project-athena 0.2.1 → 0.3.0

package/dist/chunk-PANVPNYF.js

@@ -0,0 +1,2892 @@
+#!/usr/bin/env node
+import {
+  IgnoreMatcher,
+  SOURCE_FILE,
+  TEST_FILE,
+  factsConfigHash,
+  mapLimit,
+  sniffBinary,
+  walkProject
+} from "./chunk-ELKFRTZT.js";
+import {
+  getOrCreateSalt,
+  keyedFingerprint,
+  readLocalConfig
+} from "./chunk-PVCIGUIT.js";
+import {
+  gitInfo
+} from "./chunk-OLPSEQS5.js";
+import {
+  ephemeralFingerprint,
+  isSecretLikeName,
+  redact,
+  scanText
+} from "./chunk-JCGDR4UV.js";
+import {
+  FactsCache,
+  athenaDir,
+  loadConfig,
+  readFileIndex
+} from "./chunk-2DY4PUR4.js";
+import {
+  readTextIfExists,
+  writeFileAtomic
+} from "./chunk-IQQBAWSM.js";
+import {
+  baseName,
+  dirOf
+} from "./chunk-XW3MLHI2.js";
+import {
+  ATHENA_DIR
+} from "./chunk-EUPETUWA.js";
+
+// src/core/analyzer/detectors/env.ts
+import { promises as fs } from "fs";
+import path from "path";
+var TEMPLATE_ENV = /(^|\/)\.env\.(example|sample|template|dist|defaults)$|(^|\/)(example|sample)\.env$/;
+var REAL_ENV_NAMES = [".env", ".env.local", ".env.development", ".env.production", ".env.test", ".env.development.local", ".env.production.local"];
+var CODE_REFS = [
+  [/\.(m|c)?(t|j)sx?$/, /\b(?:process\.env|import\.meta\.env)\.([A-Z][A-Z0-9_]{1,})|process\.env\[\s*["']([A-Z][A-Z0-9_]+)["']\s*\]/g],
+  [/\.py$/, /os\.(?:environ(?:\.get)?\s*[[(]\s*|getenv\s*\(\s*)["']([A-Z][A-Z0-9_]+)["']/g],
+  [/\.go$/, /os\.(?:Getenv|LookupEnv)\(\s*"([A-Z][A-Z0-9_]+)"/g],
+  [/\.rs$/, /env::var\(\s*"([A-Z][A-Z0-9_]+)"/g],
+  [/\.rb$/, /ENV\[\s*["']([A-Z][A-Z0-9_]+)["']\s*\]|ENV\.fetch\(\s*["']([A-Z][A-Z0-9_]+)["']/g],
+  [/\.php$/, /(?:getenv|env)\(\s*["']([A-Z][A-Z0-9_]+)["']/g],
+  [/\.(java|kt)$/, /System\.getenv\(\s*"([A-Z][A-Z0-9_]+)"/g],
+  [/\.cs$/, /GetEnvironmentVariable\(\s*"([A-Z][A-Z0-9_]+)"/g],
+  [/\.dart$/, /fromEnvironment\(\s*'([A-Z][A-Z0-9_]+)'/g]
+];
+var TEST_DIR = /(^|\/)(test|tests|__tests__|spec)\//;
+var templateKeysFact = {
+  id: "env-template-keys",
+  applies: (f) => TEMPLATE_ENV.test(f.path),
+  compute(text) {
+    if (!text) return [];
+    return [...text.matchAll(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/gm)].map((m) => m[1]);
+  }
+};
+var CODE_REF_FACTS = CODE_REFS.map(([fileRe, refRe], i) => ({
+  id: `env-code-refs${i}`,
+  applies: (f) => fileRe.test(f.path) && !f.large && !f.binary && !TEST_DIR.test(f.path),
+  compute(text) {
+    const out = [];
+    if (!text) return out;
+    refRe.lastIndex = 0;
+    for (const m of text.matchAll(refRe)) {
+      const name = m[1] ?? m[2];
+      if (name && name !== "NODE_ENV") out.push(name);
+    }
+    return out;
+  }
+}));
+var envDetector = {
+  id: "env",
+  version: 1,
+  facts: [templateKeysFact, ...CODE_REF_FACTS],
+  async run(ctx) {
+    const vars = /* @__PURE__ */ new Map();
+    const add = (name, ref) => {
+      if (!vars.has(name)) vars.set(name, /* @__PURE__ */ new Set());
+      vars.get(name).add(ref);
+    };
+    for (const f of ctx.find(TEMPLATE_ENV)) {
+      const keys2 = await ctx.fact(f.path, templateKeysFact);
+      if (!keys2) continue;
+      for (const k of keys2) add(k, f.path);
+    }
+    let scanned = 0;
+    for (const [i, [fileRe]] of CODE_REFS.entries()) {
+      for (const f of ctx.find(fileRe)) {
+        if (f.large || f.binary || TEST_DIR.test(f.path)) continue;
+        if (++scanned > 2e4) break;
+        const names = await ctx.fact(f.path, CODE_REF_FACTS[i]);
+        if (!names) continue;
+        for (const name of names) add(name, f.path);
+      }
+    }
+    const present = /* @__PURE__ */ new Set();
+    for (const f of ctx.find(/(^|\/)\.env(\.[a-z.]+)?$/)) if (!TEMPLATE_ENV.test(f.path)) present.add(f.path);
+    for (const name of REAL_ENV_NAMES) {
+      try {
+        const st = await fs.stat(path.join(ctx.root, name));
+        if (st.isFile()) present.add(name);
+      } catch {
+      }
+    }
+    ctx.model.env.vars = [...vars.entries()].map(([name, refs]) => ({ name, references: [...refs].sort().slice(0, 10), secretLike: isSecretLikeName(name) })).sort((a, b) => a.name.localeCompare(b.name));
+    ctx.model.env.envFilesPresent = [...present].sort();
+  }
+};
+
+// src/core/analyzer/analyze.ts
+import path5 from "path";
+import { promises as fs5 } from "fs";
+
+// src/core/model/project-model.ts
+import { z as z2 } from "zod";
+
+// src/core/model/fact.ts
+import { z } from "zod";
+var FactStatus = z.enum(["FACT", "DETECTED", "INFERRED", "UNKNOWN"]);
+var Confidence = z.enum(["high", "medium", "low"]);
+var FactSource = z.enum(["code", "config", "filesystem", "git", "developer", "ai"]);
+var Evidence = z.object({
+  /** Repo-relative POSIX path. */
+  file: z.string(),
+  line: z.number().int().positive().optional(),
+  detail: z.string().optional()
+});
+var Provenance = z.object({
+  status: FactStatus,
+  confidence: Confidence,
+  source: FactSource,
+  evidence: z.array(Evidence)
+});
+function detected(source, evidence, confidence = "high") {
+  return { status: "DETECTED", confidence, source, evidence };
+}
+function inferred(source, evidence, confidence = "medium") {
+  return { status: "INFERRED", confidence, source, evidence };
+}
+function fact(source, evidence) {
+  return { status: "FACT", confidence: "high", source, evidence };
+}
+
+// src/core/model/project-model.ts
+var Named = z2.object({ name: z2.string(), provenance: Provenance });
+var Language = z2.object({
+  name: z2.string(),
+  files: z2.number().int(),
+  bytes: z2.number().int()
+});
+var Framework = Named.extend({
+  category: z2.enum(["frontend", "backend", "fullstack", "mobile", "desktop", "orm", "testing", "other"]),
+  version: z2.string().optional(),
+  /** Workspace package root (repo-relative) this belongs to; "." for root. */
+  root: z2.string()
+});
+var Manifest = z2.object({
+  path: z2.string(),
+  ecosystem: z2.string(),
+  name: z2.string().optional(),
+  version: z2.string().optional(),
+  dependencies: z2.array(z2.string()),
+  devDependencies: z2.array(z2.string())
+});
+var WorkspacePackage = z2.object({
+  name: z2.string(),
+  path: z2.string(),
+  kind: z2.enum(["app", "package", "root", "unknown"]),
+  ecosystem: z2.string(),
+  /** Names of other workspace packages this one depends on. */
+  internalDependencies: z2.array(z2.string())
+});
+var Command = z2.object({
+  name: z2.string(),
+  command: z2.string(),
+  source: z2.string(),
+  purpose: z2.enum(["dev", "build", "test", "lint", "format", "start", "migrate", "deploy", "other"])
+});
+var Route = z2.object({
+  method: z2.string(),
+  path: z2.string(),
+  framework: z2.string(),
+  file: z2.string(),
+  line: z2.number().int().optional(),
+  provenance: Provenance
+});
+var DbEntity = z2.object({
+  name: z2.string(),
+  kind: z2.enum(["table", "model", "collection"]),
+  fields: z2.array(z2.object({ name: z2.string(), type: z2.string().optional(), attributes: z2.array(z2.string()) })),
+  indexes: z2.array(z2.string()),
+  relations: z2.array(z2.string()),
+  file: z2.string(),
+  provenance: Provenance
+});
+var Database = Named.extend({ kind: z2.enum(["engine", "orm", "driver", "service"]) });
+var EnvVar = z2.object({
+  name: z2.string(),
+  /** Where the name was seen. Values are NEVER recorded. */
+  references: z2.array(z2.string()),
+  secretLike: z2.boolean()
+});
+var SecretFinding = z2.object({
+  type: z2.string(),
+  file: z2.string(),
+  line: z2.number().int(),
+  /**
+   * Keyed fingerprint (HMAC with the machine-local salt in .athena/local.json, or a
+   * per-process key) — allows dedup without storing the secret. Never a plain hash
+   * of the value, and never written to committed files.
+   */
+  fingerprint: z2.string()
+});
+var CiJob = z2.object({ system: z2.string(), file: z2.string(), name: z2.string(), commands: z2.array(z2.string()) });
+var ContainerService = z2.object({
+  name: z2.string(),
+  image: z2.string().optional(),
+  ports: z2.array(z2.string()),
+  dependsOn: z2.array(z2.string()),
+  file: z2.string()
+});
+var TestInfo = z2.object({
+  frameworks: z2.array(Named),
+  testFileCount: z2.number().int(),
+  testDirs: z2.array(z2.string()),
+  coverageConfigs: z2.array(z2.string()),
+  /** Workspace packages that contain source files but zero detected test files (structural, not coverage). */
+  packagesWithoutTests: z2.array(z2.string())
+});
+var GitInfo = z2.object({
+  available: z2.boolean(),
+  isRepo: z2.boolean(),
+  branch: z2.string().optional(),
+  head: z2.string().optional(),
+  lastCommitDate: z2.string().optional(),
+  contributorCount: z2.number().int().optional(),
+  hotspots: z2.array(z2.object({ path: z2.string(), commits: z2.number().int() }))
+});
+var ProjectModel = z2.object({
+  schemaVersion: z2.literal(1),
+  name: z2.string(),
+  description: z2.string().optional(),
+  root: z2.string(),
+  stats: z2.object({
+    filesScanned: z2.number().int(),
+    skippedBinary: z2.number().int(),
+    skippedLarge: z2.number().int(),
+    skippedUnreadable: z2.number().int()
+  }),
+  topLevelDirs: z2.array(z2.string()),
+  languages: z2.array(Language),
+  manifests: z2.array(Manifest),
+  packageManagers: z2.array(Named),
+  buildSystems: z2.array(Named),
+  workspace: z2.object({
+    isMonorepo: z2.boolean(),
+    tool: z2.string().optional(),
+    packages: z2.array(WorkspacePackage)
+  }),
+  frameworks: z2.array(Framework),
+  entryPoints: z2.array(z2.object({ path: z2.string(), provenance: Provenance })),
+  commands: z2.array(Command),
+  databases: z2.array(Database),
+  dbEntities: z2.array(DbEntity),
+  migrations: z2.array(z2.object({ path: z2.string(), tool: z2.string(), count: z2.number().int() })),
+  routes: z2.array(Route),
+  apiSpecs: z2.array(z2.object({ path: z2.string(), kind: z2.enum(["openapi", "graphql", "grpc"]) })),
+  auth: z2.array(Named.extend({ kind: z2.enum(["library", "provider", "hashing", "middleware", "token"]) })),
+  containers: z2.object({ dockerfiles: z2.array(z2.object({ path: z2.string(), baseImages: z2.array(z2.string()), exposedPorts: z2.array(z2.string()) })), services: z2.array(ContainerService) }),
+  infrastructure: z2.array(Named.extend({ kind: z2.string(), file: z2.string() })),
+  ci: z2.array(CiJob),
+  tests: TestInfo,
+  env: z2.object({ vars: z2.array(EnvVar), envFilesPresent: z2.array(z2.string()) }),
+  security: z2.object({
+    secrets: z2.array(SecretFinding),
+    tooling: z2.array(Named),
+    /** Libraries/middleware relevant to web security controls (helmet, cors, csrf...). */
+    controls: z2.array(Named)
+  }),
+  caching: z2.array(Named),
+  queues: z2.array(Named),
+  observability: z2.array(Named),
+  git: GitInfo,
+  warnings: z2.array(z2.string())
+});
+function emptyModel(name, root) {
+  return {
+    schemaVersion: 1,
+    name,
+    root,
+    stats: { filesScanned: 0, skippedBinary: 0, skippedLarge: 0, skippedUnreadable: 0 },
+    topLevelDirs: [],
+    languages: [],
+    manifests: [],
+    packageManagers: [],
+    buildSystems: [],
+    workspace: { isMonorepo: false, packages: [] },
+    frameworks: [],
+    entryPoints: [],
+    commands: [],
+    databases: [],
+    dbEntities: [],
+    migrations: [],
+    routes: [],
+    apiSpecs: [],
+    auth: [],
+    containers: { dockerfiles: [], services: [] },
+    infrastructure: [],
+    ci: [],
+    tests: { frameworks: [], testFileCount: 0, testDirs: [], coverageConfigs: [], packagesWithoutTests: [] },
+    env: { vars: [], envFilesPresent: [] },
+    security: { secrets: [], tooling: [], controls: [] },
+    caching: [],
+    queues: [],
+    observability: [],
+    git: { available: false, isRepo: false, hotspots: [] },
+    warnings: []
+  };
+}
+
+// src/core/analyzer/context.ts
+function createContext(root, config, files, model, source, signal) {
+  const byPath = new Map(files.map((f) => [f.path, f]));
+  return {
+    root,
+    config,
+    files,
+    model,
+    signal,
+    runtime: source.runtime,
+    has: (rel) => byPath.has(rel),
+    read: (rel) => source.read(rel),
+    fact: (rel, def) => source.fact(rel, def),
+    find(match) {
+      if (match instanceof RegExp) return files.filter((f) => match.test(f.path));
+      return files.filter(match);
+    },
+    warn(message) {
+      model.warnings.push(message);
+    }
+  };
+}
+
+// src/core/analyzer/engine.ts
+import { promises as fs2 } from "fs";
+import path2 from "path";
+import crypto from "crypto";
+
+// src/core/cache/lru.ts
+var ByteLRU = class {
+  constructor(budget, weigh) {
+    this.budget = budget;
+    this.weigh = weigh;
+  }
+  budget;
+  weigh;
+  map = /* @__PURE__ */ new Map();
+  total = 0;
+  get size() {
+    return this.map.size;
+  }
+  get bytes() {
+    return this.total;
+  }
+  has(key) {
+    return this.map.has(key);
+  }
+  get(key) {
+    const e = this.map.get(key);
+    if (!e) return void 0;
+    this.map.delete(key);
+    this.map.set(key, e);
+    return e.v;
+  }
+  set(key, v) {
+    const w = Math.max(1, this.weigh(v));
+    const old = this.map.get(key);
+    if (old) {
+      this.total -= old.w;
+      this.map.delete(key);
+    }
+    if (w > this.budget) return;
+    this.map.set(key, { v, w });
+    this.total += w;
+    for (const [k, e] of this.map) {
+      if (this.total <= this.budget) break;
+      this.map.delete(k);
+      this.total -= e.w;
+    }
+  }
+  clear() {
+    this.map.clear();
+    this.total = 0;
+  }
+};
+var DEFAULT_TEXT_CACHE_BYTES = 64 * 1024 * 1024;
+
+// src/core/analyzer/engine.ts
+var ERR = "$err";
+var FactEngine = class {
+  constructor(opts) {
+    this.opts = opts;
+    this.byPath = new Map(opts.files.map((f) => [f.path, f]));
+    this.runtime = opts.runtime;
+    this.lru = new ByteLRU(opts.textCacheBytes ?? DEFAULT_TEXT_CACHE_BYTES, (s) => s.length * 2);
+    this.readFileFn = opts.readFile ?? ((abs) => fs2.readFile(abs));
+  }
+  opts;
+  byPath;
+  /** Files that could not be read in the content pass (dropped from the analysis). */
+  unreadable = /* @__PURE__ */ new Set();
+  stats = { filesRead: 0, rereads: 0, factsComputed: 0 };
+  hints = null;
+  runtime;
+  inflight = /* @__PURE__ */ new Map();
+  readPaths = /* @__PURE__ */ new Set();
+  lru;
+  readFileFn;
+  keyOf(def, rel) {
+    if (def.pathKeyed) return `${def.id}@${rel}`;
+    if (def.keyed) return `${def.id}:${this.runtime.fingerprintKeyId ?? "ephemeral"}`;
+    return def.id;
+  }
+  persistable(def) {
+    return !def.keyed || this.runtime.fingerprintKeyId !== null;
+  }
+  /** Facts computed for this file in the content pass, given the current hints. */
+  eagerDefs(f) {
+    return this.opts.defs.filter((d) => d.applies(f) && (!d.when || this.hints !== null && d.when(this.hints)));
+  }
+  /** True when the file must be read: unknown hash, or an applicable fact missing from the cache. */
+  needsProcessing(f) {
+    if (f.hash === "") return true;
+    if (f.binary || f.large) return false;
+    const entry = this.opts.cache.entry(f.hash);
+    for (const d of this.opts.defs) {
+      if (!d.applies(f) || d.when && (this.hints === null || !d.when(this.hints))) continue;
+      if (entry?.[this.keyOf(d, f.path)] === void 0 && !this.opts.cache.has(f.hash, this.keyOf(d, f.path))) return true;
+    }
+    return false;
+  }
+  async readBytes(rel) {
+    this.opts.signal?.throwIfAborted();
+    const buf = await this.readFileFn(path2.join(this.opts.root, rel));
+    this.stats.filesRead++;
+    if (this.readPaths.has(rel)) this.stats.rereads++;
+    else this.readPaths.add(rel);
+    return buf;
+  }
+  /** Content pass for one file: read once, hash, sniff, compute missing facts, drop the text. */
+  process(f, extra) {
+    let p = this.inflight.get(f.path);
+    if (!p) {
+      p = this.doProcess(f, extra);
+      this.inflight.set(f.path, p);
+    }
+    return p;
+  }
+  async doProcess(f, extra) {
+    let buf;
+    try {
+      buf = await this.readBytes(f.path);
+    } catch (err) {
+      if (this.opts.signal?.aborted) throw err;
