react-doctor 0.5.8-dev.ea00b1b → 0.5.8-dev.f028d8b

package/dist/index.d.ts

@@ -9271,6 +9271,15 @@ interface ReactDoctorConfig {
    * suppresses regardless of sibling content.
    */
   rawTextWrapperComponents?: string[];
+  /**
+   * Capitalized identifiers that exist at runtime but aren't imported in
+   * the file that uses them — react-live's `<LiveProvider scope={...}>`,
+   * Storybook globals, MDX live blocks, or an ambient `declare global` in a
+   * separate `.d.ts`. The single-file `jsx-no-undef` rule can't see those
+   * bindings and would report `<DatePicker />` as an undefined JSX component.
+   * List the injected names here and `jsx-no-undef` treats them as known.
+   */
+  runtimeGlobals?: string[];
   /**
    * Project-level allowlist of function names that the
    * `server-auth-actions` rule treats as an auth check at the top of
@@ -9726,7 +9735,7 @@ interface InspectResult {
    * Per-file lint cache outcome: files served from cache, and total files
    * considered. Both absent when the cache was off or bypassed (audit mode,
    * adopted `extends`, user plugins). The CLI projects these onto the Sentry
-   * wide event as `lintCacheHitRatio`.
+   * wide event as `lint.cacheHitRatio`.
    */
   lintCacheHitFileCount?: number | null;
   lintCacheTotalFileCount?: number | null;
@@ -10123,7 +10132,7 @@ declare const summarizeDiagnostics: (diagnostics: Diagnostic[], worstScore?: num
  * untouched so the loader sees the same plain object either way.
  */
 declare const defineConfig: (config: ReactDoctorConfig) => ReactDoctorConfig; //#endregion
-//#region src/utils/group-by.d.ts
+//#region src/utils/detect-ai-training-environment.d.ts
 //#endregion
 //#region ../api/dist/index.d.ts
 //#region src/diagnose.d.ts

package/dist/index.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="dccb6d63-63d4-5e91-af21-2756a08fe93a")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3fb133b5-fc1f-519f-8f76-6f1d3bb556ce")}catch(e){}}();
 import { r as __toESM$1, t as __commonJSMin$1 } from "./chunk-N93fKeF6.js";
 import { createRequire } from "node:module";
 import * as NFS from "node:fs";
@@ -5996,7 +5996,7 @@ const composePassthrough = /* @__PURE__ */ dual(2, (left, right) => (input) => {
 * @since 2.0.0
 */
 const Scheduler = /* @__PURE__ */ Reference("effect/Scheduler", { defaultValue: () => new MixedScheduler() });
-const setImmediate = "setImmediate" in globalThis ? (f) => {
+const setImmediate$1 = "setImmediate" in globalThis ? (f) => {
 	const timer = globalThis.setImmediate(f);
 	return () => globalThis.clearImmediate(timer);
 } : (f) => {
@@ -6040,7 +6040,7 @@ var PriorityBuckets = class {
 var MixedScheduler = class {
 	executionMode;
 	setImmediate;
-	constructor(executionMode = "async", setImmediateFn = setImmediate) {
+	constructor(executionMode = "async", setImmediateFn = setImmediate$1) {
 		this.executionMode = executionMode;
 		this.setImmediate = setImmediateFn;
 	}
@@ -6065,7 +6065,7 @@ var MixedSchedulerDispatcher = class {
 	tasks = /* @__PURE__ */ new PriorityBuckets();
 	running = void 0;
 	setImmediate;
-	constructor(setImmediateFn = setImmediate) {
+	constructor(setImmediateFn = setImmediate$1) {
 		this.setImmediate = setImmediateFn;
 	}
 	/**
@@ -33752,6 +33752,7 @@ const DEAD_CODE_PHASE_TIMEOUT_MS = 15e4;
 const LINT_PHASE_TIMEOUT_MS = 3e5;
 const SCAN_TOTAL_DEADLINE_MS = 9e5;
 const DEAD_CODE_WORKER_MAX_OLD_SPACE_MB = 8192;
+const DEAD_CODE_WORKER_MEM_BUDGET_BYTES = 2 * 1024 * 1024 * 1024;
 const DEAD_CODE_TIMEOUT_CEILING_MS = 6e5;
