react-doctor 0.9.3 → 0.9.4-dev.212b8b4

package/dist/index.js

@@ -1,16 +1,16 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0c9da9c7-4847-5807-983e-a57b7eec97cd")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8d6e3c06-44f8-589f-8e07-aaa4704b6112")}catch(e){}}();
 import { i as __toESM$1, r as __require, t as __commonJSMin$1 } from "./chunk-ChKA3wi6.js";
 import { createRequire } from "node:module";
 import { ALL_REACT_DOCTOR_RULE_KEYS, CROSS_FILE_DEPENDENCY_COLLECTORS, CROSS_FILE_RULE_IDS, FRAMEWORK_SPECIFIC_RULE_KEYS, FRAMEWORK_TOKENS, MOTION_LIBRARY_PACKAGES, REACT_COMPILER_RULES, REACT_DOCTOR_RULES, REACT_DOCTOR_RULE_REGISTRY, REACT_DOCTOR_SCAN_RULES, classifySecurityScanFile, collectCrossFileDependencyProbes, resetManifestCaches, shouldReadSecurityScanContent } from "oxlint-plugin-react-doctor/core";
 import * as Crypto from "node:crypto";
 import crypto, { createHash } from "node:crypto";
-import * as NFS from "node:fs";
-import fs from "node:fs";
 import * as Path from "node:path";
 import path from "node:path";
+import * as NFS from "node:fs";
+import fs from "node:fs";
 import * as NodeChildProcess from "node:child_process";
-import { execFileSync, spawn, spawnSync } from "node:child_process";
+import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
 import { ResolverFactory } from "oxc-resolver";
 import ts from "typescript";
 import * as NodeUrl from "node:url";
@@ -3621,7 +3621,7 @@ const flatMap$5 = /* @__PURE__ */ dual(2, (self, f) => isNone(self) ? none() : f
 * @category filtering
 * @since 2.0.0
 */
-const filter = /* @__PURE__ */ dual(2, (self, predicate) => isNone(self) ? none() : predicate(self.value) ? some(self.value) : none());
+const filter$1 = /* @__PURE__ */ dual(2, (self, predicate) => isNone(self) ? none() : predicate(self.value) ? some(self.value) : none());
 //#endregion
 //#region ../../node_modules/.pnpm/effect@4.0.0-beta.70/node_modules/effect/dist/Result.js
 /**
@@ -15556,7 +15556,7 @@ function transformOptional(f) {
 */
 function withDefault$1(defaultValue) {
 	return new Getter((o) => {
-		const filtered = filter(o, isNotUndefined);
+		const filtered = filter$1(o, isNotUndefined);
 		return isSome(filtered) ? succeed$2(filtered) : mapEager(defaultValue, some);
 	});
 }
@@ -19404,6 +19404,10 @@ var JsonReportProjectEntryV3 = class extends Class("JsonReportProjectEntryV3")({
 	scannedFileCount: optional(Number$1),
 	elapsedMilliseconds: Number$1
 }) {};
+var JsonReportSkippedProject = class extends Class("JsonReportSkippedProject")({
+	directory: String$1,
+	reason: Literal("max-duration")
+}) {};
 /** Original full, diff, and staged report contract. */
 var JsonReportV1 = class extends Class("JsonReportV1")({
 	schemaVersion: Literal(1),
@@ -19432,6 +19436,7 @@ var JsonReportV1 = class extends Class("JsonReportV1")({
 	reactDetected: optional(Boolean$1),
 	diff: NullOr(JsonReportDiffInfo),
 	projects: ArraySchema(JsonReportProjectEntry),
+	skippedProjects: optional(ArraySchema(JsonReportSkippedProject)),
 	diagnostics: ArraySchema(Diagnostic),
 	summary: JsonReportSummary,
 	elapsedMilliseconds: Number$1,
@@ -19460,6 +19465,7 @@ var JsonReportV2 = class extends Class("JsonReportV2")({
 	diff: NullOr(JsonReportDiffInfo),
 	baseline: JsonReportBaseline,
 	projects: ArraySchema(JsonReportProjectEntry),
+	skippedProjects: optional(ArraySchema(JsonReportSkippedProject)),
 	diagnostics: ArraySchema(Diagnostic),
 	summary: JsonReportSummary,
 	elapsedMilliseconds: Number$1,
@@ -19476,6 +19482,7 @@ var JsonReportV3 = class extends Class("JsonReportV3")({
 	diff: NullOr(JsonReportDiffInfo),
 	baseline: optional(JsonReportBaseline),
 	projects: ArraySchema(JsonReportProjectEntryV3),
+	skippedProjects: optional(ArraySchema(JsonReportSkippedProject)),
 	diagnostics: ArraySchema(JsonReportDiagnosticV3),
 	summary: JsonReportSummary,
 	elapsedMilliseconds: Number$1,
@@ -53458,6 +53465,47 @@ const flattenArray = (self) => transformPull$1(self, (pull) => {
 	}));
 });
 /**
+* Filters arrays of elements emitted by a channel, applying the filter
+* to each element within the arrays and only emitting non-empty filtered arrays.
+*
+* **Example** (Filtering array output)
+*
+* ```ts
+* import { Array, Channel } from "effect"
+*
+* const nonEmptyArrayPredicate = Array.isReadonlyArrayNonEmpty
+*
+* // Create a channel that outputs arrays of mixed data
+* const arrayChannel = Channel.fromIterable([
+*   Array.make(1, 2, 3, 4, 5),
+*   Array.make(6, 7, 8, 9, 10),
+*   Array.make(11, 12, 13, 14, 15)
+* ]).pipe(Channel.filter(nonEmptyArrayPredicate))
+*
+* // Filter arrays to keep only even numbers
+* const evenArraysChannel = Channel.filterArray(arrayChannel, (n) => n % 2 === 0)
+* // Outputs: [2, 4], [6, 8, 10], [12, 14]
+* // Note: Only non-empty filtered arrays are emitted
+*
+* // Arrays that would become empty after filtering are discarded entirely
+* const oddChannel = Channel.fromIterable([
+*   Array.make(1, 3, 5),
+*   Array.make(2, 4),
+*   Array.make(7, 9)
+* ]).pipe(Channel.filter(nonEmptyArrayPredicate))
+* const filteredOddChannel = Channel.filterArray(oddChannel, (n) => n % 2 === 0)
+* // Outputs: [2, 4] (the arrays [1,3,5] and [7,9] are discarded)
+* ```
+*
+* @category filtering
+* @since 4.0.0
+*/
+const filterArray = /* @__PURE__ */ dual(2, (self, predicate) => transformPull$1(self, (pull) => succeed$2(flatMap$2(pull, function loop(arr) {
+	const passes = [];
+	for (let i = 0; i < arr.length; i++) if (predicate(arr[i])) passes.push(arr[i]);
+	return isReadonlyArrayNonEmpty(passes) ? succeed$2(passes) : flatMap$2(pull, loop);
+}))));
+/**
 * Filters and maps each element inside emitted non-empty arrays using a
 * `Filter`.
 *
@@ -55095,6 +55143,30 @@ const concat = /* @__PURE__ */ dual(2, (self, that) => flatten(fromArray([self,
 */
 const merge$1 = /* @__PURE__ */ dual((args) => isStream(args[0]) && isStream(args[1]), (self, that, options) => fromChannel(merge$2(toChannel(self), toChannel(that), options)));
 /**
+* Filters a stream to the elements that satisfy a predicate.
+*
+* **Example** (Filtering stream values)
+*
+* ```ts
+* import { Console, Effect, Stream } from "effect"
+*
+* const program = Effect.gen(function*() {
+*   const stream = Stream.make(1, 2, 3, 4).pipe(
+*     Stream.filter((n) => n % 2 === 0)
+*   )
+*   const values = yield* Stream.runCollect(stream)
+*   yield* Console.log(values)
+* })
+*
+* Effect.runPromise(program)
+* // Output: [ 2, 4 ]
+* ```
+*
+* @category filtering
+* @since 2.0.0
+*/
+const filter = /* @__PURE__ */ dual(2, (self, predicate) => fromChannel(filterArray(toChannel(self), predicate)));
+/**
 * Filters and maps stream elements in one pass using a `Filter`.
 *
 * @category filtering
@@ -61878,6 +61950,7 @@ const GENERATED_BUNDLE_FILE_PATTERN = /\.(iife|umd|global|min)\.m?js$/i;
 const GENERATED_SOURCE_DIRECTORY_PATTERN = /(?:^|\/)__generated__\//;
 const MINIFIED_SNIFF_BYTES = 65536;
 const GIT_LS_FILES_MAX_BUFFER_BYTES = 50 * 1024 * 1024;
+const GIT_CHECK_ATTR_MAX_BUFFER_BYTES = GIT_LS_FILES_MAX_BUFFER_BYTES;
 const SCANNED_DOT_DIRECTORIES = new Set([".dumi", ".storybook"]);
 const IGNORED_DIRECTORIES = new Set([
 	".angular",
@@ -62163,13 +62236,9 @@ const DEAD_CODE_WORKER_TIMEOUT_MS = 12e4;
 const OXLINT_SPLIT_TOTAL_BUDGET_MS = 18e4;
 const ABORT_EXIT_CODES = new Set([134, 3221226505]);
 const OXLINT_OOM_RESCUE_BUDGET_MS = 6e4;
-const DEAD_CODE_PHASE_TIMEOUT_MS = 15e4;
-const LINT_PHASE_TIMEOUT_MS = 3e5;
-const SCAN_TOTAL_DEADLINE_MS = 9e5;
 const DEAD_CODE_WORKER_MAX_OLD_SPACE_MB = 8192;
 const DEAD_CODE_WORKER_MEM_BUDGET_BYTES = 2 * 1024 * 1024 * 1024;
 const DEAD_CODE_TIMEOUT_CEILING_MS = 6e5;
-const DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS = 3e4;
 const DEAD_CODE_OVERLAP_PARSE_SHARE = .4;
 const RECOMMENDED_PNPM_MINIMUM_RELEASE_AGE_MINUTES = 10080;
 const REACT_SERVER_DOM_PACKAGES = [
@@ -62216,7 +62285,7 @@ const SOCKET_FREE_USER_AGENT = "react-doctor-supply-chain";
 const FILE_LINT_CACHE_FILENAME = "file-lint-cache.json";
 const FILE_LINT_CACHE_MAX_FILE_COUNT = 5e4;
 const SIDECAR_LINT_CACHE_FILENAME = "sidecar-lint-cache.json";
-const CORE_PACKAGE_VERSION = "0.9.3";
+const CORE_PACKAGE_VERSION = "0.9.4";
 const DEAD_CODE_CACHE_FILENAME = "dead-code-cache.json";
 const DEAD_CODE_SUMMARY_CACHE_FILENAME = "dead-code-summaries.json";
 const SUPPLY_CHAIN_PLUGIN = "socket";
@@ -62229,17 +62298,20 @@ const SUPPLY_CHAIN_IGNORED_PACKAGES = new Set(["next"]);
 const isErrnoException = (error) => error instanceof Error && "code" in error;
 const IGNORABLE_READDIR_ERROR_CODES = new Set([
 	"EACCES",
+	"EBUSY",
 	"EPERM",
 	"ENOENT",
 	"ENOTDIR",
 	"EINVAL",
 	"ELOOP",
-	"ENAMETOOLONG"
+	"ENAMETOOLONG",
+	"ETIMEDOUT",
+	"UNKNOWN"
 ]);
 const isIgnorableReaddirError = (error) => isErrnoException(error) && typeof error.code === "string" && IGNORABLE_READDIR_ERROR_CODES.has(error.code);
 const readDirectoryEntries = (directoryPath) => {
 	try {
-		return NFS.readdirSync(directoryPath, { withFileTypes: true });
+		return fs.readdirSync(directoryPath, { withFileTypes: true });
 	} catch (error) {
 		if (isIgnorableReaddirError(error)) return [];
 		throw error;
@@ -62247,14 +62319,14 @@ const readDirectoryEntries = (directoryPath) => {
 };
 const isFile = (filePath) => {
 	try {
-		return NFS.statSync(filePath).isFile();
+		return fs.statSync(filePath).isFile();
 	} catch {
 		return false;
 	}
 };
 const isDirectory = (directoryPath) => {
 	try {
-		return NFS.statSync(directoryPath).isDirectory();
+		return fs.statSync(directoryPath).isDirectory();
 	} catch {
 		return false;
 	}
@@ -62264,6 +62336,66 @@ const isPlainObject = (value) => {
 	const prototype = Object.getPrototypeOf(value);
 	return prototype === null || prototype === Object.prototype;
 };
+const LINGUIST_ATTRIBUTES = ["linguist-generated", "linguist-vendored"];
+const DISABLED_ATTRIBUTE_VALUES = new Set([
+	"unspecified",
+	"unset",
+	"false",
+	"0",
+	"off",
+	"no"
+]);
+const buildInput = (relativePaths) => `${relativePaths.join("\0")}\0`;
+const parseIgnoredPaths = (output) => {
+	const ignoredPaths = /* @__PURE__ */ new Set();
+	const fields = output.split("\0");
+	for (let fieldIndex = 0; fieldIndex + 2 < fields.length; fieldIndex += 3) {
+		const filePath = fields[fieldIndex];
+		const value = fields[fieldIndex + 2]?.toLowerCase();
+		if (filePath && value && !DISABLED_ATTRIBUTE_VALUES.has(value)) ignoredPaths.add(filePath);
+	}
+	return ignoredPaths;
+};
+const collectGitLinguistIgnoredPaths = (rootDirectory, relativePaths) => {
+	if (relativePaths.length === 0) return /* @__PURE__ */ new Set();
+	const result = spawnSync("git", [
+		"check-attr",
+		"-z",
+		"--stdin",
+		...LINGUIST_ATTRIBUTES
+	], {
+		cwd: rootDirectory,
+		encoding: "utf-8",
+		input: buildInput(relativePaths),
+		maxBuffer: GIT_CHECK_ATTR_MAX_BUFFER_BYTES
+	});
+	if (result.error || result.status !== 0) return /* @__PURE__ */ new Set();
+	return parseIgnoredPaths(result.stdout);
+};
+const collectGitLinguistIgnoredPathsCooperative = (rootDirectory, relativePaths, signal) => {
+	if (relativePaths.length === 0) return Promise.resolve(/* @__PURE__ */ new Set());
+	return new Promise((resolve, reject) => {
+		signal?.throwIfAborted();
+		execFile("git", [
+			"check-attr",
+			"-z",
+			"--stdin",
+			...LINGUIST_ATTRIBUTES
+		], {
+			cwd: rootDirectory,
+			encoding: "utf-8",
+			killSignal: "SIGKILL",
+			maxBuffer: GIT_CHECK_ATTR_MAX_BUFFER_BYTES,
+			signal
+		}, (error, stdout) => {
+			if (signal?.aborted) {
+				reject(signal.reason);
+				return;
+			}
+			resolve(error ? /* @__PURE__ */ new Set() : parseIgnoredPaths(stdout));
+		}).stdin?.end(buildInput(relativePaths));
+	});
+};
 const lastSourceMappingUrl = (fileContent) => {
 	const lastReference = [...fileContent.matchAll(/\/\/# sourceMappingURL=(\S+)/g)].at(-1);
 	return lastReference ? lastReference[1] : null;
@@ -62368,6 +62500,9 @@ function* walkSourceTreeFiles(rootDirectory) {
 		}
 	}
 }
+const yieldToEventLoop = () => new Promise((resolve) => {
+	setImmediate(resolve);
+});
 const collectSizedSourceFiles = (rootDirectory, relativePaths) => {
 	const entries = [];
 	for (const relativePath of relativePaths) {
@@ -62381,23 +62516,55 @@ const collectSizedSourceFiles = (rootDirectory, relativePaths) => {
 	}
 	return entries;
 };
-const gitLsFiles = (rootDirectory, flags) => {
+const collectSizedSourceFilesCooperative = async (rootDirectory, relativePaths, signal) => {
+	const entries = [];
+	let sliceStartedAt = performance.now();
+	for (const relativePath of relativePaths) {
+		signal?.throwIfAborted();
+		const absolutePath = Path.resolve(rootDirectory, relativePath);
+		const sizeBytes = statSourceFileSize(absolutePath);
+		if (!isLargeMinifiedFile(absolutePath, sizeBytes)) entries.push({