+      if (f.hash === "") this.unreadable.add(f.path);
+      return;
+    }
+    f.hash = crypto.createHash("sha256").update(buf).digest("hex");
+    f.binary = sniffBinary(buf);
+    if (f.binary || f.large) return;
+    const text = buf.toString("utf8");
+    await this.opts.cache.preload([f.hash]);
+    const defs = this.eagerDefs(f);
+    if (extra && !defs.includes(extra)) defs.push(extra);
+    for (const def of defs) {
+      const key = this.keyOf(def, f.path);
+      if (!this.opts.cache.has(f.hash, key)) await this.computeAndStore(f, def, key, text);
+    }
+  }
+  async computeAndStore(f, def, key, text) {
+    let value;
+    try {
+      value = def.compute(text, f.path, this.runtime);
+    } catch (err) {
+      value = { [ERR]: err?.message ?? String(err) };
+    }
+    this.stats.factsComputed++;
+    await this.opts.cache.set(f.hash, key, value, { persist: this.persistable(def), replacePrefix: def.keyed ? `${def.id}:` : void 0 });
+  }
+  async read(rel) {
+    const cached = this.lru.get(rel);
+    if (cached !== void 0) return cached;
+    const entry = this.byPath.get(rel);
+    if (!entry || entry.binary || entry.large || this.unreadable.has(rel)) return null;
+    let text;
+    try {
+      text = (await this.readBytes(rel)).toString("utf8");
+    } catch (err) {
+      if (this.opts.signal?.aborted) throw err;
+      text = null;
+    }
+    if (text !== null) this.lru.set(rel, text);
+    return text;
+  }
+  async fact(rel, def) {
+    const f = this.byPath.get(rel);
+    if (!f) return null;
+    if (f.hash === "") await this.process(f);
+    if (f.binary || f.large || this.unreadable.has(rel)) return null;
+    const d = def;
+    const key = this.keyOf(d, rel);
+    let v = this.opts.cache.peek(f.hash, key);
+    if (v === void 0) v = await this.opts.cache.get(f.hash, key);
+    if (v === void 0 && !this.inflight.has(rel)) {
+      await this.process(f, d);
+      if (f.binary || f.large) return null;
+      v = await this.opts.cache.get(f.hash, key);
+    }
+    if (v === void 0) {
+      const text = await this.read(rel);
+      if (text === null) return null;
+      await this.computeAndStore(f, d, key, text);
+      v = await this.opts.cache.get(f.hash, key);
+    }
+    if (v && typeof v === "object" && !Array.isArray(v) && ERR in v) throw new Error(String(v[ERR]));
+    if (v === null || typeof v !== "object") return v;
+    if (Array.isArray(v) && v.length === 0) return [];
+    return structuredClone(v);
+  }
+};
+
+// src/core/analyzer/incremental.ts
+import { promises as fs3 } from "fs";
+import path3 from "path";
+var MAX_INCREMENTAL_PATHS = 2e3;
+function readExclude(root) {
+  return fs3.readFile(path3.join(root, ".git", "info", "exclude"), "utf8").catch(() => null);
+}
+function isIgnoredWithAncestors(matcher, rel, isDir2) {
+  for (let i = rel.indexOf("/"); i > 0; i = rel.indexOf("/", i + 1)) {
+    if (matcher.ignores(rel.slice(0, i), true)) return true;
+  }
+  return matcher.ignores(rel, isDir2);
+}
+async function incrementalWalk(root, config, configHash, input, signal) {
+  const { snapshot } = input;
+  if (!snapshot.reusable || snapshot.configHash !== configHash || snapshot.maxFiles !== config.maxFiles) return null;
+  const changed = [...new Set(input.changedPaths)];
+  if (changed.length > MAX_INCREMENTAL_PATHS) return null;
+  if (await readExclude(root) !== snapshot.excludeText) return null;
+  const byPath = new Map(snapshot.files.map((f) => [f.path, f]));
+  let dirPrefixes = null;
+  const isKnownDir = (rel) => {
+    if (!dirPrefixes) {
+      dirPrefixes = /* @__PURE__ */ new Set();
+      for (const f of snapshot.files) for (let i = f.path.indexOf("/"); i > 0; i = f.path.indexOf("/", i + 1)) dirPrefixes.add(f.path.slice(0, i));
+    }
+    return dirPrefixes.has(rel);
+  };
+  for (const rel of changed) {
+    signal?.throwIfAborted();
+    if (!rel || rel === "." || rel.startsWith("..") || path3.isAbsolute(rel) || rel.includes("\\")) return null;
+    const base = rel.slice(rel.lastIndexOf("/") + 1);
+    if (base === ".gitignore") return null;
+    let st;
+    try {
+      st = await fs3.lstat(path3.join(root, rel));
+    } catch (err) {
+      if (err.code !== "ENOENT" && err.code !== "ENOTDIR") return null;
+      if (byPath.delete(rel)) continue;
+      if (isKnownDir(rel)) return null;
+      continue;
+    }
+    if (st.isSymbolicLink()) return null;
+    if (st.isDirectory()) {
+      if (isIgnoredWithAncestors(snapshot.matcher, rel, true)) continue;
+      return null;
+    }
+    if (!st.isFile()) {
+      byPath.delete(rel);
+      continue;
+    }
+    if (isKnownDir(rel)) return null;
+    if (isIgnoredWithAncestors(snapshot.matcher, rel, false)) {
+      byPath.delete(rel);
+      continue;
+    }
+    const size = st.size;
+    const mtimeMs = Math.floor(st.mtimeMs);
+    byPath.set(
+      rel,
+      size > config.maxFileBytes ? { path: rel, size, mtimeMs, hash: `meta:${size}:${mtimeMs}`, binary: false, large: true } : { path: rel, size, mtimeMs, hash: "", binary: false, large: false }
+    );
+  }
+  if (byPath.size > config.maxFiles) return null;
+  const files = [...byPath.values()].map((f) => ({ ...f }));
+  files.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  return { files, skippedBinary: 0, skippedLarge: 0, skippedUnreadable: 0, truncated: false, warnings: [], symlinks: 0 };
+}
+
+// src/core/analyzer/detectors/structure.ts
+var EXT_LANG = {
+  ts: "TypeScript",
+  tsx: "TypeScript",
+  mts: "TypeScript",
+  cts: "TypeScript",
+  js: "JavaScript",
+  jsx: "JavaScript",
+  mjs: "JavaScript",
+  cjs: "JavaScript",
+  py: "Python",
+  go: "Go",
+  rs: "Rust",
+  java: "Java",
+  kt: "Kotlin",
+  kts: "Kotlin",
+  scala: "Scala",
+  swift: "Swift",
+  m: "Objective-C",
+  mm: "Objective-C",
+  c: "C",
+  h: "C/C++ header",
+  cc: "C++",
+  cpp: "C++",
+  cxx: "C++",
+  hpp: "C++",
+  cs: "C#",
+  fs: "F#",
+  vb: "Visual Basic",
+  php: "PHP",
+  rb: "Ruby",
+  dart: "Dart",
+  ex: "Elixir",
+  exs: "Elixir",
+  erl: "Erlang",
+  clj: "Clojure",
+  hs: "Haskell",
+  lua: "Lua",
+  r: "R",
+  jl: "Julia",
+  zig: "Zig",
+  sol: "Solidity",
+  vue: "Vue",
+  svelte: "Svelte",
+  astro: "Astro",
+  html: "HTML",
+  css: "CSS",
+  scss: "SCSS",
+  sass: "Sass",
+  less: "Less",
+  sql: "SQL",
+  sh: "Shell",
+  bash: "Shell",
+  zsh: "Shell",
+  ps1: "PowerShell",
+  tf: "Terraform",
+  hcl: "HCL",
+  proto: "Protocol Buffers",
+  graphql: "GraphQL",
+  gql: "GraphQL",
+  prisma: "Prisma"
+};
+var structureDetector = {
+  id: "structure",
+  version: 1,
+  async run(ctx) {
+    const langs = /* @__PURE__ */ new Map();
+    const top = /* @__PURE__ */ new Set();
+    for (const f of ctx.files) {
+      const slash = f.path.indexOf("/");
+      if (slash > 0) top.add(f.path.slice(0, slash));
+      if (f.binary) continue;
+      const dot = f.path.lastIndexOf(".");
+      if (dot === -1 || dot < f.path.lastIndexOf("/")) continue;
+      const lang = EXT_LANG[f.path.slice(dot + 1).toLowerCase()];
+      if (!lang) continue;
+      const cur = langs.get(lang) ?? { files: 0, bytes: 0 };
+      cur.files++;
+      cur.bytes += f.size;
+      langs.set(lang, cur);
+    }
+    ctx.model.languages = [...langs.entries()].map(([name, v]) => ({ name, ...v })).sort((a, b) => b.bytes - a.bytes || a.name.localeCompare(b.name));
+    ctx.model.topLevelDirs = [...top].sort();
+  }
+};
+
+// src/core/analyzer/detectors/manifests/shared.ts
+var isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var keys = (v) => isObj(v) ? Object.keys(v) : [];
+function commandPurpose(name, cmd) {
+  const n = name.toLowerCase();
+  if (/^(dev|develop|serve|watch)(:|$)/.test(n)) return "dev";
+  if (/^build(:|$)/.test(n)) return "build";
+  if (/^(test|e2e|spec|coverage)(:|$)/.test(n) || /\b(jest|vitest|pytest|playwright|cypress)\b/.test(cmd)) return "test";
+  if (/^lint(:|$)|typecheck|type-check/.test(n)) return "lint";
+  if (/^(format|fmt|prettier)(:|$)/.test(n)) return "format";
+  if (/^start(:|$)/.test(n)) return "start";
+  if (/migrat|db:/.test(n)) return "migrate";
+  if (/deploy|release|publish/.test(n)) return "deploy";
+  return "other";
+}
+
+// src/core/analyzer/detectors/manifests/npm.ts
+import { parse as parseYaml } from "yaml";
+function parseNpm(text, p, warn) {
+  if (!text) return null;
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    warn(`Could not parse ${p} (invalid JSON)`);
+    return null;
+  }
+  const scripts = isObj(json.scripts) ? json.scripts : {};
+  const commands = Object.entries(scripts).filter(([, v]) => typeof v === "string").map(([name, v]) => ({ name, command: v, source: p, purpose: commandPurpose(name, v) }));
+  let workspaceGlobs;
+  if (Array.isArray(json.workspaces)) workspaceGlobs = json.workspaces.filter((x) => typeof x === "string");
+  else if (isObj(json.workspaces) && Array.isArray(json.workspaces.packages)) workspaceGlobs = json.workspaces.packages.filter((x) => typeof x === "string");
+  return {
+    manifest: {
+      path: p,
+      ecosystem: "npm",
+      name: typeof json.name === "string" ? json.name : void 0,
+      version: typeof json.version === "string" ? json.version : void 0,
+      dependencies: [...keys(json.dependencies), ...keys(json.peerDependencies)],
+      devDependencies: keys(json.devDependencies)
+    },
+    workspaceGlobs,
+    workspaceTool: workspaceGlobs ? "npm/yarn workspaces" : void 0,
+    commands
+  };
+}
+function parsePnpmWorkspace(text) {
+  if (!text) return void 0;
+  try {
+    const y = parseYaml(text);
+    return Array.isArray(y.packages) ? y.packages.filter((x) => typeof x === "string") : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var rootPackageFact = {
+  id: "root-package",
+  applies: (f) => f.path === "package.json",
+  compute(text) {
+    const out = { pm: null, description: null, entries: [] };
+    if (!text) return out;
+    out.pm = /"packageManager"\s*:\s*"([a-z]+)@/.exec(text)?.[1] ?? null;
+    try {
+      const d = JSON.parse(text).description;
+      if (typeof d === "string" && d.trim()) out.description = d.trim();
+    } catch {
+    }
+    try {
+      const j = JSON.parse(text);
+      for (const field of ["main", "module"]) {
+        const v = j[field];
+        if (typeof v === "string") out.entries.push([v.replace(/^\.\//, ""), `"${field}" field`]);
+      }
+      if (isObj(j.bin)) {
+        for (const v of Object.values(j.bin)) if (typeof v === "string") out.entries.push([v.replace(/^\.\//, ""), '"bin" field']);
+      }
+    } catch {
+    }
+    return out;
+  }
+};
+var pnpmWorkspaceFact = {
+  id: "pnpm-workspace",
+  applies: (f) => f.path === "pnpm-workspace.yaml",
+  compute: (text) => parsePnpmWorkspace(text) ?? false
+};
+
+// src/core/analyzer/detectors/manifests/python.ts
+import { parse as parseToml } from "smol-toml";
+function pyReqName(spec) {
+  const m = /^\s*([A-Za-z0-9][A-Za-z0-9._-]*)/.exec(spec);
+  return m ? m[1].toLowerCase().replace(/_/g, "-") : null;
+}
+function parsePyproject(text, p, warn) {
+  if (!text) return null;
+  let t;
+  try {
+    t = parseToml(text);
+  } catch {
+    warn(`Could not parse ${p} (invalid TOML)`);
+    return null;
+  }
+  const project = isObj(t.project) ? t.project : {};
+  const tool = isObj(t.tool) ? t.tool : {};
+  const poetry = isObj(tool.poetry) ? tool.poetry : {};
+  const deps = /* @__PURE__ */ new Set();
+  const dev = /* @__PURE__ */ new Set();
+  for (const d of Array.isArray(project.dependencies) ? project.dependencies : []) {
+    const n = typeof d === "string" ? pyReqName(d) : null;
+    if (n) deps.add(n);
+  }
+  if (isObj(project["optional-dependencies"])) {
+    for (const group of Object.values(project["optional-dependencies"])) {
+      for (const d of Array.isArray(group) ? group : []) {
+        const n = typeof d === "string" ? pyReqName(d) : null;
+        if (n) dev.add(n);
+      }
+    }
+  }
+  if (isObj(t["dependency-groups"])) {
+    for (const group of Object.values(t["dependency-groups"])) {
+      for (const d of Array.isArray(group) ? group : []) {
+        const n = typeof d === "string" ? pyReqName(d) : null;
+        if (n) dev.add(n);
+      }
+    }
+  }
+  for (const k of keys(poetry.dependencies)) if (k.toLowerCase() !== "python") deps.add(k.toLowerCase());
+  for (const k of keys(poetry["dev-dependencies"])) dev.add(k.toLowerCase());
+  if (isObj(poetry.group)) {
+    for (const g of Object.values(poetry.group)) if (isObj(g)) for (const k of keys(g.dependencies)) dev.add(k.toLowerCase());
+  }
+  const commands = [];
+  const scripts = isObj(project.scripts) ? project.scripts : isObj(poetry.scripts) ? poetry.scripts : {};
+  for (const [name, v] of Object.entries(scripts)) if (typeof v === "string") commands.push({ name, command: v, source: p, purpose: commandPurpose(name, v) });
+  const uvWs = isObj(tool.uv) && isObj(tool.uv.workspace) && Array.isArray(tool.uv.workspace.members) ? tool.uv.workspace.members : void 0;
+  return {
+    manifest: {
+      path: p,
+      ecosystem: "python",
+      name: typeof project.name === "string" ? project.name : typeof poetry.name === "string" ? poetry.name : void 0,
+      version: typeof project.version === "string" ? project.version : void 0,
+      dependencies: [...deps],
+      devDependencies: [...dev]
+    },
+    workspaceGlobs: uvWs,
+    workspaceTool: uvWs ? "uv workspace" : void 0,
+    commands
+  };
+}
+function parseRequirements(text, p, warn) {
+  const deps = [];
+  for (const line of text.split(/\r?\n/)) {
+    const l = line.trim();
+    if (!l || l.startsWith("#") || l.startsWith("-")) continue;
+    const n = pyReqName(l);
+    if (n) deps.push(n);
+  }
+  const isDev = /dev|test|lint/i.test(baseName(p));
+  return { manifest: { path: p, ecosystem: "python", dependencies: isDev ? [] : deps, devDependencies: isDev ? deps : [] } };
+}
+function parsePipfile(text, p, warn) {
+  if (!text) return null;
+  try {
+    const t = parseToml(text);
+    return { manifest: { path: p, ecosystem: "python", dependencies: keys(t.packages).map((k) => k.toLowerCase()), devDependencies: keys(t["dev-packages"]).map((k) => k.toLowerCase()) } };
+  } catch {
+    warn(`Could not parse ${p}`);
+    return null;
+  }
+}
+
+// src/core/analyzer/detectors/manifests/go.ts
+function parseGoMod(text, p, warn) {
+  if (!text) return null;
+  const mod = /^module\s+(\S+)/m.exec(text)?.[1];
+  const deps = /* @__PURE__ */ new Set();
+  const block = /require\s*\(([\s\S]*?)\)/g;
+  for (const m of text.matchAll(block)) for (const line of m[1].split("\n")) {
+    const dep = /^\s*(\S+)\s+v/.exec(line)?.[1];
+    if (dep) deps.add(dep);
+  }
+  for (const m of text.matchAll(/^require\s+(\S+)\s+v/gm)) deps.add(m[1]);
+  return { manifest: { path: p, ecosystem: "go", name: mod, dependencies: [...deps], devDependencies: [] } };
+}
+function parseGoWork(text, p, warn) {
+  if (!text) return null;
+  const members = [];
+  for (const m of text.matchAll(/use\s*\(([\s\S]*?)\)/g)) for (const l of m[1].split("\n")) if (l.trim()) members.push(l.trim().replace(/^\.\//, ""));
+  for (const m of text.matchAll(/^use\s+(\S+)/gm)) if (m[1] !== "(") members.push(m[1].replace(/^\.\//, ""));
+  return { manifest: { path: p, ecosystem: "go", dependencies: [], devDependencies: [] }, workspaceGlobs: members, workspaceTool: "go workspace" };
+}
+
+// src/core/analyzer/detectors/manifests/cargo.ts
+import { parse as parseToml2 } from "smol-toml";
+function parseCargo(text, p, warn) {
+  if (!text) return null;
+  let t;
+  try {
+    t = parseToml2(text);
+  } catch {
+    warn(`Could not parse ${p} (invalid TOML)`);
+    return null;
+  }
+  const pkg = isObj(t.package) ? t.package : {};
+  const ws = isObj(t.workspace) && Array.isArray(t.workspace.members) ? t.workspace.members : void 0;
+  return {
+    manifest: {
+      path: p,
+      ecosystem: "cargo",
+      name: typeof pkg.name === "string" ? pkg.name : void 0,