 const DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS = 3e4;
 const DEAD_CODE_OVERLAP_PARSE_SHARE = .4;
@@ -34998,6 +34999,7 @@ const collectStringSet = (values) => {
 	if (!Array.isArray(values)) return /* @__PURE__ */ new Set();
 	return new Set(values.filter((value) => typeof value === "string"));
 };
+const JSX_NO_UNDEF_IDENTIFIER_PATTERN = /^`([^`]+)`/;
 /**
 * Pre-compiles every stateful filter and returns a single
 * `apply(diagnostic)` closure that runs (in order):
@@ -35031,11 +35033,28 @@ const buildDiagnosticPipeline = (input) => {
 	const compiledOverrides = compileIgnoreOverrides(userConfig);
 	const textComponentNames = collectStringSet(userConfig?.textComponents);
 	const rawTextWrapperComponentNames = collectStringSet(userConfig?.rawTextWrapperComponents);
+	const runtimeGlobalNames = collectStringSet(userConfig?.runtimeGlobals);
 	const hasTextComponents = textComponentNames.size > 0;
 	const hasRawTextWrappers = rawTextWrapperComponentNames.size > 0;
+	const hasRuntimeGlobals = runtimeGlobalNames.size > 0;
 	const fileLinesCache = /* @__PURE__ */ new Map();
 	const fileContextCache = /* @__PURE__ */ new Map();
 	const libraryFileCache = /* @__PURE__ */ new Map();
+	const suppressions = /* @__PURE__ */ new Map();
+	const suppress = (diagnostic, source) => {
+		const { ruleKey } = getDiagnosticRuleIdentity(diagnostic);
+		const suppressionKey = `${ruleKey}\u0000${source}`;
+		const existing = suppressions.get(suppressionKey);
+		suppressions.set(suppressionKey, existing ? {
+			...existing,
+			count: existing.count + 1
+		} : {
+			rule: ruleKey,
+			source,
+			count: 1
+		});
+		return null;
+	};
 	const isLibraryFile = (filePath) => {
 		let cached = libraryFileCache.get(filePath);
 		if (cached === void 0) {
@@ -35084,50 +35103,60 @@ const buildDiagnosticPipeline = (input) => {
 		if (hasRawTextWrappers && isInsideStringOnlyWrapper(lines, diagnostic.line, diagnostic.column, rawTextWrapperComponentNames)) return true;
 		return false;
 	};
-	return { apply: (diagnostic) => {
-		if (shouldAutoSuppress(diagnostic)) return null;
-		let current = diagnostic;
-		let explicitSeverityOverride;
-		let explicitRuleOverride;
-		if (severityControls) {
-			const { ruleKey, category } = getDiagnosticRuleIdentity(current);
-			explicitRuleOverride = resolveRuleSeverityOverride({ ruleKey }, severityControls);
-			explicitSeverityOverride = resolveRuleSeverityOverride({
-				ruleKey,
-				category
-			}, severityControls);
-			if (explicitSeverityOverride === "off") return null;
-			if (explicitSeverityOverride !== void 0) current = restampSeverity(current, explicitSeverityOverride);
-		}
-		if (explicitRuleOverride === void 0) {
-			if (isAppOnlyRule(`${current.plugin}/${current.rule}`) && isLibraryFile(current.filePath)) return null;
-		}
-		if (!showWarnings && current.severity === "warning" && explicitSeverityOverride !== "warn") return null;
-		if (userConfig) {
-			if (isRuleIgnored(`${current.plugin}/${current.rule}`)) return null;
-			if (isFileIgnoredByPatterns(current.filePath, rootDirectory, ignoredFilePatterns)) return null;
-			if (isDiagnosticIgnoredByOverrides(current, rootDirectory, compiledOverrides)) return null;
-			if (isRnRawTextSuppressedByConfig(current)) return null;
-		}
-		if (respectInlineDisables && current.line > 0) {
-			const lines = getFileLines(current.filePath);
-			if (lines) {
-				const ruleIdentifier = `${current.plugin}/${current.rule}`;
-				const evaluation = evaluateSuppression(lines, current.line - 1, ruleIdentifier);
-				if (evaluation.isSuppressed) return null;
