react-doctor 0.9.3-dev.cc28626 → 0.9.3-dev.f958625

package/dist/cli.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e4075e6f-4128-5af6-bc97-656272450282")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2b3a9fe9-8109-5067-854f-a10b2e6454e7")}catch(e){}}();
 import { createRequire } from "node:module";
 import * as NodeChildProcess from "node:child_process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
@@ -6666,7 +6666,7 @@ const flatMap$5 = /* @__PURE__ */ dual(2, (self, f) => isNone(self) ? none() : f
 * @category filtering
 * @since 2.0.0
 */
-const filter = /* @__PURE__ */ dual(2, (self, predicate) => isNone(self) ? none() : predicate(self.value) ? some(self.value) : none());
+const filter$1 = /* @__PURE__ */ dual(2, (self, predicate) => isNone(self) ? none() : predicate(self.value) ? some(self.value) : none());
 //#endregion
 //#region ../../node_modules/.pnpm/effect@4.0.0-beta.70/node_modules/effect/dist/Result.js
 /**
@@ -18657,7 +18657,7 @@ function transformOptional(f) {
 */
 function withDefault$1(defaultValue) {
 	return new Getter((o) => {
-		const filtered = filter(o, isNotUndefined);
+		const filtered = filter$1(o, isNotUndefined);
 		return isSome(filtered) ? succeed$2(filtered) : mapEager(defaultValue, some);
 	});
 }
@@ -22505,6 +22505,10 @@ var JsonReportProjectEntryV3 = class extends Class("JsonReportProjectEntryV3")({
 	scannedFileCount: optional(Number$1),
 	elapsedMilliseconds: Number$1
 }) {};
+var JsonReportSkippedProject = class extends Class("JsonReportSkippedProject")({
+	directory: String$1,
+	reason: Literal("max-duration")
+}) {};
 /** Original full, diff, and staged report contract. */
 var JsonReportV1 = class extends Class("JsonReportV1")({
 	schemaVersion: Literal(1),
@@ -22533,6 +22537,7 @@ var JsonReportV1 = class extends Class("JsonReportV1")({
 	reactDetected: optional(Boolean$1),
 	diff: NullOr(JsonReportDiffInfo),
 	projects: ArraySchema(JsonReportProjectEntry),
+	skippedProjects: optional(ArraySchema(JsonReportSkippedProject)),
 	diagnostics: ArraySchema(Diagnostic),
 	summary: JsonReportSummary,
 	elapsedMilliseconds: Number$1,
@@ -22561,6 +22566,7 @@ var JsonReportV2 = class extends Class("JsonReportV2")({
 	diff: NullOr(JsonReportDiffInfo),
 	baseline: JsonReportBaseline,
 	projects: ArraySchema(JsonReportProjectEntry),
+	skippedProjects: optional(ArraySchema(JsonReportSkippedProject)),
 	diagnostics: ArraySchema(Diagnostic),
 	summary: JsonReportSummary,
 	elapsedMilliseconds: Number$1,
@@ -22577,6 +22583,7 @@ var JsonReportV3 = class extends Class("JsonReportV3")({
 	diff: NullOr(JsonReportDiffInfo),
 	baseline: optional(JsonReportBaseline),
 	projects: ArraySchema(JsonReportProjectEntryV3),
+	skippedProjects: optional(ArraySchema(JsonReportSkippedProject)),
 	diagnostics: ArraySchema(JsonReportDiagnosticV3),
 	summary: JsonReportSummary,
 	elapsedMilliseconds: Number$1,
@@ -56559,6 +56566,47 @@ const flattenArray = (self) => transformPull$1(self, (pull) => {
 	}));
 });
 /**
+* Filters arrays of elements emitted by a channel, applying the filter
+* to each element within the arrays and only emitting non-empty filtered arrays.
+*
+* **Example** (Filtering array output)
+*
+* ```ts
+* import { Array, Channel } from "effect"
+*
+* const nonEmptyArrayPredicate = Array.isReadonlyArrayNonEmpty
+*
+* // Create a channel that outputs arrays of mixed data
+* const arrayChannel = Channel.fromIterable([
+*   Array.make(1, 2, 3, 4, 5),
+*   Array.make(6, 7, 8, 9, 10),
+*   Array.make(11, 12, 13, 14, 15)
+* ]).pipe(Channel.filter(nonEmptyArrayPredicate))
+*
+* // Filter arrays to keep only even numbers
+* const evenArraysChannel = Channel.filterArray(arrayChannel, (n) => n % 2 === 0)
+* // Outputs: [2, 4], [6, 8, 10], [12, 14]
+* // Note: Only non-empty filtered arrays are emitted
+*
+* // Arrays that would become empty after filtering are discarded entirely
+* const oddChannel = Channel.fromIterable([
+*   Array.make(1, 3, 5),
+*   Array.make(2, 4),
+*   Array.make(7, 9)
+* ]).pipe(Channel.filter(nonEmptyArrayPredicate))
+* const filteredOddChannel = Channel.filterArray(oddChannel, (n) => n % 2 === 0)
+* // Outputs: [2, 4] (the arrays [1,3,5] and [7,9] are discarded)
+* ```
+*
+* @category filtering
+* @since 4.0.0
+*/
+const filterArray = /* @__PURE__ */ dual(2, (self, predicate) => transformPull$1(self, (pull) => succeed$2(flatMap$2(pull, function loop(arr) {
+	const passes = [];
+	for (let i = 0; i < arr.length; i++) if (predicate(arr[i])) passes.push(arr[i]);
+	return isReadonlyArrayNonEmpty(passes) ? succeed$2(passes) : flatMap$2(pull, loop);
+}))));
+/**
 * Filters and maps each element inside emitted non-empty arrays using a
 * `Filter`.
 *
@@ -58196,6 +58244,30 @@ const concat = /* @__PURE__ */ dual(2, (self, that) => flatten(fromArray([self,
 */
 const merge$1 = /* @__PURE__ */ dual((args) => isStream(args[0]) && isStream(args[1]), (self, that, options) => fromChannel(merge$2(toChannel(self), toChannel(that), options)));
 /**
+* Filters a stream to the elements that satisfy a predicate.
+*
+* **Example** (Filtering stream values)
+*
+* ```ts
+* import { Console, Effect, Stream } from "effect"
+*
+* const program = Effect.gen(function*() {
+*   const stream = Stream.make(1, 2, 3, 4).pipe(
+*     Stream.filter((n) => n % 2 === 0)
+*   )
+*   const values = yield* Stream.runCollect(stream)
+*   yield* Console.log(values)
+* })
+*
+* Effect.runPromise(program)
+* // Output: [ 2, 4 ]
+* ```
+*
+* @category filtering
+* @since 2.0.0
+*/
+const filter = /* @__PURE__ */ dual(2, (self, predicate) => fromChannel(filterArray(toChannel(self), predicate)));
+/**
 * Filters and maps stream elements in one pass using a `Filter`.
 *
 * @category filtering
@@ -65046,6 +65118,7 @@ const GENERATED_BUNDLE_FILE_PATTERN = /\.(iife|umd|global|min)\.m?js$/i;
 const GENERATED_SOURCE_DIRECTORY_PATTERN = /(?:^|\/)__generated__\//;
 const MINIFIED_SNIFF_BYTES = 65536;
 const GIT_LS_FILES_MAX_BUFFER_BYTES = 50 * 1024 * 1024;
+const GIT_CHECK_ATTR_MAX_BUFFER_BYTES = GIT_LS_FILES_MAX_BUFFER_BYTES;
 const SCANNED_DOT_DIRECTORIES = new Set([".dumi", ".storybook"]);
 const IGNORED_DIRECTORIES = new Set([
 	".angular",
@@ -65365,13 +65438,9 @@ const DEAD_CODE_WORKER_TIMEOUT_MS = 12e4;
 const OXLINT_SPLIT_TOTAL_BUDGET_MS = 18e4;
 const ABORT_EXIT_CODES = new Set([134, 3221226505]);
 const OXLINT_OOM_RESCUE_BUDGET_MS = 6e4;
-const DEAD_CODE_PHASE_TIMEOUT_MS = 15e4;
-const LINT_PHASE_TIMEOUT_MS = 3e5;
-const SCAN_TOTAL_DEADLINE_MS = 9e5;
 const DEAD_CODE_WORKER_MAX_OLD_SPACE_MB = 8192;
 const DEAD_CODE_WORKER_MEM_BUDGET_BYTES = 2 * 1024 * 1024 * 1024;
 const DEAD_CODE_TIMEOUT_CEILING_MS = 6e5;
-const DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS = 3e4;
 const DEAD_CODE_OVERLAP_PARSE_SHARE = .4;
 const RECOMMENDED_PNPM_MINIMUM_RELEASE_AGE_MINUTES = 10080;
 const REACT_SERVER_DOM_PACKAGES = [
@@ -65467,6 +65536,66 @@ const isPlainObject = (value) => {
 	const prototype = Object.getPrototypeOf(value);
 	return prototype === null || prototype === Object.prototype;
 };
+const LINGUIST_ATTRIBUTES = ["linguist-generated", "linguist-vendored"];
+const DISABLED_ATTRIBUTE_VALUES = new Set([
+	"unspecified",
+	"unset",
+	"false",
+	"0",
+	"off",
+	"no"
+]);
+const buildInput = (relativePaths) => `${relativePaths.join("\0")}\0`;
+const parseIgnoredPaths = (output) => {
+	const ignoredPaths = /* @__PURE__ */ new Set();
+	const fields = output.split("\0");
+	for (let fieldIndex = 0; fieldIndex + 2 < fields.length; fieldIndex += 3) {
+		const filePath = fields[fieldIndex];
+		const value = fields[fieldIndex + 2]?.toLowerCase();
+		if (filePath && value && !DISABLED_ATTRIBUTE_VALUES.has(value)) ignoredPaths.add(filePath);
+	}
+	return ignoredPaths;
+};
+const collectGitLinguistIgnoredPaths = (rootDirectory, relativePaths) => {
+	if (relativePaths.length === 0) return /* @__PURE__ */ new Set();
+	const result = spawnSync("git", [
+		"check-attr",
+		"-z",
+		"--stdin",
+		...LINGUIST_ATTRIBUTES
+	], {
+		cwd: rootDirectory,
+		encoding: "utf-8",
+		input: buildInput(relativePaths),
+		maxBuffer: GIT_CHECK_ATTR_MAX_BUFFER_BYTES
+	});
+	if (result.error || result.status !== 0) return /* @__PURE__ */ new Set();
+	return parseIgnoredPaths(result.stdout);
+};
+const collectGitLinguistIgnoredPathsCooperative = (rootDirectory, relativePaths, signal) => {
+	if (relativePaths.length === 0) return Promise.resolve(/* @__PURE__ */ new Set());
+	return new Promise((resolve, reject) => {
+		signal?.throwIfAborted();
+		execFile("git", [
+			"check-attr",
+			"-z",
+			"--stdin",
+			...LINGUIST_ATTRIBUTES
+		], {
+			cwd: rootDirectory,
+			encoding: "utf-8",
+			killSignal: "SIGKILL",
+			maxBuffer: GIT_CHECK_ATTR_MAX_BUFFER_BYTES,
+			signal
+		}, (error, stdout) => {
+			if (signal?.aborted) {
+				reject(signal.reason);
+				return;
+			}
+			resolve(error ? /* @__PURE__ */ new Set() : parseIgnoredPaths(stdout));
+		}).stdin?.end(buildInput(relativePaths));
+	});
+};
 const lastSourceMappingUrl = (fileContent) => {
 	const lastReference = [...fileContent.matchAll(/\/\/# sourceMappingURL=(\S+)/g)].at(-1);
 	return lastReference ? lastReference[1] : null;
@@ -65568,6 +65697,9 @@ function* walkSourceTreeFiles(rootDirectory) {
 		}
 	}
 }
+const yieldToEventLoop = () => new Promise((resolve) => {
+	setImmediate(resolve);
+});
 const collectSizedSourceFiles = (rootDirectory, relativePaths) => {
 	const entries = [];
 	for (const relativePath of relativePaths) {
@@ -65581,23 +65713,55 @@ const collectSizedSourceFiles = (rootDirectory, relativePaths) => {
 	}
 	return entries;
 };
-const gitLsFiles = (rootDirectory, flags) => {
+const collectSizedSourceFilesCooperative = async (rootDirectory, relativePaths, signal) => {
+	const entries = [];
+	let sliceStartedAt = performance.now();
+	for (const relativePath of relativePaths) {
+		signal?.throwIfAborted();
+		const absolutePath = Path.resolve(rootDirectory, relativePath);
+		const sizeBytes = statSourceFileSize(absolutePath);
+		if (!isLargeMinifiedFile(absolutePath, sizeBytes)) entries.push({
+			path: relativePath,
+			sizeBytes: sizeBytes ?? 0
+		});
+		if (performance.now() - sliceStartedAt >= 12) {
+			await yieldToEventLoop();
+			sliceStartedAt = performance.now();
+		}
+	}
+	return entries;
+};
+const parseGitSourceFilePaths = (output) => {
+	const trackedPaths = /* @__PURE__ */ new Set();
+	const untrackedPaths = [];
+	for (const entry of output.split("\0")) {
+		if (entry.length === 0) continue;
+		const trackedPath = /^[0-7]{6} [0-9a-f]+ [0-3]\t([\s\S]+)$/.exec(entry)?.[1];
+		if (trackedPath === void 0) untrackedPaths.push(entry);
+		else trackedPaths.add(trackedPath);
+	}
+	return {
+		trackedPaths: [...trackedPaths],
+		untrackedPaths
+	};
+};
+const listGitSourceFilePaths = (rootDirectory) => {
 	const result = spawnSync("git", [
 		"ls-files",
 		"-z",
-		...flags
+		"--stage",
+		"--others",
+		"--exclude-standard"
 	], {
 		cwd: rootDirectory,
 		encoding: "utf-8",
 		maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES
 	});
 	if (result.error || result.status !== 0) return null;
-	return result.stdout.split("\0").filter((filePath) => filePath.length > 0);
+	return parseGitSourceFilePaths(result.stdout);
 };
-const listSourceFilesViaGit = (rootDirectory) => {
-	const trackedPaths = gitLsFiles(rootDirectory, ["--cached"]);
-	const untrackedPaths = gitLsFiles(rootDirectory, ["--others", "--exclude-standard"]);
-	if (trackedPaths === null || untrackedPaths === null) return null;
+const collectGitCandidateSourceFilePaths = (rootDirectory, paths) => {
+	const { trackedPaths, untrackedPaths } = paths;
 	const emitDuplicateJsPaths = collectTypeScriptEmitDuplicateJsPaths({
 		trackedPaths: new Set(trackedPaths),
 		untrackedPaths,
@@ -65605,12 +65769,65 @@ const listSourceFilesViaGit = (rootDirectory) => {
 	});
 	return [...trackedPaths, ...untrackedPaths].filter((filePath) => isLintableSourceFile(filePath) && !hasIgnoredPathSegment(filePath) && !emitDuplicateJsPaths.has(filePath));
 };
+const filterGitSourceFilePaths = (rootDirectory, paths) => {
+	const candidatePaths = collectGitCandidateSourceFilePaths(rootDirectory, paths);
+	const linguistIgnoredPaths = collectGitLinguistIgnoredPaths(rootDirectory, candidatePaths);
+	return candidatePaths.filter((filePath) => !linguistIgnoredPaths.has(filePath));
+};
+const listSourceFilesViaGit = (rootDirectory) => {
+	const paths = listGitSourceFilePaths(rootDirectory);
+	return paths === null ? null : filterGitSourceFilePaths(rootDirectory, paths);
+};
+const listSourceFilesViaGitCooperative = async (rootDirectory, signal) => {
+	const paths = await new Promise((resolve, reject) => {
+		signal?.throwIfAborted();
+		execFile("git", [
+			"ls-files",
+			"-z",
+			"--stage",
+			"--others",
+			"--exclude-standard"
+		], {
+			cwd: rootDirectory,
+			encoding: "utf-8",
+			killSignal: "SIGKILL",
+			maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES,
+			signal
+		}, (error, stdout) => {
+			if (signal?.aborted) {
+				reject(signal.reason);
+				return;
+			}
+			resolve(error ? null : parseGitSourceFilePaths(stdout));
+		});
+	});
+	if (paths === null) return null;
+	const candidatePaths = collectGitCandidateSourceFilePaths(rootDirectory, paths);
+	const linguistIgnoredPaths = await collectGitLinguistIgnoredPathsCooperative(rootDirectory, candidatePaths, signal);
+	return candidatePaths.filter((filePath) => !linguistIgnoredPaths.has(filePath));
+};
 const listSourceFilesViaFilesystem = (rootDirectory) => {
 	const filePaths = [];
 	for (const { absolutePath, name } of walkSourceTreeFiles(rootDirectory)) if (isLintableSourceFile(name)) filePaths.push(Path.relative(rootDirectory, absolutePath).replace(/\\/g, "/"));
 	return filePaths;
 };
-const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, (listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory)).sort());
+const listSourceFilesViaFilesystemCooperative = async (rootDirectory, signal) => {
+	const filePaths = [];
+	let sliceStartedAt = performance.now();
+	for (const { absolutePath, name } of walkSourceTreeFiles(rootDirectory)) {
+		signal?.throwIfAborted();
+		if (isLintableSourceFile(name)) filePaths.push(Path.relative(rootDirectory, absolutePath).replace(/\\/g, "/"));
+		if (performance.now() - sliceStartedAt >= 12) {
+			await yieldToEventLoop();
+			sliceStartedAt = performance.now();
+		}
+	}
+	return filePaths;
+};
+const listSourceFilePaths = (rootDirectory) => (listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory)).sort();
+const listSourceFilePathsCooperative = async (rootDirectory, signal) => (await listSourceFilesViaGitCooperative(rootDirectory, signal) ?? await listSourceFilesViaFilesystemCooperative(rootDirectory, signal)).sort();
+const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, listSourceFilePaths(rootDirectory));
+const listSourceFilesCooperative = async (rootDirectory, signal) => (await collectSizedSourceFilesCooperative(rootDirectory, await listSourceFilePathsCooperative(rootDirectory, signal), signal)).map((entry) => entry.path);
 const listSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).map((entry) => entry.path);
 const countSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).length;
 const UTF8_BOM_CHARACTER = "";
@@ -67185,13 +67402,7 @@ const hasReactDependency = (packageJson) => {
 	};
 	return Object.keys(allDependencies).some((packageName) => REACT_DEPENDENCY_NAMES.has(packageName));
 };
-const getPreactVersion = (packageJson) => {
-	return {
-		...packageJson.peerDependencies,
-		...packageJson.dependencies,
-		...packageJson.devDependencies
-	}.preact ?? null;
-};
+const getPreactVersion = (packageJson) => getDependencySpec(packageJson, "preact");
 const resolveCatalogBackedDependencyVersion = ({ rootDirectory, rootPackageJson, packageName, sourceDirectory = rootDirectory, sourcePackageJson = rootPackageJson, version }) => {
 	if (version === null || !isCatalogReference(version)) return version;
 	const catalogName = extractCatalogName(version);
@@ -67933,7 +68144,16 @@ const getBrowserslistProtectionRequirement = (directory) => {
 		if (!queries) return void 0;
 		let requirement;
 		let hasUnsupportedTarget = false;
-		for (const browserTarget of (0, import_browserslist.default)(queries)) {
+		const previousIgnoreOldData = process.env.BROWSERSLIST_IGNORE_OLD_DATA;
+		let browserTargets = [];
+		try {
+			process.env.BROWSERSLIST_IGNORE_OLD_DATA = "true";
+			browserTargets = (0, import_browserslist.default)(queries);
+		} finally {
+			if (previousIgnoreOldData === void 0) delete process.env.BROWSERSLIST_IGNORE_OLD_DATA;
+			else process.env.BROWSERSLIST_IGNORE_OLD_DATA = previousIgnoreOldData;
+		}
+		for (const browserTarget of browserTargets) {
 			const browserRequirement = getBrowserProtectionRequirement(browserTarget);
 			if (browserRequirement === "unsupported") hasUnsupportedTarget = true;
 			if (browserRequirement === "noreferrer") requirement = "noreferrer";
@@ -68039,9 +68259,9 @@ const cachedProjectInfos = /* @__PURE__ */ new Map();
 * framework-agnostic rules. Throws only when the directory has nothing
 * to scan (no enclosing project and no source files of its own).
 */
-const discoverProjectWithoutPackageJson = (directory) => {
-	const sourceFileCount = countSourceFiles(directory);
-	const hasOwnTsConfig = NFS.existsSync(Path.join(directory, "tsconfig.json"));
+const discoverProjectWithoutPackageJson = (directory, options) => {
+	const sourceFileCount = options.sourceFileCount ?? countSourceFiles(directory);
+	const hasOwnTsConfig = isFile(Path.join(directory, "tsconfig.json"));
 	const enclosingProjectRoot = findNearestAncestorPackageJson(directory);
 	const enclosingProject = enclosingProjectRoot !== null ? discoverProject(enclosingProjectRoot) : null;
 	if (enclosingProject !== null) return {
@@ -68107,12 +68327,15 @@ const discoverProjectWithoutPackageJson = (directory) => {
 		sourceFileCount
 	};
 };
-const discoverProject = (directory) => {
+const discoverProject = (directory, options = {}) => {
 	const cached = cachedProjectInfos.get(directory);
-	if (cached !== void 0) return cached;
+	if (cached !== void 0) return options.sourceFileCount === void 0 ? cached : {
+		...cached,
+		sourceFileCount: options.sourceFileCount
+	};
 	const packageJsonPath = Path.join(directory, "package.json");
 	if (!isFile(packageJsonPath)) {
-		const synthesized = discoverProjectWithoutPackageJson(directory);
+		const synthesized = discoverProjectWithoutPackageJson(directory, options);
 		cachedProjectInfos.set(directory, synthesized);
 		return synthesized;
 	}
@@ -68174,8 +68397,8 @@ const discoverProject = (directory) => {
 	const tailwindVersion = tailwindcss.version;
 	const zodVersion = zod.version;
 	const projectName = packageJson.name ?? Path.basename(directory);
-	const hasTypeScript = NFS.existsSync(Path.join(directory, "tsconfig.json"));
-	const sourceFileCount = countSourceFiles(directory);
+	const hasTypeScript = isFile(Path.join(directory, "tsconfig.json"));
+	const sourceFileCount = options.sourceFileCount ?? countSourceFiles(directory);
 	const hasReactNativeWorkspace = framework === "expo" || framework === "react-native" || workspaceFacts.hasReactNativeAwarePackage;
 	const expoVersion = hasReactNativeWorkspace ? resolveCatalogBackedDependencyVersion({
 		rootDirectory: directory,
@@ -68304,6 +68527,155 @@ const discoverProject = (directory) => {
 * single source file has nothing to analyze.