+			path: relativePath,
+			sizeBytes: sizeBytes ?? 0
+		});
+		if (performance.now() - sliceStartedAt >= 12) {
+			await yieldToEventLoop();
+			sliceStartedAt = performance.now();
+		}
+	}
+	return entries;
+};
+const parseGitSourceFilePaths = (output) => {
+	const trackedPaths = /* @__PURE__ */ new Set();
+	const untrackedPaths = [];
+	for (const entry of output.split("\0")) {
+		if (entry.length === 0) continue;
+		const trackedPath = /^[0-7]{6} [0-9a-f]+ [0-3]\t([\s\S]+)$/.exec(entry)?.[1];
+		if (trackedPath === void 0) untrackedPaths.push(entry);
+		else trackedPaths.add(trackedPath);
+	}
+	return {
+		trackedPaths: [...trackedPaths],
+		untrackedPaths
+	};
+};
+const listGitSourceFilePaths = (rootDirectory) => {
 	const result = spawnSync("git", [
 		"ls-files",
 		"-z",
-		...flags
+		"--stage",
+		"--others",
+		"--exclude-standard"
 	], {
 		cwd: rootDirectory,
 		encoding: "utf-8",
 		maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES
 	});
 	if (result.error || result.status !== 0) return null;
-	return result.stdout.split("\0").filter((filePath) => filePath.length > 0);
+	return parseGitSourceFilePaths(result.stdout);
 };
-const listSourceFilesViaGit = (rootDirectory) => {
-	const trackedPaths = gitLsFiles(rootDirectory, ["--cached"]);
-	const untrackedPaths = gitLsFiles(rootDirectory, ["--others", "--exclude-standard"]);
-	if (trackedPaths === null || untrackedPaths === null) return null;
+const collectGitCandidateSourceFilePaths = (rootDirectory, paths) => {
+	const { trackedPaths, untrackedPaths } = paths;
 	const emitDuplicateJsPaths = collectTypeScriptEmitDuplicateJsPaths({
 		trackedPaths: new Set(trackedPaths),
 		untrackedPaths,
@@ -62405,12 +62572,65 @@ const listSourceFilesViaGit = (rootDirectory) => {
 	});
 	return [...trackedPaths, ...untrackedPaths].filter((filePath) => isLintableSourceFile(filePath) && !hasIgnoredPathSegment(filePath) && !emitDuplicateJsPaths.has(filePath));
 };
+const filterGitSourceFilePaths = (rootDirectory, paths) => {
+	const candidatePaths = collectGitCandidateSourceFilePaths(rootDirectory, paths);
+	const linguistIgnoredPaths = collectGitLinguistIgnoredPaths(rootDirectory, candidatePaths);
+	return candidatePaths.filter((filePath) => !linguistIgnoredPaths.has(filePath));
+};
+const listSourceFilesViaGit = (rootDirectory) => {
+	const paths = listGitSourceFilePaths(rootDirectory);
+	return paths === null ? null : filterGitSourceFilePaths(rootDirectory, paths);
+};
+const listSourceFilesViaGitCooperative = async (rootDirectory, signal) => {
+	const paths = await new Promise((resolve, reject) => {
+		signal?.throwIfAborted();
+		execFile("git", [
+			"ls-files",
+			"-z",
+			"--stage",
+			"--others",
+			"--exclude-standard"
+		], {
+			cwd: rootDirectory,
+			encoding: "utf-8",
+			killSignal: "SIGKILL",
+			maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES,
+			signal
+		}, (error, stdout) => {
+			if (signal?.aborted) {
+				reject(signal.reason);
+				return;
+			}
+			resolve(error ? null : parseGitSourceFilePaths(stdout));
+		});
+	});
+	if (paths === null) return null;
+	const candidatePaths = collectGitCandidateSourceFilePaths(rootDirectory, paths);
+	const linguistIgnoredPaths = await collectGitLinguistIgnoredPathsCooperative(rootDirectory, candidatePaths, signal);
+	return candidatePaths.filter((filePath) => !linguistIgnoredPaths.has(filePath));
+};
 const listSourceFilesViaFilesystem = (rootDirectory) => {
 	const filePaths = [];
 	for (const { absolutePath, name } of walkSourceTreeFiles(rootDirectory)) if (isLintableSourceFile(name)) filePaths.push(Path.relative(rootDirectory, absolutePath).replace(/\\/g, "/"));
 	return filePaths;
 };
-const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, (listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory)).sort());
+const listSourceFilesViaFilesystemCooperative = async (rootDirectory, signal) => {
+	const filePaths = [];
+	let sliceStartedAt = performance.now();
+	for (const { absolutePath, name } of walkSourceTreeFiles(rootDirectory)) {
+		signal?.throwIfAborted();
+		if (isLintableSourceFile(name)) filePaths.push(Path.relative(rootDirectory, absolutePath).replace(/\\/g, "/"));
+		if (performance.now() - sliceStartedAt >= 12) {
+			await yieldToEventLoop();
+			sliceStartedAt = performance.now();
+		}
+	}
+	return filePaths;
+};
+const listSourceFilePaths = (rootDirectory) => (listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory)).sort();
+const listSourceFilePathsCooperative = async (rootDirectory, signal) => (await listSourceFilesViaGitCooperative(rootDirectory, signal) ?? await listSourceFilesViaFilesystemCooperative(rootDirectory, signal)).sort();
+const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, listSourceFilePaths(rootDirectory));
+const listSourceFilesCooperative = async (rootDirectory, signal) => (await collectSizedSourceFilesCooperative(rootDirectory, await listSourceFilePathsCooperative(rootDirectory, signal), signal)).map((entry) => entry.path);
 const listSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).map((entry) => entry.path);
 const countSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).length;
 const UTF8_BOM_CHARACTER = "";
@@ -62536,7 +62756,12 @@ const mergeCompilerOptions = (inherited, current) => {
 	};
 };
 const readResolvedCompilerOptions = (tsConfigPath, extendsDepth, visitedPaths) => {
-	const realPath = NFS.realpathSync.native(tsConfigPath);
+	let realPath;
+	try {
+		realPath = NFS.realpathSync.native(tsConfigPath);
+	} catch {
+		return null;
+	}
 	if (visitedPaths.has(realPath)) return null;
 	const tsConfig = readTsConfig(realPath);
 	if (!tsConfig) return null;
@@ -63064,27 +63289,30 @@ const getSelectedObjectProperty = (expression, propertyName, analysis, visitedEx
 	}
 	return null;
 };
-const configExpressionMayDefineProperty = (expression, propertyName, analysis) => {
+const configExpressionMayDefineProperty = (expression, propertyName, analysis, visitedExpressions = /* @__PURE__ */ new Set()) => {
 	let resolvedExpression = expression;
 	while (ts.isParenthesizedExpression(resolvedExpression) || ts.isAsExpression(resolvedExpression) || ts.isTypeAssertionExpression(resolvedExpression) || ts.isSatisfiesExpression(resolvedExpression) || ts.isNonNullExpression(resolvedExpression)) resolvedExpression = resolvedExpression.expression;
+	if (visitedExpressions.has(resolvedExpression)) return true;
+	const nextVisitedExpressions = new Set(visitedExpressions);
+	nextVisitedExpressions.add(resolvedExpression);
 	if (ts.isIdentifier(resolvedExpression)) {
 		if (analysis.localBindings.has(resolvedExpression.text)) {
 			const localReference = analysis.localBindings.get(resolvedExpression.text);
-			return localReference?.expression ? configExpressionMayDefineProperty(localReference.expression, propertyName, localReference.analysis) : true;
+			return localReference?.expression ? configExpressionMayDefineProperty(localReference.expression, propertyName, localReference.analysis, nextVisitedExpressions) : true;
 		}
 		const scopedBinding = getScopedConfigBinding(resolvedExpression);
-		if (scopedBinding.wasFound) return scopedBinding.initializer ? configExpressionMayDefineProperty(scopedBinding.initializer, propertyName, analysis) : true;
+		if (scopedBinding.wasFound) return scopedBinding.initializer ? configExpressionMayDefineProperty(scopedBinding.initializer, propertyName, analysis, nextVisitedExpressions) : true;
 		const topLevelBinding = getTopLevelBinding(analysis.sourceFile, resolvedExpression.text);
-		return topLevelBinding && ts.isExpression(topLevelBinding) ? configExpressionMayDefineProperty(topLevelBinding, propertyName, analysis) : true;
+		return topLevelBinding && ts.isExpression(topLevelBinding) ? configExpressionMayDefineProperty(topLevelBinding, propertyName, analysis, nextVisitedExpressions) : true;
 	}
 	if (ts.isConditionalExpression(resolvedExpression)) {
-		if (isStaticallyTruthyConfigExpression(resolvedExpression.condition, analysis)) return configExpressionMayDefineProperty(resolvedExpression.whenTrue, propertyName, analysis);
-		if (isStaticallyDisabledConfigExpression(resolvedExpression.condition, analysis)) return configExpressionMayDefineProperty(resolvedExpression.whenFalse, propertyName, analysis);
-		return configExpressionMayDefineProperty(resolvedExpression.whenTrue, propertyName, analysis) || configExpressionMayDefineProperty(resolvedExpression.whenFalse, propertyName, analysis);
+		if (isStaticallyTruthyConfigExpression(resolvedExpression.condition, analysis)) return configExpressionMayDefineProperty(resolvedExpression.whenTrue, propertyName, analysis, nextVisitedExpressions);
+		if (isStaticallyDisabledConfigExpression(resolvedExpression.condition, analysis)) return configExpressionMayDefineProperty(resolvedExpression.whenFalse, propertyName, analysis, nextVisitedExpressions);
+		return configExpressionMayDefineProperty(resolvedExpression.whenTrue, propertyName, analysis, nextVisitedExpressions) || configExpressionMayDefineProperty(resolvedExpression.whenFalse, propertyName, analysis, nextVisitedExpressions);
 	}
 	if (!ts.isObjectLiteralExpression(resolvedExpression)) return true;
 	return resolvedExpression.properties.some((property) => {
-		if (ts.isSpreadAssignment(property)) return configExpressionMayDefineProperty(property.expression, propertyName, analysis);
+		if (ts.isSpreadAssignment(property)) return configExpressionMayDefineProperty(property.expression, propertyName, analysis, nextVisitedExpressions);
 		if (ts.isPropertyAssignment(property) || ts.isShorthandPropertyAssignment(property) || ts.isMethodDeclaration(property) || ts.isGetAccessorDeclaration(property) || ts.isSetAccessorDeclaration(property)) {
 			const staticPropertyName = getStaticPropertyName$2(property.name);
 			return staticPropertyName === null || staticPropertyName === propertyName;
@@ -63160,7 +63388,13 @@ const analyzeConfigModuleExport = (filePath, exportName, allowCompilerTransform,
 	if (visitedModules.has(moduleVisitKey)) return false;
 	const nextVisitedModules = new Set(visitedModules);
 	nextVisitedModules.add(moduleVisitKey);
-	return analyzeConfigSourceFileExport(parseConfigSourceFile(filePath, NFS.readFileSync(filePath, "utf-8")), filePath, exportName, allowCompilerTransform, importDepth, nextVisitedModules, argumentsList, argumentAnalysis);
+	let sourceText;
+	try {
+		sourceText = NFS.readFileSync(filePath, "utf-8");
+	} catch {
+		return false;
+	}
+	return analyzeConfigSourceFileExport(parseConfigSourceFile(filePath, sourceText), filePath, exportName, allowCompilerTransform, importDepth, nextVisitedModules, argumentsList, argumentAnalysis);
 };
 const analyzeConfigSourceFileExport = (sourceFile, filePath, exportName, allowCompilerTransform, importDepth, visitedModules, argumentsList = [], argumentAnalysis) => {
 	const analysis = {
@@ -63988,13 +64222,7 @@ const hasReactDependency = (packageJson) => {
 	};
 	return Object.keys(allDependencies).some((packageName) => REACT_DEPENDENCY_NAMES.has(packageName));
 };
-const getPreactVersion = (packageJson) => {
-	return {
-		...packageJson.peerDependencies,
-		...packageJson.dependencies,
-		...packageJson.devDependencies
-	}.preact ?? null;
-};
+const getPreactVersion = (packageJson) => getDependencySpec(packageJson, "preact");
 const resolveCatalogBackedDependencyVersion = ({ rootDirectory, rootPackageJson, packageName, sourceDirectory = rootDirectory, sourcePackageJson = rootPackageJson, version }) => {
 	if (version === null || !isCatalogReference(version)) return version;
 	const catalogName = extractCatalogName(version);
@@ -64739,7 +64967,16 @@ const getBrowserslistProtectionRequirement = (directory) => {
 		if (!queries) return void 0;
 		let requirement;
 		let hasUnsupportedTarget = false;
-		for (const browserTarget of (0, import_browserslist.default)(queries)) {
+		const previousIgnoreOldData = process.env.BROWSERSLIST_IGNORE_OLD_DATA;
+		let browserTargets = [];
+		try {
+			process.env.BROWSERSLIST_IGNORE_OLD_DATA = "true";
+			browserTargets = (0, import_browserslist.default)(queries);
+		} finally {
+			if (previousIgnoreOldData === void 0) delete process.env.BROWSERSLIST_IGNORE_OLD_DATA;
+			else process.env.BROWSERSLIST_IGNORE_OLD_DATA = previousIgnoreOldData;
+		}
+		for (const browserTarget of browserTargets) {
 			const browserRequirement = getBrowserProtectionRequirement(browserTarget);
 			if (browserRequirement === "unsupported") hasUnsupportedTarget = true;
 			if (browserRequirement === "noreferrer") requirement = "noreferrer";
@@ -64849,9 +65086,9 @@ const clearProjectCache = () => {
 * framework-agnostic rules. Throws only when the directory has nothing
 * to scan (no enclosing project and no source files of its own).