-				if (evaluation.nearMissHint) current = {
-					...current,
-					suppressionHint: evaluation.nearMissHint
-				};
+	const isJsxNoUndefSuppressedByConfig = (diagnostic) => {
+		if (!hasRuntimeGlobals) return false;
+		if (diagnostic.rule !== "jsx-no-undef") return false;
+		const identifierMatch = JSX_NO_UNDEF_IDENTIFIER_PATTERN.exec(diagnostic.message);
+		return identifierMatch !== null && runtimeGlobalNames.has(identifierMatch[1]);
+	};
+	return {
+		apply: (diagnostic) => {
+			if (shouldAutoSuppress(diagnostic)) return null;
+			let current = diagnostic;
+			let explicitSeverityOverride;
+			let explicitRuleOverride;
+			if (severityControls) {
+				const { ruleKey, category } = getDiagnosticRuleIdentity(current);
+				explicitRuleOverride = resolveRuleSeverityOverride({ ruleKey }, severityControls);
+				explicitSeverityOverride = resolveRuleSeverityOverride({
+					ruleKey,
+					category
+				}, severityControls);
+				if (explicitSeverityOverride === "off") return suppress(current, "config");
+				if (explicitSeverityOverride !== void 0) current = restampSeverity(current, explicitSeverityOverride);
 			}
-		}
-		const fileContext = getFileContext(current.filePath);
-		if (fileContext !== "production") current = {
-			...current,
-			fileContext
-		};
-		return current;
-	} };
+			if (explicitRuleOverride === void 0) {
+				if (isAppOnlyRule(`${current.plugin}/${current.rule}`) && isLibraryFile(current.filePath)) return null;
+			}
+			if (!showWarnings && current.severity === "warning" && explicitSeverityOverride !== "warn") return null;
+			if (userConfig) {
+				if (isRuleIgnored(`${current.plugin}/${current.rule}`)) return suppress(current, "config");
+				if (isFileIgnoredByPatterns(current.filePath, rootDirectory, ignoredFilePatterns)) return null;
+				if (isDiagnosticIgnoredByOverrides(current, rootDirectory, compiledOverrides)) return suppress(current, "override");
+				if (isRnRawTextSuppressedByConfig(current)) return null;
+				if (isJsxNoUndefSuppressedByConfig(current)) return null;
+			}
+			if (respectInlineDisables && current.line > 0) {
+				const lines = getFileLines(current.filePath);
+				if (lines) {
+					const ruleIdentifier = `${current.plugin}/${current.rule}`;
+					const evaluation = evaluateSuppression(lines, current.line - 1, ruleIdentifier);
+					if (evaluation.isSuppressed) return suppress(current, "inline");
+					if (evaluation.nearMissHint) current = {
+						...current,
+						suppressionHint: evaluation.nearMissHint
+					};
+				}
+			}
+			const fileContext = getFileContext(current.filePath);
+			if (fileContext !== "production") current = {
+				...current,
+				fileContext
+			};
+			return current;
+		},
+		summarizeSuppressions: () => [...suppressions.values()]
+	};
 };
 const OxlintUnavailableKind = Literals(["binary-not-found", "native-binding-missing"]);
 var OxlintUnavailable = class extends TaggedErrorClass()("OxlintUnavailable", {
@@ -35369,7 +35398,7 @@ const resolveScanConcurrency = (requested) => {
 	if (!Number.isFinite(requested) || requested < 1) return 1;
 	return Math.min(Math.floor(requested), 32);
 };
-const readSystemFacts = () => ({
+const readSystemFacts$1 = () => ({
 	availableCores: os.availableParallelism(),
 	totalMemoryBytes: os.totalmem(),
 	cgroupMemoryLimitBytes: readCgroupMemoryLimitBytes()
@@ -35390,7 +35419,7 @@ const readSystemFacts = () => ({
 * `facts` is injectable so tests exercise core-bound, memory-bound, cgroup-
 * limited, and ceiling cases without mocking `os` or the filesystem.
