function parameter count`,help:`Ensure the 'inject' array has one entry per factory function parameter.`},check(e){for(let t of e.sourceFile.getClasses()){if(!O(t))continue;let n=t.getDecorator(`Module`);if(!n)continue;let r=n.getArguments()[0];if(!r||r.getKind()!==f.ObjectLiteralExpression)continue;let i=r.asKind(f.ObjectLiteralExpression);if(!i)continue;let a=i.getProperty(`providers`);if(!a)continue;let o=a.getChildrenOfKind(f.ArrayLiteralExpression)[0];if(o)for(let t of o.getElements()){if(t.getKind()!==f.ObjectLiteralExpression)continue;let n=t.asKind(f.ObjectLiteralExpression);if(!n)continue;let r=n.getProperty(`useFactory`),i=n.getProperty(`inject`);if(!(r&&i))continue;let a=i.getChildrenOfKind(f.ArrayLiteralExpression)[0];if(!a)continue;let o=a.getElements().length,s,c=r.asKind(f.MethodDeclaration);if(c)s=c.getParameters().length;else{let e=r.asKind(f.PropertyAssignment);if(!e)continue;let t=e.getInitializer();if(!t)continue;t.getKind()===f.ArrowFunction?s=t.asKind(f.ArrowFunction)?.getParameters().length:t.getKind()===f.FunctionExpression&&(s=t.asKind(f.FunctionExpression)?.getParameters().length)}s!==void 0&&o!==s&&e.report({filePath:e.filePath,message:`Factory has ${s} parameter(s) but inject array has ${o} element(s).`,help:this.meta.help,line:t.getStartLineNumber(),column:1})}}}},ft=[`Guard`,`Interceptor`,`Filter`,`Pipe`,`Middleware`,`Strategy`,`Subscriber`,`Listener`,`Processor`,`Consumer`,`Worker`,`Scheduler`,`Cron`,`HealthIndicator`],pt={meta:{id:`correctness/injectable-must-be-provided`,category:`correctness`,severity:`info`,description:`@Injectable() classes should be registered in at least one module's providers array`,help:`Add this class to a module's providers array, or remove the @Injectable() decorator if unused.`,scope:`project`},check(e){let t=new Set;for(let n of e.moduleGraph.modules.values()){for(let e of n.providers)t.add(e);for(let e of n.controllers)t.add(e)}for(let n of e.files){let r=e.project.getSourceFile(n);if(r)for(let e of r.getClasses()){if(!O(e))continue;let n=e.getDecorator(`Module`);if(!n)continue;let r=n.getArguments()[0];if(!r||r.getKind()!==f.ObjectLiteralExpression)continue;let i=r.asKind(f.ObjectLiteralExpression);if(!i)continue;let a=i.getProperty(`providers`);if(!a)continue;let o=a.getChildrenOfKind(f.ArrayLiteralExpression)[0];if(o)for(let e of o.getElements()){if(e.getKind()!==f.ObjectLiteralExpression)continue;let n=e.asKind(f.ObjectLiteralExpression);if(n)for(let e of[`useClass`,`useExisting`]){let r=n.getProperty(e);if(!r)continue;let i=r.asKind(f.PropertyAssignment);if(!i)continue;let a=i.getInitializer();a&&t.add(a.getText())}}}}for(let n of e.files){if(n.includes(`.spec.`)||n.includes(`.test.`)||n.includes(`__test__`)||n.includes(`__tests__`))continue;let r=e.project.getSourceFile(n);if(r)for(let i of r.getClasses()){if(!i.getDecorator(`Injectable`))continue;let r=i.getName();r&&(ft.some(e=>r.endsWith(e))||t.has(r)||e.report({filePath:n,message:`@Injectable() class '${r}' is not registered in any module's providers array.`,help:this.meta.help,line:i.getStartLineNumber(),column:1}))}}}};function mt(e){return e.getDescendantsOfKind(f.ReturnStatement).some(e=>{let t=e.getExpression();return!t||t.getKind()!==f.NewExpression?!1:t.asKindOrThrow(f.NewExpression).getExpression().getText()===`Promise`})}const ht={meta:{id:`correctness/no-async-without-await`,category:`correctness`,severity:`warning`,description:`Async functions/methods should contain at least one await expression`,help:`Either add an await expression or remove the async keyword. HTTP handlers with route decorators are exempted, as async is conventional for controller methods.`},check(e){for(let t of e.sourceFile.getClasses())for(let n of t.getMethods()){if(!n.isAsync()||T(t)&&k(n)||Ee(n))continue;let r=n.getBody();if(r&&r.getDescendantsOfKind(f.AwaitExpression).filter(e=>{let t=e.getParent();for(;t&&t!==r;){if(t.getKind()===f.ArrowFunction||t.getKind()===f.FunctionExpression||t.getKind()===f.FunctionDeclaration)return!1;t=t.getParent()}return!0}).length===0){let t=n.getName();mt(r)?e.report({filePath:e.filePath,message:`Async method '${t}()' returns a Promise directly — remove the async keyword.`,help:`The async keyword is unnecessary when you are already constructing a Promise manually. Remove async to avoid double-wrapping.`,line:n.getStartLineNumber(),column:1}):e.report({filePath:e.filePath,message:`Async method '${t}()' has no await expression.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}for(let t of e.sourceFile.getFunctions()){if(!t.isAsync())continue;let n=t.getBody();if(n&&n.getDescendantsOfKind(f.AwaitExpression).filter(e=>{let t=e.getParent();for(;t&&t!==n;){if(t.getKind()===f.ArrowFunction||t.getKind()===f.FunctionExpression||t.getKind()===f.FunctionDeclaration)return!1;t=t.getParent()}return!0}).length===0){let r=t.getName()??`anonymous`;mt(n)?e.report({filePath:e.filePath,message:`Async function '${r}()' returns a Promise directly — remove the async keyword.`,help:`The async keyword is unnecessary when you are already constructing a Promise manually. Remove async to avoid double-wrapping.`,line:t.getStartLineNumber(),column:1}):e.report({filePath:e.filePath,message:`Async function '${r}()' has no await expression.`,help:this.meta.help,line:t.getStartLineNumber(),column:1})}}}},gt=new Set([`ApiResponse`,`ApiQuery`,`ApiParam`,`ApiHeader`,`ApiSecurity`,`SetMetadata`,`Roles`,`Header`,`Throttle`]),_t={meta:{id:`correctness/no-duplicate-decorators`,category:`correctness`,severity:`warning`,description:`Same decorator should not appear twice on a single target`,help:`Remove the duplicate decorator — it was likely copy-pasted by mistake.`},check(e){for(let t of e.sourceFile.getClasses()){z(t.getDecorators(),e,this.meta.help);for(let n of t.getMethods())z(n.getDecorators(),e,this.meta.help);for(let n of t.getProperties())z(n.getDecorators(),e,this.meta.help);for(let n of t.getConstructors())for(let t of n.getParameters())z(t.getDecorators(),e,this.meta.help)}}};function z(e,t,n){let r=new Set;for(let i of e){let e=i.getName();gt.has(e)||(r.has(e)?t.report({filePath:t.filePath,message:`Duplicate @${e}() decorator on the same target.`,help:n,line:i.getStartLineNumber(),column:1}):r.add(e))}}const vt=[`providers`,`controllers`,`imports`,`exports`],yt={meta:{id:`correctness/no-duplicate-module-metadata`,category:`correctness`,severity:`warning`,description:`Same identifier should not appear twice in a module metadata array`,help:`Remove the duplicate entry from the module metadata.`},check(e){for(let t of e.sourceFile.getClasses()){if(!O(t))continue;let n=t.getDecorator(`Module`);if(!n)continue;let r=n.getArguments()[0];if(!r||r.getKind()!==f.ObjectLiteralExpression)continue;let i=r.asKind(f.ObjectLiteralExpression);if(i)for(let t of vt){let n=i.getProperty(t);if(!n)continue;let r=n.getChildrenOfKind(f.ArrayLiteralExpression)[0];if(!r)continue;let a=new Set;for(let n of r.getElements()){let r=n.getText();a.has(r)?e.report({filePath:e.filePath,message:`Duplicate '${r}' in @Module() ${t} array.`,help:this.meta.help,line:n.getStartLineNumber(),column:1}):a.add(r)}}}}},bt={meta:{id:`correctness/no-duplicate-routes`,category:`correctness`,severity:`error`,description:`Same HTTP method + route path + version should not appear twice in a single controller`,help:`Remove or rename one of the duplicate route handlers.`},check(e){for(let t of e.sourceFile.getClasses()){if(!T(t))continue;let n=new Map;for(let r of t.getMethods())for(let t of r.getDecorators()){let i=t.getName();if(!C.has(i))continue;let a=t.getArguments(),o=a.length>0?a[0].getText():`""`,s=r.getDecorator(`Version`),c=`${i}:${o}:${s?s.getArguments()[0]?.getText()??``:``}`,l=n.get(c);l?e.report({filePath:e.filePath,message:`Duplicate route: @${i}(${o}) is already defined in '${l}()'.`,help:this.meta.help,line:r.getStartLineNumber(),column:1}):n.set(c,r.getName())}}}},xt={meta:{id:`correctness/no-empty-handlers`,category:`correctness`,severity:`info`,description:`Controller HTTP handlers should not have empty bodies`,help:`Add implementation to the handler method or remove it if unnecessary.`},check(e){for(let t of e.sourceFile.getClasses())if(T(t))for(let n of t.getMethods()){if(!n.getDecorators().some(e=>C.has(e.getName())))continue;let t=n.getBody();if(!t)continue;let r=t.asKind(f.Block);r&&r.getStatements().length===0&&e.report({filePath:e.filePath,message:`Handler '${n.getName()}()' has an empty body.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}};function St(e){let t=e.getReturnType().getText();return t.startsWith(`Promise<`)||t===`Promise`?!0:t===`any`||t===`error`?