react-doctor 0.7.3 → 0.7.4-dev.11333b9

package/dist/cli.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a1ea28f2-3add-5149-82df-ab1cf0c4992e")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="09731967-e6b8-5d9e-84b7-cb46a451b11a")}catch(e){}}();
 import { createRequire } from "node:module";
 import * as NodeChildProcess from "node:child_process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
@@ -8,8 +8,8 @@ import path from "node:path";
 import * as NFS from "node:fs";
 import fs, { mkdtempSync, rmSync } from "node:fs";
 import process$1 from "node:process";
-import * as ts from "typescript";
-import reactDoctorPlugin, { ALL_REACT_DOCTOR_RULE_KEYS, CROSS_FILE_DEPENDENCY_COLLECTORS, CROSS_FILE_RULE_IDS, FRAMEWORK_SPECIFIC_RULE_KEYS, MOTION_LIBRARY_PACKAGES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES, classifySecurityScanFile, collectCrossFileDependencyProbes, resetManifestCaches, shouldReadSecurityScanContent } from "oxlint-plugin-react-doctor";
+import reactDoctorPlugin, { ALL_REACT_DOCTOR_RULE_KEYS, CROSS_FILE_DEPENDENCY_COLLECTORS, CROSS_FILE_RULE_IDS, FRAMEWORK_SPECIFIC_RULE_KEYS, FRAMEWORK_TOKENS, MOTION_LIBRARY_PACKAGES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES, classifySecurityScanFile, collectCrossFileDependencyProbes, resetManifestCaches, shouldReadSecurityScanContent } from "oxlint-plugin-react-doctor";
+import ts from "typescript";
 import * as OS from "node:os";
 import os, { tmpdir } from "node:os";
 import { parseJSON5 } from "confbox";
@@ -22411,12 +22411,45 @@ var Diagnostic = class extends Class("Diagnostic")({
 	relatedLocations: optional(ArraySchema(DiagnosticRelatedLocation)),
 	fixGroupId: optional(String$1)
 }) {};
+var JsonReportDiagnosticV3 = class extends Class("JsonReportDiagnosticV3")({
+	id: String$1,
+	normalizedFilePath: String$1,
+	filePath: String$1,
+	plugin: String$1,
+	rule: String$1,
+	severity: Severity,
+	tags: ArraySchema(String$1),
+	title: optional(String$1),
+	message: String$1,
+	help: String$1,
+	url: optional(String$1),
+	line: Number$1,
+	column: Number$1,
+	offset: optional(Number$1),
+	length: optional(Number$1),
+	endLine: optional(Number$1),
+	endColumn: optional(Number$1),
+	category: String$1,
+	matchByOccurrence: optional(Boolean$1),
+	fileContext: optional(Literals(["test", "story"])),
+	suppressionHint: optional(String$1),
+	relatedLocations: optional(ArraySchema(DiagnosticRelatedLocation)),
+	fixGroupId: optional(String$1)
+}) {};
+/**
+* Deterministic identity string for a diagnostic. Same diagnostic
+* across two scans yields the same identity; lets baselines,
+* suppression files, content-hash caches, and IDE "ignore this"
+* actions all key off one shared shape.
+*/
+const buildDiagnosticIdentity = (input) => `${input.filePath}::${input.line}:${input.column}::${input.plugin}/${input.rule}`;
 const JsonReportMode = Literals([
 	"full",
 	"diff",
 	"staged",
 	"baseline"
 ]);
+const Framework = Literals(FRAMEWORK_TOKENS);
 var JsonReportSummary = class extends Class("JsonReportSummary")({
 	errorCount: Number$1,
 	warningCount: Number$1,
@@ -22454,13 +22487,22 @@ var JsonReportProjectEntry = class extends Class("JsonReportProjectEntry")({
 	scannedFileCount: optional(Number$1),
 	elapsedMilliseconds: Number$1
 }) {};
-/**
-* Versioned JsonReport schema. `JsonReport` is a `Schema.Union` so we
-* can add `schemaVersion: 2` later as one new union member without
-* breaking existing v1 consumers (the GitHub Action keys off the
-* version literal). Today's union is single-arm; the shape is
-* intentional.
