react-doctor 0.9.3 → 0.9.4-dev.212b8b4

package/dist/lsp.js

@@ -9,7 +9,7 @@ import { ALL_REACT_DOCTOR_RULE_KEYS, CROSS_FILE_DEPENDENCY_COLLECTORS, CROSS_FIL
 import * as Crypto from "node:crypto";
 import crypto, { createHash } from "node:crypto";
 import * as NodeChildProcess from "node:child_process";
-import { execFileSync, spawn, spawnSync } from "node:child_process";
+import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
 import { ResolverFactory } from "oxc-resolver";
 import ts from "typescript";
 import * as NodeUrl from "node:url";
@@ -3647,7 +3647,7 @@ const flatMap$5 = /* @__PURE__ */ dual(2, (self, f) => isNone(self) ? none() : f
 * @category filtering
 * @since 2.0.0
 */
-const filter = /* @__PURE__ */ dual(2, (self, predicate) => isNone(self) ? none() : predicate(self.value) ? some(self.value) : none());
+const filter$1 = /* @__PURE__ */ dual(2, (self, predicate) => isNone(self) ? none() : predicate(self.value) ? some(self.value) : none());
 //#endregion
 //#region ../../node_modules/.pnpm/effect@4.0.0-beta.70/node_modules/effect/dist/Result.js
 /**
@@ -7275,6 +7275,16 @@ const catchTag$2 = /* @__PURE__ */ dual((args) => isEffect$1(args[0]), (self, k,
 	return catchIf$2(self, Array.isArray(k) ? (e) => hasProperty(e, "_tag") && k.includes(e._tag) : isTagged(k), f, orElse);
 });
 /** @internal */
+const catchReasons$1 = /* @__PURE__ */ dual((args) => isEffect$1(args[0]), (self, errorTag, cases, orElse) => {
+	let keys;
+	return catchIf$2(self, (e) => isTagged(e, errorTag) && hasProperty(e, "reason") && hasProperty(e.reason, "_tag") && isString(e.reason._tag), (e) => {
+		const reason = e.reason;
+		keys ??= Object.keys(cases);
+		if (keys.includes(reason._tag)) return internalCall(() => cases[reason._tag](reason, e));
+		return orElse ? internalCall(() => orElse(reason, e)) : fail$7(e);
+	});
+});
+/** @internal */
 const mapError = /* @__PURE__ */ dual(2, (self, f) => catch_$2(self, (error) => failSync(() => f(error))));
 const mapBoth = /* @__PURE__ */ dual(2, (self, options) => matchEffect$2(self, {
 	onFailure: (e) => failSync(() => options.onFailure(e)),
@@ -12184,6 +12194,42 @@ const catch_$1 = catch_$2;
 */
 const catchTag$1 = catchTag$2;
 /**
+* Catches multiple reasons within a tagged error using an object of handlers.
+*
+* **Example** (Handling multiple error reasons)
+*
+* ```ts
+* import { Data, Effect } from "effect"
+*
+* class RateLimitError extends Data.TaggedError("RateLimitError")<{
+*   retryAfter: number
+* }> {}
+*
+* class QuotaExceededError extends Data.TaggedError("QuotaExceededError")<{
+*   limit: number
+* }> {}
+*
+* class AiError extends Data.TaggedError("AiError")<{
+*   reason: RateLimitError | QuotaExceededError
+* }> {}
+*
+* declare const program: Effect.Effect<string, AiError>
+*
+* const handled = program.pipe(
+*   Effect.catchReasons("AiError", {
+*     RateLimitError: (reason) =>
+*       Effect.succeed(`Retry after ${reason.retryAfter}s`),
+*     QuotaExceededError: (reason) =>
+*       Effect.succeed(`Quota exceeded: ${reason.limit}`)
+*   })
+* )
+* ```
+*
+* @category error handling
+* @since 4.0.0
+*/
+const catchReasons = catchReasons$1;
+/**
 * Handles both recoverable and unrecoverable errors by providing a recovery
 * effect.
