react-doctor 0.2.14-dev.7b4ddf7 → 0.2.14-dev.8921575

package/dist/index.js

@@ -1,3 +1,5 @@
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="df20b0d3-9e4e-52e0-8991-ce8a6349a04a")}catch(e){}}();
 import { createRequire } from "node:module";
 import * as Schema from "effect/Schema";
 import * as fs$1 from "node:fs";
@@ -14,7 +16,10 @@ import * as Redacted from "effect/Redacted";
 import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
 import * as Otlp from "effect/unstable/observability/Otlp";
 import * as Context from "effect/Context";
+import os from "node:os";
 import * as Console from "effect/Console";
+import { parseJSON5 } from "confbox";
+import { createJiti } from "jiti";
 import * as Fiber from "effect/Fiber";
 import * as Filter from "effect/Filter";
 import * as Option from "effect/Option";
@@ -26,7 +31,6 @@ import * as NodeFileSystem from "@effect/platform-node-shared/NodeFileSystem";
 import * as NodePath from "@effect/platform-node-shared/NodePath";
 import * as ChildProcess from "effect/unstable/process/ChildProcess";
 import { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
-import os from "node:os";
 import * as ts from "typescript";
 import { gzipSync } from "node:zlib";
 //#region \0rolldown/runtime.js
@@ -59,6 +63,7 @@ var Diagnostic = class extends Schema.Class("Diagnostic")({
 	plugin: Schema.String,
 	rule: Schema.String,
 	severity: Severity,
+	title: Schema.optional(Schema.String),
 	message: Schema.String,
 	help: Schema.String,
 	url: Schema.optional(Schema.String),
@@ -2094,6 +2099,8 @@ const isFile = (filePath) => {
 	}
 };
 const SOURCE_FILE_PATTERN = /\.(tsx?|jsx?)$/;
+const GENERATED_BUNDLE_FILE_PATTERN = /\.(iife|umd|global|min)\.js$/i;
+const MINIFIED_SNIFF_BYTES = 65536;
 const GIT_LS_FILES_MAX_BUFFER_BYTES = 50 * 1024 * 1024;
 const IGNORED_DIRECTORIES = new Set([
 	".git",
@@ -2109,6 +2116,34 @@ const IGNORED_DIRECTORIES = new Set([
 	"out",
 	"storybook-static"
 ]);
+const isLintableSourceFile = (filePath) => SOURCE_FILE_PATTERN.test(filePath) && !GENERATED_BUNDLE_FILE_PATTERN.test(filePath);
+const isMinifiedSource = (absolutePath) => {
+	let fileDescriptor;
+	try {
+		fileDescriptor = fs.openSync(absolutePath, "r");
+		const buffer = Buffer.alloc(MINIFIED_SNIFF_BYTES);
+		const bytesRead = fs.readSync(fileDescriptor, buffer, 0, MINIFIED_SNIFF_BYTES, 0);
+		const prefix = buffer.toString("utf8", 0, bytesRead);
+		const lines = prefix.split("\n");
+		const longestLineLength = lines.reduce((longest, line) => Math.max(longest, line.length), 0);
+		const averageLineLength = prefix.length / lines.length;
+		return longestLineLength > 1e3 && averageLineLength > 500;
+	} catch {
+		return false;
+	} finally {
+		if (fileDescriptor !== void 0) fs.closeSync(fileDescriptor);
+	}
+};
+const isLargeMinifiedFile = (absolutePath) => {
+	let sizeBytes;
+	try {
+		sizeBytes = fs.statSync(absolutePath).size;
+	} catch {
+		return false;
+	}
+	if (sizeBytes < 2e4) return false;
+	return isMinifiedSource(absolutePath);
+};
 const IGNORABLE_READDIR_ERROR_CODES = new Set([
 	"EACCES",
 	"EPERM",
@@ -2139,7 +2174,7 @@ const countSourceFilesViaFilesystem = (rootDirectory) => {
 				if (!entry.name.startsWith(".") && !IGNORED_DIRECTORIES.has(entry.name)) stack.push(path.join(currentDirectory, entry.name));
 				continue;
 			}
-			if (entry.isFile() && SOURCE_FILE_PATTERN.test(entry.name)) count++;
+			if (entry.isFile() && isLintableSourceFile(entry.name) && !isLargeMinifiedFile(path.join(currentDirectory, entry.name))) count++;
 		}
 	}
 	return count;
@@ -2157,7 +2192,7 @@ const countSourceFilesViaGit = (rootDirectory) => {
 		maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES
 	});
 	if (result.error || result.status !== 0) return null;
-	return result.stdout.split("\0").filter((filePath) => filePath.length > 0 && SOURCE_FILE_PATTERN.test(filePath)).length;
+	return result.stdout.split("\0").filter((filePath) => filePath.length > 0 && isLintableSourceFile(filePath) && !isLargeMinifiedFile(path.resolve(rootDirectory, filePath))).length;
 };
 const countSourceFiles = (rootDirectory) => countSourceFilesViaGit(rootDirectory) ?? countSourceFilesViaFilesystem(rootDirectory);
 const cachedPackageJsons = /* @__PURE__ */ new Map();
@@ -2843,29 +2878,34 @@ const findDependencyInfoFromMonorepoRoot = (directory) => {
 		framework: rootInfo.framework !== "unknown" ? rootInfo.framework : workspaceInfo.framework
 	};
 };
-const someWorkspacePackageJson = (rootDirectory, rootPackageJson, predicate) => {
-	if (predicate(rootPackageJson)) return true;
+const findInWorkspacePackageJsons = (rootDirectory, rootPackageJson, select) => {
+	const rootValue = select(rootPackageJson);
+	if (rootValue !== null) return rootValue;
 	const patterns = getWorkspacePatterns(rootDirectory, rootPackageJson);
-	if (patterns.length === 0) return false;
+	if (patterns.length === 0) return null;
 	const visitedDirectories = /* @__PURE__ */ new Set();
 	for (const pattern of patterns) {
-		const directories = resolveWorkspaceDirectories(rootDirectory, pattern);
+		const directories = [...resolveWorkspaceDirectories(rootDirectory, pattern)].sort();
 		for (const workspaceDirectory of directories) {
 			if (visitedDirectories.has(workspaceDirectory)) continue;
 			visitedDirectories.add(workspaceDirectory);
-			if (predicate(readPackageJson(path.join(workspaceDirectory, "package.json")))) return true;
+			const value = select(readPackageJson(path.join(workspaceDirectory, "package.json")));
+			if (value !== null) return value;
 		}
 	}
-	return false;
+	return null;
 };
+const someWorkspacePackageJson = (rootDirectory, rootPackageJson, predicate) => findInWorkspacePackageJsons(rootDirectory, rootPackageJson, (packageJson) => predicate(packageJson) ? true : null) !== null;
 const NAMES = new Set([
 	"react-native",
 	"react-native-tvos",
-	"expo",
-	"expo-router",
-	"@expo/cli",
-	"@expo/metro-config",
-	"@expo/metro-runtime",
+	...new Set([
+		"expo",
+		"expo-router",
+		"@expo/cli",
+		"@expo/metro-config",
+		"@expo/metro-runtime"
+	]),
 	"react-native-windows",
 	"react-native-macos"
 ]);
@@ -2889,6 +2929,11 @@ const isPackageJsonReactNativeAware = (packageJson) => {
 	return false;
 };
 const hasReactNativeWorkspaceAnywhere = (rootDirectory, rootPackageJson) => someWorkspacePackageJson(rootDirectory, rootPackageJson, isPackageJsonReactNativeAware);
+const getExpoDependencySpec = (packageJson) => {
+	const spec = packageJson.dependencies?.expo ?? packageJson.devDependencies?.expo ?? packageJson.peerDependencies?.expo ?? packageJson.optionalDependencies?.expo;
+	return typeof spec === "string" ? spec : null;
+};
+const findExpoVersion = (rootDirectory, rootPackageJson) => findInWorkspacePackageJsons(rootDirectory, rootPackageJson, getExpoDependencySpec);
 const getPreactVersion = (packageJson) => {
 	return {
 		...packageJson.peerDependencies,
@@ -3128,6 +3173,19 @@ const discoverProject = (directory) => {
 	const hasTypeScript = fs.existsSync(path.join(directory, "tsconfig.json"));
 	const sourceFileCount = countSourceFiles(directory);
 	const hasReactNativeWorkspace = framework === "expo" || framework === "react-native" || hasReactNativeWorkspaceAnywhere(directory, packageJson);
+	let expoVersion = hasReactNativeWorkspace ? findExpoVersion(directory, packageJson) : null;
+	if (expoVersion !== null && isCatalogReference(expoVersion)) {
+		const catalogName = extractCatalogName(expoVersion);
+		let resolvedExpoVersion = resolveCatalogVersion(packageJson, "expo", directory, catalogName);
+		if (!resolvedExpoVersion) {
+			const monorepoRoot = findMonorepoRoot(directory);
+			if (monorepoRoot) {
+				const monorepoPackageJsonPath = path.join(monorepoRoot, "package.json");
+				if (isFile(monorepoPackageJsonPath)) resolvedExpoVersion = resolveCatalogVersion(readPackageJson(monorepoPackageJsonPath), "expo", monorepoRoot, catalogName);
+			}
+		}
+		expoVersion = resolvedExpoVersion ?? expoVersion;
+	}
 	const hasReanimated = hasReactNativeWorkspace && someWorkspacePackageJson(directory, packageJson, isPackageJsonReanimatedAware);
 	const preactVersion = getPreactVersion(packageJson);
 	const projectInfo = {
@@ -3145,6 +3203,7 @@ const discoverProject = (directory) => {
 		preactVersion,
 		preactMajorVersion: parseReactMajor(preactVersion),
 		hasReactNativeWorkspace,
+		expoVersion,
 		hasReanimated,
 		sourceFileCount
 	};
@@ -3234,13 +3293,31 @@ const STAGED_FILES_PROJECT_CONFIG_FILENAMES = [
 	"tsconfig.json",
 	"tsconfig.base.json",
 	"package.json",
-	"react-doctor.config.json",
+	"doctor.config.ts",
+	"doctor.config.mts",
+	"doctor.config.cts",
+	"doctor.config.js",
+	"doctor.config.mjs",
+	"doctor.config.cjs",
+	"doctor.config.json",
+	"doctor.config.jsonc",
 	"oxlint.json",
 	".oxlintrc.json"
 ];
 const OXLINT_OUTPUT_MAX_BYTES = 50 * 1024 * 1024;
 const OXLINT_SPAWN_TIMEOUT_MS = 6e4;
+const DEAD_CODE_WORKER_MAX_OLD_SPACE_MB = 8192;
 const RECOMMENDED_PNPM_MINIMUM_RELEASE_AGE_MINUTES = 10080;
+const DIAGNOSTIC_CATEGORY_BUCKETS = [
+	"Security",
+	"Bugs",
+	"Performance",
+	"Accessibility",
+	"Maintainability"
+];
+const APP_ONLY_RULE_KEYS = new Set(["react-hooks-js/static-components", "react-doctor/no-render-prop-children"]);
+const COMPILER_CLEANUP_BUCKET = "compiler-cleanup";
+const COMPILER_CLEANUP_RULE_KEYS = new Set(["react-doctor/react-compiler-no-manual-memoization"]);
 const MAX_GLOB_PATTERN_LENGTH_CHARS = 1024;
 const CONFIG_CACHE_TTL_MS = 300 * 1e3;
 var InvalidGlobPatternError = class extends Error {
@@ -3360,10 +3437,11 @@ const restampSeverity = (diagnostic, override) => {
 */
 const buildRuleSeverityControls = (config) => {
 	if (!config) return void 0;
-	if (config.rules === void 0 && config.categories === void 0) return void 0;
+	if (config.rules === void 0 && config.categories === void 0 && config.buckets === void 0) return;
 	return {
 		...config.rules !== void 0 ? { rules: config.rules } : {},
-		...config.categories !== void 0 ? { categories: config.categories } : {}
+		...config.categories !== void 0 ? { categories: config.categories } : {},
+		...config.buckets !== void 0 ? { buckets: config.buckets } : {}
 	};
 };
 const JSX_OPENER_TAG_PATTERN = /<[A-Za-z][\w.]*/g;
@@ -3727,6 +3805,69 @@ const resolveRuleSeverityOverride = (input, controls) => {
 	}
 	return input.category !== void 0 ? controls.categories?.[input.category] : void 0;
 };
+const cachedRoleByPackageDirectory = /* @__PURE__ */ new Map();
+const cachedPackageDirectoryByFilename = /* @__PURE__ */ new Map();
+const findNearestPackageDirectory = (filename) => {
+	if (!filename) return null;
+	const fromCache = cachedPackageDirectoryByFilename.get(filename);
+	if (fromCache !== void 0) return fromCache;
+	let currentDirectory = path.dirname(filename);
+	while (true) {
+		const candidatePackageJsonPath = path.join(currentDirectory, "package.json");
+		let hasPackageJson = false;
+		try {
+			hasPackageJson = fs.statSync(candidatePackageJsonPath).isFile();
+		} catch {
+			hasPackageJson = false;
+		}
+		if (hasPackageJson) {
+			cachedPackageDirectoryByFilename.set(filename, currentDirectory);
+			return currentDirectory;
+		}
+		const parentDirectory = path.dirname(currentDirectory);
+		if (parentDirectory === currentDirectory) {
+			cachedPackageDirectoryByFilename.set(filename, null);
+			return null;
+		}
+		currentDirectory = parentDirectory;
+	}
+};
+const readManifest = (packageJsonPath) => {
+	try {
+		const parsed = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
+		if (typeof parsed === "object" && parsed !== null) return parsed;
+		return null;
+	} catch {
+		return null;
+	}
+};
+const hasPublishContract = (manifest) => typeof manifest.name === "string" && manifest.name.length > 0 && manifest.exports !== void 0 && manifest.exports !== null && manifest.private !== true;
+const classifyByDirectoryCohort = (packageDirectory) => {
+	let current = packageDirectory;
+	while (true) {
+		if (path.basename(current) === "apps") return "app";
+		const parent = path.dirname(current);
+		if (parent === current) return null;
+		current = parent;
+	}
+};
+const clearPackageRoleCache = () => {
+	cachedRoleByPackageDirectory.clear();
+	cachedPackageDirectoryByFilename.clear();
+};
+const classifyPackageRole = (filename) => {
+	if (!filename) return "unknown";
+	const packageDirectory = findNearestPackageDirectory(filename);
+	if (!packageDirectory) return "unknown";
+	const cached = cachedRoleByPackageDirectory.get(packageDirectory);
+	if (cached !== void 0) return cached;
+	const manifest = readManifest(path.join(packageDirectory, "package.json"));
+	let result;
+	if (manifest && hasPublishContract(manifest)) result = "library";
+	else result = classifyByDirectoryCohort(path.dirname(packageDirectory)) ?? "unknown";
+	cachedRoleByPackageDirectory.set(packageDirectory, result);
+	return result;
+};
 /**
 * Resolves the absolute path to read for a diagnostic's `filePath`,
 * accounting for the various shapes oxlint emits:
@@ -3862,10 +4003,13 @@ const collectStringSet = (values) => {
 *    wins over `test-noise`)
 * 2. severity overrides (top-level `rules` / `categories`, with
 *    `"off"` dropping)
-* 3. ignore filters (rules / file patterns / per-file overrides)
-* 4. `rn-no-raw-text` suppression via configured `textComponents` and
+* 3. warning suppression (only when `showWarnings` is false: drops every
+*    `"warning"`-severity diagnostic unless a severity override opts a
+*    specific rule / category back in)
+* 4. ignore filters (rules / file patterns / per-file overrides)
+* 5. `rn-no-raw-text` suppression via configured `textComponents` and
 *    `rawTextWrapperComponents` (config-driven JSX enclosure checks)
-* 5. inline suppressions (`// react-doctor-disable-next-line ...`)
+* 6. inline suppressions (`// react-doctor-disable-next-line ...`)
 *
 * Returns `null` when the diagnostic is dropped, the (possibly
 * severity-restamped) diagnostic otherwise.