 */
 const isAnalyzableProject = (project) => project.reactVersion !== null || project.preactVersion !== null || project.sourceFileCount > 0;
+const LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY = {
+	"effect/no-adjust-state-on-prop-change": "react-doctor/no-adjust-state-on-prop-change",
+	"effect/no-chain-state-updates": "react-doctor/no-chain-state-updates",
+	"effect/no-derived-state": "react-doctor/no-derived-state",
+	"effect/no-event-handler": "react-doctor/no-event-handler",
+	"effect/no-initialize-state": "react-doctor/no-initialize-state",
+	"effect/no-pass-data-to-parent": "react-doctor/no-pass-data-to-parent",
+	"effect/no-pass-live-state-to-parent": "react-doctor/no-pass-live-state-to-parent",
+	"effect/no-reset-all-state-on-prop-change": "react-doctor/no-reset-all-state-on-prop-change",
+	"jsx-a11y/alt-text": "react-doctor/alt-text",
+	"jsx-a11y/anchor-ambiguous-text": "react-doctor/anchor-ambiguous-text",
+	"jsx-a11y/anchor-has-content": "react-doctor/anchor-has-content",
+	"jsx-a11y/anchor-is-valid": "react-doctor/anchor-is-valid",
+	"jsx-a11y/aria-activedescendant-has-tabindex": "react-doctor/aria-activedescendant-has-tabindex",
+	"jsx-a11y/aria-props": "react-doctor/aria-props",
+	"jsx-a11y/aria-proptypes": "react-doctor/aria-proptypes",
+	"jsx-a11y/aria-role": "react-doctor/aria-role",
+	"jsx-a11y/aria-unsupported-elements": "react-doctor/aria-unsupported-elements",
+	"jsx-a11y/autocomplete-valid": "react-doctor/autocomplete-valid",
+	"jsx-a11y/click-events-have-key-events": "react-doctor/click-events-have-key-events",
+	"jsx-a11y/control-has-associated-label": "react-doctor/control-has-associated-label",
+	"jsx-a11y/heading-has-content": "react-doctor/heading-has-content",
+	"jsx-a11y/html-has-lang": "react-doctor/html-has-lang",
+	"jsx-a11y/iframe-has-title": "react-doctor/iframe-has-title",
+	"jsx-a11y/img-redundant-alt": "react-doctor/img-redundant-alt",
+	"jsx-a11y/interactive-supports-focus": "react-doctor/interactive-supports-focus",
+	"jsx-a11y/label-has-associated-control": "react-doctor/label-has-associated-control",
+	"jsx-a11y/lang": "react-doctor/lang",
+	"jsx-a11y/media-has-caption": "react-doctor/media-has-caption",
+	"jsx-a11y/mouse-events-have-key-events": "react-doctor/mouse-events-have-key-events",
+	"jsx-a11y/no-access-key": "react-doctor/no-access-key",
+	"jsx-a11y/no-aria-hidden-on-focusable": "react-doctor/no-aria-hidden-on-focusable",
+	"jsx-a11y/no-autofocus": "react-doctor/no-autofocus",
+	"jsx-a11y/no-distracting-elements": "react-doctor/no-distracting-elements",
+	"jsx-a11y/no-interactive-element-to-noninteractive-role": "react-doctor/no-interactive-element-to-noninteractive-role",
+	"jsx-a11y/no-noninteractive-element-interactions": "react-doctor/no-noninteractive-element-interactions",
+	"jsx-a11y/no-noninteractive-element-to-interactive-role": "react-doctor/no-noninteractive-element-to-interactive-role",
+	"jsx-a11y/no-noninteractive-tabindex": "react-doctor/no-noninteractive-tabindex",
+	"jsx-a11y/no-redundant-roles": "react-doctor/no-redundant-roles",
+	"jsx-a11y/no-static-element-interactions": "react-doctor/no-static-element-interactions",
+	"jsx-a11y/prefer-tag-over-role": "react-doctor/prefer-tag-over-role",
+	"jsx-a11y/role-has-required-aria-props": "react-doctor/role-has-required-aria-props",
+	"jsx-a11y/role-supports-aria-props": "react-doctor/role-supports-aria-props",
+	"jsx-a11y/scope": "react-doctor/scope",
+	"jsx-a11y/tabindex-no-positive": "react-doctor/tabindex-no-positive",
+	"react-hooks/exhaustive-deps": "react-doctor/exhaustive-deps",
+	"react-hooks/rules-of-hooks": "react-doctor/rules-of-hooks",
+	"react-perf/jsx-no-jsx-as-prop": "react-doctor/jsx-no-jsx-as-prop",
+	"react-perf/jsx-no-new-array-as-prop": "react-doctor/jsx-no-new-array-as-prop",
+	"react-perf/jsx-no-new-function-as-prop": "react-doctor/jsx-no-new-function-as-prop",
+	"react-perf/jsx-no-new-object-as-prop": "react-doctor/jsx-no-new-object-as-prop",
+	"react-refresh/only-export-components": "react-doctor/only-export-components",
+	"react/button-has-type": "react-doctor/button-has-type",
+	"react/checked-requires-onchange-or-readonly": "react-doctor/checked-requires-onchange-or-readonly",
+	"react/display-name": "react-doctor/display-name",
+	"react/exhaustive-deps": "react-doctor/exhaustive-deps",
+	"react/forbid-component-props": "react-doctor/forbid-component-props",
+	"react/forbid-dom-props": "react-doctor/forbid-dom-props",
+	"react/forbid-elements": "react-doctor/forbid-elements",
+	"react/forward-ref-uses-ref": "react-doctor/forward-ref-uses-ref",
+	"react/hook-use-state": "react-doctor/hook-use-state",
+	"react/iframe-missing-sandbox": "react-doctor/iframe-missing-sandbox",
+	"react/jsx-boolean-value": "react-doctor/jsx-boolean-value",
+	"react/jsx-curly-brace-presence": "react-doctor/jsx-curly-brace-presence",
+	"react/jsx-filename-extension": "react-doctor/jsx-filename-extension",
+	"react/jsx-fragments": "react-doctor/jsx-fragments",
+	"react/jsx-handler-names": "react-doctor/jsx-handler-names",
+	"react/jsx-key": "react-doctor/jsx-key",
+	"react/jsx-max-depth": "react-doctor/jsx-max-depth",
+	"react/jsx-no-comment-textnodes": "react-doctor/jsx-no-comment-textnodes",
+	"react/jsx-no-constructed-context-values": "react-doctor/jsx-no-constructed-context-values",
+	"react/jsx-no-duplicate-props": "react-doctor/jsx-no-duplicate-props",
+	"react/jsx-no-jsx-as-prop": "react-doctor/jsx-no-jsx-as-prop",
+	"react/jsx-no-new-array-as-prop": "react-doctor/jsx-no-new-array-as-prop",
+	"react/jsx-no-new-function-as-prop": "react-doctor/jsx-no-new-function-as-prop",
+	"react/jsx-no-new-object-as-prop": "react-doctor/jsx-no-new-object-as-prop",
+	"react/jsx-no-script-url": "react-doctor/jsx-no-script-url",
+	"react/jsx-no-undef": "react-doctor/jsx-no-undef",
+	"react/jsx-no-useless-fragment": "react-doctor/jsx-no-useless-fragment",
+	"react/jsx-pascal-case": "react-doctor/jsx-pascal-case",
+	"react/jsx-props-no-spread-multi": "react-doctor/jsx-props-no-spread-multi",
+	"react/jsx-props-no-spreading": "react-doctor/jsx-props-no-spreading",
+	"react/no-array-index-key": "react-doctor/no-array-index-key",
+	"react/no-children-prop": "react-doctor/no-children-prop",
+	"react/no-clone-element": "react-doctor/no-clone-element",
+	"react/no-danger": "react-doctor/no-danger",
+	"react/no-danger-with-children": "react-doctor/no-danger-with-children",
+	"react/no-did-mount-set-state": "react-doctor/no-did-mount-set-state",
+	"react/no-did-update-set-state": "react-doctor/no-did-update-set-state",
+	"react/no-direct-mutation-state": "react-doctor/no-direct-mutation-state",
+	"react/no-find-dom-node": "react-doctor/no-find-dom-node",
+	"react/no-is-mounted": "react-doctor/no-is-mounted",
+	"react/no-multi-comp": "react-doctor/no-multi-comp",
+	"react/no-namespace": "react-doctor/no-namespace",
+	"react/no-react-children": "react-doctor/no-react-children",
+	"react/no-redundant-should-component-update": "react-doctor/no-redundant-should-component-update",
+	"react/no-render-return-value": "react-doctor/no-render-return-value",
+	"react/no-set-state": "react-doctor/no-set-state",
+	"react/no-string-refs": "react-doctor/no-string-refs",
+	"react/no-this-in-sfc": "react-doctor/no-this-in-sfc",
+	"react/no-unescaped-entities": "react-doctor/no-unescaped-entities",
+	"react/no-unknown-property": "react-doctor/no-unknown-property",
+	"react/no-unsafe": "react-doctor/no-unsafe",
+	"react/no-unstable-nested-components": "react-doctor/no-unstable-nested-components",
+	"react/no-will-update-set-state": "react-doctor/no-will-update-set-state",
+	"react/only-export-components": "react-doctor/only-export-components",
+	"react/prefer-es6-class": "react-doctor/prefer-es6-class",
+	"react/prefer-function-component": "react-doctor/prefer-function-component",
+	"react/react-in-jsx-scope": "react-doctor/react-in-jsx-scope",
+	"react/require-render-return": "react-doctor/require-render-return",
+	"react/rules-of-hooks": "react-doctor/rules-of-hooks",
+	"react/self-closing-comp": "react-doctor/self-closing-comp",
+	"react/state-in-constructor": "react-doctor/state-in-constructor",
+	"react/style-prop-object": "react-doctor/style-prop-object",
+	"react/void-dom-elements-no-children": "react-doctor/void-dom-elements-no-children"
+};
+const NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS = /* @__PURE__ */ new Map();
+for (const [legacyRuleKey, nativeRuleKey] of Object.entries(LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY)) {
+	const aliases = NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS.get(nativeRuleKey) ?? [];
+	aliases.push(legacyRuleKey);
+	NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS.set(nativeRuleKey, aliases);
+}
+const getLegacyRuleKeysForNative = (ruleKey) => NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS.get(ruleKey) ?? [];
+const REACT_DOCTOR_RULE_KEY_PREFIX = "react-doctor/";
+const canonicalizeRuleKey = (ruleKey) => {
+	const nativeRuleKey = LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY[ruleKey];
+	return typeof nativeRuleKey === "string" ? nativeRuleKey : ruleKey;
+};
+const isReactDoctorShortIdOf = (bareRuleKey, qualifiedRuleKey) => !bareRuleKey.includes("/") && qualifiedRuleKey === `react-doctor/${bareRuleKey}`;
+/**
+* Canonicalizes a rule key as users write it in config: a legacy alias
+* (`react/jsx-key`) maps to its native key, and a bare short id (`no-eval`)
+* qualifies as `react-doctor/<id>` — mirroring `isSameRuleKey`'s matching —
+* so telemetry groups every spelling of one rule under one key.
+*/
+const canonicalizeUserRuleKey = (ruleKey) => {
+	const nativeRuleKey = canonicalizeRuleKey(ruleKey);
+	return nativeRuleKey.includes("/") ? nativeRuleKey : `${REACT_DOCTOR_RULE_KEY_PREFIX}${nativeRuleKey}`;
+};
+const isSameRuleKey = (candidateRuleKey, targetRuleKey) => {
+	const canonicalCandidate = canonicalizeRuleKey(candidateRuleKey);
+	const canonicalTarget = canonicalizeRuleKey(targetRuleKey);
+	if (canonicalCandidate === canonicalTarget) return true;
+	return isReactDoctorShortIdOf(canonicalCandidate, canonicalTarget) || isReactDoctorShortIdOf(canonicalTarget, canonicalCandidate);
+};
+const getEquivalentRuleKeys = (ruleKey) => {
+	const nativeRuleKey = canonicalizeRuleKey(ruleKey);
+	return [nativeRuleKey, ...getLegacyRuleKeysForNative(nativeRuleKey)];
+};
 const messageFromUnknown = (error) => error instanceof Error ? error.message : String(error);
 var InvalidGlobPatternError = class extends Error {
 	pattern;
@@ -68357,6 +68729,11 @@ const warnConfigIssue = (message) => {
 };
 const isStringArray = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string");
 const collectStringList = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+const hasMatchingRuleOverride = (ruleIds, ruleIdentifier) => {
+	if (ruleIds.size === 0) return true;
+	for (const ruleId of ruleIds) if (isSameRuleKey(ruleId, ruleIdentifier)) return true;
+	return false;
+};
 const validateOverrideEntry = (entry, index) => {
 	if (!isPlainObject(entry)) {
 		warnConfigIssue(`ignore.overrides[${index}] must be an object with { files, rules }; ignoring this entry.`);
@@ -68397,7 +68774,7 @@ const isDiagnosticIgnoredByOverrides = (diagnostic, rootDirectory, overrides) =>
 	if (overrides.length === 0) return false;
 	const relativeFilePath = toRelativePath(diagnostic.filePath, rootDirectory);
 	const ruleIdentifier = `${diagnostic.plugin}/${diagnostic.rule}`;
-	return overrides.some((override) => override.filePatterns.some((pattern) => pattern.test(relativeFilePath)) && (override.ruleIds.size === 0 || override.ruleIds.has(ruleIdentifier)));
+	return overrides.some((override) => override.filePatterns.some((pattern) => pattern.test(relativeFilePath)) && hasMatchingRuleOverride(override.ruleIds, ruleIdentifier));
 };
 const SEVERITY_FOR_OVERRIDE = {
 	error: "error",
@@ -68432,155 +68809,6 @@ const buildRuleSeverityControls = (config) => {
 const FOREIGN_INLINE_DISABLE_PATTERN = /(?:\/\/|\/\*)[ \t]*(eslint|oxlint)-disable-(next-line|line)(?![\w-])([^\r\n]*)/;
 const FOREIGN_BLOCK_DISABLE_PATTERN = /\/\*[ \t]*(eslint|oxlint)-disable(?![\w-])([^*\r\n]*)/;
 const FOREIGN_BLOCK_ENABLE_PATTERN = /\/\*[ \t]*(?:eslint|oxlint)-enable(?![\w-])([^*\r\n]*)/;
-const LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY = {
-	"effect/no-adjust-state-on-prop-change": "react-doctor/no-adjust-state-on-prop-change",
-	"effect/no-chain-state-updates": "react-doctor/no-chain-state-updates",
-	"effect/no-derived-state": "react-doctor/no-derived-state",
-	"effect/no-event-handler": "react-doctor/no-event-handler",
-	"effect/no-initialize-state": "react-doctor/no-initialize-state",
-	"effect/no-pass-data-to-parent": "react-doctor/no-pass-data-to-parent",
-	"effect/no-pass-live-state-to-parent": "react-doctor/no-pass-live-state-to-parent",
-	"effect/no-reset-all-state-on-prop-change": "react-doctor/no-reset-all-state-on-prop-change",
-	"jsx-a11y/alt-text": "react-doctor/alt-text",
-	"jsx-a11y/anchor-ambiguous-text": "react-doctor/anchor-ambiguous-text",
-	"jsx-a11y/anchor-has-content": "react-doctor/anchor-has-content",
-	"jsx-a11y/anchor-is-valid": "react-doctor/anchor-is-valid",
-	"jsx-a11y/aria-activedescendant-has-tabindex": "react-doctor/aria-activedescendant-has-tabindex",
-	"jsx-a11y/aria-props": "react-doctor/aria-props",
-	"jsx-a11y/aria-proptypes": "react-doctor/aria-proptypes",
-	"jsx-a11y/aria-role": "react-doctor/aria-role",
-	"jsx-a11y/aria-unsupported-elements": "react-doctor/aria-unsupported-elements",
-	"jsx-a11y/autocomplete-valid": "react-doctor/autocomplete-valid",
-	"jsx-a11y/click-events-have-key-events": "react-doctor/click-events-have-key-events",
-	"jsx-a11y/control-has-associated-label": "react-doctor/control-has-associated-label",
-	"jsx-a11y/heading-has-content": "react-doctor/heading-has-content",
-	"jsx-a11y/html-has-lang": "react-doctor/html-has-lang",
-	"jsx-a11y/iframe-has-title": "react-doctor/iframe-has-title",
-	"jsx-a11y/img-redundant-alt": "react-doctor/img-redundant-alt",
-	"jsx-a11y/interactive-supports-focus": "react-doctor/interactive-supports-focus",
-	"jsx-a11y/label-has-associated-control": "react-doctor/label-has-associated-control",
-	"jsx-a11y/lang": "react-doctor/lang",
-	"jsx-a11y/media-has-caption": "react-doctor/media-has-caption",
-	"jsx-a11y/mouse-events-have-key-events": "react-doctor/mouse-events-have-key-events",
-	"jsx-a11y/no-access-key": "react-doctor/no-access-key",
-	"jsx-a11y/no-aria-hidden-on-focusable": "react-doctor/no-aria-hidden-on-focusable",
-	"jsx-a11y/no-autofocus": "react-doctor/no-autofocus",
-	"jsx-a11y/no-distracting-elements": "react-doctor/no-distracting-elements",
-	"jsx-a11y/no-interactive-element-to-noninteractive-role": "react-doctor/no-interactive-element-to-noninteractive-role",
-	"jsx-a11y/no-noninteractive-element-interactions": "react-doctor/no-noninteractive-element-interactions",
-	"jsx-a11y/no-noninteractive-element-to-interactive-role": "react-doctor/no-noninteractive-element-to-interactive-role",
-	"jsx-a11y/no-noninteractive-tabindex": "react-doctor/no-noninteractive-tabindex",
-	"jsx-a11y/no-redundant-roles": "react-doctor/no-redundant-roles",
-	"jsx-a11y/no-static-element-interactions": "react-doctor/no-static-element-interactions",
-	"jsx-a11y/prefer-tag-over-role": "react-doctor/prefer-tag-over-role",
-	"jsx-a11y/role-has-required-aria-props": "react-doctor/role-has-required-aria-props",
-	"jsx-a11y/role-supports-aria-props": "react-doctor/role-supports-aria-props",
-	"jsx-a11y/scope": "react-doctor/scope",
-	"jsx-a11y/tabindex-no-positive": "react-doctor/tabindex-no-positive",
-	"react-hooks/exhaustive-deps": "react-doctor/exhaustive-deps",
-	"react-hooks/rules-of-hooks": "react-doctor/rules-of-hooks",
-	"react-perf/jsx-no-jsx-as-prop": "react-doctor/jsx-no-jsx-as-prop",
-	"react-perf/jsx-no-new-array-as-prop": "react-doctor/jsx-no-new-array-as-prop",
-	"react-perf/jsx-no-new-function-as-prop": "react-doctor/jsx-no-new-function-as-prop",
-	"react-perf/jsx-no-new-object-as-prop": "react-doctor/jsx-no-new-object-as-prop",
-	"react-refresh/only-export-components": "react-doctor/only-export-components",
-	"react/button-has-type": "react-doctor/button-has-type",
-	"react/checked-requires-onchange-or-readonly": "react-doctor/checked-requires-onchange-or-readonly",
-	"react/display-name": "react-doctor/display-name",
-	"react/exhaustive-deps": "react-doctor/exhaustive-deps",
-	"react/forbid-component-props": "react-doctor/forbid-component-props",
-	"react/forbid-dom-props": "react-doctor/forbid-dom-props",
-	"react/forbid-elements": "react-doctor/forbid-elements",
-	"react/forward-ref-uses-ref": "react-doctor/forward-ref-uses-ref",
-	"react/hook-use-state": "react-doctor/hook-use-state",
-	"react/iframe-missing-sandbox": "react-doctor/iframe-missing-sandbox",
-	"react/jsx-boolean-value": "react-doctor/jsx-boolean-value",
-	"react/jsx-curly-brace-presence": "react-doctor/jsx-curly-brace-presence",
-	"react/jsx-filename-extension": "react-doctor/jsx-filename-extension",
-	"react/jsx-fragments": "react-doctor/jsx-fragments",
-	"react/jsx-handler-names": "react-doctor/jsx-handler-names",
-	"react/jsx-key": "react-doctor/jsx-key",
-	"react/jsx-max-depth": "react-doctor/jsx-max-depth",
-	"react/jsx-no-comment-textnodes": "react-doctor/jsx-no-comment-textnodes",
-	"react/jsx-no-constructed-context-values": "react-doctor/jsx-no-constructed-context-values",
-	"react/jsx-no-duplicate-props": "react-doctor/jsx-no-duplicate-props",
-	"react/jsx-no-jsx-as-prop": "react-doctor/jsx-no-jsx-as-prop",
-	"react/jsx-no-new-array-as-prop": "react-doctor/jsx-no-new-array-as-prop",
-	"react/jsx-no-new-function-as-prop": "react-doctor/jsx-no-new-function-as-prop",
-	"react/jsx-no-new-object-as-prop": "react-doctor/jsx-no-new-object-as-prop",
-	"react/jsx-no-script-url": "react-doctor/jsx-no-script-url",
-	"react/jsx-no-undef": "react-doctor/jsx-no-undef",
-	"react/jsx-no-useless-fragment": "react-doctor/jsx-no-useless-fragment",
-	"react/jsx-pascal-case": "react-doctor/jsx-pascal-case",
-	"react/jsx-props-no-spread-multi": "react-doctor/jsx-props-no-spread-multi",
-	"react/jsx-props-no-spreading": "react-doctor/jsx-props-no-spreading",
-	"react/no-array-index-key": "react-doctor/no-array-index-key",
-	"react/no-children-prop": "react-doctor/no-children-prop",
-	"react/no-clone-element": "react-doctor/no-clone-element",
-	"react/no-danger": "react-doctor/no-danger",
-	"react/no-danger-with-children": "react-doctor/no-danger-with-children",
-	"react/no-did-mount-set-state": "react-doctor/no-did-mount-set-state",
-	"react/no-did-update-set-state": "react-doctor/no-did-update-set-state",
-	"react/no-direct-mutation-state": "react-doctor/no-direct-mutation-state",
-	"react/no-find-dom-node": "react-doctor/no-find-dom-node",
-	"react/no-is-mounted": "react-doctor/no-is-mounted",
-	"react/no-multi-comp": "react-doctor/no-multi-comp",
-	"react/no-namespace": "react-doctor/no-namespace",
-	"react/no-react-children": "react-doctor/no-react-children",
-	"react/no-redundant-should-component-update": "react-doctor/no-redundant-should-component-update",
-	"react/no-render-return-value": "react-doctor/no-render-return-value",
-	"react/no-set-state": "react-doctor/no-set-state",
-	"react/no-string-refs": "react-doctor/no-string-refs",
-	"react/no-this-in-sfc": "react-doctor/no-this-in-sfc",
-	"react/no-unescaped-entities": "react-doctor/no-unescaped-entities",
-	"react/no-unknown-property": "react-doctor/no-unknown-property",
-	"react/no-unsafe": "react-doctor/no-unsafe",
-	"react/no-unstable-nested-components": "react-doctor/no-unstable-nested-components",
-	"react/no-will-update-set-state": "react-doctor/no-will-update-set-state",
-	"react/only-export-components": "react-doctor/only-export-components",
-	"react/prefer-es6-class": "react-doctor/prefer-es6-class",
-	"react/prefer-function-component": "react-doctor/prefer-function-component",
-	"react/react-in-jsx-scope": "react-doctor/react-in-jsx-scope",
-	"react/require-render-return": "react-doctor/require-render-return",
-	"react/rules-of-hooks": "react-doctor/rules-of-hooks",
-	"react/self-closing-comp": "react-doctor/self-closing-comp",
-	"react/state-in-constructor": "react-doctor/state-in-constructor",
-	"react/style-prop-object": "react-doctor/style-prop-object",
-	"react/void-dom-elements-no-children": "react-doctor/void-dom-elements-no-children"
-};
-const NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS = /* @__PURE__ */ new Map();
-for (const [legacyRuleKey, nativeRuleKey] of Object.entries(LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY)) {
-	const aliases = NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS.get(nativeRuleKey) ?? [];
-	aliases.push(legacyRuleKey);
-	NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS.set(nativeRuleKey, aliases);
-}
-const getLegacyRuleKeysForNative = (ruleKey) => NATIVE_RULE_KEY_TO_LEGACY_RULE_KEYS.get(ruleKey) ?? [];
-const REACT_DOCTOR_RULE_KEY_PREFIX = "react-doctor/";
-const canonicalizeRuleKey = (ruleKey) => {
-	const nativeRuleKey = LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY[ruleKey];
-	return typeof nativeRuleKey === "string" ? nativeRuleKey : ruleKey;
-};
-const isReactDoctorShortIdOf = (bareRuleKey, qualifiedRuleKey) => !bareRuleKey.includes("/") && qualifiedRuleKey === `react-doctor/${bareRuleKey}`;
-/**
-* Canonicalizes a rule key as users write it in config: a legacy alias
-* (`react/jsx-key`) maps to its native key, and a bare short id (`no-eval`)
-* qualifies as `react-doctor/<id>` — mirroring `isSameRuleKey`'s matching —
-* so telemetry groups every spelling of one rule under one key.