 *
@@ -15586,7 +15632,7 @@ function transformOptional(f) {
 */
 function withDefault$1(defaultValue) {
 	return new Getter((o) => {
-		const filtered = filter(o, isNotUndefined);
+		const filtered = filter$1(o, isNotUndefined);
 		return isSome(filtered) ? succeed$2(filtered) : mapEager(defaultValue, some);
 	});
 }
@@ -19434,6 +19480,10 @@ var JsonReportProjectEntryV3 = class extends Class("JsonReportProjectEntryV3")({
 	scannedFileCount: optional(Number$1),
 	elapsedMilliseconds: Number$1
 }) {};
+var JsonReportSkippedProject = class extends Class("JsonReportSkippedProject")({
+	directory: String$1,
+	reason: Literal("max-duration")
+}) {};
 /** Original full, diff, and staged report contract. */
 var JsonReportV1 = class extends Class("JsonReportV1")({
 	schemaVersion: Literal(1),
@@ -19462,6 +19512,7 @@ var JsonReportV1 = class extends Class("JsonReportV1")({
 	reactDetected: optional(Boolean$1),
 	diff: NullOr(JsonReportDiffInfo),
 	projects: ArraySchema(JsonReportProjectEntry),
+	skippedProjects: optional(ArraySchema(JsonReportSkippedProject)),
 	diagnostics: ArraySchema(Diagnostic),
 	summary: JsonReportSummary,
 	elapsedMilliseconds: Number$1,
@@ -19490,6 +19541,7 @@ var JsonReportV2 = class extends Class("JsonReportV2")({
 	diff: NullOr(JsonReportDiffInfo),
 	baseline: JsonReportBaseline,
 	projects: ArraySchema(JsonReportProjectEntry),
+	skippedProjects: optional(ArraySchema(JsonReportSkippedProject)),
 	diagnostics: ArraySchema(Diagnostic),
 	summary: JsonReportSummary,
 	elapsedMilliseconds: Number$1,
@@ -19506,6 +19558,7 @@ var JsonReportV3 = class extends Class("JsonReportV3")({
 	diff: NullOr(JsonReportDiffInfo),
 	baseline: optional(JsonReportBaseline),
 	projects: ArraySchema(JsonReportProjectEntryV3),
+	skippedProjects: optional(ArraySchema(JsonReportSkippedProject)),
 	diagnostics: ArraySchema(JsonReportDiagnosticV3),
 	summary: JsonReportSummary,
 	elapsedMilliseconds: Number$1,
@@ -53488,6 +53541,47 @@ const flattenArray = (self) => transformPull$1(self, (pull) => {
 	}));
 });
 /**
+* Filters arrays of elements emitted by a channel, applying the filter
+* to each element within the arrays and only emitting non-empty filtered arrays.
+*
+* **Example** (Filtering array output)
+*
+* ```ts
+* import { Array, Channel } from "effect"
+*
+* const nonEmptyArrayPredicate = Array.isReadonlyArrayNonEmpty
+*
+* // Create a channel that outputs arrays of mixed data
+* const arrayChannel = Channel.fromIterable([
+*   Array.make(1, 2, 3, 4, 5),
+*   Array.make(6, 7, 8, 9, 10),
+*   Array.make(11, 12, 13, 14, 15)
+* ]).pipe(Channel.filter(nonEmptyArrayPredicate))
+*
+* // Filter arrays to keep only even numbers
+* const evenArraysChannel = Channel.filterArray(arrayChannel, (n) => n % 2 === 0)
+* // Outputs: [2, 4], [6, 8, 10], [12, 14]
+* // Note: Only non-empty filtered arrays are emitted
+*
+* // Arrays that would become empty after filtering are discarded entirely
+* const oddChannel = Channel.fromIterable([
+*   Array.make(1, 3, 5),
+*   Array.make(2, 4),
+*   Array.make(7, 9)
+* ]).pipe(Channel.filter(nonEmptyArrayPredicate))
+* const filteredOddChannel = Channel.filterArray(oddChannel, (n) => n % 2 === 0)
+* // Outputs: [2, 4] (the arrays [1,3,5] and [7,9] are discarded)
+* ```
+*
+* @category filtering
+* @since 4.0.0
+*/
+const filterArray = /* @__PURE__ */ dual(2, (self, predicate) => transformPull$1(self, (pull) => succeed$2(flatMap$2(pull, function loop(arr) {
+	const passes = [];
+	for (let i = 0; i < arr.length; i++) if (predicate(arr[i])) passes.push(arr[i]);
+	return isReadonlyArrayNonEmpty(passes) ? succeed$2(passes) : flatMap$2(pull, loop);
+}))));
+/**
 * Filters and maps each element inside emitted non-empty arrays using a
 * `Filter`.
 *
@@ -55125,6 +55219,30 @@ const concat = /* @__PURE__ */ dual(2, (self, that) => flatten(fromArray([self,
 */
 const merge$1 = /* @__PURE__ */ dual((args) => isStream(args[0]) && isStream(args[1]), (self, that, options) => fromChannel(merge$2(toChannel(self), toChannel(that), options)));
 /**
+* Filters a stream to the elements that satisfy a predicate.
+*
+* **Example** (Filtering stream values)
+*
+* ```ts
+* import { Console, Effect, Stream } from "effect"
+*
+* const program = Effect.gen(function*() {
+*   const stream = Stream.make(1, 2, 3, 4).pipe(
+*     Stream.filter((n) => n % 2 === 0)
+*   )
+*   const values = yield* Stream.runCollect(stream)
+*   yield* Console.log(values)
+* })
+*
+* Effect.runPromise(program)
+* // Output: [ 2, 4 ]
+* ```
+*
+* @category filtering
+* @since 2.0.0
+*/
+const filter = /* @__PURE__ */ dual(2, (self, predicate) => fromChannel(filterArray(toChannel(self), predicate)));
+/**
 * Filters and maps stream elements in one pass using a `Filter`.