`unknown`:!1}const Ct=new Set([`save`,`create`,`insert`,`update`,`delete`,`remove`,`send`,`emit`,`publish`,`dispatch`,`execute`,`fetch`,`load`,`upload`,`download`,`process`]),wt={meta:{id:`correctness/no-fire-and-forget-async`,category:`correctness`,severity:`warning`,description:`Calling async functions without await leads to unhandled promise rejections`,help:`Add await before the async call, or use void with explicit error handling if fire-and-forget is intentional.`},check(e){for(let t of e.sourceFile.getClasses())for(let n of t.getMethods()){if(k(n))continue;let t=n.getBody();if(!t)continue;let r=t.getDescendantsOfKind(f.ExpressionStatement);for(let t of r){let r=t.getExpression();if(r.getKind()===f.VoidExpression||r.getKind()===f.AwaitExpression||r.getKind()!==f.CallExpression)continue;let i=r.asKind(f.CallExpression);if(!i)continue;let a=i.getExpression().getText().split(`.`).pop()??``,o=St(i);if(o!==!1){if(o===`unknown`){let e=a.toLowerCase();if(!(Ct.has(e)||[...Ct].some(t=>e.startsWith(t)&&e!==t)))continue}t.getFirstAncestorByKind(f.MethodDeclaration)===n&&e.report({filePath:e.filePath,message:`Async call '${a}()' is not awaited — unhandled rejections will crash the process.`,help:this.meta.help,line:t.getStartLineNumber(),column:1})}}}}},Tt={meta:{id:`correctness/no-missing-filter-catch`,category:`correctness`,severity:`error`,description:`Exception filter classes decorated with @Catch() must implement the catch() method`,help:`Add a catch(exception, host: ArgumentsHost) method to the filter class.`},check(e){for(let t of e.sourceFile.getClasses())w(t,`Catch`)&&(t.getExtends()||t.getMethods().some(e=>e.getName()===`catch`)||e.report({filePath:e.filePath,message:`Exception filter '${t.getName()}' has @Catch() but is missing the 'catch()' method.`,help:this.meta.help,line:t.getStartLineNumber(),column:1}))}},Et={meta:{id:`correctness/no-missing-guard-method`,category:`correctness`,severity:`error`,description:`Guard classes must implement the canActivate() method`,help:`Add a canActivate(context: ExecutionContext) method to the guard class. Note: This rule identifies guards by the 'Guard' class name suffix.`},check(e){for(let t of e.sourceFile.getClasses()){let n=t.getName()??``;n.endsWith(`Guard`)&&w(t,`Injectable`)&&(t.getExtends()||t.getMethods().some(e=>e.getName()===`canActivate`)||e.report({filePath:e.filePath,message:`Guard '${n}' is missing the 'canActivate()' method.`,help:this.meta.help,line:t.getStartLineNumber(),column:1}))}}},Dt={meta:{id:`correctness/no-missing-injectable`,category:`correctness`,severity:`error`,description:`Provider classes with constructor dependencies must have the @Injectable() decorator`,help:`Add @Injectable() to providers that inject constructor dependencies.`,scope:`project`},check(e){let t=new Set([...e.providers.values()].map(e=>e.name)),n=new Map;for(let t of e.files){let r=e.project.getSourceFile(t);if(r)for(let e of r.getClasses()){let r=e.getName();if(r){let i=n.get(r)??[];i.push({cls:e,filePath:t}),n.set(r,i)}}}for(let r of e.moduleGraph.modules.values())for(let i of r.providers){if(t.has(i))continue;let a=n.get(i);if(a)for(let{cls:t,filePath:n}of a){let a=(t.getConstructors()[0]?.getParameters().length??0)>0;!(t.getDecorator(`Injectable`)||t.getDecorator(`Resolver`)||t.getDecorator(`WebSocketGateway`))&&a&&e.report({filePath:n,message:`Class '${i}' is listed in '${r.name}' providers but is missing @Injectable() decorator.`,help:this.meta.help,line:t.getStartLineNumber(),column:1})}}}},Ot={meta:{id:`correctness/no-missing-interceptor-method`,category:`correctness`,severity:`error`,description:`Interceptor classes must implement the intercept() method`,help:`Add an intercept(context: ExecutionContext, next: CallHandler) method to the interceptor class.`},check(e){for(let t of e.sourceFile.getClasses()){let n=t.getName()??``;n.endsWith(`Interceptor`)&&w(t,`Injectable`)&&(t.getExtends()||t.getMethods().some(e=>e.getName()===`intercept`)||e.report({filePath:e.filePath,message:`Interceptor '${n}' is missing the 'intercept()' method.`,help:this.meta.help,line:t.getStartLineNumber(),column:1}))}}},kt={meta:{id:`correctness/no-missing-module-decorator`,category:`correctness`,severity:`warning`,description:`Classes named *Module should have a @Module() decorator`,help:`Add @Module({}) decorator to the class, or rename it if it is not a NestJS module.`},check(e){for(let t of e.sourceFile.getClasses()){let n=t.getName()??``;n.endsWith(`Module`)&&(n===`Module`||n===`DynamicModule`||w(t,`Module`)||e.report({filePath:e.filePath,message:`Class '${n}' is named like a module but is missing the @Module() decorator.`,help:this.meta.help,line:t.getStartLineNumber(),column:1}))}}},At={meta:{id:`correctness/no-missing-pipe-method`,category:`correctness`,severity:`error`,description:`Pipe classes must implement the transform() method`,help:`Add a transform(value: any, metadata: ArgumentMetadata) method to the pipe class.`},check(e){for(let t of e.sourceFile.getClasses()){let n=t.getName()??``;n.endsWith(`Pipe`)&&w(t,`Injectable`)&&(t.getExtends()||t.getMethods().some(e=>e.getName()===`transform`)||e.report({filePath:e.filePath,message:`Pipe '${n}' is missing the 'transform()' method.`,help:this.meta.help,line:t.getStartLineNumber(),column:1}))}}},jt=/:(\w+)/g,Mt={meta:{id:`correctness/param-decorator-matches-route`,category:`correctness`,severity:`error`,description:`@Param() decorator name must match a :param in the route path`,help:`Ensure the @Param('name') argument matches a ':name' segment in the route path (including controller prefix).`},check(e){for(let t of e.sourceFile.getClasses()){if(!T(t))continue;let n=t.getDecorator(`Controller`),r=``;if(n){let e=n.getArguments();if(e.length>0){let t=e[0];if(t.getKind()===f.ObjectLiteralExpression){let e=t.asKind(f.ObjectLiteralExpression);if(e){let t=e.getProperty(`path`);if(t){let e=t.asKind(f.PropertyAssignment);if(e){let t=e.getInitializer();t&&(r=t.getText().replace(/^['"`]|['"`]$/g,``))}}}}else r=t.getText().replace(/^['"`]|['"`]$/g,``)}}let i=new Set;for(let e of r.matchAll(jt))i.add(e[1]);for(let n of t.getMethods()){let t=``,r=!1;for(let e of n.getDecorators())if(C.has(e.getName())){r=!0;let n=e.getArguments();n.length>0&&(t=n[0].getText().replace(/^['"`]|['"`]$/g,``));break}if(!r)continue;let a=new Set;for(let e of t.matchAll(jt))a.add(e[1]);let o=new Set([...i,...a]);for(let t of n.getParameters())for(let n of t.getDecorators()){if(n.getName()!==`Param`)continue;let t=n.getArguments();if(t.length===0)continue;let r=t[0].getText().replace(/^['"`]|['"`]$/g,``);o.has(r)||e.report({filePath:e.filePath,message:`@Param('${r}') does not match any route parameter. Available: ${o.size>0?[...o].map(e=>`:${e}`).join(`, `):`(none)`}.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}}}},Nt={meta:{id:`correctness/prefer-readonly-injection`,category:`correctness`,severity:`warning`,description:`Constructor DI parameters should be readonly to prevent accidental reassignment`,help:`Add the 'readonly' modifier to the constructor parameter.`},check(e){for(let t of e.sourceFile.getClasses()){if(!(E(t)||T(t)))continue;let n=t.getConstructors()[0];if(n){for(let t of n.getParameters())if((t.hasModifier(`private`)||t.hasModifier(`protected`)||t.hasModifier(`public`))&&!t.isReadonly()){let n=t.getNameNode();e.report({filePath:e.filePath,message:`Constructor parameter '${t.getName()}' should be readonly.`,help:this.meta.help,line:n.getStartLineNumber(),column:n.getStartLinePos()+1})}}}}},Pt={meta:{id:`correctness/require-inject-decorator`,category:`correctness`,severity:`error`,description:`Constructor parameters without type annotations must have @Inject() decorator for NestJS DI to resolve them`,help:`Add a type annotation or @Inject() decorator to the constructor parameter.`},check(e){for(let t of e.sourceFile.getClasses()){if(!D(t))continue;let n=t.getConstructors()[0];if(n)for(let r of n.getParameters()){let n=r.getTypeNode(),i=r.getDecorators().some(e=>e.getName()===`Inject`);n||i||e.report({filePath:e.filePath,message:`Constructor parameter '${r.getName()}' in '${t.getName()}' has no type annotation and no @Inject() decorator — NestJS cannot resolve it.