 */
-const resolveAutoScanConcurrency = (facts = readSystemFacts()) => {
+const resolveAutoScanConcurrency = (facts = readSystemFacts$1()) => {
 	const availableMemoryBytes = Math.min(facts.totalMemoryBytes, facts.cgroupMemoryLimitBytes ?? Number.POSITIVE_INFINITY);
 	const memoryBoundedWorkers = Math.floor(availableMemoryBytes / PER_WORKER_MEM_BUDGET_BYTES);
 	return resolveScanConcurrency(Math.min(facts.availableCores, memoryBoundedWorkers));
@@ -35585,6 +35614,7 @@ const STRING_ARRAY_FIELD_NAMES = [
 	"projects",
 	"textComponents",
 	"rawTextWrapperComponents",
+	"runtimeGlobals",
 	"serverAuthFunctionNames"
 ];
 const SURFACE_CONTROL_FIELD_NAMES = [
@@ -36923,7 +36953,10 @@ const shouldEnableRule = (requires, tags, capabilities, ignoredTags, disabledBy)
 	}
 	return true;
 };
-const checkSecurityScan = (rootDirectory, options = {}) => {
+const yieldToEventLoop = () => new Promise((resolve) => {
+	setImmediate(resolve);
+});
+const createSecurityScanSession = (rootDirectory, options) => {
 	const capabilities = options.project ? buildCapabilities(options.project) : /* @__PURE__ */ new Set();
 	const ignoredTags = options.ignoredTags ?? /* @__PURE__ */ new Set();
 	const enabledScanRules = REACT_DOCTOR_RULES.flatMap((entry) => {
@@ -36938,7 +36971,7 @@ const checkSecurityScan = (rootDirectory, options = {}) => {
 			committedFilesOnly: rule.committedFilesOnly === true
 		}];
 	});
-	if (enabledScanRules.length === 0) return [];
+	if (enabledScanRules.length === 0) return null;
 	const diagnostics = [];
 	const seen = /* @__PURE__ */ new Set();
 	const gitIgnoredCache = /* @__PURE__ */ new Map();
@@ -36950,15 +36983,34 @@ const checkSecurityScan = (rootDirectory, options = {}) => {
 		}
 		return status === true;
 	};
-	for (const file of collectSecurityScanFiles(rootDirectory)) for (const { entry, scan, committedFilesOnly } of enabledScanRules) for (const finding of scan(file)) {
-		if (committedFilesOnly && isFileGitIgnored(file)) continue;
-		const diagnostic = buildSecurityScanDiagnostic(finding, entry, file.relativePath);
-		const key = `${diagnostic.rule}:${diagnostic.filePath}:${diagnostic.line}:${diagnostic.column}:${diagnostic.message}`;
-		if (seen.has(key)) continue;
-		seen.add(key);
-		diagnostics.push(diagnostic);
+	const scanFile = (file) => {
+		for (const { entry, scan, committedFilesOnly } of enabledScanRules) for (const finding of scan(file)) {
+			if (committedFilesOnly && isFileGitIgnored(file)) continue;
+			const diagnostic = buildSecurityScanDiagnostic(finding, entry, file.relativePath);
+			const key = `${diagnostic.rule}:${diagnostic.filePath}:${diagnostic.line}:${diagnostic.column}:${diagnostic.message}`;
+			if (seen.has(key)) continue;
+			seen.add(key);
+			diagnostics.push(diagnostic);
+		}
+	};
+	return {
+		scanFile,
+		diagnostics
+	};
+};
+const checkSecurityScanCooperative = async (rootDirectory, options = {}) => {
+	const session = createSecurityScanSession(rootDirectory, options);
+	if (session === null) return [];
+	let filesSinceYield = 0;
+	for (const file of collectSecurityScanFiles(rootDirectory)) {
+		session.scanFile(file);
+		filesSinceYield += 1;
+		if (filesSinceYield >= 16) {
+			filesSinceYield = 0;
+			await yieldToEventLoop();
+		}
 	}
-	return diagnostics;
+	return session.diagnostics;
 };
 var import_picocolors = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	let p = process || {}, argv = p.argv || [], env = p.env || {};
@@ -37175,6 +37227,74 @@ const collectDeadCodeIgnorePatterns = (rootDirectory) => {
 	return [...seen].filter((pattern) => pattern.length > 0);
 };
 const collectDeadCodeEntryPatterns = (rootDirectory) => [...new Set(collectKnipPatterns(rootDirectory, "entry"))].filter((pattern) => pattern.length > 0);
+const readSystemFacts = () => ({
+	availableCores: os.availableParallelism(),
+	totalMemoryBytes: os.totalmem(),
+	cgroupMemoryLimitBytes: readCgroupMemoryLimitBytes()
+});
+/**
+* How many real deslop dead-code child processes may run at once, across the
+* concurrent per-project `runInspect` fibers of one CLI run. The cap is the
+* smaller of the core count and the number of `DEAD_CODE_WORKER_MEM_BUDGET_BYTES`
+* workers that fit in available memory, floored at 1.
+*
+* On a roomy dev box / CI runner this resolves high enough that every
+* concurrently-scanned project still spawns its own worker (no serialization vs
+* the prior uncapped behavior); on a memory-constrained runner it collapses
+* toward 1, so the `withDeadCodeWorkerSlot` semaphore serializes the spawns
+* instead of oversubscribing memory with N simultaneous children — the global
+* cap the per-project spawn path lacked.
