querydig 0.0.0-stage → 0.1.1

package/dist/chunk-WTZLJ5ZV.js

@@ -0,0 +1,474 @@
+import {
+  RULES,
+  RULE_MAP,
+  SUPPORTED_EXTENSIONS,
+  analyzeFile
+} from "./chunk-VAYEO4RI.js";
+
+// src/config.ts
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+var CONFIG_FILES = ["querydig.config.json", ".querydigrc.json", ".querydigrc"];
+var DEFAULT_IGNORE = [
+  "**/node_modules/**",
+  "**/dist/**",
+  "**/build/**",
+  "**/out/**",
+  "**/.next/**",
+  "**/.nuxt/**",
+  "**/coverage/**",
+  "**/vendor/**",
+  "**/.git/**",
+  "**/.venv/**",
+  "**/venv/**",
+  "**/__pycache__/**",
+  "**/site-packages/**",
+  "**/*.min.js",
+  "**/*.bundle.js",
+  "**/*.d.ts",
+  "**/.querydig/**"
+];
+var TEST_IGNORE = [
+  "**/*.test.*",
+  "**/*.spec.*",
+  "**/*_test.go",
+  "**/test_*.py",
+  "**/*_test.py",
+  "**/tests/**",
+  "**/test/**",
+  "**/__tests__/**",
+  "**/__mocks__/**",
+  "**/spec/**",
+  "**/specs/**",
+  "**/benchmark/**",
+  "**/benchmarks/**",
+  "**/bench/**",
+  "**/e2e/**",
+  "**/fixtures/**",
+  "**/migrations/**",
+  "**/migration/**",
+  "**/*migration*/**",
+  "**/alembic/**",
+  "**/tests.py",
+  "**/conftest.py",
+  "**/testdata/**",
+  "**/testutil/**",
+  "**/unittest/**",
+  "**/testing/**",
+  "**/seed/**",
+  "**/seeds/**",
+  "**/seeders/**"
+];
+function loadConfig(root, explicit) {
+  const candidates = explicit ? [explicit] : CONFIG_FILES.map((f) => join(root, f));
+  for (const file of candidates) {
+    if (!existsSync(file)) continue;
+    try {
+      return JSON.parse(readFileSync(file, "utf8"));
+    } catch (e) {
+      throw new Error(`querydig: invalid config ${file}: ${e.message}`);
+    }
+  }
+  return {};
+}
+
+// src/report/formats.ts
+function renderJson(s) {
+  return JSON.stringify(s, null, 2);
+}
+var SARIF_LEVEL = { critical: "error", high: "error", medium: "warning", low: "note", info: "note" };
+var SECURITY_SEVERITY = { critical: "9.0", high: "7.0", medium: "5.0", low: "3.0", info: "1.0" };
+function renderSarif(s) {
+  const used = new Set(s.findings.map((f) => f.ruleId));
+  const rules = RULES.filter((r) => used.has(r.id));
+  const sarif = {
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [{
+      tool: {
+        driver: {
+          name: "querydig",
+          version: s.version,
+          informationUri: "https://www.npmjs.com/package/querydig",
+          rules: rules.map((r) => ({
+            id: r.id,
+            name: r.name,
+            shortDescription: { text: r.title },
+            fullDescription: { text: r.why },
+            help: { text: r.fix, markdown: `**Why:** ${r.why}
+
+**Fix:** ${r.fix}` },
+            defaultConfiguration: { level: SARIF_LEVEL[r.severity] },
+            properties: { tags: ["performance", "database", r.db], "security-severity": SECURITY_SEVERITY[r.severity] }
+          }))
+        }
+      },
+      results: s.findings.map((f) => ({
+        ruleId: f.ruleId,
+        ruleIndex: rules.findIndex((r) => r.id === f.ruleId),
+        level: SARIF_LEVEL[f.severity],
+        message: { text: `${f.message} Fix: ${f.fix}` },
+        locations: [{ physicalLocation: { artifactLocation: { uri: f.file }, region: { startLine: f.line, startColumn: f.column } } }],
+        partialFingerprints: { querydig: f.fingerprint },
+        properties: { severity: f.severity, db: f.db, confidence: f.confidence }
+      }))
+    }]
+  };
+  return JSON.stringify(sarif, null, 2);
+}
+var EMOJI = { critical: "\u{1F534}", high: "\u{1F7E0}", medium: "\u{1F7E1}", low: "\u{1F535}", info: "\u26AA" };
+function renderMarkdown(s, limit = 50) {
+  const o = [];
+  o.push(`## querydig \u2014 query performance report`);
+  o.push("");
+  o.push(`**Health: ${s.grade} (${s.score}/100)** \xB7 ${s.filesScanned} files \xB7 ${s.findings.length} issue(s)` + (s.suppressedByBaseline ? ` \xB7 ${s.suppressedByBaseline} hidden by baseline` : ""));