 */
-const discoverProjectWithoutPackageJson = (directory) => {
-	const sourceFileCount = countSourceFiles(directory);
-	const hasOwnTsConfig = NFS.existsSync(Path.join(directory, "tsconfig.json"));
+const discoverProjectWithoutPackageJson = (directory, options) => {
+	const sourceFileCount = options.sourceFileCount ?? countSourceFiles(directory);
+	const hasOwnTsConfig = isFile(Path.join(directory, "tsconfig.json"));
 	const enclosingProjectRoot = findNearestAncestorPackageJson(directory);
 	const enclosingProject = enclosingProjectRoot !== null ? discoverProject(enclosingProjectRoot) : null;
 	if (enclosingProject !== null) return {
@@ -64917,12 +65154,15 @@ const discoverProjectWithoutPackageJson = (directory) => {
 		sourceFileCount
 	};
 };
-const discoverProject = (directory) => {
+const discoverProject = (directory, options = {}) => {
 	const cached = cachedProjectInfos.get(directory);
-	if (cached !== void 0) return cached;
+	if (cached !== void 0) return options.sourceFileCount === void 0 ? cached : {
+		...cached,
+		sourceFileCount: options.sourceFileCount
+	};
 	const packageJsonPath = Path.join(directory, "package.json");
 	if (!isFile(packageJsonPath)) {
-		const synthesized = discoverProjectWithoutPackageJson(directory);
+		const synthesized = discoverProjectWithoutPackageJson(directory, options);
 		cachedProjectInfos.set(directory, synthesized);
 		return synthesized;
 	}
@@ -64984,8 +65224,8 @@ const discoverProject = (directory) => {
 	const tailwindVersion = tailwindcss.version;
 	const zodVersion = zod.version;
 	const projectName = packageJson.name ?? Path.basename(directory);
-	const hasTypeScript = NFS.existsSync(Path.join(directory, "tsconfig.json"));
-	const sourceFileCount = countSourceFiles(directory);
+	const hasTypeScript = isFile(Path.join(directory, "tsconfig.json"));
+	const sourceFileCount = options.sourceFileCount ?? countSourceFiles(directory);
 	const hasReactNativeWorkspace = framework === "expo" || framework === "react-native" || workspaceFacts.hasReactNativeAwarePackage;
 	const expoVersion = hasReactNativeWorkspace ? resolveCatalogBackedDependencyVersion({
 		rootDirectory: directory,
@@ -65114,134 +65354,6 @@ const discoverProject = (directory) => {
 * single source file has nothing to analyze.
 */
 const isAnalyzableProject = (project) => project.reactVersion !== null || project.preactVersion !== null || project.sourceFileCount > 0;
-const messageFromUnknown = (error) => error instanceof Error ? error.message : String(error);
-var InvalidGlobPatternError = class extends Error {
-	pattern;
-	reason;
-	constructor(pattern, reason) {
-		super(`Invalid glob pattern ${JSON.stringify(pattern)}: ${reason}`);
-		this.name = "InvalidGlobPatternError";
-		this.pattern = pattern;
-		this.reason = reason;
-	}
-};
-const assertGlobPattern = (condition, pattern, reason) => {
-	if (!condition) throw new InvalidGlobPatternError(pattern, reason);
-};
-const countGlobWildcards = (pattern) => (pattern.match(/[*?]/g) ?? []).length;
-const normalizeGlobPattern = (pattern) => pattern.replace(/\\/g, "/").replace(/^\//, "");
-const PICOMATCH_OPTIONS = {
-	dot: true,
-	strictSlashes: false,
-	windows: false
-};
-const compileGlobPattern = (rawPattern) => {
-	assertGlobPattern(typeof rawPattern === "string" && rawPattern.length > 0, String(rawPattern), "pattern must be a non-empty string.");
-	assertGlobPattern(rawPattern.length <= MAX_GLOB_PATTERN_LENGTH_CHARS, rawPattern, `pattern length ${rawPattern.length} exceeds the maximum of ${MAX_GLOB_PATTERN_LENGTH_CHARS} characters.`);
-	const wildcardCount = countGlobWildcards(rawPattern);
-	assertGlobPattern(wildcardCount <= 24, rawPattern, `pattern uses ${wildcardCount} wildcards (\`*\` / \`?\`), exceeding the maximum of 24. This guards against catastrophic backtracking from pathological patterns; split the pattern into multiple smaller entries.`);
-	try {
-		return import_picomatch.default.makeRe(normalizeGlobPattern(rawPattern), PICOMATCH_OPTIONS);
-	} catch (caughtError) {
-		throw new InvalidGlobPatternError(rawPattern, messageFromUnknown(caughtError));
-	}
-};
-const compileGlobPatternsLenient = (patterns, onInvalid) => {
-	const compiled = [];
-	for (const pattern of patterns) try {
-		compiled.push(compileGlobPattern(pattern));
-	} catch (caughtError) {
-		if (!(caughtError instanceof InvalidGlobPatternError)) throw caughtError;
-		onInvalid(caughtError);
-	}
-	return compiled;
-};
-const toRelativePath = (filePath, rootDirectory) => {
-	const normalizedFilePath = filePath.replace(/\\/g, "/");
-	const normalizedRoot = rootDirectory.replace(/\\/g, "/").replace(/\/$/, "") + "/";
-	if (normalizedFilePath.startsWith(normalizedRoot)) return normalizedFilePath.slice(normalizedRoot.length);
-	return normalizedFilePath.replace(/^\.\//, "");
-};
-const warnConfigIssue = (message) => {
-	process.stderr.write(`[react-doctor] ${message}\n`);
-};
-const isStringArray = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string");
-const collectStringList = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
-const validateOverrideEntry = (entry, index) => {
-	if (!isPlainObject(entry)) {
-		warnConfigIssue(`ignore.overrides[${index}] must be an object with { files, rules }; ignoring this entry.`);
-		return null;
-	}
-	if (!isStringArray(entry.files)) {
-		warnConfigIssue(`ignore.overrides[${index}].files must be an array of strings; ignoring this entry.`);
-		return null;
-	}
-	if (entry.rules !== void 0 && !isStringArray(entry.rules)) {
-		warnConfigIssue(`ignore.overrides[${index}].rules must be an array of "plugin/rule" strings or omitted; treating as missing (override would suppress every rule for the matched files).`);
-		return { files: entry.files };
-	}
-	return entry.rules === void 0 ? { files: entry.files } : {
-		files: entry.files,
-		rules: entry.rules
-	};
-};
-const compileIgnoreOverrides = (userConfig) => {
-	const overrides = userConfig?.ignore?.overrides;
-	if (overrides === void 0) return [];
-	if (!Array.isArray(overrides)) {
-		warnConfigIssue(`ignore.overrides must be an array of { files, rules } entries; ignoring.`);
-		return [];
-	}
-	return overrides.flatMap((entry, index) => {
-		const validated = validateOverrideEntry(entry, index);
-		if (!validated) return [];
-		const filePatterns = compileGlobPatternsLenient(collectStringList(validated.files), (error) => warnConfigIssue(`ignore.overrides[${index}]: ${error.message}`));
-		if (filePatterns.length === 0) return [];
-		return [{
-			filePatterns,
-			ruleIds: new Set(collectStringList(validated.rules))
-		}];
-	});
-};
-const isDiagnosticIgnoredByOverrides = (diagnostic, rootDirectory, overrides) => {
-	if (overrides.length === 0) return false;
-	const relativeFilePath = toRelativePath(diagnostic.filePath, rootDirectory);
-	const ruleIdentifier = `${diagnostic.plugin}/${diagnostic.rule}`;
-	return overrides.some((override) => override.filePatterns.some((pattern) => pattern.test(relativeFilePath)) && (override.ruleIds.size === 0 || override.ruleIds.has(ruleIdentifier)));
-};
-const SEVERITY_FOR_OVERRIDE = {
-	error: "error",
-	warn: "warning"
-};
-const restampSeverity = (diagnostic, override) => {
-	const targetSeverity = SEVERITY_FOR_OVERRIDE[override];
-	if (diagnostic.severity === targetSeverity) return diagnostic;
-	return {
-		...diagnostic,
-		severity: targetSeverity
-	};
-};
-/**
-* Assembles the internal `RuleSeverityControls` shape from a user
-* config's top-level `rules` and `categories` fields — the
-* ESLint / oxlint-shaped severity surface.
-*
-* Returns `undefined` when neither field is present so the common
-* path (no severity config at all) stays allocation-free for
-* downstream consumers.
-*/
-const buildRuleSeverityControls = (config) => {
-	if (!config) return void 0;
-	if (config.rules === void 0 && config.categories === void 0 && config.buckets === void 0) return;
-	return {
-		...config.rules !== void 0 ? { rules: config.rules } : {},
-		...config.categories !== void 0 ? { categories: config.categories } : {},
-		...config.buckets !== void 0 ? { buckets: config.buckets } : {}
-	};
-};
-const FOREIGN_INLINE_DISABLE_PATTERN = /(?:\/\/|\/\*)[ \t]*(eslint|oxlint)-disable-(next-line|line)(?![\w-])([^\r\n]*)/;
-const FOREIGN_BLOCK_DISABLE_PATTERN = /\/\*[ \t]*(eslint|oxlint)-disable(?![\w-])([^*\r\n]*)/;
-const FOREIGN_BLOCK_ENABLE_PATTERN = /\/\*[ \t]*(?:eslint|oxlint)-enable(?![\w-])([^*\r\n]*)/;
 const LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY = {
 	"effect/no-adjust-state-on-prop-change": "react-doctor/no-adjust-state-on-prop-change",
 	"effect/no-chain-state-updates": "react-doctor/no-chain-state-updates",
@@ -65380,6 +65492,139 @@ const getEquivalentRuleKeys = (ruleKey) => {
 	const nativeRuleKey = canonicalizeRuleKey(ruleKey);
 	return [nativeRuleKey, ...getLegacyRuleKeysForNative(nativeRuleKey)];
 };
+const messageFromUnknown = (error) => error instanceof Error ? error.message : String(error);
+var InvalidGlobPatternError = class extends Error {
+	pattern;
+	reason;
+	constructor(pattern, reason) {
+		super(`Invalid glob pattern ${JSON.stringify(pattern)}: ${reason}`);
+		this.name = "InvalidGlobPatternError";
+		this.pattern = pattern;
+		this.reason = reason;
+	}
+};
+const assertGlobPattern = (condition, pattern, reason) => {
+	if (!condition) throw new InvalidGlobPatternError(pattern, reason);
+};
+const countGlobWildcards = (pattern) => (pattern.match(/[*?]/g) ?? []).length;
+const normalizeGlobPattern = (pattern) => pattern.replace(/\\/g, "/").replace(/^\//, "");
+const PICOMATCH_OPTIONS = {
+	dot: true,
+	strictSlashes: false,
+	windows: false
+};
+const compileGlobPattern = (rawPattern) => {
+	assertGlobPattern(typeof rawPattern === "string" && rawPattern.length > 0, String(rawPattern), "pattern must be a non-empty string.");
+	assertGlobPattern(rawPattern.length <= MAX_GLOB_PATTERN_LENGTH_CHARS, rawPattern, `pattern length ${rawPattern.length} exceeds the maximum of ${MAX_GLOB_PATTERN_LENGTH_CHARS} characters.`);
+	const wildcardCount = countGlobWildcards(rawPattern);
+	assertGlobPattern(wildcardCount <= 24, rawPattern, `pattern uses ${wildcardCount} wildcards (\`*\` / \`?\`), exceeding the maximum of 24. This guards against catastrophic backtracking from pathological patterns; split the pattern into multiple smaller entries.`);
+	try {
+		return import_picomatch.default.makeRe(normalizeGlobPattern(rawPattern), PICOMATCH_OPTIONS);
+	} catch (caughtError) {
+		throw new InvalidGlobPatternError(rawPattern, messageFromUnknown(caughtError));
+	}
+};
+const compileGlobPatternsLenient = (patterns, onInvalid) => {
+	const compiled = [];
+	for (const pattern of patterns) try {
+		compiled.push(compileGlobPattern(pattern));
+	} catch (caughtError) {
+		if (!(caughtError instanceof InvalidGlobPatternError)) throw caughtError;
+		onInvalid(caughtError);
+	}
+	return compiled;
+};
+const toRelativePath = (filePath, rootDirectory) => {
+	const normalizedFilePath = filePath.replace(/\\/g, "/");
+	const normalizedRoot = rootDirectory.replace(/\\/g, "/").replace(/\/$/, "") + "/";
+	if (normalizedFilePath.startsWith(normalizedRoot)) return normalizedFilePath.slice(normalizedRoot.length);
+	return normalizedFilePath.replace(/^\.\//, "");
+};
+const warnConfigIssue = (message) => {
+	process.stderr.write(`[react-doctor] ${message}\n`);
+};
+const isStringArray = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string");
+const collectStringList = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+const hasMatchingRuleOverride = (ruleIds, ruleIdentifier) => {
+	if (ruleIds.size === 0) return true;
+	for (const ruleId of ruleIds) if (isSameRuleKey(ruleId, ruleIdentifier)) return true;
+	return false;
+};
+const validateOverrideEntry = (entry, index) => {
+	if (!isPlainObject(entry)) {
+		warnConfigIssue(`ignore.overrides[${index}] must be an object with { files, rules }; ignoring this entry.`);
+		return null;
+	}
+	if (!isStringArray(entry.files)) {
+		warnConfigIssue(`ignore.overrides[${index}].files must be an array of strings; ignoring this entry.`);
+		return null;
+	}
+	if (entry.rules !== void 0 && !isStringArray(entry.rules)) {
+		warnConfigIssue(`ignore.overrides[${index}].rules must be an array of "plugin/rule" strings or omitted; treating as missing (override would suppress every rule for the matched files).`);
+		return { files: entry.files };
+	}
+	return entry.rules === void 0 ? { files: entry.files } : {
+		files: entry.files,
+		rules: entry.rules
+	};
+};
+const compileIgnoreOverrides = (userConfig) => {
+	const overrides = userConfig?.ignore?.overrides;
+	if (overrides === void 0) return [];
+	if (!Array.isArray(overrides)) {
+		warnConfigIssue(`ignore.overrides must be an array of { files, rules } entries; ignoring.`);
+		return [];
+	}
+	return overrides.flatMap((entry, index) => {
+		const validated = validateOverrideEntry(entry, index);
+		if (!validated) return [];
+		const filePatterns = compileGlobPatternsLenient(collectStringList(validated.files), (error) => warnConfigIssue(`ignore.overrides[${index}]: ${error.message}`));
+		if (filePatterns.length === 0) return [];
+		return [{
+			filePatterns,
+			ruleIds: new Set(collectStringList(validated.rules))
+		}];
+	});
+};
+const isDiagnosticIgnoredByOverrides = (diagnostic, rootDirectory, overrides) => {
+	if (overrides.length === 0) return false;
+	const relativeFilePath = toRelativePath(diagnostic.filePath, rootDirectory);
+	const ruleIdentifier = `${diagnostic.plugin}/${diagnostic.rule}`;
+	return overrides.some((override) => override.filePatterns.some((pattern) => pattern.test(relativeFilePath)) && hasMatchingRuleOverride(override.ruleIds, ruleIdentifier));
+};
+const SEVERITY_FOR_OVERRIDE = {
+	error: "error",
+	warn: "warning"
+};
+const restampSeverity = (diagnostic, override) => {
+	const targetSeverity = SEVERITY_FOR_OVERRIDE[override];
+	if (diagnostic.severity === targetSeverity) return diagnostic;
+	return {
+		...diagnostic,
+		severity: targetSeverity
+	};
+};
+/**
+* Assembles the internal `RuleSeverityControls` shape from a user
+* config's top-level `rules` and `categories` fields — the
+* ESLint / oxlint-shaped severity surface.