-*/
+var JsonReportProjectEntryV3 = class extends Class("JsonReportProjectEntryV3")({
+	directory: String$1,
+	packageRoot: String$1,
+	framework: Framework,
+	project: Unknown,
+	diagnostics: ArraySchema(JsonReportDiagnosticV3),
+	score: Unknown,
+	skippedChecks: ArraySchema(String$1),
+	skippedCheckReasons: optional(Record$1(String$1, String$1)),
+	analyzedFiles: ArraySchema(String$1),
+	analyzedFileCount: Number$1,
+	complete: Boolean$1,
+	scannedFileCount: optional(Number$1),
+	elapsedMilliseconds: Number$1
+}) {};
+/** Original full, diff, and staged report contract. */
 var JsonReportV1 = class extends Class("JsonReportV1")({
 	schemaVersion: Literal(1),
 	version: String$1,
@@ -22521,7 +22563,27 @@ var JsonReportV2 = class extends Class("JsonReportV2")({
 	elapsedMilliseconds: Number$1,
 	error: NullOr(JsonReportError)
 }) {};
-Union([JsonReportV1, JsonReportV2]);
+var JsonReportV3 = class extends Class("JsonReportV3")({
+	schemaVersion: Literal(3),
+	version: String$1,
+	ok: Boolean$1,
+	directory: String$1,
+	mode: JsonReportMode,
+	baselineDegraded: optional(Boolean$1),
+	reactDetected: optional(Boolean$1),
+	diff: NullOr(JsonReportDiffInfo),
+	baseline: optional(JsonReportBaseline),
+	projects: ArraySchema(JsonReportProjectEntryV3),
+	diagnostics: ArraySchema(JsonReportDiagnosticV3),
+	summary: JsonReportSummary,
+	elapsedMilliseconds: Number$1,
+	error: NullOr(JsonReportError)
+}) {};
+Union([
+	JsonReportV1,
+	JsonReportV2,
+	JsonReportV3
+]);
 //#endregion
 //#region ../../node_modules/.pnpm/semver@7.7.4/node_modules/semver/internal/constants.js
 var require_constants$1 = /* @__PURE__ */ __commonJSMin$1(((exports, module) => {
@@ -36179,7 +36241,7 @@ const SOCKET_FREE_USER_AGENT = "react-doctor-supply-chain";
 const FILE_LINT_CACHE_FILENAME = "file-lint-cache.json";
 const FILE_LINT_CACHE_MAX_FILE_COUNT = 5e4;
 const SIDECAR_LINT_CACHE_FILENAME = "sidecar-lint-cache.json";
-const CORE_PACKAGE_VERSION = "0.7.3";
+const CORE_PACKAGE_VERSION = "0.7.4";
 const DEAD_CODE_CACHE_FILENAME = "dead-code-cache.json";
 const DEAD_CODE_SUMMARY_CACHE_FILENAME = "dead-code-summaries.json";
 const SUPPLY_CHAIN_PLUGIN = "socket";
@@ -37085,6 +37147,22 @@ const isPackageJsonReanimatedAware = (packageJson) => {
 	};
 	return Object.hasOwn(allDependencies, REANIMATED_DEPENDENCY_NAME$1);
 };
+const SSR_DEPENDENCY_NAMES = new Set([
+	"@react-router/cloudflare",
+	"@react-router/node",
+	"@react-router/serve",
+	"vike",
+	"vite-plugin-ssr"
+]);
+const isPackageJsonSsrAware = (packageJson) => {
+	const allDependencies = {
+		...packageJson.peerDependencies,
+		...packageJson.dependencies,
+		...packageJson.devDependencies,
+		...packageJson.optionalDependencies
+	};
+	return Object.keys(allDependencies).some((packageName) => SSR_DEPENDENCY_NAMES.has(packageName));
+};
 const getWorkspacePatterns = (rootDirectory, packageJson) => {
 	const pnpmPatterns = parsePnpmWorkspacePatterns(rootDirectory);
 	if (pnpmPatterns.length > 0) return pnpmPatterns;
@@ -37225,6 +37303,7 @@ const evaluateManifestFacts = (facts, packageJson, directory) => {
 	}
 	facts.hasReactNativeAwarePackage = facts.hasReactNativeAwarePackage || isPackageJsonReactNativeAware(packageJson);
 	facts.hasReanimatedAwarePackage = facts.hasReanimatedAwarePackage || isPackageJsonReanimatedAware(packageJson);
+	facts.hasSsrDependency = facts.hasSsrDependency || isPackageJsonSsrAware(packageJson);
 };
 const collectWorkspaceFacts = (rootDirectory, rootPackageJson, { collectReactGroup }) => {
 	const facts = {
@@ -37246,6 +37325,7 @@ const collectWorkspaceFacts = (rootDirectory, rootPackageJson, { collectReactGro
 		},
 		hasReactNativeAwarePackage: false,
 		hasReanimatedAwarePackage: false,
+		hasSsrDependency: false,
 		reanimatedVersion: null
 	};
 	evaluateManifestFacts(facts, rootPackageJson, rootDirectory);
@@ -37482,6 +37562,7 @@ const discoverProjectWithoutPackageJson = (directory) => {
 		hasTypeScript: hasOwnTsConfig,
 		hasReactCompiler: false,
 		hasTanStackQuery: false,
+		hasSsrDependency: false,
 		preactVersion: null,
 		preactMajorVersion: null,
 		hasReactNativeWorkspace: false,
@@ -37601,6 +37682,7 @@ const discoverProject = (directory) => {
 		hasTypeScript,
 		hasReactCompiler: detectReactCompiler(directory, packageJson),
 		hasTanStackQuery: hasTanStackQuery(packageJson),
+		hasSsrDependency: workspaceFacts.hasSsrDependency,
 		preactVersion,
 		preactMajorVersion: parseReactMajor(preactVersion),
 		hasReactNativeWorkspace,
@@ -38687,6 +38769,14 @@ var AmbiguousProject = class extends TaggedErrorClass()("AmbiguousProject", {
 		return `Ambiguous project at ${this.directory}: found ${this.candidates.length} candidates (${this.candidates.join(", ")})`;
 	}
 };
+var ProjectDiscoveryFailed = class extends TaggedErrorClass()("ProjectDiscoveryFailed", {
+	directory: String$1,
+	cause: Unknown
+}) {
+	get message() {
+		return `Project discovery failed for ${this.directory}: ${pretty(fail$6(this.cause))}`;
+	}
+};
 var DeadCodeAnalysisFailed = class extends TaggedErrorClass()("DeadCodeAnalysisFailed", { cause: Unknown }) {
 	get message() {