 *
 * @category filtering
@@ -61908,6 +62026,7 @@ const GENERATED_BUNDLE_FILE_PATTERN = /\.(iife|umd|global|min)\.m?js$/i;
 const GENERATED_SOURCE_DIRECTORY_PATTERN = /(?:^|\/)__generated__\//;
 const MINIFIED_SNIFF_BYTES = 65536;
 const GIT_LS_FILES_MAX_BUFFER_BYTES = 50 * 1024 * 1024;
+const GIT_CHECK_ATTR_MAX_BUFFER_BYTES = GIT_LS_FILES_MAX_BUFFER_BYTES;
 const SCANNED_DOT_DIRECTORIES = new Set([".dumi", ".storybook"]);
 const IGNORED_DIRECTORIES = new Set([
 	".angular",
@@ -62216,13 +62335,9 @@ const DEAD_CODE_WORKER_TIMEOUT_MS = 12e4;
 const OXLINT_SPLIT_TOTAL_BUDGET_MS = 18e4;
 const ABORT_EXIT_CODES = new Set([134, 3221226505]);
 const OXLINT_OOM_RESCUE_BUDGET_MS = 6e4;
-const DEAD_CODE_PHASE_TIMEOUT_MS = 15e4;
-const LINT_PHASE_TIMEOUT_MS = 3e5;
-const SCAN_TOTAL_DEADLINE_MS = 9e5;
 const DEAD_CODE_WORKER_MAX_OLD_SPACE_MB = 8192;
 const DEAD_CODE_WORKER_MEM_BUDGET_BYTES = 2 * 1024 * 1024 * 1024;
 const DEAD_CODE_TIMEOUT_CEILING_MS = 6e5;
-const DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS = 3e4;
 const DEAD_CODE_OVERLAP_PARSE_SHARE = .4;
 const RECOMMENDED_PNPM_MINIMUM_RELEASE_AGE_MINUTES = 10080;
 const REACT_SERVER_DOM_PACKAGES = [
@@ -62269,7 +62384,7 @@ const SOCKET_FREE_USER_AGENT = "react-doctor-supply-chain";
 const FILE_LINT_CACHE_FILENAME = "file-lint-cache.json";
 const FILE_LINT_CACHE_MAX_FILE_COUNT = 5e4;
 const SIDECAR_LINT_CACHE_FILENAME = "sidecar-lint-cache.json";
-const CORE_PACKAGE_VERSION = "0.9.3";
+const CORE_PACKAGE_VERSION = "0.9.4";
 const DEAD_CODE_CACHE_FILENAME = "dead-code-cache.json";
 const DEAD_CODE_SUMMARY_CACHE_FILENAME = "dead-code-summaries.json";
 const SUPPLY_CHAIN_PLUGIN = "socket";
@@ -62282,17 +62397,20 @@ const SUPPLY_CHAIN_IGNORED_PACKAGES = new Set(["next"]);
 const isErrnoException = (error) => error instanceof Error && "code" in error;
 const IGNORABLE_READDIR_ERROR_CODES = new Set([
 	"EACCES",
+	"EBUSY",
 	"EPERM",
 	"ENOENT",
 	"ENOTDIR",
 	"EINVAL",
 	"ELOOP",
-	"ENAMETOOLONG"
+	"ENAMETOOLONG",
+	"ETIMEDOUT",
+	"UNKNOWN"
 ]);
 const isIgnorableReaddirError = (error) => isErrnoException(error) && typeof error.code === "string" && IGNORABLE_READDIR_ERROR_CODES.has(error.code);
 const readDirectoryEntries = (directoryPath) => {
 	try {
-		return NFS.readdirSync(directoryPath, { withFileTypes: true });
+		return fs.readdirSync(directoryPath, { withFileTypes: true });
 	} catch (error) {
 		if (isIgnorableReaddirError(error)) return [];
 		throw error;
@@ -62300,14 +62418,14 @@ const readDirectoryEntries = (directoryPath) => {
 };
 const isFile = (filePath) => {
 	try {
-		return NFS.statSync(filePath).isFile();
+		return fs.statSync(filePath).isFile();
 	} catch {
 		return false;
 	}
 };
 const isDirectory = (directoryPath) => {
 	try {
-		return NFS.statSync(directoryPath).isDirectory();
+		return fs.statSync(directoryPath).isDirectory();
 	} catch {
 		return false;
 	}
@@ -62317,6 +62435,66 @@ const isPlainObject = (value) => {
 	const prototype = Object.getPrototypeOf(value);
 	return prototype === null || prototype === Object.prototype;
 };
+const LINGUIST_ATTRIBUTES = ["linguist-generated", "linguist-vendored"];
+const DISABLED_ATTRIBUTE_VALUES = new Set([
+	"unspecified",
+	"unset",
+	"false",
+	"0",
+	"off",
+	"no"
+]);
+const buildInput = (relativePaths) => `${relativePaths.join("\0")}\0`;
+const parseIgnoredPaths = (output) => {
+	const ignoredPaths = /* @__PURE__ */ new Set();
+	const fields = output.split("\0");
+	for (let fieldIndex = 0; fieldIndex + 2 < fields.length; fieldIndex += 3) {
+		const filePath = fields[fieldIndex];
+		const value = fields[fieldIndex + 2]?.toLowerCase();
+		if (filePath && value && !DISABLED_ATTRIBUTE_VALUES.has(value)) ignoredPaths.add(filePath);
+	}
+	return ignoredPaths;
+};
+const collectGitLinguistIgnoredPaths = (rootDirectory, relativePaths) => {
+	if (relativePaths.length === 0) return /* @__PURE__ */ new Set();
+	const result = spawnSync("git", [
+		"check-attr",
+		"-z",
+		"--stdin",
+		...LINGUIST_ATTRIBUTES
+	], {
+		cwd: rootDirectory,
+		encoding: "utf-8",
+		input: buildInput(relativePaths),
+		maxBuffer: GIT_CHECK_ATTR_MAX_BUFFER_BYTES
+	});
+	if (result.error || result.status !== 0) return /* @__PURE__ */ new Set();