+  o.push("");
+  o.push("| Severity | Count |");
+  o.push("|---|---|");
+  for (const k of ["critical", "high", "medium", "low"]) o.push(`| ${EMOJI[k]} ${k} | ${s.bySeverity[k]} |`);
+  o.push("");
+  if (!s.findings.length) {
+    o.push("\u2705 No query performance issues found.");
+    return o.join("\n");
+  }
+  o.push("| | Rule | Location | Issue |");
+  o.push("|---|---|---|---|");
+  for (const f of s.findings.slice(0, limit)) {
+    o.push(`| ${EMOJI[f.severity]} | \`${f.ruleId}\` ${RULE_MAP.get(f.ruleId)?.name ?? ""} | \`${f.file}:${f.line}\` | ${f.message.replace(/\|/g, "\\|")} |`);
+  }
+  if (s.findings.length > limit) o.push(`
+\u2026and ${s.findings.length - limit} more.`);
+  o.push("");
+  o.push("<details><summary>How to fix</summary>\n");
+  for (const id of Object.keys(s.byRule)) {
+    const r = RULE_MAP.get(id);
+    if (r) o.push(`- **${r.id} ${r.title}** \u2014 ${r.fix}`);
+  }
+  o.push("\n</details>");
+  return o.join("\n");
+}
+
+// src/report/html.ts
+function renderHtml(s) {
+  const used = new Set(s.findings.map((f) => f.ruleId));
+  const data = {
+    summary: { root: s.root, files: s.filesScanned, ms: s.durationMs, grade: s.grade, score: s.score, bySeverity: s.bySeverity, baseline: s.suppressedByBaseline, version: s.version, generated: (/* @__PURE__ */ new Date()).toISOString() },
+    findings: s.findings,
+    rules: RULES.filter((r) => used.has(r.id))
+  };
+  const json = JSON.stringify(data).replace(/</g, "\\u003c");
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>querydig report</title>
+<style>
+:root{--bg:#f7f7f5;--panel:#fff;--ink:#1b1b1f;--muted:#6b6b76;--line:#e4e4e0;--code:#f1f1ee;
+--crit:#b3261e;--high:#d9480f;--med:#b7791f;--low:#2b6cb0;--ok:#2f855a;--chip:#efefec}
+@media (prefers-color-scheme: dark){:root{--bg:#121214;--panel:#1b1b1f;--ink:#ececf1;--muted:#9a9aa6;--line:#2c2c33;--code:#232329;
+--crit:#ff6b60;--high:#ff922b;--med:#f2c94c;--low:#74b0ff;--ok:#5fd39a;--chip:#26262c}}
+*{box-sizing:border-box}
+body{margin:0;background:var(--bg);color:var(--ink);font:14px/1.5 ui-sans-serif,system-ui,-apple-system,"Segoe UI",sans-serif}
+main{max-width:1100px;margin:0 auto;padding:32px 16px 64px}
+h1{font-size:22px;margin:0 0 4px;letter-spacing:-.01em}
+.sub{color:var(--muted);margin-bottom:24px;word-break:break-all}
+.cards{display:grid;grid-template-columns:repeat(auto-fit,minmax(140px,1fr));gap:12px;margin-bottom:24px}
+.card{background:var(--panel);border:1px solid var(--line);border-radius:10px;padding:14px 16px}
+.card .k{color:var(--muted);font-size:12px;text-transform:uppercase;letter-spacing:.06em}
+.card .v{font-size:28px;font-weight:650;font-variant-numeric:tabular-nums}
+.grade .v{font-size:34px}
+.c-critical{color:var(--crit)}.c-high{color:var(--high)}.c-medium{color:var(--med)}.c-low{color:var(--low)}
+.bar{display:flex;height:8px;border-radius:4px;overflow:hidden;background:var(--chip);margin-bottom:24px}
+.bar span{display:block}
+.controls{display:flex;flex-wrap:wrap;gap:8px;margin-bottom:16px;align-items:center}
+.controls input,.controls select{background:var(--panel);color:var(--ink);border:1px solid var(--line);border-radius:8px;padding:7px 10px;font:inherit}
+.controls input{flex:1;min-width:200px}
+.chip{border:1px solid var(--line);background:var(--panel);color:var(--ink);border-radius:999px;padding:5px 12px;cursor:pointer;font:inherit}
+.chip[aria-pressed=false]{opacity:.45}
+.f{background:var(--panel);border:1px solid var(--line);border-left:4px solid var(--line);border-radius:10px;padding:14px 16px;margin-bottom:10px}
+.f.critical{border-left-color:var(--crit)}.f.high{border-left-color:var(--high)}.f.medium{border-left-color:var(--med)}.f.low{border-left-color:var(--low)}
