react-doctor 0.9.13-dev.ff7dd67 → 0.9.14-dev.499a020

package/dist/{should-fail-scan-gate-CCPDoHaM.js → should-fail-scan-gate-B8cvpr6W.js}

@@ -1,24 +1,26 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a4d4a5ab-7608-5645-bd28-b9bb73993dfd")}catch(e){}}();
-import { $ as Linter, A as SCAN_RESULT_CACHE_FILENAME, An as gen, At as discoverSupportedSubprojects, B as isNonInteractiveEnvironment, Bn as sync, Cn as error, Ct as collectSourceFileCountsByDirectory, Dn as Diagnostic, Dt as createNodeReadFileLinesSync, En as warn, Et as countOptInProjectRuleSelections, Fn as provide, G as isCiEnvironment, Gt as hashFileContents, Ht as groupBy, In as provideContext, J as Config, Jt as isPathInsideDirectory, K as isCiOrCodingAgentEnvironment, Kn as succeed, Kt as highlighter, Ln as provideService, Mn as map, Mt as filterPathsOutsideDirectories, Nn as orElseSucceed, Nt as filterSourceFiles, On as decodeUnknownSync, Ot as createOxlintSpawnSlots, Pn as promise, Q as LintPartialFailures, Qt as isScanComplete, Rn as runPromise, S as BASELINE_FILES_TEMP_DIR_PREFIX, Sn as Console, T as METRIC, Tn as log, Tt as computeDiagnosticDelta, U as ACTION_INPUT_ENVIRONMENT_VARIABLES, Ut as hasPublishedFixRecipe, Vn as try_, W as detectRunnerOs, Wn as mergeAll, X as Git, Xt as isReactDoctorError, Y as Files, Zn as ParentSpan, _ as VERSION, _n as shouldUseMaintainabilityLayer, _t as buildRuleSeverityControls, an as materializeSourceTree, ar as DIAGNOSTIC_CATEGORY_BUCKETS, at as Progress, bt as canonicalizeUserRuleKey, cn as resolveGithubActionsScoreMetadata, ct as Score, d as isJsonModeActive, dn as resolveScanConcurrency, dr as JSX_DUPLICATION_SOURCE_FILE_PATTERN, dt as SupplyChain, en as listSourceFiles, et as Maintainability, fn as resolveScanTarget, fr as JSX_FILE_PATTERN, gt as buildRuleDocsUrl, hr as SHARE_BASE_URL, in as mapWithConcurrency, it as PerFileLintCacheEnabled, jt as filterDiagnosticsForSurface, l as getRunId, ln as resolveLintBatchOrdering, lr as GIT_SHOW_MAX_BUFFER_BYTES, lt as SidecarLintCacheEnabled, mn as runInspect, mr as OXLINT_NODE_REQUIREMENT, mt as atomicWriteJson, n as recordDistribution, nn as listWorkspacePackages, nt as OxlintConcurrency, on as mergeReactDoctorConfigs, ot as Project, pn as restoreLegacyThrow, pr as MILLISECONDS_PER_SECOND, qt as isMonorepoRoot, r as toSpanAttributes, rt as OxlintSpawnSlots, sn as remainingDeadlineBudgetMs, sr as ENTERPRISE_CONTACT_URL, st as Reporter, t as recordCount, tn as listSourceFilesCooperative, tr as CI_URL, tt as NodeResolver, un as resolveReactDoctorCacheDir, ur as HTML_FILE_PATTERN, v as makeNoopConsole, vn as summarizeDiagnostics, vt as buildSkippedChecks, wt as computeConfigFingerprint, xn as yieldToEventLoop, xr as isFile, xt as classifyFileContext, yr as isDirectory, yt as calculateScore, z as CliInputError, zn as runSync, zt as getDiagnosticRuleIdentity } from "./record-metric-Bkorhx43.js";
-import { t as getTelemetryContext } from "./telemetry-runtime-BGWa_GB9.js";
-import { n as buildFooterLinkLines, t as buildSectionDivider } from "./build-section-divider-BRuN44fL.js";
-import { t as activeScanAbortRegistry } from "./active-scan-abort-registry-DwG6tSPy.js";
-import { t as toForwardSlashes } from "./path-format-DnHpmJwG.js";
-import { C as isRecord, M as cliLogger, S as getPackageJsonPath, a as installReactDoctorScriptStep, c as spinner, k as runGit, n as findNearestPackageDirectory, o as isSpinnerSilent, s as setSpinnerSilent } from "./install-doctor-script-Coa2ErCg.js";
-import { d as detectDefaultBranch, l as prompts, r as installReactDoctorWorkflow, u as isCommandAvailable } from "./install-github-workflow-DlfdrYkQ.js";
-import { a as isValidBlockingLevel, c as openWorkflowPullRequest, l as stageWorkflowFile, o as pickBlockingLevel } from "./resolve-scope-BFloAClV.js";
-import { n as resetSentryRunState, r as withRunSpan, t as recordSentryProjectContext } from "./with-run-span-GsCWW2_X.js";
-import { h as detectAvailableAgents, t as reportWorkflowResult } from "./report-workflow-result-CBL6CrLY.js";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="bb74300d-38db-5b33-86a5-4ad923dfbe6a")}catch(e){}}();
+import { E as TRACKED_FILE_FLAGS_GIT_ARGUMENTS, Ft as HTML_FILE_PATTERN, Ht as MAINTAINABILITY_SOURCE_FILE_PATTERN, Jt as OXLINT_NODE_REQUIREMENT, K as resolveReactDoctorCacheDir, Nt as GIT_SHOW_MAX_BUFFER_BYTES, Rt as JSX_FILE_PATTERN, St as ENTERPRISE_CONTACT_URL, Wt as MILLISECONDS_PER_SECOND, _t as DIAGNOSTIC_CATEGORY_BUCKETS, c as HEAD_SHA_GIT_ARGUMENTS, dn as SHARE_BASE_URL, h as REPOSITORY_ROOT_GIT_ARGUMENTS, i as BASELINE_FILES_TEMP_DIR_PREFIX, k as WORKTREE_STATUS_GIT_ARGUMENTS, q as resolveScanConcurrency, u as METRIC, ut as CI_URL, v as SCAN_RESULT_CACHE_FILENAME } from "./constants-CW_854PH.js";
+import { t as isCacheGloballyDisabled } from "./is-cache-globally-disabled-CoHiYz2i.js";
+import { $ as buildSkippedChecks, A as Git, B as Progress, Bt as materializeSourceTree, C as ACTION_INPUT_ENVIRONMENT_VARIABLES, Dt as hashFileContents, E as isCiOrCodingAgentEnvironment, En as succeed, F as Maintainability, Ft as listSourceFiles, Gt as resolveScanTarget, H as Reporter, Ht as remainingDeadlineBudgetMs, I as NodeResolver, In as isDirectory, It as listSourceFilesCooperative, K as SupplyChain, Kt as restoreLegacyThrow, L as OxlintConcurrency, Lt as listWorkspacePackages, Mn as isMonorepoRoot, N as LintPartialFailures, Nn as yieldToEventLoop, Nt as isScanComplete, O as Config, Ot as highlighter, P as Linter, Q as buildRuleSeverityControls, R as OxlintSpawnSlots, Rn as isFile, T as isCiEnvironment, Tt as hasPublishedFixRecipe, U as Score, Ut as resolveGithubActionsScoreMetadata, V as Project, Vt as mergeReactDoctorConfigs, W as SidecarLintCacheEnabled, Wt as resolveLintBatchOrdering, Xt as shouldUseMaintainabilityLayer, Y as atomicWriteJson, Z as buildRuleDocsUrl, Zt as summarizeDiagnostics, _ as VERSION, _n as provideService, an as log, at as computeConfigFingerprint, b as isNonInteractiveEnvironment, bn as sync, cn as decodeUnknownSync, ct as createInvocationCaches, d as isJsonModeActive, en as warmDuplicateJsxWorker, et as calculateScore, fn as map, ft as discoverSupportedSubprojects, gn as provideContext, hn as provide, ht as filterSourceFiles, it as collectSourceFilesByDirectory, j as InvocationCaches, jn as ParentSpan, jt as isReactDoctorError, k as Files, kt as isPathInsideDirectory, l as getRunId, lt as createNodeReadFileLinesSync, mn as promise, mt as filterPathsOutsideDirectories, n as recordDistribution, nn as Console, nt as classifyFileContext, on as warn, ot as computeDiagnosticDelta, pn as orElseSucceed, pt as filterDiagnosticsForSurface, qt as runInspect, r as toSpanAttributes, rn as error, sn as Diagnostic, st as countOptInProjectRuleSelections, t as recordCount, tn as warmOxlintWorkerPool, tt as canonicalizeUserRuleKey, un as gen, ut as createOxlintSpawnSlots, v as makeNoopConsole, vn as runPromise, w as detectRunnerOs, wn as mergeAll, wt as groupBy, xn as try_, xt as getDiagnosticRuleIdentity, y as CliInputError, yn as runSync, z as PerFileLintCacheEnabled, zt as mapWithConcurrency } from "./record-metric-BeiisdDK.js";
+import { t as getTelemetryContext } from "./telemetry-runtime-DfK-XYFO.js";
+import { t as activeScanAbortRegistry } from "./active-scan-abort-registry-CCTgal0O.js";
+import { n as buildFooterLinkLines, t as buildSectionDivider } from "./build-section-divider-BsKw6rbA.js";
+import { t as toForwardSlashes } from "./path-format-By20mo8A.js";
+import { t as typescriptBinding } from "./_react-doctor_require-typescript-DXQDYeWK.js";
+import { A as runGitAsync, C as isRecord, N as cliLogger, S as getPackageJsonPath, a as installReactDoctorScriptStep, c as spinner, n as findNearestPackageDirectory, o as isSpinnerSilent, s as setSpinnerSilent } from "./install-doctor-script-k5jxcUWB.js";
+import { d as detectDefaultBranch, l as prompts, r as installReactDoctorWorkflow, u as isCommandAvailable } from "./install-github-workflow-Dh3nS6ms.js";
+import { a as isValidBlockingLevel, c as openWorkflowPullRequest, l as stageWorkflowFile, o as pickBlockingLevel } from "./resolve-scope-DsrT6gaf.js";
+import { n as resetSentryRunState, r as withRunSpan, t as recordSentryProjectContext } from "./with-run-span-DP84SJbD.js";
+import { h as detectAvailableAgents, t as reportWorkflowResult } from "./report-workflow-result-CRhHHcHp.js";
 import { createRequire } from "node:module";
-import { spawn } from "node:child_process";
-import * as path$1 from "node:path";
-import path from "node:path";
 import * as fs$2 from "node:fs";
 import fs, { mkdtempSync, rmSync } from "node:fs";
-import ts from "typescript";
-import crypto, { randomUUID } from "node:crypto";
+import * as path$1 from "node:path";
+import path from "node:path";
+import { spawn } from "node:child_process";
 import { tmpdir } from "node:os";
+import crypto, { randomUUID } from "node:crypto";
 import * as fs$1 from "node:fs/promises";
 import { performance } from "node:perf_hooks";
 //#region src/cli/utils/apply-observability.ts
@@ -102,7 +104,8 @@ const buildRuntimeLayers = (input) => {
 		configSourceDirectory: input.configSourceDirectory
 	}) : Config.layerNode, Files.layerNode, Git.layerNode, linterLayer, LintPartialFailures.layerLive, maintainabilityLayer, progressLayer, reporterLayer, scoreLayer, supplyChainLayer);
 	const layersWithConcurrency = input.oxlintConcurrency === void 0 ? baseLayers : mergeAll(baseLayers, succeed(OxlintConcurrency, input.oxlintConcurrency));
-	return input.oxlintSpawnSlots === void 0 ? layersWithConcurrency : mergeAll(layersWithConcurrency, succeed(OxlintSpawnSlots, input.oxlintSpawnSlots));
+	const layersWithSpawnSlots = input.oxlintSpawnSlots === void 0 ? layersWithConcurrency : mergeAll(layersWithConcurrency, succeed(OxlintSpawnSlots, input.oxlintSpawnSlots));
+	return input.invocationCaches === void 0 ? layersWithSpawnSlots : mergeAll(layersWithSpawnSlots, succeed(InvocationCaches, input.invocationCaches));
 };
 //#endregion
 //#region src/cli/utils/diagnostic-grouping.ts
@@ -268,762 +271,347 @@ const resolveScoreUnavailableReason = (input) => {
 	return input.isAnalysisIncomplete ? "analysis-incomplete" : "api-unavailable";
 };
 //#endregion
-//#region src/cli/utils/scan-result-cache-payload.ts
-const decodeDiagnostic = decodeUnknownSync(Diagnostic);
-const isStringArray = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string");
-const isNullableString = (value) => value === null || typeof value === "string";
-const isBoolean = (value) => typeof value === "boolean";
-const isNumber = (value) => typeof value === "number";
-const isString = (value) => typeof value === "string";
-const isDiagnosticArray = (value) => {
-	if (!Array.isArray(value)) return false;
-	try {
-		for (const entry of value) decodeDiagnostic(entry);
-		return true;
-	} catch {
-		return false;
-	}
+//#region src/cli/utils/should-block-ci.ts
+const shouldBlockCi = (diagnostics, blockingLevel) => {
+	if (blockingLevel === "none") return false;
+	if (blockingLevel === "warning") return diagnostics.length > 0;
+	return diagnostics.some((diagnostic) => diagnostic.severity === "error");
 };
-const isScoreResult = (value) => value === null || isRecord(value) && typeof value.score === "number" && typeof value.label === "string";
-const isProjectInfo = (value) => isRecord(value) && typeof value.rootDirectory === "string" && typeof value.projectName === "string" && typeof value.framework === "string" && typeof value.sourceFileCount === "number";
-const isBaselineDelta = (value) => isRecord(value) && typeof value.baseRef === "string" && typeof value.fixedCount === "number" && typeof value.baseTotalCount === "number" && (value.crossFileMatchCount === void 0 || typeof value.crossFileMatchCount === "number");
-const isSuppressedRuleCountArray = (value) => Array.isArray(value) && value.every((entry) => isRecord(entry) && typeof entry.rule === "string" && typeof entry.source === "string" && typeof entry.count === "number");
-const REQUIRED_CACHED_SCAN_PAYLOAD_FIELDS = [
-	{
-		key: "diagnostics",
-		isValid: isDiagnosticArray
-	},
-	{
-		key: "score",
-		isValid: isScoreResult
-	},
-	{
-		key: "project",
-		isValid: isProjectInfo
-	},
-	{
-		key: "userConfig",
-		isValid: (value) => value === null || isRecord(value)
-	},
-	{
-		key: "didLintFail",
-		isValid: isBoolean
-	},
-	{
-		key: "lintFailureReason",
-		isValid: isNullableString
-	},
-	{
-		key: "lintPartialFailures",
-		isValid: isStringArray
-	},
-	{
-		key: "didDeadCodeFail",
-		isValid: isBoolean
-	},
-	{
-		key: "deadCodeFailureReason",
-		isValid: isNullableString
-	},
-	{
-		key: "deadCodeOverlapped",
-		isValid: isBoolean
-	},
-	{
-		key: "directory",
-		isValid: isString
-	},
-	{
-		key: "scannedFileCount",
-		isValid: isNumber
-	},
-	{
-		key: "scannedFilePaths",
-		isValid: isStringArray
-	},
-	{
-		key: "scanElapsedMilliseconds",
-		isValid: isNumber
-	},
-	{
-		key: "lintFailureReasonKind",
-		isValid: isNullableString
-	},
-	{
-		key: "supplyChainOverlapTimedOut",
-		isValid: isBoolean
-	}
-];
-const OPTIONAL_CACHED_SCAN_PAYLOAD_FIELDS = [
-	{
-		key: "analyzedFiles",
-		isValid: isStringArray
-	},
-	{
-		key: "baselineDelta",
-		isValid: isBaselineDelta
-	},
-	{
-		key: "scanConcurrency",
-		isValid: isNumber
-	},
-	{
-		key: "securityScanFailed",
-		isValid: isBoolean
-	},
-	{
-		key: "securityScanFailureReason",
-		isValid: isNullableString
-	},
-	{
-		key: "suppressedRuleCounts",
-		isValid: isSuppressedRuleCountArray
-	},
-	{
-		key: "manifestContentHash",
-		isValid: isNullableString
-	}
-];
-const hasValidRequiredCachedScanPayloadFields = (value) => REQUIRED_CACHED_SCAN_PAYLOAD_FIELDS.every((field) => field.isValid(value[field.key]));
-const hasValidOptionalCachedScanPayloadFields = (value) => OPTIONAL_CACHED_SCAN_PAYLOAD_FIELDS.every((field) => value[field.key] === void 0 || field.isValid(value[field.key]));
-const isCachedScanPayload = (value) => {
-	if (!isRecord(value)) return false;
-	return hasValidRequiredCachedScanPayloadFields(value) && hasValidOptionalCachedScanPayloadFields(value);
+//#endregion
+//#region src/cli/utils/to-category-key.ts
+/**
+* Lowercase, key-safe form of a rule category for the `diag.category.*`
+* telemetry attribute namespace (categories carry spaces / capitals, e.g.
+* "Performance" → `performance`, "Dead Code" → `dead_code`).
+*/
+const toCategoryKey = (category) => category.toLowerCase().replace(/[^a-z0-9]+/g, "_");
+//#endregion
+//#region src/cli/utils/with-namespace.ts
+/**
+* Prefixes every key in a flat attribute group with `namespace.`, so a logical
+* group (scan config, diagnostics rollup, score, …) carries one dotted
+* namespace applied in a single place rather than hand-spelled into each key —
+* which is how the wide event drifted into a flat, half-namespaced soup. The
+* dotted prefix is what makes the attributes tree up in Sentry's attribute
+* browser and stay group-/filter-/aggregate-able in the Spans dataset.
+*
+* Value types are preserved verbatim (numbers stay numbers so Sentry infers a
+* numeric attribute and `p75(...)`/`avg(...)` work; `null`/`undefined` are kept
+* so `toSpanAttributes` can drop absent signals rather than coerce them).
+*/
+const withNamespace = (namespace, attributes) => {
+	const namespaced = {};
+	for (const [key, value] of Object.entries(attributes)) namespaced[`${namespace}.${key}`] = value;
+	return namespaced;
 };
-const decodeCachedScanPayload = (value) => isCachedScanPayload(value) ? value : null;
-const shouldStoreScanPayload = (payload) => !payload.didLintFail && !payload.didDeadCodeFail && payload.lintPartialFailures.length === 0 && !payload.supplyChainOverlapTimedOut && payload.securityScanFailed !== true;
 //#endregion
-//#region src/cli/utils/scan-result-cache.ts
-const createScanResultCacheInvocationState = () => ({ repositoryIdentityByRoot: /* @__PURE__ */ new Map() });
-const CACHE_DISABLED_VALUES = new Set(["1", "true"]);
-const TOOLCHAIN_PACKAGE_SPECIFIERS = [
-	"oxlint/package.json",
-	"oxlint-plugin-react-doctor/package.json",
-	"eslint-plugin-react-hooks/package.json"
-];
-const bundledRequire = createRequire(import.meta.url);
-const RULE_PLUGIN_CONTENT_FINGERPRINT = (() => {
-	try {
-		return `oxlint-plugin-react-doctor#fingerprint=${hashFileContents(bundledRequire.resolve("oxlint-plugin-react-doctor")) ?? "unreadable"}`;
-	} catch {
-		return "oxlint-plugin-react-doctor#fingerprint=unresolved";
-	}
-})();
-const normalizeForStableJson = (value) => {
-	if (value === null) return null;
-	if (value === void 0) return void 0;
-	const valueType = typeof value;
-	if (valueType === "string" || valueType === "number" || valueType === "boolean") return value;
-	if (valueType === "bigint" || valueType === "function" || valueType === "symbol") throw new Error("Unsupported cache key value");
-	if (Array.isArray(value)) return value.map((item) => {
-		const normalized = normalizeForStableJson(item);
-		return normalized === void 0 ? null : normalized;
+//#region src/cli/utils/build-run-event.ts
+const readEnvBoolean = (name) => {
+	const value = process.env[name];
+	if (value === void 0) return null;
+	return value.toLowerCase() === "true" || value === "1";
+};
+const ratioOf = (numerator, denominator) => denominator != null && denominator > 0 ? (numerator ?? 0) / denominator : null;
+/**
+* One queryable cache temperature per scan, derived from the whole stack:
+*
+*   - `"turbo"`    — whole-repo scan-result replay (the explicit
+*                    `wholeRepoCacheHit` flag from the CLI's cachedPayload
+*                    branch; no scan work ran).