+	return parseIgnoredPaths(result.stdout);
+};
+const collectGitLinguistIgnoredPathsCooperative = (rootDirectory, relativePaths, signal) => {
+	if (relativePaths.length === 0) return Promise.resolve(/* @__PURE__ */ new Set());
+	return new Promise((resolve, reject) => {
+		signal?.throwIfAborted();
+		execFile("git", [
+			"check-attr",
+			"-z",
+			"--stdin",
+			...LINGUIST_ATTRIBUTES
+		], {
+			cwd: rootDirectory,
+			encoding: "utf-8",
+			killSignal: "SIGKILL",
+			maxBuffer: GIT_CHECK_ATTR_MAX_BUFFER_BYTES,
+			signal
+		}, (error, stdout) => {
+			if (signal?.aborted) {
+				reject(signal.reason);
+				return;
+			}
+			resolve(error ? /* @__PURE__ */ new Set() : parseIgnoredPaths(stdout));
+		}).stdin?.end(buildInput(relativePaths));
+	});
+};
 const lastSourceMappingUrl = (fileContent) => {
 	const lastReference = [...fileContent.matchAll(/\/\/# sourceMappingURL=(\S+)/g)].at(-1);
 	return lastReference ? lastReference[1] : null;
@@ -62421,6 +62599,9 @@ function* walkSourceTreeFiles(rootDirectory) {
 		}
 	}
 }
+const yieldToEventLoop = () => new Promise((resolve) => {
+	setImmediate(resolve);
+});
 const collectSizedSourceFiles = (rootDirectory, relativePaths) => {
 	const entries = [];
 	for (const relativePath of relativePaths) {
@@ -62434,23 +62615,55 @@ const collectSizedSourceFiles = (rootDirectory, relativePaths) => {
 	}
 	return entries;
 };
-const gitLsFiles = (rootDirectory, flags) => {
+const collectSizedSourceFilesCooperative = async (rootDirectory, relativePaths, signal) => {
+	const entries = [];
+	let sliceStartedAt = performance.now();
+	for (const relativePath of relativePaths) {
+		signal?.throwIfAborted();
+		const absolutePath = Path.resolve(rootDirectory, relativePath);
+		const sizeBytes = statSourceFileSize(absolutePath);
+		if (!isLargeMinifiedFile(absolutePath, sizeBytes)) entries.push({
+			path: relativePath,
+			sizeBytes: sizeBytes ?? 0
+		});
+		if (performance.now() - sliceStartedAt >= 12) {
+			await yieldToEventLoop();
+			sliceStartedAt = performance.now();
+		}
+	}
+	return entries;
+};
+const parseGitSourceFilePaths = (output) => {
+	const trackedPaths = /* @__PURE__ */ new Set();
+	const untrackedPaths = [];
+	for (const entry of output.split("\0")) {
+		if (entry.length === 0) continue;
+		const trackedPath = /^[0-7]{6} [0-9a-f]+ [0-3]\t([\s\S]+)$/.exec(entry)?.[1];
+		if (trackedPath === void 0) untrackedPaths.push(entry);
+		else trackedPaths.add(trackedPath);
+	}
+	return {
+		trackedPaths: [...trackedPaths],
+		untrackedPaths
+	};
+};
+const listGitSourceFilePaths = (rootDirectory) => {
 	const result = spawnSync("git", [
 		"ls-files",
 		"-z",
-		...flags
+		"--stage",
+		"--others",
+		"--exclude-standard"
 	], {
 		cwd: rootDirectory,
 		encoding: "utf-8",
 		maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES
 	});
 	if (result.error || result.status !== 0) return null;
-	return result.stdout.split("\0").filter((filePath) => filePath.length > 0);
+	return parseGitSourceFilePaths(result.stdout);
 };
-const listSourceFilesViaGit = (rootDirectory) => {
-	const trackedPaths = gitLsFiles(rootDirectory, ["--cached"]);
-	const untrackedPaths = gitLsFiles(rootDirectory, ["--others", "--exclude-standard"]);
-	if (trackedPaths === null || untrackedPaths === null) return null;
+const collectGitCandidateSourceFilePaths = (rootDirectory, paths) => {
+	const { trackedPaths, untrackedPaths } = paths;
 	const emitDuplicateJsPaths = collectTypeScriptEmitDuplicateJsPaths({
 		trackedPaths: new Set(trackedPaths),
 		untrackedPaths,
@@ -62458,12 +62671,65 @@ const listSourceFilesViaGit = (rootDirectory) => {
 	});
 	return [...trackedPaths, ...untrackedPaths].filter((filePath) => isLintableSourceFile(filePath) && !hasIgnoredPathSegment(filePath) && !emitDuplicateJsPaths.has(filePath));
 };
+const filterGitSourceFilePaths = (rootDirectory, paths) => {
+	const candidatePaths = collectGitCandidateSourceFilePaths(rootDirectory, paths);
+	const linguistIgnoredPaths = collectGitLinguistIgnoredPaths(rootDirectory, candidatePaths);
+	return candidatePaths.filter((filePath) => !linguistIgnoredPaths.has(filePath));
+};
+const listSourceFilesViaGit = (rootDirectory) => {
+	const paths = listGitSourceFilePaths(rootDirectory);