@@ -3875,7 +4019,7 @@ const collectStringSet = (values) => {
 * `mergeAndFilterDiagnostics` wrapper apply this closure per element.
 */
 const buildDiagnosticPipeline = (input) => {
-	const { rootDirectory, userConfig, readFileLinesSync, respectInlineDisables } = input;
+	const { rootDirectory, userConfig, readFileLinesSync, respectInlineDisables, showWarnings } = input;
 	const severityControls = buildRuleSeverityControls(userConfig);
 	const ignoredRules = new Set(Array.isArray(userConfig?.ignore?.rules) ? userConfig.ignore.rules.filter((rule) => typeof rule === "string") : []);
 	const ignoredFilePatterns = compileIgnoredFilePatterns(userConfig);
@@ -3886,6 +4030,15 @@ const buildDiagnosticPipeline = (input) => {
 	const hasRawTextWrappers = rawTextWrapperComponentNames.size > 0;
 	const fileLinesCache = /* @__PURE__ */ new Map();
 	const testFileCache = /* @__PURE__ */ new Map();
+	const libraryFileCache = /* @__PURE__ */ new Map();
+	const isLibraryFile = (filePath) => {
+		let cached = libraryFileCache.get(filePath);
+		if (cached === void 0) {
+			cached = classifyPackageRole(resolveCandidateReadPath(rootDirectory, filePath)) === "library";
+			libraryFileCache.set(filePath, cached);
+		}
+		return cached;
+	};
 	const getFileLines = (filePath) => {
 		const cached = fileLinesCache.get(filePath);
 		if (cached !== void 0) return cached;
@@ -3912,6 +4065,10 @@ const buildDiagnosticPipeline = (input) => {
 		for (const ignored of ignoredRules) if (isSameRuleKey(ignored, ruleIdentifier)) return true;
 		return false;
 	};
+	const isAppOnlyRule = (ruleIdentifier) => {
+		for (const appOnlyRuleKey of APP_ONLY_RULE_KEYS) if (isSameRuleKey(appOnlyRuleKey, ruleIdentifier)) return true;
+		return false;
+	};
 	const isRnRawTextSuppressedByConfig = (diagnostic) => {
 		if (diagnostic.rule !== "rn-no-raw-text") return false;
 		if (diagnostic.line <= 0) return false;
@@ -3925,15 +4082,22 @@ const buildDiagnosticPipeline = (input) => {
 	return { apply: (diagnostic) => {
 		if (shouldAutoSuppress(diagnostic)) return null;
 		let current = diagnostic;
+		let explicitSeverityOverride;
+		let explicitRuleOverride;
 		if (severityControls) {
 			const { ruleKey, category } = getDiagnosticRuleIdentity(current);
-			const override = resolveRuleSeverityOverride({
+			explicitRuleOverride = resolveRuleSeverityOverride({ ruleKey }, severityControls);
+			explicitSeverityOverride = resolveRuleSeverityOverride({
 				ruleKey,
 				category
 			}, severityControls);
-			if (override === "off") return null;
-			if (override !== void 0) current = restampSeverity(current, override);
+			if (explicitSeverityOverride === "off") return null;
+			if (explicitSeverityOverride !== void 0) current = restampSeverity(current, explicitSeverityOverride);
+		}
+		if (explicitRuleOverride === void 0) {
+			if (isAppOnlyRule(`${current.plugin}/${current.rule}`) && isLibraryFile(current.filePath)) return null;
 		}
+		if (!showWarnings && current.severity === "warning" && explicitSeverityOverride !== "warn") return null;
 		if (userConfig) {
 			if (isRuleIgnored(`${current.plugin}/${current.rule}`)) return null;
 			if (isFileIgnoredByPatterns(current.filePath, rootDirectory, ignoredFilePatterns)) return null;
@@ -4118,6 +4282,17 @@ const layerOtlp = Layer.unwrap(Effect.gen(function* () {
 	}).pipe(Layer.provide(FetchHttpClient.layer));
 }).pipe(Effect.orDie));
 /**
+* Resolves a requested lint worker count to a clamped integer within
+* `[MIN_SCAN_CONCURRENCY, MAX_SCAN_CONCURRENCY]`. `"auto"` uses the
+* machine's CPU cores; out-of-range or non-finite requests degrade to
+* `MIN_SCAN_CONCURRENCY` rather than oversubscribing or running zero workers.
+*/
+const resolveScanConcurrency = (requested) => {
+	const desired = requested === "auto" ? os.availableParallelism() : requested;
+	if (!Number.isFinite(desired) || desired < 1) return 1;
+	return Math.max(1, Math.min(Math.floor(desired), 16));
+};
+/**
 * Per-batch oxlint wall-clock budget. Reads from the env var on
 * startup so the eval harness can raise the budget under sandbox
 * microVMs without recompiling react-doctor. Tests override via
@@ -4137,6 +4312,30 @@ var OxlintSpawnTimeoutMs = class extends Context.Reference("react-doctor/OxlintS
 * tests that exercise the cap behavior.
 */
 var OxlintOutputMaxBytes = class extends Context.Reference("react-doctor/OxlintOutputMaxBytes", { defaultValue: () => OXLINT_OUTPUT_MAX_BYTES }) {};
+/**
+* Number of oxlint subprocesses the lint pass runs in parallel. Defaults
+* to `1` (serial — the historical behavior) so resource usage is opt-in.
+* The CLI's `--experimental-parallel` flag overrides this via `Layer.succeed`; the
+* `REACT_DOCTOR_PARALLEL` env var seeds the default for programmatic /
+* CI callers that never touch the flag:
+*
+*   - unset / `0` / `false` / `off` → `1` (serial)
+*   - `auto` / `true` / `on`        → available CPU cores (clamped)
+*   - a positive integer            → that many workers (clamped)
+*
+* The resolved value is always within
+* `[MIN_SCAN_CONCURRENCY, MAX_SCAN_CONCURRENCY]`.
+*/
+var OxlintConcurrency = class extends Context.Reference("react-doctor/OxlintConcurrency", { defaultValue: () => {
+	const raw = process.env["REACT_DOCTOR_PARALLEL"];
+	if (raw === void 0) return 1;
+	const normalized = raw.trim().toLowerCase();
+	if (normalized === "" || normalized === "0" || normalized === "false" || normalized === "off") return 1;
+	if (normalized === "auto" || normalized === "true" || normalized === "on") return resolveScanConcurrency("auto");
+	const parsed = Number.parseInt(normalized, 10);
+	if (!Number.isInteger(parsed) || parsed <= 0) return 1;
+	return resolveScanConcurrency(parsed);
+} }) {};
 const DIAGNOSTIC_SURFACES = [
 	"cli",
 	"prComment",
@@ -4165,10 +4364,18 @@ const VALID_RULE_SEVERITIES = [
 	"warn",
 	"off"
 ];
+const KNOWN_CATEGORY_LABEL = DIAGNOSTIC_CATEGORY_BUCKETS.join(", ");
+const isDiagnosticCategoryBucket = (value) => DIAGNOSTIC_CATEGORY_BUCKETS.includes(value);
+const filterKnownCategories = (fieldName, categories) => categories.filter((category) => {
+	if (isDiagnosticCategoryBucket(category)) return true;
+	warnConfigIssue(`config field "${fieldName}" lists "${category}", which is not a known category (expected one of: ${KNOWN_CATEGORY_LABEL}); ignoring the entry.`);
+	return false;
+});
 const BOOLEAN_FIELD_NAMES = [
 	"lint",
 	"deadCode",
 	"verbose",
+	"warnings",
 	"customRulesOnly",
 	"share",
 	"noScore",
@@ -4217,13 +4424,15 @@ const validateSurfaceControls = (surface, rawControls) => {
 		warnConfigIssue(`config field "surfaces.${surface}" must be an object (got ${typeof rawControls}); ignoring this surface.`);
 		return;
 	}
-	const validated = {};
+	const validatedSurfaceControls = {};
 	for (const fieldName of SURFACE_CONTROL_FIELD_NAMES) {
 		if (rawControls[fieldName] === void 0) continue;
-		const result = validateStringArrayField(`surfaces.${surface}.${fieldName}`, rawControls[fieldName]);
-		if (result !== void 0) validated[fieldName] = result;
+		const qualifiedName = `surfaces.${surface}.${fieldName}`;
+		const result = validateStringArrayField(qualifiedName, rawControls[fieldName]);
+		if (result === void 0) continue;
+		validatedSurfaceControls[fieldName] = fieldName === "includeCategories" || fieldName === "excludeCategories" ? filterKnownCategories(qualifiedName, result) : result;
 	}
-	return validated;
+	return validatedSurfaceControls;
 };
 const validateSurfacesField = (rawSurfaces) => {
 	if (!isPlainObject$1(rawSurfaces)) {
@@ -4241,7 +4450,7 @@ const validateSurfacesField = (rawSurfaces) => {
 	}
 	return validated;
 };
-const validateSeverityMap = (fieldName, rawMap) => {
+const validateSeverityMap = (fieldName, rawMap, keysAreCategories = false) => {
 	if (!isPlainObject$1(rawMap)) {
 		warnConfigIssue(`config field "${fieldName}" must be an object (got ${typeof rawMap}); ignoring this field.`);
 		return;
@@ -4252,6 +4461,10 @@ const validateSeverityMap = (fieldName, rawMap) => {
 			warnConfigIssue(`config field "${fieldName}" has an empty key; ignoring the entry.`);
 			continue;
 		}
+		if (keysAreCategories && !isDiagnosticCategoryBucket(key)) {
+			warnConfigIssue(`config field "${fieldName}.${key}" is not a known category (expected one of: ${KNOWN_CATEGORY_LABEL}); ignoring the entry.`);
+			continue;
+		}
 		if (!isRuleSeverity(value)) {
 			warnConfigIssue(`config field "${fieldName}.${key}" must be one of: ${VALID_RULE_SEVERITIES.join(", ")} (got ${formatType(value)}); ignoring the entry.`);
 			continue;
@@ -4272,76 +4485,116 @@ const validateConfigTypes = (config) => {
 	for (const fieldName of BOOLEAN_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => coerceMaybeBooleanString(fieldName, value));
 	for (const fieldName of STRING_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateString(fieldName, value));
 	applyFieldValidator(config, validated, "surfaces", validateSurfacesField);
-	for (const fieldName of SEVERITY_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateSeverityMap(fieldName, value));
+	for (const fieldName of SEVERITY_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateSeverityMap(fieldName, value, fieldName === "categories"));
 	applyFieldValidator(config, validated, "plugins", (value) => validateStringArrayField("plugins", value));
 	return validated;
 };
 const warn = (message) => {
 	Effect.runSync(Console.warn(message));
 };
-const CONFIG_FILENAME = "react-doctor.config.json";
+const CONFIG_BASENAME = "doctor.config";
+const CONFIG_EXTENSIONS = [
+	"ts",
+	"mts",
+	"cts",
+	"js",
+	"mjs",
+	"cjs",
+	"json",
+	"jsonc"
+];
+const DATA_CONFIG_EXTENSIONS = new Set(["json", "jsonc"]);
+const PACKAGE_JSON_FILENAME = "package.json";
 const PACKAGE_JSON_CONFIG_KEY = "reactDoctor";
-const loadConfigFromDirectory = (directory) => {
-	const configFilePath = path.join(directory, CONFIG_FILENAME);
-	if (isFile(configFilePath)) try {
-		const fileContent = fs.readFileSync(configFilePath, "utf-8");
-		const parsed = JSON.parse(fileContent);
-		if (isPlainObject(parsed)) return {
-			config: validateConfigTypes(parsed),
-			sourceDirectory: directory
-		};
-		warn(`${CONFIG_FILENAME} must be a JSON object, ignoring.`);
-	} catch (error) {
-		warn(`Failed to parse ${CONFIG_FILENAME}: ${error instanceof Error ? error.message : String(error)}`);
-	}
-	const packageJsonPath = path.join(directory, "package.json");
-	if (isFile(packageJsonPath)) try {
-		const fileContent = fs.readFileSync(packageJsonPath, "utf-8");
-		const packageJson = JSON.parse(fileContent);
+const LEGACY_CONFIG_FILENAME = "react-doctor.config.json";
+const jiti = createJiti(import.meta.url);
+const formatError = (error) => error instanceof Error ? error.message : String(error);
+const loadModuleConfig = async (filePath) => {
+	const imported = await jiti.import(filePath);
+	return imported?.default ?? imported;
+};
+const readDataConfig = (filePath) => parseJSON5(fs.readFileSync(filePath, "utf-8"));
+const readEmbeddedPackageJsonConfig = (directory) => {
+	const packageJsonPath = path.join(directory, PACKAGE_JSON_FILENAME);
+	if (!isFile(packageJsonPath)) return null;
+	try {
+		const packageJson = parseJSON5(fs.readFileSync(packageJsonPath, "utf-8"));
 		if (isPlainObject(packageJson)) {
 			const embeddedConfig = packageJson[PACKAGE_JSON_CONFIG_KEY];
-			if (isPlainObject(embeddedConfig)) return {
-				config: validateConfigTypes(embeddedConfig),
-				sourceDirectory: directory
+			if (isPlainObject(embeddedConfig)) return embeddedConfig;
+		}
+	} catch {}
+	return null;
+};
+const loadPackageJsonConfig = (directory) => {
+	const embeddedConfig = readEmbeddedPackageJsonConfig(directory);
+	if (!embeddedConfig) return null;
+	return {
+		config: validateConfigTypes(embeddedConfig),
+		sourceDirectory: directory,
+		configFilePath: path.join(directory, PACKAGE_JSON_FILENAME),