-*/
-const canonicalizeUserRuleKey = (ruleKey) => {
-	const nativeRuleKey = canonicalizeRuleKey(ruleKey);
-	return nativeRuleKey.includes("/") ? nativeRuleKey : `${REACT_DOCTOR_RULE_KEY_PREFIX}${nativeRuleKey}`;
-};
-const isSameRuleKey = (candidateRuleKey, targetRuleKey) => {
-	const canonicalCandidate = canonicalizeRuleKey(candidateRuleKey);
-	const canonicalTarget = canonicalizeRuleKey(targetRuleKey);
-	if (canonicalCandidate === canonicalTarget) return true;
-	return isReactDoctorShortIdOf(canonicalCandidate, canonicalTarget) || isReactDoctorShortIdOf(canonicalTarget, canonicalCandidate);
-};
-const getEquivalentRuleKeys = (ruleKey) => {
-	const nativeRuleKey = canonicalizeRuleKey(ruleKey);
-	return [nativeRuleKey, ...getLegacyRuleKeysForNative(nativeRuleKey)];
-};
 const stripDescriptionTail = (ruleList) => {
 	const descriptionMatch = ruleList.match(/(?:^|\s)--\s/);
 	if (!descriptionMatch || descriptionMatch.index === void 0) return ruleList;
@@ -69227,12 +69455,8 @@ const buildDiagnosticPipeline = (input) => {
 		if (rule.tags.includes("migration-hint")) return false;
 		return getFileContext(diagnostic.filePath) !== "production";
 	};
-	const isRuleIgnored = (ruleIdentifier) => {
-		for (const ignored of ignoredRules) if (isSameRuleKey(ignored, ruleIdentifier)) return true;
-		return false;
-	};
-	const isAppOnlyRule = (ruleIdentifier) => {
-		for (const appOnlyRuleKey of APP_ONLY_RULE_KEYS) if (isSameRuleKey(appOnlyRuleKey, ruleIdentifier)) return true;
+	const matchesRuleKey = (ruleIdentifier, candidates) => {
+		for (const candidate of candidates) if (isSameRuleKey(candidate, ruleIdentifier)) return true;
 		return false;
 	};
 	const isRnRawTextSuppressedByConfig = (diagnostic) => {
@@ -69274,12 +69498,13 @@ const buildDiagnosticPipeline = (input) => {
 				if (explicitSeverityOverride === "off") return suppress(current, "config");
 				if (explicitSeverityOverride !== void 0) current = restampSeverity(current, explicitSeverityOverride);
 			}
+			const ruleIdentifier = `${current.plugin}/${current.rule}`;
 			if (explicitRuleOverride === void 0) {
-				if (isAppOnlyRule(`${current.plugin}/${current.rule}`) && isLibraryFile(current.filePath)) return null;
+				if (matchesRuleKey(ruleIdentifier, APP_ONLY_RULE_KEYS) && isLibraryFile(current.filePath)) return null;
 			}
 			if (!showWarnings && current.severity === "warning" && explicitSeverityOverride !== "warn") return null;
 			if (userConfig) {
-				if (isRuleIgnored(`${current.plugin}/${current.rule}`)) return suppress(current, "config");
+				if (matchesRuleKey(ruleIdentifier, ignoredRules)) return suppress(current, "config");
 				if (isFileIgnoredByPatterns(current.filePath, rootDirectory, ignoredFilePatterns)) return null;
 				if (isDiagnosticIgnoredByOverrides(current, rootDirectory, compiledOverrides)) return suppress(current, "override");
 				if (isRnRawTextSuppressedByConfig(current)) return null;
@@ -69288,7 +69513,6 @@ const buildDiagnosticPipeline = (input) => {
 			if (respectInlineDisables && current.line > 0) {
 				const lines = getFileLines(current.filePath);
 				if (lines) {
-					const ruleIdentifier = `${current.plugin}/${current.rule}`;
 					const evaluation = evaluateSuppression(lines, current.line - 1, ruleIdentifier);
 					if (evaluation.isSuppressed) return suppress(current, evaluation.isForeignDirective ? "foreign-inline" : "inline");
 					if (evaluation.nearMissHint) current = {
@@ -69564,7 +69788,8 @@ const readSystemFacts$1 = () => ({
 /**
 * Auto lint-worker count: the smaller of the (cgroup-CPU-aware) core count and
 * the number of `PER_WORKER_MEM_BUDGET_BYTES` workers that fit in available
-* memory, then clamped to `[MIN, HARD_MAX]` by `resolveScanConcurrency`.
+* memory, and the measured automatic parallel-efficiency ceiling, then clamped
+* to `[MIN, HARD_MAX]` by `resolveScanConcurrency`.
 *
 * `os.availableParallelism()` already respects cgroup CPU quotas, so the core
 * term needs no help. Available memory is `os.totalmem()` floored by the cgroup
@@ -69580,7 +69805,7 @@ const readSystemFacts$1 = () => ({
 const resolveAutoScanConcurrency = (facts = readSystemFacts$1()) => {
 	const availableMemoryBytes = Math.min(facts.totalMemoryBytes, facts.cgroupMemoryLimitBytes ?? Number.POSITIVE_INFINITY);
 	const memoryBoundedWorkers = Math.floor(availableMemoryBytes / PER_WORKER_MEM_BUDGET_BYTES);
-	return resolveScanConcurrency(Math.min(facts.availableCores, memoryBoundedWorkers));
+	return resolveScanConcurrency(Math.min(facts.availableCores, memoryBoundedWorkers, 10));
 };
 const resolveLintBatchOrdering = () => {
 	return process.env["REACT_DOCTOR_LINT_BATCH_ORDERING"]?.trim().toLowerCase() === "arrival" ? "arrival" : "cost";
@@ -69593,24 +69818,22 @@ const resolveLintBatchOrdering = () => {
 */
 var OxlintSpawnTimeoutMs = class extends Reference("react-doctor/OxlintSpawnTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_OXLINT_SPAWN_TIMEOUT_MS", OXLINT_SPAWN_TIMEOUT_MS) }) {};
 /**
-* Effect-side cap on the lint phase. The env var lets CI / eval runners
-* raise the phase budget for slow large repos without recompiling.
+* Optional Effect-side cap on the lint phase. Unbounded unless explicitly
+* configured through the env var or a test layer.
 * Tests override via `Layer.succeed(LintPhaseTimeoutMs, ...)`.
 */
-var LintPhaseTimeoutMs = class extends Reference("react-doctor/LintPhaseTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_LINT_PHASE_TIMEOUT_MS", LINT_PHASE_TIMEOUT_MS) }) {};
+var LintPhaseTimeoutMs = class extends Reference("react-doctor/LintPhaseTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_LINT_PHASE_TIMEOUT_MS", null) }) {};
 /**
-* Effect-side cap on the dead-code phase, sitting above the in-worker
-* timeout as a runtime-independent backstop. The env var raises it for
-* type-heavy projects; tests override via
+* Optional Effect-side cap on the dead-code phase. Unbounded unless explicitly
+* configured through the env var or a test layer. Tests override via
 * `Layer.succeed(DeadCodePhaseTimeoutMs, ...)`.
 */
-var DeadCodePhaseTimeoutMs = class extends Reference("react-doctor/DeadCodePhaseTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_DEAD_CODE_PHASE_TIMEOUT_MS", DEAD_CODE_PHASE_TIMEOUT_MS) }) {};
+var DeadCodePhaseTimeoutMs = class extends Reference("react-doctor/DeadCodePhaseTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_DEAD_CODE_PHASE_TIMEOUT_MS", null) }) {};
 /**
-* Overall scan deadline backstop, bounding everything the per-phase
-* timeouts don't (wedged git / IO). The env var raises it for very
-* large repos; tests override via `Layer.succeed(ScanDeadlineMs, ...)`.
+* Optional overall scan deadline. Unbounded unless explicitly configured
+* through the env var or a test layer.
 */
-var ScanDeadlineMs = class extends Reference("react-doctor/ScanDeadlineMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_SCAN_DEADLINE_MS", SCAN_TOTAL_DEADLINE_MS) }) {};
+var ScanDeadlineMs = class extends Reference("react-doctor/ScanDeadlineMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_SCAN_DEADLINE_MS", null) }) {};
 /**
 * Wall-clock budget for the supply-chain check when it runs on a background
 * fiber overlapping the lint pass. Reads from the env var on startup so the
@@ -69683,14 +69906,14 @@ var DeadCodeOverlap = class extends Reference("react-doctor/DeadCodeOverlap", {
 /**
 * How the full-scan lint pass plans its file batches. `"cost"` (the default)
 * builds size-balanced LPT batches (`planLintBatches`): the same mandatory
-* batch count as greedy chunking (`ceil(files / 100)`), but every batch gets
-* an even share of files AND bytes, so no 100-file chunk is a straggler while
+* batch count as greedy chunking, but every batch gets an even share of files
+* AND bytes, so no full chunk is a straggler while
 * the remainder-batch worker idles — and the heavy files are SPREAD across
 * batches, the precondition the old sort-desc-then-chunk-100 `cost` mode
 * lacked (it packed the heaviest files into one wave-1 straggler batch,
 * measurably regressing size-skewed repos, which is why it never earned the
 * default). `"arrival"` (`REACT_DOCTOR_LINT_BATCH_ORDERING=arrival`) is the
-* rollback hatch to plain greedy 100-file chunking in discovery order. Tests
+* rollback hatch to plain greedy fixed-size chunking in discovery order. Tests
 * override via `Layer.succeed(LintBatchOrdering, ...)`. Diff / staged scans
 * never reach this — they pass user-scoped `includePaths` that skip discovery
 * and stay in arrival order; only the full-scan branch reads it.
@@ -69785,6 +70008,7 @@ const DEFAULT_SURFACE_EXCLUDED_TAGS = {
 	score: ["design"],
 	ciFailure: ["design"]
 };
+const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const VALID_RULE_SEVERITIES = [
 	"error",
 	"warn",
@@ -69827,7 +70051,6 @@ const SURFACE_CONTROL_FIELD_NAMES = [
 ];
 const isIncludedFileContext = (value) => VALID_INCLUDED_FILE_CONTEXTS.some((fileContext) => fileContext === value);
 const SEVERITY_FIELD_NAMES = ["rules", "categories"];
-const isPlainObject$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const formatType = (value) => typeof value === "string" ? `"${value}"` : typeof value;
 const isRuleSeverity = (value) => typeof value === "string" && VALID_RULE_SEVERITIES.includes(value);
 const coerceMaybeBooleanString = (fieldName, value) => {
@@ -69855,7 +70078,7 @@ const validateStringArrayField = (fieldName, value) => {
 	});
 };
 const validateSurfaceControls = (surface, rawControls) => {
-	if (!isPlainObject$1(rawControls)) {
+	if (!isRecord$1(rawControls)) {
 		warnConfigIssue(`config field "surfaces.${surface}" must be an object (got ${typeof rawControls}); ignoring this surface.`);
 		return;
 	}
@@ -69879,7 +70102,7 @@ const validateSurfaceControls = (surface, rawControls) => {
 	return validatedSurfaceControls;
 };
 const validateSurfacesField = (rawSurfaces) => {
-	if (!isPlainObject$1(rawSurfaces)) {
+	if (!isRecord$1(rawSurfaces)) {
 		warnConfigIssue(`config field "surfaces" must be an object (got ${typeof rawSurfaces}); ignoring this field.`);
 		return;
 	}
@@ -69895,7 +70118,7 @@ const validateSurfacesField = (rawSurfaces) => {
 	return validated;
 };
 const validateSeverityMap = (fieldName, rawMap, keysAreCategories = false) => {
-	if (!isPlainObject$1(rawMap)) {
+	if (!isRecord$1(rawMap)) {
 		warnConfigIssue(`config field "${fieldName}" must be an object (got ${typeof rawMap}); ignoring this field.`);
 		return;
 	}
@@ -70256,6 +70479,10 @@ const dedupeRelatedDiagnostics = (diagnostics) => {
 	}
 	return uniqueDiagnostics;
 };
+const isPathInsideDirectory = (childAbsolutePath, parentAbsolutePath) => {
+	const relativePath = Path.relative(parentAbsolutePath, childAbsolutePath);
+	return Boolean(relativePath) && !relativePath.startsWith("..") && !Path.isAbsolute(relativePath);
+};
 const compareStrings = (left, right) => left < right ? -1 : left > right ? 1 : 0;
 const sortDiagnosticsStable = (diagnostics) => [...diagnostics].sort((left, right) => compareStrings(left.filePath, right.filePath) || left.line - right.line || left.column - right.column || compareStrings(left.plugin, right.plugin) || compareStrings(left.rule, right.rule) || compareStrings(left.severity, right.severity) || compareStrings(left.message, right.message));
 const getDirectDependencyNames = (packageJson) => new Set([...Object.keys(packageJson.dependencies ?? {}), ...Object.keys(packageJson.devDependencies ?? {})]);
@@ -71832,7 +72059,7 @@ const readScannedFile = (candidate) => {
 		return null;
 	}
 };
-function* collectSecurityScanFiles(rootDirectory) {
+function* collectSecurityScanFiles(rootDirectory, excludedDirectories = /* @__PURE__ */ new Set()) {
 	const priorityCandidates = [];
 	const artifactCandidates = [];
 	const otherCandidates = [];
@@ -71847,7 +72074,7 @@ function* collectSecurityScanFiles(rootDirectory) {
 		for (const entry of readDirectoryEntries(current.absolutePath)) {
 			const absolutePath = Path.join(current.absolutePath, entry.name);
 			if (entry.isDirectory()) {
-				if (!SKIPPED_DIRECTORY_NAMES.has(entry.name)) stack.push({
+				if (!SKIPPED_DIRECTORY_NAMES.has(entry.name) && !excludedDirectories.has(Path.resolve(absolutePath))) stack.push({
 					absolutePath,
 					depth: current.depth + 1
 				});
@@ -72028,10 +72255,8 @@ const shouldEnableRule = (requires, tags, capabilities, ignoredTags, disabledWhe
 	}
 	return true;
 };
+const remainingDeadlineBudgetMs = (deadlineEpochMs) => Math.max(deadlineEpochMs - Date.now(), 0);
 const shouldEnableRuleByDefaultStatus = (options) => options.defaultEnabled !== false || options.hasExplicitOverride === true || options.includeTagDefaults && options.hasIncludedTags;
-const yieldToEventLoop = () => new Promise((resolve) => {
-	setImmediate(resolve);
-});
 const createSecurityScanSession = (rootDirectory, options) => {
 	const capabilities = options.project ? getCapabilities(options.project) : /* @__PURE__ */ new Set();
 	const ignoredTags = options.ignoredTags ?? /* @__PURE__ */ new Set();
@@ -72084,19 +72309,35 @@ const createSecurityScanSession = (rootDirectory, options) => {
 	};
 };
 const checkSecurityScanCooperative = async (rootDirectory, options = {}) => {
+	const throwIfScanAborted = () => {
+		options.signal?.throwIfAborted();
+	};
+	const didReachDeadline = () => {
+		const hasDeadlineElapsed = options.deadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(options.deadlineEpochMs) === 0;
+		if (hasDeadlineElapsed) options.onDeadlineExceeded?.();
+		return hasDeadlineElapsed;
+	};
+	throwIfScanAborted();
 	const session = createSecurityScanSession(rootDirectory, options);
 	if (session === null) return [];
+	if (didReachDeadline()) return [];
 	let sliceStartedAt = performance.now();
-	for (const file of collectSecurityScanFiles(rootDirectory)) {
+	for (const file of collectSecurityScanFiles(rootDirectory, options.excludedDirectories)) {
+		throwIfScanAborted();
+		if (didReachDeadline()) return session.diagnostics;
 		if (file === null) {
 			if (performance.now() - sliceStartedAt >= 12) {
 				await yieldToEventLoop();
+				throwIfScanAborted();
+				if (didReachDeadline()) return session.diagnostics;
 				sliceStartedAt = performance.now();
 			}
 			continue;
 		}
 		for (const _ruleStep of session.scanFileByRule(file)) if (performance.now() - sliceStartedAt >= 12) {
 			await yieldToEventLoop();
+			throwIfScanAborted();
+			if (didReachDeadline()) return session.diagnostics;
 			sliceStartedAt = performance.now();
 		}
 	}
@@ -72275,25 +72516,18 @@ const collectIgnorePatterns = (rootDirectory) => {
 	cachedPatternsByRoot.set(rootDirectory, patterns);
 	return patterns;
 };
-const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const KNIP_JSON_FILENAME = "knip.json";
-const readJsonFileSafe = (filePath) => {
-	let rawContents;
-	try {
-		rawContents = fs.readFileSync(filePath, "utf-8");
-	} catch {
-		return null;
-	}
+const failOpenReadJson = (filePath, fallback) => {
 	try {
-		return JSON.parse(rawContents);
+		return JSON.parse(NFS.readFileSync(filePath, "utf8"));
 	} catch {
-		return null;
+		return fallback;
 	}
 };
+const KNIP_JSON_FILENAME = "knip.json";
 const readKnipConfig = (rootDirectory) => {
-	const knipJson = readJsonFileSafe(path.join(rootDirectory, KNIP_JSON_FILENAME));
+	const knipJson = failOpenReadJson(path.join(rootDirectory, KNIP_JSON_FILENAME), null);
 	if (isRecord$1(knipJson)) return knipJson;
-	const packageJson = readJsonFileSafe(path.join(rootDirectory, "package.json"));
+	const packageJson = failOpenReadJson(path.join(rootDirectory, "package.json"), null);
 	const packageKnipConfig = isRecord$1(packageJson) ? packageJson.knip : null;
 	return isRecord$1(packageKnipConfig) ? packageKnipConfig : null;
 };
@@ -72341,13 +72575,6 @@ const atomicWriteJson = (filePath, value) => {
 		return;
 	}
 };
-const failOpenReadJson = (filePath, fallback) => {
-	try {
-		return JSON.parse(NFS.readFileSync(filePath, "utf8"));
-	} catch {
-		return fallback;
-	}
-};
 const hashFileContents = (filePath) => {
 	try {
 		return crypto.createHash("sha1").update(NFS.readFileSync(filePath)).digest("hex");
@@ -73026,7 +73253,6 @@ const isDiagnosticOnSurface = (diagnostic, surface, config) => {
 	return true;
 };
 const filterDiagnosticsForSurface = (diagnostics, surface, config) => diagnostics.filter((diagnostic) => isDiagnosticOnSurface(diagnostic, surface, config));
-const remainingDeadlineBudgetMs = (deadlineEpochMs) => Math.max(deadlineEpochMs - Date.now(), 0);
 /**
 * Budget for the dead-code phase, scaled to the work. deslop's graph build is
 * CPU-bound and roughly linear in file count, so a fixed 120s cap is too tight
@@ -73034,25 +73260,28 @@ const remainingDeadlineBudgetMs = (deadlineEpochMs) => Math.max(deadlineEpochMs
 * tipped over by any concurrent load — silently dropping every dead-code
 * finding. Scaling the budget with file count (and inversely with the core
 * share when overlapped) lets the pass complete, while the ceiling still
-* reclaims a genuinely wedged worker. Returns the in-worker SIGKILL deadline
-* and the Effect-side phase backstop that sits a margin above it.