+	return paths === null ? null : filterGitSourceFilePaths(rootDirectory, paths);
+};
+const listSourceFilesViaGitCooperative = async (rootDirectory, signal) => {
+	const paths = await new Promise((resolve, reject) => {
+		signal?.throwIfAborted();
+		execFile("git", [
+			"ls-files",
+			"-z",
+			"--stage",
+			"--others",
+			"--exclude-standard"
+		], {
+			cwd: rootDirectory,
+			encoding: "utf-8",
+			killSignal: "SIGKILL",
+			maxBuffer: GIT_LS_FILES_MAX_BUFFER_BYTES,
+			signal
+		}, (error, stdout) => {
+			if (signal?.aborted) {
+				reject(signal.reason);
+				return;
+			}
+			resolve(error ? null : parseGitSourceFilePaths(stdout));
+		});
+	});
+	if (paths === null) return null;
+	const candidatePaths = collectGitCandidateSourceFilePaths(rootDirectory, paths);
+	const linguistIgnoredPaths = await collectGitLinguistIgnoredPathsCooperative(rootDirectory, candidatePaths, signal);
+	return candidatePaths.filter((filePath) => !linguistIgnoredPaths.has(filePath));
+};
 const listSourceFilesViaFilesystem = (rootDirectory) => {
 	const filePaths = [];
 	for (const { absolutePath, name } of walkSourceTreeFiles(rootDirectory)) if (isLintableSourceFile(name)) filePaths.push(Path.relative(rootDirectory, absolutePath).replace(/\\/g, "/"));
 	return filePaths;
 };
-const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, (listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory)).sort());
+const listSourceFilesViaFilesystemCooperative = async (rootDirectory, signal) => {
+	const filePaths = [];
+	let sliceStartedAt = performance.now();
+	for (const { absolutePath, name } of walkSourceTreeFiles(rootDirectory)) {
+		signal?.throwIfAborted();
+		if (isLintableSourceFile(name)) filePaths.push(Path.relative(rootDirectory, absolutePath).replace(/\\/g, "/"));
+		if (performance.now() - sliceStartedAt >= 12) {
+			await yieldToEventLoop();
+			sliceStartedAt = performance.now();
+		}
+	}
+	return filePaths;
+};
+const listSourceFilePaths = (rootDirectory) => (listSourceFilesViaGit(rootDirectory) ?? listSourceFilesViaFilesystem(rootDirectory)).sort();
+const listSourceFilePathsCooperative = async (rootDirectory, signal) => (await listSourceFilesViaGitCooperative(rootDirectory, signal) ?? await listSourceFilesViaFilesystemCooperative(rootDirectory, signal)).sort();
+const listSourceFilesWithSize = (rootDirectory) => collectSizedSourceFiles(rootDirectory, listSourceFilePaths(rootDirectory));
+const listSourceFilesCooperative = async (rootDirectory, signal) => (await collectSizedSourceFilesCooperative(rootDirectory, await listSourceFilePathsCooperative(rootDirectory, signal), signal)).map((entry) => entry.path);
 const listSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).map((entry) => entry.path);
 const countSourceFiles = (rootDirectory) => listSourceFilesWithSize(rootDirectory).length;
 const UTF8_BOM_CHARACTER = "";
@@ -62589,7 +62855,12 @@ const mergeCompilerOptions = (inherited, current) => {
 	};
 };
 const readResolvedCompilerOptions = (tsConfigPath, extendsDepth, visitedPaths) => {
-	const realPath = NFS.realpathSync.native(tsConfigPath);
+	let realPath;
+	try {
+		realPath = NFS.realpathSync.native(tsConfigPath);
+	} catch {
+		return null;
+	}
 	if (visitedPaths.has(realPath)) return null;
 	const tsConfig = readTsConfig(realPath);
 	if (!tsConfig) return null;
@@ -63117,27 +63388,30 @@ const getSelectedObjectProperty = (expression, propertyName, analysis, visitedEx
 	}
 	return null;
 };
-const configExpressionMayDefineProperty = (expression, propertyName, analysis) => {
+const configExpressionMayDefineProperty = (expression, propertyName, analysis, visitedExpressions = /* @__PURE__ */ new Set()) => {
 	let resolvedExpression = expression;
 	while (ts.isParenthesizedExpression(resolvedExpression) || ts.isAsExpression(resolvedExpression) || ts.isTypeAssertionExpression(resolvedExpression) || ts.isSatisfiesExpression(resolvedExpression) || ts.isNonNullExpression(resolvedExpression)) resolvedExpression = resolvedExpression.expression;
+	if (visitedExpressions.has(resolvedExpression)) return true;
+	const nextVisitedExpressions = new Set(visitedExpressions);
+	nextVisitedExpressions.add(resolvedExpression);
 	if (ts.isIdentifier(resolvedExpression)) {