+*   - `"warm"`     — any incremental reuse: per-file lint hits, sidecar
+*                    replays.
+*   - `"disabled"` — zero reuse because the global `REACT_DOCTOR_NO_CACHE`
+*                    off-switch is on. Granular per-cache opt-outs
+*                    (`REACT_DOCTOR_NO_FILE_CACHE`, …) still read warm/cold,
+*                    since the other subsystems stay live.
+*   - `"cold"`     — caches on, zero reuse (first scan / everything changed).
+*
+* `cache.warmth` is the headline reuse magnitude in [0, 1]: the plain mean of
+* the subsystem reuse fractions known this run (lint hit ratio, sidecar
+* replay ratio), skipping subsystems that never consulted a
+* cache; `1` on turbo, dropped when nothing consulted any cache. Deliberately
+* unweighted — the per-subsystem dims stay the precise signal; warmth is the
+* p50/p90-able summary. Emitted only on the success path.
+*/
+const buildCacheAttributes = (input) => {
+	if (input.result === void 0) return {};
+	if (input.wholeRepoCacheHit) return withNamespace("cache", {
+		wholeRepoHit: true,
+		temperature: "turbo",
+		warmth: 1
 	});
-	const prototype = Object.getPrototypeOf(value);
-	if (prototype !== Object.prototype && prototype !== null) throw new Error("Unsupported cache key object");
-	if (!isRecord(value)) throw new Error("Unsupported cache key object");
-	const normalizedRecord = {};
-	for (const key of Object.keys(value).sort()) {
-		const normalized = normalizeForStableJson(value[key]);
-		if (normalized !== void 0) normalizedRecord[key] = normalized;
+	const result = input.result;
+	const subsystemReuseRatios = [ratioOf(result.lintCacheHitFileCount, result.lintCacheTotalFileCount), ratioOf(result.lintSidecarReplayedFileCount, result.lintSidecarTotalFileCount)];
+	let knownSubsystemCount = 0;
+	let reuseRatioSum = 0;
+	for (const reuseRatio of subsystemReuseRatios) {
+		if (reuseRatio === null) continue;
+		knownSubsystemCount += 1;
+		reuseRatioSum += reuseRatio;
 	}
-	return normalizedRecord;
+	const warmth = knownSubsystemCount > 0 ? reuseRatioSum / knownSubsystemCount : null;
+	const temperature = warmth !== null && warmth > 0 ? "warm" : isCacheGloballyDisabled() ? "disabled" : "cold";
+	return withNamespace("cache", {
+		wholeRepoHit: input.wholeRepoCacheHit,
+		temperature,
+		warmth
+	});
 };
-const stringifyStableJson = (value) => {
-	try {
-		return JSON.stringify(normalizeForStableJson(value));
-	} catch {
-		return null;
-	}
+const resolveVersionPin = (versionInput) => {
+	if (versionInput === void 0 || versionInput.trim() === "") return null;
+	if (versionInput === "latest") return "latest";
+	if (/^(\.\.?\/|\/)/.test(versionInput)) return "local";
+	return "pinned";
 };
-const hashString = (value) => crypto.createHash("sha1").update(value).digest("hex");
-const readHeadSha = (projectDirectory) => runGit(projectDirectory, ["rev-parse", "HEAD"]);
-const parseWorktreeStatusRecords = (statusOutput) => {
-	const entries = [];
-	const tokens = statusOutput.split("\0");
-	for (let tokenIndex = 0; tokenIndex < tokens.length; tokenIndex += 1) {
-		let record = tokens[tokenIndex];
-		if (record.length === 0) continue;
-		if (record.length < 3 || record[2] !== " ") {
-			if (tokenIndex !== 0) return null;
-			record = ` ${record}`;
-		}
-		if (record.length < 4 || record[2] !== " ") return null;
-		const statusCode = record.slice(0, 2);
-		const recordPath = record.slice(3);
-		if (statusCode.includes("R") || statusCode.includes("C")) {
-			tokenIndex += 1;
-			const originPath = tokens[tokenIndex];
-			if (originPath === void 0 || originPath.length === 0) return null;
-			entries.push({
-				statusCode,
-				path: recordPath,
-				originPath
-			});
-			continue;
-		}
-		entries.push({
-			statusCode,
-			path: recordPath
+const resolveTelemetryBlocking = (userConfig) => {
+	const fromAction = process.env[ACTION_INPUT_ENVIRONMENT_VARIABLES.blocking];
+	if (fromAction !== void 0 && isValidBlockingLevel(fromAction)) return fromAction;
+	return userConfig?.blocking ?? userConfig?.failOn ?? "error";
+};
+const buildOutcomeAttributes = (input) => {
+	if (input.result === void 0) {
+		const error = input.error;
+		const known = isReactDoctorError(error);
+		return withNamespace("outcome", {
+			status: "error",
+			exitCode: 1,
+			complete: false,
+			knownError: known,
+			errorTag: known ? error.reason._tag : error instanceof Error ? error.name : null
 		});
 	}
-	return entries;
-};
-const buildDirtyPathContentFingerprint = (absolutePath, statusCode) => {
-	let stats;
-	try {
-		stats = fs.lstatSync(absolutePath);
-	} catch {
-		return statusCode.includes("D") ? "deleted" : null;
+	const result = input.result;
+	const summary = summarizeDiagnostics(result.diagnostics);
+	const blockingLevel = resolveTelemetryBlocking(input.userConfig);
+	const gateDiagnostics = filterDiagnosticsForSurface(result.diagnostics, "ciFailure", input.userConfig);
+	const gateDiagnosticSet = new Set(gateDiagnostics);
+	const complete = isInspectResultComplete(result);
+	const didLintHardFail = hasLintHardFailure(result);
+	const failsOnHardFailure = didLintHardFail && blockingLevel !== "none";
+	const wouldBlock = !input.scoreOnly && !input.gateExempt && shouldBlockCi(gateDiagnostics, blockingLevel);
+	const isClean = result.diagnostics.length === 0 && complete;
+	const outcome = didLintHardFail ? "error" : wouldBlock ? "blocked" : isClean ? "clean" : "ok";
+	const firings = summarizeRuleFirings(result.diagnostics);
+	const countByRule = /* @__PURE__ */ new Map();
+	const countByCategory = /* @__PURE__ */ new Map();
+	for (const firing of firings) {
+		countByRule.set(firing.rule, (countByRule.get(firing.rule) ?? 0) + firing.count);
+		countByCategory.set(firing.category, (countByCategory.get(firing.category) ?? 0) + firing.count);
 	}
-	if (stats.isSymbolicLink()) try {
-		return `link:${fs.readlinkSync(absolutePath)}`;
-	} catch {
-		return null;
+	let topRule = null;
+	let topRuleCount = 0;
+	for (const [rule, count] of countByRule) if (count > topRuleCount) {
+		topRule = rule;
+		topRuleCount = count;
 	}
-	if (!stats.isFile()) return null;
-	if (stats.size > 10485760) return null;
-	return hashFileContents(absolutePath);
-};
-const buildWorktreeFingerprint = (projectDirectory, repositoryRoot) => {
-	const statusOutput = runGit(projectDirectory, [
-		"status",
-		"--porcelain=v1",
-		"-z",
-		"--untracked-files=all"
-	]);
-	if (statusOutput === null) return null;
-	if (statusOutput.length === 0) return [];
-	const statusEntries = parseWorktreeStatusRecords(statusOutput);
-	if (statusEntries === null) return null;
-	if (statusEntries.length > 300) return null;
-	const dirtyEntries = [];
-	for (const statusEntry of statusEntries) {
-		const contentFingerprint = buildDirtyPathContentFingerprint(path.join(repositoryRoot, statusEntry.path), statusEntry.statusCode);
-		if (contentFingerprint === null) return null;
-		dirtyEntries.push({
-			...statusEntry,
-			contentFingerprint
-		});
+	const largestRuleBucket = buildRuleBlastRadii(result.diagnostics)[0] ?? null;
+	let diagnosticsInTestFiles = 0;
+	let diagnosticsInStoryFiles = 0;
+	let nonProductionGateExcluded = 0;
+	const diagnosticSiteCounts = /* @__PURE__ */ new Map();
+	const findingsPerFixGroup = /* @__PURE__ */ new Map();
+	for (const diagnostic of result.diagnostics) {
+		if (diagnostic.fileContext === "test") diagnosticsInTestFiles += 1;
+		if (diagnostic.fileContext === "story") diagnosticsInStoryFiles += 1;
+		if (diagnostic.fileContext !== void 0 && !gateDiagnosticSet.has(diagnostic)) nonProductionGateExcluded += 1;
+		const diagnosticSite = JSON.stringify([
+			diagnostic.filePath,
+			diagnostic.line,
+			diagnostic.column,
+			diagnostic.plugin,
+			diagnostic.rule
+		]);
+		diagnosticSiteCounts.set(diagnosticSite, (diagnosticSiteCounts.get(diagnosticSite) ?? 0) + 1);
+		if (diagnostic.fixGroupId) findingsPerFixGroup.set(diagnostic.fixGroupId, (findingsPerFixGroup.get(diagnostic.fixGroupId) ?? 0) + 1);
 	}
-	return dirtyEntries.sort((firstEntry, secondEntry) => {
-		const firstSortKey = `${firstEntry.path}
${firstEntry.statusCode}`;
-		const secondSortKey = `${secondEntry.path}
${secondEntry.statusCode}`;
-		return firstSortKey < secondSortKey ? -1 : firstSortKey > secondSortKey ? 1 : 0;
-	});
-};
-const resolveRepositoryCacheIdentity = (projectDirectory, invocationState) => {
-	const repositoryRoot = runGit(projectDirectory, ["rev-parse", "--show-toplevel"]);
-	if (repositoryRoot === null) return null;
-	const cachedIdentity = invocationState.repositoryIdentityByRoot.get(repositoryRoot);
-	if (cachedIdentity !== void 0) return cachedIdentity;
-	const worktreeFingerprint = buildWorktreeFingerprint(projectDirectory, repositoryRoot);
-	const headSha = readHeadSha(repositoryRoot);
-	const identity = worktreeFingerprint === null || headSha === null ? null : {
-		headSha,
-		worktreeFingerprint
-	};
-	invocationState.repositoryIdentityByRoot.set(repositoryRoot, identity);
-	return identity;
-};
-const DOTENV_FILE_NAME_PATTERN = /^\.env(\.|$)/;
-const resolveDotenvFingerprint = (projectDirectory) => {
-	try {
-		return fs.readdirSync(projectDirectory).filter((entryName) => DOTENV_FILE_NAME_PATTERN.test(entryName)).sort().map((entryName) => `${entryName}=${hashFileContents(path.join(projectDirectory, entryName)) ?? "unreadable"}`);
-	} catch {
-		return [];
+	let fixGroupedFindings = 0;
+	for (const count of findingsPerFixGroup.values()) fixGroupedFindings += count;
+	let sameSiteOccurrences = 0;
+	for (const count of diagnosticSiteCounts.values()) sameSiteOccurrences += Math.max(0, count - 1);
+	const categoryRollup = {};
+	for (const [category, count] of countByCategory) categoryRollup[`category.${toCategoryKey(category)}`] = count;
+	const suppressionRollup = {};
+	if (input.suppressedRuleCounts) {
+		const countBySource = {
+			config: 0,
+			override: 0,
+			inline: 0,
+			"foreign-inline": 0
+		};
+		for (const suppression of input.suppressedRuleCounts) countBySource[suppression.source] += suppression.count;
+		suppressionRollup.suppressed = countBySource.config + countBySource.override + countBySource.inline + countBySource["foreign-inline"];
+		suppressionRollup.suppressedConfig = countBySource.config;
+		suppressionRollup.suppressedOverride = countBySource.override;
+		suppressionRollup.suppressedInline = countBySource.inline;
+		suppressionRollup.suppressedForeignInline = countBySource["foreign-inline"];
 	}
+	const attributes = {
+		...withNamespace("outcome", {
+			status: outcome,
+			exitCode: failsOnHardFailure || wouldBlock ? 1 : 0,
+			wouldBlock,
+			blocking: blockingLevel,
+			clean: isClean,
+			complete,
+			skippedChecks: result.skippedChecks.length
+		}),
+		...withNamespace("diag", {
+			total: summary.totalDiagnosticCount,
+			errors: summary.errorCount,
+			warnings: summary.warningCount,
+			affectedFiles: summary.affectedFileCount,
+			inTestFiles: diagnosticsInTestFiles,
+			inStoryFiles: diagnosticsInStoryFiles,
+			nonProductionGateExcluded,
+			distinctRules: countByRule.size,
+			topRule,
+			sameSiteOccurrences,
+			fixGroups: findingsPerFixGroup.size,
+			fixGroupedFindings,
+			...categoryRollup,
+			...suppressionRollup
+		}),
+		...withNamespace("score", {
+			value: result.score ? result.score.score : null,
+			label: result.score ? result.score.label : null,
+			available: result.score !== null,
+			unavailableReason: result.score === null ? resolveScoreUnavailableReason({
+				isScoreDisabled: input.noScore,
+				isAnalysisIncomplete: input.didLintFail === true || input.didDeadCodeFail === true
+			}) : null
+		}),
+		...withNamespace("lint", {
+			failed: input.didLintFail,
+			failureReasonKind: input.lintFailureReasonKind,
+			partialFailureCount: input.lintPartialFailureCount,
+			droppedFileCount: input.lintDroppedFileCount,
+			deadlineSkippedFileCount: input.lintDeadlineSkippedFileCount,
+			cacheHitFiles: result.lintCacheHitFileCount,
+			cacheTotalFiles: result.lintCacheTotalFileCount,
+			cacheHitRatio: ratioOf(result.lintCacheHitFileCount, result.lintCacheTotalFileCount),
+			sidecarReplayedFiles: result.lintSidecarReplayedFileCount,
+			sidecarTotalFiles: result.lintSidecarTotalFileCount,
+			sidecarReplayRatio: ratioOf(result.lintSidecarReplayedFileCount, result.lintSidecarTotalFileCount)
+		}),
+		...withNamespace("maintainability", { failed: input.didDeadCodeFail }),
+		...withNamespace("supplyChain", { overlapTimedOut: input.supplyChainOverlapTimedOut }),
+		...withNamespace("securityScan", { failed: input.securityScanFailed }),
+		...withNamespace("timing", {
+			elapsedMs: result.elapsedMilliseconds,
+			scanMs: result.scanElapsedMilliseconds
+		}),
+		...withNamespace("migration", {
+			largestRuleBucketFiles: largestRuleBucket ? largestRuleBucket.fileCount : null,
+			largestRuleBucketSites: largestRuleBucket ? largestRuleBucket.siteCount : null,
+			largestRuleBucketRule: largestRuleBucket ? largestRuleBucket.ruleKey : null
+		})
+	};
+	if (result.baselineDelta) Object.assign(attributes, withNamespace("baseline", {
+		new: summary.totalDiagnosticCount,
+		fixed: result.baselineDelta.fixedCount,
+		baseTotal: result.baselineDelta.baseTotalCount,
+		crossFileMatches: result.baselineDelta.crossFileMatchCount,
+		degraded: false
+	}));
+	else if (input.gateExempt) attributes["baseline.degraded"] = true;
+	return attributes;
 };
-const isGitIdentityTrustworthy = (projectDirectory) => {
-	const output = runGit(projectDirectory, ["ls-files", "-v"]);
-	if (output === null) return false;
-	const entryLines = output.split("\n").filter((line) => line.length > 0);
-	return entryLines.length > 0 && entryLines.every((line) => line[0] === "H");
+const buildActionAttributes = () => {
+	const { githubActorAssociation } = resolveGithubActionsScoreMetadata();
+	return withNamespace("action", {
+		actorAssociation: githubActorAssociation,
+		runnerOs: detectRunnerOs(),
+		comment: readEnvBoolean(ACTION_INPUT_ENVIRONMENT_VARIABLES.comment),
+		reviewComments: readEnvBoolean(ACTION_INPUT_ENVIRONMENT_VARIABLES.reviewComments),
+		versionPin: resolveVersionPin(process.env[ACTION_INPUT_ENVIRONMENT_VARIABLES.version])
+	});
 };
-const resolveCacheFilePath = (projectDirectory) => path.join(resolveReactDoctorCacheDir(projectDirectory), SCAN_RESULT_CACHE_FILENAME);
-const readPersistedCache = (cacheFilePath) => {
-	try {
-		const parsed = JSON.parse(fs.readFileSync(cacheFilePath, "utf8"));
-		if (!isRecord(parsed) || parsed.version !== 7) return {
-			version: 7,
-			entries: []
-		};
-		if (!Array.isArray(parsed.entries)) return {
-			version: 7,
-			entries: []
-		};
-		const entries = [];
-		for (const entry of parsed.entries) {
-			if (!isRecord(entry) || typeof entry.key !== "string" || typeof entry.createdAtMs !== "number") continue;
-			const payload = decodeCachedScanPayload(entry.payload);
-			if (payload === null) continue;
-			entries.push({
-				key: entry.key,
-				createdAtMs: entry.createdAtMs,
-				payload
-			});
-		}
-		return {
-			version: 7,
-			entries
-		};
-	} catch {
-		return {
-			version: 7,
-			entries: []
-		};
-	}
+const buildScanAttributes = (input) => {
+	const ruleOverrides = input.userConfig?.rules ?? {};
+	const ruleKeys = Object.keys(ruleOverrides);
+	return withNamespace("scan", {
+		mode: input.mode,
+		scope: input.scope,
+		parallel: input.parallel,
+		workerCount: input.workerCount,
+		maxDurationMs: input.maxDurationMs,
+		lint: input.lint,
+		maintainability: input.deadCode,
+		supplyChain: input.supplyChain,
+		scoreOnly: input.scoreOnly,
+		noScore: input.noScore,
+		respectInlineDisables: input.respectInlineDisables,
+		showWarnings: input.showWarnings,
+		usedOutputDir: input.usedOutputDir,
+		ignoredTagCount: input.ignoredTagCount,
+		hasCustomConfig: input.hasCustomConfig,
+		rulesConfigured: ruleKeys.length,
+		rulesDisabled: ruleKeys.filter((key) => ruleOverrides[key] === "off").length,
+		projectAnalysisRuleCount: countOptInProjectRuleSelections(buildRuleSeverityControls(input.userConfig)),
+		fileCount: input.result?.scannedFileCount,
+		nonJsxFileCount: input.result?.analyzedFiles?.filter((filePath) => !JSX_FILE_PATTERN.test(filePath)).length,
+		htmlFileCount: input.result?.analyzedFiles?.filter((filePath) => HTML_FILE_PATTERN.test(filePath)).length,
+		multilineDiagnosticCount: input.result?.diagnostics.filter((diagnostic) => (diagnostic.endLine ?? diagnostic.line) > diagnostic.line).length
+	});
 };
 /**
-* The global cache off-switch (`REACT_DOCTOR_NO_CACHE`), which disables every
-* cache subsystem: this whole-repo scan cache plus core's per-file lint,
-* sidecar caches (their `Context.Reference` defaults read the
-* same variable). Exported for the wide event's `cache.temperature`
-* derivation, which reports `"disabled"` instead of `"cold"` when the switch
-* is on. Granular knobs (`REACT_DOCTOR_NO_FILE_CACHE`, …) are deliberately
-* not consulted — they leave the other subsystems live.