+.f h3{margin:0;font-size:15px;display:flex;gap:8px;flex-wrap:wrap;align-items:baseline}
+.sev{font-size:11px;font-weight:700;text-transform:uppercase;letter-spacing:.06em}
+.rid{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;color:var(--muted);font-size:12px}
+.loc{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:12px;color:var(--muted);margin:4px 0 8px;word-break:break-all}
+pre{background:var(--code);border-radius:8px;padding:10px 12px;overflow-x:auto;margin:8px 0;font:12.5px/1.45 ui-monospace,SFMono-Regular,Menlo,monospace}
+.fix{color:var(--ok)}
+.tag{background:var(--chip);border-radius:6px;padding:1px 7px;font-size:11px;color:var(--muted)}
+details{margin-top:6px}summary{cursor:pointer;color:var(--muted)}
+.empty{text-align:center;color:var(--muted);padding:48px 0}
+footer{color:var(--muted);font-size:12px;margin-top:32px}
+</style>
+</head>
+<body>
+<main>
+<h1>Query performance report</h1>
+<div class="sub" id="sub"></div>
+<div class="cards" id="cards"></div>
+<div class="bar" id="bar"></div>
+<div class="controls">
+  <input id="q" type="search" placeholder="Filter by file, rule or message\u2026" aria-label="Filter findings">
+  <select id="rule" aria-label="Rule"><option value="">All rules</option></select>
+  <select id="db" aria-label="Database"><option value="">All databases</option><option>mongodb</option><option>sql</option><option>unknown</option></select>
+  <span id="sevchips"></span>
+</div>
+<div id="list"></div>
+<footer id="foot"></footer>
+</main>
+<script>
+const D=${json};
+const SEV=['critical','high','medium','low','info'];
+const esc=s=>String(s).replace(/[&<>"']/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]));
+const S=D.summary, on=new Set(['critical','high','medium','low','info']);
+document.getElementById('sub').textContent=S.root+' \xB7 '+S.files+' files \xB7 '+(S.ms/1000).toFixed(2)+'s'+(S.baseline?' \xB7 '+S.baseline+' hidden by baseline':'');
+const gc={A:'var(--ok)',B:'var(--ok)',C:'var(--med)',D:'var(--high)',F:'var(--crit)'}[S.grade];
+document.getElementById('cards').innerHTML='<div class="card grade"><div class="k">Health</div><div class="v" style="color:'+gc+'">'+S.grade+' <small style="font-size:14px;color:var(--muted)">'+S.score+'/100</small></div></div>'+
+ ['critical','high','medium','low'].map(k=>'<div class="card"><div class="k">'+k+'</div><div class="v c-'+k+'">'+S.bySeverity[k]+'</div></div>').join('');
+const tot=D.findings.length||1;
+document.getElementById('bar').innerHTML=['critical','high','medium','low'].map(k=>'<span style="width:'+(S.bySeverity[k]/tot*100)+'%;background:var(--'+({critical:'crit',high:'high',medium:'med',low:'low'}[k])+')"></span>').join('');
+const rsel=document.getElementById('rule');
+D.rules.forEach(r=>{const o=document.createElement('option');o.value=r.id;o.textContent=r.id+' '+r.title;rsel.appendChild(o)});
+const chips=document.getElementById('sevchips');
+['critical','high','medium','low'].forEach(k=>{const b=document.createElement('button');b.className='chip c-'+k;b.textContent=k;b.setAttribute('aria-pressed','true');
+ b.onclick=()=>{on.has(k)?on.delete(k):on.add(k);b.setAttribute('aria-pressed',on.has(k));render()};chips.appendChild(b)});
+const RM=Object.fromEntries(D.rules.map(r=>[r.id,r]));
+function render(){
+ const q=document.getElementById('q').value.toLowerCase(), rule=rsel.value, db=document.getElementById('db').value;
+ const fs=D.findings.filter(f=>on.has(f.severity)&&(!rule||f.ruleId===rule)&&(!db||f.db===db)&&(!q||(f.file+' '+f.ruleId+' '+f.message+' '+f.title).toLowerCase().includes(q)));
+ const L=document.getElementById('list');
+ if(!fs.length){L.innerHTML='<div class="empty">'+(D.findings.length?'No findings match the filters.':'\u2714 No query performance issues found.')+'</div>';return}