+      version: typeof pkg.version === "string" ? pkg.version : void 0,
+      dependencies: keys(t.dependencies),
+      devDependencies: keys(t["dev-dependencies"])
+    },
+    workspaceGlobs: ws,
+    workspaceTool: ws ? "cargo workspace" : void 0
+  };
+}
+
+// src/core/analyzer/detectors/manifests/maven.ts
+function parsePom(text, p, warn) {
+  if (!text) return null;
+  const noParent = text.replace(/<parent>[\s\S]*?<\/parent>/, "").replace(/<dependencies>[\s\S]*<\/dependencies>/, "").replace(/<build>[\s\S]*<\/build>/, "");
+  const name = /<artifactId>([^<]+)<\/artifactId>/.exec(noParent)?.[1];
+  const deps = [];
+  const dev = [];
+  for (const m of text.matchAll(/<dependency>([\s\S]*?)<\/dependency>/g)) {
+    const a = /<artifactId>([^<]+)<\/artifactId>/.exec(m[1])?.[1];
+    if (!a) continue;
+    if (/<scope>\s*test\s*<\/scope>/.test(m[1])) dev.push(a);
+    else deps.push(a);
+  }
+  const modules = [...text.matchAll(/<module>([^<]+)<\/module>/g)].map((m) => m[1].trim());
+  return {
+    manifest: { path: p, ecosystem: "maven", name, dependencies: deps, devDependencies: dev },
+    workspaceGlobs: modules.length ? modules : void 0,
+    workspaceTool: modules.length ? "maven multi-module" : void 0
+  };
+}
+
+// src/core/analyzer/detectors/manifests/gradle.ts
+function parseGradle(text, p, warn) {
+  if (!text) return null;
+  const deps = [];
+  const dev = [];
+  for (const m of text.matchAll(/\b(implementation|api|compileOnly|runtimeOnly|testImplementation|testRuntimeOnly|kapt|ksp|annotationProcessor)\s*\(?\s*["']([^"':]+):([^"':]+)(?::[^"']*)?["']/g)) {
+    (m[1].startsWith("test") ? dev : deps).push(m[3]);
+  }
+  return { manifest: { path: p, ecosystem: "gradle", dependencies: deps, devDependencies: dev } };
+}
+function parseGradleSettings(text, p, warn) {
+  if (!text) return null;
+  const members = [];
+  for (const m of text.matchAll(/include\s*\(?([^)\n]+)\)?/g)) {
+    for (const s of m[1].matchAll(/["']:?([^"']+)["']/g)) members.push(s[1].replace(/:/g, "/"));
+  }
+  const name = /rootProject\.name\s*=\s*["']([^"']+)["']/.exec(text)?.[1];
+  return {
+    manifest: { path: p, ecosystem: "gradle", name, dependencies: [], devDependencies: [] },
+    workspaceGlobs: members.length ? members : void 0,
+    workspaceTool: members.length ? "gradle multi-project" : void 0
+  };
+}
+
+// src/core/analyzer/detectors/manifests/composer.ts
+function parseComposer(text, p, warn) {
+  if (!text) return null;
+  try {
+    const j = JSON.parse(text);
+    const scripts = isObj(j.scripts) ? j.scripts : {};
+    const commands = Object.entries(scripts).filter(([, v]) => typeof v === "string").map(([name, v]) => ({ name, command: v, source: p, purpose: commandPurpose(name, v) }));
+    return {
+      manifest: { path: p, ecosystem: "composer", name: typeof j.name === "string" ? j.name : void 0, dependencies: keys(j.require).filter((k) => k !== "php" && !k.startsWith("ext-")), devDependencies: keys(j["require-dev"]) },
+      commands
+    };
+  } catch {
+    warn(`Could not parse ${p} (invalid JSON)`);
+    return null;
+  }
+}
+
+// src/core/analyzer/detectors/manifests/dotnet.ts
+function parseCsproj(text, p, warn) {
+  if (!text) return null;
+  const deps = [...text.matchAll(/<PackageReference\s+Include=["']([^"']+)["']/g)].map((m) => m[1]);
+  if (/Sdk=["']Microsoft\.NET\.Sdk\.Web["']/.test(text)) deps.push("Microsoft.AspNetCore.App");
+  const isTest = /xunit|nunit|mstest/i.test(deps.join(" "));
+  return { manifest: { path: p, ecosystem: "nuget", name: baseName(p).replace(/\.(cs|fs|vb)proj$/, ""), dependencies: isTest ? [] : deps, devDependencies: isTest ? deps : [] } };
+}
+
+// src/core/analyzer/detectors/manifests/ruby.ts
+function parseGemfile(text, p, warn) {
+  if (!text) return null;
+  const deps = [];
+  const dev = [];
+  let inDevGroup = false;
+  for (const line of text.split(/\r?\n/)) {
+    if (/^\s*group\s+.*:(development|test)/.test(line)) inDevGroup = true;
+    else if (/^\s*end\b/.test(line)) inDevGroup = false;
+    const m = /^\s*gem\s+["']([^"']+)["']/.exec(line);
+    if (m) (inDevGroup ? dev : deps).push(m[1]);
+  }
+  return { manifest: { path: p, ecosystem: "rubygems", dependencies: deps, devDependencies: dev } };
+}
+
+// src/core/analyzer/detectors/manifests/dart.ts
+import { parse as parseYaml2 } from "yaml";
+function parsePubspec(text, p, warn) {
+  if (!text) return null;
+  try {
+    const y = parseYaml2(text);
+    return { manifest: { path: p, ecosystem: "pub", name: typeof y.name === "string" ? y.name : void 0, dependencies: keys(y.dependencies), devDependencies: keys(y.dev_dependencies) } };
+  } catch {
+    warn(`Could not parse ${p} (invalid YAML)`);
+    return null;
+  }
+}
+
+// src/core/analyzer/detectors/manifests/elixir.ts
+function parseMix(text, p, warn) {
+  if (!text) return null;
+  const deps = [...text.matchAll(/\{\s*:([a-z0-9_]+)\s*,/g)].map((m) => m[1]);
+  const name = /app:\s*:([a-z0-9_]+)/.exec(text)?.[1];
+  return { manifest: { path: p, ecosystem: "hex", name, dependencies: deps, devDependencies: [] } };
+}
+
+// src/core/analyzer/detectors/manifests/tooling.ts
+var MAKE_RE = /(^|\/)(Makefile|makefile|justfile)$/;
+var makeTargetsFact = {
+  id: "make-targets",
+  applies: (f) => MAKE_RE.test(f.path) && f.path.split("/").length <= 3,
+  compute(text) {
+    const out = [];
+    if (!text) return out;
+    for (const m of text.matchAll(/^([A-Za-z0-9][A-Za-z0-9_.-]*)\s*:(?!=)/gm)) {
+      const name = m[1];
+      if (name === "PHONY" || name.startsWith(".")) continue;
+      out.push(name);
+    }
+    return out;
+  }
+};
+var LOCKFILES = [
+  [/(^|\/)package-lock\.json$/, "npm"],
+  [/(^|\/)npm-shrinkwrap\.json$/, "npm"],
+  [/(^|\/)yarn\.lock$/, "yarn"],
+  [/(^|\/)pnpm-lock\.yaml$/, "pnpm"],
+  [/(^|\/)bun\.lockb?$/, "bun"],
+  [/(^|\/)poetry\.lock$/, "poetry"],
+  [/(^|\/)uv\.lock$/, "uv"],
+  [/(^|\/)Pipfile\.lock$/, "pipenv"],
+  [/(^|\/)pdm\.lock$/, "pdm"],
+  [/(^|\/)go\.sum$/, "go modules"],
+  [/(^|\/)Cargo\.lock$/, "cargo"],
+  [/(^|\/)composer\.lock$/, "composer"],
+  [/(^|\/)Gemfile\.lock$/, "bundler"],
+  [/(^|\/)pubspec\.lock$/, "pub"],
+  [/(^|\/)mix\.lock$/, "mix"],
+  [/(^|\/)packages\.lock\.json$/, "nuget"]
+];
+var BUILD_SYSTEMS = [
+  [/(^|\/)turbo\.json$/, "Turborepo"],
+  [/(^|\/)nx\.json$/, "Nx"],
+  [/(^|\/)lerna\.json$/, "Lerna"],
+  [/(^|\/)(vite|vitest)\.config\.(js|ts|mjs|cjs)$/, "Vite"],
+  [/(^|\/)webpack\.config\.(js|ts|cjs|mjs)$/, "webpack"],
+  [/(^|\/)rollup\.config\.(js|ts|mjs)$/, "Rollup"],
+  [/(^|\/)tsup\.config\.(js|ts)$/, "tsup"],
+  [/(^|\/)tsconfig\.json$/, "TypeScript compiler"],
+  [/(^|\/)(Makefile|makefile|GNUmakefile)$/, "Make"],
+  [/(^|\/)justfile$/i, "just"],
+  [/(^|\/)Taskfile\.ya?ml$/, "Task"],
+  [/(^|\/)CMakeLists\.txt$/, "CMake"],
+  [/(^|\/)BUILD(\.bazel)?$|(^|\/)WORKSPACE(\.bazel)?$|(^|\/)MODULE\.bazel$/, "Bazel"],
+  [/(^|\/)build\.gradle(\.kts)?$/, "Gradle"],
+  [/(^|\/)pom\.xml$/, "Maven"],
+  [/\.sln$/, ".NET solution"]
+];
+
+// src/core/analyzer/detectors/manifests/workspace.ts
+import ignoreFactory from "ignore";
+async function detectWorkspace(ctx, parsed) {
+  const { model } = ctx;
+  const globs = [];
+  let tool;
+  for (const p of parsed) {
+    if (p.workspaceGlobs?.length && dirOf(p.manifest.path) === ".") {
+      globs.push(...p.workspaceGlobs);
+      tool ??= p.workspaceTool;
+    }
+  }
+  if (ctx.has("pnpm-workspace.yaml")) {
+    const g = await ctx.fact("pnpm-workspace.yaml", pnpmWorkspaceFact) || void 0;
+    if (g?.length) {
+      globs.push(...g);
+      tool = "pnpm workspaces";
+    }
+  }
+  const markerTool = ctx.has("turbo.json") ? "Turborepo" : ctx.has("nx.json") ? "Nx" : ctx.has("lerna.json") ? "Lerna" : void 0;
+  if (markerTool) tool = tool ? `${tool} + ${markerTool}` : markerTool;
+  const manifestDirs = /* @__PURE__ */ new Map();
+  for (const m of model.manifests) {
+    const d = dirOf(m.path);
+    manifestDirs.set(d, [...manifestDirs.get(d) ?? [], m]);
+  }
+  const matcher = globs.length ? ignoreFactory().add(globs.map((g) => g.replace(/^\.\//, "").replace(/\/$/, ""))) : null;
+  const pkgDirs = [...manifestDirs.keys()].filter((d) => d !== "." && (matcher ? matcher.ignores(d) : true));
+  const isMonorepo = globs.length > 0 || !!markerTool || pkgDirs.length >= 2 && !manifestDirs.has(".");
+  model.workspace.isMonorepo = isMonorepo;
+  model.workspace.tool = tool;
+  const packages = [];
+  const dirsForPackages = isMonorepo ? [".", ...pkgDirs] : manifestDirs.has(".") ? ["."] : pkgDirs;
+  for (const d of dirsForPackages) {
+    const ms = manifestDirs.get(d);
+    if (!ms) continue;
+    const primary = ms.find((m) => m.name) ?? ms[0];
+    const seg = d.split("/")[0] ?? "";
+    const kind = d === "." ? "root" : /^(apps|services|examples)$/.test(seg) ? "app" : /^(packages|libs|crates|modules|shared|internal)$/.test(seg) ? "package" : "unknown";
+    packages.push({ name: primary.name ?? (d === "." ? model.name : baseName(d)), path: d, kind, ecosystem: primary.ecosystem, internalDependencies: [] });
+  }
+  const names = new Set(packages.map((p) => p.name));
+  for (const pkg of packages) {
+    const deps = (manifestDirs.get(pkg.path) ?? []).flatMap((m) => [...m.dependencies, ...m.devDependencies]);
+    pkg.internalDependencies = [...new Set(deps.filter((d) => names.has(d) && d !== pkg.name))].sort();
+  }
+  model.workspace.packages = packages;
+}
+
+// src/core/analyzer/detectors/manifests/index.ts
+var PARSERS = [
+  [/(^|\/)package\.json$/, parseNpm],
+  [/(^|\/)pyproject\.toml$/, parsePyproject],
+  [/(^|\/)requirements[^/]*\.txt$/, parseRequirements],
+  [/(^|\/)Pipfile$/, parsePipfile],
+  [/(^|\/)go\.mod$/, parseGoMod],
+  [/(^|\/)go\.work$/, parseGoWork],
+  [/(^|\/)Cargo\.toml$/, parseCargo],
+  [/(^|\/)pom\.xml$/, parsePom],
+  [/(^|\/)build\.gradle(\.kts)?$/, parseGradle],
+  [/(^|\/)settings\.gradle(\.kts)?$/, parseGradleSettings],
+  [/(^|\/)composer\.json$/, parseComposer],
+  [/\.(cs|fs|vb)proj$/, parseCsproj],
+  [/(^|\/)Gemfile$/, parseGemfile],
+  [/(^|\/)pubspec\.yaml$/, parsePubspec],
+  [/(^|\/)mix\.exs$/, parseMix]
+];
+var MANIFEST_FACTS = PARSERS.map(([re, parser], i) => ({
+  id: `manifest${i}`,
+  pathKeyed: true,
+  applies: (f) => re.test(f.path),
+  compute(text, rel) {
+    const w = [];
+    const r = parser(text, rel, (m) => w.push(m));
+    return { r, w };
+  }
+}));
+async function manifestDependencyNames(p, text) {
+  const parser = PARSERS.find(([re]) => re.test(p))?.[1];
+  if (!parser) return null;
+  if (!text.trim()) return /* @__PURE__ */ new Set();
+  let failed = false;
+  const r = parser(text, p, () => failed = true);
+  if (!r || failed) return null;
+  return /* @__PURE__ */ new Set([...r.manifest.dependencies, ...r.manifest.devDependencies]);
+}
+var manifestsDetector = {
+  id: "manifests",
+  version: 1,
+  facts: [...MANIFEST_FACTS, makeTargetsFact, rootPackageFact, pnpmWorkspaceFact],
+  async run(ctx) {
+    const { model } = ctx;
+    const parsed = [];
+    for (const [i, [re]] of PARSERS.entries()) {
+      for (const f of ctx.find(re)) {
+        ctx.signal?.throwIfAborted();
+        const v = await ctx.fact(f.path, MANIFEST_FACTS[i]);
+        if (!v) continue;
+        for (const w of v.w) ctx.warn(w);
+        if (v.r) parsed.push(v.r);
+      }
+    }
+    parsed.sort((a, b) => a.manifest.path.localeCompare(b.manifest.path));
+    model.manifests = parsed.map((p) => p.manifest);
+    model.commands.push(...parsed.flatMap((p) => p.commands ?? []));
+    for (const f of ctx.find(MAKE_RE)) {
+      if (f.path.split("/").length > 3) continue;
+      const names = await ctx.fact(f.path, makeTargetsFact);
+      if (!names) continue;
+      const isJust = baseName(f.path) === "justfile";
+      for (const name of names) model.commands.push({ name, command: isJust ? `just ${name}` : `make ${name}`, source: f.path, purpose: commandPurpose(name, "") });
+    }
+    const pm = /* @__PURE__ */ new Map();
+    for (const [re, name] of LOCKFILES) for (const f of ctx.find(re)) pm.set(name, [...pm.get(name) ?? [], f.path]);
+    for (const m of parsed) {
+      const eco = m.manifest.ecosystem;
+      const implied = eco === "python" && baseName(m.manifest.path).startsWith("requirements") ? "pip" : eco === "maven" ? "maven" : eco === "gradle" ? "gradle" : eco === "nuget" ? "dotnet" : null;
+      if (implied && !pm.has(implied)) pm.set(implied, [m.manifest.path]);
+    }
+    const rootPkg = parsed.find((p) => p.manifest.path === "package.json");
+    const rootMeta = rootPkg ? await ctx.fact("package.json", rootPackageFact) : null;
+    if (rootMeta) {
+      const declared = rootMeta.pm;
+      if (declared && !pm.has(declared)) pm.set(declared, ["package.json"]);
+    }
+    model.packageManagers = [...pm.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([name, files]) => ({
+      name,
+      provenance: detected("filesystem", files.slice(0, 5).map((file) => ({ file })))
+    }));
+    const bs = /* @__PURE__ */ new Map();
+    for (const [re, name] of BUILD_SYSTEMS) for (const f of ctx.find(re)) bs.set(name, [...bs.get(name) ?? [], f.path]);
+    model.buildSystems = [...bs.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([name, files]) => ({
+      name,
+      provenance: detected("filesystem", files.slice(0, 5).map((file) => ({ file })))
+    }));
+    await detectWorkspace(ctx, parsed);
+    const rootManifest = model.manifests.find((m) => dirOf(m.path) === "." && m.name);
+    if (rootManifest?.name) model.name = rootManifest.name;
+    if (rootMeta) {
+      if (rootMeta.description) model.description = rootMeta.description;
+      for (const [p, detail] of rootMeta.entries) model.entryPoints.push({ path: p, provenance: fact("config", [{ file: "package.json", detail }]) });
+    }
+  }
+};
+
+// src/core/analyzer/catalog.ts
+var fw = (category) => ({ type: "framework", category });
+var db = (kind) => ({ type: "database", kind });
+var auth = (kind) => ({ type: "auth", kind });
+var CACHE = { type: "cache" };
+var QUEUE = { type: "queue" };
+var OBS = { type: "observability" };
+var SEC = { type: "securityControl" };
+var SECTOOL = { type: "securityTooling" };
+var TEST = { type: "testing" };
+var CATALOG = {
+  npm: {
+    next: { name: "Next.js", kind: fw("fullstack"), markers: [/(^|\/)next\.config\.(js|mjs|cjs|ts)$/] },
+    react: { name: "React", kind: fw("frontend") },
+    vue: { name: "Vue", kind: fw("frontend") },
+    nuxt: { name: "Nuxt", kind: fw("fullstack"), markers: [/(^|\/)nuxt\.config\.(js|ts|mjs)$/] },
+    "@angular/core": { name: "Angular", kind: fw("frontend"), markers: [/(^|\/)angular\.json$/] },
+    svelte: { name: "Svelte", kind: fw("frontend") },
+    "@sveltejs/kit": { name: "SvelteKit", kind: fw("fullstack"), markers: [/(^|\/)svelte\.config\.(js|ts)$/] },
+    "solid-js": { name: "SolidJS", kind: fw("frontend") },
+    astro: { name: "Astro", kind: fw("fullstack"), markers: [/(^|\/)astro\.config\.(mjs|ts|js)$/] },
+    "@remix-run/react": { name: "Remix", kind: fw("fullstack") },
+    "@tanstack/react-start": { name: "TanStack Start", kind: fw("fullstack") },
+    "@tanstack/solid-start": { name: "TanStack Start", kind: fw("fullstack") },
+    "@tanstack/react-router": { name: "TanStack Router", kind: fw("frontend") },
+    "@tanstack/react-query": { name: "TanStack Query", kind: fw("frontend") },
+    "@vercel/node": { name: "Vercel Functions (Node)", kind: fw("backend") },
+    "react-router": { name: "React Router", kind: fw("frontend") },
+    vite: { name: "Vite", kind: fw("other"), markers: [/(^|\/)vite\.config\.(js|ts|mjs)$/] },
+    "react-native": { name: "React Native", kind: fw("mobile") },
+    expo: { name: "Expo", kind: fw("mobile"), markers: [/(^|\/)app\.json$/] },
+    electron: { name: "Electron", kind: fw("desktop") },
+    "@tauri-apps/api": { name: "Tauri", kind: fw("desktop") },
+    express: { name: "Express", kind: fw("backend") },
+    fastify: { name: "Fastify", kind: fw("backend") },