+* Projects a scan into the namespaced attribute set for its root span — the
+* canonical per-scan "wide event". Every attribute carries a dotted namespace
+* that groups it by concept (`scan.*` config, `action.*` CI knobs, `outcome.*`
+* verdict, `diag.*` findings, `score.*`, `lint.*`, `maintainability.*`, `cache.*`,
+* `supplyChain.*`, `timing.*`, `migration.*`, `baseline.*`) so the attributes
+* tree up in Sentry's attribute browser and stay filter-/group-/aggregate-able
+* in the Spans dataset. Pure and exported so the projection (outcome
+* precedence, rule/category rollups, CI knobs, config shape) is unit-testable
+* without a live Sentry client. `null`/`undefined` values are dropped so absent
+* signals never become misleading `"null"`/`"undefined"` attributes. The run +
+* project base context (version, command, ci/provider, framework, …) is already
+* on the span from `withSentryRunSpan` / `recordSentryProjectContext`, so this
+* adds only what those don't carry.
 */
-const isCacheGloballyDisabled = () => CACHE_DISABLED_VALUES.has(process.env.REACT_DOCTOR_NO_CACHE?.toLowerCase() ?? "");
-const resolveProjectIdentity = (projectDirectory) => {
-	try {
-		return fs.realpathSync.native(projectDirectory);
-	} catch {
-		return path.resolve(projectDirectory);
-	}
-};
-const resolveManifestContentHash = (projectDirectory) => hashFileContents(getPackageJsonPath(projectDirectory));
-const fileFingerprint = (filePath) => {
+const buildRunEventAttributes = (input) => toSpanAttributes({
+	...buildScanAttributes(input),
+	...buildActionAttributes(),
+	...buildOutcomeAttributes(input),
+	...buildCacheAttributes(input)
+});
+/**
+* Stamps the wide-event attributes onto the run's root span. A guarded no-op
+* when tracing is off (no `rootSpan`) and swallow-on-throw, so telemetry can
+* never break the run.
+*/
+const recordRunEvent = (rootSpan, input) => {
+	if (!rootSpan) return;
 	try {
-		const stat = fs.statSync(filePath);
-		return `${filePath}:${stat.mtimeMs}:${stat.size}`;
-	} catch {
-		return null;
-	}
-};
-const resolveScanResultToolchainFingerprint = (nodeBinaryPath) => {
-	const fingerprints = [];
-	if (nodeBinaryPath !== null) fingerprints.push(nodeBinaryPath === process.execPath ? `node=${process.version}` : `node=${fileFingerprint(nodeBinaryPath) ?? "unreadable"}`);
-	for (const specifier of TOOLCHAIN_PACKAGE_SPECIFIERS) try {
-		const packageJson = bundledRequire(specifier);
-		const version = typeof packageJson.version === "string" ? packageJson.version : "unknown";
-		fingerprints.push(`${specifier}=${version}`);
-	} catch {
-		fingerprints.push(`${specifier}=missing`);
-	}
-	fingerprints.push(RULE_PLUGIN_CONTENT_FINGERPRINT);
-	return fingerprints;
-};
-const buildScanResultCacheKey = (input) => {
-	if (isCacheGloballyDisabled()) return null;
-	if (!isGitIdentityTrustworthy(input.projectDirectory)) return null;
-	const repositoryIdentity = resolveRepositoryCacheIdentity(input.projectDirectory, input.invocationState);
-	if (repositoryIdentity === null) return null;
-	if (stringifyStableJson(input.userConfig) === null) return null;
-	const cacheKeyJson = stringifyStableJson({
-		schemaVersion: 7,
-		projectIdentity: resolveProjectIdentity(input.projectDirectory),
-		headSha: repositoryIdentity.headSha,
-		worktreeFingerprint: repositoryIdentity.worktreeFingerprint,
-		dotenvFingerprint: resolveDotenvFingerprint(input.projectDirectory),
-		reactDoctorVersion: input.version,
-		nodeVersion: process.version,
-		toolchainFingerprint: resolveScanResultToolchainFingerprint(input.nodeBinaryPath),
-		configFingerprint: computeConfigFingerprint(input.projectDirectory, input.version),
-		hasConfigOverride: input.hasConfigOverride,
-		configSourceDirectory: input.configSourceDirectory,
-		userConfig: input.userConfig,
-		engineOptions: {
-			lint: input.options.lint,
-			deadCode: input.options.deadCode,
-			supplyChain: input.options.supplyChain,
-			includePaths: [...input.options.includePaths].sort(),
-			excludedProjectDirectories: [...input.options.excludedProjectDirectories ?? []].sort(),
-			retainExcludedProjectDeadCodeDiagnostics: input.options.retainExcludedProjectDeadCodeDiagnostics ?? false,
-			customRulesOnly: input.options.customRulesOnly,
-			respectInlineDisables: input.options.respectInlineDisables,
-			warnings: input.options.warnings,
-			adoptExistingLintConfig: input.options.adoptExistingLintConfig,
-			ignoredTags: [...input.options.ignoredTags].sort(),
-			includedTags: [...input.options.includedTags].sort(),
-			includeTagDefaults: input.options.includeTagDefaults,
-			concurrency: input.options.concurrency,
-			lintBatchOrdering: resolveLintBatchOrdering(),
-			baselineRef: input.options.baseline?.ref,
-			changedLineRanges: input.options.changedLineRanges ?? void 0,
-			noScore: input.options.noScore,
-			isCi: input.options.isCi,
-			suppressRendering: input.options.suppressRendering,
-			supplyChainManifestChanged: input.options.supplyChainManifestChanged
-		}
-	});
-	return cacheKeyJson === null ? null : hashString(cacheKeyJson);
-};
-const createScanResultCache = (projectDirectory) => {
-	const cacheFilePath = resolveCacheFilePath(projectDirectory);
-	const persistedCache = readPersistedCache(cacheFilePath);
-	const entries = /* @__PURE__ */ new Map();
-	for (const entry of persistedCache.entries) entries.set(entry.key, entry);
-	const persist = () => {
-		const mergedEntries = /* @__PURE__ */ new Map();
-		for (const entry of readPersistedCache(cacheFilePath).entries) mergedEntries.set(entry.key, entry);
-		for (const entry of entries.values()) mergedEntries.set(entry.key, entry);
-		atomicWriteJson(cacheFilePath, {
-			version: 7,
-			entries: [...mergedEntries.values()].sort((firstEntry, secondEntry) => secondEntry.createdAtMs - firstEntry.createdAtMs).slice(0, 20)
-		});
-	};
-	return {
-		lookup: (key) => {
-			const payload = entries.get(key)?.payload;
-			if (payload === void 0) return null;
-			return resolveProjectIdentity(payload.directory) === resolveProjectIdentity(projectDirectory) && (payload.manifestContentHash ?? null) === resolveManifestContentHash(projectDirectory) ? payload : null;
-		},
-		store: (key, payload) => {
-			entries.set(key, {
-				key,
-				createdAtMs: Date.now(),
-				payload: {
-					...payload,
-					manifestContentHash: resolveManifestContentHash(projectDirectory)
-				}
-			});
-			persist();
-		}
-	};
+		for (const [key, value] of Object.entries(buildRunEventAttributes(input))) rootSpan.attribute(key, value);
+	} catch {}
 };
 //#endregion
-//#region src/cli/utils/should-block-ci.ts
-const shouldBlockCi = (diagnostics, blockingLevel) => {
-	if (blockingLevel === "none") return false;
-	if (blockingLevel === "warning") return diagnostics.length > 0;
-	return diagnostics.some((diagnostic) => diagnostic.severity === "error");
+//#region src/cli/utils/diagnostic-intersects-line-ranges.ts
+const diagnosticIntersectsLineRanges = (diagnostic, lineRanges) => {
+	const diagnosticEndLine = Math.max(diagnostic.line, diagnostic.endLine ?? diagnostic.line);
+	return lineRanges.some(([rangeStartLine, rangeEndLine]) => diagnostic.line <= rangeEndLine && diagnosticEndLine >= rangeStartLine);
 };
 //#endregion
-//#region src/cli/utils/to-category-key.ts
-/**
-* Lowercase, key-safe form of a rule category for the `diag.category.*`
-* telemetry attribute namespace (categories carry spaces / capitals, e.g.
-* "Performance" → `performance`, "Dead Code" → `dead_code`).
-*/
-const toCategoryKey = (category) => category.toLowerCase().replace(/[^a-z0-9]+/g, "_");
-//#endregion
-//#region src/cli/utils/with-namespace.ts
-/**
-* Prefixes every key in a flat attribute group with `namespace.`, so a logical
-* group (scan config, diagnostics rollup, score, …) carries one dotted
-* namespace applied in a single place rather than hand-spelled into each key —
-* which is how the wide event drifted into a flat, half-namespaced soup. The
-* dotted prefix is what makes the attributes tree up in Sentry's attribute
-* browser and stay group-/filter-/aggregate-able in the Spans dataset.
-*
-* Value types are preserved verbatim (numbers stay numbers so Sentry infers a
-* numeric attribute and `p75(...)`/`avg(...)` work; `null`/`undefined` are kept
-* so `toSpanAttributes` can drop absent signals rather than coerce them).
-*/
-const withNamespace = (namespace, attributes) => {
-	const namespaced = {};
-	for (const [key, value] of Object.entries(attributes)) namespaced[`${namespace}.${key}`] = value;
-	return namespaced;
+//#region src/cli/utils/filter-diagnostics-by-changed-lines.ts
+const filterDiagnosticsByChangedLines = (input) => {
+	const rangesByFile = /* @__PURE__ */ new Map();
+	for (const entry of input.changedLineRanges) rangesByFile.set(toForwardSlashes(entry.file), entry.ranges);
+	return input.diagnostics.filter((diagnostic) => {
+		const relativePath = toForwardSlashes(path.isAbsolute(diagnostic.filePath) ? path.relative(input.directory, diagnostic.filePath) : diagnostic.filePath);
+		const ranges = rangesByFile.get(relativePath);
+		return ranges !== void 0 && diagnosticIntersectsLineRanges(diagnostic, ranges);
+	});
 };
 //#endregion
-//#region src/cli/utils/build-run-event.ts
-const readEnvBoolean = (name) => {
-	const value = process.env[name];
-	if (value === void 0) return null;
-	return value.toLowerCase() === "true" || value === "1";
-};
-const ratioOf = (numerator, denominator) => denominator != null && denominator > 0 ? (numerator ?? 0) / denominator : null;
+//#region src/cli/utils/resolve-invocation-oxlint-concurrency.ts
 /**
-* One queryable cache temperature per scan, derived from the whole stack:
-*
-*   - `"turbo"`    — whole-repo scan-result replay (the explicit
-*                    `wholeRepoCacheHit` flag from the CLI's cachedPayload
-*                    branch; no scan work ran).
-*   - `"warm"`     — any incremental reuse: per-file lint hits, sidecar
-*                    replays.
-*   - `"disabled"` — zero reuse because the global `REACT_DOCTOR_NO_CACHE`
-*                    off-switch is on. Granular per-cache opt-outs
-*                    (`REACT_DOCTOR_NO_FILE_CACHE`, …) still read warm/cold,
-*                    since the other subsystems stay live.
-*   - `"cold"`     — caches on, zero reuse (first scan / everything changed).
-*
-* `cache.warmth` is the headline reuse magnitude in [0, 1]: the plain mean of
-* the subsystem reuse fractions known this run (lint hit ratio, sidecar
-* replay ratio), skipping subsystems that never consulted a
-* cache; `1` on turbo, dropped when nothing consulted any cache. Deliberately
-* unweighted — the per-subsystem dims stay the precise signal; warmth is the
-* p50/p90-able summary. Emitted only on the success path.
+* The invocation-wide oxlint worker count: an explicit `--concurrency` pin
+* when given, else the env-seeded / auto-budgeted `OxlintConcurrency`, clamped
+* to the spawn ceiling. Every project of a workspace scan shares this one
+* pool, so it also sizes how many projects may be in flight at once.
 */
-const buildCacheAttributes = (input) => {
-	if (input.result === void 0) return {};
-	if (input.wholeRepoCacheHit) return withNamespace("cache", {
-		wholeRepoHit: true,
-		temperature: "turbo",
-		warmth: 1
-	});
-	const result = input.result;
-	const subsystemReuseRatios = [ratioOf(result.lintCacheHitFileCount, result.lintCacheTotalFileCount), ratioOf(result.lintSidecarReplayedFileCount, result.lintSidecarTotalFileCount)];
-	let knownSubsystemCount = 0;
-	let reuseRatioSum = 0;
-	for (const reuseRatio of subsystemReuseRatios) {
-		if (reuseRatio === null) continue;
-		knownSubsystemCount += 1;
-		reuseRatioSum += reuseRatio;
-	}
-	const warmth = knownSubsystemCount > 0 ? reuseRatioSum / knownSubsystemCount : null;
-	const temperature = warmth !== null && warmth > 0 ? "warm" : isCacheGloballyDisabled() ? "disabled" : "cold";
-	return withNamespace("cache", {
-		wholeRepoHit: input.wholeRepoCacheHit,
-		temperature,
-		warmth
-	});
-};
-const resolveVersionPin = (versionInput) => {
-	if (versionInput === void 0 || versionInput.trim() === "") return null;
-	if (versionInput === "latest") return "latest";
-	if (/^(\.\.?\/|\/)/.test(versionInput)) return "local";
-	return "pinned";
-};
-const resolveTelemetryBlocking = (userConfig) => {
-	const fromAction = process.env[ACTION_INPUT_ENVIRONMENT_VARIABLES.blocking];
-	if (fromAction !== void 0 && isValidBlockingLevel(fromAction)) return fromAction;
-	return userConfig?.blocking ?? userConfig?.failOn ?? "error";
-};
-const buildOutcomeAttributes = (input) => {
-	if (input.result === void 0) {
-		const error = input.error;
-		const known = isReactDoctorError(error);
-		return withNamespace("outcome", {
-			status: "error",
-			exitCode: 1,
-			complete: false,
-			knownError: known,
-			errorTag: known ? error.reason._tag : error instanceof Error ? error.name : null
-		});
-	}
-	const result = input.result;
-	const summary = summarizeDiagnostics(result.diagnostics);
-	const blockingLevel = resolveTelemetryBlocking(input.userConfig);
-	const gateDiagnostics = filterDiagnosticsForSurface(result.diagnostics, "ciFailure", input.userConfig);
-	const gateDiagnosticSet = new Set(gateDiagnostics);
-	const complete = isInspectResultComplete(result);
-	const didLintHardFail = hasLintHardFailure(result);
-	const failsOnHardFailure = didLintHardFail && blockingLevel !== "none";
-	const wouldBlock = !input.scoreOnly && !input.gateExempt && shouldBlockCi(gateDiagnostics, blockingLevel);
-	const isClean = result.diagnostics.length === 0 && complete;
-	const outcome = didLintHardFail ? "error" : wouldBlock ? "blocked" : isClean ? "clean" : "ok";
-	const firings = summarizeRuleFirings(result.diagnostics);
-	const countByRule = /* @__PURE__ */ new Map();
-	const countByCategory = /* @__PURE__ */ new Map();
-	for (const firing of firings) {
-		countByRule.set(firing.rule, (countByRule.get(firing.rule) ?? 0) + firing.count);
-		countByCategory.set(firing.category, (countByCategory.get(firing.category) ?? 0) + firing.count);
-	}
-	let topRule = null;
-	let topRuleCount = 0;
-	for (const [rule, count] of countByRule) if (count > topRuleCount) {
-		topRule = rule;
-		topRuleCount = count;
-	}
-	const largestRuleBucket = buildRuleBlastRadii(result.diagnostics)[0] ?? null;
-	let diagnosticsInTestFiles = 0;
-	let diagnosticsInStoryFiles = 0;
-	let nonProductionGateExcluded = 0;
-	const diagnosticSiteCounts = /* @__PURE__ */ new Map();
-	const findingsPerFixGroup = /* @__PURE__ */ new Map();
-	for (const diagnostic of result.diagnostics) {
-		if (diagnostic.fileContext === "test") diagnosticsInTestFiles += 1;
-		if (diagnostic.fileContext === "story") diagnosticsInStoryFiles += 1;
-		if (diagnostic.fileContext !== void 0 && !gateDiagnosticSet.has(diagnostic)) nonProductionGateExcluded += 1;
-		const diagnosticSite = JSON.stringify([
-			diagnostic.filePath,
-			diagnostic.line,
-			diagnostic.column,
-			diagnostic.plugin,
-			diagnostic.rule
-		]);
-		diagnosticSiteCounts.set(diagnosticSite, (diagnosticSiteCounts.get(diagnosticSite) ?? 0) + 1);
-		if (diagnostic.fixGroupId) findingsPerFixGroup.set(diagnostic.fixGroupId, (findingsPerFixGroup.get(diagnostic.fixGroupId) ?? 0) + 1);
-	}
-	let fixGroupedFindings = 0;
-	for (const count of findingsPerFixGroup.values()) fixGroupedFindings += count;
-	let sameSiteOccurrences = 0;
-	for (const count of diagnosticSiteCounts.values()) sameSiteOccurrences += Math.max(0, count - 1);
-	const categoryRollup = {};
-	for (const [category, count] of countByCategory) categoryRollup[`category.${toCategoryKey(category)}`] = count;
-	const suppressionRollup = {};
-	if (input.suppressedRuleCounts) {
-		const countBySource = {
-			config: 0,
-			override: 0,
-			inline: 0,
-			"foreign-inline": 0
-		};
-		for (const suppression of input.suppressedRuleCounts) countBySource[suppression.source] += suppression.count;
-		suppressionRollup.suppressed = countBySource.config + countBySource.override + countBySource.inline + countBySource["foreign-inline"];
-		suppressionRollup.suppressedConfig = countBySource.config;
-		suppressionRollup.suppressedOverride = countBySource.override;
-		suppressionRollup.suppressedInline = countBySource.inline;
-		suppressionRollup.suppressedForeignInline = countBySource["foreign-inline"];
-	}
-	const attributes = {
-		...withNamespace("outcome", {
-			status: outcome,
-			exitCode: failsOnHardFailure || wouldBlock ? 1 : 0,
-			wouldBlock,
-			blocking: blockingLevel,
-			clean: isClean,
-			complete,
-			skippedChecks: result.skippedChecks.length
-		}),
-		...withNamespace("diag", {
-			total: summary.totalDiagnosticCount,
-			errors: summary.errorCount,
-			warnings: summary.warningCount,
-			affectedFiles: summary.affectedFileCount,
-			inTestFiles: diagnosticsInTestFiles,
-			inStoryFiles: diagnosticsInStoryFiles,
-			nonProductionGateExcluded,
-			distinctRules: countByRule.size,
-			topRule,
-			sameSiteOccurrences,
-			fixGroups: findingsPerFixGroup.size,
-			fixGroupedFindings,
-			...categoryRollup,
-			...suppressionRollup
-		}),
-		...withNamespace("score", {
-			value: result.score ? result.score.score : null,
-			label: result.score ? result.score.label : null,
-			available: result.score !== null,
-			unavailableReason: result.score === null ? resolveScoreUnavailableReason({
-				isScoreDisabled: input.noScore,
-				isAnalysisIncomplete: input.didLintFail === true || input.didDeadCodeFail === true
-			}) : null
-		}),
-		...withNamespace("lint", {
-			failed: input.didLintFail,
-			failureReasonKind: input.lintFailureReasonKind,
-			partialFailureCount: input.lintPartialFailureCount,
-			droppedFileCount: input.lintDroppedFileCount,
-			deadlineSkippedFileCount: input.lintDeadlineSkippedFileCount,
-			cacheHitFiles: result.lintCacheHitFileCount,
-			cacheTotalFiles: result.lintCacheTotalFileCount,
-			cacheHitRatio: ratioOf(result.lintCacheHitFileCount, result.lintCacheTotalFileCount),
-			sidecarReplayedFiles: result.lintSidecarReplayedFileCount,
-			sidecarTotalFiles: result.lintSidecarTotalFileCount,
-			sidecarReplayRatio: ratioOf(result.lintSidecarReplayedFileCount, result.lintSidecarTotalFileCount)
-		}),
-		...withNamespace("maintainability", { failed: input.didDeadCodeFail }),
-		...withNamespace("supplyChain", { overlapTimedOut: input.supplyChainOverlapTimedOut }),
-		...withNamespace("securityScan", { failed: input.securityScanFailed }),
-		...withNamespace("timing", {
-			elapsedMs: result.elapsedMilliseconds,
-			scanMs: result.scanElapsedMilliseconds
-		}),
-		...withNamespace("migration", {
-			largestRuleBucketFiles: largestRuleBucket ? largestRuleBucket.fileCount : null,
-			largestRuleBucketSites: largestRuleBucket ? largestRuleBucket.siteCount : null,
-			largestRuleBucketRule: largestRuleBucket ? largestRuleBucket.ruleKey : null
-		})
-	};
-	if (result.baselineDelta) Object.assign(attributes, withNamespace("baseline", {
-		new: summary.totalDiagnosticCount,
-		fixed: result.baselineDelta.fixedCount,
-		baseTotal: result.baselineDelta.baseTotalCount,
-		crossFileMatches: result.baselineDelta.crossFileMatchCount,
-		degraded: false
-	}));
-	else if (input.gateExempt) attributes["baseline.degraded"] = true;
-	return attributes;
-};
-const buildActionAttributes = () => {
-	const { githubActorAssociation } = resolveGithubActionsScoreMetadata();
-	return withNamespace("action", {
-		actorAssociation: githubActorAssociation,
-		runnerOs: detectRunnerOs(),
-		comment: readEnvBoolean(ACTION_INPUT_ENVIRONMENT_VARIABLES.comment),
-		reviewComments: readEnvBoolean(ACTION_INPUT_ENVIRONMENT_VARIABLES.reviewComments),
-		versionPin: resolveVersionPin(process.env[ACTION_INPUT_ENVIRONMENT_VARIABLES.version])
-	});
-};
-const buildScanAttributes = (input) => {
-	const ruleOverrides = input.userConfig?.rules ?? {};
-	const ruleKeys = Object.keys(ruleOverrides);
-	return withNamespace("scan", {
-		mode: input.mode,
-		scope: input.scope,
-		parallel: input.parallel,
-		workerCount: input.workerCount,
-		maxDurationMs: input.maxDurationMs,
-		lint: input.lint,
-		maintainability: input.deadCode,
-		supplyChain: input.supplyChain,
-		scoreOnly: input.scoreOnly,
-		noScore: input.noScore,
-		respectInlineDisables: input.respectInlineDisables,
-		showWarnings: input.showWarnings,
-		usedOutputDir: input.usedOutputDir,
-		ignoredTagCount: input.ignoredTagCount,
-		hasCustomConfig: input.hasCustomConfig,
-		rulesConfigured: ruleKeys.length,
-		rulesDisabled: ruleKeys.filter((key) => ruleOverrides[key] === "off").length,
-		projectAnalysisRuleCount: countOptInProjectRuleSelections(buildRuleSeverityControls(input.userConfig)),
-		fileCount: input.result?.scannedFileCount,
-		nonJsxFileCount: input.result?.analyzedFiles?.filter((filePath) => !JSX_FILE_PATTERN.test(filePath)).length,
-		htmlFileCount: input.result?.analyzedFiles?.filter((filePath) => HTML_FILE_PATTERN.test(filePath)).length,
-		multilineDiagnosticCount: input.result?.diagnostics.filter((diagnostic) => (diagnostic.endLine ?? diagnostic.line) > diagnostic.line).length
-	});
-};
-/**
-* Projects a scan into the namespaced attribute set for its root span — the
-* canonical per-scan "wide event". Every attribute carries a dotted namespace
-* that groups it by concept (`scan.*` config, `action.*` CI knobs, `outcome.*`
-* verdict, `diag.*` findings, `score.*`, `lint.*`, `maintainability.*`, `cache.*`,
-* `supplyChain.*`, `timing.*`, `migration.*`, `baseline.*`) so the attributes
-* tree up in Sentry's attribute browser and stay filter-/group-/aggregate-able
-* in the Spans dataset. Pure and exported so the projection (outcome
-* precedence, rule/category rollups, CI knobs, config shape) is unit-testable
-* without a live Sentry client. `null`/`undefined` values are dropped so absent
-* signals never become misleading `"null"`/`"undefined"` attributes. The run +
-* project base context (version, command, ci/provider, framework, …) is already
-* on the span from `withSentryRunSpan` / `recordSentryProjectContext`, so this
-* adds only what those don't carry.