+		format: "package-json"
+	};
+};
+const loadConfigFromDirectory = async (directory) => {
+	let sawBrokenConfigFile = false;
+	for (const extension of CONFIG_EXTENSIONS) {
+		const filePath = path.join(directory, `${CONFIG_BASENAME}.${extension}`);
+		if (!isFile(filePath)) continue;
+		const isDataFile = DATA_CONFIG_EXTENSIONS.has(extension);
+		try {
+			const parsed = isDataFile ? readDataConfig(filePath) : await loadModuleConfig(filePath);
+			if (isPlainObject(parsed)) return {
+				status: "found",
+				loaded: {
+					config: validateConfigTypes(parsed),
+					sourceDirectory: directory,
+					configFilePath: filePath,
+					format: isDataFile ? "json" : "module"
+				}
 			};
+			warn(`${CONFIG_BASENAME}.${extension} must export an object, ignoring.`);
+			sawBrokenConfigFile = true;
+		} catch (error) {
+			warn(`Failed to load ${CONFIG_BASENAME}.${extension}: ${formatError(error)}`);
+			sawBrokenConfigFile = true;
 		}
-	} catch {
-		return null;
 	}
-	return null;
+	const packageJsonConfig = loadPackageJsonConfig(directory);
+	if (packageJsonConfig) return {
+		status: "found",
+		loaded: packageJsonConfig
+	};
+	if (isFile(path.join(directory, LEGACY_CONFIG_FILENAME))) warn(`${LEGACY_CONFIG_FILENAME} is no longer read — rename it to ${CONFIG_BASENAME}.json (or author a ${CONFIG_BASENAME}.ts).`);
+	return {
+		status: sawBrokenConfigFile ? "invalid" : "absent",
+		loaded: null
+	};
 };
 const cachedConfigs = /* @__PURE__ */ new Map();
 const clearConfigCache = () => {
 	cachedConfigs.clear();
 };
-const loadConfigWithSource = (rootDirectory) => {
-	const cached = cachedConfigs.get(rootDirectory);
-	if (cached !== void 0) return cached;
-	const localConfig = loadConfigFromDirectory(rootDirectory);
-	if (localConfig) {
-		cachedConfigs.set(rootDirectory, localConfig);
-		return localConfig;
-	}
-	if (isProjectBoundary(rootDirectory)) {
-		cachedConfigs.set(rootDirectory, null);
-		return null;
-	}
+const loadConfigWalkingUp = async (rootDirectory) => {
+	const localResult = await loadConfigFromDirectory(rootDirectory);
+	if (localResult.status === "found") return localResult.loaded;
+	if (localResult.status === "invalid" || isProjectBoundary(rootDirectory)) return null;
 	let ancestorDirectory = path.dirname(rootDirectory);
 	while (ancestorDirectory !== path.dirname(ancestorDirectory)) {
-		const ancestorConfig = loadConfigFromDirectory(ancestorDirectory);
-		if (ancestorConfig) {
-			cachedConfigs.set(rootDirectory, ancestorConfig);
-			return ancestorConfig;
-		}
-		if (isProjectBoundary(ancestorDirectory)) {
-			cachedConfigs.set(rootDirectory, null);
-			return null;
-		}
+		const ancestorResult = await loadConfigFromDirectory(ancestorDirectory);
+		if (ancestorResult.status === "found") return ancestorResult.loaded;
+		if (isProjectBoundary(ancestorDirectory)) return null;
 		ancestorDirectory = path.dirname(ancestorDirectory);
 	}
-	cachedConfigs.set(rootDirectory, null);
 	return null;
 };
+const loadConfigWithSource = (rootDirectory) => {
+	const cached = cachedConfigs.get(rootDirectory);
+	if (cached !== void 0) return cached;
+	const loadPromise = loadConfigWalkingUp(rootDirectory);
+	cachedConfigs.set(rootDirectory, loadPromise);
+	return loadPromise;
+};
 const resolveConfigRootDir = (config, configSourceDirectory) => {
 	if (!config || !configSourceDirectory) return null;
 	const rawRootDir = config.rootDir;
@@ -4356,11 +4609,12 @@ const resolveConfigRootDir = (config, configSourceDirectory) => {
 	}
 	return resolvedRootDir;
 };
-const resolveDiagnoseTarget = (directory) => {
+const resolveDiagnoseTarget = (directory, options = {}) => {
 	if (isFile(path.join(directory, "package.json"))) return directory;
 	const reactSubprojects = discoverReactSubprojects(directory);
 	if (reactSubprojects.length === 0) return null;
 	if (reactSubprojects.length === 1) return reactSubprojects[0].directory;
+	if (options.allowAmbiguous === true) return null;
 	throw new AmbiguousProjectError(directory, reactSubprojects.map((subproject) => path.relative(directory, subproject.directory)).toSorted());
 };
 /**
@@ -4368,13 +4622,13 @@ const resolveDiagnoseTarget = (directory) => {
 * (`inspect()`, `diagnose()`, and the CLI's `inspectAction`):
 *
 *   1. Resolve the requested directory to absolute.
-*   2. Load `react-doctor.config.(json|js)` / `package.json#reactDoctor`
-*      if present.
+*   2. Load `doctor.config.*` / `package.json#reactDoctor` if present.
 *   3. Honor `config.rootDir` to redirect the scan to a nested
 *      project root, if configured.
 *   4. Walk into a nested React subproject when the requested
 *      directory has no `package.json` of its own (raises
-*      `AmbiguousProjectError` when multiple candidates exist).
+*      `AmbiguousProjectError` when multiple candidates exist unless
+*      the caller opts into keeping the wrapper directory).
 *
 * Throws `ProjectNotFoundError` when neither the requested directory
 * nor any discoverable nested project has a `package.json`.
@@ -4386,14 +4640,14 @@ const resolveDiagnoseTarget = (directory) => {
 * via its own cache). Routing through `resolveScanTarget` keeps every
 * shell in agreement on what "the scan directory" means.
 */
-const resolveScanTarget = (requestedDirectory) => {
+const resolveScanTarget = async (requestedDirectory, options = {}) => {
 	const absoluteRequested = path.resolve(requestedDirectory);
-	const loadedConfig = loadConfigWithSource(absoluteRequested);
+	const loadedConfig = await loadConfigWithSource(absoluteRequested);
 	const userConfig = loadedConfig?.config ?? null;
 	const configSourceDirectory = loadedConfig?.sourceDirectory ?? null;
 	const redirectedDirectory = resolveConfigRootDir(userConfig, configSourceDirectory);
 	const directoryAfterRedirect = redirectedDirectory ?? absoluteRequested;
-	const resolvedDirectory = resolveDiagnoseTarget(directoryAfterRedirect) ?? directoryAfterRedirect;
+	const resolvedDirectory = resolveDiagnoseTarget(directoryAfterRedirect, options) ?? directoryAfterRedirect;
 	if (!isDirectory(resolvedDirectory)) throw existsSync(resolvedDirectory) ? new NotADirectoryError(resolvedDirectory) : new ProjectNotFoundError(resolvedDirectory);
 	return {
 		resolvedDirectory,
@@ -4403,6 +4657,427 @@ const resolveScanTarget = (requestedDirectory) => {
 		didRedirectViaRootDir: redirectedDirectory !== null
 	};
 };
+const getDirectDependencyNames = (packageJson) => new Set([...Object.keys(packageJson.dependencies ?? {}), ...Object.keys(packageJson.devDependencies ?? {})]);
+const buildExpoCheckContext = (rootDirectory, expoVersion) => {
+	const packageJson = readPackageJson(path.join(rootDirectory, "package.json"));
+	return {
+		rootDirectory,
+		packageJson,
+		directDependencyNames: getDirectDependencyNames(packageJson),
+		expoSdkMajor: getLowestDependencyMajor(expoVersion)
+	};
+};
+const buildExpoDiagnostic = (input) => ({
+	filePath: input.filePath ?? "package.json",
+	plugin: "react-doctor",
+	rule: input.rule,
+	severity: input.severity ?? "warning",
+	message: input.message,
+	help: input.help,
+	line: input.line ?? 0,
+	column: input.column ?? 0,
+	category: input.category ?? "Correctness"
+});
+const CRITICAL_OVERRIDE_NAMES = new Set([
+	"@expo/cli",
+	"@expo/config",
+	"@expo/metro-config",
+	"@expo/metro-runtime",
+	"@expo/metro",
+	"metro"
+]);
+const isCriticalOverrideName = (packageName) => CRITICAL_OVERRIDE_NAMES.has(packageName) || packageName.startsWith("metro-");
+const collectOverrideNames = (packageJson) => new Set([
+	...Object.keys(packageJson.overrides ?? {}),
+	...Object.keys(packageJson.resolutions ?? {}),
+	...Object.keys(packageJson.pnpm?.overrides ?? {})
+]);
+const checkExpoDependencyOverrides = (context) => {
+	const overriddenCriticalNames = [...collectOverrideNames(context.packageJson)].filter(isCriticalOverrideName).sort();
+	if (overriddenCriticalNames.length === 0) return [];
+	const quotedNames = overriddenCriticalNames.map((name) => `"${name}"`).join(", ");
+	return [buildExpoDiagnostic({
+		rule: "expo-no-conflicting-dependency-override",
+		message: `package.json pins SDK-critical ${overriddenCriticalNames.length === 1 ? "package" : "packages"} via overrides/resolutions (${quotedNames}) — these versions are tied to the Expo SDK release and overriding them is unsupported and may break Metro or native builds`,
+		help: `Remove the override/resolution for ${quotedNames} and reinstall so the Expo-pinned versions are used`
+	})];
+};
+const isPathGitIgnored = (rootDirectory, absolutePath) => {
+	const result = spawnSync("git", [
+		"check-ignore",
+		"-q",
+		absolutePath
+	], {
+		cwd: rootDirectory,
+		stdio: [
+			"ignore",
+			"ignore",
+			"ignore"
+		]
+	});
+	if (result.error) return null;
+	if (result.status === 0) return true;
+	if (result.status === 1) return false;
+	return null;
+};
+const LOCAL_ENV_FILE_NAMES = [
+	".env.local",
+	".env.development.local",
+	".env.production.local",
+	".env.test.local"
+];
+const checkExpoEnvLocalFiles = (context) => {
+	const { rootDirectory } = context;
+	const committedEnvFiles = LOCAL_ENV_FILE_NAMES.filter((fileName) => {
+		const filePath = path.join(rootDirectory, fileName);
+		if (!isFile(filePath)) return false;
+		return isPathGitIgnored(rootDirectory, filePath) === false;
+	});
+	if (committedEnvFiles.length === 0) return [];
+	return [buildExpoDiagnostic({
+		rule: "expo-env-local-not-gitignored",
+		category: "Security",
+		message: `Local environment ${committedEnvFiles.length === 1 ? "file" : "files"} (${committedEnvFiles.join(", ")}) ${committedEnvFiles.length === 1 ? "is" : "are"} not ignored by Git — committing \`.env*.local\` risks leaking secrets and overriding committed defaults for everyone who clones the project`,
+		help: `Add \`.env*.local\` to your .gitignore. If already committed, untrack with \`git rm --cached ${committedEnvFiles.join(" ")}\``
+	})];
+};
+const isExpoSdkAtLeast = (expoSdkMajor, minMajor) => expoSdkMajor !== null && expoSdkMajor >= minMajor;
+const UNIMODULES_HELP = "Remove every `@unimodules/*` and `react-native-unimodules` package — their functionality now lives in `expo-modules-core`. See https://expo.fyi/r/sdk-44-remove-unimodules";
+const FIREBASE_HELP = "Use the Firebase JS SDK or React Native Firebase directly. See https://expo.fyi/firebase-migration-guide";
+const unimodulesEntry = (packageName) => ({
+	packageName,
+	rule: "expo-no-unimodules-packages",
+	message: `"${packageName}" is a legacy unimodules package that is incompatible with Expo SDK 44+ and will break native builds`,
+	help: UNIMODULES_HELP
+});
+const FLAGGED_DEPENDENCIES = [
+	unimodulesEntry("@unimodules/core"),
+	unimodulesEntry("@unimodules/react-native-adapter"),
+	unimodulesEntry("react-native-unimodules"),
+	{
+		packageName: "expo-cli",
+		rule: "expo-no-cli-dependencies",
+		message: "`expo-cli` (the legacy global CLI) is a project dependency — the CLI now ships inside the `expo` package, and keeping `expo-cli` causes failures such as `unknown option --fix` when running `npx expo install --fix`",
+		help: "Remove `expo-cli` from your dependencies and use the bundled CLI via `npx expo`"
+	},
+	{
+		packageName: "eas-cli",
+		rule: "expo-no-cli-dependencies",
+		message: "`eas-cli` is a project dependency — pinning it in package.json drifts from the latest EAS CLI and bloats installs",
+		help: "Remove `eas-cli` from your dependencies and run it on demand with `npx eas-cli` (or install it globally)"
+	},
+	{
+		packageName: "expo-modules-autolinking",
+		rule: "expo-no-redundant-dependency",
+		message: "\"expo-modules-autolinking\" should not be a direct dependency — Expo installs it transitively as needed",
+		help: "Remove `expo-modules-autolinking` from your package.json"
+	},
+	{
+		packageName: "expo-dev-launcher",
+		rule: "expo-no-redundant-dependency",