 		return `Dead-code analysis failed: ${pretty(fail$6(this.cause))}`;
@@ -38721,6 +38811,7 @@ const ReactDoctorErrorReason = Union([
 	ProjectNotFound,
 	NoReactDependency,
 	AmbiguousProject,
+	ProjectDiscoveryFailed,
 	DeadCodeAnalysisFailed,
 	GitInvocationFailed,
 	GitBaseBranchMissing,
@@ -40445,6 +40536,12 @@ const CLIENT_ONLY_FRAMEWORKS = new Set([
 	"react-native",
 	"expo"
 ]);
+const SSR_FRAMEWORKS = new Set([
+	"nextjs",
+	"remix",
+	"gatsby",
+	"tanstack-start"
+]);
 const addMajorLadder = (capabilities, name, major, earliest, latest) => {
 	if (major === null) return;
 	const cappedMajor = Math.min(major, latest);
@@ -40457,6 +40554,7 @@ const buildCapabilities = (project) => {
 	if (project.framework === "expo" || project.framework === "react-native" || project.hasReactNativeWorkspace) capabilities.add("react-native");
 	if (project.expoVersion !== null) capabilities.add("expo");
 	if ((project.framework === "nextjs" || project.framework === "tanstack-start" || project.framework === "remix") && !project.isStaticExport) capabilities.add("server-actions");
+	if (SSR_FRAMEWORKS.has(project.framework) || project.hasSsrDependency) capabilities.add("ssr");
 	if (CLIENT_ONLY_FRAMEWORKS.has(project.framework)) capabilities.add("client-only");
 	if (project.isStaticExport) capabilities.add("nextjs:static-export");
 	if (project.nextjsMajorVersion !== null && project.nextjsMajorVersion >= 15) capabilities.add("nextjs:15");
@@ -43877,6 +43975,8 @@ const spawnLintBatches = async (input) => {
 	const reasonHint = firstDropReason ? ` — first failure: ${firstDropReason}` : "";
 	reportSkippedFiles(droppedFiles, (fileListPreview) => `${droppedFiles.length} file(s) failed to lint and were skipped (${fileListPreview})${reasonHint}`);
 	reportSkippedFiles(outcome.deadlineSkippedFiles, (fileListPreview) => `${outcome.deadlineSkippedFiles.length} file(s) skipped — max scan duration reached before they were linted (${fileListPreview})`);
+	const unavailableFiles = new Set([...droppedFiles, ...outcome.deadlineSkippedFiles]);
+	input.onAnalyzedFiles?.([...new Set(fileBatches.flat().filter((filePath) => !unavailableFiles.has(filePath)))].sort());
 	return dedupeDiagnostics(diagnostics);
 };
 let didValidate = false;
@@ -44133,12 +44233,18 @@ const reactHooksJsPluginDropNote = (error) => {
 *   6. always restore disable directives + clean up the temp dir
 */
 const runOxlint = async (options) => {
-	const { rootDirectory, project, includePaths, nodeBinaryPath = process.execPath, customRulesOnly = false, respectInlineDisables = true, adoptExistingLintConfig = true, ignoredTags = /* @__PURE__ */ new Set(), userConfig, configSourceDirectory = rootDirectory, onPartialFailure, perFileLintCacheEnabled = false, sidecarLintCacheEnabled = false, onCacheStats, onSidecarStats, spawnTimeoutMs, outputMaxBytes, lintBatchOrdering = "cost" } = options;
+	const { rootDirectory, project, includePaths, nodeBinaryPath = process.execPath, customRulesOnly = false, respectInlineDisables = true, adoptExistingLintConfig = true, ignoredTags = /* @__PURE__ */ new Set(), userConfig, configSourceDirectory = rootDirectory, onPartialFailure, onFileCoverage, perFileLintCacheEnabled = false, sidecarLintCacheEnabled = false, onCacheStats, onSidecarStats, spawnTimeoutMs, outputMaxBytes, lintBatchOrdering = "cost" } = options;
 	const serverAuthFunctionNames = Array.isArray(userConfig?.serverAuthFunctionNames) ? userConfig.serverAuthFunctionNames.filter((entry) => typeof entry === "string" && entry.length > 0) : void 0;
 	const severityControls = buildRuleSeverityControls(userConfig);
 	validateRuleRegistration();
 	resetManifestCaches();
-	if (includePaths !== void 0 && includePaths.length === 0) return [];
+	if (includePaths !== void 0 && includePaths.length === 0) {
+		onFileCoverage?.({
+			candidateFiles: [],
+			analyzedFiles: []
+		});
+		return [];
+	}
 	const pluginPath = resolvePluginPath();
 	const extendsPaths = (adoptExistingLintConfig && !customRulesOnly ? detectUserLintConfigPaths(rootDirectory) : []).filter(canOxlintExtendConfig);
 	const userPlugins = resolveUserPlugins(userConfig?.plugins, configSourceDirectory);
@@ -44199,6 +44305,7 @@ const runOxlint = async (options) => {
 		const runConfigOverFiles = async (buildConfigForPass, configFileName, files, fileProgress) => {
 			if (files.length === 0) return {
 				diagnostics: [],
+				analyzedFiles: [],
 				didDropReactHooksJsPlugin: false,
 				hadPartialFailure: false
 			};
@@ -44210,24 +44317,32 @@ const runOxlint = async (options) => {
 			const passConfigPath = Path.join(configDirectory, configFileName);
 			const passBaseArgs = makeBaseArgs(passConfigPath);
 			const passFileBatches = buildFileBatches(passBaseArgs, files);
-			const spawnPass = () => spawnLintBatches({
-				baseArgs: passBaseArgs,
-				fileBatches: passFileBatches,
-				rootDirectory,
-				nodeBinaryPath,
-				project,
-				onPartialFailure: reportPartialFailure,
-				onFileProgress: fileProgress,
-				spawnTimeoutMs,
-				outputMaxBytes,
-				concurrency: options.concurrency,
-				signal: options.signal,
-				deadlineEpochMs: options.deadlineEpochMs
-			});