-*/
-const buildRunEventAttributes = (input) => toSpanAttributes({
-	...buildScanAttributes(input),
-	...buildActionAttributes(),
-	...buildOutcomeAttributes(input),
-	...buildCacheAttributes(input)
-});
-/**
-* Stamps the wide-event attributes onto the run's root span. A guarded no-op
-* when tracing is off (no `rootSpan`) and swallow-on-throw, so telemetry can
-* never break the run.
-*/
-const recordRunEvent = (rootSpan, input) => {
-	if (!rootSpan) return;
-	try {
-		for (const [key, value] of Object.entries(buildRunEventAttributes(input))) rootSpan.attribute(key, value);
-	} catch {}
-};
-//#endregion
-//#region src/cli/utils/diagnostic-intersects-line-ranges.ts
-const diagnosticIntersectsLineRanges = (diagnostic, lineRanges) => {
-	const diagnosticEndLine = Math.max(diagnostic.line, diagnostic.endLine ?? diagnostic.line);
-	return lineRanges.some(([rangeStartLine, rangeEndLine]) => diagnostic.line <= rangeEndLine && diagnosticEndLine >= rangeStartLine);
-};
-//#endregion
-//#region src/cli/utils/filter-diagnostics-by-changed-lines.ts
-const filterDiagnosticsByChangedLines = (input) => {
-	const rangesByFile = /* @__PURE__ */ new Map();
-	for (const entry of input.changedLineRanges) rangesByFile.set(toForwardSlashes(entry.file), entry.ranges);
-	return input.diagnostics.filter((diagnostic) => {
-		const relativePath = toForwardSlashes(path.isAbsolute(diagnostic.filePath) ? path.relative(input.directory, diagnostic.filePath) : diagnostic.filePath);
-		const ranges = rangesByFile.get(relativePath);
-		return ranges !== void 0 && diagnosticIntersectsLineRanges(diagnostic, ranges);
-	});
-};
+const resolveInvocationOxlintConcurrency = (requestedConcurrency) => resolveScanConcurrency(requestedConcurrency ?? runSync(OxlintConcurrency));
 //#endregion
 //#region src/cli/utils/resolve-oxlint-node.ts
 const consoleWarn = (message) => warn(highlighter.warn(message));
@@ -1138,7 +726,8 @@ const resolveInspectOptions = (inputOptions, userConfig) => {
 		supplyChainManifestChanged: inputOptions.supplyChainManifestChanged ?? false,
 		excludedProjectDirectories: inputOptions.excludedProjectDirectories ?? [],
 		retainExcludedProjectDeadCodeDiagnostics: inputOptions.retainExcludedProjectDeadCodeDiagnostics ?? false,
-		precomputedSourceFileCount: inputOptions.precomputedSourceFileCount
+		precomputedSourceFileCount: inputOptions.precomputedSourceFileCount,
+		precomputedSourceFiles: inputOptions.precomputedSourceFiles
 	};
 };
 //#endregion
@@ -1605,575 +1194,1019 @@ const copyUnchangedBaselineSources = async (input) => {
 	})).every(Boolean);
 };
 //#endregion
-//#region src/cli/utils/read-diagnostic-evidence.ts
-const SOURCE_EXTENSIONS = [
-	".ts",
-	".tsx",
-	".js",
-	".jsx",
-	".mts",
-	".cts",
-	".mjs",
-	".cjs"
+//#region src/cli/utils/read-diagnostic-evidence.ts
+const SOURCE_EXTENSIONS = [
+	".ts",
+	".tsx",
+	".js",
+	".jsx",
+	".mts",
+	".cts",
+	".mjs",
+	".cjs"
+];
+const COMPONENT_WRAPPER_NAMES = new Set(["memo", "forwardRef"]);
+const getScriptKind = (filePath) => {
+	const extension = path.extname(filePath).toLowerCase();
+	if (extension === ".tsx") return typescriptBinding.ScriptKind.TSX;
+	if (extension === ".jsx") return typescriptBinding.ScriptKind.JSX;
+	if (extension === ".js" || extension === ".mjs" || extension === ".cjs") return typescriptBinding.ScriptKind.JS;
+	return typescriptBinding.ScriptKind.TS;
+};
+const resolveSafeSourcePath = (rootDirectory, filePath) => {
+	try {
+		const resolvedRootDirectory = fs.realpathSync(rootDirectory);
+		const absolutePath = path.resolve(resolvedRootDirectory, filePath);
+		const relativePath = path.relative(resolvedRootDirectory, absolutePath);
+		if (relativePath.length === 0 || relativePath === ".." || relativePath.startsWith(`..${path.sep}`) || path.isAbsolute(relativePath)) return null;
+		const stats = fs.lstatSync(absolutePath);
+		if (!stats.isFile() || stats.isSymbolicLink()) return null;
+		const realPath = fs.realpathSync(absolutePath);
+		const realRelativePath = path.relative(resolvedRootDirectory, realPath);
+		return realRelativePath !== ".." && !realRelativePath.startsWith(`..${path.sep}`) && !path.isAbsolute(realRelativePath) ? realPath : null;
+	} catch {
+		return null;
+	}
+};
+const readSourceRecord = (rootDirectory, filePath, state) => {
+	const normalizedFilePath = filePath.replace(/\\/g, "/");
+	if (state.recordByFilePath.has(normalizedFilePath)) return state.recordByFilePath.get(normalizedFilePath) ?? null;
+	const absolutePath = resolveSafeSourcePath(rootDirectory, normalizedFilePath);
+	if (absolutePath === null) {
+		state.recordByFilePath.set(normalizedFilePath, null);
+		return null;
+	}
+	try {
+		const sourceText = fs.readFileSync(absolutePath, "utf-8");
+		const record = {
+			absolutePath,
+			filePath: normalizedFilePath,
+			sourceFile: typescriptBinding.createSourceFile(absolutePath, sourceText, typescriptBinding.ScriptTarget.Latest, true, getScriptKind(absolutePath)),
+			sourceText
+		};
+		state.recordByFilePath.set(normalizedFilePath, record);
+		return record;
+	} catch {
+		state.recordByFilePath.set(normalizedFilePath, null);
+		return null;
+	}
+};
+const listSourceRecords = (rootDirectory, state) => {
+	if (state.sourceRecords !== null) return state.sourceRecords;
+	state.sourceRecords = listSourceFiles(rootDirectory).flatMap((filePath) => {
+		const record = readSourceRecord(rootDirectory, filePath, state);
+		return record === null ? [] : [record];
+	});
+	return state.sourceRecords;
+};
+const unwrapExpression = (expression) => {
+	let currentExpression = expression;
+	while (typescriptBinding.isParenthesizedExpression(currentExpression) || typescriptBinding.isAsExpression(currentExpression) || typescriptBinding.isTypeAssertionExpression(currentExpression) || typescriptBinding.isNonNullExpression(currentExpression) || typescriptBinding.isSatisfiesExpression(currentExpression)) currentExpression = currentExpression.expression;
+	return currentExpression;
+};
+const getCalleeName = (expression) => {
+	const unwrappedExpression = unwrapExpression(expression);
+	if (typescriptBinding.isIdentifier(unwrappedExpression)) return unwrappedExpression.text;
+	if (typescriptBinding.isPropertyAccessExpression(unwrappedExpression)) return unwrappedExpression.name.text;
+	return null;
+};
+const isComponentWrapperCall = (node) => {
+	const wrapperName = getCalleeName(node.expression);
+	return wrapperName !== null && COMPONENT_WRAPPER_NAMES.has(wrapperName);
+};
+const getFunctionName = (node) => {
+	if (typescriptBinding.isFunctionDeclaration(node) && node.name !== void 0) return node.name.text;
+	if (typescriptBinding.isArrowFunction(node) || typescriptBinding.isFunctionExpression(node)) {
+		let componentExpression = node;
+		while (true) {
+			const parent = componentExpression.parent;
+			if (typescriptBinding.isParenthesizedExpression(parent) || typescriptBinding.isAsExpression(parent) || typescriptBinding.isTypeAssertionExpression(parent) || typescriptBinding.isNonNullExpression(parent) || typescriptBinding.isSatisfiesExpression(parent)) {
+				componentExpression = parent;
+				continue;
+			}
+			if (typescriptBinding.isCallExpression(parent) && parent.arguments[0] === componentExpression && isComponentWrapperCall(parent)) {
+				componentExpression = parent;
+				continue;
+			}
+			if (typescriptBinding.isVariableDeclaration(parent) && typescriptBinding.isIdentifier(parent.name)) return parent.name.text;
+			return node.name?.text ?? null;
+		}
+	}
+	return null;
+};
+const isComponentFunction = (node) => typescriptBinding.isFunctionDeclaration(node) || typescriptBinding.isFunctionExpression(node) || typescriptBinding.isArrowFunction(node);
+const isDefaultExportedComponent = (record, node, componentName) => {
+	if (typescriptBinding.canHaveModifiers(node) && typescriptBinding.getModifiers(node)?.some((modifier) => modifier.kind === typescriptBinding.SyntaxKind.DefaultKeyword)) return true;
+	return record.sourceFile.statements.some((statement) => typescriptBinding.isExportAssignment(statement) && typescriptBinding.isIdentifier(statement.expression) && statement.expression.text === componentName);
+};
+const findEnclosingComponent = (record, diagnostic) => {
+	if (!Number.isInteger(diagnostic.line) || diagnostic.line < 1) return null;
+	const lineIndex = diagnostic.line - 1;
+	const lineStarts = record.sourceFile.getLineStarts();
+	const lineStart = lineStarts[lineIndex];
+	if (lineStart === void 0) return null;
+	const nextLineStart = lineStarts[lineIndex + 1] ?? record.sourceFile.end;
+	const lineEnd = Math.max(lineStart, nextLineStart - 1);
+	const columnIndex = Number.isInteger(diagnostic.column) ? Math.max(0, diagnostic.column - 1) : 0;
+	const diagnosticPosition = Math.min(lineStart + columnIndex, lineEnd);
+	let component = null;
+	let componentWidth = Number.POSITIVE_INFINITY;
+	const visit = (node) => {
+		if (diagnosticPosition < node.getStart(record.sourceFile) || diagnosticPosition > node.end) return;
+		if (isComponentFunction(node)) {
+			const name = getFunctionName(node);
+			const width = node.end - node.getStart(record.sourceFile);
+			if (name !== null && /^[A-Z]/.test(name) && width < componentWidth) {
+				component = {
+					isDefaultExport: isDefaultExportedComponent(record, node, name),
+					name,
+					node,
+					record
+				};
+				componentWidth = width;
+			}
+		}
+		typescriptBinding.forEachChild(node, visit);
+	};
+	visit(record.sourceFile);
+	return component;
+};
+const moduleSpecifierTargetsComponent = (callerRecord, moduleSpecifier, componentRecord) => {
+	if (!moduleSpecifier.startsWith(".")) return false;
+	const unresolvedPath = path.resolve(path.dirname(callerRecord.absolutePath), moduleSpecifier);
+	const specifiedExtension = path.extname(unresolvedPath).toLowerCase();
+	const sourcePathWithoutExtension = SOURCE_EXTENSIONS.includes(specifiedExtension) ? unresolvedPath.slice(0, -specifiedExtension.length) : unresolvedPath;
+	return [
+		unresolvedPath,
+		...SOURCE_EXTENSIONS.map((extension) => `${sourcePathWithoutExtension}${extension}`),
+		...sourcePathWithoutExtension === unresolvedPath ? SOURCE_EXTENSIONS.map((extension) => path.join(unresolvedPath, `index${extension}`)) : []
+	].includes(componentRecord.absolutePath);
+};
+const getComponentTagNames = (record, component) => {
+	if (record.absolutePath === component.record.absolutePath) return new Set([component.name]);
+	const tagNames = /* @__PURE__ */ new Set();
+	for (const statement of record.sourceFile.statements) {
+		if (!typescriptBinding.isImportDeclaration(statement) || !typescriptBinding.isStringLiteral(statement.moduleSpecifier) || !moduleSpecifierTargetsComponent(record, statement.moduleSpecifier.text, component.record)) continue;
+		const importClause = statement.importClause;
+		if (component.isDefaultExport && importClause?.name !== void 0) tagNames.add(importClause.name.text);
+		const namedBindings = importClause?.namedBindings;
+		if (namedBindings !== void 0 && typescriptBinding.isNamedImports(namedBindings)) {
+			for (const element of namedBindings.elements) if ((element.propertyName?.text ?? element.name.text) === component.name) tagNames.add(element.name.text);
+		}
+	}
+	return tagNames;
+};
+const getTransparentCall = (functionNode) => {
+	if (functionNode.body === void 0) return null;
+	if (!typescriptBinding.isBlock(functionNode.body)) {
+		const expression = unwrapExpression(functionNode.body);
+		return typescriptBinding.isCallExpression(expression) ? expression : null;
+	}
+	if (functionNode.body.statements.length !== 1) return null;
+	const statement = functionNode.body.statements[0];
+	if (statement === void 0) return null;
+	const expression = typescriptBinding.isExpressionStatement(statement) || typescriptBinding.isReturnStatement(statement) ? statement.expression : void 0;
+	if (expression === void 0) return null;
+	const unwrappedExpression = unwrapExpression(expression);
+	return typescriptBinding.isCallExpression(unwrappedExpression) ? unwrappedExpression : null;
+};
+const resolveTransparentTarget = (functionNode) => {
+	const call = getTransparentCall(functionNode);
+	if (call === null) return null;
+	const target = unwrapExpression(call.expression);
+	if (!typescriptBinding.isIdentifier(target) || call.arguments.length !== functionNode.parameters.length) return null;
+	for (const [parameterIndex, parameter] of functionNode.parameters.entries()) {
+		const argument = call.arguments[parameterIndex];
+		const unwrappedArgument = argument === void 0 ? null : unwrapExpression(argument);
+		if (!typescriptBinding.isIdentifier(parameter.name) || unwrappedArgument === null || !typescriptBinding.isIdentifier(unwrappedArgument) || unwrappedArgument.text !== parameter.name.text) return null;
+	}
+	return target.text;
+};
+const getForwardingFunction = (declaration) => {
+	if (typescriptBinding.isFunctionDeclaration(declaration)) return declaration;
+	if (!typescriptBinding.isVariableDeclaration(declaration) || declaration.initializer === void 0) return null;
+	const initializer = unwrapExpression(declaration.initializer);
+	if (typescriptBinding.isArrowFunction(initializer) || typescriptBinding.isFunctionExpression(initializer)) return initializer;
+	if (typescriptBinding.isCallExpression(initializer) && getCalleeName(initializer.expression) === "useCallback") {
+		const callback = initializer.arguments[0];
+		if (callback !== void 0 && (typescriptBinding.isArrowFunction(callback) || typescriptBinding.isFunctionExpression(callback))) return callback;
+	}
+	return null;
+};
+const getDeclaredBindingName = (node) => {
+	if ((typescriptBinding.isVariableDeclaration(node) || typescriptBinding.isParameter(node) || typescriptBinding.isBindingElement(node) || typescriptBinding.isFunctionDeclaration(node)) && node.name !== void 0 && typescriptBinding.isIdentifier(node.name)) return node.name.text;
+	if (typescriptBinding.isImportClause(node)) return node.name?.text ?? null;
+	if (typescriptBinding.isImportSpecifier(node) || typescriptBinding.isNamespaceImport(node)) return node.name.text;
+	return null;
+};
+const findBindingScope = (node) => {
+	let currentNode = node;
+	while (currentNode !== void 0) {
+		if (typescriptBinding.isParameter(currentNode) && typescriptBinding.isFunctionLike(currentNode.parent)) return currentNode.parent;
+		if (typescriptBinding.isBlock(currentNode) || typescriptBinding.isModuleBlock(currentNode) || typescriptBinding.isSourceFile(currentNode)) return currentNode;
+		currentNode = currentNode.parent;
+	}
+	return node.getSourceFile();
+};
+const findBindingDeclaration = (record, binding) => {
+	const usagePosition = binding.getStart(record.sourceFile);
+	const candidates = [];
+	const visit = (node) => {
+		if (getDeclaredBindingName(node) === binding.text) {
+			const scope = findBindingScope(node);
+			const isVisibleScope = usagePosition >= scope.getStart(record.sourceFile) && usagePosition <= scope.end;
+			const isVisibleDeclaration = typescriptBinding.isFunctionDeclaration(node) || typescriptBinding.isParameter(node) || typescriptBinding.isBindingElement(node) || typescriptBinding.isImportClause(node) || typescriptBinding.isImportSpecifier(node) || typescriptBinding.isNamespaceImport(node) || node.getStart(record.sourceFile) < usagePosition;
+			if (isVisibleScope && isVisibleDeclaration) candidates.push({
+				declaration: node,
+				scope
+			});
+		}
+		typescriptBinding.forEachChild(node, visit);
+	};
+	visit(record.sourceFile);
+	let nearestCandidate = null;
+	let nearestScopeWidth = Number.POSITIVE_INFINITY;
+	let isNearestScopeAmbiguous = false;
+	for (const candidate of candidates) {
+		const scopeWidth = candidate.scope.end - candidate.scope.getStart(record.sourceFile);
+		if (scopeWidth < nearestScopeWidth) {
+			nearestCandidate = candidate;
+			nearestScopeWidth = scopeWidth;
+			isNearestScopeAmbiguous = false;
+		} else if (scopeWidth === nearestScopeWidth) isNearestScopeAmbiguous = true;
+	}
+	if (isNearestScopeAmbiguous) return null;
+	const declaration = nearestCandidate?.declaration;
+	return declaration !== void 0 && (typescriptBinding.isVariableDeclaration(declaration) || typescriptBinding.isFunctionDeclaration(declaration)) ? declaration : null;