 		if (analysis.localBindings.has(resolvedExpression.text)) {
 			const localReference = analysis.localBindings.get(resolvedExpression.text);
-			return localReference?.expression ? configExpressionMayDefineProperty(localReference.expression, propertyName, localReference.analysis) : true;
+			return localReference?.expression ? configExpressionMayDefineProperty(localReference.expression, propertyName, localReference.analysis, nextVisitedExpressions) : true;
 		}
 		const scopedBinding = getScopedConfigBinding(resolvedExpression);
-		if (scopedBinding.wasFound) return scopedBinding.initializer ? configExpressionMayDefineProperty(scopedBinding.initializer, propertyName, analysis) : true;
+		if (scopedBinding.wasFound) return scopedBinding.initializer ? configExpressionMayDefineProperty(scopedBinding.initializer, propertyName, analysis, nextVisitedExpressions) : true;
 		const topLevelBinding = getTopLevelBinding(analysis.sourceFile, resolvedExpression.text);
-		return topLevelBinding && ts.isExpression(topLevelBinding) ? configExpressionMayDefineProperty(topLevelBinding, propertyName, analysis) : true;
+		return topLevelBinding && ts.isExpression(topLevelBinding) ? configExpressionMayDefineProperty(topLevelBinding, propertyName, analysis, nextVisitedExpressions) : true;
 	}
 	if (ts.isConditionalExpression(resolvedExpression)) {
-		if (isStaticallyTruthyConfigExpression(resolvedExpression.condition, analysis)) return configExpressionMayDefineProperty(resolvedExpression.whenTrue, propertyName, analysis);
-		if (isStaticallyDisabledConfigExpression(resolvedExpression.condition, analysis)) return configExpressionMayDefineProperty(resolvedExpression.whenFalse, propertyName, analysis);
-		return configExpressionMayDefineProperty(resolvedExpression.whenTrue, propertyName, analysis) || configExpressionMayDefineProperty(resolvedExpression.whenFalse, propertyName, analysis);
+		if (isStaticallyTruthyConfigExpression(resolvedExpression.condition, analysis)) return configExpressionMayDefineProperty(resolvedExpression.whenTrue, propertyName, analysis, nextVisitedExpressions);
+		if (isStaticallyDisabledConfigExpression(resolvedExpression.condition, analysis)) return configExpressionMayDefineProperty(resolvedExpression.whenFalse, propertyName, analysis, nextVisitedExpressions);
+		return configExpressionMayDefineProperty(resolvedExpression.whenTrue, propertyName, analysis, nextVisitedExpressions) || configExpressionMayDefineProperty(resolvedExpression.whenFalse, propertyName, analysis, nextVisitedExpressions);
 	}
 	if (!ts.isObjectLiteralExpression(resolvedExpression)) return true;
 	return resolvedExpression.properties.some((property) => {
-		if (ts.isSpreadAssignment(property)) return configExpressionMayDefineProperty(property.expression, propertyName, analysis);
+		if (ts.isSpreadAssignment(property)) return configExpressionMayDefineProperty(property.expression, propertyName, analysis, nextVisitedExpressions);
 		if (ts.isPropertyAssignment(property) || ts.isShorthandPropertyAssignment(property) || ts.isMethodDeclaration(property) || ts.isGetAccessorDeclaration(property) || ts.isSetAccessorDeclaration(property)) {
 			const staticPropertyName = getStaticPropertyName$2(property.name);
 			return staticPropertyName === null || staticPropertyName === propertyName;
@@ -63213,7 +63487,13 @@ const analyzeConfigModuleExport = (filePath, exportName, allowCompilerTransform,
 	if (visitedModules.has(moduleVisitKey)) return false;
 	const nextVisitedModules = new Set(visitedModules);
 	nextVisitedModules.add(moduleVisitKey);
-	return analyzeConfigSourceFileExport(parseConfigSourceFile(filePath, NFS.readFileSync(filePath, "utf-8")), filePath, exportName, allowCompilerTransform, importDepth, nextVisitedModules, argumentsList, argumentAnalysis);
+	let sourceText;
+	try {
+		sourceText = NFS.readFileSync(filePath, "utf-8");
+	} catch {
+		return false;
+	}
+	return analyzeConfigSourceFileExport(parseConfigSourceFile(filePath, sourceText), filePath, exportName, allowCompilerTransform, importDepth, nextVisitedModules, argumentsList, argumentAnalysis);
 };
 const analyzeConfigSourceFileExport = (sourceFile, filePath, exportName, allowCompilerTransform, importDepth, visitedModules, argumentsList = [], argumentAnalysis) => {