+    koa: { name: "Koa", kind: fw("backend") },
+    hono: { name: "Hono", kind: fw("backend") },
+    "@nestjs/core": { name: "NestJS", kind: fw("backend"), markers: [/(^|\/)nest-cli\.json$/] },
+    "@trpc/server": { name: "tRPC", kind: fw("backend") },
+    "@apollo/server": { name: "Apollo Server", kind: fw("backend") },
+    "apollo-server": { name: "Apollo Server", kind: fw("backend") },
+    graphql: { name: "GraphQL", kind: fw("other") },
+    tailwindcss: { name: "Tailwind CSS", kind: fw("frontend") },
+    prisma: { name: "Prisma", kind: db("orm"), markers: [/(^|\/)schema\.prisma$/] },
+    "@prisma/client": { name: "Prisma", kind: db("orm"), markers: [/(^|\/)schema\.prisma$/] },
+    "drizzle-orm": { name: "Drizzle ORM", kind: db("orm"), markers: [/(^|\/)drizzle\.config\.(ts|js)$/] },
+    typeorm: { name: "TypeORM", kind: db("orm") },
+    sequelize: { name: "Sequelize", kind: db("orm") },
+    mongoose: { name: "Mongoose", kind: db("orm") },
+    knex: { name: "Knex", kind: db("orm") },
+    kysely: { name: "Kysely", kind: db("orm") },
+    "@mikro-orm/core": { name: "MikroORM", kind: db("orm") },
+    pg: { name: "PostgreSQL (pg driver)", kind: db("driver") },
+    postgres: { name: "PostgreSQL (postgres.js driver)", kind: db("driver") },
+    mysql: { name: "MySQL driver", kind: db("driver") },
+    mysql2: { name: "MySQL driver", kind: db("driver") },
+    "better-sqlite3": { name: "SQLite (better-sqlite3)", kind: db("driver") },
+    sqlite3: { name: "SQLite driver", kind: db("driver") },
+    mongodb: { name: "MongoDB driver", kind: db("driver") },
+    "@supabase/supabase-js": { name: "Supabase", kind: db("driver") },
+    firebase: { name: "Firebase", kind: db("driver") },
+    "firebase-admin": { name: "Firebase Admin", kind: db("driver") },
+    "@planetscale/database": { name: "PlanetScale driver", kind: db("driver") },
+    "@neondatabase/serverless": { name: "Neon serverless driver", kind: db("driver") },
+    "next-auth": { name: "NextAuth.js / Auth.js", kind: auth("library") },
+    "@auth/core": { name: "Auth.js", kind: auth("library") },
+    "better-auth": { name: "Better Auth", kind: auth("library") },
+    passport: { name: "Passport", kind: auth("library") },
+    lucia: { name: "Lucia", kind: auth("library") },
+    "@clerk/nextjs": { name: "Clerk", kind: auth("provider") },
+    "@clerk/clerk-react": { name: "Clerk", kind: auth("provider") },
+    "@auth0/nextjs-auth0": { name: "Auth0", kind: auth("provider") },
+    "auth0": { name: "Auth0", kind: auth("provider") },
+    "@supabase/auth-helpers-nextjs": { name: "Supabase Auth", kind: auth("provider") },
+    "@supabase/ssr": { name: "Supabase SSR Auth", kind: auth("provider") },
+    "firebase-auth": { name: "Firebase Auth", kind: auth("provider") },
+    jsonwebtoken: { name: "jsonwebtoken (JWT)", kind: auth("token") },
+    jose: { name: "jose (JWT/JWE)", kind: auth("token") },
+    "express-session": { name: "express-session", kind: auth("library") },
+    "iron-session": { name: "iron-session", kind: auth("library") },
+    bcrypt: { name: "bcrypt", kind: auth("hashing") },
+    bcryptjs: { name: "bcryptjs", kind: auth("hashing") },
+    argon2: { name: "argon2", kind: auth("hashing") },
+    "@node-rs/argon2": { name: "argon2", kind: auth("hashing") },
+    ioredis: { name: "Redis (ioredis)", kind: CACHE },
+    redis: { name: "Redis client", kind: CACHE },
+    "@upstash/redis": { name: "Upstash Redis", kind: CACHE },
+    "lru-cache": { name: "lru-cache", kind: CACHE },
+    "node-cache": { name: "node-cache", kind: CACHE },
+    bullmq: { name: "BullMQ", kind: QUEUE },
+    bull: { name: "Bull", kind: QUEUE },
+    "bee-queue": { name: "Bee-Queue", kind: QUEUE },
+    amqplib: { name: "RabbitMQ (amqplib)", kind: QUEUE },
+    kafkajs: { name: "Kafka (kafkajs)", kind: QUEUE },
+    "@aws-sdk/client-sqs": { name: "AWS SQS", kind: QUEUE },
+    inngest: { name: "Inngest", kind: QUEUE },
+    "@trigger.dev/sdk": { name: "Trigger.dev", kind: QUEUE },
+    "@sentry/node": { name: "Sentry", kind: OBS },
+    "@sentry/nextjs": { name: "Sentry", kind: OBS },
+    "@sentry/react": { name: "Sentry", kind: OBS },
+    pino: { name: "Pino logger", kind: OBS },
+    winston: { name: "Winston logger", kind: OBS },
+    "@opentelemetry/api": { name: "OpenTelemetry", kind: OBS },
+    "dd-trace": { name: "Datadog APM", kind: OBS },
+    helmet: { name: "helmet", kind: SEC },
+    cors: { name: "cors", kind: SEC },
+    "@fastify/cors": { name: "@fastify/cors", kind: SEC },
+    "@fastify/helmet": { name: "@fastify/helmet", kind: SEC },
+    csurf: { name: "csurf (deprecated)", kind: SEC },
+    "csrf-csrf": { name: "csrf-csrf", kind: SEC },
+    "express-rate-limit": { name: "express-rate-limit", kind: SEC },
+    "@fastify/rate-limit": { name: "@fastify/rate-limit", kind: SEC },
+    zod: { name: "zod (schema validation)", kind: SEC },
+    joi: { name: "joi (schema validation)", kind: SEC },
+    yup: { name: "yup (schema validation)", kind: SEC },
+    "class-validator": { name: "class-validator", kind: SEC },
+    dompurify: { name: "DOMPurify", kind: SEC },
+    "isomorphic-dompurify": { name: "DOMPurify", kind: SEC },
+    eslint: { name: "ESLint", kind: SECTOOL },
+    "eslint-plugin-security": { name: "eslint-plugin-security", kind: SECTOOL },
+    snyk: { name: "Snyk", kind: SECTOOL },
+    jest: { name: "Jest", kind: TEST },
+    vitest: { name: "Vitest", kind: TEST },
+    mocha: { name: "Mocha", kind: TEST },
+    ava: { name: "AVA", kind: TEST },
+    "@playwright/test": { name: "Playwright", kind: TEST },
+    cypress: { name: "Cypress", kind: TEST },
+    "@testing-library/react": { name: "Testing Library", kind: TEST },
+    supertest: { name: "Supertest", kind: TEST },
+    detox: { name: "Detox", kind: TEST }
+  },
+  python: {
+    django: { name: "Django", kind: fw("fullstack"), markers: [/(^|\/)manage\.py$/] },
+    djangorestframework: { name: "Django REST Framework", kind: fw("backend") },
+    fastapi: { name: "FastAPI", kind: fw("backend") },
+    flask: { name: "Flask", kind: fw("backend") },
+    starlette: { name: "Starlette", kind: fw("backend") },
+    litestar: { name: "Litestar", kind: fw("backend") },
+    tornado: { name: "Tornado", kind: fw("backend") },
+    aiohttp: { name: "aiohttp", kind: fw("backend") },
+    streamlit: { name: "Streamlit", kind: fw("frontend") },
+    pydantic: { name: "Pydantic (validation)", kind: SEC },
+    sqlalchemy: { name: "SQLAlchemy", kind: db("orm") },
+    sqlmodel: { name: "SQLModel", kind: db("orm") },
+    "tortoise-orm": { name: "Tortoise ORM", kind: db("orm") },
+    peewee: { name: "Peewee", kind: db("orm") },
+    alembic: { name: "Alembic migrations", kind: db("orm") },
+    "psycopg2": { name: "PostgreSQL (psycopg2)", kind: db("driver") },
+    "psycopg2-binary": { name: "PostgreSQL (psycopg2)", kind: db("driver") },
+    psycopg: { name: "PostgreSQL (psycopg 3)", kind: db("driver") },
+    asyncpg: { name: "PostgreSQL (asyncpg)", kind: db("driver") },
+    pymysql: { name: "MySQL (PyMySQL)", kind: db("driver") },
+    mysqlclient: { name: "MySQL (mysqlclient)", kind: db("driver") },
+    pymongo: { name: "MongoDB (pymongo)", kind: db("driver") },
+    motor: { name: "MongoDB (motor)", kind: db("driver") },
+    "django-allauth": { name: "django-allauth", kind: auth("library") },
+    "djangorestframework-simplejwt": { name: "Simple JWT (DRF)", kind: auth("token") },
+    pyjwt: { name: "PyJWT", kind: auth("token") },
+    "python-jose": { name: "python-jose", kind: auth("token") },
+    authlib: { name: "Authlib", kind: auth("library") },
+    "flask-login": { name: "Flask-Login", kind: auth("library") },
+    "fastapi-users": { name: "FastAPI Users", kind: auth("library") },
+    passlib: { name: "passlib", kind: auth("hashing") },
+    bcrypt: { name: "bcrypt", kind: auth("hashing") },
+    "argon2-cffi": { name: "argon2-cffi", kind: auth("hashing") },
+    redis: { name: "Redis client", kind: CACHE },
+    "django-redis": { name: "django-redis", kind: CACHE },
+    celery: { name: "Celery", kind: QUEUE },
+    rq: { name: "RQ", kind: QUEUE },
+    dramatiq: { name: "Dramatiq", kind: QUEUE },
+    "sentry-sdk": { name: "Sentry", kind: OBS },
+    structlog: { name: "structlog", kind: OBS },
+    "opentelemetry-api": { name: "OpenTelemetry", kind: OBS },
+    "django-cors-headers": { name: "django-cors-headers", kind: SEC },
+    bandit: { name: "Bandit", kind: SECTOOL },
+    "pip-audit": { name: "pip-audit", kind: SECTOOL },
+    safety: { name: "Safety", kind: SECTOOL },
+    ruff: { name: "Ruff", kind: SECTOOL },
+    pytest: { name: "pytest", kind: TEST },
+    "pytest-django": { name: "pytest-django", kind: TEST },
+    hypothesis: { name: "Hypothesis", kind: TEST },
+    playwright: { name: "Playwright", kind: TEST }
+  },
+  go: {
+    "github.com/gin-gonic/gin": { name: "Gin", kind: fw("backend") },
+    "github.com/labstack/echo/v4": { name: "Echo", kind: fw("backend") },
+    "github.com/gofiber/fiber/v2": { name: "Fiber", kind: fw("backend") },
+    "github.com/gofiber/fiber/v3": { name: "Fiber", kind: fw("backend") },
+    "github.com/go-chi/chi/v5": { name: "chi", kind: fw("backend") },
+    "github.com/gorilla/mux": { name: "gorilla/mux", kind: fw("backend") },
+    "google.golang.org/grpc": { name: "gRPC", kind: fw("backend") },
+    "gorm.io/gorm": { name: "GORM", kind: db("orm") },
+    "entgo.io/ent": { name: "ent", kind: db("orm") },
+    "github.com/jmoiron/sqlx": { name: "sqlx", kind: db("driver") },
+    "github.com/jackc/pgx/v5": { name: "PostgreSQL (pgx)", kind: db("driver") },
+    "github.com/lib/pq": { name: "PostgreSQL (lib/pq)", kind: db("driver") },
+    "github.com/go-sql-driver/mysql": { name: "MySQL driver", kind: db("driver") },
+    "go.mongodb.org/mongo-driver": { name: "MongoDB driver", kind: db("driver") },
+    "github.com/golang-migrate/migrate/v4": { name: "golang-migrate", kind: db("orm") },
+    "github.com/golang-jwt/jwt/v5": { name: "golang-jwt", kind: auth("token") },
+    "golang.org/x/crypto": { name: "x/crypto (may include bcrypt/argon2)", kind: auth("hashing") },
+    "golang.org/x/oauth2": { name: "x/oauth2", kind: auth("library") },
+    "github.com/redis/go-redis/v9": { name: "Redis (go-redis)", kind: CACHE },
+    "github.com/hibiken/asynq": { name: "Asynq", kind: QUEUE },
+    "github.com/segmentio/kafka-go": { name: "Kafka (kafka-go)", kind: QUEUE },
+    "go.uber.org/zap": { name: "zap logger", kind: OBS },
+    "github.com/rs/zerolog": { name: "zerolog", kind: OBS },
+    "github.com/getsentry/sentry-go": { name: "Sentry", kind: OBS },
+    "github.com/stretchr/testify": { name: "testify", kind: TEST }
+  },
+  cargo: {
+    axum: { name: "Axum", kind: fw("backend") },
+    "actix-web": { name: "Actix Web", kind: fw("backend") },
+    rocket: { name: "Rocket", kind: fw("backend") },
+    warp: { name: "warp", kind: fw("backend") },
+    tonic: { name: "tonic (gRPC)", kind: fw("backend") },
+    leptos: { name: "Leptos", kind: fw("fullstack") },
+    tauri: { name: "Tauri", kind: fw("desktop") },
+    diesel: { name: "Diesel", kind: db("orm") },
+    sqlx: { name: "SQLx", kind: db("driver") },
+    "sea-orm": { name: "SeaORM", kind: db("orm") },
+    "tokio-postgres": { name: "PostgreSQL (tokio-postgres)", kind: db("driver") },
+    mongodb: { name: "MongoDB driver", kind: db("driver") },
+    jsonwebtoken: { name: "jsonwebtoken", kind: auth("token") },
+    argon2: { name: "argon2", kind: auth("hashing") },
+    bcrypt: { name: "bcrypt", kind: auth("hashing") },
+    oauth2: { name: "oauth2", kind: auth("library") },
+    redis: { name: "Redis client", kind: CACHE },
+    moka: { name: "moka cache", kind: CACHE },
+    lapin: { name: "RabbitMQ (lapin)", kind: QUEUE },
+    rdkafka: { name: "Kafka (rdkafka)", kind: QUEUE },
+    tracing: { name: "tracing", kind: OBS },
+    sentry: { name: "Sentry", kind: OBS },
+    "tower-http": { name: "tower-http (may include CORS)", kind: SEC }
+  },
+  maven: {
+    "spring-boot-starter-web": { name: "Spring Boot (Web)", kind: fw("backend") },
+    "spring-boot-starter-webflux": { name: "Spring WebFlux", kind: fw("backend") },
+    "spring-boot-starter": { name: "Spring Boot", kind: fw("backend") },
+    "spring-boot-starter-data-jpa": { name: "Spring Data JPA", kind: db("orm") },
+    "spring-boot-starter-data-mongodb": { name: "Spring Data MongoDB", kind: db("orm") },
+    "hibernate-core": { name: "Hibernate", kind: db("orm") },
+    "mybatis": { name: "MyBatis", kind: db("orm") },
+    postgresql: { name: "PostgreSQL JDBC", kind: db("driver") },
+    "mysql-connector-j": { name: "MySQL JDBC", kind: db("driver") },
+    "flyway-core": { name: "Flyway", kind: db("orm") },
+    "liquibase-core": { name: "Liquibase", kind: db("orm") },
+    "spring-boot-starter-security": { name: "Spring Security", kind: auth("library") },
+    "spring-boot-starter-oauth2-resource-server": { name: "Spring OAuth2 Resource Server", kind: auth("library") },
+    "spring-boot-starter-oauth2-client": { name: "Spring OAuth2 Client", kind: auth("library") },
+    "jjwt-api": { name: "JJWT", kind: auth("token") },
+    "spring-boot-starter-data-redis": { name: "Spring Data Redis", kind: CACHE },
+    "spring-boot-starter-cache": { name: "Spring Cache", kind: CACHE },
+    "spring-kafka": { name: "Spring Kafka", kind: QUEUE },
+    "spring-boot-starter-amqp": { name: "Spring AMQP", kind: QUEUE },
+    "spring-boot-starter-actuator": { name: "Spring Boot Actuator", kind: OBS },
+    "spring-boot-starter-validation": { name: "Bean Validation", kind: SEC },
+    "spring-boot-starter-test": { name: "Spring Boot Test", kind: TEST },
+    "junit-jupiter": { name: "JUnit 5", kind: TEST },
+    junit: { name: "JUnit", kind: TEST },
+    "mockito-core": { name: "Mockito", kind: TEST },
+    testcontainers: { name: "Testcontainers", kind: TEST }
+  },
+  composer: {
+    "laravel/framework": { name: "Laravel", kind: fw("fullstack"), markers: [/(^|\/)artisan$/] },
+    "symfony/framework-bundle": { name: "Symfony", kind: fw("fullstack") },
+    "slim/slim": { name: "Slim", kind: fw("backend") },
+    "doctrine/orm": { name: "Doctrine ORM", kind: db("orm") },
+    "laravel/sanctum": { name: "Laravel Sanctum", kind: auth("library") },
+    "laravel/passport": { name: "Laravel Passport", kind: auth("library") },
+    "tymon/jwt-auth": { name: "jwt-auth", kind: auth("token") },
+    "firebase/php-jwt": { name: "php-jwt", kind: auth("token") },
+    "predis/predis": { name: "Predis (Redis)", kind: CACHE },
+    "sentry/sentry-laravel": { name: "Sentry", kind: OBS },
+    "phpunit/phpunit": { name: "PHPUnit", kind: TEST },
+    "pestphp/pest": { name: "Pest", kind: TEST }
+  },
+  nuget: {
+    "Microsoft.AspNetCore.App": { name: "ASP.NET Core", kind: fw("backend") },
+    "Microsoft.EntityFrameworkCore": { name: "Entity Framework Core", kind: db("orm") },
+    "Npgsql.EntityFrameworkCore.PostgreSQL": { name: "PostgreSQL (Npgsql EF)", kind: db("driver") },
+    "Microsoft.EntityFrameworkCore.SqlServer": { name: "SQL Server (EF)", kind: db("driver") },
+    Dapper: { name: "Dapper", kind: db("orm") },
+    "Microsoft.AspNetCore.Identity.EntityFrameworkCore": { name: "ASP.NET Core Identity", kind: auth("library") },
+    "Microsoft.AspNetCore.Authentication.JwtBearer": { name: "JWT Bearer auth", kind: auth("token") },
+    "StackExchange.Redis": { name: "StackExchange.Redis", kind: CACHE },
+    "MassTransit": { name: "MassTransit", kind: QUEUE },
+    Serilog: { name: "Serilog", kind: OBS },
+    xunit: { name: "xUnit", kind: TEST },
+    NUnit: { name: "NUnit", kind: TEST },
+    MSTest: { name: "MSTest", kind: TEST }
+  },
+  gem: {
+    rails: { name: "Ruby on Rails", kind: fw("fullstack"), markers: [/(^|\/)config\/routes\.rb$/] },
+    sinatra: { name: "Sinatra", kind: fw("backend") },