+};
+const resolveHandlerBinding = (record, binding) => {
+	const declaration = findBindingDeclaration(record, binding);
+	if (declaration === null) return binding.text;
+	const forwardingFunction = getForwardingFunction(declaration);
+	const target = forwardingFunction === null ? null : resolveTransparentTarget(forwardingFunction);
+	return target === null || target === binding.text ? binding.text : target;
+};
+const getJsxTagName = (node) => typescriptBinding.isIdentifier(node.tagName) ? node.tagName.text : null;
+const getHandlerBinding = (node, propName) => {
+	for (const property of node.attributes.properties) {
+		if (!typescriptBinding.isJsxAttribute(property) || property.name.getText() !== propName) continue;
+		const initializer = property.initializer;
+		if (initializer === void 0 || !typescriptBinding.isJsxExpression(initializer)) return null;
+		if (initializer.expression === void 0) return null;
+		const expression = unwrapExpression(initializer.expression);
+		return typescriptBinding.isIdentifier(expression) ? expression : null;
+	}
+	return null;
+};
+const getForwardedHandlerAliases = (rootDirectory, component, propNames, state) => {
+	const cacheKey = `${component.record.filePath}\0${component.name}\0${[...propNames].sort().join("\0")}`;
+	const cachedAliases = state.aliasesByComponent.get(cacheKey);
+	if (cachedAliases !== void 0) return cachedAliases;
+	const bindingsByPropName = /* @__PURE__ */ new Map();
+	const unresolvedPropNames = /* @__PURE__ */ new Set();
+	let callsiteCount = 0;
+	for (const record of listSourceRecords(rootDirectory, state)) {
+		const tagNames = getComponentTagNames(record, component);
+		if (tagNames.size === 0) continue;
+		const visit = (node) => {
+			if (record === component.record && node === component.node) return;
+			if (typescriptBinding.isJsxOpeningElement(node) || typescriptBinding.isJsxSelfClosingElement(node)) {
+				const tagName = getJsxTagName(node);
+				if (tagName !== null && tagNames.has(tagName)) {
+					callsiteCount += 1;
+					for (const propName of propNames) {
+						const binding = getHandlerBinding(node, propName);
+						if (binding === null) {
+							unresolvedPropNames.add(propName);
+							continue;
+						}
+						const bindings = bindingsByPropName.get(propName) ?? /* @__PURE__ */ new Set();
+						bindings.add(resolveHandlerBinding(record, binding));
+						bindingsByPropName.set(propName, bindings);
+					}
+				}
+			}
+			typescriptBinding.forEachChild(node, visit);
+		};
+		visit(record.sourceFile);
+	}
+	const aliases = /* @__PURE__ */ new Map();
+	if (callsiteCount > 0) for (const [propName, bindings] of bindingsByPropName) {
+		if (bindings.size !== 1 || unresolvedPropNames.has(propName)) continue;
+		const [bindingName] = bindings;
+		if (bindingName !== void 0) aliases.set(propName, bindingName);
+	}
+	state.aliasesByComponent.set(cacheKey, aliases);
+	return aliases;
+};
+const normalizeForwardedHandlers = (evidence, aliases) => {
+	let normalizedEvidence = evidence;
+	for (const [propName, bindingName] of aliases) normalizedEvidence = normalizedEvidence.replace(new RegExp(`\\{\\s*${propName}\\s*\\}`, "g"), `{${bindingName}}`).replace(new RegExp(`=>\\s*${propName}\\s*\\(`, "g"), `=> ${bindingName}(`);
+	return normalizedEvidence;
+};
+const createDiagnosticEvidenceReader = (rootDirectory, options = {}) => {
+	const state = {
+		aliasesByComponent: /* @__PURE__ */ new Map(),
+		recordByFilePath: /* @__PURE__ */ new Map(),
+		sourceRecords: null
+	};
+	return (diagnostic) => {
+		const record = readSourceRecord(rootDirectory, diagnostic.filePath, state);
+		if (record === null || !Number.isInteger(diagnostic.line)) return null;
+		const sourceLines = record.sourceText.split(/\r?\n/);
+		const startLineIndex = Math.max(0, diagnostic.line - 1);
+		const endLineIndex = Math.max(startLineIndex, (diagnostic.endLine ?? diagnostic.line) - 1);
+		const evidence = sourceLines.slice(startLineIndex, endLineIndex + 1).join("\n");
+		if (!options.resolveForwardedHandlers) return evidence;
+		const propNames = new Set(evidence.match(/\bon[A-Z]\w*\b/g) ?? []);
+		if (propNames.size === 0) return evidence;
+		const component = findEnclosingComponent(record, diagnostic);
+		if (component === null) return evidence;
+		return normalizeForwardedHandlers(evidence, getForwardedHandlerAliases(rootDirectory, component, propNames, state));
+	};
+};
+//#endregion
+//#region src/cli/utils/read-source-line.ts
+/**
+* Builds a cached `(filePath, line) -> source text` reader rooted at
+* `rootDirectory`, used as the fallback when construct-level diagnostic
+* evidence cannot be read. Wraps core's
+* `createNodeReadFileLinesSync` with per-file memoization + 1-indexed line
+* lookup; unreadable files / out-of-range lines return `null`.
+*/
+const createSourceLineReader = (rootDirectory) => {
+	const readFileLines = createNodeReadFileLinesSync(rootDirectory);
+	const fileLinesCache = /* @__PURE__ */ new Map();
+	return (filePath, line) => {
+		if (!fileLinesCache.has(filePath)) fileLinesCache.set(filePath, readFileLines(filePath));
+		const lines = fileLinesCache.get(filePath) ?? null;
+		if (lines === null || line < 1 || line > lines.length) return null;
+		return lines[line - 1] ?? null;
+	};
+};
+//#endregion
+//#region src/cli/utils/is-materializable-git-source.ts
+const GIT_LFS_POINTER_HEADER = "version https://git-lfs.github.com/spec/v1";
+const isMaterializableGitSource = (content) => !content.includes("\0") && !content.startsWith(GIT_LFS_POINTER_HEADER);
+//#endregion
+//#region src/cli/utils/materialize-baseline-files.ts
+/**
+* Materializes the base side of the `ref` → worktree diff into
+* `tempDirectory`, mirroring the project layout plus head's config files so
+* both sides lint under the same rules. Git rename heuristics are disabled by
+* the diff planner, so an old path is retained as a base deletion while its
+* new path is a head addition. Missing head-only additions are expected, and a
+* base-only deletion that cannot be read has nothing at head to compare
+* against; only a missing path that the plan says exists on both sides makes
+* `isComplete` false.
+*/
+const materializeBaselineFiles = (input) => runPromise(gen(function* () {
+	const git = yield* Git;
+	const diffPlan = yield* git.baselineDiffPlan({
+		directory: input.directory,
+		ref: input.ref
+	});
+	const baseFiles = input.baseFiles ?? diffPlan?.baseFiles;
+	const headFiles = input.headFiles ?? diffPlan?.headFiles;
+	const untrackedFiles = diffPlan?.untrackedFiles ?? [];
+	if (baseFiles === void 0 || headFiles === void 0) return null;
+	const files = [...new Set([...input.files, ...baseFiles])];
+	const tree = yield* materializeSourceTree({
+		directory: input.directory,
+		files,
+		tempDirectory: input.tempDirectory,
+		readContent: (relativePath) => git.showRefContent({
+			directory: input.directory,
+			ref: input.ref,
+			relativePath,
+			options: { maxBufferBytes: GIT_SHOW_MAX_BUFFER_BYTES }
+		}).pipe(map((content) => content !== null && isMaterializableGitSource(content) ? content : null))
+	});
+	const materializedFiles = new Set(tree.materializedFiles);
+	const headFileSet = new Set(headFiles);
+	return {
+		...tree,
+		baseFiles,
+		headFiles,
+		isComplete: baseFiles.every((filePath) => materializedFiles.has(filePath) || !headFileSet.has(filePath)),
+		untrackedFiles
+	};
+}).pipe(provide(Git.layerNode)));
+/**
+* Resolves the commit a baseline scan should read base content from — the
+* merge-base of `ref` and HEAD, so "introduced" is measured against the branch
+* point. `null` when unresolvable (ref missing/unsafe, no merge-base).
+*/
+const resolveMergeBaseRef = async (directory, ref) => {
+	try {
+		return await runPromise(gen(function* () {
+			return yield* (yield* Git).mergeBase({
+				directory,
+				ref
+			});
+		}).pipe(provide(Git.layerNode)));
+	} catch {
+		return null;
+	}
+};
+//#endregion
+//#region src/cli/utils/has-unlinted-surviving-base-file.ts
+const hasUnlintedSurvivingBaseFile = (input) => {
+	const analyzedBaseFiles = new Set(input.analyzedBaseFiles.map(toForwardSlashes));
+	return filterSourceFiles(input.baseLintPaths.map(toForwardSlashes)).some((filePath) => input.headFiles.has(filePath) && !analyzedBaseFiles.has(filePath));
+};
+//#endregion
+//#region src/cli/utils/run-baseline-comparison.ts
+const silentConsole$1 = makeNoopConsole();
+const countIncompleteLintFiles = (lintPartialFailures) => countDroppedLintFiles(lintPartialFailures) + countDeadlineSkippedFiles(lintPartialFailures);
+const runBaselineComparison = async (input) => {
+	const baselineIncludePaths = filterPathsOutsideDirectories({
+		rootDirectory: input.directory,
+		relativePaths: input.options.includePaths,
+		excludedDirectories: input.options.excludedProjectDirectories
+	});
+	const baselineBaseFiles = input.baseFiles ? filterPathsOutsideDirectories({
+		rootDirectory: input.directory,
+		relativePaths: input.baseFiles,
+		excludedDirectories: input.options.excludedProjectDirectories
+	}) : void 0;
+	const baselineHeadFiles = input.headFiles ? filterPathsOutsideDirectories({
+		rootDirectory: input.directory,
+		relativePaths: input.headFiles,
+		excludedDirectories: input.options.excludedProjectDirectories
+	}) : void 0;
+	const remainingBaselineBudgetMs = input.deadlineEpochMs === null ? null : remainingDeadlineBudgetMs(input.deadlineEpochMs);
+	if (remainingBaselineBudgetMs === 0) return null;
+	const baselineDeadlineSignal = remainingBaselineBudgetMs === null ? void 0 : AbortSignal.timeout(remainingBaselineBudgetMs);
+	const baselineListingSignal = baselineDeadlineSignal === void 0 ? input.oxlintRuntime.abortSignal : input.oxlintRuntime.abortSignal === void 0 ? baselineDeadlineSignal : AbortSignal.any([input.oxlintRuntime.abortSignal, baselineDeadlineSignal]);
+	let maintainabilitySourceFiles = [];
+	if (input.options.deadCode) try {
+		maintainabilitySourceFiles = (await listSourceFilesCooperative(input.directory, baselineListingSignal)).filter((filePath) => MAINTAINABILITY_SOURCE_FILE_PATTERN.test(filePath) && classifyFileContext(filePath) === "production");
+	} catch (error) {
+		if (baselineDeadlineSignal?.aborted) return null;
+		throw error;
+	}
+	const temporaryDirectory = mkdtempSync(path.join(tmpdir(), BASELINE_FILES_TEMP_DIR_PREFIX));
+	const snapshot = await materializeBaselineFiles({
+		directory: input.directory,
+		ref: input.baselineRef,
+		files: input.options.deadCode ? input.options.includePaths : baselineIncludePaths,
+		baseFiles: input.options.deadCode ? input.baseFiles : baselineBaseFiles,
+		headFiles: input.options.deadCode ? input.headFiles : baselineHeadFiles,
+		tempDirectory: temporaryDirectory
+	}).catch((error) => {
+		rmSync(temporaryDirectory, {
+			recursive: true,
+			force: true
+		});
+		throw error;
+	});
+	if (snapshot === null) {
+		rmSync(temporaryDirectory, {
+			recursive: true,
+			force: true
+		});
+		return null;
+	}
+	try {
+		if (!snapshot.isComplete) return null;
+		if (input.options.deadCode && !await copyUnchangedBaselineSources({
+			directory: input.directory,
+			sourceFiles: maintainabilitySourceFiles,
+			baseMaterializedFiles: snapshot.materializedFiles,
+			headChangedFiles: snapshot.headFiles,
+			untrackedFiles: snapshot.untrackedFiles,
+			tempDirectory: snapshot.tempDirectory,
+			deadlineEpochMs: input.deadlineEpochMs,
+			signal: input.oxlintRuntime.abortSignal
+		})) return null;
+		const filteredSnapshotBaseFiles = filterPathsOutsideDirectories({
+			rootDirectory: input.directory,
+			relativePaths: snapshot.baseFiles,
+			excludedDirectories: input.options.excludedProjectDirectories
+		});
+		const filteredSnapshotHeadFiles = filterPathsOutsideDirectories({
+			rootDirectory: input.directory,
+			relativePaths: snapshot.headFiles,
+			excludedDirectories: input.options.excludedProjectDirectories
+		});
+		const analyzedHeadFiles = new Set(input.headAnalyzedFiles.map(toForwardSlashes));
+		const baseFiles = new Set((baselineBaseFiles ?? filteredSnapshotBaseFiles).map(toForwardSlashes));
+		const expectedHeadFiles = new Set((baselineHeadFiles ?? filteredSnapshotHeadFiles).map(toForwardSlashes));
+		for (const filePath of baselineIncludePaths) {
+			const normalizedFilePath = toForwardSlashes(filePath);
+			if (!baseFiles.has(normalizedFilePath)) expectedHeadFiles.add(normalizedFilePath);
+		}
+		if (input.options.lint && filterSourceFiles([...expectedHeadFiles]).some((filePath) => !analyzedHeadFiles.has(filePath))) return null;
+		const baselineLintPaths = new Set([...baselineIncludePaths, ...filteredSnapshotBaseFiles].map(toForwardSlashes));
+		const materializedLintPaths = snapshot.materializedFiles.filter((filePath) => baselineLintPaths.has(toForwardSlashes(filePath)));
+		const maintainabilityFocusPaths = [...new Set([...input.options.includePaths, ...snapshot.baseFiles].map(toForwardSlashes))];
+		const baselineExcludedProjectDirectories = input.options.excludedProjectDirectories.map((excludedDirectory) => path.resolve(excludedDirectory)).filter((excludedDirectory) => isPathInsideDirectory(excludedDirectory, input.directory)).map((excludedDirectory) => path.resolve(snapshot.tempDirectory, path.relative(input.directory, excludedDirectory)));
+		const baseIncludePaths = materializedLintPaths.length > 0 ? materializedLintPaths : maintainabilityFocusPaths;
+		const runtimeLayers = buildRuntimeLayers({
+			directory: snapshot.tempDirectory,
+			hasConfigOverride: true,
+			userConfig: input.userConfig,
+			configSourceDirectory: input.configSourceDirectory,
+			projectInfoOverride: input.headProjectInfo,
+			shouldSkipLint: !input.options.lint || !input.resolvedNodeBinaryPath || materializedLintPaths.length === 0,
+			shouldRunDeadCode: input.options.deadCode,
+			shouldRunSupplyChain: input.options.supplyChain,
+			shouldComputeScore: false,
+			shouldShowProgressSpinners: false,
+			oxlintConcurrency: input.oxlintRuntime.concurrency,
+			oxlintSpawnSlots: input.oxlintRuntime.spawnSlots
+		});
+		const baseOutput = await runPromise(restoreLegacyThrow(runInspect({
+			directory: snapshot.tempDirectory,
+			includePaths: baseIncludePaths,
+			maintainabilityFocusPaths,
+			customRulesOnly: input.options.customRulesOnly,
+			respectInlineDisables: input.options.respectInlineDisables,
+			warnings: input.options.warnings,
+			adoptExistingLintConfig: input.options.adoptExistingLintConfig,
+			ignoredTags: input.options.ignoredTags,
+			includedTags: input.options.includedTags,
+			includeTagDefaults: input.options.includeTagDefaults,
+			nodeBinaryPath: input.resolvedNodeBinaryPath ?? void 0,
+			runDeadCode: input.options.deadCode,
+			isCi: input.options.isCi,
+			doctorVersion: VERSION,
+			runId: getRunId(),
+			resolveLocalGithubViewerPermission: false,
+			suppressScanSummary: true,
+			supplyChainManifestChanged: input.options.supplyChainManifestChanged,
+			deadlineEpochMs: input.deadlineEpochMs ?? void 0,
+			signal: input.oxlintRuntime.abortSignal,
+			excludedProjectDirectories: baselineExcludedProjectDirectories,
+			retainExcludedProjectDeadCodeDiagnostics: input.options.retainExcludedProjectDeadCodeDiagnostics
+		}, {}).pipe(provide(runtimeLayers), provideService(PerFileLintCacheEnabled, false), provideService(SidecarLintCacheEnabled, false), provideService(Console, silentConsole$1))), { signal: input.oxlintRuntime.abortSignal });
+		if (baseOutput.didLintFail || baseOutput.didDeadCodeFail) return null;
+		if (countIncompleteLintFiles(baseOutput.lintPartialFailures) > 0 && hasUnlintedSurvivingBaseFile({
+			baseLintPaths: materializedLintPaths,
+			headFiles: expectedHeadFiles,
+			analyzedBaseFiles: baseOutput.analyzedFiles
+		})) return null;
+		const hasUnscannedUntrackedSourceFiles = filterSourceFiles(filterPathsOutsideDirectories({
+			rootDirectory: input.directory,
+			relativePaths: snapshot.untrackedFiles,
+			excludedDirectories: input.options.excludedProjectDirectories
+		}).map(toForwardSlashes)).some((filePath) => !analyzedHeadFiles.has(filePath));
+		const diagnosticDelta = computeDiagnosticDelta({
+			headDiagnostics: input.headDiagnostics,