`,help:this.meta.help,line:r.getStartLineNumber(),column:1})}}}},Ft={onModuleInit:`OnModuleInit`,onModuleDestroy:`OnModuleDestroy`,onApplicationBootstrap:`OnApplicationBootstrap`,onApplicationShutdown:`OnApplicationShutdown`,beforeApplicationShutdown:`BeforeApplicationShutdown`},It={meta:{id:`correctness/require-lifecycle-interface`,category:`correctness`,severity:`warning`,description:`Classes with lifecycle methods should implement the corresponding NestJS interface`,help:`Add 'implements OnModuleInit' (or the appropriate interface) to the class declaration.`},check(e){for(let t of e.sourceFile.getClasses()){let n=t.getImplements().map(e=>e.getText());for(let r of t.getMethods()){let i=r.getName(),a=Ft[i];a&&(n.some(e=>e===a||e.startsWith(`${a}<`))||e.report({filePath:e.filePath,message:`Class '${t.getName()}' has '${i}()' but does not implement '${a}'.`,help:this.meta.help,line:r.getStartLineNumber(),column:1}))}}}},Lt=/each\s*:\s*true/,Rt={meta:{id:`correctness/validate-nested-array-each`,category:`correctness`,severity:`warning`,description:`@ValidateNested() on array-typed properties must use { each: true }`,help:`Change @ValidateNested() to @ValidateNested({ each: true }) for array properties.`},check(e){for(let t of e.sourceFile.getClasses())for(let n of t.getProperties()){let t=n.getDecorators(),r=t.find(e=>e.getName()===`ValidateNested`);if(!r)continue;let i=zt(n),a=t.some(e=>e.getName()===`IsArray`);(i||a)&&(Bt(r)||e.report({filePath:e.filePath,message:`Property '${n.getName()}' is an array with @ValidateNested() but missing { each: true }.`,help:this.meta.help,line:r.getStartLineNumber(),column:1}))}}};function zt(e){let t=e.getTypeNode();if(!t)return!1;let n=t.getText().replace(/\s/g,``);return!!(n.endsWith(`[]`)||n.startsWith(`Array<`))}function Bt(e){let t=e.getArguments();if(t.length===0)return!1;let n=t[0];if(n.getKind()!==f.ObjectLiteralExpression)return!1;let r=n.getText();return Lt.test(r)}const Vt=new Set(`ValidateNested.IsString.IsNumber.IsBoolean.IsEmail.IsArray.IsEnum.IsNotEmpty.IsDefined.IsOptional.IsDate.IsObject.IsInt.IsPositive.IsNegative.IsUUID.IsUrl.IsISO8601.Matches.Min.Max.MinLength.MaxLength.ArrayMinSize.ArrayMaxSize.ArrayNotEmpty.IsIn.IsNotIn.Length.Contains.IsAlpha.IsAlphanumeric.IsDecimal.IsHexColor.IsJSON.IsPhoneNumber.IsIP.IsCreditCard.IsDateString.IsMilitaryTime.IsMongoId.IsPort.IsSemVer.IsStrongPassword`.split(`.`)),Ht=new Set([`string`,`number`,`boolean`,`Date`,`any`,`unknown`,`bigint`,`symbol`,`undefined`,`null`,`void`,`never`]),Ut=/\s/g,Wt=/\[\]$/,Gt=/^Array<(.+)>$/,Kt=/^["']/,qt=/^\d+$/;function B(e){let t=e.replace(Ut,``);if(t.includes(`|`))return t.split(`|`).every(e=>B(e));if(Ht.has(t)||Wt.test(t)&&B(t.replace(Wt,``)))return!0;let n=t.match(Gt);return!!(n&&B(n[1])||Kt.test(t)||qt.test(t))}const Jt={meta:{id:`correctness/validated-non-primitive-needs-type`,category:`correctness`,severity:`warning`,description:`DTO properties with class-validator decorators on non-primitive types must have @Type() from class-transformer`,help:`Add @Type(() => ClassName) from 'class-transformer' to ensure proper transformation.`},check(e){for(let t of e.sourceFile.getClasses())for(let n of t.getProperties()){let t=n.getDecorators();if(t.length===0||!t.some(e=>Vt.has(e.getName()))||t.some(e=>e.getName()===`Type`)||t.some(e=>e.getName()===`IsEnum`))continue;let r=n.getTypeNode();if(!r)continue;let i=r.getText();B(i)||e.report({filePath:e.filePath,message:`Property '${n.getName()}' has type '${i}' with class-validator decorators but is missing @Type() decorator.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}},Yt=new Set([f.ForStatement,f.ForOfStatement,f.ForInStatement,f.WhileStatement,f.DoStatement]),Xt={meta:{id:`performance/no-blocking-constructor`,category:`performance`,severity:`warning`,description:`Constructors in Injectable/Controller classes should not contain heavy operations`,help:`Move heavy initialization logic to the onModuleInit() lifecycle method. Constructors cannot be async, so asynchronous work should always use lifecycle hooks.`},check(e){for(let t of e.sourceFile.getClasses()){if(!(w(t,`Injectable`)||w(t,`Controller`)))continue;let n=t.getConstructors()[0];if(!n)continue;let r=n.getBody();if(r){for(let i of r.getDescendants())if(Yt.has(i.getKind())){e.report({filePath:e.filePath,message:`Constructor in '${t.getName()}' contains blocking operation — use onModuleInit() instead.`,help:this.meta.help,line:n.getStartLineNumber(),column:1});break}}}}},Zt={meta:{id:`performance/no-dynamic-require`,category:`performance`,severity:`warning`,description:`Dynamic require() with variable arguments prevents bundler optimization`,help:`Use static import statements or dynamic import() with string literals.`},check(e){let t=e.sourceFile.getDescendantsOfKind(f.CallExpression);for(let n of t){if(n.getExpression().getText()!==`require`)continue;let t=n.getArguments();t.length!==0&&t[0].getKind()!==f.StringLiteral&&e.report({filePath:e.filePath,message:`Dynamic require() with non-literal argument prevents bundler optimization.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}},Qt={meta:{id:`performance/no-orphan-modules`,category:`performance`,severity:`info`,description:`Module is never imported by any other module and may be dead code`,help:`Import this module in another module or remove it if it is unused.`,scope:`project`},check(e){let t=new Set;for(let n of e.moduleGraph.modules.values())for(let e of n.imports)t.add(e);for(let n of e.moduleGraph.modules.values())n.name!==`AppModule`&&(t.has(n.name)||e.report({filePath:n.filePath,message:`Module '${n.name}' is never imported by any other module.`,help:this.meta.help,line:n.classDeclaration.getStartLineNumber(),column:1}))}},$t={meta:{id:`performance/no-request-scope-abuse`,category:`performance`,severity:`warning`,description:`Scope.REQUEST creates a new provider instance per request — use only when necessary`,help:`Remove Scope.REQUEST unless the provider genuinely needs per-request state (e.g., request-scoped context). Consider Scope.DEFAULT or Scope.TRANSIENT instead.`},check(e){let t=e.sourceFile.getDescendantsOfKind(f.PropertyAccessExpression);for(let n of t)n.getName()===`REQUEST`&&n.getExpression().getText()===`Scope`&&e.report({filePath:e.filePath,message:`Scope.REQUEST creates a new instance per request, which impacts performance and propagates request scope to all dependents.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}},en=new Set([`readFileSync`,`writeFileSync`,`existsSync`,`mkdirSync`,`readdirSync`,`statSync`,`accessSync`,`appendFileSync`,`copyFileSync`,`renameSync`,`unlinkSync`]),tn={meta:{id:`performance/no-sync-io`,category:`performance`,severity:`warning`,description:`Synchronous I/O calls block the event loop and should be avoided in NestJS applications`,help:`Use the async variant (e.g., readFile instead of readFileSync) with await.`},check(e){let t=e.sourceFile.getDescendantsOfKind(f.CallExpression);for(let n of t){let t=n.getExpression().getText().split(`.`).pop()??``;en.has(t)&&e.report({filePath:e.filePath,message:`Synchronous I/O call '${t}()' blocks the event loop.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}},nn={meta:{id:`performance/no-unused-module-exports`,category:`performance`,severity:`info`,description:`Module exports a provider that no importing module actually uses`,help:`Remove the unused export or use the provider in an importing module.`,scope:`project`},check(e){for(let t of e.moduleGraph.modules.values()){if(t.exports.length===0)continue;let n=[];for(let r of e.moduleGraph.modules.values())r.name!==t.name&&r.imports.includes(t.name)&&n.push(r.name);if(n.length===0)continue;let r=new Set;for(let i of n){let n=e.moduleGraph.modules.get(i);if(n){for(let t of n.providers){let n=e.providers.get(t);if(n)for(let e of n.dependencies)r.add(e)}if(n.exports.includes(t.name))for(let e of t.exports)r.add(e);for(let t of n.controllers)for(let n of e.files){let i=e.project.getSourceFile(n);if(i)for(let e of i.getClasses()){if(e.getName()!==t)continue;let n=e.getConstructors()[0];if(n)for(let e of n.getParameters()){let t=e.getTypeNode(),n=t?t.getText():e.getType().getText(),i=n.split(`.`).pop()?.split(`<`)[0]??n;r.add(i)}}}}}for(let n of t.exports)e.moduleGraph.modules.has(n)||r.has(n)||e.report({filePath:t.filePath,message:`Module '${t.name}' exports '${n}' but no importing module uses it.`,help:this.meta.help,line:t.classDeclaration.getStartLineNumber(),column:1})}}},rn=new Set([`Cron`,`Interval`,`Timeout`,`OnEvent`,`Process`,`OnQueueEvent`,`EventSubscriber`,`SubscribeMessage`,`WebSocketGateway`]);function an(e){for(let t of e.getDecorators())if(rn.has(t.getName()))return!0;for(let t of e.getMethods())for(let e of t.getDecorators())if(rn.has(e.getName()))return!0;return!1}const on={meta:{id:`performance/no-unused-providers`,category:`performance`,severity:`warning`,description:`Injectable providers that are never injected and have no self-activating decorators may be dead code`,help:`Remove the unused provider, inject it where needed, or verify it is activated by a framework decorator (e.g. @Cron, @OnEvent).