+ L.innerHTML=fs.slice(0,1000).map(f=>{const r=RM[f.ruleId]||{};return '<div class="f '+f.severity+'"><h3><span class="sev c-'+f.severity+'">'+f.severity+'</span><span class="rid">'+f.ruleId+'</span>'+esc(f.title)+' <span class="tag">'+f.db+'</span><span class="tag">'+f.confidence+' confidence</span></h3>'+
+  '<div class="loc">'+esc(f.file)+':'+f.line+':'+f.column+'</div><pre>'+esc(f.snippet)+'</pre><div>'+esc(f.message)+'</div><div class="fix"><b>Fix:</b> '+esc(f.fix)+'</div>'+
+  (r.why?'<details><summary>Why is this slow?</summary><p>'+esc(r.why)+'</p>'+(r.example?'<div>Before</div><pre>'+esc(r.example.bad)+'</pre><div>After</div><pre>'+esc(r.example.good)+'</pre>':'')+'</details>':'')+'</div>'}).join('')+(fs.length>1000?'<div class="empty">Showing first 1000 of '+fs.length+'</div>':'');
+}
+['q','db'].forEach(id=>document.getElementById(id).addEventListener('input',render));rsel.addEventListener('input',render);
+document.getElementById('foot').textContent='Generated by querydig v'+S.version+' on '+new Date(S.generated).toLocaleString();
+render();
+</script>
+</body>
+</html>
+`;
+}
+
+// src/report/terminal.ts
+import pc from "picocolors";
+var SEV_COLOR = {
+  critical: (s) => pc.bgRed(pc.white(pc.bold(s))),
+  high: (s) => pc.red(pc.bold(s)),
+  medium: (s) => pc.yellow(s),
+  low: (s) => pc.cyan(s),
+  info: (s) => pc.dim(s)
+};
+var GRADE_COLOR = { A: pc.green, B: pc.green, C: pc.yellow, D: pc.red, F: pc.red };
+function renderTerminal(s, opts = {}) {
+  const out = [];
+  const limit = opts.limit ?? 25;
+  out.push("");
+  out.push(pc.bold(`querydig ${pc.dim("v" + s.version)}  \u2014  slow-query scan of ${s.root}`));
+  out.push(pc.dim(`${s.filesScanned} files in ${(s.durationMs / 1e3).toFixed(2)}s`));
+  out.push("");
+  if (!s.findings.length) {
+    out.push(pc.green(pc.bold("\u2714 No query performance issues found.")));
+    if (s.suppressedByBaseline) out.push(pc.dim(`  (${s.suppressedByBaseline} known issue(s) hidden by baseline)`));
+    out.push("");
+    return out.join("\n");
+  }
+  const shown = s.findings.slice(0, limit);
+  for (const f of shown) out.push(renderFinding(f, opts.verbose));
+  if (s.findings.length > shown.length) {
+    out.push(pc.dim(`\u2026 ${s.findings.length - shown.length} more. Use --limit 0 to show all, or --format html for the full report.`));
+    out.push("");
+  }
+  const sev = (k) => `${SEV_COLOR[k](` ${k.toUpperCase()} `)} ${s.bySeverity[k]}`;
+  out.push(pc.bold("Summary"));
+  out.push(`  ${sev("critical")}   ${sev("high")}   ${sev("medium")}   ${sev("low")}`);
+  const g = (GRADE_COLOR[s.grade] ?? pc.white)(pc.bold(`${s.grade} (${s.score}/100)`));
+  out.push(`  Query health: ${g}`);
+  const top = Object.entries(s.byRule).sort((a, b) => b[1] - a[1]).slice(0, 5);
+  out.push(`  Top rules: ${top.map(([r, n]) => `${r}\xD7${n}`).join(", ")}`);
+  if (s.suppressedByBaseline) out.push(pc.dim(`  ${s.suppressedByBaseline} known issue(s) hidden by baseline`));
+  if (s.errors.length) out.push(pc.yellow(`  ${s.errors.length} file(s) could not be analyzed (run with --verbose)`));
+  if (opts.verbose) for (const e of s.errors) out.push(pc.dim(`    ${e.file}: ${e.error}`));
+  out.push(pc.dim("  Explain a rule: npx querydig explain <RULE>"));
+  out.push("");
+  return out.join("\n");
+}
+function renderFinding(f, verbose) {
+  const lines = [];
+  const db = f.db === "unknown" ? "" : pc.dim(` [${f.db}]`);
+  lines.push(`${SEV_COLOR[f.severity](` ${f.severity.toUpperCase()} `)} ${pc.bold(f.ruleId)} ${f.title}${db}`);
+  lines.push(`  ${pc.underline(`${f.file}:${f.line}:${f.column}`)}`);
+  for (const l of f.snippet.split("\n").slice(0, 3)) lines.push(pc.dim("  \u2502 ") + l);
+  lines.push(`  ${f.message}`);
+  lines.push(`  ${pc.green("fix:")} ${f.fix}`);