+			baseDiagnostics: baseOutput.diagnostics,
+			readHeadLine: createSourceLineReader(input.directory),
+			readBaseLine: createSourceLineReader(snapshot.tempDirectory),
+			readHeadEvidence: createDiagnosticEvidenceReader(input.directory, { resolveForwardedHandlers: true }),
+			readBaseEvidence: createDiagnosticEvidenceReader(snapshot.tempDirectory)
+		});
+		return {
+			displayDiagnostics: diagnosticDelta.newDiagnostics,
+			baselineDelta: {
+				baseRef: input.baselineRef,
+				fixedCount: hasUnscannedUntrackedSourceFiles ? 0 : diagnosticDelta.fixedCount,
+				baseTotalCount: baseOutput.diagnostics.length,
+				crossFileMatchCount: diagnosticDelta.crossFileMatchCount
+			}
+		};
+	} finally {
+		snapshot.cleanup();
+	}
+};
+//#endregion
+//#region src/cli/utils/scan-result-cache-payload.ts
+const decodeDiagnostic = decodeUnknownSync(Diagnostic);
+const isStringArray = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string");
+const isNullableString = (value) => value === null || typeof value === "string";
+const isBoolean = (value) => typeof value === "boolean";
+const isNumber = (value) => typeof value === "number";
+const isString = (value) => typeof value === "string";
+const isDiagnosticArray = (value) => {
+	if (!Array.isArray(value)) return false;
+	try {
+		for (const entry of value) decodeDiagnostic(entry);
+		return true;
+	} catch {
+		return false;
+	}
+};
+const isScoreResult = (value) => value === null || isRecord(value) && typeof value.score === "number" && typeof value.label === "string";
+const isProjectInfo = (value) => isRecord(value) && typeof value.rootDirectory === "string" && typeof value.projectName === "string" && typeof value.framework === "string" && typeof value.sourceFileCount === "number";
+const isBaselineDelta = (value) => isRecord(value) && typeof value.baseRef === "string" && typeof value.fixedCount === "number" && typeof value.baseTotalCount === "number" && (value.crossFileMatchCount === void 0 || typeof value.crossFileMatchCount === "number");
+const isSuppressedRuleCountArray = (value) => Array.isArray(value) && value.every((entry) => isRecord(entry) && typeof entry.rule === "string" && typeof entry.source === "string" && typeof entry.count === "number");
+const REQUIRED_CACHED_SCAN_PAYLOAD_FIELDS = [
+	{
+		key: "diagnostics",
+		isValid: isDiagnosticArray
+	},
+	{
+		key: "score",
+		isValid: isScoreResult
+	},
+	{
+		key: "project",
+		isValid: isProjectInfo
+	},
+	{
+		key: "userConfig",
+		isValid: (value) => value === null || isRecord(value)
+	},
+	{
+		key: "didLintFail",
+		isValid: isBoolean
+	},
+	{
+		key: "lintFailureReason",
+		isValid: isNullableString
+	},
+	{
+		key: "lintPartialFailures",
+		isValid: isStringArray
+	},
+	{
+		key: "didDeadCodeFail",
+		isValid: isBoolean
+	},
+	{
+		key: "deadCodeFailureReason",
+		isValid: isNullableString
+	},
+	{
+		key: "deadCodeOverlapped",
+		isValid: isBoolean
+	},
+	{
+		key: "directory",
+		isValid: isString
+	},
+	{
+		key: "scannedFileCount",
+		isValid: isNumber
+	},
+	{
+		key: "scannedFilePaths",
+		isValid: isStringArray
+	},
+	{
+		key: "scanElapsedMilliseconds",
+		isValid: isNumber
+	},
+	{
+		key: "lintFailureReasonKind",
+		isValid: isNullableString
+	},
+	{
+		key: "supplyChainOverlapTimedOut",
+		isValid: isBoolean
+	}
+];
+const OPTIONAL_CACHED_SCAN_PAYLOAD_FIELDS = [
+	{
+		key: "analyzedFiles",
+		isValid: isStringArray
+	},
+	{
+		key: "baselineDelta",
+		isValid: isBaselineDelta
+	},
+	{
+		key: "scanConcurrency",
+		isValid: isNumber
+	},
+	{
+		key: "securityScanFailed",
+		isValid: isBoolean
+	},
+	{
+		key: "securityScanFailureReason",
+		isValid: isNullableString
+	},
+	{
+		key: "suppressedRuleCounts",
+		isValid: isSuppressedRuleCountArray
+	},
+	{
+		key: "manifestContentHash",
+		isValid: isNullableString
+	}
+];
+const hasValidRequiredCachedScanPayloadFields = (value) => REQUIRED_CACHED_SCAN_PAYLOAD_FIELDS.every((field) => field.isValid(value[field.key]));
+const hasValidOptionalCachedScanPayloadFields = (value) => OPTIONAL_CACHED_SCAN_PAYLOAD_FIELDS.every((field) => value[field.key] === void 0 || field.isValid(value[field.key]));
+const isCachedScanPayload = (value) => {
+	if (!isRecord(value)) return false;
+	return hasValidRequiredCachedScanPayloadFields(value) && hasValidOptionalCachedScanPayloadFields(value);
+};
+const decodeCachedScanPayload = (value) => isCachedScanPayload(value) ? value : null;
+const shouldStoreScanPayload = (payload) => !payload.didLintFail && !payload.didDeadCodeFail && payload.lintPartialFailures.length === 0 && !payload.supplyChainOverlapTimedOut && payload.securityScanFailed !== true;
+//#endregion
+//#region src/cli/utils/scan-result-cache.ts
+const createScanResultCacheInvocationState = () => ({
+	repositoryIdentityByRoot: /* @__PURE__ */ new Map(),
+	firstProjectIdentity: null
+});
+const TOOLCHAIN_PACKAGE_SPECIFIERS = [
+	"oxlint/package.json",
+	"oxlint-plugin-react-doctor/package.json",
+	"eslint-plugin-react-hooks/package.json"
 ];
-const COMPONENT_WRAPPER_NAMES = new Set(["memo", "forwardRef"]);
-const getScriptKind = (filePath) => {
-	const extension = path.extname(filePath).toLowerCase();
-	if (extension === ".tsx") return ts.ScriptKind.TSX;
-	if (extension === ".jsx") return ts.ScriptKind.JSX;
-	if (extension === ".js" || extension === ".mjs" || extension === ".cjs") return ts.ScriptKind.JS;
-	return ts.ScriptKind.TS;
-};
-const resolveSafeSourcePath = (rootDirectory, filePath) => {
+const bundledRequire = createRequire(import.meta.url);
+const RULE_PLUGIN_CONTENT_FINGERPRINT = (() => {
 	try {
-		const resolvedRootDirectory = fs.realpathSync(rootDirectory);
-		const absolutePath = path.resolve(resolvedRootDirectory, filePath);
-		const relativePath = path.relative(resolvedRootDirectory, absolutePath);
-		if (relativePath.length === 0 || relativePath === ".." || relativePath.startsWith(`..${path.sep}`) || path.isAbsolute(relativePath)) return null;
-		const stats = fs.lstatSync(absolutePath);
-		if (!stats.isFile() || stats.isSymbolicLink()) return null;
-		const realPath = fs.realpathSync(absolutePath);
-		const realRelativePath = path.relative(resolvedRootDirectory, realPath);
-		return realRelativePath !== ".." && !realRelativePath.startsWith(`..${path.sep}`) && !path.isAbsolute(realRelativePath) ? realPath : null;
+		return `oxlint-plugin-react-doctor#fingerprint=${hashFileContents(bundledRequire.resolve("oxlint-plugin-react-doctor")) ?? "unreadable"}`;
 	} catch {
-		return null;
+		return "oxlint-plugin-react-doctor#fingerprint=unresolved";
 	}
-};
-const readSourceRecord = (rootDirectory, filePath, state) => {
-	const normalizedFilePath = filePath.replace(/\\/g, "/");
-	if (state.recordByFilePath.has(normalizedFilePath)) return state.recordByFilePath.get(normalizedFilePath) ?? null;
-	const absolutePath = resolveSafeSourcePath(rootDirectory, normalizedFilePath);
-	if (absolutePath === null) {
-		state.recordByFilePath.set(normalizedFilePath, null);
-		return null;
+})();
+const normalizeForStableJson = (value) => {
+	if (value === null) return null;
+	if (value === void 0) return void 0;
+	const valueType = typeof value;
+	if (valueType === "string" || valueType === "number" || valueType === "boolean") return value;
+	if (valueType === "bigint" || valueType === "function" || valueType === "symbol") throw new Error("Unsupported cache key value");
+	if (Array.isArray(value)) return value.map((item) => {
+		const normalized = normalizeForStableJson(item);
+		return normalized === void 0 ? null : normalized;
+	});
+	const prototype = Object.getPrototypeOf(value);
+	if (prototype !== Object.prototype && prototype !== null) throw new Error("Unsupported cache key object");
+	if (!isRecord(value)) throw new Error("Unsupported cache key object");
+	const normalizedRecord = {};
+	for (const key of Object.keys(value).sort()) {
+		const normalized = normalizeForStableJson(value[key]);
+		if (normalized !== void 0) normalizedRecord[key] = normalized;
 	}
+	return normalizedRecord;
+};
+const stringifyStableJson = (value) => {
 	try {
-		const sourceText = fs.readFileSync(absolutePath, "utf-8");
-		const record = {
-			absolutePath,
-			filePath: normalizedFilePath,
-			sourceFile: ts.createSourceFile(absolutePath, sourceText, ts.ScriptTarget.Latest, true, getScriptKind(absolutePath)),
-			sourceText
-		};
-		state.recordByFilePath.set(normalizedFilePath, record);
-		return record;
+		return JSON.stringify(normalizeForStableJson(value));
 	} catch {
-		state.recordByFilePath.set(normalizedFilePath, null);
 		return null;
 	}
 };
-const listSourceRecords = (rootDirectory, state) => {
-	if (state.sourceRecords !== null) return state.sourceRecords;
-	state.sourceRecords = listSourceFiles(rootDirectory).flatMap((filePath) => {
-		const record = readSourceRecord(rootDirectory, filePath, state);
-		return record === null ? [] : [record];
-	});
-	return state.sourceRecords;
-};
-const unwrapExpression = (expression) => {
-	let currentExpression = expression;
-	while (ts.isParenthesizedExpression(currentExpression) || ts.isAsExpression(currentExpression) || ts.isTypeAssertionExpression(currentExpression) || ts.isNonNullExpression(currentExpression) || ts.isSatisfiesExpression(currentExpression)) currentExpression = currentExpression.expression;
-	return currentExpression;
-};
-const getCalleeName = (expression) => {
-	const unwrappedExpression = unwrapExpression(expression);
-	if (ts.isIdentifier(unwrappedExpression)) return unwrappedExpression.text;
-	if (ts.isPropertyAccessExpression(unwrappedExpression)) return unwrappedExpression.name.text;
-	return null;
-};
-const isComponentWrapperCall = (node) => {
-	const wrapperName = getCalleeName(node.expression);
-	return wrapperName !== null && COMPONENT_WRAPPER_NAMES.has(wrapperName);
-};
-const getFunctionName = (node) => {
-	if (ts.isFunctionDeclaration(node) && node.name !== void 0) return node.name.text;
-	if (ts.isArrowFunction(node) || ts.isFunctionExpression(node)) {
-		let componentExpression = node;
-		while (true) {
-			const parent = componentExpression.parent;
-			if (ts.isParenthesizedExpression(parent) || ts.isAsExpression(parent) || ts.isTypeAssertionExpression(parent) || ts.isNonNullExpression(parent) || ts.isSatisfiesExpression(parent)) {
-				componentExpression = parent;
-				continue;
-			}
-			if (ts.isCallExpression(parent) && parent.arguments[0] === componentExpression && isComponentWrapperCall(parent)) {
-				componentExpression = parent;
-				continue;
-			}
-			if (ts.isVariableDeclaration(parent) && ts.isIdentifier(parent.name)) return parent.name.text;
-			return node.name?.text ?? null;
-		}
-	}
-	return null;
-};
-const isComponentFunction = (node) => ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node) || ts.isArrowFunction(node);
-const isDefaultExportedComponent = (record, node, componentName) => {
-	if (ts.canHaveModifiers(node) && ts.getModifiers(node)?.some((modifier) => modifier.kind === ts.SyntaxKind.DefaultKeyword)) return true;
-	return record.sourceFile.statements.some((statement) => ts.isExportAssignment(statement) && ts.isIdentifier(statement.expression) && statement.expression.text === componentName);
-};
-const findEnclosingComponent = (record, diagnostic) => {
-	if (!Number.isInteger(diagnostic.line) || diagnostic.line < 1) return null;
-	const lineIndex = diagnostic.line - 1;
-	const lineStarts = record.sourceFile.getLineStarts();
-	const lineStart = lineStarts[lineIndex];
-	if (lineStart === void 0) return null;
-	const nextLineStart = lineStarts[lineIndex + 1] ?? record.sourceFile.end;
-	const lineEnd = Math.max(lineStart, nextLineStart - 1);
-	const columnIndex = Number.isInteger(diagnostic.column) ? Math.max(0, diagnostic.column - 1) : 0;
-	const diagnosticPosition = Math.min(lineStart + columnIndex, lineEnd);
-	let component = null;
-	let componentWidth = Number.POSITIVE_INFINITY;
-	const visit = (node) => {
-		if (diagnosticPosition < node.getStart(record.sourceFile) || diagnosticPosition > node.end) return;
-		if (isComponentFunction(node)) {
-			const name = getFunctionName(node);
-			const width = node.end - node.getStart(record.sourceFile);
-			if (name !== null && /^[A-Z]/.test(name) && width < componentWidth) {
-				component = {
-					isDefaultExport: isDefaultExportedComponent(record, node, name),
-					name,
-					node,
-					record
-				};
-				componentWidth = width;
-			}
+const hashString = (value) => crypto.createHash("sha1").update(value).digest("hex");
+const readHeadSha = (projectDirectory) => runGitAsync(projectDirectory, HEAD_SHA_GIT_ARGUMENTS);
+const parseWorktreeStatusRecords = (statusOutput) => {
+	const entries = [];
+	const tokens = statusOutput.split("\0");
+	for (let tokenIndex = 0; tokenIndex < tokens.length; tokenIndex += 1) {
+		let record = tokens[tokenIndex];
+		if (record.length === 0) continue;
+		if (record.length < 3 || record[2] !== " ") {
+			if (tokenIndex !== 0) return null;
+			record = ` ${record}`;
 		}
-		ts.forEachChild(node, visit);
-	};
-	visit(record.sourceFile);
-	return component;
-};
-const moduleSpecifierTargetsComponent = (callerRecord, moduleSpecifier, componentRecord) => {
-	if (!moduleSpecifier.startsWith(".")) return false;
-	const unresolvedPath = path.resolve(path.dirname(callerRecord.absolutePath), moduleSpecifier);
-	const specifiedExtension = path.extname(unresolvedPath).toLowerCase();
-	const sourcePathWithoutExtension = SOURCE_EXTENSIONS.includes(specifiedExtension) ? unresolvedPath.slice(0, -specifiedExtension.length) : unresolvedPath;
-	return [
-		unresolvedPath,
-		...SOURCE_EXTENSIONS.map((extension) => `${sourcePathWithoutExtension}${extension}`),
-		...sourcePathWithoutExtension === unresolvedPath ? SOURCE_EXTENSIONS.map((extension) => path.join(unresolvedPath, `index${extension}`)) : []
-	].includes(componentRecord.absolutePath);
-};
-const getComponentTagNames = (record, component) => {
-	if (record.absolutePath === component.record.absolutePath) return new Set([component.name]);
-	const tagNames = /* @__PURE__ */ new Set();
-	for (const statement of record.sourceFile.statements) {
-		if (!ts.isImportDeclaration(statement) || !ts.isStringLiteral(statement.moduleSpecifier) || !moduleSpecifierTargetsComponent(record, statement.moduleSpecifier.text, component.record)) continue;
-		const importClause = statement.importClause;
-		if (component.isDefaultExport && importClause?.name !== void 0) tagNames.add(importClause.name.text);
-		const namedBindings = importClause?.namedBindings;
-		if (namedBindings !== void 0 && ts.isNamedImports(namedBindings)) {
-			for (const element of namedBindings.elements) if ((element.propertyName?.text ?? element.name.text) === component.name) tagNames.add(element.name.text);
+		if (record.length < 4 || record[2] !== " ") return null;
+		const statusCode = record.slice(0, 2);
+		const recordPath = record.slice(3);
+		if (statusCode.includes("R") || statusCode.includes("C")) {
+			tokenIndex += 1;
+			const originPath = tokens[tokenIndex];
+			if (originPath === void 0 || originPath.length === 0) return null;
+			entries.push({
+				statusCode,
+				path: recordPath,
+				originPath
+			});
+			continue;
 		}
+		entries.push({
+			statusCode,
+			path: recordPath
+		});
 	}
-	return tagNames;
-};
-const getTransparentCall = (functionNode) => {
-	if (functionNode.body === void 0) return null;
-	if (!ts.isBlock(functionNode.body)) {
-		const expression = unwrapExpression(functionNode.body);
-		return ts.isCallExpression(expression) ? expression : null;
-	}
-	if (functionNode.body.statements.length !== 1) return null;
-	const statement = functionNode.body.statements[0];
-	if (statement === void 0) return null;
-	const expression = ts.isExpressionStatement(statement) || ts.isReturnStatement(statement) ? statement.expression : void 0;
-	if (expression === void 0) return null;
-	const unwrappedExpression = unwrapExpression(expression);
-	return ts.isCallExpression(unwrappedExpression) ? unwrappedExpression : null;
-};
-const resolveTransparentTarget = (functionNode) => {
-	const call = getTransparentCall(functionNode);
-	if (call === null) return null;
-	const target = unwrapExpression(call.expression);