+*
+* Returns `undefined` when neither field is present so the common
+* path (no severity config at all) stays allocation-free for
+* downstream consumers.
+*/
+const buildRuleSeverityControls = (config) => {
+	if (!config) return void 0;
+	if (config.rules === void 0 && config.categories === void 0 && config.buckets === void 0) return;
+	return {
+		...config.rules !== void 0 ? { rules: config.rules } : {},
+		...config.categories !== void 0 ? { categories: config.categories } : {},
+		...config.buckets !== void 0 ? { buckets: config.buckets } : {}
+	};
+};
+const FOREIGN_INLINE_DISABLE_PATTERN = /(?:\/\/|\/\*)[ \t]*(eslint|oxlint)-disable-(next-line|line)(?![\w-])([^\r\n]*)/;
+const FOREIGN_BLOCK_DISABLE_PATTERN = /\/\*[ \t]*(eslint|oxlint)-disable(?![\w-])([^*\r\n]*)/;
+const FOREIGN_BLOCK_ENABLE_PATTERN = /\/\*[ \t]*(?:eslint|oxlint)-enable(?![\w-])([^*\r\n]*)/;
 const stripDescriptionTail = (ruleList) => {
 	const descriptionMatch = ruleList.match(/(?:^|\s)--\s/);
 	if (!descriptionMatch || descriptionMatch.index === void 0) return ruleList;
@@ -66030,12 +66275,8 @@ const buildDiagnosticPipeline = (input) => {
 		if (rule.tags.includes("migration-hint")) return false;
 		return getFileContext(diagnostic.filePath) !== "production";
 	};
-	const isRuleIgnored = (ruleIdentifier) => {
-		for (const ignored of ignoredRules) if (isSameRuleKey(ignored, ruleIdentifier)) return true;
-		return false;
-	};
-	const isAppOnlyRule = (ruleIdentifier) => {
-		for (const appOnlyRuleKey of APP_ONLY_RULE_KEYS) if (isSameRuleKey(appOnlyRuleKey, ruleIdentifier)) return true;
+	const matchesRuleKey = (ruleIdentifier, candidates) => {
+		for (const candidate of candidates) if (isSameRuleKey(candidate, ruleIdentifier)) return true;
 		return false;
 	};
 	const isRnRawTextSuppressedByConfig = (diagnostic) => {
@@ -66077,12 +66318,13 @@ const buildDiagnosticPipeline = (input) => {
 				if (explicitSeverityOverride === "off") return suppress(current, "config");
 				if (explicitSeverityOverride !== void 0) current = restampSeverity(current, explicitSeverityOverride);
 			}
+			const ruleIdentifier = `${current.plugin}/${current.rule}`;
 			if (explicitRuleOverride === void 0) {
-				if (isAppOnlyRule(`${current.plugin}/${current.rule}`) && isLibraryFile(current.filePath)) return null;
+				if (matchesRuleKey(ruleIdentifier, APP_ONLY_RULE_KEYS) && isLibraryFile(current.filePath)) return null;
 			}
 			if (!showWarnings && current.severity === "warning" && explicitSeverityOverride !== "warn") return null;
 			if (userConfig) {
-				if (isRuleIgnored(`${current.plugin}/${current.rule}`)) return suppress(current, "config");
+				if (matchesRuleKey(ruleIdentifier, ignoredRules)) return suppress(current, "config");
 				if (isFileIgnoredByPatterns(current.filePath, rootDirectory, ignoredFilePatterns)) return null;
 				if (isDiagnosticIgnoredByOverrides(current, rootDirectory, compiledOverrides)) return suppress(current, "override");
 				if (isRnRawTextSuppressedByConfig(current)) return null;
@@ -66091,7 +66333,6 @@ const buildDiagnosticPipeline = (input) => {
 			if (respectInlineDisables && current.line > 0) {
 				const lines = getFileLines(current.filePath);
 				if (lines) {
-					const ruleIdentifier = `${current.plugin}/${current.rule}`;
 					const evaluation = evaluateSuppression(lines, current.line - 1, ruleIdentifier);
 					if (evaluation.isSuppressed) return suppress(current, evaluation.isForeignDirective ? "foreign-inline" : "inline");
 					if (evaluation.nearMissHint) current = {
@@ -66367,7 +66608,8 @@ const readSystemFacts$1 = () => ({
 /**
 * Auto lint-worker count: the smaller of the (cgroup-CPU-aware) core count and
 * the number of `PER_WORKER_MEM_BUDGET_BYTES` workers that fit in available
-* memory, then clamped to `[MIN, HARD_MAX]` by `resolveScanConcurrency`.
+* memory, and the measured automatic parallel-efficiency ceiling, then clamped
+* to `[MIN, HARD_MAX]` by `resolveScanConcurrency`.
 *
 * `os.availableParallelism()` already respects cgroup CPU quotas, so the core
 * term needs no help. Available memory is `os.totalmem()` floored by the cgroup
@@ -66383,7 +66625,7 @@ const readSystemFacts$1 = () => ({
 const resolveAutoScanConcurrency = (facts = readSystemFacts$1()) => {
 	const availableMemoryBytes = Math.min(facts.totalMemoryBytes, facts.cgroupMemoryLimitBytes ?? Number.POSITIVE_INFINITY);
 	const memoryBoundedWorkers = Math.floor(availableMemoryBytes / PER_WORKER_MEM_BUDGET_BYTES);
-	return resolveScanConcurrency(Math.min(facts.availableCores, memoryBoundedWorkers));
+	return resolveScanConcurrency(Math.min(facts.availableCores, memoryBoundedWorkers, 10));
 };
 const resolveLintBatchOrdering = () => {
 	return process.env["REACT_DOCTOR_LINT_BATCH_ORDERING"]?.trim().toLowerCase() === "arrival" ? "arrival" : "cost";
@@ -66396,24 +66638,22 @@ const resolveLintBatchOrdering = () => {
 */
 var OxlintSpawnTimeoutMs = class extends Reference("react-doctor/OxlintSpawnTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_OXLINT_SPAWN_TIMEOUT_MS", OXLINT_SPAWN_TIMEOUT_MS) }) {};
 /**
-* Effect-side cap on the lint phase. The env var lets CI / eval runners
-* raise the phase budget for slow large repos without recompiling.
+* Optional Effect-side cap on the lint phase. Unbounded unless explicitly
+* configured through the env var or a test layer.
 * Tests override via `Layer.succeed(LintPhaseTimeoutMs, ...)`.
 */
-var LintPhaseTimeoutMs = class extends Reference("react-doctor/LintPhaseTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_LINT_PHASE_TIMEOUT_MS", LINT_PHASE_TIMEOUT_MS) }) {};
+var LintPhaseTimeoutMs = class extends Reference("react-doctor/LintPhaseTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_LINT_PHASE_TIMEOUT_MS", null) }) {};
 /**
-* Effect-side cap on the dead-code phase, sitting above the in-worker
-* timeout as a runtime-independent backstop. The env var raises it for
-* type-heavy projects; tests override via
+* Optional Effect-side cap on the dead-code phase. Unbounded unless explicitly
+* configured through the env var or a test layer. Tests override via
 * `Layer.succeed(DeadCodePhaseTimeoutMs, ...)`.
 */
-var DeadCodePhaseTimeoutMs = class extends Reference("react-doctor/DeadCodePhaseTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_DEAD_CODE_PHASE_TIMEOUT_MS", DEAD_CODE_PHASE_TIMEOUT_MS) }) {};
+var DeadCodePhaseTimeoutMs = class extends Reference("react-doctor/DeadCodePhaseTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_DEAD_CODE_PHASE_TIMEOUT_MS", null) }) {};
 /**
-* Overall scan deadline backstop, bounding everything the per-phase
-* timeouts don't (wedged git / IO). The env var raises it for very
-* large repos; tests override via `Layer.succeed(ScanDeadlineMs, ...)`.
+* Optional overall scan deadline. Unbounded unless explicitly configured
+* through the env var or a test layer.
 */
-var ScanDeadlineMs = class extends Reference("react-doctor/ScanDeadlineMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_SCAN_DEADLINE_MS", SCAN_TOTAL_DEADLINE_MS) }) {};
+var ScanDeadlineMs = class extends Reference("react-doctor/ScanDeadlineMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_SCAN_DEADLINE_MS", null) }) {};
 /**
 * Wall-clock budget for the supply-chain check when it runs on a background
 * fiber overlapping the lint pass. Reads from the env var on startup so the
@@ -66486,14 +66726,14 @@ var DeadCodeOverlap = class extends Reference("react-doctor/DeadCodeOverlap", {
 /**
 * How the full-scan lint pass plans its file batches. `"cost"` (the default)
 * builds size-balanced LPT batches (`planLintBatches`): the same mandatory
-* batch count as greedy chunking (`ceil(files / 100)`), but every batch gets
-* an even share of files AND bytes, so no 100-file chunk is a straggler while
+* batch count as greedy chunking, but every batch gets an even share of files
+* AND bytes, so no full chunk is a straggler while
 * the remainder-batch worker idles — and the heavy files are SPREAD across
 * batches, the precondition the old sort-desc-then-chunk-100 `cost` mode
 * lacked (it packed the heaviest files into one wave-1 straggler batch,
 * measurably regressing size-skewed repos, which is why it never earned the
 * default). `"arrival"` (`REACT_DOCTOR_LINT_BATCH_ORDERING=arrival`) is the
-* rollback hatch to plain greedy 100-file chunking in discovery order. Tests
+* rollback hatch to plain greedy fixed-size chunking in discovery order. Tests
 * override via `Layer.succeed(LintBatchOrdering, ...)`. Diff / staged scans
 * never reach this — they pass user-scoped `includePaths` that skip discovery
 * and stay in arrival order; only the full-scan branch reads it.