 	const analysis = {
@@ -64041,13 +64321,7 @@ const hasReactDependency = (packageJson) => {
 	};
 	return Object.keys(allDependencies).some((packageName) => REACT_DEPENDENCY_NAMES.has(packageName));
 };
-const getPreactVersion = (packageJson) => {
-	return {
-		...packageJson.peerDependencies,
-		...packageJson.dependencies,
-		...packageJson.devDependencies
-	}.preact ?? null;
-};
+const getPreactVersion = (packageJson) => getDependencySpec(packageJson, "preact");
 const resolveCatalogBackedDependencyVersion = ({ rootDirectory, rootPackageJson, packageName, sourceDirectory = rootDirectory, sourcePackageJson = rootPackageJson, version }) => {
 	if (version === null || !isCatalogReference(version)) return version;
 	const catalogName = extractCatalogName(version);
@@ -64792,7 +65066,16 @@ const getBrowserslistProtectionRequirement = (directory) => {
 		if (!queries) return void 0;
 		let requirement;
 		let hasUnsupportedTarget = false;
-		for (const browserTarget of (0, import_browserslist.default)(queries)) {
+		const previousIgnoreOldData = process.env.BROWSERSLIST_IGNORE_OLD_DATA;
+		let browserTargets = [];
+		try {
+			process.env.BROWSERSLIST_IGNORE_OLD_DATA = "true";
+			browserTargets = (0, import_browserslist.default)(queries);
+		} finally {
+			if (previousIgnoreOldData === void 0) delete process.env.BROWSERSLIST_IGNORE_OLD_DATA;
+			else process.env.BROWSERSLIST_IGNORE_OLD_DATA = previousIgnoreOldData;
+		}
+		for (const browserTarget of browserTargets) {
 			const browserRequirement = getBrowserProtectionRequirement(browserTarget);
 			if (browserRequirement === "unsupported") hasUnsupportedTarget = true;
 			if (browserRequirement === "noreferrer") requirement = "noreferrer";
@@ -64902,9 +65185,9 @@ const clearProjectCache = () => {
 * framework-agnostic rules. Throws only when the directory has nothing
 * to scan (no enclosing project and no source files of its own).
 */
-const discoverProjectWithoutPackageJson = (directory) => {
-	const sourceFileCount = countSourceFiles(directory);
-	const hasOwnTsConfig = NFS.existsSync(Path.join(directory, "tsconfig.json"));
+const discoverProjectWithoutPackageJson = (directory, options) => {
+	const sourceFileCount = options.sourceFileCount ?? countSourceFiles(directory);
+	const hasOwnTsConfig = isFile(Path.join(directory, "tsconfig.json"));
 	const enclosingProjectRoot = findNearestAncestorPackageJson(directory);
 	const enclosingProject = enclosingProjectRoot !== null ? discoverProject(enclosingProjectRoot) : null;
 	if (enclosingProject !== null) return {
@@ -64970,12 +65253,15 @@ const discoverProjectWithoutPackageJson = (directory) => {
 		sourceFileCount
 	};
 };
-const discoverProject = (directory) => {
+const discoverProject = (directory, options = {}) => {
 	const cached = cachedProjectInfos.get(directory);
-	if (cached !== void 0) return cached;
+	if (cached !== void 0) return options.sourceFileCount === void 0 ? cached : {
+		...cached,
+		sourceFileCount: options.sourceFileCount
+	};
 	const packageJsonPath = Path.join(directory, "package.json");
 	if (!isFile(packageJsonPath)) {
-		const synthesized = discoverProjectWithoutPackageJson(directory);
+		const synthesized = discoverProjectWithoutPackageJson(directory, options);
 		cachedProjectInfos.set(directory, synthesized);
 		return synthesized;
 	}
@@ -65037,8 +65323,8 @@ const discoverProject = (directory) => {
 	const tailwindVersion = tailwindcss.version;
 	const zodVersion = zod.version;
 	const projectName = packageJson.name ?? Path.basename(directory);
-	const hasTypeScript = NFS.existsSync(Path.join(directory, "tsconfig.json"));
-	const sourceFileCount = countSourceFiles(directory);
+	const hasTypeScript = isFile(Path.join(directory, "tsconfig.json"));
+	const sourceFileCount = options.sourceFileCount ?? countSourceFiles(directory);
 	const hasReactNativeWorkspace = framework === "expo" || framework === "react-native" || workspaceFacts.hasReactNativeAwarePackage;
 	const expoVersion = hasReactNativeWorkspace ? resolveCatalogBackedDependencyVersion({
 		rootDirectory: directory,
@@ -65167,134 +65453,6 @@ const discoverProject = (directory) => {
 * single source file has nothing to analyze.