+*
+* Mirrors `resolveAutoScanConcurrency` (lint), but budgets memory per the
+* heavier dead-code worker. `facts` is injectable for tests.
+*/
+const resolveDeadCodeConcurrency = (facts = readSystemFacts()) => {
+	const availableMemoryBytes = Math.min(facts.totalMemoryBytes, facts.cgroupMemoryLimitBytes ?? Number.POSITIVE_INFINITY);
+	const memoryBoundedWorkers = Math.floor(availableMemoryBytes / DEAD_CODE_WORKER_MEM_BUDGET_BYTES);
+	return Math.max(1, Math.min(facts.availableCores, memoryBoundedWorkers));
+};
+let availableSlots = -1;
+const waiters = [];
+const releaseSlot = () => {
+	const nextWaiter = waiters.shift();
+	if (nextWaiter !== void 0) nextWaiter();
+	else availableSlots += 1;
+};
+/**
+* Runs `task` once a dead-code worker slot is free, releasing the slot when the
+* task settles (success or failure). With a high cap (roomy machine) every
+* caller proceeds immediately; with a low cap (constrained runner) callers
+* queue and run as slots free.
+*
+* `abortSignal` short-circuits the WAIT: if it's already aborted, or fires while
+* this caller is queued, the call rejects without acquiring a slot or running
+* `task` — so a cancelled scan (e.g. lint failed) doesn't sit in the queue and
+* then spawn a child only to tear it down. A queued caller that aborts removes
+* its own waiter so a later release never hands a slot to a dead request.
+*/
+const withDeadCodeWorkerSlot = async (task, abortSignal) => {
+	if (abortSignal?.aborted) throw new Error("Dead-code worker aborted.");
+	if (availableSlots < 0) availableSlots = resolveDeadCodeConcurrency();
+	if (availableSlots > 0) availableSlots -= 1;
+	else await new Promise((resolve, reject) => {
+		const waiter = () => {
+			abortSignal?.removeEventListener("abort", onAbort);
+			resolve();
+		};
+		const onAbort = () => {
+			const queuedIndex = waiters.indexOf(waiter);
+			if (queuedIndex !== -1) waiters.splice(queuedIndex, 1);
+			reject(/* @__PURE__ */ new Error("Dead-code worker aborted."));
+		};
+		waiters.push(waiter);
+		abortSignal?.addEventListener("abort", onAbort, { once: true });
+	});
+	try {
+		return await task();
+	} finally {
+		releaseSlot();
+	}
+};
 /**
 * Resolves a path to its canonical, symlink-free form, falling back to
 * the input when it cannot be realpath'd (broken symlink, permission
@@ -37199,6 +37319,11 @@ const toCanonicalPath = (filePath) => {
 };
 const DEAD_CODE_PLUGIN = "deslop";
 const DEAD_CODE_CATEGORY = "Maintainability";
+const REACT_DOCTOR_TOOLCHAIN_PACKAGES = new Set([
+	"react-doctor",
+	"eslint-plugin-react-doctor",
+	"oxlint-plugin-react-doctor"
+]);
 const DEAD_CODE_WORKER_SCRIPT = `
 const inputChunks = [];
 process.stdin.on("data", (chunk) => inputChunks.push(chunk));
@@ -37465,14 +37590,17 @@ const checkDeadCode = async (options) => {
 	if (!NFS.existsSync(Path.join(rootDirectory, "package.json"))) return [];
 	const entryPatterns = collectDeadCodeEntryPatterns(rootDirectory);
 	const ignorePatterns = collectDeadCodeIgnorePatterns(rootDirectory);
-	const result = parseDeadCodeWorkerResult(await runDeadCodeWorkerWithTimeout((options.createWorker ?? createDeadCodeWorker)({
-		rootDirectory,
-		entryPatterns,
-		tsConfigPath: resolveTsConfigPath(rootDirectory),
-		ignorePatterns,
-		deslopJsModuleSpecifier: options.deslopJsModuleSpecifier ?? import.meta.resolve("deslop-js"),
-		parseConcurrency: options.parseConcurrency
-	}), options.workerTimeoutMs ?? 12e4, options.abortSignal));
+	const spawnAndRun = () => {
+		return runDeadCodeWorkerWithTimeout((options.createWorker ?? createDeadCodeWorker)({
+			rootDirectory,
+			entryPatterns,
+			tsConfigPath: resolveTsConfigPath(rootDirectory),
+			ignorePatterns,