+* reclaims a genuinely wedged worker.
 */
 const resolveDeadCodeTimeout = (input) => {
 	const coreShareFactor = Math.max(1, input.fullConcurrency / Math.max(1, input.deadCodeConcurrency));
-	const workerTimeoutMs = Math.min(DEAD_CODE_TIMEOUT_CEILING_MS, Math.max(DEAD_CODE_WORKER_TIMEOUT_MS, Math.ceil(input.sourceFileCount * 30 * coreShareFactor)));
-	return {
-		workerTimeoutMs,
-		phaseTimeoutMs: workerTimeoutMs + DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS
-	};
+	return { workerTimeoutMs: Math.min(DEAD_CODE_TIMEOUT_CEILING_MS, Math.max(DEAD_CODE_WORKER_TIMEOUT_MS, Math.ceil(input.sourceFileCount * 30 * coreShareFactor))) };
 };
-const resolveLintIncludePaths = (rootDirectory, userConfig) => {
+const resolveLintIncludePaths = (rootDirectory, userConfig, sourceFiles) => {
 	if (!Array.isArray(userConfig?.ignore?.files) || userConfig.ignore.files.length === 0) return;
 	const ignoredPatterns = compileIgnoredFilePatterns(userConfig);
-	return listSourceFiles(rootDirectory).filter((filePath) => {
+	return (sourceFiles ?? listSourceFiles(rootDirectory)).filter((filePath) => {
 		if (!isLintableSourceFile(filePath)) return false;
 		return !isFileIgnoredByPatterns(filePath, rootDirectory, ignoredPatterns);
 	});
 };
+const filterPathsOutsideDirectories = (input) => {
+	const excludedPrefixes = input.excludedDirectories.map((excludedDirectory) => Path.resolve(excludedDirectory)).filter((excludedDirectory) => isPathInsideDirectory(excludedDirectory, input.rootDirectory)).map((excludedDirectory) => Path.relative(input.rootDirectory, excludedDirectory).replaceAll("\\", "/")).sort((left, right) => left.length - right.length).filter((candidatePrefix, index, prefixes) => !prefixes.slice(0, index).some((prefix) => candidatePrefix.startsWith(`${prefix}/`)));
+	if (excludedPrefixes.length === 0) return [...input.relativePaths];
+	return input.relativePaths.filter((relativePath) => {
+		const normalizedRelativePath = relativePath.replaceAll("\\", "/").replace(/^\.\//, "");
+		return !excludedPrefixes.some((excludedPrefix) => normalizedRelativePath === excludedPrefix || normalizedRelativePath.startsWith(`${excludedPrefix}/`));
+	});
+};
 var Config = class Config extends Service()("react-doctor/Config") {
 	static layerNode = effect(Config, gen(function* () {
 		const cache = yield* make$3({
@@ -73114,6 +73343,7 @@ var Files = class Files extends Service()("react-doctor/Files") {
 	static layerNode = succeed$3(Files, Files.of({
 		readLines: (input) => sync(() => createNodeReadFileLinesSync(input.rootDirectory)(input.filePath)),
 		listSourceFiles: (rootDirectory) => sync(() => listSourceFiles(rootDirectory)),
+		listSourceFilesCooperative: (input) => promise(() => listSourceFilesCooperative(input.rootDirectory, input.signal)),
 		isFile: (filePath) => sync(() => isFile(filePath)),
 		isDirectory: (filePath) => sync(() => isDirectory(filePath))
 	}));
@@ -73140,6 +73370,16 @@ var Files = class Files extends Service()("react-doctor/Files") {
 				}
 				return files;
 			}),
+			listSourceFilesCooperative: (input) => sync(() => {
+				const rootDirectory = input.rootDirectory;
+				const prefix = rootDirectory.endsWith("/") ? rootDirectory : `${rootDirectory}/`;
+				const files = [];
+				for (const absolute of tree.keys()) {
+					if (!absolute.startsWith(prefix)) continue;
+					files.push(absolute.slice(prefix.length));
+				}
+				return files;
+			}),
 			isFile: (filePath) => sync(() => tree.has(filePath)),
 			isDirectory: (filePath) => sync(() => {
 				const prefix = filePath.endsWith("/") ? filePath : `${filePath}/`;
@@ -73715,7 +73955,7 @@ const batchIncludePaths = (baseArgs, includePaths) => {
 	for (const filePath of includePaths) {
 		const entryLength = filePath.length + 1;
 		const exceedsArgLength = currentBatch.length > 0 && currentBatchLength + entryLength > 24e3;
-		const exceedsFileCount = currentBatch.length >= 100;
+		const exceedsFileCount = currentBatch.length >= 200;
 		if (exceedsArgLength || exceedsFileCount) {
 			batches.push(currentBatch);
 			currentBatch = [];
@@ -74062,7 +74302,7 @@ const buildUserPluginRules = (userPlugin, severityControls) => {
 	}
 	return enabled;
 };
-const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, extendsPaths = [], ignoredTags = /* @__PURE__ */ new Set(), includedTags = /* @__PURE__ */ new Set(), includeTagDefaults = false, runtimeGlobals, unpluginAutoImportGlobalScopes, serverAuthFunctionNames, severityControls, userPlugins = [], disableReactHooksJsPlugin = false, ruleSelection, sidecarRuleIdFilter }) => {
+const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, extendsPaths = [], ignoredTags = /* @__PURE__ */ new Set(), includedTags = /* @__PURE__ */ new Set(), includeTagDefaults = false, runtimeGlobals, unpluginAutoImportGlobalScopes, serverAuthFunctionNames, projectIndexModuleSources, severityControls, userPlugins = [], disableReactHooksJsPlugin = false, ruleSelection, sidecarRuleIdFilter }) => {
 	const hasIncludedTags = includedTags.size > 0;
 	const reactHooksJsPlugin = disableReactHooksJsPlugin || ruleSelection === "sidecar" || hasIncludedTags ? null : resolveReactHooksJsPlugin(project.hasReactCompiler || project.hasReactCompilerLintPlugin === true, customRulesOnly);
 	const reactCompilerRules = reactHooksJsPlugin ? applyRuleSeverityControls(filterRulesToAvailable(REACT_COMPILER_RULES, "react-hooks-js", reactHooksJsPlugin.availableRuleNames), severityControls) : {};
@@ -74126,7 +74366,8 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 				}))
 			} : {},
 			...project.shopifyFlashListMajorVersion !== null ? { shopifyFlashListMajorVersion: project.shopifyFlashListMajorVersion } : {},
-			...serverAuthFunctionNames && serverAuthFunctionNames.length > 0 ? { serverAuthFunctionNames: [...serverAuthFunctionNames] } : {}
+			...serverAuthFunctionNames && serverAuthFunctionNames.length > 0 ? { serverAuthFunctionNames: [...serverAuthFunctionNames] } : {},
+			...projectIndexModuleSources !== void 0 ? { projectIndexModuleSources: [...projectIndexModuleSources] } : {}
 		} },
 		rules: {
 			...reactCompilerRules,
@@ -74375,11 +74616,17 @@ const collectUnpluginAutoImportGlobalScopes = ({ rootDirectory, candidateFiles }
 	return scopes.some((scope) => scope.names.length > 0) ? scopes : [];
 };
 const validateDiagnostic$1 = decodeUnknownSync(Diagnostic);
+const decodeDiagnostic = (raw) => {
+	const diagnostic = validateDiagnostic$1(raw);
+	return {
+		...diagnostic,
+		relatedLocations: diagnostic.relatedLocations?.map((location) => ({ ...location }))
+	};
+};
 const decodeFileDiagnostics = (raw) => {
 	if (!Array.isArray(raw)) return null;
 	try {
-		for (const entry of raw) validateDiagnostic$1(entry);
-		return raw;
+		return raw.map((entry) => decodeDiagnostic(entry));
 	} catch {
 		return null;
 	}
@@ -75611,6 +75858,12 @@ const buildProfiledNodeArguments = (input) => [
 	...input.heapProfileDirectory ? ["--heap-prof", `--heap-prof-dir=${input.heapProfileDirectory}`] : [],
 	...input.argumentsList
 ];
+const lowerChildProcessPriority = (processId) => {
+	if (processId === void 0) return;
+	try {
+		OS.setPriority(processId, OS.constants.priority.PRIORITY_BELOW_NORMAL);
+	} catch {}
+};
 const SANITIZED_ENV = buildOxlintChildEnv(process.env);
 /**
 * Spawn one oxlint subprocess with hard ceilings on wall time and
@@ -75649,6 +75902,7 @@ const spawnOxlint = (args, rootDirectory, nodeBinaryPath, spawnTimeoutMs = OXLIN
 			"pipe"
 		]
 	});
+	lowerChildProcessPriority(child.pid);
 	const onAbort = () => {
 		child.kill("SIGKILL");
 		reject(new ReactDoctorError({ reason: new OxlintSpawnFailed({ cause: "lint phase aborted" }) }));
@@ -75771,7 +76025,7 @@ const isParallelismRelatedSpawnError = (error) => {
 * loop with a slimmer config in that case.
 */
 const spawnLintBatches = async (input) => {
-	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, sourcePathByLintPath, sourceMapByLintPath, onPartialFailure, onFileProgress, spawnTimeoutMs, outputMaxBytes, splitTotalBudgetMs = OXLINT_SPLIT_TOTAL_BUDGET_MS, splitMaxDepth = 8, signal, deadlineEpochMs } = input;
+	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, sourcePathByLintPath, sourceMapByLintPath, onPartialFailure, onFileProgress, spawnTimeoutMs, outputMaxBytes, splitTotalBudgetMs = OXLINT_SPLIT_TOTAL_BUDGET_MS, splitMaxDepth = 9, signal, deadlineEpochMs } = input;
 	const resolveSourcePath = (filePath) => {
 		const absoluteFilePath = Path.isAbsolute(filePath) ? filePath : Path.resolve(rootDirectory, filePath);
 		return sourcePathByLintPath?.get(Path.normalize(absoluteFilePath)) ?? filePath;
@@ -75779,6 +76033,12 @@ const spawnLintBatches = async (input) => {
 	const requestedConcurrency = resolveScanConcurrency(input.concurrency ?? 1);
 	let rescueDeadlineEpochMs;
 	const isPastDeadline = () => deadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(deadlineEpochMs) === 0 || rescueDeadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(rescueDeadlineEpochMs) === 0;
+	const resolveSpawnTimeoutMs = () => {
+		const deadlineBudgets = [deadlineEpochMs, rescueDeadlineEpochMs].filter((deadline) => deadline !== void 0).map(remainingDeadlineBudgetMs);
+		if (deadlineBudgets.length === 0) return spawnTimeoutMs;
+		const remainingDeadlineMs = Math.min(...deadlineBudgets);
+		return spawnTimeoutMs === void 0 ? remainingDeadlineMs : Math.min(spawnTimeoutMs, remainingDeadlineMs);
+	};
 	const runBatchPass = async (concurrency, passBatches, passOnFileProgress) => {
 		const totalFileCount = passBatches.reduce((sum, batch) => sum + batch.length, 0);
 		const allDiagnostics = [];
@@ -75796,12 +76056,13 @@ const spawnLintBatches = async (input) => {
 			const batchArgs = [...baseArgs, ...batch];
 			try {
 				const spawnBatch = () => {
-					if (isPastDeadline()) {
+					const effectiveSpawnTimeoutMs = resolveSpawnTimeoutMs();
+					if (effectiveSpawnTimeoutMs === 0) {
 						deadlineSkippedFiles.push(...batch);
 						batchState.deadlineSkippedFileCount += batch.length;
 						return Promise.resolve(null);
 					}
-					return spawnOxlint(batchArgs, rootDirectory, nodeBinaryPath, spawnTimeoutMs, outputMaxBytes, signal, () => {
+					return spawnOxlint(batchArgs, rootDirectory, nodeBinaryPath, effectiveSpawnTimeoutMs, outputMaxBytes, signal, () => {
 						if (batchState.didStart) return;
 						batchState.didStart = true;
 						startedFileCount += batchState.initialFileCount;
@@ -75956,11 +76217,36 @@ const validateRuleRegistration = () => {
 	].filter((entry) => entry !== null).join("; ");
 	console.warn(`[react-doctor] rule-registration drift: ${detail}`);
 };
+const PROJECT_INDEX_MODULE_SOURCES = [
+	"next/og",
+	"@vercel/og",
+	"satori",
+	"remotion"
+];
+const collectProjectIndexModuleSources = async (rootDirectory, candidateFiles) => {
+	const foundModuleSources = /* @__PURE__ */ new Set();
+	let sliceStartedAt = performance.now();
+	for (const candidateFile of candidateFiles) {
+		let sourceBuffer;
+		try {
+			sourceBuffer = NFS.readFileSync(Path.isAbsolute(candidateFile) ? candidateFile : Path.resolve(rootDirectory, candidateFile));
+		} catch {
+			continue;
+		}
+		for (const moduleSource of PROJECT_INDEX_MODULE_SOURCES) if (sourceBuffer.includes(`"${moduleSource}"`) || sourceBuffer.includes(`'${moduleSource}'`)) foundModuleSources.add(moduleSource);
+		if (foundModuleSources.size === PROJECT_INDEX_MODULE_SOURCES.length) break;
+		if (performance.now() - sliceStartedAt >= 12) {
+			await yieldToEventLoop();
+			sliceStartedAt = performance.now();
+		}
+	}
+	return [...foundModuleSources].sort();
+};
 /**
 * Balanced LPT (longest-processing-time-first) lint batch planner. Where
-* `batchIncludePaths` greedily fills 100-file batches and leaves a small
-* remainder batch (617 files → 6×100 + 17, so the parallel pool's wall clock
-* is set by whichever 100-file chunk happened to collect the most work while
+* `batchIncludePaths` greedily fills fixed-size batches and leaves a small
+* remainder batch, so the parallel pool's wall clock is set by whichever
+* full chunk happened to collect the most work while
 * the remainder's worker idles), this planner keeps the SAME mandatory batch
 * count — `ceil(files / OXLINT_MAX_FILES_PER_BATCH)`, the JS-plugin
 * perf-cliff / native-binding SIGABRT guard — and assigns files largest-first,
@@ -75989,7 +76275,7 @@ const validateRuleRegistration = () => {
 */
 const planLintBatches = ({ baseArgs, files, sizeByFile }) => {
 	if (files.length === 0) return [];
-	const batchCount = Math.ceil(files.length / 100);
+	const batchCount = Math.ceil(files.length / 200);
 	const maxFilesPerBatch = Math.ceil(files.length / batchCount);
 	const baseArgsLengthChars = estimateArgsLength(baseArgs);
 	const descendingSizeIndexes = [...files.keys()].sort((leftIndex, rightIndex) => (sizeByFile.get(files[rightIndex]) ?? 0) - (sizeByFile.get(files[leftIndex]) ?? 0));
@@ -76518,6 +76804,7 @@ const runOxlint = async (options) => {
 		await yieldToEventLoop();
 		const sizedScanFiles = includePaths === void 0 ? listSourceFilesWithSize(rootDirectory) : null;
 		const candidateFiles = includePaths !== void 0 ? includePaths : (sizedScanFiles ?? []).map((entry) => entry.path);
+		const projectIndexModuleSources = includePaths === void 0 && options.deadlineEpochMs === void 0 ? await collectProjectIndexModuleSources(rootDirectory, candidateFiles) : void 0;
 		unpluginAutoImportGlobalScopes = collectUnpluginAutoImportGlobalScopes({
 			rootDirectory,
 			candidateFiles
@@ -76540,6 +76827,7 @@ const runOxlint = async (options) => {
 			runtimeGlobals,
 			unpluginAutoImportGlobalScopes,
 			serverAuthFunctionNames,
+			projectIndexModuleSources,
 			severityControls,
 			userPlugins,
 			disableReactHooksJsPlugin: overrides.disableReactHooksJsPlugin,
@@ -77007,10 +77295,10 @@ const translateProjectInfoError = (cause, directory) => {
 	}) });
 };
 var Project = class Project extends Service()("react-doctor/Project") {
-	static layerNode = succeed$3(Project, Project.of({ discover: fn("Project.discover")(function* (directory) {
+	static layerNode = succeed$3(Project, Project.of({ discover: fn("Project.discover")(function* (input) {
 		return yield* try_({
-			try: () => discoverProject(directory),
-			catch: (cause) => translateProjectInfoError(cause, directory)
+			try: () => discoverProject(input.directory, { sourceFileCount: input.sourceFileCount }),
+			catch: (cause) => translateProjectInfoError(cause, input.directory)
 		});
 	}) }));
 	static layerOf = (projectInfo) => succeed$3(Project, Project.of({ discover: () => succeed$2(projectInfo) }));
@@ -77595,9 +77883,10 @@ const checkSupplyChain = (input) => gen(function* () {
 * outage.
 */
 var SupplyChain = class SupplyChain extends Service()("react-doctor/SupplyChain") {
-	static layerNode = succeed$3(SupplyChain, SupplyChain.of({ run: (input) => unwrap(flatMap$2(SupplyChainOverlapTimeoutMs, (totalTimeoutMs) => checkSupplyChain({
-		...input,
-		totalTimeoutMs
+	static layerNode = succeed$3(SupplyChain, SupplyChain.of({ run: (input) => unwrap(flatMap$2(SupplyChainOverlapTimeoutMs, (configuredTimeoutMs) => checkSupplyChain({
+		rootDirectory: input.rootDirectory,
+		userConfig: input.userConfig,
+		totalTimeoutMs: input.timeoutMs ?? configuredTimeoutMs
 	})).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)), withSpan("SupplyChain.run"))) }));
 	static layerOf = (diagnostics) => succeed$3(SupplyChain, SupplyChain.of({ run: () => fromIterable$1(diagnostics) }));
 };
@@ -77632,10 +77921,6 @@ const NO_HOOKS = {
 	beforeLint: () => void_,
 	afterLint: () => void_
 };
-const filterMapNullable = (transform) => fromPredicateOption((value) => {
-	const result = transform(value);
-	return result === null ? none() : some(result);
-});
 const fileReader = (filesService, rootDirectory) => (filePath) => {
 	const lines = runSync(filesService.readLines({
 		filePath,
@@ -77659,7 +77944,7 @@ const formatLintFailText = (reasonTag, nodeVersion) => {
 *      The GitHub viewer-permission lookup is forked onto a background
 *      fiber here and joined late (it feeds score metadata, not
 *      diagnostics).
-*   2. beforeLint hook (e.g. CLI renders the project-detection block)
+*   2. beforeLint hook (e.g. CLI records project telemetry)
 *   3. environment checks (reduced-motion + pnpm hardening +
 *      expo/react-native), collected synchronously. The heavier
 *      content-regex security scan is forked instead (like supply-chain
@@ -77672,13 +77957,11 @@ const formatLintFailText = (reasonTag, nodeVersion) => {
 *      `SupplyChainOverlapTimeoutMs` (measured from fork) so a hung
 *      socket can't drag out its join; on timeout it fails open to no
 *      diagnostics — the same outcome class as a Socket outage.