+		message: "\"expo-dev-launcher\" should not be a direct dependency — it is pulled in by `expo-dev-client`",
+		help: "Remove `expo-dev-launcher` and depend on `expo-dev-client` instead"
+	},
+	{
+		packageName: "expo-dev-menu",
+		rule: "expo-no-redundant-dependency",
+		message: "\"expo-dev-menu\" should not be a direct dependency — it is pulled in by `expo-dev-client`",
+		help: "Remove `expo-dev-menu` and depend on `expo-dev-client` instead"
+	},
+	{
+		packageName: "expo-modules-core",
+		rule: "expo-no-redundant-dependency",
+		message: "\"expo-modules-core\" should not be a direct dependency — use the API re-exported from the `expo` package",
+		help: "Remove `expo-modules-core` from your package.json and import from `expo` instead"
+	},
+	{
+		packageName: "@expo/metro-config",
+		rule: "expo-no-redundant-dependency",
+		message: "\"@expo/metro-config\" should not be a direct dependency — use the `expo/metro-config` sub-export of the `expo` package",
+		help: "Remove `@expo/metro-config` and import `expo/metro-config` in your metro.config.js"
+	},
+	{
+		packageName: "@types/react-native",
+		rule: "expo-no-redundant-dependency",
+		message: "\"@types/react-native\" should not be installed — React Native ships its own types since SDK 48",
+		help: "Remove `@types/react-native` from your package.json",
+		minSdkMajor: 48
+	},
+	{
+		packageName: "@expo/config-plugins",
+		rule: "expo-no-redundant-dependency",
+		message: "\"@expo/config-plugins\" should not be a direct dependency — use the `expo/config-plugins` sub-export of the `expo` package",
+		help: "Remove `@expo/config-plugins`; config-plugin authors should import from `expo/config-plugins`. See https://github.com/expo/expo/pull/18855",
+		minSdkMajor: 48
+	},
+	{
+		packageName: "@expo/prebuild-config",
+		rule: "expo-no-redundant-dependency",
+		message: "\"@expo/prebuild-config\" should not be a direct dependency — Expo installs it transitively",
+		help: "Remove `@expo/prebuild-config` from your package.json",
+		minSdkMajor: 53
+	},
+	{
+		packageName: "expo-permissions",
+		rule: "expo-no-redundant-dependency",
+		message: "\"expo-permissions\" was deprecated in SDK 41 and may no longer compile — permissions moved onto each module (e.g. `MediaLibrary.requestPermissionsAsync()`)",
+		help: "Remove `expo-permissions` and request permissions from the relevant module instead",
+		minSdkMajor: 50
+	},
+	{
+		packageName: "expo-app-loading",
+		rule: "expo-no-redundant-dependency",
+		message: "\"expo-app-loading\" was removed in SDK 49",
+		help: "Remove `expo-app-loading` and use `expo-splash-screen` instead. See https://docs.expo.dev/versions/latest/sdk/splash-screen/",
+		minSdkMajor: 49
+	},
+	{
+		packageName: "expo-firebase-analytics",
+		rule: "expo-no-redundant-dependency",
+		message: "\"expo-firebase-analytics\" was removed in SDK 48",
+		help: FIREBASE_HELP,
+		minSdkMajor: 48
+	},
+	{
+		packageName: "expo-firebase-recaptcha",
+		rule: "expo-no-redundant-dependency",
+		message: "\"expo-firebase-recaptcha\" was removed in SDK 48",
+		help: FIREBASE_HELP,
+		minSdkMajor: 48
+	},
+	{
+		packageName: "expo-firebase-core",
+		rule: "expo-no-redundant-dependency",
+		message: "\"expo-firebase-core\" was removed in SDK 48",
+		help: FIREBASE_HELP,
+		minSdkMajor: 48
+	}
+];
+const checkExpoFlaggedDependencies = (context) => FLAGGED_DEPENDENCIES.filter((flaggedDependency) => {
+	if (!context.directDependencyNames.has(flaggedDependency.packageName)) return false;
+	if (flaggedDependency.minSdkMajor === void 0) return true;
+	return isExpoSdkAtLeast(context.expoSdkMajor, flaggedDependency.minSdkMajor);
+}).map((flaggedDependency) => buildExpoDiagnostic({
+	rule: flaggedDependency.rule,
+	message: flaggedDependency.message,
+	help: flaggedDependency.help
+}));
+const findLocalModuleNativeFiles = (rootDirectory) => {
+	const modulesDirectory = path.join(rootDirectory, "modules");
+	if (!isDirectory(modulesDirectory)) return [];
+	const nativeFilePaths = [];
+	for (const moduleEntry of readDirectoryEntries(modulesDirectory)) {
+		if (!moduleEntry.isDirectory()) continue;
+		const moduleDirectory = path.join(modulesDirectory, moduleEntry.name);
+		const gradlePath = path.join(moduleDirectory, "android", "build.gradle");
+		if (isFile(gradlePath)) nativeFilePaths.push(gradlePath);
+		const iosDirectory = path.join(moduleDirectory, "ios");
+		if (isDirectory(iosDirectory)) {
+			for (const iosEntry of readDirectoryEntries(iosDirectory)) if (iosEntry.isFile() && iosEntry.name.endsWith(".podspec")) nativeFilePaths.push(path.join(iosDirectory, iosEntry.name));
+		}
+	}
+	return nativeFilePaths;
+};
+const checkExpoGitignore = (context) => {
+	const { rootDirectory } = context;
+	const diagnostics = [];
+	const expoStateDirectory = path.join(rootDirectory, ".expo");
+	if (isDirectory(expoStateDirectory) && isPathGitIgnored(rootDirectory, expoStateDirectory) === false) diagnostics.push(buildExpoDiagnostic({
+		rule: "expo-gitignore",
+		message: "The `.expo` directory is not ignored by Git — it holds machine-specific device history and dev-server settings that should not be committed",
+		help: "Add `.expo/` to your .gitignore"
+	}));
+	if (findLocalModuleNativeFiles(rootDirectory).find((nativeFilePath) => isPathGitIgnored(rootDirectory, nativeFilePath) === true) !== void 0) diagnostics.push(buildExpoDiagnostic({
+		rule: "expo-gitignore",
+		message: "The native `ios`/`android` directories of a local Expo module under `modules/` are gitignored — usually caused by an overly broad `ios`/`android` ignore rule",
+		help: "Use anchored patterns like `/ios` and `/android` in .gitignore so only the top-level native directories are excluded, not those inside `modules/`"
+	}));
+	return diagnostics;
+};
+const LOCKFILE_NAMES = [
+	"pnpm-lock.yaml",
+	"yarn.lock",
+	"package-lock.json",
+	"bun.lockb",
+	"bun.lock"
+];
+const checkExpoLockfile = (context) => {
+	const workspaceRoot = isMonorepoRoot(context.rootDirectory) ? context.rootDirectory : findMonorepoRoot(context.rootDirectory) ?? context.rootDirectory;
+	const presentLockfiles = LOCKFILE_NAMES.filter((lockfileName) => isFile(path.join(workspaceRoot, lockfileName)));
+	if (presentLockfiles.length === 0) return [buildExpoDiagnostic({
+		rule: "expo-lockfile",
+		message: "No lock file detected at the project root — installs are not reproducible, and EAS Build cannot infer your package manager",
+		help: "Install dependencies with your package manager to generate a lock file, then commit it"
+	})];
+	if (presentLockfiles.length > 1) return [buildExpoDiagnostic({
+		rule: "expo-lockfile",
+		message: `Multiple lock files detected (${presentLockfiles.join(", ")}) — CI environments such as EAS Build infer the package manager from the lock file, so this is ambiguous`,
+		help: "Delete the lock files for the package managers you are not using and keep only one"
+	})];
+	return [];
+};
+const METRO_CONFIG_FILE_NAMES = [
+	"metro.config.js",
+	"metro.config.cjs",
+	"metro.config.mjs",
+	"metro.config.ts"
+];
+const EXPO_METRO_CONFIG_EXTEND_SIGNALS = [
+	"expo/metro-config",
+	"@sentry/react-native/metro",
+	"getSentryExpoConfig"
+];
+const checkExpoMetroConfig = (context) => {
+	const metroConfigPath = METRO_CONFIG_FILE_NAMES.map((fileName) => path.join(context.rootDirectory, fileName)).find((candidatePath) => isFile(candidatePath));
+	if (metroConfigPath === void 0) return [];
+	let contents;
+	try {
+		contents = fs.readFileSync(metroConfigPath, "utf-8");
+	} catch {
+		return [];
+	}
+	if (EXPO_METRO_CONFIG_EXTEND_SIGNALS.some((signal) => contents.includes(signal))) return [];
+	return [buildExpoDiagnostic({
+		rule: "expo-metro-config",
+		filePath: path.basename(metroConfigPath),
+		message: "Your metro.config does not extend `expo/metro-config` — a custom Metro config that doesn't extend Expo's leads to unexpected, hard-to-debug bundling issues",
+		help: "Update your metro config to extend `expo/metro-config`. See https://docs.expo.dev/guides/customizing-metro/"
+	})];
+};
+const CONFLICTING_SCRIPT_NAMES = ["expo", "react-native"];
+const checkExpoPackageJsonConflicts = (context) => {
+	const { packageJson } = context;
+	const diagnostics = [];
+	const conflictingScriptNames = CONFLICTING_SCRIPT_NAMES.filter((scriptName) => Boolean(packageJson.scripts?.[scriptName]));
+	if (conflictingScriptNames.length > 0) {
+		const quotedNames = conflictingScriptNames.map((name) => `"${name}"`).join(", ");
+		const shadowsExpoCli = conflictingScriptNames.includes("expo");
+		diagnostics.push(buildExpoDiagnostic({
+			rule: "expo-package-json-conflict",
+			message: `package.json defines ${quotedNames} ${conflictingScriptNames.length === 1 ? "as a script that conflicts" : "as scripts that conflict"} with binaries in node_modules/.bin${shadowsExpoCli ? " — a `expo` script shadows the Expo CLI and will likely cause build failures" : ""}`,
+			help: "Rename these scripts so they don't collide with the `expo` / `react-native` binaries"
+		}));
+	}
+	const packageName = packageJson.name;
+	if (typeof packageName === "string" && context.directDependencyNames.has(packageName)) diagnostics.push(buildExpoDiagnostic({
+		rule: "expo-package-json-conflict",
+		message: `package.json "name" is "${packageName}", which collides with a dependency of the same name`,
+		help: "Rename your package so it no longer matches one of its dependencies"
+	}));
+	return diagnostics;
+};
+const APP_CONFIG_JSON_FILES = ["app.config.json", "app.json"];
+const APP_CONFIG_DYNAMIC_FILES = [
+	"app.config.ts",
+	"app.config.js",
+	"app.config.cjs",
+	"app.config.mjs"
+];
+const ExpoConfigSchema = Schema.Struct({
+	newArchEnabled: Schema.optional(Schema.Boolean),
+	updates: Schema.optional(Schema.Struct({ disableAntiBrickingMeasures: Schema.optional(Schema.Boolean) }))
+});
+const AppManifestSchema = Schema.Struct({ expo: Schema.optional(ExpoConfigSchema) });
+const NO_CONFIG = {
+	config: null,
+	configFile: null
+};
+const decodeExpoConfig = (filePath) => {
+	let raw;
+	try {
+		raw = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+	} catch {
+		return null;
+	}
+	return Option.getOrNull(Schema.decodeUnknownOption(AppManifestSchema)(raw))?.expo ?? null;
+};
+const readExpoAppConfig = (rootDirectory) => {
+	if (APP_CONFIG_DYNAMIC_FILES.some((fileName) => isFile(path.join(rootDirectory, fileName)))) return NO_CONFIG;
+	for (const fileName of APP_CONFIG_JSON_FILES) {
+		const filePath = path.join(rootDirectory, fileName);
+		if (!isFile(filePath)) continue;
+		const config = decodeExpoConfig(filePath);
+		if (config) return {
+			config,
+			configFile: fileName
+		};
+	}
+	return NO_CONFIG;
+};
+const REANIMATED_PACKAGE = "react-native-reanimated";
+const WORKLETS_PACKAGE = "react-native-worklets";
+const FIRST_NEW_ARCH_ONLY_REANIMATED_MAJOR = 4;
+const checkExpoReanimatedNewArch = (context) => {
+	const reanimatedSpec = context.packageJson.dependencies?.[REANIMATED_PACKAGE] ?? context.packageJson.devDependencies?.[REANIMATED_PACKAGE];
+	const reanimatedMajor = reanimatedSpec === void 0 ? null : getLowestDependencyMajor(reanimatedSpec);
+	if (!(reanimatedMajor !== null && reanimatedMajor >= FIRST_NEW_ARCH_ONLY_REANIMATED_MAJOR || context.directDependencyNames.has(WORKLETS_PACKAGE))) return [];
+	const appConfig = readExpoAppConfig(context.rootDirectory);
+	if (appConfig.config?.newArchEnabled !== false) return [];
+	return [buildExpoDiagnostic({
+		rule: "expo-reanimated-v4-requires-new-arch",
+		severity: "error",
+		filePath: appConfig.configFile ?? "app.json",
+		message: "react-native-reanimated v4 supports only the New Architecture, but `newArchEnabled: false` is set in your app config, so the app will crash on first launch.",
+		help: "Remove `newArchEnabled: false` from your app config (the New Architecture is the default on SDK 52+), or pin react-native-reanimated to v3 if you must stay on the legacy architecture."