+  if (verbose) lines.push(pc.dim(`  confidence: ${f.confidence}  fingerprint: ${f.fingerprint}`));
+  lines.push("");
+  return lines.join("\n");
+}
+
+// src/types.ts
+var SEVERITIES = ["critical", "high", "medium", "low", "info"];
+var SEVERITY_RANK = { critical: 4, high: 3, medium: 2, low: 1, info: 0 };
+
+// src/version.ts
+var VERSION = true ? "0.1.1" : "0.0.0-dev";
+
+// src/scan.ts
+import { execFileSync } from "child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { availableParallelism } from "os";
+import { join as join2, relative, resolve, sep } from "path";
+import { fileURLToPath } from "url";
+import { Worker } from "worker_threads";
+import fg from "fast-glob";
+import ignore from "ignore";
+async function listFiles(opts) {
+  const root = resolve(opts.root);
+  const patterns = opts.include?.length ? opts.include : [`**/*{${SUPPORTED_EXTENSIONS.join(",")}}`];
+  const ignorePatterns = [...DEFAULT_IGNORE, ...opts.includeTests ? [] : TEST_IGNORE, ...opts.ignore ?? []];
+  let files = await fg(patterns, { cwd: root, ignore: ignorePatterns, dot: false, onlyFiles: true, followSymbolicLinks: false });
+  const gi = join2(root, ".gitignore");
+  if (existsSync2(gi)) {
+    const ig = ignore().add(readFileSync2(gi, "utf8"));
+    files = files.filter((f) => !ig.ignores(f));
+  }
+  if (opts.diff) {
+    const changed = new Set(gitChanged(root, opts.diff));
+    files = files.filter((f) => changed.has(f));
+  }
+  if (opts.files?.length) {
+    const only = new Set(opts.files.map((f) => relative(root, resolve(f)).split(sep).join("/")));
+    files = files.filter((f) => only.has(f));
+  }
+  return files.sort();
+}
+function gitChanged(root, ref) {
+  const top = execFileSync("git", ["rev-parse", "--show-toplevel"], { cwd: root, encoding: "utf8" }).trim();
+  const out = execFileSync("git", ["diff", "--name-only", "--diff-filter=ACMR", `${ref}...HEAD`], { cwd: root, encoding: "utf8" });
+  const untracked = execFileSync("git", ["ls-files", "--others", "--exclude-standard"], { cwd: root, encoding: "utf8" });
+  const staged = execFileSync("git", ["diff", "--name-only", "--diff-filter=ACMR", "HEAD"], { cwd: root, encoding: "utf8" });
+  return [...out.split("\n"), ...untracked.split("\n"), ...staged.split("\n")].filter(Boolean).map((f) => relative(root, join2(top, f)).split(sep).join("/"));
+}
+async function runPool(root, files, threads, onProgress) {
+  const workerUrl = new URL("./worker.js", import.meta.url);
+  const canUseWorkers = workerUrl.protocol === "file:" && existsSync2(fileURLToPath(workerUrl));
+  const results = new Array(files.length);
+  let done = 0;
+  if (!canUseWorkers || threads <= 1 || files.length < 64) {
+    let next2 = 0;
+    const lanes = Array.from({ length: Math.min(8, files.length) }, async () => {
+      while (next2 < files.length) {
+        const i = next2++;
+        results[i] = await analyzeFile(root, files[i]);
+        onProgress?.(++done, files.length);
+      }
+    });
+    await Promise.all(lanes);
+    return results;
+  }
+  const n = Math.min(threads, Math.ceil(files.length / 32));
+  let next = 0;
+  await Promise.all(
+    Array.from({ length: n }, () => new Promise((resolveLane, reject) => {
+      const w = new Worker(workerUrl);
+      const send = () => {
+        if (next >= files.length) {
+          void w.terminate();
+          resolveLane();
+          return;
+        }
+        const id = next++;
+        w.postMessage({ id, root, file: files[id] });
+      };
+      w.on("message", (m) => {
+        results[m.id] = m.result;
+        onProgress?.(++done, files.length);
+        send();
+      });
+      w.on("error", reject);
+      send();
+    }))
+  );
+  return results;
+}
+function gradeFor(findings, files) {