-*   5. Linter.run runs; DeadCode.run runs concurrently (forked child
-*      fiber) ONLY when the memory gate has headroom to run the 8 GB
-*      dead-code child alongside the oxlint workers — or when overlap is
-*      forced via REACT_DOCTOR_DEAD_CODE_OVERLAP. Otherwise dead-code
-*      runs sequentially after lint, exactly as it did pre-overlap. The
-*      fiber is joined (or interrupted, SIGKILLing its worker, on lint
-*      failure) before diagnostics are concatenated. The afterLint hook
+*   5. Linter.run runs; DeadCode.run forks only when
+*      REACT_DOCTOR_DEAD_CODE_OVERLAP=on. The default "auto" and explicit
+*      "off" paths stay sequential. The fiber is joined (or interrupted,
+*      SIGKILLing its worker, on lint failure) before diagnostics are
+*      concatenated. The afterLint hook
 *      fires between lint and dead-code. Progress spinner labels AND the
 *      final diagnostic / score order stay independent of execution
 *      order, so terminal output is identical either way; supply-chain
@@ -77713,8 +77996,28 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	const partialFailuresRef = yield* LintPartialFailures;
 	const resolvedConfig = yield* configService.resolve(input.directory);
 	const scanDirectory = resolvedConfig.resolvedDirectory;
-	const project = yield* projectService.discover(scanDirectory);
+	const excludedProjectDirectories = (input.excludedProjectDirectories ?? []).map((excludedDirectory) => Path.resolve(excludedDirectory)).filter((excludedDirectory) => isPathInsideDirectory(excludedDirectory, scanDirectory));
+	const excludedProjectRelativePaths = excludedProjectDirectories.map((excludedDirectory) => Path.relative(scanDirectory, excludedDirectory).replaceAll("\\", "/"));
+	const isExcludedProjectDiagnostic = (diagnostic) => {
+		const relativeFilePath = toNormalizedRelativePath(diagnostic.filePath, scanDirectory);
+		return excludedProjectRelativePaths.some((excludedRelativePath) => relativeFilePath === excludedRelativePath || relativeFilePath.startsWith(`${excludedRelativePath}/`));
+	};
+	const precomputedSourceFiles = input.suppressScanSummary === true || excludedProjectDirectories.length > 0 ? yield* filesService.listSourceFilesCooperative({
+		rootDirectory: scanDirectory,
+		signal: input.signal
+	}) : null;
+	const includedPrecomputedSourceFiles = precomputedSourceFiles !== null && excludedProjectDirectories.length > 0 ? filterPathsOutsideDirectories({
+		rootDirectory: scanDirectory,
+		relativePaths: precomputedSourceFiles,
+		excludedDirectories: excludedProjectDirectories
+	}) : precomputedSourceFiles;
+	const sourceFileCount = excludedProjectDirectories.length > 0 ? includedPrecomputedSourceFiles?.length : input.precomputedSourceFileCount ?? includedPrecomputedSourceFiles?.length;
+	const project = yield* projectService.discover({
+		directory: scanDirectory,
+		sourceFileCount
+	});
 	if (!isAnalyzableProject(project)) return yield* new ReactDoctorError({ reason: new NoReactDependency({ directory: scanDirectory }) });
+	const deadCodeSourceFileCount = input.retainExcludedProjectDeadCodeDiagnostics === true && precomputedSourceFiles !== null ? precomputedSourceFiles.length : project.sourceFileCount;
 	const [repo, sha, defaultBranch] = yield* all([
 		gitService.githubRepo(scanDirectory).pipe(orElseSucceed(() => null)),
 		gitService.headSha(scanDirectory).pipe(orElseSucceed(() => null)),
@@ -77725,11 +78028,16 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		directory: scanDirectory,
 		repo
 	}).pipe(orElseSucceed(() => null)) : succeed$2(null));
-	const lintIncludePaths = (input.skipExplicitIncludePathFilter ? input.includePaths.length > 0 ? [...input.includePaths] : void 0 : computeExplicitLintIncludePaths([...input.includePaths])) ?? resolveLintIncludePaths(scanDirectory, resolvedConfig.config);
-	const fallbackScannedFilePaths = input.suppressScanSummary ? (lintIncludePaths ?? (yield* filesService.listSourceFiles(scanDirectory))).map((relativePath) => Path.resolve(scanDirectory, relativePath)) : [];
+	let lintIncludePaths = (input.skipExplicitIncludePathFilter ? input.includePaths.length > 0 ? [...input.includePaths] : void 0 : computeExplicitLintIncludePaths([...input.includePaths])) ?? resolveLintIncludePaths(scanDirectory, resolvedConfig.config, includedPrecomputedSourceFiles ?? void 0);
+	if (excludedProjectDirectories.length > 0) lintIncludePaths = filterPathsOutsideDirectories({
+		rootDirectory: scanDirectory,
+		relativePaths: lintIncludePaths ?? includedPrecomputedSourceFiles ?? (yield* filesService.listSourceFiles(scanDirectory)),
+		excludedDirectories: excludedProjectDirectories
+	});
+	const fallbackScannedFilePaths = input.suppressScanSummary ? (lintIncludePaths ?? includedPrecomputedSourceFiles ?? (yield* filesService.listSourceFiles(scanDirectory))).map((relativePath) => Path.resolve(scanDirectory, relativePath)) : [];
 	const beforeLint = hooks.beforeLint ?? NO_HOOKS.beforeLint;
 	const afterLint = hooks.afterLint ?? NO_HOOKS.afterLint;
-	yield* beforeLint(project, lintIncludePaths ?? void 0);
+	yield* beforeLint(project);
 	const isDiffMode = input.includePaths.length > 0;
 	const showWarnings = input.warnings ?? resolvedConfig.config?.warnings ?? true;
 	const transform = buildDiagnosticPipeline({
@@ -77739,7 +78047,10 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		respectInlineDisables: input.respectInlineDisables,
 		showWarnings
 	});
-	const filterPerElementPipeline = (rawStream) => rawStream.pipe(filterMap(filterMapNullable(transform.apply)));
+	const filterPerElementPipeline = (rawStream) => rawStream.pipe(filterMap(fromPredicateOption((diagnostic) => {
+		const filteredDiagnostic = transform.apply(diagnostic);
+		return filteredDiagnostic === null ? none() : some(filteredDiagnostic);
+	})));
 	const applyPerElementPipeline = (rawStream) => filterPerElementPipeline(rawStream).pipe(tap((diagnostic) => reporterService.emit(diagnostic)));
 	const envCollected = yield* runCollect(applyPerElementPipeline(fromIterable$1(isDiffMode ? [] : [
 		...checkReducedMotion(scanDirectory),
@@ -77749,17 +78060,31 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		...checkReactNativeProject(scanDirectory, project)
 	])));
 	const securityScanFailedRef = yield* make$13(false);
-	const securityScanFiber = yield* forkChild(runCollect(applyPerElementPipeline(isDiffMode ? empty$4 : unwrap(tryPromise(() => checkSecurityScanCooperative(scanDirectory, {
+	let didSecurityScanReachDeadline = false;
+	const securityScanFiber = yield* forkChild(runCollect(applyPerElementPipeline(isDiffMode ? empty$4 : unwrap(tryPromise((signal) => checkSecurityScanCooperative(scanDirectory, {
 		project,
 		ignoredTags: input.ignoredTags,
 		includedTags: input.includedTags,
-		includeTagDefaults: input.includeTagDefaults
+		includeTagDefaults: input.includeTagDefaults,
+		excludedDirectories: new Set(excludedProjectDirectories),
+		deadlineEpochMs: input.deadlineEpochMs,
+		signal,
+		onDeadlineExceeded: () => {
+			didSecurityScanReachDeadline = true;
+		}
 	})).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)), catch_$1(() => set(securityScanFailedRef, true).pipe(as(empty$4))))))).pipe(withSpan("SecurityScan.run")));
+	const capToDeadline = (phaseTimeoutMs) => input.deadlineEpochMs === void 0 ? phaseTimeoutMs : Math.min(phaseTimeoutMs, remainingDeadlineBudgetMs(input.deadlineEpochMs));
+	const capOptionalToDeadline = (phaseTimeoutMs) => {
+		if (input.deadlineEpochMs === void 0) return phaseTimeoutMs;
+		const remainingBudgetMs = remainingDeadlineBudgetMs(input.deadlineEpochMs);
+		return phaseTimeoutMs === null ? remainingBudgetMs : Math.min(phaseTimeoutMs, remainingBudgetMs);
+	};
 	const shouldRunSupplyChain = !isDiffMode || (input.supplyChainManifestChanged ?? false);
-	const supplyChainOverlapTimeout = yield* SupplyChainOverlapTimeoutMs;
+	const supplyChainOverlapTimeout = capToDeadline(yield* SupplyChainOverlapTimeoutMs);
 	const supplyChainFiber = yield* forkChild(shouldRunSupplyChain ? runCollect(applyPerElementPipeline(supplyChainService.run({
 		rootDirectory: scanDirectory,
-		userConfig: resolvedConfig.config
+		userConfig: resolvedConfig.config,
+		timeoutMs: supplyChainOverlapTimeout
 	}))).pipe(map$3((diagnostics) => ({
 		diagnostics,
 		timedOut: false
@@ -77783,46 +78108,49 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	const scanConcurrency = resolveScanConcurrency(yield* OxlintConcurrency);
 	const lintPhaseTimeoutMs = yield* LintPhaseTimeoutMs;
 	const deadCodePhaseTimeoutMs = yield* DeadCodePhaseTimeoutMs;
-	const resolveDeadCodePhaseTimeoutMs = (scaledPhaseTimeoutMs) => deadCodePhaseTimeoutMs === 15e4 ? scaledPhaseTimeoutMs : deadCodePhaseTimeoutMs;
 	const workerCountSuffix = scanConcurrency > 1 ? ` ${highlighter.dim(`[~${scanConcurrency} workers]`)}` : "";
-	const capToDeadline = (phaseTimeoutMs) => input.deadlineEpochMs === void 0 ? phaseTimeoutMs : Math.min(phaseTimeoutMs, remainingDeadlineBudgetMs(input.deadlineEpochMs));
 	const shouldRunDeadCode = input.runDeadCode && !isDiffMode && (showWarnings || deadCodeMaySurfaceWhenWarningsHidden(resolvedConfig.config));
 	const deadCodeOverlapMode = yield* DeadCodeOverlap;
 	const shouldOverlapDeadCode = shouldRunDeadCode && deadCodeOverlapMode === "on";
 	const deadCodeParseConcurrency = shouldOverlapDeadCode ? Math.max(1, Math.floor(scanConcurrency * DEAD_CODE_OVERLAP_PARSE_SHARE)) : void 0;
 	const lintConcurrency = deadCodeParseConcurrency === void 0 ? scanConcurrency : Math.max(1, scanConcurrency - deadCodeParseConcurrency);
-	const buildCollectDeadCode = (deadCodeTimeout) => runCollect(applyPerElementPipeline(deadCodeService.run({
-		rootDirectory: scanDirectory,
-		parseConcurrency: deadCodeParseConcurrency,
-		workerTimeoutMs: deadCodeTimeout.workerTimeoutMs,
-		onCacheOutcome: (didHitCache) => {
-			deadCodeCacheHit = didHitCache;
-		},
-		onSummaryCacheStats: (stats) => {
-			deadCodeSummaryCacheHits = stats.hits;
-			deadCodeSummaryCacheMisses = stats.misses;
-		}
-	}).pipe(catchTag("ReactDoctorError", (error) => unwrap(gen(function* () {
-		yield* set(deadCodeFailure, {
-			didFail: true,
-			reason: error.message
-		});
-		return empty$4;
-	})))))).pipe(timeoutOption(deadCodeTimeout.phaseTimeoutMs), flatMap$2(match$3({
-		onNone: () => set(deadCodeFailure, {
-			didFail: true,
-			reason: `Dead-code analysis exceeded ${Math.round(deadCodeTimeout.phaseTimeoutMs / MILLISECONDS_PER_SECOND)}s and was skipped.`
-		}).pipe(as([])),
-		onSome: succeed$2
-	})));
+	const buildCollectDeadCode = (deadCodeTimeout) => {
+		const collectDeadCode = runCollect(applyPerElementPipeline(deadCodeService.run({
+			rootDirectory: scanDirectory,
+			parseConcurrency: deadCodeParseConcurrency,
+			workerTimeoutMs: deadCodeTimeout.workerTimeoutMs,
+			onCacheOutcome: (didHitCache) => {
+				deadCodeCacheHit = didHitCache;
+			},
+			onSummaryCacheStats: (stats) => {
+				deadCodeSummaryCacheHits = stats.hits;
+				deadCodeSummaryCacheMisses = stats.misses;
+			}
+		}).pipe(filter((diagnostic) => input.retainExcludedProjectDeadCodeDiagnostics === true || !isExcludedProjectDiagnostic(diagnostic)), catchTag("ReactDoctorError", (error) => unwrap(gen(function* () {
+			yield* set(deadCodeFailure, {
+				didFail: true,
+				reason: error.message
+			});
+			return empty$4;
+		}))))));
+		const phaseTimeoutMs = deadCodeTimeout.phaseTimeoutMs;
+		if (phaseTimeoutMs === null) return collectDeadCode;
+		return collectDeadCode.pipe(timeoutOption(phaseTimeoutMs), flatMap$2(match$3({
+			onNone: () => set(deadCodeFailure, {
+				didFail: true,
+				reason: `Dead-code analysis exceeded ${Math.round(phaseTimeoutMs / MILLISECONDS_PER_SECOND)}s and was skipped.`
+			}).pipe(as([])),
+			onSome: succeed$2
+		})));
+	};
 	const overlapDeadCodeTimeout = resolveDeadCodeTimeout({
-		sourceFileCount: project.sourceFileCount,
+		sourceFileCount: deadCodeSourceFileCount,
 		deadCodeConcurrency: deadCodeParseConcurrency ?? scanConcurrency,
 		fullConcurrency: scanConcurrency
 	});
 	const deadCodeFiber = shouldOverlapDeadCode ? yield* forkChild(buildCollectDeadCode({
 		workerTimeoutMs: overlapDeadCodeTimeout.workerTimeoutMs,
-		phaseTimeoutMs: capToDeadline(resolveDeadCodePhaseTimeoutMs(overlapDeadCodeTimeout.phaseTimeoutMs))
+		phaseTimeoutMs: capOptionalToDeadline(deadCodePhaseTimeoutMs)
 	})) : null;
 	const scanProgress = yield* progressService.start("Scanning...");
 	const scanStartTime = Date.now();
@@ -77873,7 +78201,8 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		});
 		return empty$4;
 	}))));
-	const lintCollected = dedupeRelatedDiagnostics(yield* runCollect(filterPerElementPipeline(shouldOverlapDeadCode ? baseLintStream.pipe(provideService(OxlintConcurrency, lintConcurrency)) : baseLintStream)).pipe(timeoutOption(lintPhaseTimeoutMs), flatMap$2(match$3({
+	const collectLintDiagnostics = runCollect(filterPerElementPipeline(shouldOverlapDeadCode ? baseLintStream.pipe(provideService(OxlintConcurrency, lintConcurrency)) : baseLintStream));
+	const lintCollected = dedupeRelatedDiagnostics(yield* lintPhaseTimeoutMs === null ? collectLintDiagnostics : collectLintDiagnostics.pipe(timeoutOption(lintPhaseTimeoutMs), flatMap$2(match$3({
 		onNone: () => set(lintFailure, {
 			didFail: true,
 			reason: `Lint analysis exceeded ${lintPhaseTimeoutMs / MILLISECONDS_PER_SECOND}s and was skipped.`,
@@ -77903,13 +78232,13 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	} else {
 		yield* scanProgress.update(`Scanned ${scannedFilesLabel}, analyzing dead code...`);
 		const sequentialDeadCodeTimeout = resolveDeadCodeTimeout({
-			sourceFileCount: totalFileCount,
+			sourceFileCount: input.retainExcludedProjectDeadCodeDiagnostics === true ? deadCodeSourceFileCount : totalFileCount,
 			deadCodeConcurrency: scanConcurrency,
 			fullConcurrency: scanConcurrency
 		});
 		deadCodeCollected = deadCodeFiber !== null ? yield* join(deadCodeFiber) : yield* buildCollectDeadCode({
 			workerTimeoutMs: sequentialDeadCodeTimeout.workerTimeoutMs,
-			phaseTimeoutMs: capToDeadline(resolveDeadCodePhaseTimeoutMs(sequentialDeadCodeTimeout.phaseTimeoutMs))
+			phaseTimeoutMs: capOptionalToDeadline(deadCodePhaseTimeoutMs)
 		});
 	}
 	const deadCodeFailureState = lintFailureState.didFail ? {
@@ -77953,7 +78282,11 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		metadata: scoreMetadata
 	});
 	const lintPartialFailures = yield* get$2(partialFailuresRef);
-	const securityScanFailed = yield* get$2(securityScanFailedRef);
+	const didSecurityScanFail = yield* get$2(securityScanFailedRef);
+	const securityScanFailed = didSecurityScanFail || didSecurityScanReachDeadline;
+	let securityScanFailureReason = null;
+	if (didSecurityScanReachDeadline) securityScanFailureReason = "Security scan reached the max scan duration; findings collected before the deadline were preserved.";
+	else if (didSecurityScanFail) securityScanFailureReason = "Security scan failed and was skipped.";
 	return {
 		project,
 		userConfig: resolvedConfig.config,
@@ -77976,6 +78309,7 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		scanConcurrency,
 		supplyChainOverlapTimedOut: supplyChainResult.timedOut,
 		securityScanFailed,
+		securityScanFailureReason,
 		lintCacheHitFileCount,
 		lintCacheTotalFileCount,
 		lintSidecarReplayedFileCount,
@@ -77991,7 +78325,10 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	"inspect.runDeadCode": input.runDeadCode,
 	"inspect.isCi": input.isCi,
 	"inspect.scoreSurface": input.scoreSurface ?? "score"
-} }), (scanProgram) => flatMap$2(ScanDeadlineMs, (scanDeadlineMs) => scanProgram.pipe(timeout(scanDeadlineMs), catchTag$1("TimeoutError", () => new ReactDoctorError({ reason: new ScanDeadlineExceeded({ detail: `${scanDeadlineMs / MILLISECONDS_PER_SECOND}s elapsed` }) })))));
+} }), (scanProgram) => flatMap$2(ScanDeadlineMs, (scanDeadlineMs) => {
+	if (scanDeadlineMs === null) return scanProgram;
+	return scanProgram.pipe(timeout(scanDeadlineMs), catchTag$1("TimeoutError", () => new ReactDoctorError({ reason: new ScanDeadlineExceeded({ detail: `${scanDeadlineMs / MILLISECONDS_PER_SECOND}s elapsed` }) })));
+}));
 const parseNodeVersion = (versionString) => {
 	const [major = 0, minor = 0, patch = 0] = versionString.replace(/^v/, "").trim().split(".").map(Number);
 	return {
@@ -78103,16 +78440,6 @@ var NodeResolver = class NodeResolver extends Service()("react-doctor/NodeResolv
 	});
 };
 /**
-* Zip-Slip defense: relative paths come from git (`diff --name-only`), which
-* normalizes during ordinary adds, but a crafted index/pack/symlinked tree can
-* smuggle `..` segments that escape the temp root. Resolve against the temp dir
-* and reject anything that lands outside before writing.
-*/
-const isPathInsideDirectory = (childAbsolutePath, parentAbsolutePath) => {
-	const relative = path.relative(parentAbsolutePath, childAbsolutePath);
-	return Boolean(relative) && !relative.startsWith("..") && !path.isAbsolute(relative);
-};
-/**
 * Writes a set of source files (supplied by `readContent` — e.g.
 * `git show <ref>:<path>` for a baseline tree, or `git show :<path>` for the
 * index) into a temp tree that mirrors the project layout, copying the
@@ -78400,6 +78727,7 @@ const buildJsonReport = (input) => {
 		directory: input.directory,
 		diff: toJsonDiff(input.diff),
 		projects,
+		...input.skippedProjects && input.skippedProjects.length > 0 ? { skippedProjects: [...input.skippedProjects] } : {},
 		diagnostics: flattenedDiagnostics,
 		summary,
 		elapsedMilliseconds: input.totalElapsedMilliseconds,
@@ -78424,7 +78752,7 @@ const buildSkippedChecks = (input) => {
 	else if (input.lintPartialFailures.length > 0) skippedCheckReasons["lint:partial"] = input.lintPartialFailures.join("; ");
 	if (input.didDeadCodeFail && input.deadCodeFailureReason !== null) skippedCheckReasons["dead-code"] = input.deadCodeFailureReason;
 	if (input.supplyChainOverlapTimedOut) skippedCheckReasons["supply-chain"] = "Supply-chain analysis timed out and was skipped.";
-	if (input.securityScanFailed) skippedCheckReasons["security-scan"] = "Security scan failed and was skipped.";
+	if (input.securityScanFailed) skippedCheckReasons["security-scan"] = input.securityScanFailureReason ?? "Security scan failed and was skipped.";
 	return {
 		skippedChecks,
 		skippedCheckReasons
@@ -78564,6 +78892,33 @@ const getChangedLineRanges = (input) => runPromise(gen(function* () {
 * instead of being improvised per diagnostic.
 */
 const buildRuleDocsUrl = (plugin, rule) => `${DOCS_RULES_BASE_URL}/${plugin}/${rule}`;
+const collectSourceFileCountsByDirectory = async (rootDirectory, projectDirectories, signal) => {
+	const resolvedRootDirectory = Path.resolve(rootDirectory);
+	const sourceFileCounts = /* @__PURE__ */ new Map();
+	const projectDirectoryByRelativePath = /* @__PURE__ */ new Map();
+	for (const projectDirectory of projectDirectories) {
+		const resolvedProjectDirectory = Path.resolve(projectDirectory);
+		const relativeDirectory = Path.relative(resolvedRootDirectory, resolvedProjectDirectory);
+		if (Path.isAbsolute(relativeDirectory) || relativeDirectory.startsWith("..")) continue;
+		sourceFileCounts.set(resolvedProjectDirectory, 0);
+		projectDirectoryByRelativePath.set(relativeDirectory.replaceAll(Path.sep, "/"), resolvedProjectDirectory);
+	}
+	const sourceFilePaths = await listSourceFilesCooperative(resolvedRootDirectory, signal);
+	for (const sourceFilePath of sourceFilePaths) {
+		let relativeDirectory = Path.posix.dirname(sourceFilePath);
+		while (true) {
+			const normalizedRelativeDirectory = relativeDirectory === "." ? "" : relativeDirectory;
+			const projectDirectory = projectDirectoryByRelativePath.get(normalizedRelativeDirectory);
+			if (projectDirectory !== void 0) {
+				sourceFileCounts.set(projectDirectory, (sourceFileCounts.get(projectDirectory) ?? 0) + 1);
+				break;
+			}
+			if (relativeDirectory === ".") break;
+			relativeDirectory = Path.posix.dirname(relativeDirectory);
+		}
+	}
+	return sourceFileCounts;
+};
 const computeConfigFingerprint = (projectDirectory, version) => {
 	const parts = [`v=${version}`];
 	let directory = projectDirectory;
@@ -78934,8 +79289,11 @@ const METRIC = {
 	scanPhaseDuration: "scan.phase_duration",
 	scanFiles: "scan.files",
 	scanScore: "scan.score",
+	scanScoreRetry: "scan.score_retry",
 	scanClean: "scan.clean",
 	scanCheckSkipped: "scan.check_skipped",
+	scanProjectSkipped: "scan.project_skipped",
+	scanWorkspaceDeadCodeShared: "scan.workspace_deadcode_shared",
 	scanNoReactDetected: "scan.no_react_detected",
 	baselineDegraded: "baseline.degraded",
 	ruleFired: "rule.fired",
@@ -78966,8 +79324,10 @@ const METRIC = {
 	tuiFindingNavigated: "tui.finding_navigated",
 	tuiIssueStreamShown: "tui.issue_stream_shown",
 	tuiProjectPathContextShown: "tui.project_path_context_shown",
+	tuiProjectSelectInlineShown: "tui.project_select_inline_shown",
 	tuiReportActionSelected: "tui.report_action_selected",
 	tuiCancelled: "tui.cancelled",
+	tuiScanInlineShown: "tui.scan_inline_shown",
 	tuiStackedReportCapped: "tui.stacked_report_capped",
 	aiTrainingWarningShown: "ai.training.warning_shown",
 	jsonOutUsed: "json.out_used"
@@ -79013,7 +79373,7 @@ const makeNoopConsole = () => ({
 });
 //#endregion
 //#region src/cli/utils/version.ts
-const VERSION = "0.9.3-dev.cc28626";
+const VERSION = "0.9.3-dev.f958625";
 //#endregion
 //#region src/cli/utils/json-mode.ts
 let context = null;
@@ -79250,6 +79610,9 @@ const buildSentryScope = (runContext = buildRunContext()) => {
 	};
 };
 //#endregion
+//#region src/cli/utils/is-env-flag-enabled.ts
+const isEnvFlagEnabled = (value) => value === "1" || value?.toLowerCase() === "true";
+//#endregion
 //#region src/cli/utils/anonymize-text.ts
 /**
 * Free-text fields can carry both a home-directory path (the OS username) and a
@@ -79371,13 +79734,13 @@ const isDevVersion = (version) => version === "0.0.0" || version.includes("-");
 * uploads source-map artifacts under, so stack frames symbolicate. Honors the
 * standard `SENTRY_RELEASE` override.