+	})];
+};
+const EXPO_ROUTER_REACT_NAVIGATION_MIN_SDK_MAJOR = 56;
+const EXPO_ROUTER_REACT_NAVIGATION_MAX_SDK_MAJOR_EXCLUSIVE = 57;
+const checkExpoRouterReactNavigation = (context) => {
+	const { expoSdkMajor } = context;
+	if (!isExpoSdkAtLeast(expoSdkMajor, EXPO_ROUTER_REACT_NAVIGATION_MIN_SDK_MAJOR)) return [];
+	if (expoSdkMajor !== null && expoSdkMajor >= EXPO_ROUTER_REACT_NAVIGATION_MAX_SDK_MAJOR_EXCLUSIVE) return [];
+	if (!context.directDependencyNames.has("expo-router")) return [];
+	const reactNavigationNames = [...context.directDependencyNames].filter((packageName) => packageName.startsWith("@react-navigation/")).sort();
+	if (reactNavigationNames.length === 0) return [];
+	return [buildExpoDiagnostic({
+		rule: "expo-router-no-react-navigation",
+		message: `As of SDK 56, expo-router is no longer compatible with react-navigation, but ${reactNavigationNames.map((name) => `"${name}"`).join(", ")} ${reactNavigationNames.length === 1 ? "is" : "are"} installed as direct ${reactNavigationNames.length === 1 ? "dependency" : "dependencies"}`,
+		help: "Remove these `@react-navigation/*` packages and replace direct imports with their expo-router equivalents. See https://docs.expo.dev/router/migrate/sdk-55-to-56/"
+	})];
+};
+const checkExpoUpdatesConfig = (context) => {
+	const appConfig = readExpoAppConfig(context.rootDirectory);
+	if (appConfig.config?.updates?.disableAntiBrickingMeasures !== true) return [];
+	return [buildExpoDiagnostic({
+		rule: "expo-updates-no-unsafe-production-config",
+		severity: "error",
+		filePath: appConfig.configFile ?? "app.json",
+		message: "`updates.disableAntiBrickingMeasures: true` disables expo-updates' recovery safeguards and is liable to leave installed apps in a permanently bricked state, so it must not be used in production.",
+		help: "Remove `disableAntiBrickingMeasures` from your app config's `updates` block. See https://docs.expo.dev/versions/latest/config/app/#updates"
+	})];
+};
+const VECTOR_ICONS_MIN_SDK_MAJOR = 56;
+const SCOPED_VECTOR_ICONS_NAMESPACE = "@react-native-vector-icons/";
+const CONFLICTING_VECTOR_ICONS_PACKAGES = ["@expo/vector-icons", "react-native-vector-icons"];
+const checkExpoVectorIcons = (context) => {
+	if (!isExpoSdkAtLeast(context.expoSdkMajor, VECTOR_ICONS_MIN_SDK_MAJOR)) return [];
+	const hasScopedPackage = [...context.directDependencyNames].some((packageName) => packageName.startsWith(SCOPED_VECTOR_ICONS_NAMESPACE));
+	const hasConflictingPackage = CONFLICTING_VECTOR_ICONS_PACKAGES.some((packageName) => context.directDependencyNames.has(packageName));
+	if (!hasScopedPackage || !hasConflictingPackage) return [];
+	return [buildExpoDiagnostic({
+		rule: "expo-vector-icons-conflict",
+		message: "This project installs both the scoped `@react-native-vector-icons/*` packages and `@expo/vector-icons` (or the deprecated `react-native-vector-icons`) — mixing them causes icon-rendering conflicts",
+		help: "Migrate to the scoped packages by running `npx @react-native-vector-icons/codemod`, then remove the conflicting package"
+	})];
+};
+const checkExpoProject = (rootDirectory, project) => {
+	if (project.expoVersion === null) return [];
+	const context = buildExpoCheckContext(rootDirectory, project.expoVersion);
+	return [
+		...checkExpoFlaggedDependencies(context),
+		...checkExpoDependencyOverrides(context),
+		...checkExpoRouterReactNavigation(context),
+		...checkExpoVectorIcons(context),
+		...checkExpoPackageJsonConflicts(context),
+		...checkExpoLockfile(context),
+		...checkExpoGitignore(context),
+		...checkExpoEnvLocalFiles(context),
+		...checkExpoMetroConfig(context),
+		...checkExpoReanimatedNewArch(context),
+		...checkExpoUpdatesConfig(context)
+	];
+};
 const PNPM_WORKSPACE_FILE = "pnpm-workspace.yaml";
 const PNPM_LOCKFILE = "pnpm-lock.yaml";
 const PACKAGE_JSON_FILE = "package.json";
@@ -4517,6 +5192,69 @@ const checkPnpmHardening = (rootDirectory) => {
 	}));
 	return diagnostics;
 };
+const BUILDER_BOB_PACKAGE = "react-native-builder-bob";
+const isBuilderBobLibrary = (packageJson) => {
+	const bobConfig = packageJson[BUILDER_BOB_PACKAGE];
+	return typeof bobConfig === "object" && bobConfig !== null;
+};
+const checkReactNativeLibraryDependencies = (rootDirectory) => {
+	const packageJson = readPackageJson(path.join(rootDirectory, "package.json"));
+	if (!isBuilderBobLibrary(packageJson)) return [];
+	const misplaced = ["react", "react-native"].filter((name) => packageJson.dependencies?.[name] !== void 0);
+	if (misplaced.length === 0) return [];
+	const quoted = misplaced.map((name) => `"${name}"`).join(" and ");
+	return [{
+		filePath: "package.json",
+		plugin: "react-doctor",
+		rule: "rn-library-react-in-dependencies",
+		severity: "warning",
+		message: `This react-native-builder-bob library lists ${quoted} in \`dependencies\` — that ships a second copy into consumer apps, causing "Invalid hook call" (duplicate React) and duplicate-native-module crashes.`,
+		help: `Move ${quoted} to \`peerDependencies\` (keep ${misplaced.length === 1 ? "it" : "them"} in \`devDependencies\` for local development).`,
+		line: 0,
+		column: 0,
+		category: "Correctness"
+	}];
+};
+const BABEL_CONFIG_FILE_NAMES = [
+	"babel.config.js",
+	"babel.config.cjs",
+	"babel.config.mjs",
+	"babel.config.json",
+	".babelrc",
+	".babelrc.js",
+	".babelrc.json"
+];
+const LEGACY_PRESET_SPEC = "module:metro-react-native-babel-preset";
+const checkReactNativeMetroBabelPreset = (rootDirectory) => {
+	for (const fileName of BABEL_CONFIG_FILE_NAMES) {
+		const filePath = path.join(rootDirectory, fileName);
+		if (!isFile(filePath)) continue;
+		let contents;
+		try {
+			contents = fs.readFileSync(filePath, "utf-8");
+		} catch {
+			continue;
+		}
+		if (!contents.includes(LEGACY_PRESET_SPEC)) continue;
+		return [{
+			filePath: fileName,
+			plugin: "react-doctor",
+			rule: "rn-no-metro-babel-preset",
+			severity: "error",
+			message: "`module:metro-react-native-babel-preset` was renamed to `@react-native/babel-preset` and is no longer installed by React Native 0.73+ — this preset reference fails to resolve and breaks the Metro/Babel transform.",
+			help: "Replace the preset with `module:@react-native/babel-preset` (or `babel-preset-expo` on Expo) and remove the old `metro-react-native-babel-preset` dependency.",
+			line: 0,
+			column: 0,
+			category: "Correctness"
+		}];
+	}
+	return [];
+};
+const isReactNativeProject = (project) => project.framework === "react-native" || project.framework === "expo" || project.hasReactNativeWorkspace || project.expoVersion !== null;
+const checkReactNativeProject = (rootDirectory, project) => {
+	if (!isReactNativeProject(project)) return [];
+	return [...checkReactNativeMetroBabelPreset(rootDirectory), ...checkReactNativeLibraryDependencies(rootDirectory)];
+};
 const REDUCED_MOTION_GREP_PATTERN = "prefers-reduced-motion|useReducedMotion|MotionConfig|reducedMotion";
 const REDUCED_MOTION_FILE_GLOBS = [
 	"*.ts",
@@ -4572,99 +5310,6 @@ const checkReducedMotion = (rootDirectory) => {
 	return [MISSING_REDUCED_MOTION_DIAGNOSTIC];
 };
 const computeJsxIncludePaths = (includePaths) => includePaths.length > 0 ? includePaths.filter((filePath) => JSX_FILE_PATTERN.test(filePath)) : void 0;
-const toStringSet = (values) => {
-	if (!values || values.length === 0) return /* @__PURE__ */ new Set();
-	return new Set(values.filter((value) => typeof value === "string" && value.length > 0));
-};
-const buildResolvedControls = (surface, userControls) => {
-	const excludeTags = new Set(DEFAULT_SURFACE_EXCLUDED_TAGS[surface]);
-	const includeTags = toStringSet(userControls?.includeTags);
-	for (const tag of includeTags) excludeTags.delete(tag);
-	for (const tag of toStringSet(userControls?.excludeTags)) excludeTags.add(tag);
-	return {
-		includeTags,
-		excludeTags,
-		includeCategories: toStringSet(userControls?.includeCategories),
-		excludeCategories: toStringSet(userControls?.excludeCategories),
-		includeRuleKeys: toStringSet(userControls?.includeRules),
-		excludeRuleKeys: toStringSet(userControls?.excludeRules)
-	};
-};
-const intersects = (values, candidates) => values.some((value) => candidates.has(value));
-const isDiagnosticOnSurface = (diagnostic, surface, config) => {
-	const resolved = buildResolvedControls(surface, config?.surfaces?.[surface]);
-	const { ruleKey, category, tags } = getDiagnosticRuleIdentity(diagnostic);
-	if (resolved.includeRuleKeys.has(ruleKey)) return true;
-	if (resolved.includeCategories.has(category)) return true;
-	if (intersects(tags, resolved.includeTags)) return true;
-	if (resolved.excludeRuleKeys.has(ruleKey)) return false;
-	if (resolved.excludeCategories.has(category)) return false;
-	if (intersects(tags, resolved.excludeTags)) return false;
-	return true;
-};
-const filterDiagnosticsForSurface = (diagnostics, surface, config) => diagnostics.filter((diagnostic) => isDiagnosticOnSurface(diagnostic, surface, config));
-const listSourceFilesViaGit = (rootDirectory) => {
-	const result = spawnSync("git", [
-		"ls-files",
-		"-z",
-		"--cached",
-		"--others",
-		"--exclude-standard"
-	], {
-		cwd: rootDirectory,
-		encoding: "utf-8",
-		maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES
-	});
-	if (result.error || result.status !== 0) return null;
-	return result.stdout.split("\0").filter((filePath) => filePath.length > 0 && SOURCE_FILE_PATTERN.test(filePath));
-};
-const listSourceFilesViaFilesystem = (rootDirectory) => {
-	const filePaths = [];
-	const stack = [rootDirectory];
-	while (stack.length > 0) {
-		const currentDirectory = stack.pop();
-		const entries = readDirectoryEntries(currentDirectory);
-		for (const entry of entries) {
-			const absolutePath = path.join(currentDirectory, entry.name);
-			if (entry.isDirectory()) {
-				if (!entry.name.startsWith(".") && !IGNORED_DIRECTORIES.has(entry.name)) stack.push(absolutePath);
-				continue;
-			}
-			if (entry.isFile() && SOURCE_FILE_PATTERN.test(entry.name)) filePaths.push(path.relative(rootDirectory, absolutePath).replace(/\\/g, "/"));
-		}
-	}
-	return filePaths;
-};
-const listSourceFiles = (rootDirectory) => listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory);
-const resolveLintIncludePaths = (rootDirectory, userConfig) => {
-	if (!Array.isArray(userConfig?.ignore?.files) || userConfig.ignore.files.length === 0) return;
-	const ignoredPatterns = compileIgnoredFilePatterns(userConfig);
-	return listSourceFiles(rootDirectory).filter((filePath) => {
-		if (!JSX_FILE_PATTERN.test(filePath)) return false;
-		return !isFileIgnoredByPatterns(filePath, rootDirectory, ignoredPatterns);
-	});
-};
-var Config = class Config extends Context.Service()("react-doctor/Config") {
-	static layerNode = Layer.effect(Config, Effect.gen(function* () {
-		const cache = yield* Cache.make({
-			capacity: 16,
-			timeToLive: CONFIG_CACHE_TTL_MS,
-			lookup: (directory) => Effect.sync(() => {
-				const loaded = loadConfigWithSource(directory);
-				const redirected = resolveConfigRootDir(loaded?.config ?? null, loaded?.sourceDirectory ?? null);
-				return {
-					config: loaded?.config ?? null,
-					resolvedDirectory: redirected ?? directory,
-					configSourceDirectory: loaded?.sourceDirectory ?? null
-				};
-			})
-		});
-		return Config.of({ resolve: Effect.fn("Config.resolve")(function* (directory) {
-			return yield* Cache.get(cache, directory);
-		}) });
-	}));
-	static layerOf = (resolved) => Layer.succeed(Config, Config.of({ resolve: () => Effect.succeed(resolved) }));
-};
 const LINGUIST_ATTRIBUTE_PATTERN = /^linguist-(?:vendored|generated)(?:=([a-zA-Z0-9]+))?$/i;
 const FALSY_VALUES = new Set([
 	"false",
@@ -4746,6 +5391,30 @@ const collectIgnorePatterns = (rootDirectory) => {
 	cachedPatternsByRoot.set(rootDirectory, patterns);
 	return patterns;
 };
+/**
+* Resolves a path to its canonical, symlink-free form, falling back to
+* the input when it cannot be realpath'd (broken symlink, permission
+* error) so a best-effort normalization never throws.
+*
+* deslop's dead-code module graph is collected with `fast-glob` (which
+* keeps the scan root's symlinks intact) while imports are resolved
+* through `oxc-resolver` (which returns realpath'd targets). When the
+* project root sits behind a symlink — e.g. macOS iCloud-synced
+* `~/Documents` / `~/Desktop`, or a symlinked checkout — those two path
+* spaces diverge: every resolved import misses the graph and the files
+* they point at (commonly every `@/…` alias target) are mis-reported as
+* unreachable. Canonicalizing the root before the scan keeps both path
+* spaces in agreement.