`,scope:`project`},check(e){let t=new Set;for(let n of e.providers.values())for(let e of n.dependencies)t.add(e);let n=[`Controller`,`Resolver`,`WebSocketGateway`];for(let r of e.files){let i=e.project.getSourceFile(r);if(i)for(let e of i.getClasses()){if(!n.some(t=>e.getDecorator(t)!==void 0))continue;let r=e.getConstructors()[0];if(r)for(let e of r.getParameters()){let n=e.getTypeNode(),r=n?n.getText():e.getType().getText(),i=r.split(`.`).pop()?.split(`<`)[0]??r;t.add(i)}}}for(let n of e.providers.values()){let r=n.name;if(ft.some(e=>r.endsWith(e))||t.has(r)||an(n.classDeclaration))continue;let i=!1;for(let t of e.moduleGraph.modules.values())if(t.exports.includes(r)){i=!0;break}i||e.report({filePath:n.filePath,message:`Provider '${r}' is never injected by any other provider or controller.`,help:this.meta.help,line:n.classDeclaration.getStartLineNumber(),column:1})}}},sn={meta:{id:`schema/require-cascade-rule`,category:`schema`,scope:`schema`,severity:`info`,description:`Relations should have explicit onDelete/cascade behavior defined`,help:`Add an explicit onDelete option (e.g. CASCADE, SET NULL) to avoid relying on database defaults.`},check(e){for(let t of e.schemaGraph.relations)if(!(t.type!==`many-to-one`&&t.type!==`one-to-one`)&&!t.onDelete){let n=e.schemaGraph.entities.get(t.fromEntity);if(!n)continue;e.report({filePath:n.filePath,entity:n.name,message:`Relation '${t.propertyName}' on '${t.fromEntity}' has no explicit onDelete behavior.`,help:this.meta.help})}}},cn={meta:{id:`schema/require-primary-key`,category:`schema`,scope:`schema`,severity:`error`,description:`Every entity must have at least one primary key column`,help:`Add a primary key column (e.g. @id in Prisma, @PrimaryColumn/@PrimaryGeneratedColumn in TypeORM).`},check(e){for(let t of e.schemaGraph.entities.values())t.columns.some(e=>e.isPrimary)||e.report({filePath:t.filePath,entity:t.name,message:`Entity '${t.name}' has no primary key column.`,help:this.meta.help})}},ln=/delete/i;function un(e,t){let n=new Set(e.columns.map(e=>e.name.toLowerCase()));return n.has(`createdat`)||n.has(`created_at`)?!0:t===`typeorm`?e.columns.some(e=>e.type===`timestamp`&&e.isGenerated&&!ln.test(e.name)):t===`prisma`?e.columns.some(e=>e.type===`DateTime`&&e.defaultValue!==void 0&&e.defaultValue.includes(`now()`)):t===`drizzle`?e.columns.some(e=>(e.type===`timestamp`||e.type===`date`||e.type===`datetime`)&&e.defaultValue!==void 0&&e.defaultValue.includes(`now()`)):!1}const dn={meta:{id:`schema/require-timestamps`,category:`schema`,scope:`schema`,severity:`warning`,description:`Entities should have timestamp columns (createdAt/updatedAt)`,help:`Add createdAt/updatedAt columns to track when records are created and modified.`},check(e){for(let t of e.schemaGraph.entities.values())un(t,e.orm)||e.report({filePath:t.filePath,entity:t.name,message:`Entity '${t.name}' has no timestamp columns (createdAt/updatedAt).`,help:this.meta.help})}},fn={meta:{id:`security/no-csrf-disabled`,category:`security`,severity:`error`,description:`CSRF protection should not be explicitly disabled`,help:`Enable CSRF protection or remove the explicit disabling of it.`},check(e){let t=e.sourceFile.getDescendantsOfKind(f.PropertyAssignment);for(let n of t){let t=n.getName();if(t!==`csrf`&&t!==`csrfProtection`)continue;let r=n.getInitializer();r&&r.getText()===`false`&&e.report({filePath:e.filePath,message:`CSRF protection explicitly disabled (${t}: false).`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}},pn={meta:{id:`security/no-dangerous-redirects`,category:`security`,severity:`error`,description:`Redirects using user-controlled input (from @Query/@Param) are an open redirect vulnerability`,help:`Validate redirect URLs against an allowlist of safe destinations.`},check(e){for(let t of e.sourceFile.getClasses())if(T(t))for(let n of t.getMethods()){let t=new Set;for(let e of n.getParameters())e.getDecorators().some(e=>e.getName()===`Query`||e.getName()===`Param`)&&t.add(e.getName());if(t.size===0)continue;let r=n.getDescendantsOfKind(f.CallExpression);for(let n of r)if(n.getExpression().getText().endsWith(`redirect`))for(let r of n.getArguments()){let i=r.getText();t.has(i)&&e.report({filePath:e.filePath,message:`Redirect uses user-controlled parameter '${i}' — open redirect risk.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}let i=n.getDecorators().find(e=>e.getName()===`Redirect`);if(i)for(let n of i.getArguments()){let r=n.getText();t.has(r)&&e.report({filePath:e.filePath,message:`@Redirect() uses user-controlled parameter '${r}' — open redirect risk.`,help:this.meta.help,line:i.getStartLineNumber(),column:1})}}}},mn={meta:{id:`security/no-eval`,category:`security`,severity:`error`,description:`Usage of eval() or new Function() is a security risk and should be avoided`,help:`Refactor to avoid eval() and new Function(). Use safer alternatives like JSON.parse() or a sandboxed interpreter.`},check(e){let t=e.sourceFile.getDescendantsOfKind(f.CallExpression);for(let n of t)n.getExpression().getText()===`eval`&&e.report({filePath:e.filePath,message:`Usage of eval() is a security risk.`,help:this.meta.help,line:n.getStartLineNumber(),column:1});let n=e.sourceFile.getDescendantsOfKind(f.NewExpression);for(let t of n)t.getExpression().getText()===`Function`&&e.report({filePath:e.filePath,message:`Usage of new Function() is a security risk.`,help:this.meta.help,line:t.getStartLineNumber(),column:1})}},hn={meta:{id:`security/no-exposed-env-vars`,category:`security`,severity:`warning`,description:`Use NestJS ConfigService instead of direct process.env access in Injectable/Controller classes`,help:`Inject ConfigService and use configService.get('VAR_NAME') instead of process.env.VAR_NAME.`},check(e){for(let t of e.sourceFile.getClasses()){if(!(w(t,`Injectable`)||w(t,`Controller`)))continue;let n=t.getDescendantsOfKind(f.PropertyAccessExpression);for(let r of n)r.getExpression().getText()===`process.env`&&e.report({filePath:e.filePath,message:`Direct 'process.env.${r.getName()}' access in '${t.getName()}'. Use ConfigService instead.`,help:this.meta.help,line:r.getStartLineNumber(),column:1})}}},gn=/^(error|err|e|ex|exception)$/,_n={meta:{id:`security/no-exposed-stack-trace`,category:`security`,severity:`warning`,description:`Stack traces should not be exposed in responses — they leak internal implementation details`,help:`Log the stack trace internally and return a generic error message to the client.`},check(e){let t=e.sourceFile.getDescendantsOfKind(f.PropertyAccessExpression);for(let n of t){if(n.getName()!==`stack`)continue;let t=n.getExpression().getText();if(!(gn.test(t)||t.endsWith(`.error`)||t.endsWith(`.err`)))continue;let r=n.getParent();if(!r)continue;let i=r.getKind();(i===f.ReturnStatement||i===f.PropertyAssignment||i===f.ShorthandPropertyAssignment||i===f.CallExpression)&&e.report({filePath:e.filePath,message:`Stack trace '${t}.stack' may be exposed in response — leaks implementation details.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}},vn=[{pattern:/^(?=.*\d)[A-Za-z0-9+/]{40,}={0,2}$/,name:`Base64 key`},{pattern:/^sk[-_][a-zA-Z0-9]{20,}$/,name:`Secret key`},{pattern:/^pk[-_][a-zA-Z0-9]{20,}$/,name:`Public key (in source)`},{pattern:/^ghp_[a-zA-Z0-9]{36,}$/,name:`GitHub personal access token`},{pattern:/^github_pat_[a-zA-Z0-9_]{22,}$/,name:`GitHub fine-grained PAT`},{pattern:/^gho_[a-zA-Z0-9]{36,}$/,name:`GitHub OAuth token`},{pattern:/^xox[bpras]-[a-zA-Z0-9-]+$/,name:`Slack token`},{pattern:/^eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\./,name:`JWT token`},{pattern:/^AKIA[0-9A-Z]{16}$/,name:`AWS Access Key ID`},{pattern:/^[a-f0-9]{64}$/,name:`Hex-encoded secret (64 chars)`}],yn=[/secret/i,/password/i,/passwd/i,/api[_-]?key/i,/auth[_-]?token/i,/private[_-]?key/i,/access[_-]?key/i,/client[_-]?secret/i],bn=new Set([`your-secret-here`,`changeme`,`password`]),xn=/^[A-Za-z][A-Za-z0-9_]*(\.[A-Za-z][A-Za-z0-9_]*)+$/,Sn=new Set([`cursor`,`nextCursor`,`prevCursor`,`previousCursor`,`startCursor`,`endCursor`,`pageToken`,`nextPageToken`,`continuationToken`,`continuation`,`nextPage`,`afterCursor`,`beforeCursor`]);function Cn(e){return!