@@ -66588,6 +66828,7 @@ const DEFAULT_SURFACE_EXCLUDED_TAGS = {
 	score: ["design"],
 	ciFailure: ["design"]
 };
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const VALID_RULE_SEVERITIES = [
 	"error",
 	"warn",
@@ -66630,7 +66871,6 @@ const SURFACE_CONTROL_FIELD_NAMES = [
 ];
 const isIncludedFileContext = (value) => VALID_INCLUDED_FILE_CONTEXTS.some((fileContext) => fileContext === value);
 const SEVERITY_FIELD_NAMES = ["rules", "categories"];
-const isPlainObject$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const formatType = (value) => typeof value === "string" ? `"${value}"` : typeof value;
 const isRuleSeverity = (value) => typeof value === "string" && VALID_RULE_SEVERITIES.includes(value);
 const coerceMaybeBooleanString = (fieldName, value) => {
@@ -66657,8 +66897,45 @@ const validateStringArrayField = (fieldName, value) => {
 		return false;
 	});
 };
+const validateIgnoreOverride = (rawOverride, index) => {
+	const fieldName = `ignore.overrides[${index}]`;
+	if (!isRecord(rawOverride)) {
+		warnConfigIssue(`config field "${fieldName}" must be an object (got ${typeof rawOverride}); ignoring this override.`);
+		return;
+	}
+	const files = validateStringArrayField(`${fieldName}.files`, rawOverride.files);
+	if (files === void 0) return void 0;
+	const validatedOverride = { files };
+	if (rawOverride.rules !== void 0) {
+		const rules = validateStringArrayField(`${fieldName}.rules`, rawOverride.rules);
+		if (rules !== void 0) validatedOverride.rules = rules;
+	}
+	return validatedOverride;
+};
+const validateIgnoreField = (rawIgnore) => {
+	if (!isRecord(rawIgnore)) {
+		warnConfigIssue(`config field "ignore" must be an object (got ${typeof rawIgnore}); ignoring this field.`);
+		return;
+	}
+	const validatedIgnore = {};
+	for (const fieldName of [
+		"rules",
+		"files",
+		"tags"
+	]) {
+		if (rawIgnore[fieldName] === void 0) continue;
+		const validatedValues = validateStringArrayField(`ignore.${fieldName}`, rawIgnore[fieldName]);
+		if (validatedValues !== void 0) validatedIgnore[fieldName] = validatedValues;
+	}
+	if (rawIgnore.overrides !== void 0) if (!Array.isArray(rawIgnore.overrides)) warnConfigIssue(`config field "ignore.overrides" must be an array (got ${typeof rawIgnore.overrides}); ignoring this field.`);
+	else validatedIgnore.overrides = rawIgnore.overrides.flatMap((rawOverride, index) => {
+		const validatedOverride = validateIgnoreOverride(rawOverride, index);
+		return validatedOverride ? [validatedOverride] : [];
+	});
+	return validatedIgnore;
+};
 const validateSurfaceControls = (surface, rawControls) => {
-	if (!isPlainObject$1(rawControls)) {
+	if (!isRecord(rawControls)) {
 		warnConfigIssue(`config field "surfaces.${surface}" must be an object (got ${typeof rawControls}); ignoring this surface.`);
 		return;
 	}
@@ -66682,7 +66959,7 @@ const validateSurfaceControls = (surface, rawControls) => {
 	return validatedSurfaceControls;
 };
 const validateSurfacesField = (rawSurfaces) => {
-	if (!isPlainObject$1(rawSurfaces)) {
+	if (!isRecord(rawSurfaces)) {
 		warnConfigIssue(`config field "surfaces" must be an object (got ${typeof rawSurfaces}); ignoring this field.`);
 		return;
 	}
@@ -66698,7 +66975,7 @@ const validateSurfacesField = (rawSurfaces) => {
 	return validated;
 };
 const validateSeverityMap = (fieldName, rawMap, keysAreCategories = false) => {
-	if (!isPlainObject$1(rawMap)) {
+	if (!isRecord(rawMap)) {
 		warnConfigIssue(`config field "${fieldName}" must be an object (got ${typeof rawMap}); ignoring this field.`);
 		return;
 	}
@@ -66732,6 +67009,7 @@ const validateConfigTypes = (config) => {
 	for (const fieldName of BOOLEAN_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => coerceMaybeBooleanString(fieldName, value));
 	for (const fieldName of STRING_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateString(fieldName, value));
 	for (const fieldName of STRING_ARRAY_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateStringArrayField(fieldName, value));
+	applyFieldValidator(config, validated, "ignore", validateIgnoreField);
 	applyFieldValidator(config, validated, "surfaces", validateSurfacesField);
 	for (const fieldName of SEVERITY_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateSeverityMap(fieldName, value, fieldName === "categories"));
 	applyFieldValidator(config, validated, "plugins", (value) => validateStringArrayField("plugins", value));
@@ -67031,6 +67309,10 @@ const dedupeRelatedDiagnostics = (diagnostics) => {
 	}
 	return uniqueDiagnostics;
 };
+const isPathInsideDirectory = (childAbsolutePath, parentAbsolutePath) => {
+	const relativePath = Path.relative(parentAbsolutePath, childAbsolutePath);
+	return Boolean(relativePath) && !relativePath.startsWith("..") && !Path.isAbsolute(relativePath);
+};
 const compareStrings = (left, right) => left < right ? -1 : left > right ? 1 : 0;
 const sortDiagnosticsStable = (diagnostics) => [...diagnostics].sort((left, right) => compareStrings(left.filePath, right.filePath) || left.line - right.line || left.column - right.column || compareStrings(left.plugin, right.plugin) || compareStrings(left.rule, right.rule) || compareStrings(left.severity, right.severity) || compareStrings(left.message, right.message));
 const getDirectDependencyNames = (packageJson) => new Set([...Object.keys(packageJson.dependencies ?? {}), ...Object.keys(packageJson.devDependencies ?? {})]);
@@ -68392,7 +68674,7 @@ const collectScriptMotionEvidence = (sourceFile, typeChecker, program) => {
 			if (calleeEvidence.isReducedMotionHook && isExpressionValueConsumed(node)) evidence.hasReducedMotionHandling = true;
 		}
 		if (ts.isJsxOpeningElement(node) || ts.isJsxSelfClosingElement(node)) {
-			const tagEvidence = ts.isJsxNamespacedName(node.tagName) ? EMPTY_MOTION_EXPRESSION_EVIDENCE : resolveMotionExpressionEvidence(node.tagName, typeChecker, program);
+			const tagEvidence = ts.isIdentifier(node.tagName) || ts.isPropertyAccessExpression(node.tagName) ? resolveMotionExpressionEvidence(node.tagName, typeChecker, program) : EMPTY_MOTION_EXPRESSION_EVIDENCE;
 			if (tagEvidence.isMotionComponent || tagEvidence.isMotionComponentFactory) evidence.hasMotionUse = true;
 			if (tagEvidence.isMotionConfig && jsxElementHasReducedMotionConfiguration(node.attributes, typeChecker)) evidence.hasReducedMotionHandling = true;
 		}
@@ -68607,7 +68889,7 @@ const readScannedFile = (candidate) => {
 		return null;
 	}
 };
-function* collectSecurityScanFiles(rootDirectory) {
+function* collectSecurityScanFiles(rootDirectory, excludedDirectories = /* @__PURE__ */ new Set()) {
 	const priorityCandidates = [];
 	const artifactCandidates = [];
 	const otherCandidates = [];
@@ -68622,7 +68904,7 @@ function* collectSecurityScanFiles(rootDirectory) {
 		for (const entry of readDirectoryEntries(current.absolutePath)) {
 			const absolutePath = Path.join(current.absolutePath, entry.name);
 			if (entry.isDirectory()) {
-				if (!SKIPPED_DIRECTORY_NAMES.has(entry.name)) stack.push({
+				if (!SKIPPED_DIRECTORY_NAMES.has(entry.name) && !excludedDirectories.has(Path.resolve(absolutePath))) stack.push({
 					absolutePath,
 					depth: current.depth + 1
 				});
@@ -68803,10 +69085,8 @@ const shouldEnableRule = (requires, tags, capabilities, ignoredTags, disabledWhe
 	}
 	return true;
 };
+const remainingDeadlineBudgetMs = (deadlineEpochMs) => Math.max(deadlineEpochMs - Date.now(), 0);
 const shouldEnableRuleByDefaultStatus = (options) => options.defaultEnabled !== false || options.hasExplicitOverride === true || options.includeTagDefaults && options.hasIncludedTags;
-const yieldToEventLoop = () => new Promise((resolve) => {
-	setImmediate(resolve);
-});
 const createSecurityScanSession = (rootDirectory, options) => {
 	const capabilities = options.project ? getCapabilities(options.project) : /* @__PURE__ */ new Set();
 	const ignoredTags = options.ignoredTags ?? /* @__PURE__ */ new Set();
@@ -68859,19 +69139,35 @@ const createSecurityScanSession = (rootDirectory, options) => {
 	};
 };
 const checkSecurityScanCooperative = async (rootDirectory, options = {}) => {
+	const throwIfScanAborted = () => {
+		options.signal?.throwIfAborted();
+	};
+	const didReachDeadline = () => {
+		const hasDeadlineElapsed = options.deadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(options.deadlineEpochMs) === 0;
+		if (hasDeadlineElapsed) options.onDeadlineExceeded?.();
+		return hasDeadlineElapsed;
+	};
+	throwIfScanAborted();
 	const session = createSecurityScanSession(rootDirectory, options);
 	if (session === null) return [];
+	if (didReachDeadline()) return [];
 	let sliceStartedAt = performance.now();
-	for (const file of collectSecurityScanFiles(rootDirectory)) {
+	for (const file of collectSecurityScanFiles(rootDirectory, options.excludedDirectories)) {
+		throwIfScanAborted();
+		if (didReachDeadline()) return session.diagnostics;
 		if (file === null) {
 			if (performance.now() - sliceStartedAt >= 12) {
 				await yieldToEventLoop();
+				throwIfScanAborted();
+				if (didReachDeadline()) return session.diagnostics;
 				sliceStartedAt = performance.now();
 			}
 			continue;
 		}
 		for (const _ruleStep of session.scanFileByRule(file)) if (performance.now() - sliceStartedAt >= 12) {
 			await yieldToEventLoop();
+			throwIfScanAborted();
+			if (didReachDeadline()) return session.diagnostics;
 			sliceStartedAt = performance.now();
 		}
 	}
@@ -69034,25 +69330,18 @@ const collectIgnorePatterns = (rootDirectory) => {
 	cachedPatternsByRoot.set(rootDirectory, patterns);
 	return patterns;
 };
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const KNIP_JSON_FILENAME = "knip.json";
-const readJsonFileSafe = (filePath) => {
-	let rawContents;
-	try {
-		rawContents = fs.readFileSync(filePath, "utf-8");
-	} catch {
-		return null;
-	}
+const failOpenReadJson = (filePath, fallback) => {
 	try {
-		return JSON.parse(rawContents);
+		return JSON.parse(NFS.readFileSync(filePath, "utf8"));
 	} catch {
-		return null;
+		return fallback;
 	}
 };
+const KNIP_JSON_FILENAME = "knip.json";
 const readKnipConfig = (rootDirectory) => {
-	const knipJson = readJsonFileSafe(path.join(rootDirectory, KNIP_JSON_FILENAME));
+	const knipJson = failOpenReadJson(path.join(rootDirectory, KNIP_JSON_FILENAME), null);
 	if (isRecord(knipJson)) return knipJson;
-	const packageJson = readJsonFileSafe(path.join(rootDirectory, "package.json"));
+	const packageJson = failOpenReadJson(path.join(rootDirectory, "package.json"), null);
 	const packageKnipConfig = isRecord(packageJson) ? packageJson.knip : null;
 	return isRecord(packageKnipConfig) ? packageKnipConfig : null;
 };
@@ -69100,13 +69389,6 @@ const atomicWriteJson = (filePath, value) => {
 		return;
 	}
 };
-const failOpenReadJson = (filePath, fallback) => {
-	try {
-		return JSON.parse(NFS.readFileSync(filePath, "utf8"));
-	} catch {
-		return fallback;
-	}
-};
 const hashFileContents = (filePath) => {
 	try {
 		return crypto.createHash("sha1").update(NFS.readFileSync(filePath)).digest("hex");
@@ -69785,7 +70067,6 @@ const isDiagnosticOnSurface = (diagnostic, surface, config) => {
 	return true;
 };
 const filterDiagnosticsForSurface = (diagnostics, surface, config) => diagnostics.filter((diagnostic) => isDiagnosticOnSurface(diagnostic, surface, config));
-const remainingDeadlineBudgetMs = (deadlineEpochMs) => Math.max(deadlineEpochMs - Date.now(), 0);
 /**
 * Budget for the dead-code phase, scaled to the work. deslop's graph build is
 * CPU-bound and roughly linear in file count, so a fixed 120s cap is too tight
@@ -69793,25 +70074,28 @@ const remainingDeadlineBudgetMs = (deadlineEpochMs) => Math.max(deadlineEpochMs
 * tipped over by any concurrent load — silently dropping every dead-code
 * finding. Scaling the budget with file count (and inversely with the core
 * share when overlapped) lets the pass complete, while the ceiling still
-* reclaims a genuinely wedged worker. Returns the in-worker SIGKILL deadline
-* and the Effect-side phase backstop that sits a margin above it.
+* reclaims a genuinely wedged worker.
 */
 const resolveDeadCodeTimeout = (input) => {
 	const coreShareFactor = Math.max(1, input.fullConcurrency / Math.max(1, input.deadCodeConcurrency));
-	const workerTimeoutMs = Math.min(DEAD_CODE_TIMEOUT_CEILING_MS, Math.max(DEAD_CODE_WORKER_TIMEOUT_MS, Math.ceil(input.sourceFileCount * 30 * coreShareFactor)));
-	return {
-		workerTimeoutMs,
-		phaseTimeoutMs: workerTimeoutMs + DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS
-	};
+	return { workerTimeoutMs: Math.min(DEAD_CODE_TIMEOUT_CEILING_MS, Math.max(DEAD_CODE_WORKER_TIMEOUT_MS, Math.ceil(input.sourceFileCount * 30 * coreShareFactor))) };
 };
-const resolveLintIncludePaths = (rootDirectory, userConfig) => {
+const resolveLintIncludePaths = (rootDirectory, userConfig, sourceFiles) => {
 	if (!Array.isArray(userConfig?.ignore?.files) || userConfig.ignore.files.length === 0) return;
 	const ignoredPatterns = compileIgnoredFilePatterns(userConfig);
-	return listSourceFiles(rootDirectory).filter((filePath) => {
+	return (sourceFiles ?? listSourceFiles(rootDirectory)).filter((filePath) => {
 		if (!isLintableSourceFile(filePath)) return false;
 		return !isFileIgnoredByPatterns(filePath, rootDirectory, ignoredPatterns);
 	});
 };
+const filterPathsOutsideDirectories = (input) => {
+	const excludedPrefixes = input.excludedDirectories.map((excludedDirectory) => Path.resolve(excludedDirectory)).filter((excludedDirectory) => isPathInsideDirectory(excludedDirectory, input.rootDirectory)).map((excludedDirectory) => Path.relative(input.rootDirectory, excludedDirectory).replaceAll("\\", "/")).sort((left, right) => left.length - right.length).filter((candidatePrefix, index, prefixes) => !prefixes.slice(0, index).some((prefix) => candidatePrefix.startsWith(`${prefix}/`)));
+	if (excludedPrefixes.length === 0) return [...input.relativePaths];
+	return input.relativePaths.filter((relativePath) => {
+		const normalizedRelativePath = relativePath.replaceAll("\\", "/").replace(/^\.\//, "");
+		return !excludedPrefixes.some((excludedPrefix) => normalizedRelativePath === excludedPrefix || normalizedRelativePath.startsWith(`${excludedPrefix}/`));
+	});
+};
 var Config = class Config extends Service()("react-doctor/Config") {
 	static layerNode = effect(Config, gen(function* () {
 		const cache = yield* make$3({
@@ -69873,6 +70157,7 @@ var Files = class Files extends Service()("react-doctor/Files") {
 	static layerNode = succeed$3(Files, Files.of({
 		readLines: (input) => sync(() => createNodeReadFileLinesSync(input.rootDirectory)(input.filePath)),