+*/
+const toCanonicalPath = (filePath) => {
+	try {
+		return fs.realpathSync(filePath);
+	} catch {
+		return filePath;
+	}
+};
+const DEAD_CODE_PLUGIN = "deslop";
+const DEAD_CODE_CATEGORY = "Maintainability";
 const TSCONFIG_FILENAMES$1 = ["tsconfig.json", "tsconfig.base.json"];
 const DEAD_CODE_WORKER_SCRIPT = `
 const inputChunks = [];
@@ -4921,7 +5590,11 @@ const buildDeadCodeWorkerError = (workerError) => {
 	return error;
 };
 const createDeadCodeWorker = (input) => {
-	const child = spawn(process.execPath, ["-e", DEAD_CODE_WORKER_SCRIPT], {
+	const child = spawn(process.execPath, [
+		`--max-old-space-size=${DEAD_CODE_WORKER_MAX_OLD_SPACE_MB}`,
+		"-e",
+		DEAD_CODE_WORKER_SCRIPT
+	], {
 		stdio: [
 			"pipe",
 			"pipe",
@@ -4996,7 +5669,8 @@ const runDeadCodeWorkerWithTimeout = (handle, timeoutMs) => new Promise((resolve
 	});
 });
 const checkDeadCode = async (options) => {
-	const { rootDirectory, userConfig } = options;
+	const { userConfig } = options;
+	const rootDirectory = toCanonicalPath(options.rootDirectory);
 	if (!fs.existsSync(path.join(rootDirectory, "package.json"))) return [];
 	const ignorePatterns = collectDeadCodeIgnorePatterns(rootDirectory, userConfig);
 	const result = parseDeadCodeWorkerResult(await runDeadCodeWorkerWithTimeout((options.createWorker ?? createDeadCodeWorker)({
@@ -5009,59 +5683,162 @@ const checkDeadCode = async (options) => {
 	const diagnostics = [];
 	for (const unusedFile of result.unusedFiles) diagnostics.push({
 		filePath: toRelative(unusedFile.path),
-		plugin: "deslop",
+		plugin: DEAD_CODE_PLUGIN,
 		rule: "unused-file",
 		severity: "warning",
 		message: "Unused file — not reachable from any entry point",
 		help: "Delete the file if it is truly unreachable, or import it from an entry point.",
 		line: 0,
 		column: 0,
-		category: "Dead Code"
+		category: DEAD_CODE_CATEGORY
 	});
 	for (const unusedExport of result.unusedExports) {
 		const label = unusedExport.isTypeOnly ? "type export" : "export";
 		diagnostics.push({
 			filePath: toRelative(unusedExport.path),
-			plugin: "deslop",
+			plugin: DEAD_CODE_PLUGIN,
 			rule: unusedExport.isTypeOnly ? "unused-type" : "unused-export",
 			severity: "warning",
 			message: `Unused ${label}: \`${unusedExport.name}\``,
 			help: "Drop the `export` keyword (or remove the declaration) if no other module uses this symbol.",
 			line: unusedExport.line,
 			column: unusedExport.column,
-			category: "Dead Code"
+			category: DEAD_CODE_CATEGORY
 		});
 	}
 	for (const unusedDependency of result.unusedDependencies) {
 		const label = unusedDependency.isDevDependency ? "devDependency" : "dependency";
 		diagnostics.push({
 			filePath: "package.json",
-			plugin: "deslop",
+			plugin: DEAD_CODE_PLUGIN,
 			rule: unusedDependency.isDevDependency ? "unused-dev-dependency" : "unused-dependency",
 			severity: "warning",
 			message: `Unused ${label}: \`${unusedDependency.name}\``,
 			help: "Remove the dependency from package.json if it is genuinely unused.",
 			line: 0,
 			column: 0,
-			category: "Dead Code"
+			category: DEAD_CODE_CATEGORY
 		});
 	}
 	for (const cycle of result.circularDependencies) {
 		if (cycle.files.length === 0) continue;
 		diagnostics.push({
 			filePath: toRelative(cycle.files[0]),
-			plugin: "deslop",
+			plugin: DEAD_CODE_PLUGIN,
 			rule: "circular-dependency",
 			severity: "warning",
 			message: `Circular import cycle: ${cycle.files.map(toRelative).join(" → ")}`,
 			help: "Break the cycle by extracting the shared code into a third module that both files import.",
 			line: 0,
 			column: 0,
-			category: "Dead Code"
+			category: DEAD_CODE_CATEGORY
 		});
 	}
 	return diagnostics;
 };
+const DEAD_CODE_RULE_KEY_PREFIX = `${DEAD_CODE_PLUGIN}/`;
+const isSurfacingOverride = (override) => override === "warn" || override === "error";
+const deadCodeMaySurfaceWhenWarningsHidden = (userConfig) => {
+	const severityControls = buildRuleSeverityControls(userConfig);
+	if (!severityControls) return false;
+	if (isSurfacingOverride(severityControls.categories?.["Maintainability"])) return true;
+	for (const [ruleKey, override] of Object.entries(severityControls.rules ?? {})) if (ruleKey.startsWith(DEAD_CODE_RULE_KEY_PREFIX) && isSurfacingOverride(override)) return true;
+	return false;
+};
+const toStringSet = (values) => {
+	if (!values || values.length === 0) return /* @__PURE__ */ new Set();
+	return new Set(values.filter((value) => typeof value === "string" && value.length > 0));
+};
+const buildResolvedControls = (surface, userControls) => {
+	const excludeTags = new Set(DEFAULT_SURFACE_EXCLUDED_TAGS[surface]);
+	const includeTags = toStringSet(userControls?.includeTags);
+	for (const tag of includeTags) excludeTags.delete(tag);
+	for (const tag of toStringSet(userControls?.excludeTags)) excludeTags.add(tag);
+	return {
+		includeTags,
+		excludeTags,
+		includeCategories: toStringSet(userControls?.includeCategories),
+		excludeCategories: toStringSet(userControls?.excludeCategories),
+		includeRuleKeys: toStringSet(userControls?.includeRules),
+		excludeRuleKeys: toStringSet(userControls?.excludeRules)
+	};
+};
+const intersects = (values, candidates) => values.some((value) => candidates.has(value));
+const isDiagnosticOnSurface = (diagnostic, surface, config) => {
+	const resolved = buildResolvedControls(surface, config?.surfaces?.[surface]);
+	const { ruleKey, category, tags } = getDiagnosticRuleIdentity(diagnostic);
+	if (resolved.includeRuleKeys.has(ruleKey)) return true;
+	if (resolved.includeCategories.has(category)) return true;
+	if (intersects(tags, resolved.includeTags)) return true;
+	if (resolved.excludeRuleKeys.has(ruleKey)) return false;
+	if (resolved.excludeCategories.has(category)) return false;
+	if (intersects(tags, resolved.excludeTags)) return false;
+	return true;
+};
+const filterDiagnosticsForSurface = (diagnostics, surface, config) => diagnostics.filter((diagnostic) => isDiagnosticOnSurface(diagnostic, surface, config));
+const excludeMinifiedFiles = (rootDirectory, relativePaths) => relativePaths.filter((relativePath) => !isLargeMinifiedFile(path.resolve(rootDirectory, relativePath)));
+const listSourceFilesViaGit = (rootDirectory) => {
+	const result = spawnSync("git", [
+		"ls-files",
+		"-z",
+		"--cached",
+		"--others",
+		"--exclude-standard"
+	], {
+		cwd: rootDirectory,
+		encoding: "utf-8",
+		maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES
+	});
+	if (result.error || result.status !== 0) return null;
+	return result.stdout.split("\0").filter((filePath) => filePath.length > 0 && isLintableSourceFile(filePath));
+};
+const listSourceFilesViaFilesystem = (rootDirectory) => {
+	const filePaths = [];
+	const stack = [rootDirectory];
+	while (stack.length > 0) {
+		const currentDirectory = stack.pop();
+		const entries = readDirectoryEntries(currentDirectory);
+		for (const entry of entries) {
+			const absolutePath = path.join(currentDirectory, entry.name);
+			if (entry.isDirectory()) {
+				if (!entry.name.startsWith(".") && !IGNORED_DIRECTORIES.has(entry.name)) stack.push(absolutePath);
+				continue;
+			}
+			if (entry.isFile() && isLintableSourceFile(entry.name)) filePaths.push(path.relative(rootDirectory, absolutePath).replace(/\\/g, "/"));
+		}
+	}
+	return filePaths;
+};
+const listSourceFiles = (rootDirectory) => excludeMinifiedFiles(rootDirectory, listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory));
+const resolveLintIncludePaths = (rootDirectory, userConfig) => {
+	if (!Array.isArray(userConfig?.ignore?.files) || userConfig.ignore.files.length === 0) return;
+	const ignoredPatterns = compileIgnoredFilePatterns(userConfig);
+	return listSourceFiles(rootDirectory).filter((filePath) => {
+		if (!JSX_FILE_PATTERN.test(filePath)) return false;
+		return !isFileIgnoredByPatterns(filePath, rootDirectory, ignoredPatterns);
+	});
+};
+var Config = class Config extends Context.Service()("react-doctor/Config") {
+	static layerNode = Layer.effect(Config, Effect.gen(function* () {
+		const cache = yield* Cache.make({
+			capacity: 16,
+			timeToLive: CONFIG_CACHE_TTL_MS,
+			lookup: (directory) => Effect.promise(async () => {
+				const loaded = await loadConfigWithSource(directory);
+				const redirected = resolveConfigRootDir(loaded?.config ?? null, loaded?.sourceDirectory ?? null);
+				return {
+					config: loaded?.config ?? null,
+					resolvedDirectory: redirected ?? directory,
+					configSourceDirectory: loaded?.sourceDirectory ?? null
+				};
+			})
+		});
+		return Config.of({ resolve: Effect.fn("Config.resolve")(function* (directory) {
+			return yield* Cache.get(cache, directory);
+		}) });
+	}));
+	static layerOf = (resolved) => Layer.succeed(Config, Config.of({ resolve: () => Effect.succeed(resolved) }));
+};
 /**
 * `DeadCode` runs whole-project reachability analysis and streams
 * diagnostics. Reachability is a whole-project property — the
@@ -5567,12 +6344,12 @@ const findFilesWithDisableDirectivesViaGit = async (rootDirectory, includePaths)
 		return null;
 	}
 	if (grepResult === null) return null;
-	return grepResult.stdout.split("\n").filter((filePath) => filePath.length > 0 && SOURCE_FILE_PATTERN.test(filePath));
+	return grepResult.stdout.split("\n").filter((filePath) => filePath.length > 0 && isLintableSourceFile(filePath));
 };
 const findFilesWithDisableDirectivesViaFilesystem = (rootDirectory, includePaths) => {
 	const matches = [];
 	const checkFile = (relativePath) => {
-		if (!SOURCE_FILE_PATTERN.test(relativePath)) return;
+		if (!isLintableSourceFile(relativePath)) return;
 		const absolutePath = path.join(rootDirectory, relativePath);
 		let content;
 		try {
@@ -5644,6 +6421,7 @@ const buildCapabilities = (project) => {
 	const capabilities = /* @__PURE__ */ new Set();
 	capabilities.add(project.framework);
 	if (project.framework === "expo" || project.framework === "react-native" || project.hasReactNativeWorkspace) capabilities.add("react-native");
+	if (project.expoVersion !== null) capabilities.add("expo");
 	const reactMajor = project.reactMajorVersion;
 	if (reactMajor !== null) {
 		const cappedReactMajor = Math.min(reactMajor, 30);
@@ -5815,10 +6593,14 @@ const resolveSettingsRootDirectory = (rootDirectory) => {
 	if (!fs.existsSync(rootDirectory)) return rootDirectory;
 	return fs.realpathSync(rootDirectory);
 };
+const resolveCompilerCleanupBucketSeverity = (ruleKey, severityControls) => {
+	if (!COMPILER_CLEANUP_RULE_KEYS.has(ruleKey)) return void 0;
+	return severityControls?.buckets?.[COMPILER_CLEANUP_BUCKET];
+};
 const applyRuleSeverityControls = (rules, severityControls) => {
 	const enabledRules = {};
 	for (const [ruleKey, defaultSeverity] of Object.entries(rules)) {
-		const severity = resolveRuleSeverityOverride({ ruleKey }, severityControls) ?? defaultSeverity;
+		const severity = resolveRuleSeverityOverride({ ruleKey }, severityControls) ?? resolveCompilerCleanupBucketSeverity(ruleKey, severityControls) ?? defaultSeverity;
 		if (severity === "off") continue;
 		enabledRules[ruleKey] = severity;
 	}
@@ -5860,7 +6642,7 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 			category: rule.category
 		}, severityControls);
 		if (rule.defaultEnabled === false && explicitSeverity === void 0) continue;
-		const severity = explicitSeverity ?? rule.severity;
+		const severity = explicitSeverity ?? resolveCompilerCleanupBucketSeverity(registryEntry.key, severityControls) ?? rule.severity;
 		if (severity === "off") continue;
 		enabledReactDoctorRules[registryEntry.key] = severity;
 	}
@@ -5917,6 +6699,44 @@ const dedupeDiagnostics = (diagnostics) => {
 	}
 	return uniqueDiagnostics;
 };
+/**
+* Runs `task` over `items` with at most `concurrency` tasks in flight at
+* once, returning results in input order. A pool of workers each pulls the
+* next not-yet-started index until the list drains — so a worker that
+* finishes a fast task immediately picks up the next one (greedy load
+* balancing), which matters when tasks have uneven durations (oxlint
+* batches do).
+*
+* Failure semantics mirror a bounded `Promise.all`: on the first rejection
+* no further tasks are started, the already-in-flight tasks are awaited to
+* settle (so no subprocess is orphaned mid-write), and the returned promise
+* rejects with that first error. This keeps the caller's fail-fast retry
+* path (e.g. oxlint's retry-without-extends) from spawning a second wave on
+* top of a still-running first one.
+*/
+const mapWithConcurrency = async (items, concurrency, task) => {
+	const results = new Array(items.length);
+	if (items.length === 0) return results;
+	const workerCount = Math.min(Math.max(1, Math.floor(concurrency) || 1), items.length);
+	let nextIndex = 0;
+	const errors = [];
+	const runWorker = async () => {
+		while (errors.length === 0) {
+			const index = nextIndex;
+			nextIndex += 1;
+			if (index >= items.length) return;
+			try {
+				results[index] = await task(items[index], index);
+			} catch (error) {
+				errors.push(error);
+				return;
+			}
+		}
+	};
+	await Promise.all(Array.from({ length: workerCount }, runWorker));
+	if (errors.length > 0) throw errors[0];
+	return results;
+};
 const getPublicEnvPrefix = (framework) => {
 	switch (framework) {
 		case "nextjs": return "NEXT_PUBLIC_*";
@@ -5939,6 +6759,149 @@ const appendReanimatedSharedValueHint = (help, rule, project) => {
 	if (!help) return REANIMATED_SHARED_VALUE_HINT;
 	return `${help}\n\n${REANIMATED_SHARED_VALUE_HINT}`;
 };
+const REDACTED_PLACEHOLDER = "<redacted>";
+const KEEP_PREFIX = `$1${REDACTED_PLACEHOLDER}`;
+const KNOWN_SECRET_RULES = [
+	{
+		pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+		replacement: REDACTED_PLACEHOLDER
+	},
+	{
+		pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g,
+		replacement: REDACTED_PLACEHOLDER
+	},
+	{
+		pattern: /(?<=:\/\/)[^\s/:@]+:[^\s/@]+(?=@)/g,
+		replacement: REDACTED_PLACEHOLDER
+	},
+	{
+		pattern: /\b(AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA|A3T[A-Z0-9])[0-9A-Z]{16,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(gh[pousr]_)[A-Za-z0-9]{36,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(github_pat_)[A-Za-z0-9_]{22,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(glpat-)[A-Za-z0-9_-]{20,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(xox[baprs]-)[A-Za-z0-9-]{10,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /(?<=hooks\.slack\.com\/services\/)[A-Za-z0-9/+_-]{20,}/g,
+		replacement: REDACTED_PLACEHOLDER
+	},
+	{
+		pattern: /\b((?:sk|rk)_(?:live|test)_)[0-9A-Za-z]{10,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(sk-(?:proj-|ant-)?)[A-Za-z0-9_-]{20,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(AIza)[0-9A-Za-z_-]{35,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(ya29\.)[0-9A-Za-z_-]{20,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(npm_)[A-Za-z0-9]{36,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(SG\.)[A-Za-z0-9_-]{22,}\.[A-Za-z0-9_-]{43,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(SK)[0-9a-fA-F]{32,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(dop_v1_)[a-f0-9]{64,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(shp(?:at|ca|pa|ss)_)[a-fA-F0-9]{32,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b(sq0[a-z]{3}-)[0-9A-Za-z_-]{22,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /\b([0-9]{8,10}:AA)[0-9A-Za-z_-]{32,}/g,
+		replacement: KEEP_PREFIX
+	},
+	{
+		pattern: /(?<=\bBearer\s)[A-Za-z0-9._~+/=-]{16,}/g,
+		replacement: REDACTED_PLACEHOLDER
+	},
+	{
+		pattern: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g,
+		replacement: REDACTED_PLACEHOLDER
+	}
+];
+const CANDIDATE_TOKEN_PATTERN = /[A-Za-z0-9_][A-Za-z0-9_-]*/g;
+const HEX_DIGEST_PATTERN = /^(?:[0-9a-f]{32}|[0-9a-f]{40}|[0-9a-f]{64})$/;
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const HAS_LETTER_PATTERN = /[A-Za-z]/;
+const HAS_DIGIT_PATTERN = /[0-9]/;
+const shannonEntropyBits = (value) => {
+	const counts = /* @__PURE__ */ new Map();
+	for (const char of value) counts.set(char, (counts.get(char) ?? 0) + 1);
+	let bits = 0;
+	for (const count of counts.values()) {
+		const probability = count / value.length;
+		bits -= probability * Math.log2(probability);
+	}
+	return bits;
+};
+const looksLikeHighEntropySecret = (token) => {
+	if (token.length < 32) return false;
+	if (!HAS_LETTER_PATTERN.test(token) || !HAS_DIGIT_PATTERN.test(token)) return false;
+	if (HEX_DIGEST_PATTERN.test(token) || UUID_PATTERN.test(token)) return false;
+	return shannonEntropyBits(token) >= 3;
+};
+const redactHighEntropyTokens = (text) => text.replace(CANDIDATE_TOKEN_PATTERN, (token) => looksLikeHighEntropySecret(token) ? REDACTED_PLACEHOLDER : token);
+/**
+* Masks API keys, tokens, private keys, credentialed URLs, and emails
+* found anywhere inside a free-text string, returning the scrubbed text.