(e.length<8||e.includes("${")||e.startsWith(`process.env`)||bn.has(e)||e.includes(` `)||xn.test(e))}function wn(e){return yn.some(t=>t.test(e))}function Tn(e){try{let t=Buffer.from(e,`base64`).toString(`utf-8`);return JSON.parse(t),!0}catch{return!1}}function En(e){let t=new Map;for(let n of e)t.set(n,(t.get(n)??0)+1);let n=0;for(let r of t.values()){let t=r/e.length;n-=t*Math.log2(t)}return n}const Dn=new Set([...`aeiouyAEIOUY`]),On=/^[A-Z]{2,4}_/,kn=/(?<=[a-z])(?=[A-Z])|(?<=[A-Za-z])(?=\d)|(?<=\d)(?=[A-Za-z])|_/,An=/[a-zA-Z]/;function jn(e){let t=e.includes(`_`),n=e.split(kn).filter(e=>e.length>0).filter(e=>An.test(e)),r=n.filter(e=>e.length>=4&&[...e].some(e=>Dn.has(e)));return n.slice(0,6).filter(e=>e.length>=4&&[...e].some(e=>Dn.has(e))).length>=2||t&&e.split(`_`).filter(e=>e.length>=3).length>=2||On.test(e)?!0:(En(e)>4.9&&!t&&r.length,!1)}function Mn(e){let t=e.getParent();if(!t)return!1;let n=t.asKind(f.PropertyAssignment);if(n)return Sn.has(n.getName());let r=t.asKind(f.VariableDeclaration);return r?Sn.has(r.getName()):!1}const Nn={meta:{id:`security/no-hardcoded-secrets`,category:`security`,severity:`error`,description:`Detect hardcoded secrets, API keys, and tokens in source code`,help:`Move secrets to environment variables and access them via ConfigService.`},check(e){let t=e.sourceFile.getDescendantsOfKind(f.StringLiteral);for(let n of t){let t=n.getLiteralValue();if(!(t.length<16)&&n.getParent()?.getKind()!==f.ImportDeclaration){for(let{pattern:r,name:i}of vn)if(r.test(t)){if(i===`Base64 key`&&(Tn(t)||Mn(n)||jn(t)))break;e.report({filePath:e.filePath,message:`Possible hardcoded ${i} detected.`,help:this.meta.help,line:n.getStartLineNumber(),column:1});break}}}let n=e.sourceFile.getDescendantsOfKind(f.VariableDeclaration);for(let t of n){let n=t.getName(),r=t.getInitializer();!r||r.getKind()!==f.StringLiteral||wn(n)&&Cn(r.getText().slice(1,-1))&&e.report({filePath:e.filePath,message:`Variable '${n}' appears to contain a hardcoded secret.`,help:this.meta.help,line:t.getStartLineNumber(),column:1})}let r=e.sourceFile.getDescendantsOfKind(f.PropertyAssignment);for(let t of r){let n=t.getName(),r=t.getInitializer();!r||r.getKind()!==f.StringLiteral||wn(n)&&Cn(r.getText().slice(1,-1))&&e.report({filePath:e.filePath,message:`Property '${n}' appears to contain a hardcoded secret.`,help:this.meta.help,line:t.getStartLineNumber(),column:1})}}},Pn=RegExp(`(?:^|[^a-zA-Z])\\w*(?:${[`Entity`,`Model`].join(`|`)})(?:[^a-zA-Z]|$)`),Fn={meta:{id:`security/no-raw-entity-in-response`,category:`security`,severity:`warning`,description:`Returning ORM entities directly from controllers can leak internal fields like passwords or IDs`,help:`Map entities to DTOs or use class-transformer's @Exclude()/@Expose() decorators before returning.`},check(e){for(let t of e.sourceFile.getClasses())if(T(t))for(let n of t.getMethods()){if(!k(n))continue;let t=n.getReturnType().getText();Pn.test(t)&&!t.includes(`DTO`)&&!t.includes(`Dto`)&&!t.includes(`Response`)&&e.report({filePath:e.filePath,message:`Controller method '${n.getName()}' returns a raw entity type. This may leak internal fields.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}},In={meta:{id:`security/no-synchronize-in-production`,category:`security`,severity:`error`,description:`TypeORM synchronize: true auto-syncs schema and can drop columns or tables in production`,help:`Set synchronize: false and use migrations for production schema changes.`},check(e){let t=e.sourceFile.getDescendantsOfKind(f.PropertyAssignment);for(let n of t){if(n.getName()!==`synchronize`)continue;let t=n.getInitializer();t&&t.getText()===`true`&&e.report({filePath:e.filePath,message:`TypeORM 'synchronize: true' can auto-drop columns and tables in production.`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}},Ln=new Set([`md5`,`sha1`]),Rn={meta:{id:`security/no-weak-crypto`,category:`security`,severity:`warning`,description:`Weak hashing algorithms (MD5, SHA1) should not be used for security purposes`,help:`Use a stronger algorithm like SHA-256 or bcrypt for password hashing.`},check(e){let t=e.sourceFile.getDescendantsOfKind(f.CallExpression);for(let n of t){if(!n.getExpression().getText().endsWith(`createHash`))continue;let t=n.getArguments();if(t.length===0)continue;let r=t[0];if(r.getKind()!==f.StringLiteral)continue;let i=r.getText().slice(1,-1).toLowerCase();Ln.has(i)&&e.report({filePath:e.filePath,message:`Weak hashing algorithm '${i}' used in createHash().`,help:this.meta.help,line:n.getStartLineNumber(),column:1})}}},zn=new Set([`Public`,`AllowAnonymous`,`SkipAuth`,`IsPublic`]),Bn=[De,at,Ye,et,Ge,st,ct,ut,we,Be,Nt,It,xt,bt,Et,At,Tt,Ot,ht,yt,kt,Pt,wt,Mt,dt,Jt,_t,Rt,Dt,pt,Nn,mn,Rn,hn,fn,_n,pn,In,Fn,{meta:{id:`security/require-guards-on-endpoints`,category:`security`,severity:`warning`,description:`Controller endpoints should be protected by @UseGuards() at class or method level`,help:`Add @UseGuards(AuthGuard) to the controller class or individual route handlers, or mark routes as @Public(). If you use a global guard via APP_GUARD, you can disable this rule.`},check(e){for(let t of e.sourceFile.getClasses())if(T(t)&&t.getDecorator(`UseGuards`)===void 0&&!t.getDecorators().some(e=>zn.has(e.getName())))for(let n of t.getMethods())k(n)&&n.getDecorator(`UseGuards`)===void 0&&(n.getDecorators().some(e=>zn.has(e.getName()))||e.report({filePath:e.filePath,message:`Endpoint '${n.getName()}' has no @UseGuards() at class or method level.`,help:this.meta.help,line:n.getStartLineNumber(),column:1}))}},tn,Xt,Zt,$t,on,nn,Qt,cn,dn,sn];function Vn(){return[...Bn]}function Hn(e){return e.meta.scope===`project`}function Un(e){return e.meta.scope===`schema`}function Wn(e,t,n){if(t.length===0)return e;let r=new Set(e.map(e=>e.meta.id)),i=[...e];for(let e of t){if(r.has(e.meta.id)){n.push(`Custom rule "${e.meta.id}" conflicts with a built-in rule and was skipped`);continue}i.push(e)}return i}function Gn(e,t){return t.filter(t=>{let n=e.rules?.[t.meta.id];return!(n===!1||typeof n==`object`&&n.enabled===!1||e.categories?.[t.meta.category]===!1)})}function Kn(e){let t=[],n=[],r=[];for(let i of e)Un(i)?r.push(i):Hn(i)?n.push(i):t.push(i);return{fileRules:t,projectRules:n,schemaRules:r}}const qn=new Set([`security`,`performance`,`correctness`,`architecture`]),Jn=new Set([`error`,`warning`,`info`]),Yn=new Set([`file`,`project`]),Xn=`custom/`;function Zn(e){if(typeof e!=`object`||!e)return!1;let t=e;if(typeof t.check!=`function`||typeof t.meta!=`object`||t.meta===null)return!1;let n=t.meta;return!(typeof n.id!=`string`||n.id.trim()===``||typeof n.description!=`string`||typeof n.help!=`string`||!qn.has(n.category)||!Jn.has(n.severity)||n.scope!==void 0&&!Yn.has(n.scope))}function Qn(e){return e.meta.id.startsWith(Xn)?e:{...e,meta:{...e.meta,id:`${Xn}${e.meta.id}`}}}async function $n(t,i){let a=[],o=[],c=s(i,t);if(!e(c))return o.push(`Custom rules directory not found: ${c}`),{rules:a,warnings:o};if(!r(c).isDirectory())return o.push(`Custom rules path is not a directory: ${c}`),{rules:a,warnings:o};let l;try{l=n(c)}catch(e){return o.push(`Failed to read custom rules directory: ${e instanceof Error?e.message:String(e)}`),{rules:a,warnings:o}}let u=l.filter(e=>e.endsWith(`.ts`));if(u.length===0)return o.push(`No rule files (.ts) found in: ${c}`),{rules:a,warnings:o};let d=m(c,{interopDefault:!0});for(let e of u){let t=s(c,e),n;try{n=await d.import(t)}catch(t){o.push(`Failed to load custom rule file "${e}": ${t instanceof Error?t.message:String(t)}`);continue}let r=!1;for(let[t,i]of Object.entries(n))Zn(i)?(a.push(Qn(i)),r=!0):t!==`__esModule`&&typeof i==`object`&&i&&`meta`in i&&o.push(`Invalid rule export "${t}" in "${e}": missing or invalid required fields (check, meta.id, meta.description, meta.help, meta.category, meta.severity)`);!r&&Object.keys(n).length>0&&(Object.values(n).some(e=>typeof e==`object`&&!!e&&(`meta`in e||`check`in e))||o.push(`No valid rule exports found in "${e}"`))}return{rules:a,warnings:o}}function er(e,t){return e.customRulesDir?$n(e.customRulesDir,t):Promise.resolve({rules:[],warnings:[]})}async function V(e,t){let n=await b(e,t),{rules:r,warnings:i}=await er(n,e),a=Wn(Bn,r,i),{fileRules:o,projectRules:s,schemaRules:c}=Kn(Gn(n,a));return{combinedRules:a,config:n,customRuleWarnings:i,fileRules:o,projectRules:s,schemaRules:c}}async function tr(e,t={}){return(await l(t.include??y.include,{cwd:e,absolute:!0,ignore:t.exclude??y.exclude})).sort()}async function nr(e,t,n={}){let r=await Promise.all([...t.projects.entries()].map(async([t,r])=>[t,await tr(a(e,r),n)])),i=new Map;for(let[e,t]of r)i.set(e,t);return i}function rr(e){let t=new d({compilerOptions:{strict:!0,target:99,module:99,skipFileDependencyResolution:!0},skipAddingFilesFromTsConfig:!0});for(let n of e)t.addSourceFileAtPath(n);return t}const ir=/import\([^)]+\)\.