-	if (!ts.isIdentifier(target) || call.arguments.length !== functionNode.parameters.length) return null;
-	for (const [parameterIndex, parameter] of functionNode.parameters.entries()) {
-		const argument = call.arguments[parameterIndex];
-		const unwrappedArgument = argument === void 0 ? null : unwrapExpression(argument);
-		if (!ts.isIdentifier(parameter.name) || unwrappedArgument === null || !ts.isIdentifier(unwrappedArgument) || unwrappedArgument.text !== parameter.name.text) return null;
-	}
-	return target.text;
+	return entries;
 };
-const getForwardingFunction = (declaration) => {
-	if (ts.isFunctionDeclaration(declaration)) return declaration;
-	if (!ts.isVariableDeclaration(declaration) || declaration.initializer === void 0) return null;
-	const initializer = unwrapExpression(declaration.initializer);
-	if (ts.isArrowFunction(initializer) || ts.isFunctionExpression(initializer)) return initializer;
-	if (ts.isCallExpression(initializer) && getCalleeName(initializer.expression) === "useCallback") {
-		const callback = initializer.arguments[0];
-		if (callback !== void 0 && (ts.isArrowFunction(callback) || ts.isFunctionExpression(callback))) return callback;
+const buildDirtyPathContentFingerprint = (absolutePath, statusCode) => {
+	let stats;
+	try {
+		stats = fs.lstatSync(absolutePath);
+	} catch {
+		return statusCode.includes("D") ? "deleted" : null;
 	}
-	return null;
-};
-const getDeclaredBindingName = (node) => {
-	if ((ts.isVariableDeclaration(node) || ts.isParameter(node) || ts.isBindingElement(node) || ts.isFunctionDeclaration(node)) && node.name !== void 0 && ts.isIdentifier(node.name)) return node.name.text;
-	if (ts.isImportClause(node)) return node.name?.text ?? null;
-	if (ts.isImportSpecifier(node) || ts.isNamespaceImport(node)) return node.name.text;
-	return null;
+	if (stats.isSymbolicLink()) try {
+		return `link:${fs.readlinkSync(absolutePath)}`;
+	} catch {
+		return null;
+	}
+	if (!stats.isFile()) return null;
+	if (stats.size > 10485760) return null;
+	return hashFileContents(absolutePath);
 };
-const findBindingScope = (node) => {
-	let currentNode = node;
-	while (currentNode !== void 0) {
-		if (ts.isParameter(currentNode) && ts.isFunctionLike(currentNode.parent)) return currentNode.parent;
-		if (ts.isBlock(currentNode) || ts.isModuleBlock(currentNode) || ts.isSourceFile(currentNode)) return currentNode;
-		currentNode = currentNode.parent;
+const buildWorktreeFingerprint = (repositoryRoot, statusOutput) => {
+	if (statusOutput === null) return null;
+	if (statusOutput.length === 0) return [];
+	const statusEntries = parseWorktreeStatusRecords(statusOutput);
+	if (statusEntries === null) return null;
+	if (statusEntries.length > 300) return null;
+	const dirtyEntries = [];
+	for (const statusEntry of statusEntries) {
+		const contentFingerprint = buildDirtyPathContentFingerprint(path.join(repositoryRoot, statusEntry.path), statusEntry.statusCode);
+		if (contentFingerprint === null) return null;
+		dirtyEntries.push({
+			...statusEntry,
+			contentFingerprint
+		});
 	}
-	return node.getSourceFile();
+	return dirtyEntries.sort((firstEntry, secondEntry) => {
+		const firstSortKey = `${firstEntry.path}
${firstEntry.statusCode}`;
+		const secondSortKey = `${secondEntry.path}
${secondEntry.statusCode}`;
+		return firstSortKey < secondSortKey ? -1 : firstSortKey > secondSortKey ? 1 : 0;
+	});
 };
-const findBindingDeclaration = (record, binding) => {
-	const usagePosition = binding.getStart(record.sourceFile);
-	const candidates = [];
-	const visit = (node) => {
-		if (getDeclaredBindingName(node) === binding.text) {
-			const scope = findBindingScope(node);
-			const isVisibleScope = usagePosition >= scope.getStart(record.sourceFile) && usagePosition <= scope.end;
-			const isVisibleDeclaration = ts.isFunctionDeclaration(node) || ts.isParameter(node) || ts.isBindingElement(node) || ts.isImportClause(node) || ts.isImportSpecifier(node) || ts.isNamespaceImport(node) || node.getStart(record.sourceFile) < usagePosition;
-			if (isVisibleScope && isVisibleDeclaration) candidates.push({
-				declaration: node,
-				scope
-			});
-		}
-		ts.forEachChild(node, visit);
+const resolveIdentityFromProbes = async (repositoryRoot, statusPromise, headShaPromise, invocationState) => {
+	const [statusOutput, headSha] = await Promise.all([statusPromise, headShaPromise]);
+	const worktreeFingerprint = buildWorktreeFingerprint(repositoryRoot, statusOutput);
+	const identity = worktreeFingerprint === null || headSha === null ? null : {
+		headSha,
+		worktreeFingerprint
 	};
-	visit(record.sourceFile);
-	let nearestCandidate = null;
-	let nearestScopeWidth = Number.POSITIVE_INFINITY;
-	let isNearestScopeAmbiguous = false;
-	for (const candidate of candidates) {
-		const scopeWidth = candidate.scope.end - candidate.scope.getStart(record.sourceFile);
-		if (scopeWidth < nearestScopeWidth) {
-			nearestCandidate = candidate;
-			nearestScopeWidth = scopeWidth;
-			isNearestScopeAmbiguous = false;
-		} else if (scopeWidth === nearestScopeWidth) isNearestScopeAmbiguous = true;
-	}
-	if (isNearestScopeAmbiguous) return null;
-	const declaration = nearestCandidate?.declaration;
-	return declaration !== void 0 && (ts.isVariableDeclaration(declaration) || ts.isFunctionDeclaration(declaration)) ? declaration : null;
+	invocationState.repositoryIdentityByRoot.set(repositoryRoot, identity);
+	return identity;
 };
-const resolveHandlerBinding = (record, binding) => {
-	const declaration = findBindingDeclaration(record, binding);
-	if (declaration === null) return binding.text;
-	const forwardingFunction = getForwardingFunction(declaration);
-	const target = forwardingFunction === null ? null : resolveTransparentTarget(forwardingFunction);
-	return target === null || target === binding.text ? binding.text : target;
+const resolveSiblingIdentity = async (projectDirectory, invocationState, repositoryRootPromise, firstProjectIdentity) => {
+	const [repositoryRoot] = await Promise.all([repositoryRootPromise, firstProjectIdentity]);
+	if (repositoryRoot === null) return null;
+	const cachedIdentity = invocationState.repositoryIdentityByRoot.get(repositoryRoot);
+	if (cachedIdentity !== void 0) return cachedIdentity;
+	return resolveIdentityFromProbes(repositoryRoot, runGitAsync(projectDirectory, WORKTREE_STATUS_GIT_ARGUMENTS), readHeadSha(repositoryRoot), invocationState);
 };
-const getJsxTagName = (node) => ts.isIdentifier(node.tagName) ? node.tagName.text : null;
-const getHandlerBinding = (node, propName) => {
-	for (const property of node.attributes.properties) {
-		if (!ts.isJsxAttribute(property) || property.name.getText() !== propName) continue;
-		const initializer = property.initializer;
-		if (initializer === void 0 || !ts.isJsxExpression(initializer)) return null;
-		if (initializer.expression === void 0) return null;
-		const expression = unwrapExpression(initializer.expression);
-		return ts.isIdentifier(expression) ? expression : null;
-	}
-	return null;
+const resolveRepositoryCacheIdentity = (projectDirectory, invocationState, repositoryRootPromise) => {
+	if (invocationState.firstProjectIdentity !== null) return resolveSiblingIdentity(projectDirectory, invocationState, repositoryRootPromise, invocationState.firstProjectIdentity);
+	const speculativeStatus = runGitAsync(projectDirectory, WORKTREE_STATUS_GIT_ARGUMENTS);
+	const speculativeHeadSha = readHeadSha(projectDirectory);
+	invocationState.firstProjectIdentity = repositoryRootPromise.then((repositoryRoot) => repositoryRoot === null ? null : resolveIdentityFromProbes(repositoryRoot, speculativeStatus, speculativeHeadSha, invocationState));
+	return invocationState.firstProjectIdentity;
 };
-const getForwardedHandlerAliases = (rootDirectory, component, propNames, state) => {
-	const cacheKey = `${component.record.filePath}\0${component.name}\0${[...propNames].sort().join("\0")}`;
-	const cachedAliases = state.aliasesByComponent.get(cacheKey);
-	if (cachedAliases !== void 0) return cachedAliases;
-	const bindingsByPropName = /* @__PURE__ */ new Map();
-	const unresolvedPropNames = /* @__PURE__ */ new Set();
-	let callsiteCount = 0;
-	for (const record of listSourceRecords(rootDirectory, state)) {
-		const tagNames = getComponentTagNames(record, component);
-		if (tagNames.size === 0) continue;
-		const visit = (node) => {
-			if (record === component.record && node === component.node) return;
-			if (ts.isJsxOpeningElement(node) || ts.isJsxSelfClosingElement(node)) {
-				const tagName = getJsxTagName(node);
-				if (tagName !== null && tagNames.has(tagName)) {
-					callsiteCount += 1;
-					for (const propName of propNames) {
-						const binding = getHandlerBinding(node, propName);
-						if (binding === null) {
-							unresolvedPropNames.add(propName);
-							continue;
-						}
-						const bindings = bindingsByPropName.get(propName) ?? /* @__PURE__ */ new Set();
-						bindings.add(resolveHandlerBinding(record, binding));
-						bindingsByPropName.set(propName, bindings);
-					}
-				}
-			}
-			ts.forEachChild(node, visit);
-		};
-		visit(record.sourceFile);
-	}
-	const aliases = /* @__PURE__ */ new Map();
-	if (callsiteCount > 0) for (const [propName, bindings] of bindingsByPropName) {
-		if (bindings.size !== 1 || unresolvedPropNames.has(propName)) continue;
-		const [bindingName] = bindings;
-		if (bindingName !== void 0) aliases.set(propName, bindingName);
+const DOTENV_FILE_NAME_PATTERN = /^\.env(\.|$)/;
+const resolveDotenvFingerprint = (projectDirectory) => {
+	try {
+		return fs.readdirSync(projectDirectory).filter((entryName) => DOTENV_FILE_NAME_PATTERN.test(entryName)).sort().map((entryName) => `${entryName}=${hashFileContents(path.join(projectDirectory, entryName)) ?? "unreadable"}`);
+	} catch {
+		return [];
 	}
-	state.aliasesByComponent.set(cacheKey, aliases);
-	return aliases;
-};
-const normalizeForwardedHandlers = (evidence, aliases) => {
-	let normalizedEvidence = evidence;
-	for (const [propName, bindingName] of aliases) normalizedEvidence = normalizedEvidence.replace(new RegExp(`\\{\\s*${propName}\\s*\\}`, "g"), `{${bindingName}}`).replace(new RegExp(`=>\\s*${propName}\\s*\\(`, "g"), `=> ${bindingName}(`);
-	return normalizedEvidence;
-};
-const createDiagnosticEvidenceReader = (rootDirectory, options = {}) => {
-	const state = {
-		aliasesByComponent: /* @__PURE__ */ new Map(),
-		recordByFilePath: /* @__PURE__ */ new Map(),
-		sourceRecords: null
-	};
-	return (diagnostic) => {
-		const record = readSourceRecord(rootDirectory, diagnostic.filePath, state);
-		if (record === null || !Number.isInteger(diagnostic.line)) return null;
-		const sourceLines = record.sourceText.split(/\r?\n/);
-		const startLineIndex = Math.max(0, diagnostic.line - 1);
-		const endLineIndex = Math.max(startLineIndex, (diagnostic.endLine ?? diagnostic.line) - 1);
-		const evidence = sourceLines.slice(startLineIndex, endLineIndex + 1).join("\n");
-		if (!options.resolveForwardedHandlers) return evidence;
-		const propNames = new Set(evidence.match(/\bon[A-Z]\w*\b/g) ?? []);
-		if (propNames.size === 0) return evidence;
-		const component = findEnclosingComponent(record, diagnostic);
-		if (component === null) return evidence;
-		return normalizeForwardedHandlers(evidence, getForwardedHandlerAliases(rootDirectory, component, propNames, state));
-	};
 };
-//#endregion
-//#region src/cli/utils/read-source-line.ts
-/**
-* Builds a cached `(filePath, line) -> source text` reader rooted at
-* `rootDirectory`, used as the fallback when construct-level diagnostic
-* evidence cannot be read. Wraps core's
-* `createNodeReadFileLinesSync` with per-file memoization + 1-indexed line
-* lookup; unreadable files / out-of-range lines return `null`.
-*/
-const createSourceLineReader = (rootDirectory) => {
-	const readFileLines = createNodeReadFileLinesSync(rootDirectory);
-	const fileLinesCache = /* @__PURE__ */ new Map();
-	return (filePath, line) => {
-		if (!fileLinesCache.has(filePath)) fileLinesCache.set(filePath, readFileLines(filePath));
-		const lines = fileLinesCache.get(filePath) ?? null;
-		if (lines === null || line < 1 || line > lines.length) return null;
-		return lines[line - 1] ?? null;
-	};
+const isGitIdentityTrustworthy = async (projectDirectory) => {
+	const output = await runGitAsync(projectDirectory, TRACKED_FILE_FLAGS_GIT_ARGUMENTS);
+	if (output === null) return false;
+	const entryLines = output.split("\n").filter((line) => line.length > 0);
+	return entryLines.length > 0 && entryLines.every((line) => line[0] === "H");
+};
+const resolveCacheFilePath = (projectDirectory) => path.join(resolveReactDoctorCacheDir(projectDirectory), SCAN_RESULT_CACHE_FILENAME);
+const readPersistedCache = (cacheFilePath) => {
+	try {
+		const parsed = JSON.parse(fs.readFileSync(cacheFilePath, "utf8"));
+		if (!isRecord(parsed) || parsed.version !== 7) return {
+			version: 7,
+			entries: []
+		};
+		if (!Array.isArray(parsed.entries)) return {
+			version: 7,
+			entries: []
+		};
+		const entries = [];
+		for (const entry of parsed.entries) {
+			if (!isRecord(entry) || typeof entry.key !== "string" || typeof entry.createdAtMs !== "number") continue;
+			const payload = decodeCachedScanPayload(entry.payload);
+			if (payload === null) continue;
+			entries.push({
+				key: entry.key,
+				createdAtMs: entry.createdAtMs,
+				payload
+			});
+		}
+		return {
+			version: 7,
+			entries
+		};
+	} catch {
+		return {
+			version: 7,
+			entries: []
+		};
+	}
 };
-//#endregion
-//#region src/cli/utils/is-materializable-git-source.ts
-const GIT_LFS_POINTER_HEADER = "version https://git-lfs.github.com/spec/v1";
-const isMaterializableGitSource = (content) => !content.includes("\0") && !content.startsWith(GIT_LFS_POINTER_HEADER);
-//#endregion
-//#region src/cli/utils/materialize-baseline-files.ts
-/**
-* Materializes the base side of the `ref` → worktree diff into
-* `tempDirectory`, mirroring the project layout plus head's config files so
-* both sides lint under the same rules. Git rename heuristics are disabled by
-* the diff planner, so an old path is retained as a base deletion while its
-* new path is a head addition. Missing head-only additions are expected;
-* missing paths that the plan says must exist at base make `isComplete` false.
-*/
-const materializeBaselineFiles = (input) => runPromise(gen(function* () {
-	const git = yield* Git;
-	const diffPlan = yield* git.baselineDiffPlan({
-		directory: input.directory,
-		ref: input.ref
-	});
-	const baseFiles = input.baseFiles ?? diffPlan?.baseFiles;
-	const headFiles = input.headFiles ?? diffPlan?.headFiles;
-	const untrackedFiles = diffPlan?.untrackedFiles ?? [];
-	if (baseFiles === void 0 || headFiles === void 0) return null;
-	const files = [...new Set([...input.files, ...baseFiles])];
-	const tree = yield* materializeSourceTree({
-		directory: input.directory,
-		files,
-		tempDirectory: input.tempDirectory,
-		readContent: (relativePath) => git.showRefContent({
-			directory: input.directory,
-			ref: input.ref,
-			relativePath,
-			options: { maxBufferBytes: GIT_SHOW_MAX_BUFFER_BYTES }
-		}).pipe(map((content) => content !== null && isMaterializableGitSource(content) ? content : null))
-	});
-	const materializedFiles = new Set(tree.materializedFiles);
-	return {
-		...tree,
-		baseFiles,
-		headFiles,
-		isComplete: baseFiles.every((filePath) => materializedFiles.has(filePath)),
-		untrackedFiles
-	};
-}).pipe(provide(Git.layerNode)));
 /**
-* Resolves the commit a baseline scan should read base content from — the
-* merge-base of `ref` and HEAD, so "introduced" is measured against the branch
-* point. `null` when unresolvable (ref missing/unsafe, no merge-base).
+* The global cache off-switch (`REACT_DOCTOR_NO_CACHE`), which disables every
+* cache subsystem: this whole-repo scan cache plus core's per-file lint,
+* sidecar caches (their `Context.Reference` defaults read the
+* same variable). Exported for the wide event's `cache.temperature`
+* derivation, which reports `"disabled"` instead of `"cold"` when the switch
+* is on. Granular knobs (`REACT_DOCTOR_NO_FILE_CACHE`, …) are deliberately
+* not consulted — they leave the other subsystems live.