+* Applied to every diagnostic's `message` / `help` at construction time
+* so secrets never reach the terminal, the JSON report, or the score
+* API — react-doctor must never echo or transmit a user's secrets.
+*
+* Provider tokens keep their non-secret, type-identifying prefix (e.g.
+* `sk_live_<redacted>`, `ghp_<redacted>`, `AKIA<redacted>`) so the leaked
+* credential's type stays visible; structural or unknown-format secrets
+* with no meaningful prefix are masked whole.
+*
+* Runs the high-precision known-shape detectors first, then a generic
+* entropy-gated sweep for unknown-format secrets. Idempotent: the inert
+* `<redacted>` placeholder matches none of the detectors and is too
+* short for the generic sweep, so re-running leaves the text unchanged.
+*
+* Accepts `unknown` on purpose: callers feed it diagnostic `message` /
+* `help` that originate from oxlint JSON, which is only shape-checked at
+* the top level (the per-field `string` types are assumed, not validated).
+* A malformed non-string value returns `""` instead of throwing on
+* `.replace`, so one bad diagnostic can't abort parsing the whole batch.
+*/
+const redactSensitiveText = (text) => {
+	if (typeof text !== "string" || text === "") return "";
+	let redacted = text;
+	for (const rule of KNOWN_SECRET_RULES) redacted = redacted.replace(rule.pattern, rule.replacement);
+	return redactHighEntropyTokens(redacted);
+};
 const REACT_MODULE_SOURCE = "react";
 const REQUIRE_IDENTIFIER = "require";
 const USE_IDENTIFIER = "use";
@@ -6233,25 +7196,26 @@ const shouldSuppressLocalUseHookDiagnostic = (diagnostic, rootDirectory) => {
 	return bindingResolution !== null && !bindingResolution.isReactUseBinding;
 };
 const FILEPATH_WITH_LOCATION_PATTERN = /\S+\.\w+:\d+:\d+[\s\S]*$/;
-const REACT_COMPILER_MESSAGE = "React Compiler can't optimize this code";
+const REACT_COMPILER_TITLE = "React Compiler can't optimize this";
+const REACT_COMPILER_MESSAGE = "This component misses React Compiler's automatic memoization & re-renders more than it should. Rewrite the flagged code so the compiler can optimize it.";
 const PLUGIN_CATEGORY_MAP = {
-	react: "Correctness",
-	"react-hooks": "Correctness",
-	"react-hooks-js": "React Compiler",
-	"react-doctor": "Other",
+	react: "Bugs",
+	"react-hooks": "Bugs",
+	"react-hooks-js": "Performance",
+	"react-doctor": "Bugs",
 	"jsx-a11y": "Accessibility",
-	effect: "State & Effects",
-	eslint: "Correctness",
-	oxc: "Correctness",
-	typescript: "Correctness",
-	unicorn: "Correctness",
-	import: "Bundle Size",
-	promise: "Correctness",
-	n: "Correctness",
-	node: "Correctness",
-	vitest: "Correctness",
-	jest: "Correctness",
-	nextjs: "Next.js"
+	effect: "Bugs",
+	eslint: "Bugs",
+	oxc: "Bugs",
+	typescript: "Bugs",
+	unicorn: "Bugs",
+	import: "Performance",
+	promise: "Bugs",
+	n: "Bugs",
+	node: "Bugs",
+	vitest: "Bugs",
+	jest: "Bugs",
+	nextjs: "Bugs"
 };
 const lookupOwnString = (record, key) => Object.hasOwn(record, key) ? record[key] : void 0;
 const getRuleRecommendation = (ruleName, project) => {
@@ -6259,7 +7223,16 @@ const getRuleRecommendation = (ruleName, project) => {
 	return reactDoctorPlugin.rules[ruleName]?.recommendation;
 };
 const getRuleCategory = (ruleName) => reactDoctorPlugin.rules[ruleName]?.category;
+const getRuleTitle = (ruleName) => reactDoctorPlugin.rules[ruleName]?.title;
+const resolveDiagnosticTitle = (plugin, rule) => plugin === "react-hooks-js" ? REACT_COMPILER_TITLE : getRuleTitle(rule);
 const cleanDiagnosticMessage = (message, help, plugin, rule, project) => {
+	const cleaned = resolveCleanedDiagnostic(typeof message === "string" ? message : "", typeof help === "string" ? help : "", plugin, rule, project);
+	return {
+		message: redactSensitiveText(cleaned.message),
+		help: redactSensitiveText(cleaned.help)
+	};
+};
+const resolveCleanedDiagnostic = (message, help, plugin, rule, project) => {
 	if (plugin === "react-hooks-js") return {
 		message: REACT_COMPILER_MESSAGE,
 		help: appendReanimatedSharedValueHint(message.replace(FILEPATH_WITH_LOCATION_PATTERN, "").trim() || help, rule, project)
@@ -6280,7 +7253,7 @@ const parseRuleCode = (code) => {
 		rule: match[2]
 	};
 };
-const resolveDiagnosticCategory = (plugin, rule) => getRuleCategory(rule) ?? lookupOwnString(PLUGIN_CATEGORY_MAP, plugin) ?? "Other";
+const resolveDiagnosticCategory = (plugin, rule) => getRuleCategory(rule) ?? lookupOwnString(PLUGIN_CATEGORY_MAP, plugin) ?? "Bugs";
 const isOxlintOutput = (value) => {
 	if (typeof value !== "object" || value === null) return false;
 	const candidate = value;
@@ -6304,7 +7277,16 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 		throw new ReactDoctorError({ reason: new OxlintOutputUnparseable({ preview: stdout.slice(0, 200) }) });
 	}
 	if (!isOxlintOutput(parsed)) throw new ReactDoctorError({ reason: new OxlintOutputUnparseable({ preview: stdout.slice(0, 200) }) });
-	return parsed.diagnostics.filter((diagnostic) => diagnostic.code && SOURCE_FILE_PATTERN.test(diagnostic.filename) && !shouldSuppressLocalUseHookDiagnostic(diagnostic, rootDirectory)).map((diagnostic) => {
+	const minifiedFileCache = /* @__PURE__ */ new Map();
+	const isMinifiedDiagnosticFile = (filename) => {
+		const absolutePath = path.isAbsolute(filename) ? filename : path.resolve(rootDirectory || ".", filename);
+		const cached = minifiedFileCache.get(absolutePath);
+		if (cached !== void 0) return cached;
+		const minified = isMinifiedSource(absolutePath);
+		minifiedFileCache.set(absolutePath, minified);
+		return minified;
+	};
+	return parsed.diagnostics.filter((diagnostic) => diagnostic.code && isLintableSourceFile(diagnostic.filename) && !isMinifiedDiagnosticFile(diagnostic.filename) && !shouldSuppressLocalUseHookDiagnostic(diagnostic, rootDirectory)).map((diagnostic) => {
 		const { plugin, rule } = parseRuleCode(diagnostic.code);
 		const primaryLabel = diagnostic.labels[0];
 		const cleaned = cleanDiagnosticMessage(diagnostic.message, diagnostic.help, plugin, rule, project);
@@ -6313,6 +7295,7 @@ const parseOxlintOutput = (stdout, project, rootDirectory) => {
 			plugin,
 			rule,
 			severity: diagnostic.severity,
+			title: resolveDiagnosticTitle(plugin, rule),
 			message: cleaned.message,
 			help: cleaned.help,
 			url: diagnostic.url,
@@ -6436,6 +7419,7 @@ const spawnOxlint = (args, rootDirectory, nodeBinaryPath, spawnTimeoutMs = OXLIN
 */
 const spawnLintBatches = async (input) => {
 	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, onPartialFailure, onFileProgress, spawnTimeoutMs, outputMaxBytes } = input;
+	const concurrency = resolveScanConcurrency(input.concurrency ?? 1);
 	const totalFileCount = fileBatches.reduce((sum, batch) => sum + batch.length, 0);
 	const allDiagnostics = [];
 	const droppedFiles = [];
@@ -6455,20 +7439,31 @@ const spawnLintBatches = async (input) => {
 			return [...await spawnLintBatch(batch.slice(0, splitIndex)), ...await spawnLintBatch(batch.slice(splitIndex))];
 		}
 	};
+	let startedFileCount = 0;
 	let scannedFileCount = 0;
-	for (const batch of fileBatches) {
-		let batchFileIndex = 0;
-		const progressInterval = onFileProgress && batch.length > 1 ? setInterval(() => {
-			if (batchFileIndex < batch.length) {
-				batchFileIndex += 1;
-				onFileProgress(scannedFileCount + batchFileIndex, totalFileCount);
+	let displayedFileCount = 0;
+	const progressTimer = onFileProgress && totalFileCount > 1 ? setInterval(() => {
+		const ceiling = Math.min(startedFileCount, totalFileCount - 1);
+		if (displayedFileCount < ceiling) {
+			displayedFileCount += 1;
+			onFileProgress(displayedFileCount, totalFileCount);
+		}
+	}, 50) : null;
+	progressTimer?.unref?.();
+	try {
+		const batchResults = await mapWithConcurrency(fileBatches, concurrency, async (batch) => {
+			startedFileCount += batch.length;
+			const batchDiagnostics = await spawnLintBatch(batch);
+			scannedFileCount += batch.length;
+			if (onFileProgress) {
+				displayedFileCount = Math.min(Math.max(displayedFileCount, scannedFileCount), totalFileCount);
+				onFileProgress(displayedFileCount, totalFileCount);
 			}
-		}, 50) : null;
-		const batchDiagnostics = await spawnLintBatch(batch);
-		if (progressInterval !== null) clearInterval(progressInterval);
-		allDiagnostics.push(...batchDiagnostics);
-		scannedFileCount += batch.length;
-		onFileProgress?.(scannedFileCount, totalFileCount);
+			return batchDiagnostics;
+		});
+		for (const batchDiagnostics of batchResults) allDiagnostics.push(...batchDiagnostics);
+	} finally {
+		if (progressTimer !== null) clearInterval(progressTimer);
 	}
 	if (droppedFiles.length > 0 && onPartialFailure) {
 		const previewFiles = droppedFiles.slice(0, 3).join(", ");
@@ -6595,7 +7590,8 @@ const runOxlint = async (options) => {
 			onPartialFailure,
 			onFileProgress: options.onFileProgress,
 			spawnTimeoutMs,
-			outputMaxBytes
+			outputMaxBytes,
+			concurrency: options.concurrency
 		});
 		writeOxlintConfig(configPath, buildConfig(extendsPaths));
 		try {
@@ -6663,6 +7659,7 @@ var Linter = class Linter extends Context.Service()("react-doctor/Linter") {
 		const partialFailures = yield* LintPartialFailures;
 		const spawnTimeoutMs = yield* OxlintSpawnTimeoutMs;
 		const outputMaxBytes = yield* OxlintOutputMaxBytes;
+		const concurrency = yield* OxlintConcurrency;
 		const collectedFailures = [];
 		const diagnostics = yield* Effect.tryPromise({
 			try: () => runOxlint({
@@ -6681,7 +7678,8 @@ var Linter = class Linter extends Context.Service()("react-doctor/Linter") {
 				},
 				onFileProgress: input.onFileProgress,
 				spawnTimeoutMs,
-				outputMaxBytes
+				outputMaxBytes,
+				concurrency
 			}),
 			catch: ensureReactDoctorError
 		});
@@ -6727,7 +7725,8 @@ var Progress = class Progress extends Context.Service()("react-doctor/Progress")
 	static layerNoop = Layer.succeed(Progress, Progress.of({ start: () => Effect.succeed({
 		update: () => Effect.void,
 		succeed: () => Effect.void,
-		fail: () => Effect.void
+		fail: () => Effect.void,
+		stop: () => Effect.void
 	}) }));
 	static layerCapture = Layer.effect(Progress, Effect.map(ProgressCapture, (events) => Progress.of({ start: (text) => Effect.gen(function* () {
 		yield* Ref.update(events, (existing) => [...existing, {
@@ -6746,6 +7745,10 @@ var Progress = class Progress extends Context.Service()("react-doctor/Progress")
 			fail: (displayText) => Ref.update(events, (existing) => [...existing, {
 				_tag: "Failed",
 				text: displayText
+			}]),
+			stop: () => Ref.update(events, (existing) => [...existing, {
+				_tag: "Stopped",
+				text
 			}])
 		};
 	}) }))).pipe(Layer.provideMerge(ProgressCapture.layer));
@@ -6817,17 +7820,21 @@ var Reporter = class Reporter extends Context.Service()("react-doctor/Reporter")
 		});
 	}));
 };
-const parseScoreResult = (value) => {
-	if (typeof value !== "object" || value === null) return null;
-	if (!("score" in value) || !("label" in value)) return null;
-	const scoreValue = Reflect.get(value, "score");
-	const labelValue = Reflect.get(value, "label");
-	if (typeof scoreValue !== "number" || typeof labelValue !== "string") return null;
-	return {
-		score: scoreValue,
-		label: labelValue
-	};
-};
+const RulePrioritySchema = Schema.Struct({
+	priority: Schema.NullOr(Schema.Number),
+	tier: Schema.Literals([
+		"P0",
+		"P1",
+		"P2",
+		"P3"
+	])
+});
+const ScoreApiResponseSchema = Schema.Struct({
+	score: Schema.Number,
+	label: Schema.String,
+	rules: Schema.optional(Schema.Record(Schema.String, RulePrioritySchema))
+});
+const parseScoreResult = (value) => Option.getOrNull(Schema.decodeUnknownOption(ScoreApiResponseSchema)(value));
 const stripFilePaths = (diagnostics) => diagnostics.map(({ filePath: _filePath, ...rest }) => rest);
 const isAbortError = (error) => error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError");
 const describeFailure = (error) => {
@@ -6991,18 +7998,26 @@ const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 		repo
 	}).pipe(Effect.orElseSucceed(() => null)) : Effect.succeed(null));
 	const lintIncludePaths = computeJsxIncludePaths([...input.includePaths]) ?? resolveLintIncludePaths(scanDirectory, resolvedConfig.config);