+			let analyzedFiles = [];
+			const spawnPass = () => {
+				analyzedFiles = [];
+				return spawnLintBatches({
+					baseArgs: passBaseArgs,
+					fileBatches: passFileBatches,
+					rootDirectory,
+					nodeBinaryPath,
+					project,
+					onPartialFailure: reportPartialFailure,
+					onAnalyzedFiles: (filePaths) => {
+						analyzedFiles = filePaths;
+					},
+					onFileProgress: fileProgress,
+					spawnTimeoutMs,
+					outputMaxBytes,
+					concurrency: options.concurrency,
+					signal: options.signal,
+					deadlineEpochMs: options.deadlineEpochMs
+				});
+			};
 			writeOxlintConfig(passConfigPath, buildConfigForPass({}));
 			try {
 				return {
 					diagnostics: await spawnPass(),
+					analyzedFiles,
 					didDropReactHooksJsPlugin: false,
 					hadPartialFailure
 				};
@@ -44239,6 +44354,7 @@ const runOxlint = async (options) => {
 				reportPartialFailure(reactHooksJsDropNote);
 				return {
 					diagnostics,
+					analyzedFiles,
 					didDropReactHooksJsPlugin: true,
 					hadPartialFailure
 				};
@@ -44314,6 +44430,7 @@ const runOxlint = async (options) => {
 			const missFileSet = new Set(missFiles);
 			const hitFiles = candidateFiles.filter((candidateFile) => !missFileSet.has(candidateFile));
 			const sidecarReplayedDiagnostics = [];
+			const sidecarReplayedFiles = [];
 			const sidecarLintFiles = [];
 			if (sidecarCache === null) sidecarLintFiles.push(...hitFiles);
 			else {
@@ -44321,8 +44438,10 @@ const runOxlint = async (options) => {
 				for (const hitFile of hitFiles) {
 					const cacheKey = cacheKeyByFile.get(hitFile);
 					const entry = cacheKey === void 0 ? null : sidecarCache.lookup(cacheKey);
-					if (entry !== null && entry.probes.every((probe) => probeAnswers.answerFor(probe.kind, probe.path) === probe.answer)) sidecarReplayedDiagnostics.push(...entry.diagnostics);
-					else sidecarLintFiles.push(hitFile);
+					if (entry !== null && entry.probes.every((probe) => probeAnswers.answerFor(probe.kind, probe.path) === probe.answer)) {
+						sidecarReplayedFiles.push(hitFile);
+						sidecarReplayedDiagnostics.push(...entry.diagnostics);
+					} else sidecarLintFiles.push(hitFile);
 					if (performance.now() - verifySliceStartedAt >= 12) {
 						await yieldToEventLoop();
 						verifySliceStartedAt = performance.now();
@@ -44348,6 +44467,7 @@ const runOxlint = async (options) => {
 				sidecarRuleIdFilter: new Set(unboundedSidecarRuleIds)
 			}), "oxlintrc.sidecar-unbounded.json", hitFiles, void 0) : {
 				diagnostics: [],
+				analyzedFiles: [],
 				didDropReactHooksJsPlugin: false,
 				hadPartialFailure: false
 			};
@@ -44378,6 +44498,15 @@ const runOxlint = async (options) => {
 					probesByFile: await missProbesTask
 				}]
 			});
+			const analyzedFileSet = new Set(fullResult.analyzedFiles);
+			const boundedSidecarAnalyzedFileSet = new Set(boundedSidecarResult.analyzedFiles);
+			const unboundedSidecarAnalyzedFileSet = new Set(unboundedSidecarResult.analyzedFiles);
+			const sidecarReplayedFileSet = new Set(sidecarReplayedFiles);
+			for (const hitFile of hitFiles) if (useSidecarCache ? (sidecarReplayedFileSet.has(hitFile) || boundedSidecarAnalyzedFileSet.has(hitFile)) && (unboundedSidecarRuleIds.length === 0 || unboundedSidecarAnalyzedFileSet.has(hitFile)) : boundedSidecarAnalyzedFileSet.has(hitFile)) analyzedFileSet.add(hitFile);
+			onFileCoverage?.({
+				candidateFiles,
+				analyzedFiles: candidateFiles.filter((candidateFile) => analyzedFileSet.has(candidateFile))
+			});
 			return dedupeDiagnostics([
 				...replayedDiagnostics,
 				...fullResult.diagnostics,
@@ -44388,6 +44517,7 @@ const runOxlint = async (options) => {
 		}
 		const baseArgs = makeBaseArgs(configPath);
 		const fileBatches = buildFileBatches(baseArgs, candidateFiles);
+		let analyzedFiles = [];
 		const runBatches = () => spawnLintBatches({
 			baseArgs,
 			fileBatches,
@@ -44395,6 +44525,9 @@ const runOxlint = async (options) => {
 			nodeBinaryPath,
 			project,
 			onPartialFailure,
+			onAnalyzedFiles: (filePaths) => {
+				analyzedFiles = filePaths;
+			},
 			onFileProgress: options.onFileProgress,
 			spawnTimeoutMs,
 			outputMaxBytes,
@@ -44404,7 +44537,12 @@ const runOxlint = async (options) => {
 		});
 		writeOxlintConfig(configPath, buildConfig({ extendsPaths }));
 		try {
-			return await runBatches();
+			const diagnostics = await runBatches();
+			onFileCoverage?.({
+				candidateFiles,
+				analyzedFiles
+			});
+			return diagnostics;
 		} catch (error) {
 			const reactHooksJsDropNote = reactHooksJsPluginDropNote(error);
 			if (reactHooksJsDropNote !== null) {
@@ -44414,11 +44552,20 @@ const runOxlint = async (options) => {
 				}));
 				const diagnostics = await runBatches();
 				onPartialFailure?.(reactHooksJsDropNote);
+				onFileCoverage?.({
+					candidateFiles,
+					analyzedFiles
+				});
 				return diagnostics;
 			}
 			if (extendsPaths.length === 0) throw error;
 			writeOxlintConfig(configPath, buildConfig({ extendsPaths: [] }));
-			return await runBatches();
+			const diagnostics = await runBatches();
+			onFileCoverage?.({
+				candidateFiles,
+				analyzedFiles
+			});