 */
-const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.9.3-dev.cc28626`;
+const resolveSentryRelease = () => process.env.SENTRY_RELEASE || `react-doctor@0.9.3-dev.f958625`;
 /**
 * Deployment environment shown in Sentry's environment filter. Defaults to
 * `production` for tagged releases and `development` for dev/unbuilt versions,
 * overridable via the standard `SENTRY_ENVIRONMENT` env var.
 */
-const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.9.3-dev.cc28626") ? "development" : "production");
+const resolveSentryEnvironment = () => process.env.SENTRY_ENVIRONMENT || (isDevVersion("0.9.3-dev.f958625") ? "development" : "production");
 /**
 * Performance-tracing sample rate in `[0, 1]`. Reads `SENTRY_TRACES_SAMPLE_RATE`
 * (set to `0` to disable tracing) and falls back to
@@ -79400,7 +79763,6 @@ const shouldEnableSentry = () => {
 	if (process.env.VITEST || process.env.NODE_ENV === "test") return false;
 	return true;
 };
-const isEnvFlagEnabled = (value) => value === "1" || value?.toLowerCase() === "true";
 /**
 * Whether performance traces will actually be recorded — Sentry is live and the
 * resolved sample rate is above zero. Used to gate the per-run root span and
@@ -83016,27 +83378,21 @@ const prompts = (questions, options = {}) => {
 //#endregion
 //#region src/cli/utils/to-span-attributes.ts
 /**
-* Converts a Sentry tag map (which permits `null` to denote an absent signal)
-* into Sentry/OTel span attributes, which only accept primitives. `null` values
-* are dropped rather than coerced, so an absent signal doesn't become a
-* misleading `"null"` attribute.
+* Converts a Sentry tag map (which permits `null`/`undefined` to denote an
+* absent signal) into Sentry/OTel span attributes, which only accept primitives.
+* Missing values are dropped rather than coerced, so an absent signal doesn't
+* become a misleading `"null"` or `"undefined"` attribute.
 */
 const toSpanAttributes = (tags) => {
 	const attributes = {};
-	for (const [key, value] of Object.entries(tags)) if (value !== null) attributes[key] = value;
+	for (const [key, value] of Object.entries(tags)) if (value != null) attributes[key] = value;
 	return attributes;
 };
 //#endregion
 //#region src/cli/utils/record-metric.ts
-const cleanAttributes = (attributes) => {
-	const cleaned = {};
-	if (!attributes) return cleaned;
-	for (const [key, value] of Object.entries(attributes)) if (value !== null && value !== void 0) cleaned[key] = value;
-	return cleaned;
-};
 const withRunAttributes = (attributes) => ({
 	...toSpanAttributes(buildSentryScope().tags),
-	...cleanAttributes(attributes)
+	...toSpanAttributes(attributes ?? {})
 });
 /**
 * Emits a Sentry counter. A guarded, swallow-on-throw no-op unless the CLI's
@@ -91053,6 +91409,19 @@ const ciInstallAction = (options) => runCiCommand("install", runCiInstall, optio
 const ciUpgradeAction = (options) => runCiCommand("upgrade", runCiUpgrade, options);
 const ciConfigAction = (options) => runCiCommand("config", runCiConfig, options);
 //#endregion
+//#region src/cli/utils/active-scan-abort-registry.ts
+const activeScanAbortControllers = /* @__PURE__ */ new Set();
+const activeScanAbortRegistry = {
+	register: (controller) => {
+		activeScanAbortControllers.add(controller);
+		return () => activeScanAbortControllers.delete(controller);
+	},
+	abortAll: () => {
+		for (const controller of activeScanAbortControllers) controller.abort();
+		activeScanAbortControllers.clear();
+	}
+};
+//#endregion
 //#region src/cli/utils/sentry-tracer.ts
 const toHrTime = (epochNanoseconds) => [Number(epochNanoseconds / NANOSECONDS_PER_SECOND), Number(epochNanoseconds % NANOSECONDS_PER_SECOND)];
 const SPAN_KIND_TO_OTEL = {
@@ -91469,7 +91838,14 @@ const isInspectResultComplete = (result) => isScanComplete({
 	skippedCheckReasonCount: Object.keys(result.skippedCheckReasons ?? {}).length
 });
 //#endregion
+//#region src/cli/utils/resolve-score-unavailable-reason.ts
+const resolveScoreUnavailableReason = (input) => {
+	if (input.isScoreDisabled) return "disabled";
+	return input.isAnalysisIncomplete ? "analysis-incomplete" : "api-unavailable";
+};
+//#endregion
 //#region src/cli/utils/scan-result-cache.ts
+const createScanResultCacheInvocationState = () => ({ repositoryIdentityByRoot: /* @__PURE__ */ new Map() });
 const CACHE_DISABLED_VALUES = new Set(["1", "true"]);
 const TOOLCHAIN_PACKAGE_SPECIFIERS = [
 	"oxlint/package.json",
@@ -91554,7 +91930,7 @@ const buildDirtyPathContentFingerprint = (absolutePath, statusCode) => {
 	if (stats.size > 10485760) return null;
 	return hashFileContents(absolutePath);
 };
-const buildWorktreeFingerprint = (projectDirectory) => {
+const buildWorktreeFingerprint = (projectDirectory, repositoryRoot) => {
 	const statusOutput = runGit(projectDirectory, [
 		"status",
 		"--porcelain=v1",
@@ -91566,8 +91942,6 @@ const buildWorktreeFingerprint = (projectDirectory) => {
 	const statusEntries = parseWorktreeStatusRecords(statusOutput);
 	if (statusEntries === null) return null;
 	if (statusEntries.length > 300) return null;
-	const repositoryRoot = runGit(projectDirectory, ["rev-parse", "--show-toplevel"]);
-	if (repositoryRoot === null) return null;
 	const dirtyEntries = [];
 	for (const statusEntry of statusEntries) {
 		const contentFingerprint = buildDirtyPathContentFingerprint(path.join(repositoryRoot, statusEntry.path), statusEntry.statusCode);
@@ -91583,6 +91957,20 @@ const buildWorktreeFingerprint = (projectDirectory) => {
 		return firstSortKey < secondSortKey ? -1 : firstSortKey > secondSortKey ? 1 : 0;
 	});
 };
+const resolveRepositoryCacheIdentity = (projectDirectory, invocationState) => {
+	const repositoryRoot = runGit(projectDirectory, ["rev-parse", "--show-toplevel"]);
+	if (repositoryRoot === null) return null;
+	const cachedIdentity = invocationState.repositoryIdentityByRoot.get(repositoryRoot);
+	if (cachedIdentity !== void 0) return cachedIdentity;
+	const worktreeFingerprint = buildWorktreeFingerprint(projectDirectory, repositoryRoot);
+	const headSha = readHeadSha(repositoryRoot);
+	const identity = worktreeFingerprint === null || headSha === null ? null : {
+		headSha,
+		worktreeFingerprint
+	};
+	invocationState.repositoryIdentityByRoot.set(repositoryRoot, identity);
+	return identity;
+};
 const DOTENV_FILE_NAME_PATTERN = /^\.env(\.|$)/;
 const resolveDotenvFingerprint = (projectDirectory) => {
 	try {
@@ -91677,16 +92065,14 @@ const resolveToolchainFingerprint = (nodeBinaryPath) => {
 const buildScanResultCacheKey = (input) => {
 	if (isCacheGloballyDisabled()) return null;
 	if (!isGitIdentityTrustworthy(input.projectDirectory)) return null;
-	const worktreeFingerprint = buildWorktreeFingerprint(input.projectDirectory);
-	if (worktreeFingerprint === null) return null;
-	const headSha = readHeadSha(input.projectDirectory);
-	if (headSha === null) return null;
+	const repositoryIdentity = resolveRepositoryCacheIdentity(input.projectDirectory, input.invocationState);
+	if (repositoryIdentity === null) return null;
 	if (stringifyStableJson(input.userConfig) === null) return null;
 	const cacheKeyJson = stringifyStableJson({
 		schemaVersion: 6,
 		projectIdentity: resolveProjectIdentity(input.projectDirectory),
-		headSha,
-		worktreeFingerprint,
+		headSha: repositoryIdentity.headSha,
+		worktreeFingerprint: repositoryIdentity.worktreeFingerprint,
 		dotenvFingerprint: resolveDotenvFingerprint(input.projectDirectory),
 		reactDoctorVersion: input.version,
 		nodeVersion: process.version,
@@ -91700,6 +92086,8 @@ const buildScanResultCacheKey = (input) => {
 			deadCode: input.options.deadCode,
 			supplyChain: input.options.supplyChain,
 			includePaths: [...input.options.includePaths].sort(),
+			excludedProjectDirectories: [...input.options.excludedProjectDirectories ?? []].sort(),
+			retainExcludedProjectDeadCodeDiagnostics: input.options.retainExcludedProjectDeadCodeDiagnostics ?? false,
 			customRulesOnly: input.options.customRulesOnly,
 			respectInlineDisables: input.options.respectInlineDisables,
 			warnings: input.options.warnings,
@@ -91777,8 +92165,8 @@ const toCategoryKey = (category) => category.toLowerCase().replace(/[^a-z0-9]+/g
 * browser and stay group-/filter-/aggregate-able in the Spans dataset.
 *
 * Value types are preserved verbatim (numbers stay numbers so Sentry infers a
-* numeric attribute and `p75(...)`/`avg(...)` work; `null` is kept so
-* `toSpanAttributes` can drop absent signals rather than coerce them).
+* numeric attribute and `p75(...)`/`avg(...)` work; `null`/`undefined` are kept
+* so `toSpanAttributes` can drop absent signals rather than coerce them).
 */
 const withNamespace = (namespace, attributes) => {
 	const namespaced = {};
@@ -91844,7 +92232,7 @@ const buildCacheAttributes = (input) => {
 	const warmth = knownSubsystemCount > 0 ? reuseRatioSum / knownSubsystemCount : null;
 	const temperature = warmth !== null && warmth > 0 ? "warm" : isCacheGloballyDisabled() ? "disabled" : "cold";
 	return withNamespace("cache", {
-		wholeRepoHit: input.wholeRepoCacheHit ?? null,
+		wholeRepoHit: input.wholeRepoCacheHit,
 		temperature,
 		warmth
 	});
@@ -91966,33 +92354,37 @@ const buildOutcomeAttributes = (input) => {
 		...withNamespace("score", {
 			value: result.score ? result.score.score : null,
 			label: result.score ? result.score.label : null,
-			available: result.score !== null
+			available: result.score !== null,
+			unavailableReason: result.score === null ? resolveScoreUnavailableReason({
+				isScoreDisabled: input.noScore,
+				isAnalysisIncomplete: input.didLintFail === true || input.didDeadCodeFail === true
+			}) : null
 		}),
 		...withNamespace("lint", {
-			failed: input.didLintFail ?? null,
-			failureReasonKind: input.lintFailureReasonKind ?? null,
-			partialFailureCount: input.lintPartialFailureCount ?? null,
-			droppedFileCount: input.lintDroppedFileCount ?? null,
-			deadlineSkippedFileCount: input.lintDeadlineSkippedFileCount ?? null,
-			cacheHitFiles: result.lintCacheHitFileCount ?? null,
-			cacheTotalFiles: result.lintCacheTotalFileCount ?? null,
+			failed: input.didLintFail,
+			failureReasonKind: input.lintFailureReasonKind,
+			partialFailureCount: input.lintPartialFailureCount,
+			droppedFileCount: input.lintDroppedFileCount,
+			deadlineSkippedFileCount: input.lintDeadlineSkippedFileCount,
+			cacheHitFiles: result.lintCacheHitFileCount,
+			cacheTotalFiles: result.lintCacheTotalFileCount,
 			cacheHitRatio: ratioOf(result.lintCacheHitFileCount, result.lintCacheTotalFileCount),
-			sidecarReplayedFiles: result.lintSidecarReplayedFileCount ?? null,
-			sidecarTotalFiles: result.lintSidecarTotalFileCount ?? null,
+			sidecarReplayedFiles: result.lintSidecarReplayedFileCount,
+			sidecarTotalFiles: result.lintSidecarTotalFileCount,
 			sidecarReplayRatio: ratioOf(result.lintSidecarReplayedFileCount, result.lintSidecarTotalFileCount)
 		}),
 		...withNamespace("deadCode", {
-			failed: input.didDeadCodeFail ?? null,
-			overlapped: input.deadCodeOverlapped ?? null,
-			cacheHit: result.deadCodeCacheHit ?? null,
-			summaryCacheHits: result.deadCodeSummaryCacheHits ?? null,
-			summaryCacheMisses: result.deadCodeSummaryCacheMisses ?? null
+			failed: input.didDeadCodeFail,
+			overlapped: input.deadCodeOverlapped,
+			cacheHit: result.deadCodeCacheHit,
+			summaryCacheHits: result.deadCodeSummaryCacheHits,
+			summaryCacheMisses: result.deadCodeSummaryCacheMisses
 		}),
-		...withNamespace("supplyChain", { overlapTimedOut: input.supplyChainOverlapTimedOut ?? null }),
-		...withNamespace("securityScan", { failed: input.securityScanFailed ?? null }),
+		...withNamespace("supplyChain", { overlapTimedOut: input.supplyChainOverlapTimedOut }),
+		...withNamespace("securityScan", { failed: input.securityScanFailed }),
 		...withNamespace("timing", {
 			elapsedMs: result.elapsedMilliseconds,
-			scanMs: result.scanElapsedMilliseconds ?? null
+			scanMs: result.scanElapsedMilliseconds
 		}),
 		...withNamespace("migration", {
 			largestRuleBucketFiles: largestRuleBucket ? largestRuleBucket.fileCount : null,
@@ -92004,7 +92396,7 @@ const buildOutcomeAttributes = (input) => {
 		new: summary.totalDiagnosticCount,
 		fixed: result.baselineDelta.fixedCount,
 		baseTotal: result.baselineDelta.baseTotalCount,
-		crossFileMatches: result.baselineDelta.crossFileMatchCount ?? null,
+		crossFileMatches: result.baselineDelta.crossFileMatchCount,
 		degraded: false
 	}));
 	else if (input.gateExempt) attributes["baseline.degraded"] = true;
@@ -92013,7 +92405,7 @@ const buildOutcomeAttributes = (input) => {
 const buildActionAttributes = () => {
 	const { githubActorAssociation } = resolveGithubActionsScoreMetadata();
 	return withNamespace("action", {
-		actorAssociation: githubActorAssociation ?? null,
+		actorAssociation: githubActorAssociation,
 		runnerOs: detectRunnerOs(),
 		comment: readEnvBoolean(ACTION_INPUT_ENVIRONMENT_VARIABLES.comment),
 		reviewComments: readEnvBoolean(ACTION_INPUT_ENVIRONMENT_VARIABLES.reviewComments),
@@ -92027,7 +92419,7 @@ const buildScanAttributes = (input) => {
 		mode: input.mode,
 		scope: input.scope,
 		parallel: input.parallel,
-		workerCount: input.workerCount ?? null,
+		workerCount: input.workerCount,
 		maxDurationMs: input.maxDurationMs,
 		lint: input.lint,
 		deadCode: input.deadCode,
@@ -92041,10 +92433,10 @@ const buildScanAttributes = (input) => {
 		hasCustomConfig: input.hasCustomConfig,
 		rulesConfigured: ruleKeys.length,
 		rulesDisabled: ruleKeys.filter((key) => ruleOverrides[key] === "off").length,
-		fileCount: input.result?.scannedFileCount ?? null,
-		nonJsxFileCount: input.result?.analyzedFiles?.filter((filePath) => !JSX_FILE_PATTERN.test(filePath)).length ?? null,
-		htmlFileCount: input.result?.analyzedFiles?.filter((filePath) => HTML_FILE_PATTERN.test(filePath)).length ?? null,
-		multilineDiagnosticCount: input.result?.diagnostics.filter((diagnostic) => (diagnostic.endLine ?? diagnostic.line) > diagnostic.line).length ?? null
+		fileCount: input.result?.scannedFileCount,
+		nonJsxFileCount: input.result?.analyzedFiles?.filter((filePath) => !JSX_FILE_PATTERN.test(filePath)).length,
+		htmlFileCount: input.result?.analyzedFiles?.filter((filePath) => HTML_FILE_PATTERN.test(filePath)).length,
+		multilineDiagnosticCount: input.result?.diagnostics.filter((diagnostic) => (diagnostic.endLine ?? diagnostic.line) > diagnostic.line).length
 	});
 };
 /**
@@ -92056,11 +92448,11 @@ const buildScanAttributes = (input) => {
 * tree up in Sentry's attribute browser and stay filter-/group-/aggregate-able
 * in the Spans dataset. Pure and exported so the projection (outcome
 * precedence, rule/category rollups, CI knobs, config shape) is unit-testable
-* without a live Sentry client. `null` values are dropped so absent signals
-* never become misleading `"null"` attributes. The run + project base context
-* (version, command, ci/provider, framework, …) is already on the span from
-* `withSentryRunSpan` / `recordSentryProjectContext`, so this adds only what
-* those don't carry.
+* without a live Sentry client. `null`/`undefined` values are dropped so absent
+* signals never become misleading `"null"`/`"undefined"` attributes. The run +
+* project base context (version, command, ci/provider, framework, …) is already
+* on the span from `withSentryRunSpan` / `recordSentryProjectContext`, so this
+* adds only what those don't carry.