+			deslopJsModuleSpecifier: options.deslopJsModuleSpecifier ?? import.meta.resolve("deslop-js"),
+			parseConcurrency: options.parseConcurrency
+		}), options.workerTimeoutMs ?? 12e4, options.abortSignal);
+	};
+	const result = parseDeadCodeWorkerResult(options.createWorker === void 0 ? await withDeadCodeWorkerSlot(spawnAndRun, options.abortSignal) : await spawnAndRun());
 	const toRelative = (filePath) => toRelativeFilePath(rootDirectory, filePath);
 	const diagnostics = [];
 	for (const unusedFile of result.unusedFiles) diagnostics.push({
@@ -37501,6 +37629,7 @@ const checkDeadCode = async (options) => {
 		});
 	}
 	for (const unusedDependency of result.unusedDependencies) {
+		if (REACT_DOCTOR_TOOLCHAIN_PACKAGES.has(unusedDependency.name)) continue;
 		const label = unusedDependency.isDevDependency ? "devDependency" : "dependency";
 		diagnostics.push({
 			filePath: "package.json",
@@ -39234,11 +39363,12 @@ const REACT_COMPILER_TITLE = "React Compiler can't optimize this";
 const REACT_COMPILER_TODO_TITLE = "React Compiler doesn't support this syntax";
 const REACT_COMPILER_IMPACT = "This component misses React Compiler's automatic memoization & re-renders more than it should";
 const REACT_COMPILER_ACTION = "Rewrite the flagged code so the compiler can optimize it.";
+const REACT_COMPILER_INCOMPATIBLE_LIBRARY_ACTION = "It's how the library works, not a bug in your code. Memoize values you pass from it into other memoized components, or suppress it with `// react-doctor-disable-next-line react-hooks-js/incompatible-library`.";
 const REACT_COMPILER_GENERIC_MESSAGE = `${REACT_COMPILER_IMPACT}. ${REACT_COMPILER_ACTION}`;
-const buildReactCompilerMessage = (reasonSummary) => {
+const buildReactCompilerMessage = (reasonSummary, action = REACT_COMPILER_ACTION) => {
 	const normalizedSummary = reasonSummary.replace(TRAILING_PERIOD_PATTERN, "");
-	if (!normalizedSummary) return REACT_COMPILER_GENERIC_MESSAGE;
-	return `${REACT_COMPILER_IMPACT}: ${normalizedSummary}. ${REACT_COMPILER_ACTION}`;
+	if (!normalizedSummary) return `${REACT_COMPILER_IMPACT}. ${action}`;
+	return `${REACT_COMPILER_IMPACT}: ${normalizedSummary}. ${action}`;
 };
 const PLUGIN_CATEGORY_MAP = {
 	react: "Bugs",
@@ -39287,7 +39417,7 @@ const resolveCleanedDiagnostic = (message, help, plugin, rule, project) => {
 		const [reasonSummary = "", ...reasonDetailLines] = bailoutReason.split("\n");
 		const reasonDetail = reasonDetailLines.join("\n").trim();
 		return {
-			message: buildReactCompilerMessage(reasonSummary.trim()),
+			message: buildReactCompilerMessage(reasonSummary.trim(), rule === "incompatible-library" ? REACT_COMPILER_INCOMPATIBLE_LIBRARY_ACTION : REACT_COMPILER_ACTION),
 			help: appendReanimatedSharedValueHint(reasonDetail || help, rule, project)
 		};
 	}
@@ -40636,7 +40766,10 @@ const formatLintFailText = (reasonTag, nodeVersion) => {
 *      diagnostics).
 *   2. beforeLint hook (e.g. CLI renders the project-detection block)
 *   3. environment checks (reduced-motion + pnpm hardening +
-*      expo/react-native + security scan), collected synchronously
+*      expo/react-native), collected synchronously. The heavier
+*      content-regex security scan is forked instead (like supply-chain
+*      below) and joined before the concat, so its CPU overlaps lint
+*      rather than blocking the event loop before it.
 *   4. The supply-chain check (Socket.dev) is forked onto a background
 *      fiber so its ~100% network-bound time overlaps the ~100%
 *      CPU/subprocess-bound lint pass below, collapsing two serial
@@ -40656,7 +40789,7 @@ const formatLintFailText = (reasonTag, nodeVersion) => {
 *      order, so terminal output is identical either way; supply-chain
 *      rides alongside without a spinner.