+			return diagnostics;
 		}
 	} finally {
 		restoreDisableDirectives();
@@ -44498,6 +44645,7 @@ var Linter = class Linter extends Service()("react-doctor/Linter") {
 				onPartialFailure: (reason) => {
 					collectedFailures.push(reason);
 				},
+				onFileCoverage: input.onFileCoverage,
 				onFileProgress: input.onFileProgress,
 				perFileLintCacheEnabled,
 				sidecarLintCacheEnabled,
@@ -44590,7 +44738,10 @@ const translateProjectInfoError = (cause, directory) => {
 		directory: cause.directory,
 		candidates: cause.candidates
 	}) });
-	return new ReactDoctorError({ reason: new ProjectNotFound({ directory }) });
+	return new ReactDoctorError({ reason: new ProjectDiscoveryFailed({
+		directory,
+		cause
+	}) });
 };
 var Project = class Project extends Service()("react-doctor/Project") {
 	static layerNode = succeed$3(Project, Project.of({ discover: fn("Project.discover")(function* (directory) {
@@ -45202,6 +45353,7 @@ const resolveGithubActionsScoreMetadata = (environment = process.env) => {
 		...actorAssociation !== void 0 ? { githubActorAssociation: actorAssociation } : {}
 	};
 };
+const toNormalizedRelativePath = (filePath, rootDirectory) => Path.relative(Path.resolve(rootDirectory), Path.resolve(rootDirectory, filePath)).replaceAll("\\", "/") || ".";
 const NO_HOOKS = {
 	beforeLint: () => void_,
 	afterLint: () => void_
@@ -45300,7 +45452,7 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		repo
 	}).pipe(orElseSucceed(() => null)) : succeed$2(null));
 	const lintIncludePaths = (input.skipJsxIncludeFilter ? input.includePaths.length > 0 ? [...input.includePaths] : void 0 : computeExplicitLintIncludePaths([...input.includePaths], project)) ?? resolveLintIncludePaths(scanDirectory, resolvedConfig.config, project);
-	const scannedFilePaths = input.suppressScanSummary ? (lintIncludePaths ?? (yield* filesService.listSourceFiles(scanDirectory))).map((relativePath) => Path.resolve(scanDirectory, relativePath)) : [];
+	const fallbackScannedFilePaths = input.suppressScanSummary ? (lintIncludePaths ?? (yield* filesService.listSourceFiles(scanDirectory))).map((relativePath) => Path.resolve(scanDirectory, relativePath)) : [];
 	const beforeLint = hooks.beforeLint ?? NO_HOOKS.beforeLint;
 	const afterLint = hooks.afterLint ?? NO_HOOKS.afterLint;
 	yield* beforeLint(project, lintIncludePaths ?? void 0);
@@ -45405,6 +45557,7 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	let deadCodeCacheHit = null;
 	let deadCodeSummaryCacheHits = null;
 	let deadCodeSummaryCacheMisses = null;
+	const lintFileCoverageState = { value: null };
 	const baseLintStream = linterService.run({
 		rootDirectory: scanDirectory,
 		project,
@@ -45420,6 +45573,9 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 			lastReportedTotalFileCount = totalFileCount;
 			runSync(scanProgress.update(`Scanning files (${scannedFileCount}/${totalFileCount})${workerCountSuffix}...`));
 		},
+		onFileCoverage: (coverage) => {
+			lintFileCoverageState.value = coverage;
+		},
 		onCacheStats: (cacheHitFileCount, totalConsideredFileCount) => {
 			lintCacheHitFileCount = cacheHitFileCount;
 			lintCacheTotalFileCount = totalConsideredFileCount;
@@ -45450,7 +45606,10 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	const lintFailureState = yield* get$2(lintFailure);
 	yield* afterLint(lintFailureState.didFail);
 	if (lintFailureState.didFail) yield* scanProgress.fail(formatLintFailText(lintFailureState.reasonTag, process.version));
-	const totalFileCount = lastReportedTotalFileCount || (lintIncludePaths?.length ?? project.sourceFileCount);
+	const candidateFiles = lintFileCoverageState.value === null ? [] : [...new Set(lintFileCoverageState.value.candidateFiles.map((filePath) => toNormalizedRelativePath(filePath, scanDirectory)))];
+	const analyzedFiles = lintFileCoverageState.value === null ? [] : [...new Set(lintFileCoverageState.value.analyzedFiles.map((filePath) => toNormalizedRelativePath(filePath, scanDirectory)))].sort();
+	const totalFileCount = candidateFiles.length || lastReportedTotalFileCount || (lintIncludePaths?.length ?? project.sourceFileCount);
+	const scannedFilePaths = input.suppressScanSummary ? candidateFiles.length > 0 ? candidateFiles.map((filePath) => Path.resolve(scanDirectory, filePath)) : fallbackScannedFilePaths : [];
 	const scannedFilesLabel = `${totalFileCount} ${totalFileCount === 1 ? "file" : "files"}`;
 	let deadCodeCollected = [];
 	if (lintFailureState.didFail) {
@@ -45532,6 +45691,7 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		deadCodeOverlapped: shouldOverlapDeadCode,
 		scannedFileCount: totalFileCount,
 		scannedFilePaths,
+		analyzedFiles,
 		scanElapsedMilliseconds,
 		scanConcurrency,
 		supplyChainOverlapTimedOut: supplyChainResult.timedOut,
@@ -45807,7 +45967,7 @@ const buildJsonReportError = (input) => {
 		sentryEventId
 	};
 	return {
-		schemaVersion: 1,
+		schemaVersion: 3,
 		version: input.version,
 		ok: false,
 		directory: input.directory,
@@ -45852,6 +46012,7 @@ const summarizeDiagnostics = (diagnostics, worstScore = null, worstScoreLabel =
 * React-runtime rule family was gated off for the project.