+  const weights = { critical: 10, high: 5, medium: 2, low: 0.5, info: 0 };
+  const penalty = findings.reduce((s, f) => s + weights[f.severity], 0);
+  const density = penalty / Math.max(1, Math.sqrt(Math.max(files, 1)));
+  const score = Math.max(0, Math.round(100 - density * 4));
+  const grade = score >= 90 ? "A" : score >= 80 ? "B" : score >= 65 ? "C" : score >= 50 ? "D" : "F";
+  return { grade, score };
+}
+async function scan(opts) {
+  const started = Date.now();
+  const root = resolve(opts.root);
+  const files = await listFiles({ ...opts, root });
+  const threads = opts.threads ?? Math.max(1, availableParallelism() - 1);
+  const results = await runPool(root, files, threads, opts.onProgress);
+  let findings = [];
+  const errors = [];
+  for (const r of results) {
+    if (!r) continue;
+    if (r.error) errors.push({ file: r.file, error: r.error });
+    findings.push(...r.findings);
+  }
+  if (opts.rules) {
+    findings = findings.flatMap((f) => {
+      const o = opts.rules[f.ruleId];
+      if (o === "off") return [];
+      return o ? [{ ...f, severity: o }] : [f];
+    });
+  }
+  if (opts.minSeverity) findings = findings.filter((f) => SEVERITY_RANK[f.severity] >= SEVERITY_RANK[opts.minSeverity]);
+  let suppressedByBaseline = 0;
+  if (opts.baseline) {
+    const remaining = /* @__PURE__ */ new Map();
+    if (opts.baseline instanceof Map) for (const [k, v] of opts.baseline) remaining.set(k, v);
+    else for (const k of opts.baseline) remaining.set(k, (remaining.get(k) ?? 0) + 1);
+    findings = findings.filter((f) => {
+      const c = remaining.get(f.fingerprint) ?? 0;
+      if (c > 0) {
+        remaining.set(f.fingerprint, c - 1);
+        suppressedByBaseline++;
+        return false;
+      }
+      return true;
+    });
+  }
+  findings.sort((a, b) => SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity] || a.file.localeCompare(b.file) || a.line - b.line);
+  const bySeverity = Object.fromEntries(SEVERITIES.map((s) => [s, 0]));
+  const byRule = {};
+  for (const f of findings) {
+    bySeverity[f.severity]++;
+    byRule[f.ruleId] = (byRule[f.ruleId] ?? 0) + 1;
+  }
+  const { grade, score } = gradeFor(findings, files.length);
+  return {
+    root,
+    filesScanned: files.length,
+    durationMs: Date.now() - started,
+    findings,
+    bySeverity,
+    byRule,
+    grade,
+    score,
+    suppressedByBaseline,
+    errors,
+    version: VERSION
+  };
+}
+
+export {
+  CONFIG_FILES,
+  loadConfig,
+  renderJson,
+  renderSarif,
+  renderMarkdown,
+  renderHtml,
+  renderTerminal,
+  SEVERITIES,
+  SEVERITY_RANK,
+  VERSION,
+  listFiles,
+  scan
+};

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,166 @@
+#!/usr/bin/env node
+import {
+  CONFIG_FILES,
+  SEVERITIES,
+  SEVERITY_RANK,
+  VERSION,
+  loadConfig,
+  renderHtml,
+  renderJson,
+  renderMarkdown,
+  renderSarif,
+  renderTerminal,
+  scan
+} from "./chunk-WTZLJ5ZV.js";
+import {
+  RULES,
+  findRule
+} from "./chunk-VAYEO4RI.js";
+
+// src/cli.ts
+import { existsSync as existsSync2, writeFileSync as writeFileSync2 } from "fs";
+import { resolve } from "path";
+import { Command, Option } from "commander";
+import pc from "picocolors";
+
+// src/baseline.ts
+import { existsSync, readFileSync, writeFileSync } from "fs";
+function readBaseline(path) {
+  if (!existsSync(path)) return void 0;
+  const data = JSON.parse(readFileSync(path, "utf8"));
+  return new Map(Object.entries(data.fingerprints ?? {}).map(([k, v]) => [k, v.count]));
+}
+function writeBaseline(path, findings) {
+  const fingerprints = {};
+  for (const f of findings) {
+    const e = fingerprints[f.fingerprint] ??= { count: 0, ruleId: f.ruleId, file: f.file };
+    e.count++;
+  }
+  const data = { version: 1, generatedAt: (/* @__PURE__ */ new Date()).toISOString(), fingerprints };