+    "activerecord": { name: "ActiveRecord", kind: db("orm") },
+    pg: { name: "PostgreSQL (pg gem)", kind: db("driver") },
+    mysql2: { name: "MySQL (mysql2 gem)", kind: db("driver") },
+    devise: { name: "Devise", kind: auth("library") },
+    omniauth: { name: "OmniAuth", kind: auth("library") },
+    pundit: { name: "Pundit (authorization)", kind: auth("library") },
+    cancancan: { name: "CanCanCan (authorization)", kind: auth("library") },
+    jwt: { name: "ruby-jwt", kind: auth("token") },
+    bcrypt: { name: "bcrypt", kind: auth("hashing") },
+    redis: { name: "Redis client", kind: CACHE },
+    sidekiq: { name: "Sidekiq", kind: QUEUE },
+    "sentry-ruby": { name: "Sentry", kind: OBS },
+    brakeman: { name: "Brakeman", kind: SECTOOL },
+    "bundler-audit": { name: "bundler-audit", kind: SECTOOL },
+    rspec: { name: "RSpec", kind: TEST },
+    "rspec-rails": { name: "RSpec Rails", kind: TEST },
+    minitest: { name: "Minitest", kind: TEST }
+  },
+  pub: {
+    flutter: { name: "Flutter", kind: fw("mobile") },
+    firebase_core: { name: "Firebase", kind: db("driver") },
+    cloud_firestore: { name: "Cloud Firestore", kind: db("driver") },
+    sqflite: { name: "SQLite (sqflite)", kind: db("driver") },
+    drift: { name: "Drift", kind: db("orm") },
+    firebase_auth: { name: "Firebase Auth", kind: auth("provider") },
+    supabase_flutter: { name: "Supabase", kind: db("driver") },
+    flutter_test: { name: "flutter_test", kind: TEST },
+    integration_test: { name: "integration_test", kind: TEST },
+    sentry_flutter: { name: "Sentry", kind: OBS }
+  },
+  hex: {
+    phoenix: { name: "Phoenix", kind: fw("fullstack") },
+    ecto_sql: { name: "Ecto", kind: db("orm") },
+    postgrex: { name: "PostgreSQL (Postgrex)", kind: db("driver") },
+    guardian: { name: "Guardian", kind: auth("token") },
+    bcrypt_elixir: { name: "bcrypt_elixir", kind: auth("hashing") },
+    oban: { name: "Oban", kind: QUEUE }
+  }
+};
+function ecosystemKey(ecosystem) {
+  const map = {
+    npm: "npm",
+    python: "python",
+    go: "go",
+    cargo: "cargo",
+    maven: "maven",
+    gradle: "maven",
+    composer: "composer",
+    nuget: "nuget",
+    rubygems: "gem",
+    pub: "pub",
+    hex: "hex"
+  };
+  return map[ecosystem] ?? null;
+}
+function normalizeDep(ecosystem, dep) {
+  if (ecosystem === "python") return dep.toLowerCase().replace(/_/g, "-");
+  return dep;
+}
+
+// src/core/analyzer/detectors/dependencies.ts
+var dependenciesDetector = {
+  id: "dependencies",
+  version: 1,
+  async run(ctx) {
+    const { model } = ctx;
+    const buckets = {
+      database: /* @__PURE__ */ new Map(),
+      auth: /* @__PURE__ */ new Map(),
+      cache: /* @__PURE__ */ new Map(),
+      queue: /* @__PURE__ */ new Map(),
+      observability: /* @__PURE__ */ new Map(),
+      securityControl: /* @__PURE__ */ new Map(),
+      securityTooling: /* @__PURE__ */ new Map(),
+      testing: /* @__PURE__ */ new Map()
+    };
+    const frameworks = /* @__PURE__ */ new Map();
+    const addEvidence = (prov, ev) => {
+      if (!prov.evidence.some((e) => e.file === ev.file && e.detail === ev.detail)) prov.evidence.push(ev);
+    };
+    for (const manifest of model.manifests) {
+      const eco = ecosystemKey(manifest.ecosystem);
+      if (!eco) continue;
+      const table = CATALOG[eco];
+      const lookup = new Map(Object.entries(table).map(([k, v]) => [normalizeDep(manifest.ecosystem, k), v]));
+      const root = dirOf(manifest.path);
+      const all = [
+        ...manifest.dependencies.map((d) => [d, false]),
+        ...manifest.devDependencies.map((d) => [d, true])
+      ];
+      for (const [dep, isDev] of all) {
+        const entry = lookup.get(normalizeDep(manifest.ecosystem, dep));
+        if (!entry) continue;
+        const ev = { file: manifest.path, detail: `${isDev ? "dev " : ""}dependency "${dep}"` };
+        const marker = entry.markers?.flatMap((re) => ctx.find(re).map((f) => f.path)).find((p) => dirOf(p) === root || p.startsWith(root === "." ? "" : `${root}/`));
+        const kind = entry.kind;
+        const confidence = marker || !isDev || kind.type === "testing" || kind.type === "securityTooling" ? "high" : "medium";
+        const mkProv = () => ({ status: "DETECTED", confidence, source: "config", evidence: [] });
+        if (kind.type === "framework") {
+          const key = `${entry.name}@${root}`;
+          const cur2 = frameworks.get(key) ?? { name: entry.name, category: kind.category, root, provenance: mkProv() };
+          addEvidence(cur2.provenance, ev);
+          if (marker) addEvidence(cur2.provenance, { file: marker, detail: "framework config file" });
+          if (confidence === "high") cur2.provenance.confidence = "high";
+          frameworks.set(key, cur2);
+          continue;
+        }
+        const bucket = buckets[kind.type];
+        const cur = bucket.get(entry.name) ?? { name: entry.name, provenance: mkProv(), ..."kind" in kind ? { kind: kind.kind } : {} };
+        addEvidence(cur.provenance, ev);
+        if (marker) addEvidence(cur.provenance, { file: marker, detail: "config file" });
+        if (confidence === "high") cur.provenance.confidence = "high";
+        bucket.set(entry.name, cur);
+      }
+    }
+    const sorted = (m) => [...m.values()].sort((a, b) => a.name.localeCompare(b.name));
+    model.frameworks = [...frameworks.values()].sort((a, b) => a.root.localeCompare(b.root) || a.name.localeCompare(b.name));
+    model.databases.push(...sorted(buckets.database));
+    model.auth.push(...sorted(buckets.auth));
+    model.caching.push(...sorted(buckets.cache));
+    model.queues.push(...sorted(buckets.queue));
+    model.observability.push(...sorted(buckets.observability));
+    model.security.controls.push(...sorted(buckets.securityControl));
+    model.security.tooling.push(...sorted(buckets.securityTooling));
+    model.tests.frameworks.push(...sorted(buckets.testing));
+  }
+};
+
+// src/core/analyzer/detectors/infra.ts
+import { parseAllDocuments, parse as parseYaml3 } from "yaml";
+var isObj2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var IMAGE_CAPS = [
+  [/^(?:.*\/)?(postgres|postgis\/postgis|pgvector\/pgvector|timescale\/timescaledb)(:|$)/, "PostgreSQL", "database"],
+  [/^(?:.*\/)?(mysql|mariadb)(:|$)/, "MySQL/MariaDB", "database"],
+  [/^(?:.*\/)?mongo(:|$)/, "MongoDB", "database"],
+  [/^(?:.*\/)?(mcr\.microsoft\.com\/mssql\/server|mssql)/, "SQL Server", "database"],
+  [/^(?:.*\/)?(elasticsearch|opensearch)/, "Elasticsearch/OpenSearch", "database"],
+  [/^(?:.*\/)?clickhouse/, "ClickHouse", "database"],
+  [/^(?:.*\/)?(redis|valkey|redis\/redis-stack)(:|$)/, "Redis", "cache"],
+  [/^(?:.*\/)?memcached(:|$)/, "Memcached", "cache"],
+  [/^(?:.*\/)?rabbitmq(:|$)/, "RabbitMQ", "queue"],
+  [/^(?:.*\/)?(confluentinc\/cp-kafka|bitnami\/kafka|apache\/kafka)/, "Kafka", "queue"],
+  [/^(?:.*\/)?nats(:|$)/, "NATS", "queue"]
+];
+var HOSTING = [
+  [/(^|\/)vercel\.json$/, "Vercel", "hosting"],
+  [/(^|\/)netlify\.toml$/, "Netlify", "hosting"],
+  [/(^|\/)fly\.toml$/, "Fly.io", "hosting"],
+  [/(^|\/)render\.ya?ml$/, "Render", "hosting"],
+  [/(^|\/)railway\.(json|toml)$/, "Railway", "hosting"],
+  [/(^|\/)Procfile$/, "Procfile (Heroku-style)", "hosting"],
+  [/(^|\/)app\.ya?ml$/, "Google App Engine (app.yaml)", "hosting"],
+  [/(^|\/)firebase\.json$/, "Firebase Hosting/config", "hosting"],
+  [/(^|\/)wrangler\.(toml|jsonc?)$/, "Cloudflare Workers", "hosting"],
+  [/(^|\/)serverless\.ya?ml$/, "Serverless Framework", "hosting"],
+  [/(^|\/)template\.ya?ml$|(^|\/)samconfig\.toml$/, "AWS SAM (possible)", "hosting"],
+  [/(^|\/)cdk\.json$/, "AWS CDK", "iac"],
+  [/(^|\/)Pulumi\.ya?ml$/, "Pulumi", "iac"],
+  [/(^|\/)Chart\.yaml$/, "Helm chart", "kubernetes"],
+  [/(^|\/)kustomization\.ya?ml$/, "Kustomize", "kubernetes"],
+  [/(^|\/)skaffold\.ya?ml$/, "Skaffold", "kubernetes"],
+  [/(^|\/)nginx[^/]*\.conf$|(^|\/)nginx\/.*\.conf$/, "nginx config", "reverse-proxy"],
+  [/(^|\/)Caddyfile$/, "Caddy", "reverse-proxy"],
+  [/(^|\/)traefik\.ya?ml$/, "Traefik", "reverse-proxy"]
+];
+function strList(v) {
+  if (Array.isArray(v)) return v.map((x) => typeof x === "string" || typeof x === "number" ? String(x) : isObj2(x) && x.target ? `${x.published ?? ""}:${x.target}` : "").filter(Boolean);
+  if (isObj2(v)) return Object.keys(v);
+  return [];
+}
+function trimCmd(s) {
+  const one = s.split("\n").map((l) => l.trim()).filter(Boolean).join(" && ");
+  return redact(one.length > 160 ? `${one.slice(0, 157)}...` : one);
+}
+var COMPOSE_RE = /(^|\/)(docker-)?compose(\.[\w-]+)?\.ya?ml$/;
+var composeFact = {
+  id: "compose-services",
+  applies: (f) => COMPOSE_RE.test(f.path),
+  compute(text) {
+    const services = [];
+    if (!text) return { services };
+    let y;
+    try {
+      y = parseYaml3(text);
+    } catch {
+      return { invalid: true };
+    }
+    if (!isObj2(y) || !isObj2(y.services)) return { services };
+    for (const [name, svc] of Object.entries(y.services)) {
+      if (!isObj2(svc)) continue;
+      services.push({
+        name,
+        image: typeof svc.image === "string" ? svc.image : isObj2(svc.build) || typeof svc.build === "string" ? "(built locally)" : void 0,
+        ports: strList(svc.ports),
+        dependsOn: strList(svc.depends_on)
+      });
+    }
+    return { services };
+  }
+};
+async function composeServices(ctx) {
+  const out = [];
+  for (const f of ctx.find(COMPOSE_RE)) {
+    const v = await ctx.fact(f.path, composeFact);
+    if (!v) continue;
+    if ("invalid" in v) {
+      ctx.warn(`Could not parse ${f.path} (invalid YAML)`);
+      continue;
+    }
+    for (const svc of v.services) out.push({ name: svc.name, image: svc.image, ports: svc.ports, dependsOn: svc.dependsOn, file: f.path });
+  }
+  return out;
+}
+function ciYaml(text) {
+  if (!text) return { y: null };
+  try {
+    const y = parseYaml3(text);
+    return { y: isObj2(y) ? y : null };
+  } catch {
+    return { invalid: true };
+  }
+}
+var GHA_RE = /^\.github\/workflows\/[^/]+\.ya?ml$/;
+var githubActionsFact = {
+  id: "ci-github-actions",
+  applies: (f) => GHA_RE.test(f.path),
+  compute(text) {
+    const r = ciYaml(text);
+    if ("invalid" in r) return r;
+    const jobs = [];
+    const y = r.y;
+    if (!y || !isObj2(y.jobs)) return { jobs };
+    for (const [id, job] of Object.entries(y.jobs)) {
+      if (!isObj2(job)) continue;
+      const steps = Array.isArray(job.steps) ? job.steps : [];
+      const commands = steps.flatMap((s) => isObj2(s) && typeof s.run === "string" ? [trimCmd(s.run)] : isObj2(s) && typeof s.uses === "string" ? [`uses: ${s.uses}`] : []);
+      jobs.push({ name: typeof job.name === "string" ? job.name : id, commands: commands.slice(0, 12) });
+    }
+    return { jobs };
+  }
+};
+var gitlabFact = {
+  id: "ci-gitlab",
+  applies: (f) => f.path === ".gitlab-ci.yml",
+  compute(text) {
+    const r = ciYaml(text);
+    if ("invalid" in r) return r;
+    const jobs = [];
+    const y = r.y;
+    if (y) for (const [id, job] of Object.entries(y)) {
+      if (id.startsWith(".") || !isObj2(job) || !("script" in job)) continue;
+      const script = Array.isArray(job.script) ? job.script.map(String) : [String(job.script)];
+      jobs.push({ name: id, commands: script.map(trimCmd).slice(0, 12) });
+    }
+    return { jobs };
+  }
+};
+var circleFact = {
+  id: "ci-circleci",
+  applies: (f) => f.path === ".circleci/config.yml",
+  compute(text) {
+    const r = ciYaml(text);
+    if ("invalid" in r) return r;
+    const jobs = [];
+    const y = r.y;
+    if (y && isObj2(y.jobs)) for (const [id, job] of Object.entries(y.jobs)) {
+      const steps = isObj2(job) && Array.isArray(job.steps) ? job.steps : [];
+      const commands = steps.flatMap((s) => isObj2(s) && isObj2(s.run) && typeof s.run.command === "string" ? [trimCmd(s.run.command)] : isObj2(s) && typeof s.run === "string" ? [trimCmd(s.run)] : []);
+      jobs.push({ name: id, commands: commands.slice(0, 12) });
+    }
+    return { jobs };
+  }
+};
+var JENKINS_RE = /(^|\/)Jenkinsfile$/;
+var jenkinsFact = {
+  id: "ci-jenkins-stages",
+  applies: (f) => JENKINS_RE.test(f.path),
+  compute: (text) => [...text.matchAll(/stage\s*\(\s*['"]([^'"]+)['"]/g)].map((m) => m[1])
+};
+async function ciJobs(ctx) {
+  const jobs = [];
+  const load = async (p, def) => {
+    const v = await ctx.fact(p, def);
+    if (!v) return [];
+    if ("invalid" in v) {
+      ctx.warn(`Could not parse ${p} (invalid YAML)`);
+      return [];
+    }
+    return v.jobs;
+  };
+  for (const f of ctx.find(GHA_RE)) {
+    for (const j of await load(f.path, githubActionsFact)) jobs.push({ system: "GitHub Actions", file: f.path, name: j.name, commands: j.commands });
+  }
+  if (ctx.has(".gitlab-ci.yml")) {
+    for (const j of await load(".gitlab-ci.yml", gitlabFact)) jobs.push({ system: "GitLab CI", file: ".gitlab-ci.yml", name: j.name, commands: j.commands });
+  }
+  if (ctx.has(".circleci/config.yml")) {
+    for (const j of await load(".circleci/config.yml", circleFact)) jobs.push({ system: "CircleCI", file: ".circleci/config.yml", name: j.name, commands: j.commands });
+  }
+  for (const f of ctx.find(/(^|\/)azure-pipelines\.ya?ml$/)) jobs.push({ system: "Azure Pipelines", file: f.path, name: "pipeline", commands: [] });
+  for (const f of ctx.find(/(^|\/)bitbucket-pipelines\.yml$/)) jobs.push({ system: "Bitbucket Pipelines", file: f.path, name: "pipeline", commands: [] });
+  for (const f of ctx.find(JENKINS_RE)) {
+    const stages = await ctx.fact(f.path, jenkinsFact) ?? [];
+    if (stages.length) for (const s of stages) jobs.push({ system: "Jenkins", file: f.path, name: s, commands: [] });
+    else jobs.push({ system: "Jenkins", file: f.path, name: "pipeline", commands: [] });
+  }
+  return jobs;
+}
+var DOCKERFILE_RE = /(^|\/)(Dockerfile|Containerfile)(\.[\w.-]+)?$|\.dockerfile$/i;
+var dockerfileFact = {
+  id: "dockerfile",
+  applies: (f) => DOCKERFILE_RE.test(f.path),
+  compute(text) {
+    if (!text) return false;
+    const baseImages = [...text.matchAll(/^\s*FROM\s+(?:--platform=\S+\s+)?(\S+)/gim)].map((m) => m[1]);
+    const exposedPorts = [...text.matchAll(/^\s*EXPOSE\s+(.+)$/gim)].flatMap((m) => m[1].trim().split(/\s+/));
+    return { baseImages: [...new Set(baseImages)], exposedPorts: [...new Set(exposedPorts)] };
+  }
+};
+var terraformFact = {
+  id: "terraform-providers",
+  applies: (f) => /\.tf$/.test(f.path),
+  compute(text) {
+    const out = [];
+    if (!text) return out;
+    for (const m of text.matchAll(/(?:provider|required_providers)\s*"?([a-z0-9_-]+)"?\s*\{|source\s*=\s*"(?:[\w.-]+\/)?([\w-]+)\/([\w-]+)"/g)) {
+      const p = m[1] ?? m[3];
+      if (p && p !== "required_providers") out.push(p);
+    }
+    return out;
+  }
+};
+var K8S_SKIP = /(^|\/)(\.github|\.gitlab|\.circleci)\//;
+var k8sFact = {
+  id: "k8s-kinds",
+  applies: (f) => /\.ya?ml$/.test(f.path) && !f.large && !K8S_SKIP.test(f.path) && !/compose/.test(f.path),
+  compute(text) {
+    const kinds = [];
+    if (!text || !/^apiVersion:/m.test(text) || !/^kind:/m.test(text)) return kinds;
+    try {
+      for (const doc of parseAllDocuments(text)) {
+        const j = doc.toJSON();
+        if (isObj2(j) && typeof j.kind === "string" && typeof j.apiVersion === "string") kinds.push(j.kind);
+      }
+    } catch {
+    }
+    return kinds;
+  }
+};
+var infraDetector = {
+  id: "infra",
+  version: 1,
+  facts: [dockerfileFact, composeFact, terraformFact, k8sFact, githubActionsFact, gitlabFact, circleFact, jenkinsFact],
+  async run(ctx) {
+    const { model } = ctx;
+    for (const f of ctx.find(DOCKERFILE_RE)) {
+      const v = await ctx.fact(f.path, dockerfileFact);
+      if (!v) continue;
+      model.containers.dockerfiles.push({ path: f.path, baseImages: v.baseImages, exposedPorts: v.exposedPorts });
+    }
+    model.containers.services = await composeServices(ctx);
+    for (const svc of model.containers.services) {