 */
 const hasReactRuntime = (project) => project.reactVersion !== null || project.preactVersion !== null;
+const isScanComplete = (input) => input.analyzedFileCount !== void 0 && input.scannedFileCount !== void 0 && input.skippedCheckCount === 0 && input.skippedCheckReasonCount === 0 && input.analyzedFileCount === input.scannedFileCount;
 const toJsonDiff = (diff) => {
 	if (!diff) return null;
 	return {
@@ -45874,21 +46035,68 @@ const findWorstScoredProject = (projects) => {
 	}
 	return worst;
 };
+const toJsonReportDiagnostic = (diagnostic, projectRoot, reportRoot) => {
+	const normalizedFilePath = toNormalizedRelativePath(diagnostic.filePath, projectRoot);
+	const reportRelativeFilePath = toNormalizedRelativePath(Path.resolve(projectRoot, diagnostic.filePath), reportRoot);
+	const ruleIdentity = getDiagnosticRuleIdentity(diagnostic);
+	return {
+		...diagnostic,
+		id: buildDiagnosticIdentity({
+			filePath: reportRelativeFilePath,
+			line: diagnostic.line,
+			column: diagnostic.column,
+			plugin: diagnostic.plugin,
+			rule: diagnostic.rule
+		}),
+		normalizedFilePath,
+		category: ruleIdentity.category,
+		tags: [...new Set(ruleIdentity.tags)].sort()
+	};
+};
 const buildJsonReport = (input) => {
-	const projects = input.scans.map(({ directory, result }) => ({
-		directory,
-		project: result.project,
-		diagnostics: result.diagnostics,
-		score: result.score,
-		skippedChecks: result.skippedChecks,
-		...result.skippedCheckReasons ? { skippedCheckReasons: result.skippedCheckReasons } : {},
-		...typeof result.scannedFileCount === "number" ? { scannedFileCount: result.scannedFileCount } : {},
-		elapsedMilliseconds: result.elapsedMilliseconds
-	}));
+	const projects = input.scans.map(({ directory, result }) => {
+		const skippedChecks = result.skippedChecks ?? [];
+		const analyzedFiles = [...new Set((result.analyzedFiles ?? []).map((filePath) => toNormalizedRelativePath(filePath, result.project.rootDirectory)))].sort();
+		const scannedFileCount = result.scannedFileCount ?? result.project.sourceFileCount;
+		return {
+			directory,
+			packageRoot: result.project.rootDirectory,
+			framework: result.project.framework,
+			project: result.project,
+			diagnostics: result.diagnostics.map((diagnostic) => toJsonReportDiagnostic(diagnostic, result.project.rootDirectory, input.directory)),
+			score: result.score,
+			skippedChecks,
+			...result.skippedCheckReasons ? { skippedCheckReasons: result.skippedCheckReasons } : {},
+			analyzedFiles,
+			analyzedFileCount: analyzedFiles.length,
+			complete: isScanComplete({
+				analyzedFileCount: result.analyzedFiles === void 0 ? void 0 : analyzedFiles.length,
+				scannedFileCount,
+				skippedCheckCount: skippedChecks.length,
+				skippedCheckReasonCount: Object.keys(result.skippedCheckReasons ?? {}).length
+			}),
+			...typeof result.scannedFileCount === "number" ? { scannedFileCount } : {},
+			elapsedMilliseconds: result.elapsedMilliseconds
+		};
+	});
 	const flattenedDiagnostics = projects.flatMap((entry) => entry.diagnostics);
 	const worstScoredProject = findWorstScoredProject(projects);
-	const summary = summarizeDiagnostics(flattenedDiagnostics, worstScoredProject?.score?.score ?? null, worstScoredProject?.score?.label ?? null);
-	const shared = {
+	const diagnosticSummary = summarizeDiagnostics(flattenedDiagnostics, worstScoredProject?.score?.score ?? null, worstScoredProject?.score?.label ?? null);
+	const affectedFileCount = projects.reduce((totalAffectedFileCount, project) => totalAffectedFileCount + new Set(project.diagnostics.map((diagnostic) => diagnostic.normalizedFilePath)).size, 0);
+	const summary = {
+		...diagnosticSummary,
+		affectedFileCount
+	};
+	return {
+		schemaVersion: 3,
+		mode: input.baseline !== void 0 ? "baseline" : input.baselineDegraded && input.mode === "baseline" ? "diff" : input.mode,
+		...input.baseline ? { baseline: {
+			baseRef: input.baseline.baseRef,
+			newCount: summary.totalDiagnosticCount,
+			fixedCount: input.baseline.fixedCount,
+			baseTotalCount: input.baseline.baseTotalCount
+		} } : {},
+		...input.baselineDegraded ? { baselineDegraded: true } : {},
 		...input.scans.length > 0 ? { reactDetected: input.scans.some((scan) => hasReactRuntime(scan.result.project)) } : {},
 		version: input.version,
 		ok: true,
@@ -45900,39 +46108,26 @@ const buildJsonReport = (input) => {
 		elapsedMilliseconds: input.totalElapsedMilliseconds,
 		error: null
 	};
-	if (input.baseline) return {
-		schemaVersion: 2,
-		mode: "baseline",
-		baseline: {
-			baseRef: input.baseline.baseRef,
-			newCount: summary.totalDiagnosticCount,
-			fixedCount: input.baseline.fixedCount,
-			baseTotalCount: input.baseline.baseTotalCount
-		},
-		...shared
-	};
-	return {
-		schemaVersion: 1,
-		mode: input.mode,
-		...input.baselineDegraded ? { baselineDegraded: true } : {},
-		...shared
-	};
 };
 /**
 * Single source of truth for the skipped-check accounting shared by the
 * CLI renderer (`react-doctor/src/inspect.ts → finalizeAndRender`) and the
 * programmatic shell (`@react-doctor/api → diagnose()`). Both surface a
-* failed lint / dead-code pass instead of a false "all clear", so the
+* failed or partial analysis pass instead of a false "all clear", so the
 * branch logic lives here once.