 *   6. Join the supply-chain fiber, then assemble the diagnostics in a
-*      FIXED order (env, supply-chain, lint, dead-code) so the output is
+*      FIXED order (env, security-scan, supply-chain, lint, dead-code) so the output is
 *      byte-identical regardless of which fiber settled first. The
 *      viewer-permission fiber is joined later, during score-metadata
 *      assembly (it feeds score metadata, not diagnostics). The per-element
@@ -40717,12 +40850,12 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		...checkPnpmHardening(scanDirectory),
 		...checkReactServerComponentsAdvisory(scanDirectory, project),
 		...checkExpoProject(scanDirectory, project),
-		...checkReactNativeProject(scanDirectory, project),
-		...checkSecurityScan(scanDirectory, {
-			project,
-			ignoredTags: input.ignoredTags
-		})
+		...checkReactNativeProject(scanDirectory, project)
 	])));
+	const securityScanFiber = yield* forkChild(runCollect(applyPerElementPipeline(isDiffMode ? empty$4 : unwrap(promise(() => checkSecurityScanCooperative(scanDirectory, {
+		project,
+		ignoredTags: input.ignoredTags
+	})).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)))))).pipe(withSpan("SecurityScan.run")));
 	const shouldRunSupplyChain = !isDiffMode || (input.supplyChainManifestChanged ?? false);
 	const supplyChainOverlapTimeout = yield* SupplyChainOverlapTimeoutMs;
 	const supplyChainFiber = yield* forkChild(shouldRunSupplyChain ? runCollect(applyPerElementPipeline(supplyChainService.run({
@@ -40858,9 +40991,11 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	else yield* scanProgress.succeed(`Scanned ${scannedFilesLabel} in ${scanElapsedSeconds}s${workerCountSuffix}`);
 	const supplyChainResult = yield* join(supplyChainFiber);
 	const supplyChainCollected = supplyChainResult.diagnostics;
+	const securityScanCollected = yield* join(securityScanFiber);
 	yield* reporterService.finalize;
 	const finalDiagnostics = sortDiagnosticsStable(assignFixGroups([
 		...envCollected,
+		...securityScanCollected,
 		...supplyChainCollected,
 		...lintCollected,
 		...deadCodeCollected
@@ -40907,7 +41042,8 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		scanConcurrency,
 		supplyChainOverlapTimedOut: supplyChainResult.timedOut,
 		lintCacheHitFileCount,
-		lintCacheTotalFileCount
+		lintCacheTotalFileCount,
+		suppressedRuleCounts: transform.summarizeSuppressions()
 	};
 }).pipe(withSpan("runInspect", { attributes: {
 	"inspect.directory": input.directory,
@@ -41312,6 +41448,61 @@ const clearAutoSuppressionCaches = () => {};
 * untouched so the loader sees the same plain object either way.
 */
 const defineConfig = (config) => config;
+const AI_TRAINING_ENV_VARS = [
+	["HF_DATASETS_CACHE", "huggingface"],
+	["HF_HOME", "huggingface"],
+	["HUGGINGFACE_HUB_CACHE", "huggingface"],
+	["SPACE_ID", "huggingface-spaces"],
+	["CUDA_VISIBLE_DEVICES", "cuda"],
+	["NVIDIA_VISIBLE_DEVICES", "nvidia"],
+	["ROCR_VISIBLE_DEVICES", "rocm"],
+	["TPU_NAME", "google-tpu"],
+	["WANDB_RUN_ID", "wandb"],
+	["WANDB_SWEEP_ID", "wandb"],
+	["MLFLOW_RUN_ID", "mlflow"],
+	["MLFLOW_TRACKING_URI", "mlflow"],
+	["COMET_EXPERIMENT_KEY", "comet"],
+	["NEPTUNE_RUN_ID", "neptune"],
+	["CLEARML_TASK_ID", "clearml"],
+	["DVC_STAGE", "dvc"],
+	["RAY_WORKER_PROCESS", "ray"],
+	["RAY_ADDRESS", "ray"],
+	["MUJOCO_GL", "mujoco"],
+	["MUJOCO_PATH", "mujoco"],
+	["GYM_DISABLE_ENV_CHECKER", "gymnasium"],
+	["SM_TRAINING_ENV", "sagemaker"],
+	["TRAINING_JOB_ARN", "sagemaker"],
+	["SAGEMAKER_BASE_DIR", "sagemaker"],