 */
 const buildRunEventAttributes = (input) => toSpanAttributes({
 	...buildScanAttributes(input),
@@ -92534,10 +92926,29 @@ const createDiagnosticEvidenceReader = (rootDirectory, options = {}) => {
 //#endregion
 //#region src/cli/utils/build-no-score-message.ts
 const ENTERPRISE_CONTACT_HINT = `Want something custom to your company? Contact us at ${ENTERPRISE_CONTACT_URL}.`;
-const buildNoScoreMessage = (isScoreDisabled, disabledMessage) => {
-	return `${isScoreDisabled ? disabledMessage ?? "Score disabled by --no-score." : "Score unavailable (could not reach the score API)."} ${ENTERPRISE_CONTACT_HINT}`;
+const buildNoScoreMessage = (input) => {
+	const unavailableReason = resolveScoreUnavailableReason({
+		isScoreDisabled: input.isScoreDisabled,
+		isAnalysisIncomplete: input.isAnalysisIncomplete ?? false
+	});
+	let reason;
+	switch (unavailableReason) {
+		case "disabled":
+			reason = input.disabledMessage ?? "Score disabled by --no-score.";
+			break;
+		case "analysis-incomplete":
+			reason = "Score not shown because lint or dead-code analysis could not complete.";
+			break;
+		case "api-unavailable":
+			reason = "Score unavailable (could not reach the score API).";
+			break;
+	}
+	return `${reason} ${ENTERPRISE_CONTACT_HINT}`;
 };
 //#endregion
+//#region src/cli/utils/has-incomplete-score-analysis.ts
+const hasIncompleteScoreAnalysis = (skippedChecks) => skippedChecks.includes("lint") || skippedChecks.includes("dead-code");
+//#endregion
 //#region src/cli/utils/build-empty-report-message.ts
 const buildEmptyReportMessage = (input) => {
 	const categoryFilters = [...input.categoryFilters];
@@ -93290,9 +93701,6 @@ const markOnboardingComplete = (options = {}) => {
 	if (isGatePending(ONBOARDING_GATE, {}, options)) recordGate(ONBOARDING_GATE, {}, options);
 };
 //#endregion
-//#region src/cli/utils/render-project-detection.ts
-const printProjectDetection = (_input) => void_;
-//#endregion
 //#region src/cli/utils/colorize-by-score.ts
 const colorizeByScore = (text, score) => {
 	if (score >= 75) return highlighter.success(text);
@@ -93660,9 +94068,6 @@ const resolveCliCategories = (categoryFlag) => {
 //#endregion
 //#region src/inspect.ts
 const silentConsole = makeNoopConsole();
-const runConsole = (effect) => {
-	runSync(effect);
-};
 const recordOnboardingCompletion = (options) => {
 	const forceOnboarding = isOnboardingForced();
 	if (shouldRecordOnboarding({
@@ -93721,7 +94126,10 @@ const mergeInspectOptions = (inputOptions, userConfig) => {
 		maxDurationMs: inputOptions.maxDurationMs ?? null,
 		baseline: inputOptions.baseline ?? null,
 		changedLineRanges: inputOptions.changedLineRanges ?? null,
-		supplyChainManifestChanged: inputOptions.supplyChainManifestChanged ?? false
+		supplyChainManifestChanged: inputOptions.supplyChainManifestChanged ?? false,
+		excludedProjectDirectories: inputOptions.excludedProjectDirectories ?? [],
+		retainExcludedProjectDeadCodeDiagnostics: inputOptions.retainExcludedProjectDeadCodeDiagnostics ?? false,
+		precomputedSourceFileCount: inputOptions.precomputedSourceFileCount
 	};
 };
 const deriveScope = (options) => {
@@ -93754,13 +94162,14 @@ const inspectWithOxlintRuntime = async (directory, inputOptions, oxlintRuntime)
 	const deadlineEpochMs = inputOptions.deadlineEpochMs ?? (inputOptions.maxDurationMs != null ? Date.now() + inputOptions.maxDurationMs : null);
 	const isConcurrentScan = inputOptions.concurrentScan === true;
 	if (!isConcurrentScan) resetSentryRunState();
-	const hasConfigOverride = inputOptions.configOverride !== void 0;
+	const configOverride = inputOptions.configOverride;
+	const hasConfigOverride = configOverride !== void 0;
 	let scanDirectory;
 	let userConfig;
 	let configSourceDirectory;
 	if (hasConfigOverride) {
 		scanDirectory = directory;
-		userConfig = inputOptions.configOverride ?? null;
+		userConfig = configOverride;
 		configSourceDirectory = inputOptions.configSourceDirectory ?? null;
 	} else {
 		const scanTarget = await resolveScanTarget(directory);
@@ -93793,11 +94202,22 @@ const inspectWithOxlintRuntime = async (directory, inputOptions, oxlintRuntime)
 };
 const createInvocationInspect = (requestedOxlintConcurrency) => {
 	const concurrency = resolveScanConcurrency(requestedOxlintConcurrency ?? runSync(OxlintConcurrency));
-	const oxlintRuntime = {
-		concurrency,
-		spawnSlots: createOxlintSpawnSlots(concurrency)
+	const spawnSlots = createOxlintSpawnSlots(concurrency);
+	const scanResultCacheInvocationState = createScanResultCacheInvocationState();
+	return async (directory, inputOptions = {}) => {
+		const abortController = new AbortController();
+		const unregisterAbortController = activeScanAbortRegistry.register(abortController);
+		try {
+			return await inspectWithOxlintRuntime(directory, inputOptions, {
+				concurrency,
+				spawnSlots,
+				abortSignal: abortController.signal,
+				scanResultCacheInvocationState
+			});
+		} finally {
+			unregisterAbortController();
+		}
 	};
-	return (directory, inputOptions = {}) => inspectWithOxlintRuntime(directory, inputOptions, oxlintRuntime);
 };
 const inspect = async (directory, inputOptions = {}) => createInvocationInspect(inputOptions.concurrency)(directory, inputOptions);
 const countIncompleteLintFiles = (lintPartialFailures) => countDroppedLintFiles(lintPartialFailures) + countDeadlineSkippedFiles(lintPartialFailures);
@@ -93810,12 +94230,27 @@ const countIncompleteLintFiles = (lintPartialFailures) => countDroppedLintFiles(
 */
 const runBaselineComparison = async (params) => {
 	const tempDirectory = mkdtempSync(path.join(tmpdir(), BASELINE_FILES_TEMP_DIR_PREFIX));
+	const baselineIncludePaths = filterPathsOutsideDirectories({
+		rootDirectory: params.directory,
+		relativePaths: params.options.includePaths,
+		excludedDirectories: params.options.excludedProjectDirectories
+	});
+	const baselineBaseFiles = params.baseFiles ? filterPathsOutsideDirectories({
+		rootDirectory: params.directory,
+		relativePaths: params.baseFiles,
+		excludedDirectories: params.options.excludedProjectDirectories
+	}) : void 0;
+	const baselineHeadFiles = params.headFiles ? filterPathsOutsideDirectories({
+		rootDirectory: params.directory,
+		relativePaths: params.headFiles,
+		excludedDirectories: params.options.excludedProjectDirectories
+	}) : void 0;
 	const snapshot = await materializeBaselineFiles({
 		directory: params.directory,
 		ref: params.baselineRef,
-		files: params.options.includePaths,
-		baseFiles: params.baseFiles,
-		headFiles: params.headFiles,
+		files: baselineIncludePaths,
+		baseFiles: baselineBaseFiles,
+		headFiles: baselineHeadFiles,
 		tempDirectory
 	}).catch((error) => {
 		rmSync(tempDirectory, {
@@ -93837,7 +94272,7 @@ const runBaselineComparison = async (params) => {
 		const baseFiles = new Set(snapshot.baseFiles.map(toForwardSlashes));
 		const trackedHeadFiles = new Set(snapshot.headFiles.map(toForwardSlashes));
 		const expectedHeadFiles = new Set(trackedHeadFiles);
-		for (const filePath of params.options.includePaths) {
+		for (const filePath of baselineIncludePaths) {
 			const normalizedFilePath = toForwardSlashes(filePath);
 			if (!baseFiles.has(normalizedFilePath)) expectedHeadFiles.add(normalizedFilePath);
 		}
@@ -93874,8 +94309,9 @@ const runBaselineComparison = async (params) => {
 			resolveLocalGithubViewerPermission: false,
 			suppressScanSummary: true,
 			supplyChainManifestChanged: params.options.supplyChainManifestChanged,
-			deadlineEpochMs: params.deadlineEpochMs ?? void 0
-		}, {}).pipe(provide(baseLayers), provideService$2(PerFileLintCacheEnabled, false), provideService$2(SidecarLintCacheEnabled, false), provideService$2(Console, silentConsole))));
+			deadlineEpochMs: params.deadlineEpochMs ?? void 0,
+			signal: params.oxlintRuntime.abortSignal
+		}, {}).pipe(provide(baseLayers), provideService$2(PerFileLintCacheEnabled, false), provideService$2(SidecarLintCacheEnabled, false), provideService$2(Console, silentConsole))), { signal: params.oxlintRuntime.abortSignal });
 		if (baseOutput.didLintFail || countIncompleteLintFiles(baseOutput.lintPartialFailures) > 0) return null;
 		const hasUnscannedUntrackedSourceFiles = filterSourceFiles(snapshot.untrackedFiles.map(toForwardSlashes)).some((filePath) => !analyzedHeadFiles.has(filePath));
 		const delta = computeDiagnosticDelta({
@@ -93903,6 +94339,7 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 	const isDiffMode = options.includePaths.length > 0;
 	const resolvedNodeBinaryPath = await resolveOxlintNode(options.lint, options.scoreOnly || options.silent);
 	const lintBindingMissing = options.lint && !resolvedNodeBinaryPath;
+	await yieldToEventLoop();
 	const cacheKey = buildScanResultCacheKey({
 		projectDirectory: directory,
 		version: VERSION,
@@ -93910,19 +94347,14 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		options,
 		userConfig,
 		hasConfigOverride,
-		configSourceDirectory
+		configSourceDirectory,
+		invocationState: oxlintRuntime.scanResultCacheInvocationState
 	});
 	const scanResultCache = cacheKey === null ? null : createScanResultCache(directory);
-	const cachedPayload = cacheKey === null ? null : scanResultCache?.lookup(cacheKey) ?? null;
+	const cachedPayload = cacheKey === null || scanResultCache === null ? null : scanResultCache.lookup(cacheKey);
 	if (cachedPayload) {
 		recordSentryProjectContext(cachedPayload.project, rootSentrySpan, { concurrentScan: options.concurrentScan });
 		recordCount(METRIC.projectDetected, 1);
-		await renderCachedProjectDetection({
-			payload: cachedPayload,
-			options,
-			userConfig,
-			isDiffMode
-		});
 		const baselineDegraded = Boolean(options.baseline) && isDiffMode && cachedPayload.baselineDelta === void 0;
 		const result = await renderAndRecordScan({
 			payload: cachedPayload,
@@ -93956,6 +94388,7 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 	});
 	const program = runInspect({
 		directory,
+		precomputedSourceFileCount: options.precomputedSourceFileCount,
 		includePaths: options.includePaths,
 		customRulesOnly: options.customRulesOnly,
 		respectInlineDisables: options.respectInlineDisables,
@@ -93972,26 +94405,19 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		resolveLocalGithubViewerPermission: !options.noScore,
 		suppressScanSummary: options.suppressRendering,
 		supplyChainManifestChanged: options.supplyChainManifestChanged,
-		concurrentScan: options.concurrentScan,
-		deadlineEpochMs: deadlineEpochMs ?? void 0
-	}, { beforeLint: (projectInfo, lintIncludePaths) => gen(function* () {
+		deadlineEpochMs: deadlineEpochMs ?? void 0,
+		signal: oxlintRuntime.abortSignal,
+		excludedProjectDirectories: options.excludedProjectDirectories,
+		retainExcludedProjectDeadCodeDiagnostics: options.retainExcludedProjectDeadCodeDiagnostics
+	}, { beforeLint: (projectInfo) => sync(() => {
 		recordSentryProjectContext(projectInfo, rootSentrySpan, { concurrentScan: options.concurrentScan });
 		recordCount(METRIC.projectDetected, 1);
-		if (options.scoreOnly || options.suppressRendering) return;
-		const lintSourceFileCount = lintIncludePaths?.length ?? projectInfo.sourceFileCount;
-		yield* printProjectDetection({
-			projectInfo,
-			userConfig,
-			isDiffMode,
-			includePaths: options.includePaths,
-			lintSourceFileCount
-		});
 	}) });
-	const output = await runPromise(restoreLegacyThrow(applyObservability(options.silent ? program.pipe(provide(layers), provideService$2(Console, silentConsole)) : program.pipe(provide(layers)), rootSentrySpan)));
+	const output = await runPromise(restoreLegacyThrow(applyObservability(options.silent ? program.pipe(provide(layers), provideService$2(Console, silentConsole)) : program.pipe(provide(layers)), rootSentrySpan)), { signal: oxlintRuntime.abortSignal });
 	const didLintFail = lintBindingMissing || output.didLintFail;
 	const lintFailureReason = lintBindingMissing ? `oxlint native binding not found for Node ${process.version}; expected one matching ${OXLINT_NODE_REQUIREMENT}` : output.lintFailureReason;
-	if (!options.scoreOnly && !options.uiLayers && !lintBindingMissing && output.didLintFail && lintFailureReason !== null) if (output.lintFailureReasonKind === "native-binding-missing") runConsole(log(highlighter.gray(`  Upgrade to Node ${OXLINT_NODE_REQUIREMENT} or run: npx -p oxlint@latest react-doctor@latest`)));
-	else runConsole(error$1(highlighter.error(lintFailureReason)));
+	if (!options.scoreOnly && !options.uiLayers && !lintBindingMissing && output.didLintFail && lintFailureReason !== null) if (output.lintFailureReasonKind === "native-binding-missing") runSync(log(highlighter.gray(`  Upgrade to Node ${OXLINT_NODE_REQUIREMENT} or run: npx -p oxlint@latest react-doctor@latest`)));
+	else runSync(error$1(highlighter.error(lintFailureReason)));
 	let inspectDiagnostics = output.diagnostics;
 	let baselineDelta;
 	if (options.baseline && isDiffMode && !didLintFail && countIncompleteLintFiles(output.lintPartialFailures) === 0) {
@@ -94041,6 +94467,7 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 		lintFailureReasonKind: lintBindingMissing ? "native-binding-missing" : output.lintFailureReasonKind,
 		supplyChainOverlapTimedOut: output.supplyChainOverlapTimedOut,
 		securityScanFailed: output.securityScanFailed,
+		securityScanFailureReason: output.securityScanFailureReason,
 		suppressedRuleCounts: output.suppressedRuleCounts
 	};
 	if (cacheKey !== null && scanResultCache !== null && shouldStoreScanPayload(payload) && !baselineDegraded) scanResultCache.store(cacheKey, payload);
@@ -94066,16 +94493,6 @@ const runInspectWithRuntime = async (directory, options, userConfig, hasConfigOv
 	return result;
 };
 const runMaybeSilent = (effect, silent) => silent ? effect.pipe(provideService$2(Console, silentConsole)) : effect;
-const renderCachedProjectDetection = async (input) => {
-	if (input.options.scoreOnly || input.options.suppressRendering) return;
-	await runPromise(runMaybeSilent(printProjectDetection({
-		projectInfo: input.payload.project,
-		userConfig: input.userConfig,
-		isDiffMode: input.isDiffMode,
-		includePaths: input.options.includePaths,
-		lintSourceFileCount: input.payload.scannedFileCount
-	}), input.options.silent));
-};
 const renderAndRecordScan = async (input) => {
 	const result = await runPromise(runMaybeSilent(finalizeAndRender({
 		options: input.options,
@@ -94091,6 +94508,7 @@ const renderAndRecordScan = async (input) => {
 		deadCodeFailureReason: input.payload.deadCodeFailureReason,
 		supplyChainOverlapTimedOut: input.payload.supplyChainOverlapTimedOut,
 		securityScanFailed: input.payload.securityScanFailed ?? false,
+		securityScanFailureReason: input.payload.securityScanFailureReason ?? null,
 		directory: input.payload.directory,
 		scannedFileCount: input.payload.scannedFileCount,
 		scannedFilePaths: input.payload.scannedFilePaths,
@@ -94142,7 +94560,7 @@ const renderAndRecordScan = async (input) => {
 	return result;
 };
 const finalizeAndRender = (input) => gen(function* () {
-	const { options, elapsedMilliseconds, diagnostics, score, project, userConfig, didLintFail, lintFailureReason, lintPartialFailures, didDeadCodeFail, deadCodeFailureReason, supplyChainOverlapTimedOut, securityScanFailed, directory, scannedFileCount, scannedFilePaths, analyzedFiles, scanElapsedMilliseconds, lintCacheHitFileCount, lintCacheTotalFileCount, lintSidecarReplayedFileCount, lintSidecarTotalFileCount, deadCodeCacheHit, deadCodeSummaryCacheHits, deadCodeSummaryCacheMisses, baselineDelta } = input;
+	const { options, elapsedMilliseconds, diagnostics, score, project, userConfig, didLintFail, lintFailureReason, lintPartialFailures, didDeadCodeFail, deadCodeFailureReason, supplyChainOverlapTimedOut, securityScanFailed, securityScanFailureReason, directory, scannedFileCount, scannedFilePaths, analyzedFiles, scanElapsedMilliseconds, lintCacheHitFileCount, lintCacheTotalFileCount, lintSidecarReplayedFileCount, lintSidecarTotalFileCount, deadCodeCacheHit, deadCodeSummaryCacheHits, deadCodeSummaryCacheMisses, baselineDelta } = input;
 	const { skippedChecks, skippedCheckReasons } = buildSkippedChecks({
 		didLintFail,
 		lintFailureReason,
@@ -94150,10 +94568,15 @@ const finalizeAndRender = (input) => gen(function* () {
 		didDeadCodeFail,
 		deadCodeFailureReason,
 		supplyChainOverlapTimedOut,
-		securityScanFailed
+		securityScanFailed,
+		securityScanFailureReason
 	});
 	const hasSkippedChecks = skippedChecks.length > 0;
-	const noScoreMessage = buildNoScoreMessage(options.noScore, options.scoreDisabledMessage);
+	const noScoreMessage = buildNoScoreMessage({
+		isScoreDisabled: options.noScore,
+		isAnalysisIncomplete: hasIncompleteScoreAnalysis(skippedChecks),
+		disabledMessage: options.scoreDisabledMessage
+	});
 	const buildResult = () => ({
 		diagnostics: [...diagnostics],
 		score,
@@ -94283,6 +94706,32 @@ const materializeStagedFiles = async (input) => {
 	};
 };
 //#endregion
+//#region src/cli/utils/deduplicate-project-scans.ts
+const deduplicateProjectScans = (projectScans) => {
+	const uniqueProjectScans = [];
+	const seenDirectories = /* @__PURE__ */ new Set();
+	for (const projectScan of projectScans) {
+		if (seenDirectories.has(projectScan.directory)) continue;
+		seenDirectories.add(projectScan.directory);
+		uniqueProjectScans.push(projectScan);
+	}
+	return uniqueProjectScans;
+};
+//#endregion
+//#region src/cli/utils/collect-project-source-file-counts.ts
+const collectProjectSourceFileCounts = async (rootDirectory, projectDirectories) => {
+	const abortController = new AbortController();
+	const unregisterAbortController = activeScanAbortRegistry.register(abortController);
+	try {
+		return await collectSourceFileCountsByDirectory(rootDirectory, projectDirectories, abortController.signal);
+	} finally {
+		unregisterAbortController();
+	}
+};
+//#endregion
+//#region src/cli/utils/format-skipped-projects-message.ts
+const formatSkippedProjectsMessage = (projectCount) => `${projectCount} ${projectCount === 1 ? "project was" : "projects were"} skipped because the max scan duration was reached.`;
+//#endregion
 //#region src/cli/utils/is-share-opted-out.ts
 const isShareOptedOut = (scans, flagNoScore) => Boolean(flagNoScore) || scans.some((scan) => Boolean(scan.config?.noScore) || scan.config?.share === false);
 //#endregion
@@ -95683,7 +96132,7 @@ const runInstallReactDoctor = async (options = {}) => {
 	const shouldInstallGitHook = gitHookPath != null && (Boolean(options.yes) || !didSkipOptionalSetup && selectedSetupActions.includes(SETUP_OPTION_GIT_HOOK));
 	const shouldInstallAgentHooks = Boolean(options.agentHooks) || !didSkipOptionalSetup && selectedSetupActions.includes(SETUP_OPTION_AGENT_HOOKS);
 	if (!options.dryRun) {
-		if (shouldInstallGitHook && gitHookTarget !== null && gitHookTarget !== void 0) installReactDoctorGitHookStep(gitHookTarget);
+		if (shouldInstallGitHook && gitHookTarget != null) installReactDoctorGitHookStep(gitHookTarget);
 		if (shouldInstallAgentHooks) installReactDoctorAgentHooksStep(projectRoot, selectedAgents);
 	}
 	if (options.dryRun) {
@@ -96301,6 +96750,27 @@ const resolveCliInspectOptions = (flags, userConfig) => {
 	};
 };
 //#endregion
+//#region src/cli/utils/resolve-workspace-dead-code-owner.ts
+const resolveWorkspaceDeadCodeOwner = (input) => {
+	if (!input.isRootDeadCodeEnabled) return null;
+	const resolvedRootDirectory = Path.resolve(input.rootDirectory);
+	return input.projectDirectories.find((projectDirectory) => Path.resolve(projectDirectory) === resolvedRootDirectory) ?? null;
+};
+//#endregion
+//#region src/cli/utils/retry-missing-project-scores.ts
+const retryMissingProjectScores = async (projectScans) => mapWithConcurrency(projectScans, 64, async (projectScan) => {
+	if (!(projectScan.result.score === null && !projectScan.isScoreDisabled && !hasIncompleteScoreAnalysis(projectScan.result.skippedChecks))) return projectScan;
+	const score = await calculateScore(filterScansForSurface([projectScan], "score"));
+	recordCount(METRIC.scanScoreRetry, 1, { succeeded: score !== null });
+	return score === null ? projectScan : {
+		...projectScan,
+		result: {
+			...projectScan.result,
+			score
+		}
+	};
+});
+//#endregion
 //#region src/cli/utils/resolve-project-relative-directory.ts
 /**
 * The scanned project's directory relative to the diff root, forward-slashed —
@@ -96361,6 +96831,16 @@ const resolveProjectChangedLineRanges = (rootDirectory, projectDirectory, ranges
 	});
 };
 //#endregion
+//#region src/cli/utils/resolve-project-scan.ts
+const resolveProjectScan = async (rootScanTarget, projectDirectory) => {
+	const projectScanTarget = projectDirectory === rootScanTarget.resolvedDirectory ? rootScanTarget : await resolveScanTarget(projectDirectory, { allowAmbiguous: true });
+	return {
+		directory: projectScanTarget.resolvedDirectory,
+		config: projectDirectory === rootScanTarget.resolvedDirectory ? rootScanTarget.userConfig : mergeReactDoctorConfigs(rootScanTarget.userConfig, projectScanTarget.userConfig ?? void 0),
+		configSourceDirectory: projectScanTarget.userConfig?.plugins === void 0 ? rootScanTarget.configSourceDirectory : projectScanTarget.configSourceDirectory
+	};
+};
+//#endregion
 //#region src/cli/utils/build-diagnostic-issue-url.ts
 const formatRuleIdentifier = (diagnostic) => `${diagnostic.plugin}/${diagnostic.rule}`;
 const buildDiagnosticIssueBody = (input) => {
@@ -96503,7 +96983,7 @@ const resolveExplainTargetDirectory = async (filePath, context) => {
 	if (context.projectFlag) {
 		const matchedDirectories = await selectProjects(context.resolvedDirectory, context.projectFlag, true);
 		if (matchedDirectories.length === 0) return context.resolvedDirectory;
-		if (matchedDirectories.length > 1) throw new Error(`--explain takes a single project; --project resolved to ${matchedDirectories.length} projects.`);
+		if (matchedDirectories.length > 1) throw new Error(`why takes a single project; --project resolved to ${matchedDirectories.length} projects.`);
 		return matchedDirectories[0];
 	}
 	return findOwningProjectDirectory(context.resolvedDirectory, filePath);
@@ -96722,6 +97202,15 @@ const filterCompletedScansByCategories = (completedScans, categoryFilters) => {
 		}
 	}));
 };
+const reportSkippedProjects = (input) => {
+	input.skippedProjects.sort((left, right) => left.directory.localeCompare(right.directory));
+	if (input.skippedProjects.length === 0) return;
+	recordCount(METRIC.scanProjectSkipped, input.skippedProjects.length, { reason: "max-duration" });
+	if (!input.isQuiet) {
+		cliLogger.warn(formatSkippedProjectsMessage(input.skippedProjects.length));
+		cliLogger.break();
+	}
+};
 /**
 * Post-scan finalization shared by the staged-arm and project-loop
 * paths of `inspectAction`: emit the JSON report (when in JSON mode)
@@ -96736,7 +97225,7 @@ const filterCompletedScansByCategories = (completedScans, categoryFilters) => {
 */
 const finalizeScans = (input) => {
 	const baselineDeltas = input.completedScans.flatMap((scan) => scan.result.baselineDelta ? [scan.result.baselineDelta] : []);