 */
-const resolveMergeBaseRef = async (directory, ref) => {
+const resolveProjectIdentity = (projectDirectory) => {
 	try {
-		return await runPromise(gen(function* () {
-			return yield* (yield* Git).mergeBase({
-				directory,
-				ref
-			});
-		}).pipe(provide(Git.layerNode)));
+		return fs.realpathSync.native(projectDirectory);
 	} catch {
-		return null;
+		return path.resolve(projectDirectory);
 	}
 };
-//#endregion
-//#region src/cli/utils/run-baseline-comparison.ts
-const silentConsole$1 = makeNoopConsole();
-const countIncompleteLintFiles = (lintPartialFailures) => countDroppedLintFiles(lintPartialFailures) + countDeadlineSkippedFiles(lintPartialFailures);
-const runBaselineComparison = async (input) => {
-	const baselineIncludePaths = filterPathsOutsideDirectories({
-		rootDirectory: input.directory,
-		relativePaths: input.options.includePaths,
-		excludedDirectories: input.options.excludedProjectDirectories
-	});
-	const baselineBaseFiles = input.baseFiles ? filterPathsOutsideDirectories({
-		rootDirectory: input.directory,
-		relativePaths: input.baseFiles,
-		excludedDirectories: input.options.excludedProjectDirectories
-	}) : void 0;
-	const baselineHeadFiles = input.headFiles ? filterPathsOutsideDirectories({
-		rootDirectory: input.directory,
-		relativePaths: input.headFiles,
-		excludedDirectories: input.options.excludedProjectDirectories
-	}) : void 0;
-	const remainingBaselineBudgetMs = input.deadlineEpochMs === null ? null : remainingDeadlineBudgetMs(input.deadlineEpochMs);
-	if (remainingBaselineBudgetMs === 0) return null;
-	const baselineDeadlineSignal = remainingBaselineBudgetMs === null ? void 0 : AbortSignal.timeout(remainingBaselineBudgetMs);
-	const baselineListingSignal = baselineDeadlineSignal === void 0 ? input.oxlintRuntime.abortSignal : input.oxlintRuntime.abortSignal === void 0 ? baselineDeadlineSignal : AbortSignal.any([input.oxlintRuntime.abortSignal, baselineDeadlineSignal]);
-	let maintainabilitySourceFiles = [];
-	if (input.options.deadCode) try {
-		maintainabilitySourceFiles = (await listSourceFilesCooperative(input.directory, baselineListingSignal)).filter((filePath) => JSX_DUPLICATION_SOURCE_FILE_PATTERN.test(filePath) && classifyFileContext(filePath) === "production");
-	} catch (error) {
-		if (baselineDeadlineSignal?.aborted) return null;
-		throw error;
-	}
-	const temporaryDirectory = mkdtempSync(path.join(tmpdir(), BASELINE_FILES_TEMP_DIR_PREFIX));
-	const snapshot = await materializeBaselineFiles({
-		directory: input.directory,
-		ref: input.baselineRef,
-		files: input.options.deadCode ? input.options.includePaths : baselineIncludePaths,
-		baseFiles: input.options.deadCode ? input.baseFiles : baselineBaseFiles,
-		headFiles: input.options.deadCode ? input.headFiles : baselineHeadFiles,
-		tempDirectory: temporaryDirectory
-	}).catch((error) => {
-		rmSync(temporaryDirectory, {
-			recursive: true,
-			force: true
-		});
-		throw error;
-	});
-	if (snapshot === null) {
-		rmSync(temporaryDirectory, {
-			recursive: true,
-			force: true
-		});
+const resolveManifestContentHash = (projectDirectory) => hashFileContents(getPackageJsonPath(projectDirectory));
+const fileFingerprint = (filePath) => {
+	try {
+		const stat = fs.statSync(filePath);
+		return `${filePath}:${stat.mtimeMs}:${stat.size}`;
+	} catch {
 		return null;
 	}
-	try {
-		if (!snapshot.isComplete) return null;
-		if (input.options.deadCode && !await copyUnchangedBaselineSources({
-			directory: input.directory,
-			sourceFiles: maintainabilitySourceFiles,
-			baseMaterializedFiles: snapshot.materializedFiles,
-			headChangedFiles: snapshot.headFiles,
-			untrackedFiles: snapshot.untrackedFiles,
-			tempDirectory: snapshot.tempDirectory,
-			deadlineEpochMs: input.deadlineEpochMs,
-			signal: input.oxlintRuntime.abortSignal
-		})) return null;
-		const filteredSnapshotBaseFiles = filterPathsOutsideDirectories({
-			rootDirectory: input.directory,
-			relativePaths: snapshot.baseFiles,
-			excludedDirectories: input.options.excludedProjectDirectories
-		});
-		const filteredSnapshotHeadFiles = filterPathsOutsideDirectories({
-			rootDirectory: input.directory,
-			relativePaths: snapshot.headFiles,
-			excludedDirectories: input.options.excludedProjectDirectories
-		});
-		const analyzedHeadFiles = new Set(input.headAnalyzedFiles.map(toForwardSlashes));
-		const baseFiles = new Set((baselineBaseFiles ?? filteredSnapshotBaseFiles).map(toForwardSlashes));
-		const expectedHeadFiles = new Set((baselineHeadFiles ?? filteredSnapshotHeadFiles).map(toForwardSlashes));
-		for (const filePath of baselineIncludePaths) {
-			const normalizedFilePath = toForwardSlashes(filePath);
-			if (!baseFiles.has(normalizedFilePath)) expectedHeadFiles.add(normalizedFilePath);
-		}
-		if (input.options.lint && filterSourceFiles([...expectedHeadFiles]).some((filePath) => !analyzedHeadFiles.has(filePath))) return null;
-		const baselineLintPaths = new Set([...baselineIncludePaths, ...filteredSnapshotBaseFiles].map(toForwardSlashes));
-		const materializedLintPaths = snapshot.materializedFiles.filter((filePath) => baselineLintPaths.has(toForwardSlashes(filePath)));
-		const maintainabilityFocusPaths = [...new Set([...input.options.includePaths, ...snapshot.baseFiles].map(toForwardSlashes))];
-		const baselineExcludedProjectDirectories = input.options.excludedProjectDirectories.map((excludedDirectory) => path.resolve(excludedDirectory)).filter((excludedDirectory) => isPathInsideDirectory(excludedDirectory, input.directory)).map((excludedDirectory) => path.resolve(snapshot.tempDirectory, path.relative(input.directory, excludedDirectory)));
-		const baseIncludePaths = materializedLintPaths.length > 0 ? materializedLintPaths : maintainabilityFocusPaths;
-		const runtimeLayers = buildRuntimeLayers({
-			directory: snapshot.tempDirectory,
-			hasConfigOverride: true,
-			userConfig: input.userConfig,
-			configSourceDirectory: input.configSourceDirectory,
-			projectInfoOverride: input.headProjectInfo,
-			shouldSkipLint: !input.options.lint || !input.resolvedNodeBinaryPath || materializedLintPaths.length === 0,
-			shouldRunDeadCode: input.options.deadCode,
-			shouldRunSupplyChain: input.options.supplyChain,
-			shouldComputeScore: false,
-			shouldShowProgressSpinners: false,
-			oxlintConcurrency: input.oxlintRuntime.concurrency,
-			oxlintSpawnSlots: input.oxlintRuntime.spawnSlots
-		});
-		const baseOutput = await runPromise(restoreLegacyThrow(runInspect({
-			directory: snapshot.tempDirectory,
-			includePaths: baseIncludePaths,
-			maintainabilityFocusPaths,
+};
+const resolveScanResultToolchainFingerprint = (nodeBinaryPath) => {
+	const fingerprints = [];
+	if (nodeBinaryPath !== null) fingerprints.push(nodeBinaryPath === process.execPath ? `node=${process.version}` : `node=${fileFingerprint(nodeBinaryPath) ?? "unreadable"}`);
+	for (const specifier of TOOLCHAIN_PACKAGE_SPECIFIERS) try {
+		const packageJson = bundledRequire(specifier);
+		const version = typeof packageJson.version === "string" ? packageJson.version : "unknown";
+		fingerprints.push(`${specifier}=${version}`);
+	} catch {
+		fingerprints.push(`${specifier}=missing`);
+	}
+	fingerprints.push(RULE_PLUGIN_CONTENT_FINGERPRINT);
+	return fingerprints;
+};
+const buildScanResultCacheKey = async (input) => {
+	if (isCacheGloballyDisabled()) return null;
+	const isTrustworthyPromise = isGitIdentityTrustworthy(input.projectDirectory);
+	const repositoryIdentityPromise = resolveRepositoryCacheIdentity(input.projectDirectory, input.invocationState, runGitAsync(input.projectDirectory, REPOSITORY_ROOT_GIT_ARGUMENTS));
+	const [isTrustworthy, repositoryIdentity] = await Promise.all([isTrustworthyPromise, repositoryIdentityPromise]);
+	if (!isTrustworthy || repositoryIdentity === null) return null;
+	if (stringifyStableJson(input.userConfig) === null) return null;
+	const cacheKeyJson = stringifyStableJson({
+		schemaVersion: 7,
+		projectIdentity: resolveProjectIdentity(input.projectDirectory),
+		headSha: repositoryIdentity.headSha,
+		worktreeFingerprint: repositoryIdentity.worktreeFingerprint,
+		dotenvFingerprint: resolveDotenvFingerprint(input.projectDirectory),
+		reactDoctorVersion: input.version,
+		nodeVersion: process.version,
+		toolchainFingerprint: resolveScanResultToolchainFingerprint(input.nodeBinaryPath),
+		configFingerprint: computeConfigFingerprint(input.projectDirectory, input.version),
+		hasConfigOverride: input.hasConfigOverride,
+		configSourceDirectory: input.configSourceDirectory,
+		userConfig: input.userConfig,
+		engineOptions: {
+			lint: input.options.lint,
+			deadCode: input.options.deadCode,
+			supplyChain: input.options.supplyChain,
+			includePaths: [...input.options.includePaths].sort(),
+			excludedProjectDirectories: [...input.options.excludedProjectDirectories ?? []].sort(),
+			retainExcludedProjectDeadCodeDiagnostics: input.options.retainExcludedProjectDeadCodeDiagnostics ?? false,
 			customRulesOnly: input.options.customRulesOnly,
 			respectInlineDisables: input.options.respectInlineDisables,
 			warnings: input.options.warnings,
 			adoptExistingLintConfig: input.options.adoptExistingLintConfig,
-			ignoredTags: input.options.ignoredTags,
-			includedTags: input.options.includedTags,
+			ignoredTags: [...input.options.ignoredTags].sort(),
+			includedTags: [...input.options.includedTags].sort(),
 			includeTagDefaults: input.options.includeTagDefaults,
-			nodeBinaryPath: input.resolvedNodeBinaryPath ?? void 0,
-			runDeadCode: input.options.deadCode,
+			concurrency: input.options.concurrency,
+			lintBatchOrdering: resolveLintBatchOrdering(),
+			baselineRef: input.options.baseline?.ref,
+			changedLineRanges: input.options.changedLineRanges ?? void 0,
+			noScore: input.options.noScore,
 			isCi: input.options.isCi,
-			doctorVersion: VERSION,
-			runId: getRunId(),
-			resolveLocalGithubViewerPermission: false,
-			suppressScanSummary: true,
-			supplyChainManifestChanged: input.options.supplyChainManifestChanged,
-			deadlineEpochMs: input.deadlineEpochMs ?? void 0,
-			signal: input.oxlintRuntime.abortSignal,
-			excludedProjectDirectories: baselineExcludedProjectDirectories,
-			retainExcludedProjectDeadCodeDiagnostics: input.options.retainExcludedProjectDeadCodeDiagnostics
-		}, {}).pipe(provide(runtimeLayers), provideService(PerFileLintCacheEnabled, false), provideService(SidecarLintCacheEnabled, false), provideService(Console, silentConsole$1))), { signal: input.oxlintRuntime.abortSignal });
-		if (baseOutput.didLintFail || baseOutput.didDeadCodeFail || countIncompleteLintFiles(baseOutput.lintPartialFailures) > 0) return null;
-		const hasUnscannedUntrackedSourceFiles = filterSourceFiles(filterPathsOutsideDirectories({
-			rootDirectory: input.directory,
-			relativePaths: snapshot.untrackedFiles,
-			excludedDirectories: input.options.excludedProjectDirectories
-		}).map(toForwardSlashes)).some((filePath) => !analyzedHeadFiles.has(filePath));
-		const diagnosticDelta = computeDiagnosticDelta({
-			headDiagnostics: input.headDiagnostics,
-			baseDiagnostics: baseOutput.diagnostics,
-			readHeadLine: createSourceLineReader(input.directory),
-			readBaseLine: createSourceLineReader(snapshot.tempDirectory),
-			readHeadEvidence: createDiagnosticEvidenceReader(input.directory, { resolveForwardedHandlers: true }),
-			readBaseEvidence: createDiagnosticEvidenceReader(snapshot.tempDirectory)
+			suppressRendering: input.options.suppressRendering,
+			supplyChainManifestChanged: input.options.supplyChainManifestChanged
+		}
+	});
+	return cacheKeyJson === null ? null : hashString(cacheKeyJson);
+};
+const createScanResultCache = (projectDirectory) => {
+	const cacheFilePath = resolveCacheFilePath(projectDirectory);
+	const persistedCache = readPersistedCache(cacheFilePath);
+	const entries = /* @__PURE__ */ new Map();
+	for (const entry of persistedCache.entries) entries.set(entry.key, entry);
+	const persist = () => {
+		const mergedEntries = /* @__PURE__ */ new Map();
+		for (const entry of readPersistedCache(cacheFilePath).entries) mergedEntries.set(entry.key, entry);
+		for (const entry of entries.values()) mergedEntries.set(entry.key, entry);
+		atomicWriteJson(cacheFilePath, {
+			version: 7,
+			entries: [...mergedEntries.values()].sort((firstEntry, secondEntry) => secondEntry.createdAtMs - firstEntry.createdAtMs).slice(0, 20)
 		});
-		return {
-			displayDiagnostics: diagnosticDelta.newDiagnostics,
-			baselineDelta: {
-				baseRef: input.baselineRef,
-				fixedCount: hasUnscannedUntrackedSourceFiles ? 0 : diagnosticDelta.fixedCount,
-				baseTotalCount: baseOutput.diagnostics.length,
-				crossFileMatchCount: diagnosticDelta.crossFileMatchCount
-			}
-		};
-	} finally {
-		snapshot.cleanup();
-	}
+	};
+	return {
+		lookup: (key) => {
+			const payload = entries.get(key)?.payload;
+			if (payload === void 0) return null;
+			return resolveProjectIdentity(payload.directory) === resolveProjectIdentity(projectDirectory) && (payload.manifestContentHash ?? null) === resolveManifestContentHash(projectDirectory) ? payload : null;
+		},
+		store: (key, payload) => {
+			entries.set(key, {
+				key,
+				createdAtMs: Date.now(),
+				payload: {
+					...payload,
+					manifestContentHash: resolveManifestContentHash(projectDirectory)
+				}
+			});
+			persist();
+		}
+	};
 };
 //#endregion
 //#region src/cli/utils/scan-result-cache-lifecycle.ts
-const createScanResultCacheLifecycle = (input) => {
-	const cacheKey = buildScanResultCacheKey({
+const createScanResultCacheLifecycle = async (input) => {
+	const cacheKey = await buildScanResultCacheKey({
 		projectDirectory: input.directory,
 		version: VERSION,
 		nodeBinaryPath: input.resolvedNodeBinaryPath,
@@ -2240,7 +2273,10 @@ const inspectWithOxlintRuntime = async (directory, inputOptions, oxlintRuntime)
 		userConfig = scanTarget.userConfig;
 		configSourceDirectory = scanTarget.configSourceDirectory;
 	}
-	const options = resolveInspectOptions(inputOptions, userConfig);
+	const options = resolveInspectOptions(path$1.resolve(directory) === path$1.resolve(scanDirectory) ? inputOptions : {
+		...inputOptions,
+		precomputedSourceFiles: void 0
+	}, userConfig);
 	const ownsSpinnerSilence = options.silent && !isConcurrentScan;
 	const wasSpinnerSilent = isSpinnerSilent();
 	if (ownsSpinnerSilence) setSpinnerSilent(true);
@@ -2264,9 +2300,10 @@ const inspectWithOxlintRuntime = async (directory, inputOptions, oxlintRuntime)
 	}
 };
 const createInvocationInspect = (requestedOxlintConcurrency) => {
-	const concurrency = resolveScanConcurrency(requestedOxlintConcurrency ?? runSync(OxlintConcurrency));
+	const concurrency = resolveInvocationOxlintConcurrency(requestedOxlintConcurrency);
 	const spawnSlots = createOxlintSpawnSlots(concurrency);
 	const scanResultCacheInvocationState = createScanResultCacheInvocationState();
+	const invocationCaches = createInvocationCaches();
 	return async (directory, inputOptions = {}) => {
 		const abortController = new AbortController();
 		const unregisterAbortController = activeScanAbortRegistry.register(abortController);
@@ -2275,7 +2312,8 @@ const createInvocationInspect = (requestedOxlintConcurrency) => {
 				concurrency,
 				spawnSlots,
 				abortSignal: abortController.signal,
-				scanResultCacheInvocationState
+				scanResultCacheInvocationState,
+				invocationCaches
 			});
 		} finally {
 			unregisterAbortController();
@@ -2288,7 +2326,7 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 	const resolvedNodeBinaryPath = await resolveOxlintNode(options.lint, options.scoreOnly || options.silent);
 	const lintBindingMissing = options.lint && !resolvedNodeBinaryPath;
 	await yieldToEventLoop();
-	const scanResultCacheLifecycle = createScanResultCacheLifecycle({
+	const scanResultCacheLifecycle = await createScanResultCacheLifecycle({
 		directory,
 		options,
 		userConfig,
@@ -2301,6 +2339,11 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 	});
 	const cachedResult = scanResultCacheLifecycle.replay();
 	if (cachedResult !== null) return cachedResult;
+	if (options.lint && resolvedNodeBinaryPath) warmOxlintWorkerPool(resolvedNodeBinaryPath, oxlintRuntime.concurrency);
+	if (options.deadCode && shouldUseMaintainabilityLayer({
+		shouldRunDuplicateJsx: options.deadCode,
+		userConfig
+	})) warmDuplicateJsxWorker();
 	const shouldShowProgressSpinners = !options.isCiOrCodingAgentEnvironment && !options.silent && !options.scoreOnly && !options.suppressRendering && options.lint && Boolean(resolvedNodeBinaryPath);
 	const layers = buildRuntimeLayers({
 		directory,
@@ -2314,12 +2357,14 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		shouldShowProgressSpinners,
 		oxlintConcurrency: oxlintRuntime.concurrency,
 		oxlintSpawnSlots: oxlintRuntime.spawnSlots,
+		invocationCaches: oxlintRuntime.invocationCaches,
 		reporterLayer: options.uiLayers?.reporter,
 		progressLayer: options.uiLayers?.progress
 	});
 	const program = runInspect({
 		directory,
 		precomputedSourceFileCount: options.precomputedSourceFileCount,
+		precomputedSourceFiles: options.precomputedSourceFiles,
 		includePaths: options.includePaths,
 		changedLineRanges: options.changedLineRanges ?? void 0,
 		customRulesOnly: options.customRulesOnly,
@@ -2431,12 +2476,12 @@ const deduplicateProjectScans = (projectScans) => {
 	return uniqueProjectScans;
 };
 //#endregion
-//#region src/cli/utils/collect-project-source-file-counts.ts
-const collectProjectSourceFileCounts = async (rootDirectory, projectDirectories) => {
+//#region src/cli/utils/collect-project-source-files.ts
+const collectProjectSourceFiles = async (rootDirectory, projectDirectories) => {
 	const abortController = new AbortController();
 	const unregisterAbortController = activeScanAbortRegistry.register(abortController);
 	try {
-		return await collectSourceFileCountsByDirectory(rootDirectory, projectDirectories, abortController.signal);
+		return await collectSourceFilesByDirectory(rootDirectory, projectDirectories, abortController.signal);
 	} finally {
 		unregisterAbortController();
 	}
@@ -2965,6 +3010,17 @@ const projectManifestChanged = (rootDirectory, projectDirectory, diffInfo) => {
 	return diffInfo.changedFiles.some((filePath) => toForwardSlashes(filePath) === manifestPath);
 };
 //#endregion
+//#region src/cli/utils/resolve-excluded-project-directories.ts
+const resolveExcludedProjectDirectories = (scanDirectory, projectDirectories) => {
+	const excludedDirectories = /* @__PURE__ */ new Map();
+	for (const projectDirectory of projectDirectories) {
+		if (!isPathInsideDirectory(projectDirectory, scanDirectory)) continue;
+		const resolvedDirectory = path$1.resolve(projectDirectory);
+		if (!excludedDirectories.has(resolvedDirectory)) excludedDirectories.set(resolvedDirectory, projectDirectory);
+	}
+	return [...excludedDirectories.values()];
+};
+//#endregion
 //#region src/cli/utils/validate-mode-flags.ts
 const usedDiffAlias = (flags) => flags.diff !== void 0 && flags.diff !== false && flags.diff !== "false" && flags.diff !== "";
 const usedScope = (flags) => typeof flags.scope === "string" && flags.scope.length > 0;
@@ -3002,7 +3058,7 @@ const shouldFailScanGate = (input) => {
 	return shouldBlockCi(filterScansForSurface(input.scans, "ciFailure"), input.blockingLevel);
 };
 //#endregion
-export { inspect as A, filterDiagnosticsByCategories as B, CLI_AGENT_BINARIES as C, collectProjectSourceFileCounts as D, buildHandoffPayload as E, formatElapsedTime as F, buildSortedRuleGroups as G, buildEmptyReportMessage as H, printFooter as I, formatFixRecipeLine as K, printDiagnosticsDump as L, printHeadlessReport as M, pluralize as N, deduplicateProjectScans as O, formatSkippedCheckLabel as P, formatDiagnosticSite as R, detectLaunchableAgents as S, launchCliAgent as T, hasLintHardFailure as U, buildNoScoreMessage as V, buildRulePriorityMap as W, resolveWorkspaceDeadCodeOwner as _, validateModeFlags as a, countUniqueScannedFiles as b, discoverWorkspacePackages as c, resolveProjectScan as d, resolveProjectChangedLineRanges as f, retryMissingProjectScores as g, resolveProjectRelativeDirectory as h, validateIncludeUntrackedScope as i, resolveMergeBaseRef as j, createInvocationInspect as k, selectProjects as l, resolveProjectSourceFilePaths as m, formatSkippedProjectsMessage as n, projectManifestChanged as o, resolveProjectDiffIncludePaths as p, formatLearnMoreLine as q, validateFilePathSelectionFlags as r, partitionProjectScanOutcomes as s, shouldFailScanGate as t, buildCodeFrame as u, resolveCliInspectOptions as v, copyToClipboard as w, setUpGitHubActions as x, filterScansForSurface as y, hasIncompleteScoreAnalysis as z };
+export { createInvocationInspect as A, hasIncompleteScoreAnalysis as B, detectLaunchableAgents as C, buildHandoffPayload as D, launchCliAgent as E, formatSkippedCheckLabel as F, hasLintHardFailure as G, buildNoScoreMessage as H, formatElapsedTime as I, formatFixRecipeLine as J, buildRulePriorityMap as K, printFooter as L, resolveMergeBaseRef as M, printHeadlessReport as N, collectProjectSourceFiles as O, pluralize as P, printDiagnosticsDump as R, setUpGitHubActions as S, copyToClipboard as T, buildEmptyReportMessage as U, filterDiagnosticsByCategories as V, resolveInvocationOxlintConcurrency as W, formatLearnMoreLine as Y, retryMissingProjectScores as _, validateModeFlags as a, filterScansForSurface as b, partitionProjectScanOutcomes as c, buildCodeFrame as d, resolveProjectScan as f, resolveProjectRelativeDirectory as g, resolveProjectSourceFilePaths as h, validateIncludeUntrackedScope as i, inspect as j, deduplicateProjectScans as k, discoverWorkspacePackages as l, resolveProjectDiffIncludePaths as m, formatSkippedProjectsMessage as n, resolveExcludedProjectDirectories as o, resolveProjectChangedLineRanges as p, buildSortedRuleGroups as q, validateFilePathSelectionFlags as r, projectManifestChanged as s, shouldFailScanGate as t, selectProjects as u, resolveWorkspaceDeadCodeOwner as v, CLI_AGENT_BINARIES as w, countUniqueScannedFiles as x, resolveCliInspectOptions as y, formatDiagnosticSite as z };
 
-//# sourceMappingURL=should-fail-scan-gate-CCPDoHaM.js.map
-//# debugId=a4d4a5ab-7608-5645-bd28-b9bb73993dfd
+//# sourceMappingURL=should-fail-scan-gate-B8cvpr6W.js.map
+//# debugId=bb74300d-38db-5b33-86a5-4ad923dfbe6a