 */
 const buildSkippedChecks = (input) => {
 	const skippedChecks = [];
 	if (input.didLintFail) skippedChecks.push("lint");
 	if (input.didDeadCodeFail) skippedChecks.push("dead-code");
+	if (input.supplyChainOverlapTimedOut) skippedChecks.push("supply-chain");
+	if (input.securityScanFailed) skippedChecks.push("security-scan");
 	const skippedCheckReasons = {};
 	if (input.didLintFail && input.lintFailureReason !== null) skippedCheckReasons.lint = input.lintFailureReason;
 	else if (input.lintPartialFailures.length > 0) skippedCheckReasons["lint:partial"] = input.lintPartialFailures.join("; ");
 	if (input.didDeadCodeFail && input.deadCodeFailureReason !== null) skippedCheckReasons["dead-code"] = input.deadCodeFailureReason;
+	if (input.supplyChainOverlapTimedOut) skippedCheckReasons["supply-chain"] = "Supply-chain analysis timed out and was skipped.";
+	if (input.securityScanFailed) skippedCheckReasons["security-scan"] = "Security scan failed and was skipped.";
 	return {
 		skippedChecks,
 		skippedCheckReasons
@@ -46347,7 +46542,7 @@ const GH_DEFAULT_BRANCH_PROBE_TIMEOUT_MS = 5e3;
 const CI_TRUST_COMPANIES = "PayPal, Rippling, and Alibaba";
 const WELCOME_EXPLANATION_HOLD_MS = 1e3;
 const CATEGORY_COUNTUP_SETTLE_HOLD_MS = 1e3;
-const INTERNAL_ERROR_JSON_FALLBACK = "{\"schemaVersion\":1,\"ok\":false,\"error\":{\"message\":\"Internal error\",\"name\":\"Error\",\"chain\":[]}}\n";
+const INTERNAL_ERROR_JSON_FALLBACK = "{\"schemaVersion\":3,\"version\":\"unknown\",\"ok\":false,\"directory\":\"\",\"mode\":\"full\",\"diff\":null,\"projects\":[],\"diagnostics\":[],\"summary\":{\"errorCount\":0,\"warningCount\":0,\"affectedFileCount\":0,\"totalDiagnosticCount\":0,\"score\":null,\"scoreLabel\":null},\"elapsedMilliseconds\":0,\"error\":{\"message\":\"Internal error\",\"name\":\"Error\",\"chain\":[]}}\n";
 const SENTRY_FLUSH_TIMEOUT_MS = 2e3;
 const NANOSECONDS_PER_SECOND = 1000000000n;
 const METRIC = {
@@ -46434,7 +46629,7 @@ const makeNoopConsole = () => ({
 });
 //#endregion
 //#region src/cli/utils/version.ts
-const VERSION = "0.7.3";
+const VERSION = "0.7.4-dev.11333b9";
 //#endregion
 //#region src/cli/utils/json-mode.ts
 let context = null;
@@ -46803,13 +46998,13 @@ const isDevVersion = (version) => version === "0.0.0" || version.includes("-");
 * uploads source-map artifacts under, so stack frames symbolicate. Honors the
 * standard `SENTRY_RELEASE` override.
 */
-const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.7.3`;
+const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.7.4-dev.11333b9`;
 /**
 * Deployment environment shown in Sentry's environment filter. Defaults to
 * `production` for tagged releases and `development` for dev/unbuilt versions,
 * overridable via the standard `SENTRY_ENVIRONMENT` env var.
 */
-const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.7.3") ? "development" : "production");
+const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.7.4-dev.11333b9") ? "development" : "production");
 /**
 * Performance-tracing sample rate in `[0, 1]`. Reads `SENTRY_TRACES_SAMPLE_RATE`
 * (set to `0` to disable tracing) and falls back to
@@ -59019,12 +59214,12 @@ const resolveCacheFilePath = (projectDirectory) => path.join(resolveReactDoctorC
 const readPersistedCache = (cacheFilePath) => {
 	try {
 		const parsed = JSON.parse(fs.readFileSync(cacheFilePath, "utf8"));
-		if (!isRecord(parsed) || parsed.version !== 4) return {
-			version: 4,
+		if (!isRecord(parsed) || parsed.version !== 5) return {
+			version: 5,
 			entries: []
 		};
 		if (!Array.isArray(parsed.entries)) return {
-			version: 4,
+			version: 5,
 			entries: []
 		};
 		const entries = [];
@@ -59034,12 +59229,12 @@ const readPersistedCache = (cacheFilePath) => {
 			entries.push(entry);
 		}
 		return {
-			version: 4,
+			version: 5,
 			entries
 		};
 	} catch {
 		return {
-			version: 4,
+			version: 5,
 			entries: []
 		};
 	}
@@ -59101,7 +59296,7 @@ const buildScanResultCacheKey = (input) => {
 	if (headSha === null) return null;
 	if (stringifyStableJson(input.userConfig) === null) return null;
 	const cacheKeyJson = stringifyStableJson({
-		schemaVersion: 4,
+		schemaVersion: 5,
 		projectIdentity: resolveProjectIdentity(input.projectDirectory),
 		headSha,
 		worktreeFingerprint,
@@ -59142,7 +59337,7 @@ const createScanResultCache = (projectDirectory) => {
 	for (const entry of persistedCache.entries) entries.set(entry.key, entry);
 	const persist = () => {
 		writePersistedCache(cacheFilePath, {
-			version: 4,
+			version: 5,
 			entries: [...entries.values()].sort((firstEntry, secondEntry) => secondEntry.createdAtMs - firstEntry.createdAtMs).slice(0, 20)
 		});