+      if (!svc.image) continue;
+      for (const [re, name, cap] of IMAGE_CAPS) {
+        if (!re.test(svc.image)) continue;
+        const prov = detected("config", [{ file: svc.file, detail: `compose service "${svc.name}" image ${svc.image}` }]);
+        if (cap === "database") model.databases.push({ name, kind: "service", provenance: prov });
+        else if (cap === "cache") model.caching.push({ name: `${name} (container)`, provenance: prov });
+        else model.queues.push({ name: `${name} (container)`, provenance: prov });
+      }
+    }
+    for (const [re, name, kind] of HOSTING) {
+      for (const f of ctx.find(re)) model.infrastructure.push({ name, kind, file: f.path, provenance: detected("filesystem", [{ file: f.path }], name.includes("possible") ? "low" : "high") });
+    }
+    const tfProviders = /* @__PURE__ */ new Map();
+    for (const f of ctx.find(/\.tf$/)) {
+      const providers = await ctx.fact(f.path, terraformFact);
+      if (!providers) continue;
+      for (const p of providers) if (!tfProviders.has(p)) tfProviders.set(p, f.path);
+    }
+    for (const [p, file] of tfProviders) model.infrastructure.push({ name: `Terraform provider: ${p}`, kind: "iac", file, provenance: detected("config", [{ file }]) });
+    const k8sKinds = /* @__PURE__ */ new Map();
+    for (const f of ctx.find(/\.ya?ml$/)) {
+      if (f.large || K8S_SKIP.test(f.path) || /compose/.test(f.path)) continue;
+      const kinds = await ctx.fact(f.path, k8sFact);
+      if (!kinds) continue;
+      for (const kind of kinds) if (!k8sKinds.has(kind)) k8sKinds.set(kind, f.path);
+    }
+    for (const [kind, file] of k8sKinds) model.infrastructure.push({ name: `Kubernetes ${kind}`, kind: "kubernetes", file, provenance: detected("config", [{ file }]) });
+    model.ci = await ciJobs(ctx);
+    for (const f of ctx.find(/(^|\/)(\.github\/dependabot\.ya?ml|renovate\.json5?|\.renovaterc(\.json)?|\.snyk|\.semgrep\.ya?ml|\.gitleaks\.toml|\.trivyignore|codeql[^/]*\.ya?ml|\.pre-commit-config\.yaml|SECURITY\.md)$/)) {
+      const name = /dependabot/.test(f.path) ? "Dependabot" : /renovate/.test(f.path) ? "Renovate" : /snyk/.test(f.path) ? "Snyk" : /semgrep/.test(f.path) ? "Semgrep" : /gitleaks/.test(f.path) ? "Gitleaks" : /trivy/.test(f.path) ? "Trivy" : /codeql/.test(f.path) ? "CodeQL" : /pre-commit/.test(f.path) ? "pre-commit hooks" : "Security policy (SECURITY.md)";
+      model.security.tooling.push({ name, provenance: detected("filesystem", [{ file: f.path }]) });
+    }
+    for (const job of model.ci) {
+      for (const c of job.commands) {
+        const m = /(codeql|trivy|snyk|semgrep|gitleaks|npm audit|pip-audit|govulncheck|cargo audit|bandit|brakeman|zap)/i.exec(c);
+        if (m) model.security.tooling.push({ name: `${m[1]} (in CI)`, provenance: detected("config", [{ file: job.file, detail: `job "${job.name}"` }]) });
+      }
+    }
+  }
+};
+
+// src/core/analyzer/detectors/tests.ts
+var TEST_FILE_RE = TEST_FILE;
+var SOURCE_RE = SOURCE_FILE;
+var RUNNER_CONFIGS = [
+  [/(^|\/)jest\.config\.(js|ts|cjs|mjs|json)$/, "Jest"],
+  [/(^|\/)vitest\.config\.(js|ts|mjs|cjs)$/, "Vitest"],
+  [/(^|\/)playwright\.config\.(js|ts)$/, "Playwright"],
+  [/(^|\/)cypress\.config\.(js|ts)$|(^|\/)cypress\.json$/, "Cypress"],
+  [/(^|\/)(pytest\.ini|conftest\.py)$/, "pytest"],
+  [/(^|\/)\.mocharc\.(js|json|ya?ml|cjs)$/, "Mocha"],
+  [/(^|\/)karma\.conf\.(js|ts)$/, "Karma"],
+  [/(^|\/)phpunit\.xml(\.dist)?$/, "PHPUnit"],
+  [/(^|\/)\.rspec$/, "RSpec"]
+];
+var COVERAGE = /(^|\/)(\.nycrc(\.json)?|\.coveragerc|codecov\.ya?ml|\.codecov\.ya?ml|jacoco[^/]*\.xml|\.c8rc(\.json)?|coverage\.xml|sonar-project\.properties)$/;
+var COVERAGE_CONFIG = /(^|\/)(jest|vitest)\.config\.(js|ts|mjs|cjs)$/;
+var rustTestFact = {
+  id: "rust-test-attr",
+  applies: (f) => /\.rs$/.test(f.path),
+  compute: (text) => !!text && /#\[(tokio::)?test\]/.test(text)
+};
+var coverageFact = {
+  id: "runner-coverage",
+  applies: (f) => COVERAGE_CONFIG.test(f.path),
+  compute: (text) => !!text && /coverage/.test(text)
+};
+var testsDetector = {
+  id: "tests",
+  version: 1,
+  facts: [rustTestFact, coverageFact],
+  async run(ctx) {
+    const { model } = ctx;
+    const testFiles = ctx.find((f) => !f.binary && SOURCE_RE.test(f.path) && TEST_FILE_RE.test(f.path));
+    model.tests.testFileCount = testFiles.length;
+    const dirs = /* @__PURE__ */ new Map();
+    for (const f of testFiles) {
+      const m = /^(.*?(?:__tests__|tests?|spec|specs|e2e))\//.exec(f.path);
+      if (m) dirs.set(m[1], (dirs.get(m[1]) ?? 0) + 1);
+    }
+    model.tests.testDirs = [...dirs.entries()].sort((a, b) => b[1] - a[1]).slice(0, 15).map(([d]) => d);
+    const known = new Set(model.tests.frameworks.map((f) => f.name));
+    for (const [re, name] of RUNNER_CONFIGS) {
+      const files = ctx.find(re);
+      if (!files.length) continue;
+      const existing = model.tests.frameworks.find((f) => f.name === name);
+      if (existing) existing.provenance.evidence.push(...files.slice(0, 3).map((f) => ({ file: f.path, detail: "runner config" })));
+      else if (!known.has(name)) model.tests.frameworks.push({ name, provenance: detected("config", files.slice(0, 3).map((f) => ({ file: f.path, detail: "runner config" }))) });
+    }
+    if (ctx.find(/_test\.go$/).length && !known.has("go test")) model.tests.frameworks.push({ name: "go test", provenance: detected("filesystem", ctx.find(/_test\.go$/).slice(0, 3).map((f) => ({ file: f.path }))) });
+    if (model.manifests.some((m) => m.ecosystem === "cargo") && ctx.find(/\.rs$/).length) {
+      const withTests = [];
+      for (const f of ctx.find(/\.rs$/).slice(0, 2e3)) {
+        if (await ctx.fact(f.path, rustTestFact)) withTests.push(f.path);
+        if (withTests.length >= 3) break;
+      }
+      if (withTests.length) model.tests.frameworks.push({ name: "cargo test", provenance: detected("code", withTests.map((file) => ({ file, detail: "#[test] attribute" }))) });
+    }
+    model.tests.frameworks.sort((a, b) => a.name.localeCompare(b.name));
+    model.tests.coverageConfigs = ctx.find(COVERAGE).map((f) => f.path);
+    for (const f of ctx.find(COVERAGE_CONFIG)) {
+      if (await ctx.fact(f.path, coverageFact)) model.tests.coverageConfigs.push(f.path);
+    }
+    if (model.workspace.isMonorepo) {
+      for (const pkg of model.workspace.packages) {
+        if (pkg.path === ".") continue;
+        const prefix = `${pkg.path}/`;
+        const src = ctx.files.some((f) => f.path.startsWith(prefix) && SOURCE_RE.test(f.path) && !TEST_FILE_RE.test(f.path));
+        const tests = testFiles.some((f) => f.path.startsWith(prefix));
+        if (src && !tests) model.tests.packagesWithoutTests.push(pkg.path);
+      }
+    }
+  }
+};
+
+// src/core/analyzer/detectors/database.ts
+var prismaFact = {
+  id: "db-prisma",
+  applies: (f) => /\.prisma$/.test(f.path),
+  compute(text) {
+    if (!text) return false;
+    const provider = /datasource\s+\w+\s*\{[^}]*provider\s*=\s*"([^"]+)"/.exec(text)?.[1] ?? null;
+    const models = [];
+    for (const m of text.matchAll(/^(model|view)\s+(\w+)\s*\{([\s\S]*?)^\}/gm)) {
+      const body = m[3];
+      const fields = [];
+      const indexes = [];
+      const relations = [];
+      for (const raw of body.split("\n")) {
+        const line = raw.replace(/\/\/.*$/, "").trim();
+        if (!line) continue;
+        if (line.startsWith("@@")) {
+          indexes.push(line);
+          continue;
+        }
+        const fm = /^(\w+)\s+([\w[\]?.()"]+)\s*(.*)$/.exec(line);
+        if (!fm) continue;
+        const attributes = [...fm[3].matchAll(/@[\w.]+(\([^)]*\))?/g)].map((a) => a[0]);
+        fields.push({ name: fm[1], type: fm[2], attributes });
+        const rel = attributes.find((a) => a.startsWith("@relation"));
+        if (rel) relations.push(`${fm[1]} \u2192 ${fm[2].replace(/[[\]?]/g, "")}`);
+      }
+      models.push({ name: m[2], kind: "model", fields, indexes, relations, line: text.slice(0, m.index).split("\n").length });
+    }
+    return { provider, models };
+  }
+};
+async function prisma(ctx) {
+  const out = [];
+  for (const f of ctx.find(/\.prisma$/)) {
+    const v = await ctx.fact(f.path, prismaFact);
+    if (!v) continue;
+    if (v.provider) ctx.model.databases.push({ name: `${v.provider} (Prisma datasource)`, kind: "engine", provenance: detected("config", [{ file: f.path, detail: "datasource provider" }]) });
+    for (const e of v.models) out.push({ name: e.name, kind: e.kind, fields: e.fields, indexes: e.indexes, relations: e.relations, file: f.path, provenance: detected("code", [{ file: f.path, line: e.line }]) });
+  }
+  return out;
+}
+function stripSqlComments(sql) {
+  return sql.replace(/--[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "");
+}
+var SQL_RE = /\.sql$/i;
+var sqlFact = {
+  id: "db-sql",
+  applies: (f) => SQL_RE.test(f.path) && !f.large,
+  compute(raw) {
+    if (!raw) return false;
+    const text = stripSqlComments(raw);
+    const out = { tables: [], indexes: [] };
+    for (const m of text.matchAll(/CREATE\s+(?:UNLOGGED\s+|TEMP(?:ORARY)?\s+)?TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?([`"[\]\w.]+)\s*\(([\s\S]*?)\)\s*;/gi)) {
+      const name = m[1].replace(/[`"[\]]/g, "");
+      const fields = [];
+      const relations = [];
+      for (const col of splitTopLevel(m[2])) {
+        const c = col.trim();
+        const fk = /FOREIGN\s+KEY\s*\(([^)]+)\)\s*REFERENCES\s+([`"\w.]+)/i.exec(c);
+        if (fk) {
+          relations.push(`${fk[1].trim()} \u2192 ${fk[2].replace(/[`"]/g, "")}`);
+          continue;
+        }
+        if (/^(CONSTRAINT|PRIMARY\s+KEY|UNIQUE|CHECK|INDEX|KEY)\b/i.test(c)) continue;
+        const cm = /^([`"\w]+)\s+([\w]+(?:\s*\([^)]*\))?)(.*)$/s.exec(c);
+        if (!cm) continue;
+        const attrs = [];
+        if (/PRIMARY\s+KEY/i.test(cm[3])) attrs.push("PRIMARY KEY");
+        if (/NOT\s+NULL/i.test(cm[3])) attrs.push("NOT NULL");
+        if (/\bUNIQUE\b/i.test(cm[3])) attrs.push("UNIQUE");
+        const ref = /REFERENCES\s+([`"\w.]+)/i.exec(cm[3]);
+        if (ref) relations.push(`${cm[1].replace(/[`"]/g, "")} \u2192 ${ref[1].replace(/[`"]/g, "")}`);
+        fields.push({ name: cm[1].replace(/[`"]/g, ""), type: cm[2], attributes: attrs });
+      }
+      const line = raw.slice(0, raw.indexOf(m[0].slice(0, 20))).split("\n").length;
+      out.tables.push({ name, fields, relations, line: line > 0 ? line : void 0 });
+    }
+    for (const m of text.matchAll(/CREATE\s+(UNIQUE\s+)?INDEX\s+(?:CONCURRENTLY\s+)?(?:IF\s+NOT\s+EXISTS\s+)?([`"\w.]+)\s+ON\s+([`"\w.]+)\s*(?:USING\s+\w+\s*)?\(([^)]*)\)/gi)) {
+      out.indexes.push([m[3].replace(/[`"]/g, "").toLowerCase(), `${m[1] ? "UNIQUE " : ""}${m[2].replace(/[`"]/g, "")} (${m[4].trim()})`]);
+    }
+    return out;
+  }
+};
+async function sqlFiles(ctx) {
+  const tables = /* @__PURE__ */ new Map();
+  const files = ctx.find((f) => SQL_RE.test(f.path) && !f.large).slice(0, 2e3);
+  for (const f of files) {
+    const v = await ctx.fact(f.path, sqlFact);
+    if (!v) continue;
+    for (const t of v.tables) {
+      tables.set(t.name.toLowerCase(), { name: t.name, kind: "table", fields: t.fields, indexes: tables.get(t.name.toLowerCase())?.indexes ?? [], relations: t.relations, file: f.path, provenance: detected("code", [{ file: f.path, line: t.line }]) });
+    }
+    for (const [table, index] of v.indexes) {
+      const t = tables.get(table);
+      if (t) t.indexes.push(index);
+    }
+  }
+  return [...tables.values()];
+}
+function splitTopLevel(s) {
+  const parts = [];
+  let depth = 0;
+  let cur = "";
+  for (const ch of s) {
+    if (ch === "(") depth++;
+    if (ch === ")") depth--;
+    if (ch === "," && depth === 0) {
+      parts.push(cur);
+      cur = "";
+    } else cur += ch;
+  }
+  if (cur.trim()) parts.push(cur);
+  return parts;
+}
+var DJANGO_MODELS_RE = /(^|\/)models(\.py|\/[^/]+\.py)$/;
+var djangoFact = {
+  id: "db-django-models",
+  applies: (f) => DJANGO_MODELS_RE.test(f.path),
+  compute(text) {
+    const out = [];
+    if (!text || !/from django\.db import models|models\.Model/.test(text)) return out;
+    const classRe = /^class\s+(\w+)\(([^)]*models\.Model[^)]*)\):\s*\n((?:[ \t]+.*\n|\s*\n)*)/gm;
+    for (const m of text.matchAll(classRe)) {
+      const fields = [];
+      const relations = [];
+      for (const fm of m[3].matchAll(/^\s+(\w+)\s*=\s*models\.(\w+)\(([^)\n]*)/gm)) {
+        fields.push({ name: fm[1], type: fm[2], attributes: [] });
+        if (/ForeignKey|OneToOneField|ManyToManyField/.test(fm[2])) relations.push(`${fm[1]} \u2192 ${fm[3].split(",")[0].trim().replace(/["']/g, "")}`);
+      }
+      out.push({ name: m[1], kind: "model", fields, indexes: [], relations, line: text.slice(0, m.index).split("\n").length });
+    }
+    return out;
+  }
+};
+var entitiesFrom = (file, list) => (list ?? []).map((e) => ({ name: e.name, kind: e.kind, fields: e.fields, indexes: e.indexes, relations: e.relations, file, provenance: detected("code", [{ file, line: e.line }], "medium") }));
+async function djangoModels(ctx) {
+  const out = [];
+  for (const f of ctx.find(DJANGO_MODELS_RE)) out.push(...entitiesFrom(f.path, await ctx.fact(f.path, djangoFact)));
+  return out;
+}
+var sqlalchemyFact = {
+  id: "db-sqlalchemy-models",
+  applies: (f) => /\.py$/.test(f.path),
+  compute(text) {
+    const out = [];
+    if (!text || !/__tablename__|table=True/.test(text)) return out;
+    for (const m of text.matchAll(/^class\s+(\w+)\(([^)]*)\):\s*\n((?:[ \t]+.*\n|\s*\n)*)/gm)) {
+      const body = m[3];
+      const tn = /__tablename__\s*=\s*["'](\w+)["']/.exec(body)?.[1];
+      if (!tn && !/table\s*=\s*True/.test(m[2])) continue;
+      const fields = [...body.matchAll(/^\s+(\w+)\s*(?::\s*[^=\n]+)?=\s*(?:Column|mapped_column|Field)\(/gm)].map((fm) => ({ name: fm[1], attributes: [] }));
+      out.push({ name: tn ?? m[1], kind: "table", fields, indexes: [], relations: [], line: text.slice(0, m.index).split("\n").length });
+    }
+    return out;
+  }
+};
+async function sqlalchemyModels(ctx) {
+  const out = [];
+  if (!ctx.model.databases.some((d) => /SQLAlchemy|SQLModel/.test(d.name))) return out;
+  for (const f of ctx.find(/\.py$/).slice(0, 5e3)) out.push(...entitiesFrom(f.path, await ctx.fact(f.path, sqlalchemyFact)));
+  return out;
+}
+var MONGOOSE_RE = /\.(m|c)?(t|j)s$/;
+var mongooseFact = {
+  id: "db-mongoose-models",
+  applies: (f) => MONGOOSE_RE.test(f.path),
+  compute(text) {
+    const out = [];
+    if (!text || !text.includes("model(")) return out;
+    for (const m of text.matchAll(/mongoose\.model\s*(?:<[^>]*>)?\(\s*["'](\w+)["']|\bmodel\s*(?:<[^>]*>)?\(\s*["'](\w+)["']\s*,/g)) {
+      out.push([m[1] ?? m[2], text.slice(0, m.index).split("\n").length]);
+    }
+    return out;
+  }
+};
+async function mongooseModels(ctx) {
+  if (!ctx.model.databases.some((d) => d.name === "Mongoose")) return [];
+  const out = [];
+  for (const f of ctx.find(MONGOOSE_RE).slice(0, 5e3)) {
+    for (const [name, line] of await ctx.fact(f.path, mongooseFact) ?? []) {
+      out.push({ name, kind: "collection", fields: [], indexes: [], relations: [], file: f.path, provenance: detected("code", [{ file: f.path, line }], "medium") });
+    }
+  }
+  return out;
+}
+var MIGRATION_DIRS = [
+  [/(^|\/)prisma\/migrations\/[^/]+\/migration\.sql$/, "Prisma Migrate"],
+  [/(^|\/)drizzle\/[^/]*\.sql$/, "Drizzle Kit"],
+  [/(^|\/)alembic\/versions\/[^/]+\.py$|(^|\/)migrations\/versions\/[^/]+\.py$/, "Alembic"],
+  [/(^|\/)migrations\/\d{4}_[^/]+\.py$/, "Django migrations"],
+  [/(^|\/)db\/migrate\/[^/]+\.rb$/, "Rails migrations"],
+  [/(^|\/)db\/migration\/V\d+[^/]*\.sql$|(^|\/)resources\/db\/migration\/[^/]+\.sql$/, "Flyway"],
+  [/(^|\/)(db\/)?changelog\/[^/]+\.(xml|ya?ml|sql)$/, "Liquibase"],
+  [/(^|\/)database\/migrations\/[^/]+\.php$/, "Laravel migrations"],
+  [/(^|\/)Migrations\/\d+_[^/]+\.cs$/, "EF Core migrations"],