(\w+)/,ar=/^(\w+)</;function or(e,t){let n=[];for(let r of e.getClasses()){if(!r.getDecorator(`Injectable`))continue;let e=r.getName();if(!e)continue;let i=r.getConstructors()[0],a=i?i.getParameters().map(e=>{let t=e.getTypeNode();return lr(t?t.getText():e.getType().getText())}):[],o=r.getMethods().filter(e=>{let t=e.getScope();return!t||t===`public`}).length;n.push({name:e,filePath:t,classDeclaration:r,dependencies:a,publicMethodCount:o})}return n}function sr(e,t){let n=new Map;for(let r of t){let t=e.getSourceFile(r);if(t)for(let e of or(t,r))n.set(e.name,e)}return n}function cr(e,t,n){for(let[t,r]of e)r.filePath===n&&e.delete(t);let r=t.getSourceFile(n);if(r)for(let t of or(r,n))e.set(t.name,t)}function lr(e){let t=e.match(ir);if(t)return t[1];let n=e.match(ar);return n?n[1]:e}const H=/^['"`]|['"`]$/g,ur=/\/+/g,dr=/\/$/;function fr(e,t){let n=e;for(;n&&n!==t;){let e=n.getParent();if(!e||e===t)break;let r=e.getKind();if(r===f.IfStatement){let t=e.asKindOrThrow(f.IfStatement);if(n===t.getThenStatement()||n===t.getElseStatement())return!0}if(r===f.ConditionalExpression){let t=e.asKindOrThrow(f.ConditionalExpression);if(n===t.getWhenTrue()||n===t.getWhenFalse())return!0}let i=n.getKind();if(i===f.CaseClause||i===f.DefaultClause||i===f.CatchClause)return!0;n=e}return!1}function pr(e){let t=e.getDecorator(`Controller`);if(!t)return``;let n=t.getArguments();if(n.length===0)return``;let r=n[0];if(r.getKind()===f.ObjectLiteralExpression){let e=r.asKindOrThrow(f.ObjectLiteralExpression).getProperty(`path`);if(!e)return``;let t=e.asKind(f.PropertyAssignment);if(!t)return``;let n=t.getInitializer();return n?n.getText().replace(H,``):``}return r.getText().replace(H,``)}function mr(e){for(let t of e.getDecorators()){let e=t.getName();if(!C.has(e))continue;let n=t.getArguments(),r=n.length>0?n[0].getText().replace(H,``):``;return{httpMethod:e.toUpperCase(),path:r}}}function hr(e,t){return`/${[e,t].filter(Boolean).join(`/`)}`.replace(ur,`/`).replace(dr,``)||`/`}function U(e){let t=new Map,n=e.getConstructors()[0];if(!n)return t;for(let e of n.getParameters()){let n=e.getName(),r=e.getTypeNode(),i=r?r.getText():e.getType().getText();t.set(n,lr(i))}return t}function gr(e,t){let n=e.getBody();if(!n)return[];let r=new Map,i=0,a=n.getDescendantsOfKind(f.CallExpression);for(let e of a){let a=e.getExpression();if(a.getKind()!==f.PropertyAccessExpression)continue;let o=a.asKindOrThrow(f.PropertyAccessExpression),s=o.getName(),c=o.getExpression();if(c.getKind()!==f.PropertyAccessExpression)continue;let l=c.asKindOrThrow(f.PropertyAccessExpression);if(l.getExpression().getKind()!==f.ThisKeyword)continue;let u=l.getName();if(!t.has(u))continue;r.has(u)||r.set(u,new Map);let d=r.get(u),p=fr(e,n),m=d.get(s);m?m.isUnconditional=m.isUnconditional||!p:d.set(s,{isUnconditional:!p,order:i++})}let o=[];for(let[e,n]of r){let r=[];for(let[e,t]of n)r.push({name:e,conditional:!t.isUnconditional,order:t.order});r.sort((e,t)=>e.order-t.order),o.push({className:t.get(e),methodsCalled:r})}return o}function _r(e){return e.endsWith(`Repository`)?`repository`:e.endsWith(`Guard`)?`guard`:e.endsWith(`Interceptor`)?`interceptor`:e.endsWith(`Pipe`)?`pipe`:e.endsWith(`Filter`)?`filter`:e.endsWith(`Gateway`)?`gateway`:`service`}function W(e,t,n){let r=[],i=new Set,a=[],o=[];for(let t of e)if(t.methodsCalled.length===0)o.push(t);else for(let e of t.methodsCalled)a.push({className:t.className,mc:e,dep:t});a.sort((e,t)=>e.mc.order-t.mc.order);for(let e of o){if(n.has(e.className)||i.has(e.className))continue;i.add(e.className),n.add(e.className);let a=t.get(e.className),o=[];a&&(o=a.dependencies.map(e=>({className:e,methodsCalled:[]}))),r.push({className:e.className,conditional:!1,dependencies:W(o,t,new Set(n)),filePath:a?.filePath??``,line:0,methodName:null,order:0,totalMethods:a?.publicMethodCount??0,type:_r(e.className)})}let s=new Map;for(let{className:e,dep:t}of a)s.has(e)||s.set(e,t.methodsCalled);for(let{className:e,mc:o}of a){if(n.has(e))continue;let a=t.get(e),c=!i.has(e);c&&i.add(e);let l=[];if(c&&a){let r=new Set(n);r.add(e);let i=U(a.classDeclaration),o=new Map,c=0,u=s.get(e)??[];for(let e of u){let t=a.classDeclaration.getInstanceMethod(e.name);if(t)for(let e of gr(t,i)){o.has(e.className)||o.set(e.className,new Map);let t=o.get(e.className);for(let n of e.methodsCalled){let e=t.get(n.name);e?e.isUnconditional=e.isUnconditional||!n.conditional:t.set(n.name,{isUnconditional:!n.conditional,order:c++})}}}l=W([...o.entries()].map(([e,t])=>({className:e,methodsCalled:[...t.entries()].map(([e,t])=>({name:e,conditional:!t.isUnconditional,order:t.order})).sort((e,t)=>e.order-t.order)})),t,r)}let u=0;if(a){let e=a.classDeclaration.getInstanceMethod(o.name);e&&(u=e.getStartLineNumber())}r.push({className:e,conditional:o.conditional,dependencies:l,filePath:a?.filePath??``,line:u,methodName:o.name,order:o.order,totalMethods:a?.publicMethodCount??0,type:_r(e)})}return r}function vr(e,t,n){let r=[];for(let i of e.getClasses()){if(!T(i))continue;let e=pr(i),a=i.getName()??`AnonymousController`,o=U(i);for(let s of i.getMethods()){let i=mr(s);if(!i)continue;let c=hr(e,i.path),l=W(gr(s,o),n,new Set);r.push({controllerClass:a,dependencies:l,filePath:t,handlerMethod:s.getName(),httpMethod:i.httpMethod,line:s.getStartLineNumber(),routePath:c})}}return r}function G(e,t,n){let r=[];for(let i of t){let t=e.getSourceFile(i);t&&r.push(...vr(t,i,n))}return{endpoints:r}}function K(e,t,n,r,i,a){if(i>10)return[];let o=e.getBody();if(!o)return[];let s=[],c=o.getDescendantsOfKind(f.CallExpression);for(let e of c){let o=e.getExpression();if(o.getKind()!==f.PropertyAccessExpression)continue;let c=o.asKindOrThrow(f.PropertyAccessExpression),l=c.getName(),u=c.getExpression();if(u.getKind()===f.PropertyAccessExpression){let e=u.asKindOrThrow(f.PropertyAccessExpression);if(e.getExpression().getKind()!==f.ThisKeyword)continue;let a=e.getName(),o=t.get(a);if(!o)continue;let c=`${o}.${l}`;if(r.has(c)){s.push({calls:[],circular:!0,className:o,filePath:``,line:0,methodName:l});continue}r.add(c);let d=n.get(o),p=[],m=``,h=0;if(d){m=d.filePath;let e=d.classDeclaration.getInstanceMethod(l);e&&(h=e.getStartLineNumber(),p=K(e,U(d.classDeclaration),n,new Set(r),i+1,d.classDeclaration))}s.push({calls:p,className:o,filePath:m,line:h,methodName:l})}else if(u.getKind()===f.ThisKeyword&&a){let e=a.getInstanceMethod(l);if(!e)continue;let o=`${a.getName()??`Anonymous`}.${l}`;if(r.has(o))continue;r.add(o);let c=K(e,t,n,new Set(r),i+1,a);s.push(...c)}}return s}function yr(e,t,n){let r=n.getSourceFile(e.filePath);if(!r)return[];let i=r.getClasses().find(t=>t.getName()===e.controllerClass);if(!i)return[];let a=i.getInstanceMethod(e.handlerMethod);return a?K(a,U(i),t,new Set,0,i):[]}function br(e,t,n,r){e.endpoints=e.endpoints.filter(e=>e.filePath!==n);let i=t.getSourceFile(n);i&&e.endpoints.push(...vr(i,n,r))}const xr=new Set([`pgTable`,`mysqlTable`,`sqliteTable`]),Sr=new Set([`serial`,`bigserial`,`smallserial`]),Cr=/=>\s*(\w+)/;function wr(e){let t={type:`unknown`,isPrimary:!1,isNullable:!0,isGenerated:!1,isUnique:!1};function n(e){if(e.getKind()===f.CallExpression){let r=e.asKindOrThrow(f.CallExpression),i=r.getExpression();if(i.getKind()===f.PropertyAccessExpression){let e=i.asKindOrThrow(f.PropertyAccessExpression);switch(e.getName()){case`primaryKey`:t.isPrimary=!0;break;case`notNull`:t.isNullable=!1;break;case`unique`:t.isUnique=!0;break;case`default`:{let e=r.getArguments();e.length>0&&(t.defaultValue=e[0].getText().replace(/['"]/g,``));break}case`defaultNow`:t.defaultValue=`now()`;break;case`generatedAlwaysAsIdentity`:case`autoincrement`:t.isGenerated=!0;break;case`references`:{let e=r.getArguments();if(e.length>0){let n=e[0].getText(),r=Cr.exec(n);if(r&&(t.reference={toEntity:r[1]}),e.length>1){let n=e[1];if(n.getKind()===f.ObjectLiteralExpression){let e=n.asKindOrThrow(f.ObjectLiteralExpression);for(let n of e.getProperties())if(n.getKind()===f.PropertyAssignment){let e=n.asKindOrThrow(f.PropertyAssignment);if(e.getName()===`onDelete`){let n=e.getInitializer()?.getText();n&&(t.reference.onDelete=n.replace(/['"]/g,``))}}}}}break}default:break}n(e.getExpression())}else if(i.getKind()===f.Identifier){let e=i.getText();t.type=e,Sr.has(e)&&(t.isGenerated=!0)}}}return n(e),t}function Tr(e){let t=[];for(let n of e.getProperties()){if(n.getKind()!