+  writeFileSync(path, JSON.stringify(data, null, 2) + "\n");
+  return findings.length;
+}
+
+// src/cli.ts
+var program = new Command();
+program.name("querydig").description("Find slow and unoptimized database queries (MongoDB, SQL) in JS/TS, Python and Go code.").version(VERSION);
+program.command("scan", { isDefault: true }).description("Scan a project for slow query patterns").argument("[path]", "project root", ".").addOption(new Option("-f, --format <format>", "output format").choices(["terminal", "json", "sarif", "md", "html"]).default("terminal")).option("-o, --output <file>", "write report to a file (default for html: querydig-report.html)").addOption(new Option("--fail-on <severity>", "exit with code 1 if any finding is at or above this severity").choices([...SEVERITIES, "none"])).addOption(new Option("--min-severity <severity>", "hide findings below this severity").choices(SEVERITIES)).option("--baseline <file>", "ignore findings recorded in this baseline file").option("--update-baseline [file]", "write all current findings to a baseline file and exit 0").option("--diff <ref>", "only scan files changed since a git ref (e.g. origin/main)").option("--include-tests", "also scan tests, fixtures, migrations and seeds", false).option("--ignore <globs...>", "extra glob patterns to ignore").option("--rules <list>", "only report these rule ids (comma separated)").option("--disable <list>", "disable these rule ids (comma separated)").option("-c, --config <file>", "path to a config file").option("--limit <n>", "max findings shown in terminal (0 = all)", "25").option("--threads <n>", "worker threads").option("-v, --verbose", "show confidence, fingerprints and parse errors", false).action(async (path, o) => {
+  const root = resolve(path);
+  if (!existsSync2(root)) {
+    console.error(pc.red(`querydig: path not found: ${root}`));
+    process.exit(2);
+  }
+  const cfg = loadConfig(root, o.config);
+  const rules = { ...cfg.rules ?? {} };
+  for (const id of splitList(o.disable)) rules[id] = "off";
+  const only = splitList(o.rules);
+  if (only.length) {
+    for (const r of RULES) if (!only.includes(r.id)) rules[r.id] = "off";
+  }
+  const baselinePath = o.baseline ? resolve(o.baseline) : void 0;
+  const updating = o.updateBaseline !== void 0;
+  const baseline = !updating && baselinePath ? readBaseline(baselinePath) : void 0;
+  if (baselinePath && !updating && !baseline) console.error(pc.yellow(`querydig: baseline ${baselinePath} not found \u2014 reporting all findings`));
+  const interactive = o.format === "terminal" && process.stderr.isTTY;
+  let last = 0;
+  const summary = await scan({
+    root,
+    ignore: [...cfg.ignore ?? [], ...o.ignore ?? []],
+    include: cfg.include,
+    includeTests: o.includeTests || cfg.includeTests,
+    rules,
+    minSeverity: o.minSeverity ?? cfg.minSeverity,
+    diff: o.diff,
+    baseline,
+    threads: o.threads ? Number(o.threads) : void 0,
+    onProgress: interactive ? (d, t) => {
+      const now = Date.now();
+      if (now - last > 80 || d === t) {
+        last = now;
+        process.stderr.write(`\r${pc.dim(`scanning ${d}/${t}`)}${d === t ? "\r\x1B[K" : ""}`);
+      }
+    } : void 0
+  });
+  if (updating) {
+    const file = resolve(typeof o.updateBaseline === "string" ? o.updateBaseline : baselinePath ?? ".querydig-baseline.json");
+    const n = writeBaseline(file, summary.findings);
+    console.log(pc.green(`querydig: wrote ${n} finding(s) to ${file}`));
+    return;
+  }
+  let text;
+  switch (o.format) {
+    case "json":
+      text = renderJson(summary);
+      break;
+    case "sarif":
+      text = renderSarif(summary);
+      break;
+    case "md":
+      text = renderMarkdown(summary);
+      break;
+    case "html":