 		listSourceFiles: (rootDirectory) => sync(() => listSourceFiles(rootDirectory)),
+		listSourceFilesCooperative: (input) => promise(() => listSourceFilesCooperative(input.rootDirectory, input.signal)),
 		isFile: (filePath) => sync(() => isFile(filePath)),
 		isDirectory: (filePath) => sync(() => isDirectory(filePath))
 	}));
@@ -69899,6 +70184,16 @@ var Files = class Files extends Service()("react-doctor/Files") {
 				}
 				return files;
 			}),
+			listSourceFilesCooperative: (input) => sync(() => {
+				const rootDirectory = input.rootDirectory;
+				const prefix = rootDirectory.endsWith("/") ? rootDirectory : `${rootDirectory}/`;
+				const files = [];
+				for (const absolute of tree.keys()) {
+					if (!absolute.startsWith(prefix)) continue;
+					files.push(absolute.slice(prefix.length));
+				}
+				return files;
+			}),
 			isFile: (filePath) => sync(() => tree.has(filePath)),
 			isDirectory: (filePath) => sync(() => {
 				const prefix = filePath.endsWith("/") ? filePath : `${filePath}/`;
@@ -70363,7 +70658,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 					changedFiles: yield* mergeUntracked(directory, splitNullSeparated(diff.stdout), includeUntracked),
 					isCurrentChanges: false
 				};
-			}).pipe(withSpan("Git.diffSelection")),
+			}).pipe(catchReasons("ReactDoctorError", { GitInvocationFailed: () => succeed$2(null) }, (_reason, error) => fail$4(error)), withSpan("Git.diffSelection")),
 			stagedFilePaths: (directory) => runGit(directory, [
 				"diff",
 				"--no-ext-diff",
@@ -70474,7 +70769,7 @@ const batchIncludePaths = (baseArgs, includePaths) => {
 	for (const filePath of includePaths) {
 		const entryLength = filePath.length + 1;
 		const exceedsArgLength = currentBatch.length > 0 && currentBatchLength + entryLength > 24e3;
-		const exceedsFileCount = currentBatch.length >= 100;
+		const exceedsFileCount = currentBatch.length >= 200;
 		if (exceedsArgLength || exceedsFileCount) {
 			batches.push(currentBatch);
 			currentBatch = [];
@@ -70821,7 +71116,7 @@ const buildUserPluginRules = (userPlugin, severityControls) => {
 	}
 	return enabled;
 };
-const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, extendsPaths = [], ignoredTags = /* @__PURE__ */ new Set(), includedTags = /* @__PURE__ */ new Set(), includeTagDefaults = false, runtimeGlobals, unpluginAutoImportGlobalScopes, serverAuthFunctionNames, severityControls, userPlugins = [], disableReactHooksJsPlugin = false, ruleSelection, sidecarRuleIdFilter }) => {
+const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, extendsPaths = [], ignoredTags = /* @__PURE__ */ new Set(), includedTags = /* @__PURE__ */ new Set(), includeTagDefaults = false, runtimeGlobals, unpluginAutoImportGlobalScopes, serverAuthFunctionNames, projectIndexModuleSources, severityControls, userPlugins = [], disableReactHooksJsPlugin = false, ruleSelection, sidecarRuleIdFilter }) => {
 	const hasIncludedTags = includedTags.size > 0;
 	const reactHooksJsPlugin = disableReactHooksJsPlugin || ruleSelection === "sidecar" || hasIncludedTags ? null : resolveReactHooksJsPlugin(project.hasReactCompiler || project.hasReactCompilerLintPlugin === true, customRulesOnly);
 	const reactCompilerRules = reactHooksJsPlugin ? applyRuleSeverityControls(filterRulesToAvailable(REACT_COMPILER_RULES, "react-hooks-js", reactHooksJsPlugin.availableRuleNames), severityControls) : {};
@@ -70885,7 +71180,8 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 				}))
 			} : {},
 			...project.shopifyFlashListMajorVersion !== null ? { shopifyFlashListMajorVersion: project.shopifyFlashListMajorVersion } : {},
-			...serverAuthFunctionNames && serverAuthFunctionNames.length > 0 ? { serverAuthFunctionNames: [...serverAuthFunctionNames] } : {}
+			...serverAuthFunctionNames && serverAuthFunctionNames.length > 0 ? { serverAuthFunctionNames: [...serverAuthFunctionNames] } : {},
+			...projectIndexModuleSources !== void 0 ? { projectIndexModuleSources: [...projectIndexModuleSources] } : {}
 		} },
 		rules: {
 			...reactCompilerRules,
@@ -71134,11 +71430,17 @@ const collectUnpluginAutoImportGlobalScopes = ({ rootDirectory, candidateFiles }
 	return scopes.some((scope) => scope.names.length > 0) ? scopes : [];
 };
 const validateDiagnostic$1 = decodeUnknownSync(Diagnostic);
+const decodeDiagnostic = (raw) => {
+	const diagnostic = validateDiagnostic$1(raw);
+	return {
+		...diagnostic,
+		relatedLocations: diagnostic.relatedLocations?.map((location) => ({ ...location }))
+	};
+};
 const decodeFileDiagnostics = (raw) => {
 	if (!Array.isArray(raw)) return null;
 	try {
-		for (const entry of raw) validateDiagnostic$1(entry);
-		return raw;
+		return raw.map((entry) => decodeDiagnostic(entry));
 	} catch {
 		return null;
 	}
@@ -72370,6 +72672,12 @@ const buildProfiledNodeArguments = (input) => [
 	...input.heapProfileDirectory ? ["--heap-prof", `--heap-prof-dir=${input.heapProfileDirectory}`] : [],
 	...input.argumentsList
 ];
+const lowerChildProcessPriority = (processId) => {
+	if (processId === void 0) return;
+	try {
+		OS.setPriority(processId, OS.constants.priority.PRIORITY_BELOW_NORMAL);
+	} catch {}
+};
 const SANITIZED_ENV = buildOxlintChildEnv(process.env);
 /**
 * Spawn one oxlint subprocess with hard ceilings on wall time and
@@ -72408,6 +72716,7 @@ const spawnOxlint = (args, rootDirectory, nodeBinaryPath, spawnTimeoutMs = OXLIN
 			"pipe"
 		]
 	});
+	lowerChildProcessPriority(child.pid);
 	const onAbort = () => {
 		child.kill("SIGKILL");
 		reject(new ReactDoctorError({ reason: new OxlintSpawnFailed({ cause: "lint phase aborted" }) }));
@@ -72530,7 +72839,7 @@ const isParallelismRelatedSpawnError = (error) => {
 * loop with a slimmer config in that case.
 */
 const spawnLintBatches = async (input) => {
-	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, sourcePathByLintPath, sourceMapByLintPath, onPartialFailure, onFileProgress, spawnTimeoutMs, outputMaxBytes, splitTotalBudgetMs = OXLINT_SPLIT_TOTAL_BUDGET_MS, splitMaxDepth = 8, signal, deadlineEpochMs } = input;
+	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, sourcePathByLintPath, sourceMapByLintPath, onPartialFailure, onFileProgress, spawnTimeoutMs, outputMaxBytes, splitTotalBudgetMs = OXLINT_SPLIT_TOTAL_BUDGET_MS, splitMaxDepth = 9, signal, deadlineEpochMs } = input;
 	const resolveSourcePath = (filePath) => {
 		const absoluteFilePath = Path.isAbsolute(filePath) ? filePath : Path.resolve(rootDirectory, filePath);
 		return sourcePathByLintPath?.get(Path.normalize(absoluteFilePath)) ?? filePath;
@@ -72538,6 +72847,12 @@ const spawnLintBatches = async (input) => {
 	const requestedConcurrency = resolveScanConcurrency(input.concurrency ?? 1);
 	let rescueDeadlineEpochMs;
 	const isPastDeadline = () => deadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(deadlineEpochMs) === 0 || rescueDeadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(rescueDeadlineEpochMs) === 0;
+	const resolveSpawnTimeoutMs = () => {
+		const deadlineBudgets = [deadlineEpochMs, rescueDeadlineEpochMs].filter((deadline) => deadline !== void 0).map(remainingDeadlineBudgetMs);
+		if (deadlineBudgets.length === 0) return spawnTimeoutMs;
+		const remainingDeadlineMs = Math.min(...deadlineBudgets);
+		return spawnTimeoutMs === void 0 ? remainingDeadlineMs : Math.min(spawnTimeoutMs, remainingDeadlineMs);
+	};
 	const runBatchPass = async (concurrency, passBatches, passOnFileProgress) => {
 		const totalFileCount = passBatches.reduce((sum, batch) => sum + batch.length, 0);
 		const allDiagnostics = [];
@@ -72555,12 +72870,13 @@ const spawnLintBatches = async (input) => {
 			const batchArgs = [...baseArgs, ...batch];
 			try {
 				const spawnBatch = () => {
-					if (isPastDeadline()) {
+					const effectiveSpawnTimeoutMs = resolveSpawnTimeoutMs();
+					if (effectiveSpawnTimeoutMs === 0) {
 						deadlineSkippedFiles.push(...batch);
 						batchState.deadlineSkippedFileCount += batch.length;
 						return Promise.resolve(null);
 					}
-					return spawnOxlint(batchArgs, rootDirectory, nodeBinaryPath, spawnTimeoutMs, outputMaxBytes, signal, () => {
+					return spawnOxlint(batchArgs, rootDirectory, nodeBinaryPath, effectiveSpawnTimeoutMs, outputMaxBytes, signal, () => {
 						if (batchState.didStart) return;
 						batchState.didStart = true;
 						startedFileCount += batchState.initialFileCount;
@@ -72715,11 +73031,36 @@ const validateRuleRegistration = () => {
 	].filter((entry) => entry !== null).join("; ");
 	console.warn(`[react-doctor] rule-registration drift: ${detail}`);
 };
+const PROJECT_INDEX_MODULE_SOURCES = [
+	"next/og",
+	"@vercel/og",
+	"satori",
+	"remotion"
+];
+const collectProjectIndexModuleSources = async (rootDirectory, candidateFiles) => {
+	const foundModuleSources = /* @__PURE__ */ new Set();
+	let sliceStartedAt = performance.now();
+	for (const candidateFile of candidateFiles) {
+		let sourceBuffer;
+		try {
+			sourceBuffer = NFS.readFileSync(Path.isAbsolute(candidateFile) ? candidateFile : Path.resolve(rootDirectory, candidateFile));
+		} catch {
+			continue;
+		}
+		for (const moduleSource of PROJECT_INDEX_MODULE_SOURCES) if (sourceBuffer.includes(`"${moduleSource}"`) || sourceBuffer.includes(`'${moduleSource}'`)) foundModuleSources.add(moduleSource);
+		if (foundModuleSources.size === PROJECT_INDEX_MODULE_SOURCES.length) break;
+		if (performance.now() - sliceStartedAt >= 12) {
+			await yieldToEventLoop();
+			sliceStartedAt = performance.now();
+		}
+	}
+	return [...foundModuleSources].sort();
+};
 /**
 * Balanced LPT (longest-processing-time-first) lint batch planner. Where
-* `batchIncludePaths` greedily fills 100-file batches and leaves a small
-* remainder batch (617 files → 6×100 + 17, so the parallel pool's wall clock
-* is set by whichever 100-file chunk happened to collect the most work while
+* `batchIncludePaths` greedily fills fixed-size batches and leaves a small
+* remainder batch, so the parallel pool's wall clock is set by whichever
+* full chunk happened to collect the most work while
 * the remainder's worker idles), this planner keeps the SAME mandatory batch
 * count — `ceil(files / OXLINT_MAX_FILES_PER_BATCH)`, the JS-plugin
 * perf-cliff / native-binding SIGABRT guard — and assigns files largest-first,
@@ -72748,7 +73089,7 @@ const validateRuleRegistration = () => {
 */
 const planLintBatches = ({ baseArgs, files, sizeByFile }) => {
 	if (files.length === 0) return [];
-	const batchCount = Math.ceil(files.length / 100);
+	const batchCount = Math.ceil(files.length / 200);
 	const maxFilesPerBatch = Math.ceil(files.length / batchCount);
 	const baseArgsLengthChars = estimateArgsLength(baseArgs);
 	const descendingSizeIndexes = [...files.keys()].sort((leftIndex, rightIndex) => (sizeByFile.get(files[rightIndex]) ?? 0) - (sizeByFile.get(files[leftIndex]) ?? 0));
@@ -73277,6 +73618,7 @@ const runOxlint = async (options) => {
 		await yieldToEventLoop();
 		const sizedScanFiles = includePaths === void 0 ? listSourceFilesWithSize(rootDirectory) : null;
 		const candidateFiles = includePaths !== void 0 ? includePaths : (sizedScanFiles ?? []).map((entry) => entry.path);
+		const projectIndexModuleSources = includePaths === void 0 && options.deadlineEpochMs === void 0 ? await collectProjectIndexModuleSources(rootDirectory, candidateFiles) : void 0;
 		unpluginAutoImportGlobalScopes = collectUnpluginAutoImportGlobalScopes({
 			rootDirectory,
 			candidateFiles
@@ -73299,6 +73641,7 @@ const runOxlint = async (options) => {
 			runtimeGlobals,
 			unpluginAutoImportGlobalScopes,
 			serverAuthFunctionNames,
+			projectIndexModuleSources,
 			severityControls,
 			userPlugins,
 			disableReactHooksJsPlugin: overrides.disableReactHooksJsPlugin,
@@ -73766,10 +74109,10 @@ const translateProjectInfoError = (cause, directory) => {
 	}) });
 };
 var Project = class Project extends Service()("react-doctor/Project") {
-	static layerNode = succeed$3(Project, Project.of({ discover: fn("Project.discover")(function* (directory) {
+	static layerNode = succeed$3(Project, Project.of({ discover: fn("Project.discover")(function* (input) {
 		return yield* try_({
-			try: () => discoverProject(directory),
-			catch: (cause) => translateProjectInfoError(cause, directory)
+			try: () => discoverProject(input.directory, { sourceFileCount: input.sourceFileCount }),
+			catch: (cause) => translateProjectInfoError(cause, input.directory)
 		});
 	}) }));
 	static layerOf = (projectInfo) => succeed$3(Project, Project.of({ discover: () => succeed$2(projectInfo) }));
@@ -74354,9 +74697,10 @@ const checkSupplyChain = (input) => gen(function* () {
 * outage.
 */
 var SupplyChain = class SupplyChain extends Service()("react-doctor/SupplyChain") {
-	static layerNode = succeed$3(SupplyChain, SupplyChain.of({ run: (input) => unwrap(flatMap$2(SupplyChainOverlapTimeoutMs, (totalTimeoutMs) => checkSupplyChain({
-		...input,
-		totalTimeoutMs
+	static layerNode = succeed$3(SupplyChain, SupplyChain.of({ run: (input) => unwrap(flatMap$2(SupplyChainOverlapTimeoutMs, (configuredTimeoutMs) => checkSupplyChain({
+		rootDirectory: input.rootDirectory,
+		userConfig: input.userConfig,
+		totalTimeoutMs: input.timeoutMs ?? configuredTimeoutMs
 	})).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)), withSpan("SupplyChain.run"))) }));
 	static layerOf = (diagnostics) => succeed$3(SupplyChain, SupplyChain.of({ run: () => fromIterable$1(diagnostics) }));
 };
@@ -74391,10 +74735,6 @@ const NO_HOOKS = {
 	beforeLint: () => void_,
 	afterLint: () => void_
 };
-const filterMapNullable = (transform) => fromPredicateOption((value) => {
-	const result = transform(value);
-	return result === null ? none() : some(result);
-});
 const fileReader = (filesService, rootDirectory) => (filePath) => {
 	const lines = runSync(filesService.readLines({
 		filePath,
@@ -74418,7 +74758,7 @@ const formatLintFailText = (reasonTag, nodeVersion) => {
 *      The GitHub viewer-permission lookup is forked onto a background
 *      fiber here and joined late (it feeds score metadata, not
 *      diagnostics).
-*   2. beforeLint hook (e.g. CLI renders the project-detection block)
+*   2. beforeLint hook (e.g. CLI records project telemetry)
 *   3. environment checks (reduced-motion + pnpm hardening +
 *      expo/react-native), collected synchronously. The heavier
 *      content-regex security scan is forked instead (like supply-chain
@@ -74431,13 +74771,11 @@ const formatLintFailText = (reasonTag, nodeVersion) => {
 *      `SupplyChainOverlapTimeoutMs` (measured from fork) so a hung
 *      socket can't drag out its join; on timeout it fails open to no
 *      diagnostics — the same outcome class as a Socket outage.