==f.PropertyAssignment)continue;let e=n.asKindOrThrow(f.PropertyAssignment),r=e.getName(),i=e.getInitializer();if(!i)continue;let a=wr(i);t.push({name:r,type:a.type,isPrimary:a.isPrimary,isNullable:a.isNullable,isGenerated:a.isGenerated,isUnique:a.isUnique,defaultValue:a.defaultValue})}return t}function Er(e,t){let n=[];for(let r of e.getProperties()){if(r.getKind()!==f.PropertyAssignment)continue;let e=r.asKindOrThrow(f.PropertyAssignment),i=e.getName(),a=e.getInitializer();if(!a)continue;let o=wr(a);o.reference&&n.push({type:`many-to-one`,fromEntity:t,toEntity:o.reference.toEntity,propertyName:i,isNullable:o.isNullable,...o.reference.onDelete?{onDelete:o.reference.onDelete}:{}})}return n}function Dr(e){let t=[],n=e.getDescendantsOfKind(f.CallExpression);for(let e of n){let n=e.getExpression();if(n.getKind()!==f.PropertyAccessExpression||n.asKindOrThrow(f.PropertyAccessExpression).getName()!==`on`)continue;let r=[];for(let t of e.getArguments())if(t.getKind()===f.PropertyAccessExpression){let e=t.asKindOrThrow(f.PropertyAccessExpression);r.push(e.getName())}if(r.length===0)continue;let i=e.getText().includes(`uniqueIndex`);t.push({columns:r,isUnique:i})}return t}function Or(e){let t=[],n=e.getFilePath();for(let r of e.getDescendantsOfKind(f.VariableDeclaration)){let e=r.getInitializer();if(!e||e.getKind()!==f.CallExpression)continue;let i=e.asKindOrThrow(f.CallExpression),a=i.getExpression();if(a.getKind()!==f.Identifier)continue;let o=a.getText();if(!xr.has(o))continue;let s=i.getArguments();if(s.length<2)continue;let c=s[0],l=r.getName();c.getKind()===f.StringLiteral&&(l=c.asKindOrThrow(f.StringLiteral).getLiteralValue());let u=s[1];if(u.getKind()!==f.ObjectLiteralExpression)continue;let d=u.asKindOrThrow(f.ObjectLiteralExpression),p=r.getName(),m=Tr(d),h=Er(d,p),g;if(s.length>=3&&(g=Dr(s[2]),g))for(let e of g)for(let t of e.columns){let e=m.find(e=>e.name===t);e&&(e.hasIndex=!0)}t.push({name:p,tableName:l,filePath:n,columns:m,relations:h,indexes:g})}return t}const kr={supportsIncrementalUpdate:!0,extract(e,t){let n=[];for(let r of t){let t=e.getSourceFile(r);t&&n.push(...Or(t))}return n}},Ar=/^model\s+(\w+)\s*\{/,jr=/^enum\s+(\w+)\s*\{/,Mr=/^(\w+)\s+(\w+)(\?)?(\[\])?(.*)$/,Nr=/@(\w+)(\((?:[^()]*|\([^()]*\))*\))?/g,Pr=/@default\(((?:[^()]*|\([^()]*\))*)\)/,Fr=/^@@map\(\s*"([^"]+)"\s*\)/;function Ir(r){let i=a(r,`prisma`,`schema.prisma`);if(e(i)){let e=a(r,`prisma`),t=n(e).filter(e=>e.endsWith(`.prisma`));return t.length>1?t.map(t=>a(e,t)):[i]}let o=a(r,`schema.prisma`);if(e(o))return[o];try{let n=a(r,`package.json`),i=JSON.parse(t(n,`utf-8`)).prisma?.schema;if(i){let t=a(r,i);if(e(t))return[t]}}catch{}return[]}function Lr(e){let n=[],r=new Set;for(let i of e){let e;try{e=t(i,`utf-8`)}catch{continue}let a=e.split(`
+`),o=null,s=[],c=[],l=[],u;for(let e of a){let t=e.trim(),a=Ar.exec(t);if(a){o={type:`model`,name:a[1]},s=[],c=[],l=[],u=void 0;continue}let d=jr.exec(t);if(d){o={type:`enum`,name:d[1]},r.add(d[1]);continue}if(t===`}`){o?.type===`model`&&n.push({name:o.name,fields:s,indexes:c,compositeIdColumns:l,filePath:i,tableName:u}),o=null,s=[],c=[],l=[],u=void 0;continue}if(o?.type===`model`&&t&&!t.startsWith(`//`)){if(t.startsWith(`@@`)){let e=zr.exec(t);e&&(l=e[1].split(`,`).map(e=>e.trim()));let n=Br(t);n&&c.push(n);let r=Fr.exec(t);r&&(u=r[1]);continue}let e=Vr(t);e&&s.push(e)}}}return{models:n,enums:r}}const Rr=/^@@(index|unique)\(\[([^\]]*)\]\)/,zr=/^@@id\(\[([^\]]*)\]\)/;function Br(e){let t=Rr.exec(e);if(!t)return null;let n=t[1]===`unique`,r=t[2].split(`,`).map(e=>e.trim()).filter(Boolean);return r.length===0?null:{columns:r,isUnique:n}}function Vr(e){let t=Mr.exec(e);if(!t)return null;let n=t[1],r=t[2],i=t[3]===`?`,a=t[4]===`[]`,o=t[5]??``,s=[],c=new RegExp(Nr.source,Nr.flags),l=c.exec(o);for(;l!==null;)s.push(`@${l[1]}${l[2]??``}`),l=c.exec(o);return{name:n,type:r,isOptional:i,isList:a,attributes:s}}function Hr(e){let t=e.attributes.some(e=>e.startsWith(`@id`)),n=e.attributes.some(e=>e.startsWith(`@unique`)),r=e.attributes.find(e=>e.startsWith(`@default(`)),i=!1,a;if(r){let e=Pr.exec(r);if(e){let t=e[1];a=t,(t===`autoincrement()`||t===`uuid()`||t===`cuid()`||t===`dbgenerated()`)&&(i=!0)}}return{name:e.name,type:e.type,isPrimary:t,isNullable:e.isOptional,isGenerated:i,isUnique:n,defaultValue:a}}const Ur=/onDelete:\s*(\w+)/;function Wr(e){let t=e.attributes.find(e=>e.startsWith(`@relation`));if(!t)return;let n=Ur.exec(t);return n?n[1]:void 0}function Gr(e,t){let n=new Set(e.map(e=>e.name));return e.map(r=>{let i=[],a=[],o=new Set;for(let e of r.indexes)for(let t of e.columns)o.add(t);let s=new Set(r.compositeIdColumns);for(let c of r.fields)if(n.has(c.type)&&!t.has(c.type)){let t;t=c.isList?`one-to-many`:`many-to-one`;let n=c.isOptional;c.isList&&e.find(e=>e.name===c.type)?.fields.find(e=>e!==c&&e.type===r.name&&e.isList)&&(t=`many-to-many`);let i=Wr(c);a.push({type:t,fromEntity:r.name,toEntity:c.type,propertyName:c.name,isNullable:n??!1,...i?{onDelete:i}:{}})}else if(!c.attributes.some(e=>e.startsWith(`@relation`))){let e=Hr(c);s.has(c.name)&&(e.isPrimary=!0),(o.has(c.name)||c.attributes.some(e=>e.startsWith(`@unique`)))&&(e.hasIndex=!0),i.push(e)}return{name:r.name,tableName:r.tableName??r.name,filePath:r.filePath,columns:i,relations:a,indexes:r.indexes}})}const Kr={supportsIncrementalUpdate:!1,extract(e,t,n){let r=Ir(n);if(r.length===0)return[];let{models:i,enums:a}=Lr(r);return Gr(i,a)}},qr=/=>\s*(\w+)/,Jr=new Set([`Column`,`PrimaryColumn`,`PrimaryGeneratedColumn`,`CreateDateColumn`,`UpdateDateColumn`,`DeleteDateColumn`,`VersionColumn`]),Yr={OneToOne:`one-to-one`,OneToMany:`one-to-many`,ManyToOne:`many-to-one`,ManyToMany:`many-to-many`};function q(e){let t=e.getArguments();for(let e of t)if(e.getKind()===f.ObjectLiteralExpression){let t={},n=e.asKind(f.ObjectLiteralExpression);if(!n)continue;for(let e of n.getProperties())if(e.getKind()===f.PropertyAssignment){let n=e.asKind(f.PropertyAssignment);n&&(t[n.getName()]=n.getInitializer()?.getText()??``)}return t}return null}function J(e){let t=e.getArguments();if(t.length===0)return null;let n=t[0];return n.getKind()===f.StringLiteral?n.asKind(f.StringLiteral)?.getLiteralValue()??null:null}function Xr(e){let t=e.getDecorator(`Entity`);if(!t)return e.getName()??`UnknownEntity`;let n=J(t);if(n)return n;let r=q(t);return r?.name?r.name.replace(/['"]/g,``):e.getName()??`UnknownEntity`}function Zr(e,t){let n=t.getName(),r=n===`PrimaryColumn`||n===`PrimaryGeneratedColumn`,i=n===`PrimaryGeneratedColumn`||n===`CreateDateColumn`||n===`UpdateDateColumn`||n===`DeleteDateColumn`||n===`VersionColumn`,a=`unknown`,o=!1,s=!1,c,l=J(t);l&&(a=l);let u=q(t);return u&&(u.type&&(a=u.type.replace(/['"]/g,``)),u.nullable===`true`&&(o=!0),u.unique===`true`&&(s=!0),u.default!==void 0&&(c=u.default)),a===`unknown`&&(n===`PrimaryGeneratedColumn`?a=`integer`:n===`CreateDateColumn`||n===`UpdateDateColumn`||n===`DeleteDateColumn`?a=`timestamp`:n===`VersionColumn`&&(a=`integer`)),{name:e,type:a,isPrimary:r,isNullable:o,isGenerated:i,isUnique:s,defaultValue:c}}function Qr(e,t,n){let r=Yr[n.getName()];if(!r)return null;let i=n.getArguments();if(i.length===0)return null;let a=i[0].getText(),o=qr.exec(a);if(!o)return null;let s=o[1],c=q(n),l=c?.nullable===`true`,u=c?.onDelete?.replace(/['"]/g,``);return{type:r,fromEntity:e,toEntity:s,propertyName:t,isNullable:l,...u?{onDelete:u}:{}}}function $r(e){if(!w(e,`Entity`))return null;let t=e.getName();if(!t)return null;let n=Xr(e),r=e.getSourceFile().getFilePath(),i=[],a=[],o=[];for(let t of e.getDecorators())if(t.getName()===`Index`){let e=t.getArguments();for(let n of e)if(n.getKind()===f.ArrayLiteralExpression){let e=n.asKind(f.ArrayLiteralExpression);if(e){let n=e.getElements().map(e=>e.getKind()===f.StringLiteral?e.asKind(f.StringLiteral)?.getLiteralValue()??``:``).filter(Boolean);if(n.length>0){let e=q(t);o.push({columns:n,isUnique:e?.unique===`true`})}}}}let s=new Set;for(let n of e.getProperties()){let e=n.getName(),r=n.getDecorators(),c=r.some(e=>e.getName()===`Index`);c&&(s.add(e),o.push({columns:[e],isUnique:!1}));for(let n of r){let r=n.getName();if(Jr.has(r)){let t=Zr(e,n);c&&(t.hasIndex=!0),i.push(t);break}if(r in Yr){let r=Qr(t,e,n);r&&a.push(r);break}}}for(let e of o)for(let t of e.columns){let e=i.find(e=>e.name===t);e&&(e.hasIndex=!0)}return{name:t,tableName:n,filePath:r,columns:i,relations:a,indexes:o}}const ei={prisma:Kr,typeorm:{supportsIncrementalUpdate:!0,extract(e,t){let n=[];for(let r of t){let t=e.getSourceFile(r);if(t)for(let e of t.getClasses()){let t=$r(e);t&&n.push(t)}}return n}},drizzle:kr};function Y(e,t,n,r){let i={entities:new Map,relations:[],orm:n??