+  [/(^|\/)migrations\/[^/]+\.(up|down)\.sql$|(^|\/)migrations\/\d+[^/]*\.sql$/, "SQL migrations"],
+  [/(^|\/)priv\/repo\/migrations\/[^/]+\.exs$/, "Ecto migrations"],
+  [/(^|\/)supabase\/migrations\/[^/]+\.sql$/, "Supabase migrations"]
+];
+var databaseDetector = {
+  id: "database",
+  version: 1,
+  facts: [prismaFact, sqlFact, djangoFact, sqlalchemyFact, mongooseFact],
+  async run(ctx) {
+    const { model } = ctx;
+    const entities = [...await prisma(ctx), ...await sqlFiles(ctx), ...await djangoModels(ctx), ...await sqlalchemyModels(ctx), ...await mongooseModels(ctx)];
+    model.dbEntities = entities.sort((a, b) => a.name.localeCompare(b.name));
+    const seen = /* @__PURE__ */ new Set();
+    for (const [re, tool] of MIGRATION_DIRS) {
+      const files = ctx.find(re).filter((f) => !seen.has(f.path));
+      if (!files.length) continue;
+      files.forEach((f) => seen.add(f.path));
+      const byDir = /* @__PURE__ */ new Map();
+      for (const f of files) {
+        const d = tool === "Prisma Migrate" ? dirOf(dirOf(f.path)) : dirOf(f.path);
+        byDir.set(d, (byDir.get(d) ?? 0) + 1);
+      }
+      for (const [dir, count] of byDir) model.migrations.push({ path: dir, tool, count });
+    }
+    const merged = /* @__PURE__ */ new Map();
+    for (const d of model.databases) {
+      const cur = merged.get(d.name);
+      if (cur) cur.provenance.evidence.push(...d.provenance.evidence);
+      else merged.set(d.name, d);
+    }
+    model.databases = [...merged.values()];
+  }
+};
+
+// src/core/analyzer/detectors/routes.ts
+import { parse as babelParse } from "@babel/parser";
+var HTTP = ["get", "post", "put", "patch", "delete", "options", "head", "all"];
+var MAX_ROUTES = 5e3;
+var isNode = (v) => typeof v === "object" && v !== null && typeof v.type === "string";
+function walk(node, visit, parent = null) {
+  if (Array.isArray(node)) {
+    for (const c of node) walk(c, visit, parent);
+    return;
+  }
+  if (!isNode(node)) return;
+  visit(node, parent);
+  for (const key of Object.keys(node)) {
+    if (key === "loc" || key === "start" || key === "end" || key === "extra" || key === "comments" || key === "leadingComments" || key === "trailingComments") continue;
+    const v = node[key];
+    if (typeof v === "object" && v !== null) walk(v, visit, node);
+  }
+}
+function strValue(n) {
+  if (!isNode(n)) return null;
+  if (n.type === "StringLiteral") return n.value;
+  if (n.type === "TemplateLiteral" && Array.isArray(n.quasis) && n.quasis.length === 1) return n.quasis[0].value.cooked;
+  return null;
+}
+var lineOf = (n) => n.loc?.start?.line;
+function jsRoutes(file, text, framework) {
+  let ast;
+  try {
+    ast = babelParse(text, { sourceType: "unambiguous", errorRecovery: true, plugins: ["typescript", "jsx", "decorators"] });
+  } catch {
+    return [];
+  }
+  const routes = [];
+  const prov = (line) => detected("code", [{ file, line }], "high");
+  walk(ast, (n) => {
+    if (n.type === "CallExpression" && isNode(n.callee) && n.callee.type === "MemberExpression" && isNode(n.callee.property) && n.callee.property.type === "Identifier") {
+      const method = n.callee.property.name.toLowerCase();
+      const args = n.arguments;
+      if (HTTP.includes(method) && args.length >= 2) {
+        const p = strValue(args[0]);
+        if (p !== null && (p.startsWith("/") || p === "*")) routes.push({ method: method.toUpperCase(), path: p, framework, file, line: lineOf(n), provenance: prov(lineOf(n)) });
+      }
+      if (method === "route" && isNode(args[0]) && args[0].type === "ObjectExpression") {
+        let m = null;
+        let u = null;
+        for (const prop of args[0].properties) {
+          const k = isNode(prop.key) ? prop.key.name ?? prop.key.value : null;
+          if (k === "method") m = strValue(prop.value);
+          if (k === "url" || k === "path") u = strValue(prop.value);
+        }
+        if (m && u) routes.push({ method: m.toUpperCase(), path: u, framework, file, line: lineOf(n), provenance: prov(lineOf(n)) });
+      }
+    }
+    if ((n.type === "ClassDeclaration" || n.type === "ClassExpression") && Array.isArray(n.decorators)) {
+      let prefix = null;
+      for (const d of n.decorators) {
+        const expr = d.expression;
+        if (expr?.type === "CallExpression" && isNode(expr.callee) && expr.callee.name === "Controller") {
+          const a = expr.arguments[0];
+          prefix = strValue(a) ?? (isNode(a) && a.type === "ObjectExpression" ? null : "");
+        }
+      }
+      if (prefix === null) return;
+      const body = n.body.body;
+      for (const member of body) {
+        for (const d of member.decorators ?? []) {
+          const expr = d.expression;
+          if (expr?.type !== "CallExpression" || !isNode(expr.callee)) continue;
+          const name = expr.callee.name;
+          if (!["Get", "Post", "Put", "Patch", "Delete", "Options", "Head", "All"].includes(name)) continue;
+          const sub = strValue(expr.arguments[0]) ?? "";
+          const full = `/${[prefix, sub].filter(Boolean).join("/")}`.replace(/\/+/g, "/");
+          routes.push({ method: name.toUpperCase(), path: full, framework: "NestJS", file, line: lineOf(d), provenance: prov(lineOf(d)) });
+        }
+      }
+    }
+  });
+  return routes;
+}
+function regexRoutes(text, re, pick) {
+  const out = [];
+  for (const m of text.matchAll(re)) {
+    const r = pick(m);
+    if (!r) continue;
+    const line = text.slice(0, m.index).split("\n").length;
+    out.push([r.method, r.path, line]);
+  }
+  return out;
+}
+var toRoutes = (file, framework, rows) => (rows ?? []).map(([method, path7, line]) => ({ method, path: path7, framework, file, line: line ?? void 0, provenance: detected("code", [{ file, line: line ?? void 0 }], "medium") }));
+var JS_RE = /\.(m|c)?(t|j)sx?$/;
+var JS_FRAMEWORKS = ["Express", "Fastify", "Koa", "Hono", "NestJS"];
+var jsRoutesFact = {
+  id: "routes-js",
+  applies: (f) => JS_RE.test(f.path) && !f.large && !/\.(test|spec|d)\.[cm]?[jt]sx?$/.test(f.path),
+  when: (hints) => JS_FRAMEWORKS.some((n) => hints.frameworks.has(n)),
+  compute(text, rel) {
+    if (!text || !/\b(express|fastify|hono|koa|@nestjs\/common|Router)\b/.test(text)) return false;
+    const guess = /@nestjs\/common/.test(text) ? "NestJS" : /\bfastify\b/i.test(text) ? "Fastify" : /\bhono\b/.test(text) ? "Hono" : /\bkoa\b/.test(text) ? "Koa" : "Express";
+    return jsRoutes(rel, text, guess).map((r) => [r.method, r.path, r.framework, r.line ?? null]);
+  }
+};
+var NEXT_APP_RE = /(^|\/)(src\/)?app\/(.+\/)?route\.(t|j)sx?$/;
+var nextRouteFact = {
+  id: "routes-next-app",
+  applies: (f) => NEXT_APP_RE.test(f.path),
+  compute(text) {
+    const out = [];
+    if (!text) return out;
+    for (const m of text.matchAll(/export\s+(?:async\s+)?(?:function|const)\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\b/g)) out.push([m[1], text.slice(0, m.index).split("\n").length]);
+    return out;
+  }
+};
+async function nextRoutes(ctx) {
+  const out = [];
+  for (const f of ctx.find(NEXT_APP_RE)) {
+    const rows = await ctx.fact(f.path, nextRouteFact);
+    if (!rows) continue;
+    const seg = /(?:^|\/)(?:src\/)?app\/(.*)route\.(?:t|j)sx?$/.exec(f.path)?.[1] ?? "";
+    const urlPath = `/${seg.replace(/\/$/, "")}`.split("/").filter((s) => !/^\(.*\)$/.test(s) && !s.startsWith("@")).join("/") || "/";
+    for (const [method, line] of rows) out.push({ method, path: urlPath, framework: "Next.js (app router)", file: f.path, line, provenance: detected("code", [{ file: f.path, line }]) });
+  }
+  for (const f of ctx.find(/(^|\/)(src\/)?pages\/api\/.+\.(t|j)sx?$/)) {
+    const seg = /(?:^|\/)(?:src\/)?pages(\/api\/.+)\.(?:t|j)sx?$/.exec(f.path)?.[1] ?? "";
+    out.push({ method: "ANY", path: seg.replace(/\/index$/, ""), framework: "Next.js (pages API)", file: f.path, provenance: detected("filesystem", [{ file: f.path }]) });
+  }
+  return out;
+}
+var pyRoutesFact = {
+  id: "routes-python",
+  applies: (f) => /\.py$/.test(f.path),
+  compute(text) {
+    if (!text || !/@\w+\.(get|post|put|patch|delete|route|api_route)\(/.test(text)) return [];
+    return regexRoutes(text, /@(\w+)\.(get|post|put|patch|delete|options|head|route|api_route)\(\s*["']([^"']*)["']([^\n]*)/g, (m) => {
+      const verb = m[2];
+      if (verb === "route" || verb === "api_route") {
+        const methods = /methods\s*=\s*\[([^\]]+)\]/.exec(m[4])?.[1]?.replace(/["'\s]/g, "").toUpperCase();
+        return { method: methods || "GET", path: m[3] };
+      }
+      return { method: verb.toUpperCase(), path: m[3] };
+    });
+  }
+};
+var DJANGO_URLS_RE = /(^|\/)urls\.py$/;
+var djangoRoutesFact = {
+  id: "routes-django",
+  applies: (f) => DJANGO_URLS_RE.test(f.path),
+  compute: (text) => text ? regexRoutes(text, /\b(re_)?path\(\s*r?["']([^"']*)["']\s*,\s*([\w.]+)/g, (m) => ({ method: "ANY", path: `/${m[2]}` })) : []
+};
+var JAVA_RE = /\.(java|kt)$/;
+var springRoutesFact = {
+  id: "routes-spring",
+  applies: (f) => JAVA_RE.test(f.path),
+  compute(text) {
+    if (!text || !/@(Get|Post|Put|Patch|Delete|Request)Mapping/.test(text)) return [];
+    const prefix = /@RequestMapping\(\s*(?:value\s*=\s*|path\s*=\s*)?["']([^"']*)["']\s*\)\s*(?:@\w+(?:\([^)]*\))?\s*)*(?:public\s+)?(?:abstract\s+)?(?:class|interface)/.exec(text)?.[1] ?? "";
+    return regexRoutes(text, /@(Get|Post|Put|Patch|Delete)Mapping(?:\(\s*(?:value\s*=\s*|path\s*=\s*)?\{?\s*["']([^"']*)["'])?/g, (m) => ({ method: m[1].toUpperCase(), path: `${prefix}${m[2] ?? ""}` || "/" }));
+  }
+};
+var goRoutesFact = {
+  id: "routes-go",
+  applies: (f) => /\.go$/.test(f.path) && !f.path.endsWith("_test.go"),
+  compute(text) {
+    if (!text) return [];
+    return regexRoutes(text, /\.(GET|POST|PUT|PATCH|DELETE|Get|Post|Put|Patch|Delete|HandleFunc|Handle)\(\s*"([^"]+)"/g, (m) => {
+      const verb = m[1];
+      if (verb.startsWith("Handle")) {
+        const sp = /^(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\s+(\/.*)$/.exec(m[2]);
+        if (sp) return { method: sp[1], path: sp[2] };
+        return m[2].startsWith("/") ? { method: "ANY", path: m[2] } : null;
+      }
+      return m[2].startsWith("/") ? { method: verb.toUpperCase(), path: m[2] } : null;
+    });
+  }
+};
+var rustRoutesFact = {
+  id: "routes-rust",
+  applies: (f) => /\.rs$/.test(f.path),
+  compute(text) {
+    if (!text) return { axum: [], actix: [] };
+    return {
+      axum: regexRoutes(text, /\.route\(\s*"([^"]+)"\s*,\s*(get|post|put|patch|delete)/g, (m) => ({ method: m[2].toUpperCase(), path: m[1] })),
+      actix: regexRoutes(text, /#\[(get|post|put|patch|delete)\(\s*"([^"]+)"/g, (m) => ({ method: m[1].toUpperCase(), path: m[2] }))
+    };
+  }
+};
+var railsRoutesFact = {
+  id: "routes-rails",
+  applies: (f) => f.path === "config/routes.rb",
+  compute(text) {
+    if (!text) return false;
+    return [
+      ...regexRoutes(text, /^\s*(get|post|put|patch|delete)\s+["']([^"']+)["']/gm, (m) => ({ method: m[1].toUpperCase(), path: m[2].startsWith("/") ? m[2] : `/${m[2]}` })),
+      ...regexRoutes(text, /^\s*resources?\s+:(\w+)/gm, (m) => ({ method: "RESOURCE", path: `/${m[1]}` }))
+    ];
+  }
+};
+var LARAVEL_RE = /(^|\/)routes\/[^/]+\.php$/;
+var laravelRoutesFact = {
+  id: "routes-laravel",
+  applies: (f) => LARAVEL_RE.test(f.path),
+  compute: (text) => text ? regexRoutes(text, /Route::(get|post|put|patch|delete|any|resource|apiResource)\(\s*["']([^"']+)["']/g, (m) => ({ method: m[1].toUpperCase(), path: m[2].startsWith("/") ? m[2] : `/${m[2]}` })) : []
+};
+var aspnetRoutesFact = {
+  id: "routes-aspnet",
+  applies: (f) => /\.cs$/.test(f.path),
+  compute(text) {
+    if (!text) return [];
+    const rows = regexRoutes(text, /\.Map(Get|Post|Put|Patch|Delete)\(\s*"([^"]+)"/g, (m) => ({ method: m[1].toUpperCase(), path: m[2] }));
+    if (/\[Http(Get|Post|Put|Patch|Delete)/.test(text)) {
+      const prefix = /\[Route\(\s*"([^"]+)"\s*\)\]\s*(?:\[[^\]]+\]\s*)*public\s+(?:sealed\s+|partial\s+)*class/.exec(text)?.[1] ?? "";
+      rows.push(...regexRoutes(text, /\[Http(Get|Post|Put|Patch|Delete)(?:\(\s*"([^"]*)"\s*\))?\]/g, (m) => ({ method: m[1].toUpperCase(), path: `/${[prefix, m[2] ?? ""].filter(Boolean).join("/")}` })));
+    }
+    return rows;
+  }
+};
+var routesDetector = {
+  id: "routes",
+  version: 1,
+  facts: [jsRoutesFact, nextRouteFact, pyRoutesFact, djangoRoutesFact, springRoutesFact, goRoutesFact, rustRoutesFact, railsRoutesFact, laravelRoutesFact, aspnetRoutesFact],
+  async run(ctx) {
+    const { model } = ctx;
+    const routes = [];
+    const fw2 = new Set(model.frameworks.map((f) => f.name));
+    const push = (rs) => {
+      for (const r of rs) if (routes.length < MAX_ROUTES) routes.push(r);
+    };
+    if (fw2.has("Next.js")) push(await nextRoutes(ctx));
+    if (!fw2.has("Next.js") && (ctx.has("vercel.json") || fw2.has("Vercel Functions (Node)"))) {
+      for (const f of ctx.find(/^api\/.+\.(m|c)?(t|j)s$/)) {
+        if (/(^|\/)_|\.(test|spec|d)\./.test(f.path)) continue;
+        const urlPath = `/${f.path.replace(/\.(m|c)?(t|j)s$/, "").replace(/\/index$/, "")}`;
+        routes.push({ method: "ANY", path: urlPath, framework: "Vercel Functions", file: f.path, provenance: detected("filesystem", [{ file: f.path, detail: "Vercel api/ directory convention" }], "medium") });
+      }
+    }
+    const jsFrameworks = JS_FRAMEWORKS.filter((n) => fw2.has(n));
+    if (jsFrameworks.length) {
+      for (const f of ctx.find(JS_RE)) {
+        if (f.large || /\.(test|spec|d)\.[cm]?[jt]sx?$/.test(f.path)) continue;
+        const rows = await ctx.fact(f.path, jsRoutesFact);
+        if (!rows) continue;
+        push(rows.map(([method, path7, framework, line]) => ({ method, path: path7, framework, file: f.path, line: line ?? void 0, provenance: detected("code", [{ file: f.path, line: line ?? void 0 }], "high") })));
+      }
+    }
+    const pyFw = ["FastAPI", "Flask", "Starlette", "Litestar"].some((n) => fw2.has(n));
+    if (pyFw) {
+      for (const f of ctx.find(/\.py$/)) push(toRoutes(f.path, fw2.has("FastAPI") ? "FastAPI" : "Flask", await ctx.fact(f.path, pyRoutesFact)));
+    }
+    if (fw2.has("Django")) {
+      for (const f of ctx.find(DJANGO_URLS_RE)) push(toRoutes(f.path, "Django", await ctx.fact(f.path, djangoRoutesFact)));
+    }
+    for (const f of ctx.find(JAVA_RE)) push(toRoutes(f.path, "Spring", await ctx.fact(f.path, springRoutesFact)));
+    for (const f of ctx.find(/\.go$/)) {
+      if (f.path.endsWith("_test.go")) continue;
+      push(toRoutes(f.path, "Go", await ctx.fact(f.path, goRoutesFact)));
+    }
+    for (const f of ctx.find(/\.rs$/)) {
+      const v = await ctx.fact(f.path, rustRoutesFact);
+      if (!v) continue;
+      push(toRoutes(f.path, "Axum", v.axum));
+      push(toRoutes(f.path, "Actix/Rocket", v.actix));
+    }
+    if (ctx.has("config/routes.rb")) {
+      const rows = await ctx.fact("config/routes.rb", railsRoutesFact);
+      if (rows) push(toRoutes("config/routes.rb", "Rails", rows));
+    }
+    for (const f of ctx.find(LARAVEL_RE)) push(toRoutes(f.path, "Laravel", await ctx.fact(f.path, laravelRoutesFact)));
+    for (const f of ctx.find(/\.cs$/)) push(toRoutes(f.path, "ASP.NET Core", await ctx.fact(f.path, aspnetRoutesFact)));
+    model.routes = routes.sort((a, b) => a.path.localeCompare(b.path) || a.method.localeCompare(b.method));
+    if (routes.length >= MAX_ROUTES) ctx.warn(`Route listing truncated at ${MAX_ROUTES} entries.`);
+    for (const f of ctx.find(/(^|\/)(openapi|swagger)[^/]*\.(json|ya?ml)$/i)) model.apiSpecs.push({ path: f.path, kind: "openapi" });
+    for (const f of ctx.find(/\.(graphql|gql)$/)) model.apiSpecs.push({ path: f.path, kind: "graphql" });
+    for (const f of ctx.find(/\.proto$/)) model.apiSpecs.push({ path: f.path, kind: "grpc" });
+  }
+};
+
+// src/core/analyzer/detectors/auth.ts
+var MIDDLEWARE_RE = /(^|\/)(src\/)?middleware\.(t|j)s$/;