-*   5. Linter.run runs; DeadCode.run runs concurrently (forked child
-*      fiber) ONLY when the memory gate has headroom to run the 8 GB
-*      dead-code child alongside the oxlint workers — or when overlap is
-*      forced via REACT_DOCTOR_DEAD_CODE_OVERLAP. Otherwise dead-code
-*      runs sequentially after lint, exactly as it did pre-overlap. The
-*      fiber is joined (or interrupted, SIGKILLing its worker, on lint
-*      failure) before diagnostics are concatenated. The afterLint hook
+*   5. Linter.run runs; DeadCode.run forks only when
+*      REACT_DOCTOR_DEAD_CODE_OVERLAP=on. The default "auto" and explicit
+*      "off" paths stay sequential. The fiber is joined (or interrupted,
+*      SIGKILLing its worker, on lint failure) before diagnostics are
+*      concatenated. The afterLint hook
 *      fires between lint and dead-code. Progress spinner labels AND the
 *      final diagnostic / score order stay independent of execution
 *      order, so terminal output is identical either way; supply-chain
@@ -74472,8 +74810,28 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	const partialFailuresRef = yield* LintPartialFailures;
 	const resolvedConfig = yield* configService.resolve(input.directory);
 	const scanDirectory = resolvedConfig.resolvedDirectory;
-	const project = yield* projectService.discover(scanDirectory);
+	const excludedProjectDirectories = (input.excludedProjectDirectories ?? []).map((excludedDirectory) => Path.resolve(excludedDirectory)).filter((excludedDirectory) => isPathInsideDirectory(excludedDirectory, scanDirectory));
+	const excludedProjectRelativePaths = excludedProjectDirectories.map((excludedDirectory) => Path.relative(scanDirectory, excludedDirectory).replaceAll("\\", "/"));
+	const isExcludedProjectDiagnostic = (diagnostic) => {
+		const relativeFilePath = toNormalizedRelativePath(diagnostic.filePath, scanDirectory);
+		return excludedProjectRelativePaths.some((excludedRelativePath) => relativeFilePath === excludedRelativePath || relativeFilePath.startsWith(`${excludedRelativePath}/`));
+	};
+	const precomputedSourceFiles = input.suppressScanSummary === true || excludedProjectDirectories.length > 0 ? yield* filesService.listSourceFilesCooperative({
+		rootDirectory: scanDirectory,
+		signal: input.signal
+	}) : null;
+	const includedPrecomputedSourceFiles = precomputedSourceFiles !== null && excludedProjectDirectories.length > 0 ? filterPathsOutsideDirectories({
+		rootDirectory: scanDirectory,
+		relativePaths: precomputedSourceFiles,
+		excludedDirectories: excludedProjectDirectories
+	}) : precomputedSourceFiles;
+	const sourceFileCount = excludedProjectDirectories.length > 0 ? includedPrecomputedSourceFiles?.length : input.precomputedSourceFileCount ?? includedPrecomputedSourceFiles?.length;
+	const project = yield* projectService.discover({
+		directory: scanDirectory,
+		sourceFileCount
+	});
 	if (!isAnalyzableProject(project)) return yield* new ReactDoctorError({ reason: new NoReactDependency({ directory: scanDirectory }) });
+	const deadCodeSourceFileCount = input.retainExcludedProjectDeadCodeDiagnostics === true && precomputedSourceFiles !== null ? precomputedSourceFiles.length : project.sourceFileCount;
 	const [repo, sha, defaultBranch] = yield* all([
 		gitService.githubRepo(scanDirectory).pipe(orElseSucceed(() => null)),
 		gitService.headSha(scanDirectory).pipe(orElseSucceed(() => null)),
@@ -74484,11 +74842,16 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		directory: scanDirectory,
 		repo
 	}).pipe(orElseSucceed(() => null)) : succeed$2(null));
-	const lintIncludePaths = (input.skipExplicitIncludePathFilter ? input.includePaths.length > 0 ? [...input.includePaths] : void 0 : computeExplicitLintIncludePaths([...input.includePaths])) ?? resolveLintIncludePaths(scanDirectory, resolvedConfig.config);
-	const fallbackScannedFilePaths = input.suppressScanSummary ? (lintIncludePaths ?? (yield* filesService.listSourceFiles(scanDirectory))).map((relativePath) => Path.resolve(scanDirectory, relativePath)) : [];
+	let lintIncludePaths = (input.skipExplicitIncludePathFilter ? input.includePaths.length > 0 ? [...input.includePaths] : void 0 : computeExplicitLintIncludePaths([...input.includePaths])) ?? resolveLintIncludePaths(scanDirectory, resolvedConfig.config, includedPrecomputedSourceFiles ?? void 0);
+	if (excludedProjectDirectories.length > 0) lintIncludePaths = filterPathsOutsideDirectories({
+		rootDirectory: scanDirectory,
+		relativePaths: lintIncludePaths ?? includedPrecomputedSourceFiles ?? (yield* filesService.listSourceFiles(scanDirectory)),
+		excludedDirectories: excludedProjectDirectories
+	});
+	const fallbackScannedFilePaths = input.suppressScanSummary ? (lintIncludePaths ?? includedPrecomputedSourceFiles ?? (yield* filesService.listSourceFiles(scanDirectory))).map((relativePath) => Path.resolve(scanDirectory, relativePath)) : [];
 	const beforeLint = hooks.beforeLint ?? NO_HOOKS.beforeLint;
 	const afterLint = hooks.afterLint ?? NO_HOOKS.afterLint;
-	yield* beforeLint(project, lintIncludePaths ?? void 0);
+	yield* beforeLint(project);
 	const isDiffMode = input.includePaths.length > 0;
 	const showWarnings = input.warnings ?? resolvedConfig.config?.warnings ?? true;
 	const transform = buildDiagnosticPipeline({
@@ -74498,7 +74861,10 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		respectInlineDisables: input.respectInlineDisables,
 		showWarnings
 	});
-	const filterPerElementPipeline = (rawStream) => rawStream.pipe(filterMap(filterMapNullable(transform.apply)));
+	const filterPerElementPipeline = (rawStream) => rawStream.pipe(filterMap(fromPredicateOption((diagnostic) => {
+		const filteredDiagnostic = transform.apply(diagnostic);
+		return filteredDiagnostic === null ? none() : some(filteredDiagnostic);
+	})));
 	const applyPerElementPipeline = (rawStream) => filterPerElementPipeline(rawStream).pipe(tap((diagnostic) => reporterService.emit(diagnostic)));
 	const envCollected = yield* runCollect(applyPerElementPipeline(fromIterable$1(isDiffMode ? [] : [
 		...checkReducedMotion(scanDirectory),
@@ -74508,17 +74874,31 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		...checkReactNativeProject(scanDirectory, project)
 	])));
 	const securityScanFailedRef = yield* make$13(false);
-	const securityScanFiber = yield* forkChild(runCollect(applyPerElementPipeline(isDiffMode ? empty$4 : unwrap(tryPromise(() => checkSecurityScanCooperative(scanDirectory, {
+	let didSecurityScanReachDeadline = false;
+	const securityScanFiber = yield* forkChild(runCollect(applyPerElementPipeline(isDiffMode ? empty$4 : unwrap(tryPromise((signal) => checkSecurityScanCooperative(scanDirectory, {
 		project,
 		ignoredTags: input.ignoredTags,
 		includedTags: input.includedTags,
-		includeTagDefaults: input.includeTagDefaults
+		includeTagDefaults: input.includeTagDefaults,
+		excludedDirectories: new Set(excludedProjectDirectories),
+		deadlineEpochMs: input.deadlineEpochMs,
+		signal,
+		onDeadlineExceeded: () => {
+			didSecurityScanReachDeadline = true;
+		}
 	})).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)), catch_$1(() => set(securityScanFailedRef, true).pipe(as(empty$4))))))).pipe(withSpan("SecurityScan.run")));
+	const capToDeadline = (phaseTimeoutMs) => input.deadlineEpochMs === void 0 ? phaseTimeoutMs : Math.min(phaseTimeoutMs, remainingDeadlineBudgetMs(input.deadlineEpochMs));
+	const capOptionalToDeadline = (phaseTimeoutMs) => {
+		if (input.deadlineEpochMs === void 0) return phaseTimeoutMs;
+		const remainingBudgetMs = remainingDeadlineBudgetMs(input.deadlineEpochMs);
+		return phaseTimeoutMs === null ? remainingBudgetMs : Math.min(phaseTimeoutMs, remainingBudgetMs);
+	};
 	const shouldRunSupplyChain = !isDiffMode || (input.supplyChainManifestChanged ?? false);
-	const supplyChainOverlapTimeout = yield* SupplyChainOverlapTimeoutMs;
+	const supplyChainOverlapTimeout = capToDeadline(yield* SupplyChainOverlapTimeoutMs);
 	const supplyChainFiber = yield* forkChild(shouldRunSupplyChain ? runCollect(applyPerElementPipeline(supplyChainService.run({
 		rootDirectory: scanDirectory,
-		userConfig: resolvedConfig.config
+		userConfig: resolvedConfig.config,
+		timeoutMs: supplyChainOverlapTimeout
 	}))).pipe(map$3((diagnostics) => ({
 		diagnostics,
 		timedOut: false
@@ -74542,46 +74922,49 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	const scanConcurrency = resolveScanConcurrency(yield* OxlintConcurrency);
 	const lintPhaseTimeoutMs = yield* LintPhaseTimeoutMs;
 	const deadCodePhaseTimeoutMs = yield* DeadCodePhaseTimeoutMs;
-	const resolveDeadCodePhaseTimeoutMs = (scaledPhaseTimeoutMs) => deadCodePhaseTimeoutMs === 15e4 ? scaledPhaseTimeoutMs : deadCodePhaseTimeoutMs;
 	const workerCountSuffix = scanConcurrency > 1 ? ` ${highlighter.dim(`[~${scanConcurrency} workers]`)}` : "";
-	const capToDeadline = (phaseTimeoutMs) => input.deadlineEpochMs === void 0 ? phaseTimeoutMs : Math.min(phaseTimeoutMs, remainingDeadlineBudgetMs(input.deadlineEpochMs));
 	const shouldRunDeadCode = input.runDeadCode && !isDiffMode && (showWarnings || deadCodeMaySurfaceWhenWarningsHidden(resolvedConfig.config));
 	const deadCodeOverlapMode = yield* DeadCodeOverlap;
 	const shouldOverlapDeadCode = shouldRunDeadCode && deadCodeOverlapMode === "on";
 	const deadCodeParseConcurrency = shouldOverlapDeadCode ? Math.max(1, Math.floor(scanConcurrency * DEAD_CODE_OVERLAP_PARSE_SHARE)) : void 0;
 	const lintConcurrency = deadCodeParseConcurrency === void 0 ? scanConcurrency : Math.max(1, scanConcurrency - deadCodeParseConcurrency);
-	const buildCollectDeadCode = (deadCodeTimeout) => runCollect(applyPerElementPipeline(deadCodeService.run({
-		rootDirectory: scanDirectory,
-		parseConcurrency: deadCodeParseConcurrency,
-		workerTimeoutMs: deadCodeTimeout.workerTimeoutMs,
-		onCacheOutcome: (didHitCache) => {
-			deadCodeCacheHit = didHitCache;
-		},
-		onSummaryCacheStats: (stats) => {
-			deadCodeSummaryCacheHits = stats.hits;
-			deadCodeSummaryCacheMisses = stats.misses;
-		}
-	}).pipe(catchTag("ReactDoctorError", (error) => unwrap(gen(function* () {
-		yield* set(deadCodeFailure, {
-			didFail: true,
-			reason: error.message
-		});
-		return empty$4;
-	})))))).pipe(timeoutOption(deadCodeTimeout.phaseTimeoutMs), flatMap$2(match$3({
-		onNone: () => set(deadCodeFailure, {
-			didFail: true,
-			reason: `Dead-code analysis exceeded ${Math.round(deadCodeTimeout.phaseTimeoutMs / MILLISECONDS_PER_SECOND)}s and was skipped.`
-		}).pipe(as([])),
-		onSome: succeed$2
-	})));
+	const buildCollectDeadCode = (deadCodeTimeout) => {
+		const collectDeadCode = runCollect(applyPerElementPipeline(deadCodeService.run({
+			rootDirectory: scanDirectory,
+			parseConcurrency: deadCodeParseConcurrency,
+			workerTimeoutMs: deadCodeTimeout.workerTimeoutMs,
+			onCacheOutcome: (didHitCache) => {
+				deadCodeCacheHit = didHitCache;
+			},
+			onSummaryCacheStats: (stats) => {
+				deadCodeSummaryCacheHits = stats.hits;
+				deadCodeSummaryCacheMisses = stats.misses;
+			}
+		}).pipe(filter((diagnostic) => input.retainExcludedProjectDeadCodeDiagnostics === true || !isExcludedProjectDiagnostic(diagnostic)), catchTag("ReactDoctorError", (error) => unwrap(gen(function* () {
+			yield* set(deadCodeFailure, {
+				didFail: true,
+				reason: error.message
+			});
+			return empty$4;
+		}))))));
+		const phaseTimeoutMs = deadCodeTimeout.phaseTimeoutMs;
+		if (phaseTimeoutMs === null) return collectDeadCode;
+		return collectDeadCode.pipe(timeoutOption(phaseTimeoutMs), flatMap$2(match$3({
+			onNone: () => set(deadCodeFailure, {
+				didFail: true,
+				reason: `Dead-code analysis exceeded ${Math.round(phaseTimeoutMs / MILLISECONDS_PER_SECOND)}s and was skipped.`
+			}).pipe(as([])),
+			onSome: succeed$2
+		})));
+	};
 	const overlapDeadCodeTimeout = resolveDeadCodeTimeout({
-		sourceFileCount: project.sourceFileCount,
+		sourceFileCount: deadCodeSourceFileCount,
 		deadCodeConcurrency: deadCodeParseConcurrency ?? scanConcurrency,
 		fullConcurrency: scanConcurrency
 	});
 	const deadCodeFiber = shouldOverlapDeadCode ? yield* forkChild(buildCollectDeadCode({
 		workerTimeoutMs: overlapDeadCodeTimeout.workerTimeoutMs,
-		phaseTimeoutMs: capToDeadline(resolveDeadCodePhaseTimeoutMs(overlapDeadCodeTimeout.phaseTimeoutMs))