+	["AZUREML_RUN_ID", "azure-ml"],
+	["AZURE_ML_MODEL_DIR", "azure-ml"],
+	["CLOUD_ML_PROJECT_ID", "vertex-ai"],
+	["VERTEX_AI_LOG_LEVEL", "vertex-ai"],
+	["DET_MASTER", "determined-ai"],
+	["LIGHTNING_USER_ID", "lightning-ai"],
+	["FLYTE_INTERNAL_EXECUTION_ID", "flyte"],
+	["ARGO_WORKFLOW_NAME", "argo-workflows"],
+	["KFP_POD_NAME", "kubeflow-pipelines"],
+	["KAGGLE_KERNEL_RUN_TYPE", "kaggle"],
+	["COLAB_BACKEND_VERSION", "google-colab"],
+	["DATABRICKS_RUNTIME_VERSION", "databricks"],
+	["DAYTONA_WS_ID", "daytona"],
+	["DAYTONA_WS_NAME", "daytona"],
+	["E2B_SANDBOX_ID", "e2b"],
+	["MODAL_FUNCTION_ID", "modal"],
+	["MODAL_TASK_ID", "modal"],
+	["RUNPOD_POD_ID", "runpod"],
+	["REPLICATE_USERNAME", "replicate"],
+	["VAST_CONTAINERLABEL", "vast-ai"],
+	["HARBOR_URL", "harbor"],
+	["HARBOR_HOSTNAME", "harbor"],
+	["SWE_BENCH_TASK", "swe-bench"],
+	["SWEBENCH_TASK", "swe-bench"],
+	["SWE_AGENT_MODEL", "swe-agent"]
+];
+const detectAiTrainingEnvironment = () => {
+	for (const [envVar, label] of AI_TRAINING_ENV_VARS) if (process.env[envVar]) return label;
+	return null;
+};
 const unionValues = (baseValues, overrideValues) => [...new Set([...baseValues, ...overrideValues])];
 const mergeIgnores = (baseIgnore, overrideIgnore) => {
 	const mergedIgnore = {
@@ -41356,6 +41547,12 @@ const mergeReactDoctorConfigs = (baseConfig, overrideConfig) => {
 };
 //#endregion
 //#region ../api/dist/index.js
+let didWarnAiTraining = false;
+const warnIfAiTrainingEnvironment = () => {
+	if (didWarnAiTraining || detectAiTrainingEnvironment() === null) return;
+	didWarnAiTraining = true;
+	console.warn("[react-doctor] Use in an AI or ML pipeline requires written permission under the react-doctor license. Contact founders@million.dev to request access.");
+};
 const buildDiagnoseLayer = (config, configOverrideTarget) => {
 	const configLayer = configOverrideTarget === void 0 ? Config.layerNode : Config.layerOf({
 		config,
@@ -41393,6 +41590,7 @@ const outputToDiagnoseResult = (output, elapsedMilliseconds) => {
 	};
 };
 const diagnoseDirectory = async (directory, options) => {
+	warnIfAiTrainingEnvironment();
 	const startTime = globalThis.performance.now();
 	const scanTarget = await resolveScanTarget(directory);
 	return outputToDiagnoseResult(await runPromise(restoreLegacyThrow(buildInspectProgram(scanTarget, options).pipe(provide(buildDiagnoseLayer(scanTarget.userConfig)), provide(layerOtlp)))), globalThis.performance.now() - startTime);
@@ -41439,6 +41637,7 @@ const diagnoseProject = async (projectDefinition, baseOptions, batchConfig) => {
 	}
 };
 const diagnoseProjectBatch = async (input) => {
+	warnIfAiTrainingEnvironment();
 	const startTime = globalThis.performance.now();
 	const { projects, concurrency, config: batchConfig, ...baseOptions } = input;
 	const projectResults = await mapWithConcurrency(projects, concurrency ?? 4, (projectDefinition) => diagnoseProject(projectDefinition, baseOptions, batchConfig));
@@ -41483,4 +41682,4 @@ const toJsonReport = (result, options) => buildJsonReport({
 export { AmbiguousProjectError, NoReactDependencyError, NotADirectoryError, PackageJsonNotFoundError, ProjectNotFoundError, ReactDoctorError, buildJsonReport, buildJsonReportError, clearCaches, defineConfig, diagnose, filterSourceFiles, getDiffInfo, isProjectDiscoveryError, isReactDoctorError, summarizeDiagnostics, toJsonReport };
 
 //# sourceMappingURL=index.js.map
-//# debugId=dccb6d63-63d4-5e91-af21-2756a08fe93a
+//# debugId=3fb133b5-fc1f-519f-8f76-6f1d3bb556ce