+var ROLE_FILE_RE = /\.(prisma|ts|tsx|py|java|kt|cs|go|rb|php)$/;
+var MAX_ROLE_EVIDENCE = 10;
+var middlewareFact = {
+  id: "auth-middleware",
+  applies: (f) => MIDDLEWARE_RE.test(f.path),
+  compute: (text) => !!text && /(auth|session|token|redirect\(.*login)/i.test(text)
+};
+var roleDefsFact = {
+  id: "auth-role-defs",
+  applies: (f) => ROLE_FILE_RE.test(f.path) && !f.large,
+  compute(text) {
+    const out = [];
+    if (!text || !/role|permission/i.test(text)) return out;
+    for (const m of text.matchAll(/\b(?:enum|class|type|interface)\s+(\w*(?:Role|Permission)s?)\b/g)) {
+      out.push([m[1], text.slice(0, m.index).split("\n").length]);
+      if (out.length >= MAX_ROLE_EVIDENCE) break;
+    }
+    return out;
+  }
+};
+var authDetector = {
+  id: "auth",
+  version: 1,
+  facts: [middlewareFact, roleDefsFact],
+  async run(ctx) {
+    const { model } = ctx;
+    const authFiles = ctx.find((f) => !f.binary && /\.(m|c)?(t|j)sx?$|\.(py|go|rs|java|kt|cs|php|rb|ex)$/.test(f.path) && /(^|\/)[^/]*(auth|session|login|oauth|jwt|guard|permission|rbac|acl|polic(y|ies))[^/]*$/i.test(f.path) && !/\.(test|spec)\./.test(f.path));
+    if (authFiles.length) {
+      model.auth.push({
+        name: `Auth-related source files (${authFiles.length})`,
+        kind: "middleware",
+        provenance: inferred("filesystem", authFiles.slice(0, 8).map((f) => ({ file: f.path, detail: "file name suggests auth concern" })), "low")
+      });
+    }
+    for (const f of ctx.find(MIDDLEWARE_RE)) {
+      if (await ctx.fact(f.path, middlewareFact)) {
+        model.auth.push({ name: "Next.js middleware referencing auth/session", kind: "middleware", provenance: detected("code", [{ file: f.path }], "medium") });
+      }
+    }
+    const roleEvidence = [];
+    for (const f of ctx.find(ROLE_FILE_RE)) {
+      if (f.large || roleEvidence.length >= MAX_ROLE_EVIDENCE) continue;
+      const defs = await ctx.fact(f.path, roleDefsFact);
+      if (!defs) continue;
+      for (const [name, line] of defs) {
+        roleEvidence.push({ file: f.path, line, detail: `definition "${name}"` });
+        if (roleEvidence.length >= MAX_ROLE_EVIDENCE) break;
+      }
+    }
+    for (const e of model.dbEntities) {
+      if (/^(roles?|permissions?|user_roles?|role_permissions?)$/i.test(e.name)) roleEvidence.push({ file: e.file, line: e.provenance.evidence[0]?.line ?? 1, detail: `database entity "${e.name}"` });
+    }
+    if (roleEvidence.length) {
+      model.auth.push({ name: "Role/permission definitions", kind: "middleware", provenance: detected("code", roleEvidence, "medium") });
+    }
+  }
+};
+
+// src/core/analyzer/detectors/entrypoints.ts
+var CONVENTIONAL = /(^|\/)(src\/)?(main|index|server|app|cli)\.(m|c)?(t|j)sx?$|(^|\/)(main|app|wsgi|asgi|manage|__main__)\.py$|(^|\/)(cmd\/[^/]+\/)?main\.go$|(^|\/)src\/(main|lib)\.rs$|(^|\/)Program\.cs$|(^|\/)[A-Za-z]+Application\.(java|kt)$|(^|\/)lib\/main\.dart$|(^|\/)public\/index\.php$|(^|\/)config\.ru$/;
+var entryPointsDetector = {
+  id: "entrypoints",
+  version: 1,
+  async run(ctx) {
+    const known = new Set(ctx.model.entryPoints.map((e) => e.path));
+    const candidates = ctx.find((f) => CONVENTIONAL.test(f.path) && f.path.split("/").length <= 5 && !/(^|\/)(test|tests|__tests__|examples?|fixtures?)\//.test(f.path));
+    for (const f of candidates.slice(0, 30)) {
+      if (known.has(f.path)) continue;
+      ctx.model.entryPoints.push({ path: f.path, provenance: inferred("filesystem", [{ file: f.path, detail: "conventional entry-point file name" }], "medium") });
+    }
+  }
+};
+
+// src/core/analyzer/detectors/secrets.ts
+import { promises as fs4 } from "fs";
+import path4 from "path";
+import crypto2 from "crypto";
+var SKIP = /(^|\/)(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lock|poetry\.lock|uv\.lock|Cargo\.lock|go\.sum|composer\.lock|Gemfile\.lock|pubspec\.lock)$|\.(min\.js|map|svg|snap)$/;
+var MAX_SECRET_FINDINGS = 500;
+async function secretFingerprinter(root) {
+  return (await secretFingerprintKey(root)).fingerprint;
+}
+async function secretFingerprintKey(root, saltOverride) {
+  try {
+    let salt = saltOverride;
+    if (!salt) salt = (await readLocalConfig(root)).salt;
+    if (!salt) {
+      const hasDir = await fs4.stat(path4.join(root, ATHENA_DIR)).then((s) => s.isDirectory(), () => false);
+      if (hasDir) salt = await getOrCreateSalt(root);
+    }
+    if (salt) {
+      const key = salt;
+      return { fingerprint: (value) => keyedFingerprint(key, value), fingerprintKeyId: crypto2.createHash("sha256").update(`athena-fingerprint-key:${key}`).digest("hex").slice(0, 12) };
+    }
+  } catch {
+  }
+  return { fingerprint: ephemeralFingerprint, fingerprintKeyId: null };
+}
+async function scanFilesForSecrets(files, read, opts) {
+  const findings = opts.into ?? [];
+  const max = opts.max ?? MAX_SECRET_FINDINGS;
+  const stats = { skippedLongLines: 0 };
+  let truncated = false;
+  for (const f of files) {
+    if (f.binary || f.large || SKIP.test(f.path)) continue;
+    if (findings.length >= max) {
+      truncated = true;
+      break;
+    }
+    opts.signal?.throwIfAborted();
+    const text = await read(f.path);
+    if (!text) continue;
+    for (const m of scanText(text, { fingerprint: opts.fingerprint, stats })) findings.push({ type: m.type, file: f.path, line: m.line, fingerprint: m.fingerprint });
+  }
+  return { findings, truncated, skippedLongLines: stats.skippedLongLines };
+}
+var secretsFact = {
+  id: "secrets",
+  keyed: true,
+  applies: (f) => !f.binary && !f.large && !SKIP.test(f.path),
+  compute(text, _rel, rt) {
+    if (!text) return [];
+    return scanText(text, { fingerprint: rt.fingerprint }).map((m) => [m.type, m.line, m.fingerprint]);
+  }
+};
+var secretsDetector = {
+  id: "secrets",
+  version: 2,
+  facts: [secretsFact],
+  async run(ctx) {
+    const findings = ctx.model.security.secrets;
+    let truncated = false;
+    for (const f of ctx.files) {
+      if (f.binary || f.large || SKIP.test(f.path)) continue;
+      if (findings.length >= MAX_SECRET_FINDINGS) {
+        truncated = true;
+        break;
+      }
+      ctx.signal?.throwIfAborted();
+      const rows = await ctx.fact(f.path, secretsFact);
+      if (!rows) continue;
+      for (const [type, line, fingerprint] of rows) findings.push({ type, file: f.path, line, fingerprint });
+    }
+    if (truncated) ctx.warn(`Secret scan stopped after ${MAX_SECRET_FINDINGS} findings.`);
+  }
+};
+
+// src/core/analyzer/analyze.ts
+var DETECTORS = [
+  structureDetector,
+  manifestsDetector,
+  dependenciesDetector,
+  envDetector,
+  infraDetector,
+  testsDetector,
+  databaseDetector,
+  routesDetector,
+  authDetector,
+  entryPointsDetector,
+  secretsDetector
+];
+var FACTS_REVISION = 1;
+var DETECTORS_VERSION = `${FACTS_REVISION};${DETECTORS.map((d) => `${d.id}@${d.version}`).join(",")}`;
+var ALL_FACTS = DETECTORS.flatMap((d) => d.facts ?? []);
+var pendingCaches = /* @__PURE__ */ new WeakMap();
+async function isDir(p) {
+  return fs5.stat(p).then((s) => s.isDirectory(), () => false);
+}
+async function analyzeProject(rootInput, opts = {}) {
+  const started = Date.now();
+  const root = await fs5.realpath(path5.resolve(rootInput));
+  const loaded = opts.config ? { config: opts.config } : await loadConfig(root);
+  const config = loaded.config;
+  const model = emptyModel(path5.basename(root), root);
+  if ("warning" in loaded && loaded.warning) model.warnings.push(loaded.warning);
+  const athena = path5.join(root, ATHENA_DIR);
+  const useCache = opts.cache !== false && await isDir(athena);
+  const reuse = opts.reuse ?? (useCache ? await readFileIndex(athena) : void 0);
+  opts.onStage?.("scan");
+  const configHash = factsConfigHash(config);
+  const walkStarted = Date.now();
+  const [excludeText, prevWalk] = await Promise.all([readExclude(root), opts.incremental ? incrementalWalk(root, config, configHash, opts.incremental, opts.signal) : null]);
+  const matcher = prevWalk ? opts.incremental.snapshot.matcher : await IgnoreMatcher.load(root, config);
+  const walk2 = prevWalk ?? await walkProject(root, { config, signal: opts.signal, reuse, deferRead: true, matcher });
+  model.warnings.push(...walk2.warnings);
+  const runtime = await secretFingerprintKey(root, opts.fingerprintSalt);
+  const cache = await FactsCache.open(useCache ? athena : null, { detectors: DETECTORS_VERSION, config: configHash });
+  const engine = new FactEngine({ root, files: walk2.files, cache, runtime, defs: ALL_FACTS, signal: opts.signal, readFile: opts.readFile, textCacheBytes: opts.textCacheBytes });
+  await cache.preload(walk2.files.filter((f) => f.hash && !f.binary && !f.large).map((f) => f.hash));
+  const gated = ALL_FACTS.filter((d) => d.when);
+  const needHints = walk2.files.some((f) => !f.large && gated.some((d) => d.applies(f) && (f.hash === "" || !f.binary && !cache.has(f.hash, engine.keyOf(d, f.path)))));
+  engine.hints = needHints ? await projectHints(root, config, walk2.files, engine, opts.signal) : { frameworks: /* @__PURE__ */ new Set() };
+  const todo = walk2.files.filter((f) => engine.needsProcessing(f));
+  await mapLimit(todo, 32, (f) => engine.process(f));
+  opts.signal?.throwIfAborted();
+  const files = engine.unreadable.size ? walk2.files.filter((f) => !engine.unreadable.has(f.path)) : walk2.files;
+  let skippedBinary = 0;
+  let skippedLarge = 0;
+  for (const f of files) {
+    if (f.binary) skippedBinary++;
+    if (f.large) skippedLarge++;
+  }
+  model.stats = { filesScanned: files.length, skippedBinary, skippedLarge, skippedUnreadable: walk2.skippedUnreadable + engine.unreadable.size };
+  opts.onStage?.("detect");
+  const ctx = createContext(root, config, files, model, engine, opts.signal);
+  for (const d of DETECTORS) {
+    opts.signal?.throwIfAborted();
+    const t = Date.now();
+    try {
+      await d.run(ctx);
+    } catch (err) {
+      if (opts.signal?.aborted) throw err;
+      model.warnings.push(`Detector "${d.id}" failed: ${err.message}`);
+    }
+    opts.onDetector?.(d.id, Date.now() - t);
+  }
+  opts.onStage?.("git");
+  model.git = await gitInfo(root);
+  opts.onStage?.("finalize");
+  const redacted = redactDeep(model);
+  const check = ProjectModel.safeParse(redacted);
+  if (!check.success) redacted.warnings.push(`Internal model validation issue: ${check.error.issues[0]?.path.join(".")} ${check.error.issues[0]?.message}`);
+  const live = new Set(files.map((f) => f.hash));
+  const result = {
+    model: redacted,
+    files,
+    config,
+    detectorVersions: Object.fromEntries(DETECTORS.map((d) => [d.id, d.version])),
+    durationMs: 0,
+    perf: { ...engine.stats, cache: cache.stats },
+    walkMode: prevWalk ? "incremental" : "full",
+    snapshot: {
+      files,
+      configHash,
+      maxFiles: config.maxFiles,
+      excludeText,
+      matcher,
+      // An incremental walk inherits reusability from the snapshot it started from.
+      reusable: engine.unreadable.size === 0 && (prevWalk ? true : !walk2.truncated && walk2.symlinks === 0 && walk2.skippedUnreadable === 0),
+      takenAt: prevWalk ? opts.incremental.snapshot.takenAt : walkStarted
+    }
+  };
+  if (useCache) {
+    try {
+      await cache.save(athena, live);
+    } catch {
+    }
+  } else if (opts.cache !== false) pendingCaches.set(result, { cache, live });
+  result.durationMs = Date.now() - started;
+  return result;
+}
+async function persistAnalysisCache(result, athenaDir2) {
+  const pending = pendingCaches.get(result);
+  if (!pending) return;
+  pendingCaches.delete(result);
+  try {
+    await pending.cache.save(athenaDir2, pending.live);
+  } catch {
+  }
+}
+async function projectHints(root, config, files, engine, signal) {
+  const scratch = emptyModel(path5.basename(root), root);
+  const ctx = createContext(root, config, files, scratch, engine, signal);
+  try {
+    await manifestsDetector.run(ctx);
+    await dependenciesDetector.run(ctx);
+  } catch (err) {
+    if (signal?.aborted) throw err;
+  }
+  return { frameworks: new Set(scratch.frameworks.map((f) => f.name)) };
+}
+function redactDeep(value, memo = /* @__PURE__ */ new Map()) {
+  if (typeof value === "string") {
+    let r = memo.get(value);
+    if (r === void 0) {
+      r = redact(value);
+      memo.set(value, r);
+    }
+    return r;
+  }
+  if (Array.isArray(value)) return value.map((v) => redactDeep(v, memo));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) out[k] = redactDeep(v, memo);
+    return out;
+  }
+  return value;
+}
+
+// src/core/model/security-scan.ts
+import { z as z3 } from "zod";
+import path6 from "path";
+var SCAN_FILE = "security-scan.json";
+var SEVERITIES = ["critical", "high", "moderate", "low", "unrated"];
+var SEVERITY_ORDER = [...SEVERITIES];
+var RATED_SEVERITIES = ["critical", "high", "moderate", "low"];
+var legacySeverity = (v) => v === "unknown" ? "unrated" : v;
+var Severity = z3.preprocess(legacySeverity, z3.enum(SEVERITIES));
+var Vulnerability = z3.object({
+  package: z3.string(),
+  severity: Severity,
+  title: z3.string(),
+  id: z3.string().optional(),
+  url: z3.string().optional(),
+  vulnerableRange: z3.string().optional(),
+  fixAvailable: z3.boolean().optional()
+});
+var ToolResult = z3.object({
+  tool: z3.string(),
+  ecosystem: z3.string(),
+  /** What was audited when a tool runs once per input (e.g. a requirements file). */
+  target: z3.string().optional(),
+  /** ok: ran and produced results · unavailable: not installed / nothing to audit · failed/timeout: ran but no usable output */
+  status: z3.enum(["ok", "unavailable", "failed", "timeout"]),
+  message: z3.string().optional(),
+  durationMs: z3.number(),
+  findings: z3.array(Vulnerability)
+});
+var Counts = z3.preprocess(
+  (v) => {
+    if (!v || typeof v !== "object") return v;
+    const { unknown, ...rest } = v;
+    return { critical: 0, high: 0, moderate: 0, low: 0, unrated: 0, ...rest, ...typeof unknown === "number" ? { unrated: (rest.unrated ?? 0) + unknown } : {} };
+  },
+  z3.object({ critical: z3.number(), high: z3.number(), moderate: z3.number(), low: z3.number(), unrated: z3.number() })
+);
+var SecurityScan = z3.object({
+  schemaVersion: z3.literal(1),
+  scannedAt: z3.string(),
+  durationMs: z3.number(),
+  tools: z3.array(ToolResult),
+  counts: Counts,
+  secrets: z3.object({
+    count: z3.number(),
+    files: z3.array(z3.string()),
+    /** Lines longer than 4096 chars on which generic keyword patterns were not applied. */
+    skippedLongLines: z3.number().optional(),
+    truncated: z3.boolean().optional()
+  })
+});
+var loadScan = (root) => loadScanFromDir(athenaDir(root));
+async function saveScan(root, scan) {
+  await writeFileAtomic(path6.join(athenaDir(root), SCAN_FILE), `${JSON.stringify(scan, null, 2)}
+`);
+}
+async function loadScanFromDir(dir) {
+  const raw = await readTextIfExists(path6.join(dir, SCAN_FILE));
+  if (!raw) return null;
+  try {
+    const parsed = SecurityScan.safeParse(JSON.parse(raw));
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}
+function unratedFindings(scan) {
+  return scan.tools.flatMap((t) => t.status === "ok" ? t.findings.filter((f) => f.severity === "unrated") : []);
+}
+function meetsThreshold(scan, level, opts = {}) {
+  const max = SEVERITY_ORDER.indexOf(level);
+  const unrated = opts.unrated ?? "fail";
+  return scan.tools.some(
+    (t) => t.findings.some((f) => {
+      if (f.severity === "unrated") return unrated === "fail";
+      return SEVERITY_ORDER.indexOf(f.severity) <= max;
+    })
+  );
+}
+
+export {
+  ProjectModel,
+  readExclude,
+  manifestDependencyNames,
+  REAL_ENV_NAMES,
+  secretFingerprinter,
+  scanFilesForSecrets,
+  analyzeProject,
+  persistAnalysisCache,
+  redactDeep,
+  SCAN_FILE,
+  SEVERITY_ORDER,
+  RATED_SEVERITIES,
+  SecurityScan,
+  loadScan,
+  saveScan,
+  loadScanFromDir,
+  unratedFindings,
+  meetsThreshold
+};
+//# sourceMappingURL=chunk-PANVPNYF.js.map