-	const baselineComputed = input.completedScans.length > 0 && input.completedScans.every((scan) => scan.result.baselineDelta !== void 0);
+	const baselineComputed = input.skippedProjects.length === 0 && input.completedScans.length > 0 && input.completedScans.every((scan) => scan.result.baselineDelta !== void 0);
 	const baselineDegraded = input.baselineIntended && !baselineComputed;
 	const mode = baselineDegraded ? "diff" : input.mode;
 	const isReactDetected = input.completedScans.some((scan) => hasReactRuntime(scan.result.project));
@@ -96757,6 +97246,7 @@ const finalizeScans = (input) => {
 			mode,
 			diff: input.diff,
 			scans: jsonCompletedScans,
+			skippedProjects: input.skippedProjects,
 			totalElapsedMilliseconds: performance$1.now() - input.startTime,
 			baseline,
 			baselineDegraded
@@ -96877,16 +97367,16 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 				return;
 			}
 			const buildProjectScanContext = async (projectDirectory) => {
-				const projectScanTarget = projectDirectory === resolvedDirectory ? scanTarget : await resolveScanTarget(projectDirectory, { allowAmbiguous: true });
-				const scanDirectory = projectScanTarget.resolvedDirectory;
+				const projectScan = await resolveProjectScan(scanTarget, projectDirectory);
+				const scanDirectory = projectScan.directory;
 				const treeRelativeDirectory = resolveProjectRelativeDirectory(resolvedDirectory, scanDirectory);
 				if (treeRelativeDirectory === null) return null;
 				return {
 					projectDirectory,
 					scanDirectory,
 					treeRelativeDirectory,
-					projectConfig: projectDirectory === resolvedDirectory ? userConfig : mergeReactDoctorConfigs(userConfig, projectScanTarget.userConfig ?? void 0),
-					projectConfigSourceDirectory: projectScanTarget.userConfig?.plugins === void 0 ? scanTarget.configSourceDirectory : projectScanTarget.configSourceDirectory
+					projectConfig: projectScan.config,
+					projectConfigSourceDirectory: projectScan.configSourceDirectory
 				};
 			};
 			const projectScanContexts = [];
@@ -96973,6 +97463,7 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 				includePaths: resolveProjectSourceFilePaths(resolvedDirectory, projectScan.scanDirectory, projectScan.stagedFiles.filter((stagedFile) => materializedStagedFiles.has(stagedFile)))
 			})).filter((projectRun) => projectRun.includePaths.length > 0);
 			const isMultiProject = stagedProjectRuns.length > 1;
+			const skippedProjects = [];
 			if (stagedProjectRuns.length === 0) {
 				snapshot.cleanup();
 				reportNothingToScan({
@@ -96988,6 +97479,13 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 			}
 			const scanStagedProject = async (projectRun) => {
 				const { projectScan, includePaths } = projectRun;
+				if (scanDeadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(scanDeadlineEpochMs) === 0) {
+					skippedProjects.push({
+						directory: projectScan.scanDirectory,
+						reason: "max-duration"
+					});
+					return null;
+				}
 				const projectTempDirectory = Path.join(snapshot.tempDirectory, projectScan.treeRelativeDirectory);
 				const scanResult = await inspectProject(projectTempDirectory, {
 					...scanOptions,
@@ -97028,7 +97526,11 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 			});
 			const completedScans = stagedBatch.completedScans;
 			try {
-				if (!isQuiet && isMultiProject) {
+				reportSkippedProjects({
+					skippedProjects,
+					isQuiet
+				});
+				if (!isQuiet && isMultiProject && completedScans.length > 0) {
 					const showShareLink = !isShareOptedOut(completedScans, scanOptions.noScore) && !scanOptions.isCi;
 					await runPromise(printMultiProjectSummary({
 						completedScans,
@@ -97046,6 +97548,7 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 			}
 			finalizeScans({
 				completedScans,
+				skippedProjects,
 				mode: "staged",
 				diff: null,
 				baselineIntended: false,
@@ -97121,12 +97624,28 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 			}
 			cliLogger.break();
 		}
-		const isMultiProject = projectDirectories.length > 1;
-		const scanProject = async (projectDirectory) => {
-			const projectScanTarget = projectDirectory === resolvedDirectory ? scanTarget : await resolveScanTarget(projectDirectory, { allowAmbiguous: true });
-			const scanDirectory = projectScanTarget.resolvedDirectory;
-			const projectConfig = projectDirectory === resolvedDirectory ? userConfig : mergeReactDoctorConfigs(userConfig, projectScanTarget.userConfig ?? void 0);
-			const projectConfigSourceDirectory = projectScanTarget.userConfig?.plugins === void 0 ? scanTarget.configSourceDirectory : projectScanTarget.configSourceDirectory;
+		const projectScans = deduplicateProjectScans(await Promise.all(projectDirectories.map((projectDirectory) => resolveProjectScan(scanTarget, projectDirectory))));
+		const isMultiProject = projectScans.length > 1;
+		const rootProjectScan = projectScans.find((projectScan) => Path.resolve(projectScan.directory) === Path.resolve(resolvedDirectory));
+		const workspaceDeadCodeOwner = resolveWorkspaceDeadCodeOwner({
+			rootDirectory: resolvedDirectory,
+			projectDirectories: projectScans.map((projectScan) => projectScan.directory),
+			isRootDeadCodeEnabled: scanOptions.deadCode ?? rootProjectScan?.config?.deadCode ?? true
+		});
+		if (workspaceDeadCodeOwner !== null) recordCount(METRIC.scanWorkspaceDeadCodeShared, 1, { projectCount: projectScans.length });
+		const precomputedSourceFileCounts = isMultiProject && !isDiffMode ? await collectProjectSourceFileCounts(resolvedDirectory, projectScans.map((projectScan) => projectScan.directory)) : null;
+		const skippedProjects = [];
+		const scanProject = async (projectScan) => {
+			if (scanDeadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(scanDeadlineEpochMs) === 0) {
+				skippedProjects.push({
+					directory: projectScan.directory,
+					reason: "max-duration"
+				});
+				return null;
+			}
+			const scanDirectory = projectScan.directory;
+			const projectConfig = projectScan.config;
+			const ownsWorkspaceDeadCode = scanDirectory === workspaceDeadCodeOwner;
 			const supplyChainEnabled = flags.supplyChain ?? projectConfig?.supplyChain?.enabled !== false;
 			let includePaths;
 			let supplyChainManifestChanged = false;
@@ -97150,12 +97669,16 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 			if (!isQuiet && !isMultiProject) cliLogger.dim("  ");
 			const scanResult = await inspectProject(scanDirectory, {
 				...scanOptions,
+				deadCode: workspaceDeadCodeOwner === null ? scanOptions.deadCode : ownsWorkspaceDeadCode,
+				precomputedSourceFileCount: precomputedSourceFileCounts?.get(scanDirectory),
 				deadlineEpochMs: scanDeadlineEpochMs,
 				includePaths,
 				configOverride: projectConfig,
-				configSourceDirectory: projectConfigSourceDirectory ?? void 0,
+				configSourceDirectory: projectScan.configSourceDirectory ?? void 0,
 				suppressRendering: isMultiProject,
 				concurrentScan: isMultiProject,
+				excludedProjectDirectories: projectScans.filter((candidateProjectScan) => isPathInsideDirectory(candidateProjectScan.directory, scanDirectory)).map((candidateProjectScan) => candidateProjectScan.directory),
+				retainExcludedProjectDeadCodeDiagnostics: ownsWorkspaceDeadCode,
 				baseline: baselineRef !== null && projectBaselineBaseFiles !== null && projectBaselineHeadFiles !== null ? {
 					ref: baselineRef,
 					baseFiles: projectBaselineBaseFiles,
@@ -97172,12 +97695,19 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 			};
 		};
 		const projectBatch = await runProjectScanBatch({
-			projects: projectDirectories,
+			projects: projectScans,
 			isQuiet,
 			isSilent: scanOptions.silent === true,
 			scanProject
 		});
-		const completedScans = projectBatch.completedScans;
+		const completedScans = await retryMissingProjectScores(projectBatch.completedScans.map((completedScan) => ({
+			...completedScan,
+			isScoreDisabled: scanOptions.noScore ?? completedScan.config?.noScore ?? false
+		})));
+		reportSkippedProjects({
+			skippedProjects,
+			isQuiet
+		});
 		if (!isQuiet && isMultiProject && completedScans.length > 0) {
 			const showShareLink = !isShareOptedOut(completedScans, scanOptions.noScore) && !scanOptions.isCi;
 			await runPromise(printMultiProjectSummary({
@@ -97195,6 +97725,7 @@ const inspectAction = async (directory, flags, invocationCommand = "inspect") =>
 		if (flags.outputDir && !didScansWriteDump) await runPromise(printDiagnosticsDump(selectedSurfaceDiagnostics, flags.outputDir, false, isQuiet ? "stderr" : "stdout"));
 		finalizeScans({
 			completedScans,
+			skippedProjects,
 			mode: baselineRef ? "baseline" : isDiffMode ? "diff" : "full",
 			diff: isDiffMode ? diffInfo : null,
 			baselineIntended: scope === "changed" && diffInfo !== null && !diffInfo.isCurrentChanges,
@@ -97292,6 +97823,7 @@ const shouldUseTui = (input) => {
 //#endregion
 //#region src/cli/commands/scan.ts
 const runScanCommand = async (input) => {
+	if (input.flags.cache === false) process.env.REACT_DOCTOR_NO_CACHE = "1";
 	const nodeMajorVersion = Number(process.versions.node.split(".")[0]);
 	const tuiEnvironment = {
 		flags: input.flags,
@@ -97316,7 +97848,7 @@ const runScanCommand = async (input) => {
 		return;
 	}
 	recordCount(METRIC.cliInvoked, 1, { command: input.invocationCommand });
-	const { runScanApp } = await import("./run-scan-app-DtYeufgr.js");
+	const { runScanApp } = await import("./run-scan-app-QbtG43NL.js");
 	const { shouldFail } = await runScanApp({
 		directory: input.directory,
 		scanTarget,
@@ -97968,11 +98500,27 @@ const ensureWindowsUtf8Console = () => {
 	} catch {}
 };
 //#endregion
+//#region src/cli/utils/active-tui-renderer.ts
+let activeTuiRenderer = null;
+const registerActiveTuiRenderer = (renderer) => {
+	activeTuiRenderer = renderer;
+	return () => {
+		if (activeTuiRenderer === renderer) activeTuiRenderer = null;
+	};
+};
+const clearActiveTuiRenderer = () => {
+	const renderer = activeTuiRenderer;
+	activeTuiRenderer = null;
+	renderer?.clear();
+};
+//#endregion
 //#region src/cli/utils/exit-gracefully.ts
 let didStartExiting = false;
 const exitGracefully = () => {
 	if (didStartExiting) return process.exit(130);
 	didStartExiting = true;
+	activeScanAbortRegistry.abortAll();
+	clearActiveTuiRenderer();
 	try {
 		if (isJsonModeActive()) writeJsonErrorReport(/* @__PURE__ */ new Error("Scan cancelled by user (SIGINT/SIGTERM)"));
 		else console.log([
@@ -98102,6 +98650,7 @@ const ROOT_FLAG_SPEC = {
 		"--json-compact",
 		"--lint",
 		"--no-color",
+		"--no-cache",
 		"--no-dead-code",
 		"--no-lint",
 		"--no-parallel",
@@ -98225,13 +98774,18 @@ const COMMAND_FLAG_SPECS = new Map([
 		longOptionsWithoutValues: new Set([
 			"--color",
 			"--help",
+			"--no-cache",
 			"--no-color",
 			"--no-dead-code",
 			"--no-score",
 			"--no-supply-chain",
 			"--yes"
 		]),
-		longOptionsWithRequiredValues: new Set(["--blocking", "--project"]),
+		longOptionsWithRequiredValues: new Set([
+			"--blocking",
+			"--max-duration",
+			"--project"
+		]),
 		longOptionsWithOptionalValues: /* @__PURE__ */ new Set(),
 		shortOptionsWithoutValues: new Set(["-h", "-y"]),
 		shortOptionsWithRequiredValues: new Set(["-p"])
@@ -98373,6 +98927,7 @@ ${highlighter.dim("Scope:")}
   Dead-code, supply-chain, external lint-config, custom-plugin, and health-score passes are skipped.
   Standard scan flags such as ${highlighter.info("--scope")}, ${highlighter.info("--project")}, ${highlighter.info("--verbose")}, and ${highlighter.info("--json")} still work.
 `;
+const MAX_DURATION_OPTION_DESCRIPTION = "scan time budget for the whole run, shared across workspace projects: past it, queued projects, remaining lint batches, and dead-code are skipped and partial results are reported (skipped files and projects are listed in the JSON report)";
 const renderCiHelpEpilog = () => `
 ${highlighter.dim("Examples:")}
 ${formatExampleLines([
@@ -98392,7 +98947,7 @@ ${highlighter.dim("Learn more:")}
   ${highlighter.info(CI_URL)}
 `;
 const collectCategoryOption = (value, previousValues) => [...previousValues ?? [], value];
-const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--supply-chain", "enable the dependency supply-chain scan (default)").option("--no-supply-chain", "skip the dependency supply-chain scan (Socket.dev dependency health checks)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("--json-out <path>", "with --json, write the report to a file instead of stdout").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much supported JS/TS and inline HTML script source to scan/report: full (default), files, changed (only new issues vs base), or lines (issues whose source spans touch changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").option("--include-untracked", "with --scope files/changed/lines, also scan ordinary untracked files (respects .gitignore)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks (honors --project and config `projects`; exits 0 when nothing is staged)").option("--max-duration <seconds>", "scan time budget for the whole run, shared across workspace projects: past it, remaining lint batches and dead-code are skipped and partial results are reported (skipped files are listed in the JSON report)").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
+const program = new Command().name("react-doctor").description("Diagnose React codebase health").version(VERSION, "-v, --version", "display the version number").argument("[directory]", "project directory to scan", ".").option("--lint", "enable linting").option("--no-lint", "skip linting").option("--dead-code", "enable dead-code analysis (default)").option("--no-dead-code", "skip dead-code analysis (unused files / exports / dependencies, circular imports)").option("--supply-chain", "enable the dependency supply-chain scan (default)").option("--no-supply-chain", "skip the dependency supply-chain scan (Socket.dev dependency health checks)").option("--verbose", "show every rule and per-file details (default shows top 3 rules)").option("--debug", "force a Sentry trace and print its id at the end (paste it into a bug report)").option("--output-dir <dir>", "directory for the full diagnostics dump (default: a temp folder)").option("--score", "output only the score").option("--json", "output a single structured JSON report (suppresses other output)").option("--json-compact", "with --json, emit compact JSON (no indentation)").option("--json-out <path>", "with --json, write the report to a file instead of stdout").option("--no-cache", "disable all scan caches for this run").option("-y, --yes", "skip prompts, scan all workspace projects").option("--no-parallel", "lint serially with one worker (default: parallel across CPU cores; set the worker count with REACT_DOCTOR_PARALLEL)").option("--project <name>", "select projects: workspace names or directory paths (comma-separated for multiple); overrides the `projects` config field").option("--scope <value>", "how much supported JS/TS and inline HTML script source to scan/report: full (default), files, changed (only new issues vs base), or lines (issues whose source spans touch changed lines)").option("--base <ref>", "base git ref for files/changed/lines scope (auto-detected when omitted)").option("--include-untracked", "with --scope files/changed/lines, also scan ordinary untracked files (respects .gitignore)").addOption(new Option("--diff [base]", "[deprecated] alias for --scope changed (pass `false` to force a full scan)").hideHelp()).addOption(new Option("--changed-files-from <file>", "scan source files listed in a newline-delimited changed-files file").hideHelp()).option("--no-score", "skip the score API, the share URL, and crash reporting").addOption(new Option("--category <category>", "only show diagnostics in a category (repeatable; e.g. Security)").argParser(collectCategoryOption)).option("--no-telemetry", "alias for --no-score (skip the score API, share URL, and crash reporting)").option("--staged", "scan only staged (git index) files for pre-commit hooks (honors --project and config `projects`; exits 0 when nothing is staged)").option("--max-duration <seconds>", MAX_DURATION_OPTION_DESCRIPTION).option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").addOption(new Option("--fail-on <level>", "[deprecated] alias for --blocking <level>").hideHelp()).option("--no-respect-inline-disables", "audit mode: neutralize inline lint suppressions before scanning").option("--warnings", "show warning-severity diagnostics (default)").option("--no-warnings", "hide warning-severity diagnostics (errors only)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").addHelpText("after", renderRootHelpEpilog);
 program.action((directory = ".", flags) => runScanCommand({
 	directory,
 	flags,
@@ -98418,7 +98973,7 @@ rules.command("category <category> <severity>").description("Set the severity fo
 rules.command("ignore-tag <tag>").description("Skip a whole rule family by tag before linting (e.g. design)").option("-c, --cwd <cwd>", "working directory", process.cwd()).action((tag, _options, command) => rulesIgnoreTagAction(tag, command.optsWithGlobals()));
 rules.command("unignore-tag <tag>").description("Stop ignoring a tag previously skipped via ignore-tag").option("-c, --cwd <cwd>", "working directory", process.cwd()).action((tag, _options, command) => rulesUnignoreTagAction(tag, command.optsWithGlobals()));
 program.command("experimental-lsp", { hidden: false }).description("[experimental] run the React Doctor language server over stdio (for editors)").allowUnknownOption().action(() => {});
-program.command("experimental-tui [directory]", { hidden: true }).description("[experimental] interactive, scrollable scan report").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").option("--no-dead-code", "skip dead-code analysis").option("--no-supply-chain", "skip the dependency supply-chain scan").option("--score", "only print the numeric score (for scripts and CI)").option("--no-score", "skip the score API, the share URL, and crash reporting").option("-p, --project <names>", "scan specific workspace projects (comma-separated, or *)").option("-y, --yes", "skip the project prompt and scan every discovered project").action((directory = ".", _localOptions, command) => runScanCommand({
+program.command("experimental-tui [directory]", { hidden: true }).description("[experimental] interactive, scrollable scan report").option("--blocking <level>", "severity that fails CI: error (default), warning, or none (advisory)").option("--color", "force colored output").option("--no-color", "disable colored output (also honors NO_COLOR)").option("--no-dead-code", "skip dead-code analysis").option("--no-supply-chain", "skip the dependency supply-chain scan").option("--score", "only print the numeric score (for scripts and CI)").option("--no-score", "skip the score API, the share URL, and crash reporting").option("--no-cache", "disable all scan caches for this run").option("--max-duration <seconds>", MAX_DURATION_OPTION_DESCRIPTION).option("-p, --project <names>", "scan specific workspace projects (comma-separated, or *)").option("-y, --yes", "skip the project prompt and scan every discovered project").action((directory = ".", _localOptions, command) => runScanCommand({
 	directory,
 	flags: command.optsWithGlobals(),
 	invocationCommand: "experimental-tui"
@@ -98449,7 +99004,7 @@ Promise.resolve().then(() => assertNoRemovedFlags(process.argv)).then(() => prog
 	handleError(error, { sentryEventId });
 });
 //#endregion
-export { highlighter as $, hasLintHardFailure as A, isUnicodeSupported as B, shouldRecordOnboarding as C, buildCodeFrame as D, formatElapsedTime as E, resolveBlockingLevel as F, isCiEnvironment as G, METRIC as H, isReactDoctorWorkflowInstalled as I, Progress as J, DIAGNOSTIC_CATEGORY_BUCKETS as K, recordCount as L, buildSortedRuleGroups as M, formatFixRecipeLine as N, buildEmptyReportMessage as O, formatLearnMoreLine as P, hasPublishedFixRecipe as Q, toForwardSlashes as R, isOnboardingForced as S, computeProjectedScore as T, TUI_REPORT_COMPACT_MAX_ROWS as U, CI_TRUST_COMPANIES as V, TUI_REPORT_DETAIL_WIDTH_FRACTION as W, buildRuleDocsUrl as X, Reporter as Y, getCategoryImpact as Z, printFooter as _, resolveCliInspectOptions as a, void_ as at, markOnboardingComplete as b, setUpGitHubActions as c, CLI_AGENT_BINARIES as d, mapWithConcurrency as et, copyToClipboard as f, createInvocationInspect as g, isShareOptedOut as h, selectProjects as i, sync as it, buildRulePriorityMap as j, buildNoScoreMessage as k, openUrl as l, buildHandoffPayload as m, shouldFailScanGate as n, resolveScanTarget as nt, filterScansForSurface as o, succeed$3 as ot, launchCliAgent as p, GITHUB_ACTIONS_SETUP_URL as q, discoverWorkspacePackages as r, runPromise as rt, countUniqueScannedFiles as s, exitGracefully as t, mergeReactDoctorConfigs as tt, detectLaunchableAgents as u, easeOutCubic as v, filterDiagnosticsByCategories as w, canAnimateOnboarding as x, doctorFace as y, findNearestPackageDirectory as z };
+export { TUI_REPORT_DETAIL_WIDTH_FRACTION as $, shouldRecordOnboarding as A, buildSortedRuleGroups as B, createInvocationInspect as C, markOnboardingComplete as D, doctorFace as E, buildEmptyReportMessage as F, recordCount as G, formatLearnMoreLine as H, hasIncompleteScoreAnalysis as I, findNearestPackageDirectory as J, recordDistribution as K, buildNoScoreMessage as L, computeProjectedScore as M, formatElapsedTime as N, canAnimateOnboarding as O, buildCodeFrame as P, TUI_REPORT_COMPACT_MAX_ROWS as Q, hasLintHardFailure as R, deduplicateProjectScans as S, easeOutCubic as T, resolveBlockingLevel as U, formatFixRecipeLine as V, isReactDoctorWorkflowInstalled as W, CI_TRUST_COMPANIES as X, isUnicodeSupported as Y, METRIC as Z, launchCliAgent as _, succeed$3 as _t, selectProjects as a, buildRuleDocsUrl as at, formatSkippedProjectsMessage as b, resolveWorkspaceDeadCodeOwner as c, highlighter as ct, countUniqueScannedFiles as d, remainingDeadlineBudgetMs as dt, isCiEnvironment as et, setUpGitHubActions as f, resolveScanTarget as ft, copyToClipboard as g, void_ as gt, CLI_AGENT_BINARIES as h, sync as ht, discoverWorkspacePackages as i, Reporter as it, filterDiagnosticsByCategories as j, isOnboardingForced as k, resolveCliInspectOptions as l, isPathInsideDirectory as lt, detectLaunchableAgents as m, runPromise as mt, registerActiveTuiRenderer as n, GITHUB_ACTIONS_SETUP_URL as nt, resolveProjectScan as o, getCategoryImpact as ot, openUrl as p, yieldToEventLoop as pt, toForwardSlashes as q, shouldFailScanGate as r, Progress as rt, retryMissingProjectScores as s, hasPublishedFixRecipe as st, exitGracefully as t, DIAGNOSTIC_CATEGORY_BUCKETS as tt, filterScansForSurface as u, mapWithConcurrency as ut, buildHandoffPayload as v, printFooter as w, collectProjectSourceFileCounts as x, isShareOptedOut as y, buildRulePriorityMap as z };
 
 //# sourceMappingURL=cli.js.map
-//# debugId=e4075e6f-4128-5af6-bc97-656272450282
+//# debugId=2b3a9fe9-8109-5067-854f-a10b2e6454e7