+	const scannedFilePaths = input.suppressScanSummary ? (lintIncludePaths ?? (yield* filesService.listSourceFiles(scanDirectory))).map((relativePath) => path.resolve(scanDirectory, relativePath)) : [];
 	const beforeLint = hooks.beforeLint ?? NO_HOOKS.beforeLint;
 	const afterLint = hooks.afterLint ?? NO_HOOKS.afterLint;
 	yield* beforeLint(project, lintIncludePaths ?? void 0);
 	const isDiffMode = input.includePaths.length > 0;
+	const showWarnings = input.warnings ?? resolvedConfig.config?.warnings ?? true;
 	const transform = buildDiagnosticPipeline({
 		rootDirectory: scanDirectory,
 		userConfig: resolvedConfig.config,
 		readFileLinesSync: fileReader(filesService, scanDirectory),
-		respectInlineDisables: input.respectInlineDisables
+		respectInlineDisables: input.respectInlineDisables,
+		showWarnings
 	});
 	const applyPerElementPipeline = (rawStream) => rawStream.pipe(Stream.filterMap(filterMapNullable(transform.apply)), Stream.tap((diagnostic) => reporterService.emit(diagnostic)));
-	const environmentDiagnostics = isDiffMode ? [] : [...checkReducedMotion(scanDirectory), ...checkPnpmHardening(scanDirectory)];
+	const environmentDiagnostics = isDiffMode ? [] : [
+		...checkReducedMotion(scanDirectory),
+		...checkPnpmHardening(scanDirectory),
+		...checkExpoProject(scanDirectory, project),
+		...checkReactNativeProject(scanDirectory, project)
+	];
 	const envCollected = yield* Stream.runCollect(applyPerElementPipeline(Stream.fromIterable(environmentDiagnostics)));
 	const lintFailure = yield* Ref.make({
 		didFail: false,
@@ -7014,6 +8029,8 @@ const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 		didFail: false,
 		reason: null
 	});
+	const scanConcurrency = yield* OxlintConcurrency;
+	const workerCountSuffix = scanConcurrency > 1 ? ` · ${scanConcurrency} workers` : "";
 	const scanProgress = yield* progressService.start("Scanning...");
 	const scanStartTime = Date.now();
 	let lastReportedTotalFileCount = 0;
@@ -7030,7 +8047,7 @@ const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 		configSourceDirectory: resolvedConfig.configSourceDirectory ?? void 0,
 		onFileProgress: (scannedFileCount, totalFileCount) => {
 			lastReportedTotalFileCount = totalFileCount;
-			Effect.runSync(scanProgress.update(`Scanning files (${scannedFileCount}/${totalFileCount})...`));
+			Effect.runSync(scanProgress.update(`Scanning files (${scannedFileCount}/${totalFileCount})${workerCountSuffix}...`));
 		}
 	}).pipe(Stream.catchTag("ReactDoctorError", (error) => Stream.unwrap(Effect.gen(function* () {
 		yield* Ref.set(lintFailure, {
@@ -7045,7 +8062,7 @@ const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 	const lintFailureState = yield* Ref.get(lintFailure);
 	yield* afterLint(lintFailureState.didFail);
 	if (lintFailureState.didFail) yield* scanProgress.fail(formatLintFailText(lintFailureState.reasonTag, process.version));
-	const shouldRunDeadCode = input.runDeadCode && !isDiffMode;
+	const shouldRunDeadCode = input.runDeadCode && !isDiffMode && (showWarnings || deadCodeMaySurfaceWhenWarningsHidden(resolvedConfig.config));
 	const deadCodeCollected = lintFailureState.didFail || !shouldRunDeadCode ? [] : yield* scanProgress.update("Analyzing dead code...").pipe(Effect.andThen(Stream.runCollect(applyPerElementPipeline(deadCodeService.run({
 		rootDirectory: scanDirectory,
 		userConfig: resolvedConfig.config
@@ -7057,10 +8074,12 @@ const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 		return Stream.empty;
 	}))))))));
 	const deadCodeFailureState = yield* Ref.get(deadCodeFailure);
-	const scanElapsedSeconds = ((Date.now() - scanStartTime) / 1e3).toFixed(1);
+	const scanElapsedMilliseconds = Date.now() - scanStartTime;
+	const scanElapsedSeconds = (scanElapsedMilliseconds / 1e3).toFixed(1);
 	const totalFileCount = lastReportedTotalFileCount || (lintIncludePaths?.length ?? project.sourceFileCount);
 	if (!lintFailureState.didFail) if (deadCodeFailureState.didFail) yield* scanProgress.fail(DEAD_CODE_FAIL_TEXT);
-	else yield* scanProgress.succeed(`Scanned ${totalFileCount} ${totalFileCount === 1 ? "file" : "files"} in ${scanElapsedSeconds}s`);
+	else if (input.suppressScanSummary) yield* scanProgress.stop();
+	else yield* scanProgress.succeed(`Scanned ${totalFileCount} ${totalFileCount === 1 ? "file" : "files"} in ${scanElapsedSeconds}s${workerCountSuffix}`);
 	yield* reporterService.finalize;
 	const finalDiagnostics = [
 		...envCollected,
@@ -7100,7 +8119,10 @@ const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 		lintFailureReasonKind: lintFailureState.reasonKind,
 		lintPartialFailures,
 		didDeadCodeFail: deadCodeFailureState.didFail,
-		deadCodeFailureReason: deadCodeFailureState.reason
+		deadCodeFailureReason: deadCodeFailureState.reason,
+		scannedFileCount: totalFileCount,
+		scannedFilePaths,
+		scanElapsedMilliseconds
 	};
 }).pipe(Effect.withSpan("runInspect", { attributes: {
 	"inspect.directory": input.directory,
@@ -7109,7 +8131,6 @@ const runInspect = (input, hooks = {}) => Effect.gen(function* () {
 	"inspect.isCi": input.isCi,
 	"inspect.scoreSurface": input.scoreSurface ?? "score"
 } }));
-Layer.mergeAll(Project.layerNode, Config.layerNode, DeadCode.layerNode, Files.layerNode, Git.layerNode, Linter.layerOxlint, LintPartialFailures.layerLive, Progress.layerNoop, Reporter.layerNoop, Score.layerHttp);
 const parseNodeVersion = (versionString) => {
 	const [major = 0, minor = 0, patch = 0] = versionString.replace(/^v/, "").trim().split(".").map(Number);
 	return {
@@ -7226,7 +8247,7 @@ const isPathInsideDirectory = (childAbsolutePath, parentAbsolutePath) => {
 	static layerNode = Layer.effect(StagedFiles, Effect.gen(function* () {
 		const git = yield* Git;
 		return StagedFiles.of({
-			discoverSourceFiles: (directory) => git.stagedFilePaths(directory).pipe(Effect.map((entries) => entries.filter((entry) => SOURCE_FILE_PATTERN.test(entry)))),
+			discoverSourceFiles: (directory) => git.stagedFilePaths(directory).pipe(Effect.map((entries) => entries.filter(isLintableSourceFile))),
 			materialize: ({ directory, stagedFiles, tempDirectory }) => Effect.gen(function* () {
 				const materializedFiles = [];
 				const resolvedTempDirectory = path.resolve(tempDirectory);
@@ -7408,6 +8429,26 @@ const buildJsonReport = (input) => {
 	};
 };
 /**
+* Single source of truth for the skipped-check accounting shared by the
+* CLI renderer (`react-doctor/src/inspect.ts → finalizeAndRender`) and the
+* programmatic shell (`@react-doctor/api → diagnose()`). Both surface a
+* failed lint / dead-code pass instead of a false "all clear", so the
+* branch logic lives here once.
+*/
+const buildSkippedChecks = (input) => {
+	const skippedChecks = [];
+	if (input.didLintFail) skippedChecks.push("lint");
+	if (input.didDeadCodeFail) skippedChecks.push("dead-code");
+	const skippedCheckReasons = {};
+	if (input.didLintFail && input.lintFailureReason !== null) skippedCheckReasons.lint = input.lintFailureReason;
+	else if (input.lintPartialFailures.length > 0) skippedCheckReasons["lint:partial"] = input.lintPartialFailures.join("; ");
+	if (input.didDeadCodeFail && input.deadCodeFailureReason !== null) skippedCheckReasons["dead-code"] = input.deadCodeFailureReason;
+	return {
+		skippedChecks,
+		skippedCheckReasons
+	};
+};
+/**
 * Programmatic façade over `Git.diffSelection`. Async because the
 * Git service runs through Effect's `ChildProcess` (true subprocess
 * spawn, not `spawnSync`).
@@ -7435,7 +8476,7 @@ const getDiffInfo = (directory, explicitBaseBranch) => Effect.runPromise(Effect.
 	GitBaseBranchInvalid: (reason) => Effect.die(new Error(reason.detail)),
 	GitBaseBranchMissing: (reason) => Effect.die(new Error(reason.message))
 })));
-const filterSourceFiles = (filePaths) => filePaths.filter((filePath) => SOURCE_FILE_PATTERN.test(filePath));
+const filterSourceFiles = (filePaths) => filePaths.filter(isLintableSourceFile);
 var import_picocolors = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	let p = process || {}, argv = p.argv || [], env = p.env || {};
 	let isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p.platform === "win32" || (p.stdout || {}).isTTY && env.TERM !== "dumb" || !!env.CI);
@@ -7513,7 +8554,7 @@ import_picocolors.default.red, import_picocolors.default.yellow, import_picocolo
 const clearAutoSuppressionCaches = () => {};
 //#endregion
 //#region ../api/dist/index.js
-const DEFAULT_LAYER = Layer.mergeAll(Project.layerNode, Config.layerNode, DeadCode.layerNode, Files.layerNode, Git.layerNode, Linter.layerOxlint, LintPartialFailures.layerLive, Progress.layerNoop, Reporter.layerNoop, Score.layerHttp);
+const buildDiagnoseLayer = (configLayer = Config.layerNode) => Layer.mergeAll(Project.layerNode, configLayer, DeadCode.layerNode, Files.layerNode, Git.layerNode, Linter.layerOxlint, LintPartialFailures.layerLive, Progress.layerNoop, Reporter.layerNoop, Score.layerHttp);
 const buildInspectProgram = (scanTarget, options, configOverride) => {
 	const effectiveConfig = configOverride ?? scanTarget.userConfig;
 	const includePaths = options.includePaths ?? [];
@@ -7522,6 +8563,7 @@ const buildInspectProgram = (scanTarget, options, configOverride) => {
 		includePaths,
 		customRulesOnly: effectiveConfig?.customRulesOnly ?? false,
 		respectInlineDisables: options.respectInlineDisables ?? effectiveConfig?.respectInlineDisables ?? true,
+		warnings: options.warnings ?? effectiveConfig?.warnings ?? true,
 		adoptExistingLintConfig: effectiveConfig?.adoptExistingLintConfig ?? true,
 		ignoredTags: new Set(effectiveConfig?.ignore?.tags ?? []),
 		runDeadCode: options.deadCode ?? effectiveConfig?.deadCode ?? true,
@@ -7531,13 +8573,7 @@ const buildInspectProgram = (scanTarget, options, configOverride) => {
 };
 const outputToDiagnoseResult = (output, elapsedMilliseconds) => {
 	if (output.didLintFail && output.lintFailureReason !== null) console.error("Lint failed:", output.lintFailureReason);
-	const skippedChecks = [];
-	if (output.didLintFail) skippedChecks.push("lint");
-	if (output.didDeadCodeFail) skippedChecks.push("dead-code");
-	const skippedCheckReasons = {};
-	if (output.didLintFail && output.lintFailureReason !== null) skippedCheckReasons.lint = output.lintFailureReason;
-	else if (output.lintPartialFailures.length > 0) skippedCheckReasons["lint:partial"] = output.lintPartialFailures.join("; ");
-	if (output.didDeadCodeFail && output.deadCodeFailureReason !== null) skippedCheckReasons["dead-code"] = output.deadCodeFailureReason;
+	const { skippedChecks, skippedCheckReasons } = buildSkippedChecks(output);
 	return {
 		diagnostics: [...output.diagnostics],
 		score: output.score,
@@ -7549,8 +8585,8 @@ const outputToDiagnoseResult = (output, elapsedMilliseconds) => {
 };
 const diagnose = async (directory, options = {}) => {
 	const startTime = globalThis.performance.now();
-	const program = buildInspectProgram(resolveScanTarget(directory), options);
-	return outputToDiagnoseResult(await Effect.runPromise(restoreLegacyThrow(program.pipe(Effect.provide(DEFAULT_LAYER), Effect.provide(layerOtlp)))), globalThis.performance.now() - startTime);
+	const program = buildInspectProgram(await resolveScanTarget(directory), options);
+	return outputToDiagnoseResult(await Effect.runPromise(restoreLegacyThrow(program.pipe(Effect.provide(buildDiagnoseLayer()), Effect.provide(layerOtlp)))), globalThis.performance.now() - startTime);
 };
 //#endregion
 //#region src/index.ts
@@ -7559,6 +8595,7 @@ const clearCaches = () => {
 	clearConfigCache();
 	clearPackageJsonCache();
 	clearIgnorePatternsCache();
+	clearPackageRoleCache();
 	clearAutoSuppressionCaches();
 };
 const toJsonReport = (result, options) => buildJsonReport({
@@ -7582,4 +8619,5 @@ const toJsonReport = (result, options) => buildJsonReport({
 //#endregion
 export { AmbiguousProjectError, NoReactDependencyError, NotADirectoryError, PackageJsonNotFoundError, ProjectNotFoundError, ReactDoctorError, buildJsonReport, buildJsonReportError, clearCaches, diagnose, filterSourceFiles, getDiffInfo, isProjectDiscoveryError, isReactDoctorError, summarizeDiagnostics, toJsonReport };
 
-//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map
+//# debugId=df20b0d3-9e4e-52e0-8991-ce8a6349a04a