`unknown`};if(!n)return i;let a=ei[n];if(!a)return i;let o=a.extract(e,t,r),s=new Map,c=[];for(let e of o)s.set(e.name,e),c.push(...e.relations);return{entities:s,relations:c,orm:n}}function ti(e){return{entities:[...e.entities.values()],relations:e.relations,orm:e.orm}}function ni(e,t,n,r){for(let[t,r]of e.entities)r.filePath===n&&e.entities.delete(t);let i=ei[e.orm];if(!i?.supportsIncrementalUpdate){ri(e);return}let a=i.extract(t,[n],r);for(let t of a)e.entities.set(t.name,t);ri(e)}function ri(e){let t=[];for(let n of e.entities.values())t.push(...n.relations);e.relations=t}async function X(e,t){let{config:n,fileRules:r,projectRules:i,schemaRules:a}=t,[o,s]=await Promise.all([tr(e,n),_e(e)]),c=rr(o),l=Oe(e),u=M(c,o,l),d=sr(c,o);return{astProject:c,config:n,endpointGraph:G(c,o,d),fileRules:r,files:o,moduleGraph:u,pathAliases:l,project:s,projectRules:i,providers:d,schemaGraph:Y(c,o,s.orm,e),schemaRules:a,targetPath:e}}async function ii(e,t={}){let n=await V(e,t.config);return{context:await X(e,n),customRuleWarnings:n.customRuleWarnings}}function ai(e,t){let n=e.astProject.getSourceFile(t);n&&e.astProject.removeSourceFile(n),e.astProject.addSourceFileAtPath(t),e.files.includes(t)||e.files.push(t),Fe(e.moduleGraph,e.astProject,t,e.pathAliases),cr(e.providers,e.astProject,t),br(e.endpointGraph,e.astProject,t,e.providers),e.schemaGraph&&ni(e.schemaGraph,e.astProject,t,e.targetPath)}async function oi(e,t,n){let{config:r,combinedRules:i}=t,o=await nr(e,n,r),s=await Promise.all([...o.entries()].filter(([,e])=>e.length>0).map(async([t,o])=>{let s=a(e,n.projects.get(t)),[c,l]=await Promise.all([_e(s),Se(s,r)]),u=rr(o),d=Oe(s),f=M(u,o,d),p=sr(u,o),m=G(u,o,p),h=Y(u,o,c.orm,s),{fileRules:g,projectRules:ee,schemaRules:te}=Kn(Gn(l,i));return[t,{astProject:u,config:l,endpointGraph:m,fileRules:g,files:o,moduleGraph:f,pathAliases:d,project:c,projectRules:ee,providers:p,schemaGraph:h,schemaRules:te,targetPath:s}]}));return{subProjects:new Map(s)}}const si=e=>h.makeRe(e,{windows:!1}),ci=/\\/g,li=/\/$/,ui=(e,t,n)=>{let r=new Set(Array.isArray(t.ignore?.rules)?t.ignore.rules:[]),i=Array.isArray(t.ignore?.files)?t.ignore.files.map(si):[];if(r.size===0&&i.length===0)return e;let a=n.replace(ci,`/`).replace(li,``);return e.filter(e=>{if(r.has(e.rule))return!1;let t=e.filePath.replace(ci,`/`),n=t.startsWith(`${a}/`)?t.slice(a.length+1):t;return!i.some(e=>e.test(n))})};function di(e,t,n,r){let i=[],a=[],o=e.getSourceFile(t);if(!o)return{diagnostics:i,errors:a};let s=o.getFullText().split(`
+`);for(let e of n){let n={config:r,sourceFile:o,filePath:t,report(t){let n=[],r=Math.max(0,t.line-6),a=Math.min(s.length,t.line+5);for(let e=r;e<a;e++)n.push({line:e+1,text:s[e]});i.push({...t,rule:e.meta.id,category:e.meta.category,scope:`file`,severity:e.meta.severity,sourceLines:n})}};try{e.check(n)}catch(t){a.push({ruleId:e.meta.id,error:t})}}return{diagnostics:i,errors:a}}function fi(e,t,n,r){let i=[],a=[];for(let o of t){let t=di(e,o,n,r);i.push(...t.diagnostics),a.push(...t.errors)}return{diagnostics:i,errors:a}}function pi(e,t,n,r){let i=[],a=[];for(let o of n){let n={project:e,files:t,moduleGraph:r.moduleGraph,providers:r.providers,config:r.config,report(e){i.push({...e,rule:o.meta.id,category:o.meta.category,scope:`project`,severity:o.meta.severity})}};try{o.check(n)}catch(e){a.push({ruleId:o.meta.id,error:e})}}return{diagnostics:i,errors:a}}function mi(e,t){let n=[],r=[];for(let i of t){let t={schemaGraph:e,orm:e.orm,report(e){n.push({...e,rule:i.meta.id,category:i.meta.category,scope:`schema`,severity:i.meta.severity})}};try{i.check(t)}catch(e){r.push({ruleId:i.meta.id,error:e})}}return{diagnostics:n,errors:r}}function hi(e){return e instanceof Error?e.message:String(e)}function Z(e,t,n){return{diagnostics:ui(e,n.config,n.targetPath),errors:t.map(e=>({ruleId:e.ruleId,error:hi(e.error)}))}}function gi(e,t){let n=fi(e.astProject,[t],e.fileRules,e.config);return Z(n.diagnostics,n.errors,e)}function _i(e){let t=fi(e.astProject,e.files,e.fileRules,e.config);return Z(t.diagnostics,t.errors,e)}function vi(e){let t={moduleGraph:e.moduleGraph,providers:e.providers,config:e.config},n=pi(e.astProject,e.files,e.projectRules,t),{diagnostics:r,errors:i}=Z(n.diagnostics,n.errors,e),a=yi(e);return r.push(...a.diagnostics),i.push(...a.errors),{diagnostics:r,errors:i}}function yi(e){if(!e.schemaGraph||e.schemaRules.length===0||e.schemaGraph.entities.size===0)return{diagnostics:[],errors:[]};let t=mi(e.schemaGraph,e.schemaRules);return Z(t.diagnostics,t.errors,e)}function Q(e){let t=u.now(),n=_i(e),r=vi(e),i=u.now()-t;return{diagnostics:[...n.diagnostics,...r.diagnostics],elapsedMs:i,ruleErrors:[...n.errors,...r.errors]}}function bi(e){return e>=90?`Excellent`:e>=75?`Good`:e>=50?`Fair`:e>=25?`Poor`:`Critical`}const xi={error:3,warning:1.5,info:.5},Si={security:1.5,correctness:1.3,schema:1.1,architecture:1,performance:.8};function Ci(e,t){if(t===0)return{value:100,label:bi(100)};let n=0;for(let t of e){let e=xi[t.severity],r=Si[t.category];n+=e*r}let r=n/t,i=Math.max(0,Math.min(100,Math.round(100-r*10)));return{value:i,label:bi(i)}}function wi(e){let t={total:0,errors:0,warnings:0,info:0,byCategory:{security:0,performance:0,correctness:0,architecture:0,schema:0}};for(let n of e)t.total++,n.severity===`error`?t.errors++:n.severity===`warning`?t.warnings++:t.info++,t.byCategory[n.category]++;return t}function $(e,t,n=[]){let{diagnostics:r,ruleErrors:i,elapsedMs:a}=t,o=e.schemaGraph??Y(e.astProject,e.files,e.project.orm,e.targetPath),s=Ci(r,e.files.length),c=wi(r);return{result:{score:s,diagnostics:r,endpoints:e.endpointGraph,project:{...e.project,fileCount:e.files.length,moduleCount:e.moduleGraph.modules.size},summary:c,ruleErrors:i,elapsedMs:a,schema:ti(o)},moduleGraph:e.moduleGraph,schemaGraph:o,customRuleWarnings:n,files:e.files,providers:e.providers}}function Ti(e,t,n,r){let i=[],a=[],o=[],s=new Map,c=[],l=0,u=[],d=[],f=``;for(let[n,r]of e.subProjects){let e=$(r,t.get(n));i.push({name:n,result:e.result}),s.set(n,e.moduleGraph),a.push(...e.result.diagnostics),o.push(...e.result.ruleErrors),l+=e.result.project.fileCount,e.result.endpoints&&c.push(...e.result.endpoints.endpoints),e.result.schema&&(u.push(...e.result.schema.entities),d.push(...e.result.schema.relations),e.result.schema.orm&&e.result.schema.orm!==`unknown`&&(f=e.result.schema.orm))}let p=Ci(a,l),m=wi(a);return{moduleGraphs:s,customRuleWarnings:n,result:{isMonorepo:!0,subProjects:i,combined:{score:p,diagnostics:a,endpoints:c.length>0?{endpoints:c}:void 0,project:{name:`monorepo`,nestVersion:i[0]?.result.project.nestVersion??null,orm:f||(i[0]?.result.project.orm??null),framework:i[0]?.result.project.framework??null,fileCount:l,moduleCount:i.reduce((e,t)=>e+t.result.project.moduleCount,0)},summary:m,ruleErrors:o,elapsedMs:r,schema:u.length>0?{entities:u,relations:d,orm:f||`unknown`}:void 0},elapsedMs:r}}}async function Ei(e,t,n){let r=u.now(),i=await oi(e,t,n),a=new Map;for(let[e,t]of i.subProjects)a.set(e,Q(t));let o=u.now()-r;return Ti(i,a,t.customRuleWarnings,o)}async function Di(e,t={}){let n=await V(e,t.config),r=await ge(e);if(r)return{isMonorepo:!0,monorepo:await Ei(e,n,r)};let i=await X(e,n);return{isMonorepo:!1,single:$(i,Q(i),n.customRuleWarnings)}}function Oi(e){return`line`in e}function ki(e){return`entity`in e}function Ai(t){if(!t||t.trim()===``)throw new _(`Path must be a non-empty string. Received an empty path.`);let n=s(t);if(!e(n))throw new _(`Path does not exist: ${n}`);if(!r(n).isDirectory())throw new _(`Path must be a directory, not a file: ${n}`);return n}async function ji(e,t={}){let n=Ai(e),r=await V(n,t.config),i=await X(n,r),{result:a}=$(i,Q(i),r.customRuleWarnings);return a}async function Mi(e,t={}){let n=Ai(e),r=await V(n,t.config),i=await ge(n);if(!i){let e=await X(n,r),{result:t}=$(e,Q(e),r.customRuleWarnings);return{isMonorepo:!1,subProjects:[{name:`default`,result:t}],combined:t,elapsedMs:t.elapsedMs}}let{result:a}=await Ei(n,r,i);return a}export{ee as ConfigurationError,g as NestjsDoctorError,te as ScanError,_ as ValidationError,Di as autoScan,X as buildAnalysisContext,G as buildEndpointGraph,$ as buildResult,_i as checkAllFiles,gi as checkFile,vi as checkProject,yi as checkSchema,ji as diagnose,Mi as diagnoseMonorepo,Y as extractSchema,Vn as getRules,Oi as isCodeDiagnostic,ki as isSchemaDiagnostic,ii as prepareAnalysis,V as resolveScanConfig,yr as traceEndpointCalls,br as updateEndpointGraphForFile,ai as updateFile,Fe as updateModuleGraphForFile,cr as updateProvidersForFile};