+      text = renderHtml(summary);
+      break;
+    default:
+      text = renderTerminal(summary, { limit: Number(o.limit) || Infinity, verbose: o.verbose });
+  }
+  const outFile = o.output ?? (o.format === "html" ? "querydig-report.html" : void 0);
+  if (outFile) {
+    writeFileSync2(resolve(outFile), text);
+    if (o.format === "html" || o.format === "terminal") {
+      console.log(renderTerminal(summary, { limit: 0 === Number(o.limit) ? Infinity : 5 }).trimEnd());
+    }
+    console.error(pc.green(`report written to ${resolve(outFile)}`));
+  } else {
+    process.stdout.write(text.endsWith("\n") ? text : text + "\n");
+  }
+  const failOn = o.failOn ?? cfg.failOn;
+  if (failOn && failOn !== "none") {
+    const failing = summary.findings.filter((f) => SEVERITY_RANK[f.severity] >= SEVERITY_RANK[failOn]);
+    if (failing.length) {
+      console.error(pc.red(`querydig: ${failing.length} finding(s) at or above "${failOn}" \u2014 failing.`));
+      process.exitCode = 1;
+    }
+  }
+});
+program.command("rules").description("List all rules").action(() => {
+  for (const r of RULES) console.log(`${pc.bold(r.id)}  ${r.severity.padEnd(8)} ${pc.dim(r.db.padEnd(7))} ${r.title}`);
+});
+program.command("explain").description("Explain a rule and how to fix it").argument("<rule>", "rule id or name, e.g. QD001 or n-plus-one").action((id) => {
+  const r = findRule(id);
+  if (!r) {
+    console.error(pc.red(`Unknown rule ${id}. Run \`querydig rules\`.`));
+    process.exit(2);
+  }
+  console.log(`
+${pc.bold(`${r.id} \xB7 ${r.title}`)}  ${pc.dim(`(${r.name}, default ${r.severity}, ${r.db})`)}
+`);
+  console.log(`${pc.bold("Why it is slow")}
+  ${r.why}
+`);
+  console.log(`${pc.bold("How to fix")}
+  ${r.fix}
+`);
+  if (r.example) {
+    console.log(pc.red("Before"));
+    console.log(r.example.bad.replace(/^/gm, "  "));
+    console.log(pc.green("\nAfter"));
+    console.log(r.example.good.replace(/^/gm, "  ") + "\n");
+  }
+});
+program.command("init").description("Create a querydig.config.json").action(() => {
+  const file = resolve(CONFIG_FILES[0]);
+  if (existsSync2(file)) {
+    console.error(pc.yellow(`${file} already exists`));
+    return;
+  }
+  writeFileSync2(file, JSON.stringify({ ignore: [], includeTests: false, failOn: "high", rules: { MQ010: "off", MQ011: "off" } }, null, 2) + "\n");
+  console.log(pc.green(`created ${file}`));
+});
+function splitList(v) {
+  return v ? v.split(",").map((s) => s.trim().toUpperCase()).filter(Boolean) : [];
+}
+program.parseAsync().catch((e) => {
+  console.error(pc.red(`querydig: ${e.message}`));
+  process.exit(2);
+});

package/dist/config.d.ts

@@ -0,0 +1,14 @@
+import type { Severity } from './types.js';
+export interface QuerydigConfig {
+    include?: string[];
+    ignore?: string[];
+    includeTests?: boolean;
+    /** rule id -> 'off' | severity override */
+    rules?: Record<string, 'off' | Severity>;
+    failOn?: Severity;
+    minSeverity?: Severity;
+}
+export declare const CONFIG_FILES: string[];
+export declare const DEFAULT_IGNORE: string[];
+export declare const TEST_IGNORE: string[];
+export declare function loadConfig(root: string, explicit?: string): QuerydigConfig;

package/dist/fileAnalyzer.d.ts

@@ -0,0 +1,2 @@
+import type { FileResult } from './types.js';
+export declare function analyzeFile(root: string, rel: string): Promise<FileResult>;

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export { scan, listFiles } from './scan.js';
+export { analyzeSource } from './analyzer.js';
+export { RULES, findRule } from './rules.js';
+export { renderJson, renderSarif, renderMarkdown } from './report/formats.js';
+export { renderHtml } from './report/html.js';
+export { renderTerminal } from './report/terminal.js';
+export type * from './types.js';