 	};
@@ -59283,6 +59478,7 @@ const buildOutcomeAttributes = (input) => {
 		return withNamespace("outcome", {
 			status: "error",
 			exitCode: 1,
+			complete: false,
 			knownError: known,
 			errorTag: known ? error.reason._tag : error instanceof Error ? error.name : null
 		});
@@ -59292,8 +59488,13 @@ const buildOutcomeAttributes = (input) => {
 	const blockingLevel = resolveTelemetryBlocking(input.userConfig);
 	const gateDiagnostics = filterDiagnosticsForSurface(result.diagnostics, "ciFailure", input.userConfig);
 	const wouldBlock = !input.scoreOnly && !input.gateExempt && shouldBlockCi(gateDiagnostics, blockingLevel);
-	const hasSkippedChecks = result.skippedChecks.length > 0;
-	const isClean = result.diagnostics.length === 0 && !hasSkippedChecks;
+	const complete = isScanComplete({
+		analyzedFileCount: result.analyzedFiles?.length,
+		scannedFileCount: result.scannedFileCount,
+		skippedCheckCount: result.skippedChecks.length,
+		skippedCheckReasonCount: Object.keys(result.skippedCheckReasons ?? {}).length
+	});
+	const isClean = result.diagnostics.length === 0 && complete;
 	const outcome = wouldBlock ? "blocked" : isClean ? "clean" : "ok";
 	const firings = summarizeRuleFirings(result.diagnostics);
 	const countByRule = /* @__PURE__ */ new Map();
@@ -59343,6 +59544,7 @@ const buildOutcomeAttributes = (input) => {
 			wouldBlock,
 			blocking: blockingLevel,
 			clean: isClean,
+			complete,
 			skippedChecks: result.skippedChecks.length
 		}),
 		...withNamespace("diag", {
@@ -60993,6 +61195,7 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		directory: output.resolvedDirectory,
 		scannedFileCount: output.scannedFileCount,
 		scannedFilePaths: output.scannedFilePaths,
+		analyzedFiles: output.analyzedFiles,
 		scanElapsedMilliseconds: output.scanElapsedMilliseconds,
 		scanConcurrency: output.scanConcurrency,
 		baselineDelta,
@@ -61047,9 +61250,12 @@ const renderAndRecordScan = async (input) => {
 		lintPartialFailures: input.payload.lintPartialFailures,
 		didDeadCodeFail: input.payload.didDeadCodeFail,
 		deadCodeFailureReason: input.payload.deadCodeFailureReason,
+		supplyChainOverlapTimedOut: input.payload.supplyChainOverlapTimedOut,
+		securityScanFailed: input.payload.securityScanFailed ?? false,
 		directory: input.payload.directory,
 		scannedFileCount: input.payload.scannedFileCount,
 		scannedFilePaths: input.payload.scannedFilePaths,
+		analyzedFiles: input.payload.analyzedFiles ?? [],
 		scanElapsedMilliseconds: input.payload.scanElapsedMilliseconds,
 		lintCacheHitFileCount: input.lintCacheHitFileCount ?? null,
 		lintCacheTotalFileCount: input.lintCacheTotalFileCount ?? null,
@@ -61097,13 +61303,15 @@ const renderAndRecordScan = async (input) => {
 	return result;
 };
 const finalizeAndRender = (input) => gen(function* () {
-	const { options, elapsedMilliseconds, diagnostics, score, project, userConfig, didLintFail, lintFailureReason, lintPartialFailures, didDeadCodeFail, deadCodeFailureReason, directory, scannedFileCount, scannedFilePaths, scanElapsedMilliseconds, lintCacheHitFileCount, lintCacheTotalFileCount, lintSidecarReplayedFileCount, lintSidecarTotalFileCount, deadCodeCacheHit, deadCodeSummaryCacheHits, deadCodeSummaryCacheMisses, baselineDelta } = input;
+	const { options, elapsedMilliseconds, diagnostics, score, project, userConfig, didLintFail, lintFailureReason, lintPartialFailures, didDeadCodeFail, deadCodeFailureReason, supplyChainOverlapTimedOut, securityScanFailed, directory, scannedFileCount, scannedFilePaths, analyzedFiles, scanElapsedMilliseconds, lintCacheHitFileCount, lintCacheTotalFileCount, lintSidecarReplayedFileCount, lintSidecarTotalFileCount, deadCodeCacheHit, deadCodeSummaryCacheHits, deadCodeSummaryCacheMisses, baselineDelta } = input;
 	const { skippedChecks, skippedCheckReasons } = buildSkippedChecks({
 		didLintFail,
 		lintFailureReason,
 		lintPartialFailures,
 		didDeadCodeFail,
-		deadCodeFailureReason
+		deadCodeFailureReason,
+		supplyChainOverlapTimedOut,
+		securityScanFailed
 	});
 	const hasSkippedChecks = skippedChecks.length > 0;
 	const noScoreMessage = buildNoScoreMessage(options.noScore);
@@ -61116,6 +61324,7 @@ const finalizeAndRender = (input) => gen(function* () {
 		elapsedMilliseconds,
 		scannedFileCount,
 		scannedFilePaths,
+		analyzedFiles,
 		scanElapsedMilliseconds,
 		...lintCacheTotalFileCount !== null ? {
 			lintCacheHitFileCount,
@@ -64984,4 +65193,4 @@ Promise.resolve().then(() => assertNoRemovedFlags(process.argv)).then(() => prog
 export {};
 
 //# sourceMappingURL=cli.js.map
-//# debugId=a1ea28f2-3add-5149-82df-ab1cf0c4992e
+//# debugId=09731967-e6b8-5d9e-84b7-cb46a451b11a