+		phaseTimeoutMs: capOptionalToDeadline(deadCodePhaseTimeoutMs)
 	})) : null;
 	const scanProgress = yield* progressService.start("Scanning...");
 	const scanStartTime = Date.now();
@@ -74632,7 +75015,8 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		});
 		return empty$4;
 	}))));
-	const lintCollected = dedupeRelatedDiagnostics(yield* runCollect(filterPerElementPipeline(shouldOverlapDeadCode ? baseLintStream.pipe(provideService(OxlintConcurrency, lintConcurrency)) : baseLintStream)).pipe(timeoutOption(lintPhaseTimeoutMs), flatMap$2(match$3({
+	const collectLintDiagnostics = runCollect(filterPerElementPipeline(shouldOverlapDeadCode ? baseLintStream.pipe(provideService(OxlintConcurrency, lintConcurrency)) : baseLintStream));
+	const lintCollected = dedupeRelatedDiagnostics(yield* lintPhaseTimeoutMs === null ? collectLintDiagnostics : collectLintDiagnostics.pipe(timeoutOption(lintPhaseTimeoutMs), flatMap$2(match$3({
 		onNone: () => set(lintFailure, {
 			didFail: true,
 			reason: `Lint analysis exceeded ${lintPhaseTimeoutMs / MILLISECONDS_PER_SECOND}s and was skipped.`,
@@ -74662,13 +75046,13 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	} else {
 		yield* scanProgress.update(`Scanned ${scannedFilesLabel}, analyzing dead code...`);
 		const sequentialDeadCodeTimeout = resolveDeadCodeTimeout({
-			sourceFileCount: totalFileCount,
+			sourceFileCount: input.retainExcludedProjectDeadCodeDiagnostics === true ? deadCodeSourceFileCount : totalFileCount,
 			deadCodeConcurrency: scanConcurrency,
 			fullConcurrency: scanConcurrency
 		});
 		deadCodeCollected = deadCodeFiber !== null ? yield* join(deadCodeFiber) : yield* buildCollectDeadCode({
 			workerTimeoutMs: sequentialDeadCodeTimeout.workerTimeoutMs,
-			phaseTimeoutMs: capToDeadline(resolveDeadCodePhaseTimeoutMs(sequentialDeadCodeTimeout.phaseTimeoutMs))
+			phaseTimeoutMs: capOptionalToDeadline(deadCodePhaseTimeoutMs)
 		});
 	}
 	const deadCodeFailureState = lintFailureState.didFail ? {
@@ -74712,7 +75096,11 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		metadata: scoreMetadata
 	});
 	const lintPartialFailures = yield* get$2(partialFailuresRef);
-	const securityScanFailed = yield* get$2(securityScanFailedRef);
+	const didSecurityScanFail = yield* get$2(securityScanFailedRef);
+	const securityScanFailed = didSecurityScanFail || didSecurityScanReachDeadline;
+	let securityScanFailureReason = null;
+	if (didSecurityScanReachDeadline) securityScanFailureReason = "Security scan reached the max scan duration; findings collected before the deadline were preserved.";
+	else if (didSecurityScanFail) securityScanFailureReason = "Security scan failed and was skipped.";
 	return {
 		project,
 		userConfig: resolvedConfig.config,
@@ -74735,6 +75123,7 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		scanConcurrency,
 		supplyChainOverlapTimedOut: supplyChainResult.timedOut,
 		securityScanFailed,
+		securityScanFailureReason,
 		lintCacheHitFileCount,
 		lintCacheTotalFileCount,
 		lintSidecarReplayedFileCount,
@@ -74750,7 +75139,10 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	"inspect.runDeadCode": input.runDeadCode,
 	"inspect.isCi": input.isCi,
 	"inspect.scoreSurface": input.scoreSurface ?? "score"
-} }), (scanProgram) => flatMap$2(ScanDeadlineMs, (scanDeadlineMs) => scanProgram.pipe(timeout(scanDeadlineMs), catchTag$1("TimeoutError", () => new ReactDoctorError({ reason: new ScanDeadlineExceeded({ detail: `${scanDeadlineMs / MILLISECONDS_PER_SECOND}s elapsed` }) })))));
+} }), (scanProgram) => flatMap$2(ScanDeadlineMs, (scanDeadlineMs) => {
+	if (scanDeadlineMs === null) return scanProgram;
+	return scanProgram.pipe(timeout(scanDeadlineMs), catchTag$1("TimeoutError", () => new ReactDoctorError({ reason: new ScanDeadlineExceeded({ detail: `${scanDeadlineMs / MILLISECONDS_PER_SECOND}s elapsed` }) })));
+}));
 const parseNodeVersion = (versionString) => {
 	const [major = 0, minor = 0, patch = 0] = versionString.replace(/^v/, "").trim().split(".").map(Number);
 	return {
@@ -74851,16 +75243,6 @@ const resolveNodeForOxlint = () => {
 	});
 });
 /**
-* Zip-Slip defense: relative paths come from git (`diff --name-only`), which
-* normalizes during ordinary adds, but a crafted index/pack/symlinked tree can
-* smuggle `..` segments that escape the temp root. Resolve against the temp dir
-* and reject anything that lands outside before writing.
-*/
-const isPathInsideDirectory = (childAbsolutePath, parentAbsolutePath) => {
-	const relative = path.relative(parentAbsolutePath, childAbsolutePath);
-	return Boolean(relative) && !relative.startsWith("..") && !path.isAbsolute(relative);
-};
-/**
 * Writes a set of source files (supplied by `readContent` — e.g.
 * `git show <ref>:<path>` for a baseline tree, or `git show :<path>` for the
 * index) into a temp tree that mirrors the project layout, copying the
@@ -74896,7 +75278,7 @@ const materializeSourceTree = (input) => gen(function* () {
 			const sourcePath = path.join(input.directory, subdirectory, configFilename);
 			const targetPath = path.resolve(resolvedTempDirectory, subdirectory, configFilename);
 			if (!isPathInsideDirectory(targetPath, resolvedTempDirectory)) continue;
-			if (fs.existsSync(sourcePath) && !fs.existsSync(targetPath)) {
+			if (isFile(sourcePath) && !fs.existsSync(targetPath)) {
 				fs.mkdirSync(path.dirname(targetPath), { recursive: true });
 				fs.cpSync(sourcePath, targetPath);
 			}
@@ -75135,6 +75517,7 @@ const buildJsonReport = (input) => {
 		directory: input.directory,
 		diff: toJsonDiff(input.diff),
 		projects,
+		...input.skippedProjects && input.skippedProjects.length > 0 ? { skippedProjects: [...input.skippedProjects] } : {},
 		diagnostics: flattenedDiagnostics,
 		summary,
 		elapsedMilliseconds: input.totalElapsedMilliseconds,
@@ -75159,7 +75542,7 @@ const buildSkippedChecks = (input) => {
 	else if (input.lintPartialFailures.length > 0) skippedCheckReasons["lint:partial"] = input.lintPartialFailures.join("; ");
 	if (input.didDeadCodeFail && input.deadCodeFailureReason !== null) skippedCheckReasons["dead-code"] = input.deadCodeFailureReason;
 	if (input.supplyChainOverlapTimedOut) skippedCheckReasons["supply-chain"] = "Supply-chain analysis timed out and was skipped.";
-	if (input.securityScanFailed) skippedCheckReasons["security-scan"] = "Security scan failed and was skipped.";
+	if (input.securityScanFailed) skippedCheckReasons["security-scan"] = input.securityScanFailureReason ?? "Security scan failed and was skipped.";
 	return {
 		skippedChecks,
 		skippedCheckReasons
@@ -75194,14 +75577,6 @@ const getDiffInfo = (directory, explicitBaseBranch, includeUntracked) => runProm
 	};
 }).pipe(provide(Git.layerNode)));
 const filterSourceFiles = (filePaths) => filePaths.filter(isLintableSourceFile);
-/**
-* Back-compat alias: the streaming pipeline holds its caches in
-* per-pipeline closures that are garbage-collected when the pipeline
-* goes out of scope, so there is nothing to clear at module scope. The
-* public CLI's `clearCaches()` still calls this for symmetry with the
-* other `clear*` helpers.
-*/
-const clearAutoSuppressionCaches = () => {};
 const createLintPhaseAbortError = () => new ReactDoctorError({ reason: new OxlintSpawnFailed({ cause: "lint phase aborted" }) });
 const createOxlintSpawnSlots = (concurrency) => createWorkerSlots({
 	slotCount: resolveScanConcurrency(concurrency),
@@ -75214,71 +75589,47 @@ const createOxlintSpawnSlots = (concurrency) => createWorkerSlots({
 * untouched so the loader sees the same plain object either way.
 */
 const defineConfig = (config) => config;
-const AI_TRAINING_ENV_VARS = [
-	["HF_DATASETS_CACHE", "huggingface"],
-	["HF_HOME", "huggingface"],
-	["HUGGINGFACE_HUB_CACHE", "huggingface"],
-	["SPACE_ID", "huggingface-spaces"],
-	["CUDA_VISIBLE_DEVICES", "cuda"],
-	["NVIDIA_VISIBLE_DEVICES", "nvidia"],
-	["ROCR_VISIBLE_DEVICES", "rocm"],
-	["TPU_NAME", "google-tpu"],
+const AI_TRAINING_BY_ENVIRONMENT_VARIABLE = [
 	["WANDB_RUN_ID", "wandb"],
 	["WANDB_SWEEP_ID", "wandb"],
 	["MLFLOW_RUN_ID", "mlflow"],
-	["MLFLOW_TRACKING_URI", "mlflow"],
 	["COMET_EXPERIMENT_KEY", "comet"],
 	["NEPTUNE_RUN_ID", "neptune"],
 	["CLEARML_TASK_ID", "clearml"],
 	["DVC_STAGE", "dvc"],
 	["RAY_WORKER_PROCESS", "ray"],
-	["RAY_ADDRESS", "ray"],
-	["MUJOCO_GL", "mujoco"],
-	["MUJOCO_PATH", "mujoco"],
-	["GYM_DISABLE_ENV_CHECKER", "gymnasium"],
 	["SM_TRAINING_ENV", "sagemaker"],
 	["TRAINING_JOB_ARN", "sagemaker"],
-	["SAGEMAKER_BASE_DIR", "sagemaker"],
 	["AZUREML_RUN_ID", "azure-ml"],
-	["AZURE_ML_MODEL_DIR", "azure-ml"],
-	["CLOUD_ML_PROJECT_ID", "vertex-ai"],
-	["VERTEX_AI_LOG_LEVEL", "vertex-ai"],
-	["DET_MASTER", "determined-ai"],
-	["LIGHTNING_USER_ID", "lightning-ai"],
 	["FLYTE_INTERNAL_EXECUTION_ID", "flyte"],
-	["ARGO_WORKFLOW_NAME", "argo-workflows"],
 	["KFP_POD_NAME", "kubeflow-pipelines"],
 	["KAGGLE_KERNEL_RUN_TYPE", "kaggle"],
 	["COLAB_BACKEND_VERSION", "google-colab"],
-	["DATABRICKS_RUNTIME_VERSION", "databricks"],
 	["DAYTONA_WS_ID", "daytona"],
-	["DAYTONA_WS_NAME", "daytona"],
 	["E2B_SANDBOX_ID", "e2b"],
 	["MODAL_FUNCTION_ID", "modal"],
 	["MODAL_TASK_ID", "modal"],
 	["RUNPOD_POD_ID", "runpod"],
-	["REPLICATE_USERNAME", "replicate"],
 	["VAST_CONTAINERLABEL", "vast-ai"],
-	["HARBOR_URL", "harbor"],
-	["HARBOR_HOSTNAME", "harbor"],
 	["SWE_BENCH_TASK", "swe-bench"],
 	["SWEBENCH_TASK", "swe-bench"],
 	["SWE_AGENT_MODEL", "swe-agent"]
 ];
-const detectAiTrainingEnvironment = () => {
-	for (const [envVar, label] of AI_TRAINING_ENV_VARS) if (process.env[envVar]) return label;
+const detectAiTrainingEnvironment = (environment = process.env) => {
+	for (const [environmentVariable, label] of AI_TRAINING_BY_ENVIRONMENT_VARIABLE) if (environment[environmentVariable]?.trim()) return label;
 	return null;
 };
-const unionValues = (baseValues, overrideValues) => [...new Set([...baseValues, ...overrideValues])];
+const stringValues = (values) => Array.isArray(values) ? values.filter((value) => typeof value === "string") : [];
+const unionValues = (baseValues, overrideValues) => [...new Set([...stringValues(baseValues), ...stringValues(overrideValues)])];
 const mergeIgnores = (baseIgnore, overrideIgnore) => {
 	const mergedIgnore = {
 		...baseIgnore,
 		...overrideIgnore
 	};
-	if (baseIgnore.rules && overrideIgnore.rules) mergedIgnore.rules = unionValues(baseIgnore.rules, overrideIgnore.rules);
-	if (baseIgnore.files && overrideIgnore.files) mergedIgnore.files = unionValues(baseIgnore.files, overrideIgnore.files);
-	if (baseIgnore.tags && overrideIgnore.tags) mergedIgnore.tags = unionValues(baseIgnore.tags, overrideIgnore.tags);
-	if (baseIgnore.overrides && overrideIgnore.overrides) mergedIgnore.overrides = [...baseIgnore.overrides, ...overrideIgnore.overrides];
+	if (baseIgnore.rules !== void 0 || overrideIgnore.rules !== void 0) mergedIgnore.rules = unionValues(baseIgnore.rules, overrideIgnore.rules);
+	if (baseIgnore.files !== void 0 || overrideIgnore.files !== void 0) mergedIgnore.files = unionValues(baseIgnore.files, overrideIgnore.files);
+	if (baseIgnore.tags !== void 0 || overrideIgnore.tags !== void 0) mergedIgnore.tags = unionValues(baseIgnore.tags, overrideIgnore.tags);
+	if (baseIgnore.overrides !== void 0 || overrideIgnore.overrides !== void 0) mergedIgnore.overrides = [...Array.isArray(baseIgnore.overrides) ? baseIgnore.overrides : [], ...Array.isArray(overrideIgnore.overrides) ? overrideIgnore.overrides : []];
 	return mergedIgnore;
 };
 /**
@@ -75460,7 +75811,6 @@ const clearCaches = () => {
 	clearPackageJsonCache();
 	clearIgnorePatternsCache();
 	clearPackageRoleCache();
-	clearAutoSuppressionCaches();
 	clearMinifiedFileCache();
 };
 const toJsonReport = (result, options) => buildJsonReport({
@@ -75487,4 +75837,4 @@ const toJsonReport = (result, options) => buildJsonReport({
 export { AmbiguousProjectError, NoReactDependencyError, NotADirectoryError, PackageJsonNotFoundError, ProjectNotFoundError, ReactDoctorError, buildJsonReport, buildJsonReportError, clearCaches, defineConfig, diagnose, filterSourceFiles, getDiffInfo, hasReactRuntime, isProjectDiscoveryError, isReactDoctorError, summarizeDiagnostics, toJsonReport };
 
 //# sourceMappingURL=index.js.map
-//# debugId=0c9da9c7-4847-5807-983e-a57b7eec97cd
+//# debugId=8d6e3c06-44f8-589f-8e07-aaa4704b6112