 */
 const isAnalyzableProject = (project) => project.reactVersion !== null || project.preactVersion !== null || project.sourceFileCount > 0;
-const messageFromUnknown = (error) => error instanceof Error ? error.message : String(error);
-var InvalidGlobPatternError = class extends Error {
-	pattern;
-	reason;
-	constructor(pattern, reason) {
-		super(`Invalid glob pattern ${JSON.stringify(pattern)}: ${reason}`);
-		this.name = "InvalidGlobPatternError";
-		this.pattern = pattern;
-		this.reason = reason;
-	}
-};
-const assertGlobPattern = (condition, pattern, reason) => {
-	if (!condition) throw new InvalidGlobPatternError(pattern, reason);
-};
-const countGlobWildcards = (pattern) => (pattern.match(/[*?]/g) ?? []).length;
-const normalizeGlobPattern = (pattern) => pattern.replace(/\\/g, "/").replace(/^\//, "");
-const PICOMATCH_OPTIONS = {
-	dot: true,
-	strictSlashes: false,
-	windows: false
-};
-const compileGlobPattern = (rawPattern) => {
-	assertGlobPattern(typeof rawPattern === "string" && rawPattern.length > 0, String(rawPattern), "pattern must be a non-empty string.");
-	assertGlobPattern(rawPattern.length <= MAX_GLOB_PATTERN_LENGTH_CHARS, rawPattern, `pattern length ${rawPattern.length} exceeds the maximum of ${MAX_GLOB_PATTERN_LENGTH_CHARS} characters.`);
-	const wildcardCount = countGlobWildcards(rawPattern);
-	assertGlobPattern(wildcardCount <= 24, rawPattern, `pattern uses ${wildcardCount} wildcards (\`*\` / \`?\`), exceeding the maximum of 24. This guards against catastrophic backtracking from pathological patterns; split the pattern into multiple smaller entries.`);
-	try {
-		return import_picomatch.default.makeRe(normalizeGlobPattern(rawPattern), PICOMATCH_OPTIONS);
-	} catch (caughtError) {
-		throw new InvalidGlobPatternError(rawPattern, messageFromUnknown(caughtError));
-	}
-};
-const compileGlobPatternsLenient = (patterns, onInvalid) => {
-	const compiled = [];
-	for (const pattern of patterns) try {
-		compiled.push(compileGlobPattern(pattern));
-	} catch (caughtError) {
-		if (!(caughtError instanceof InvalidGlobPatternError)) throw caughtError;
-		onInvalid(caughtError);
-	}
-	return compiled;
-};
-const toRelativePath = (filePath, rootDirectory) => {
-	const normalizedFilePath = filePath.replace(/\\/g, "/");
-	const normalizedRoot = rootDirectory.replace(/\\/g, "/").replace(/\/$/, "") + "/";
-	if (normalizedFilePath.startsWith(normalizedRoot)) return normalizedFilePath.slice(normalizedRoot.length);
-	return normalizedFilePath.replace(/^\.\//, "");
-};
-const warnConfigIssue = (message) => {
-	process.stderr.write(`[react-doctor] ${message}\n`);
-};
-const isStringArray = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string");
-const collectStringList = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
-const validateOverrideEntry = (entry, index) => {
-	if (!isPlainObject(entry)) {
-		warnConfigIssue(`ignore.overrides[${index}] must be an object with { files, rules }; ignoring this entry.`);
-		return null;
-	}
-	if (!isStringArray(entry.files)) {
-		warnConfigIssue(`ignore.overrides[${index}].files must be an array of strings; ignoring this entry.`);
-		return null;
-	}
-	if (entry.rules !== void 0 && !isStringArray(entry.rules)) {
-		warnConfigIssue(`ignore.overrides[${index}].rules must be an array of "plugin/rule" strings or omitted; treating as missing (override would suppress every rule for the matched files).`);
-		return { files: entry.files };
-	}
-	return entry.rules === void 0 ? { files: entry.files } : {
-		files: entry.files,
-		rules: entry.rules
-	};
-};
-const compileIgnoreOverrides = (userConfig) => {
-	const overrides = userConfig?.ignore?.overrides;
-	if (overrides === void 0) return [];
-	if (!Array.isArray(overrides)) {
-		warnConfigIssue(`ignore.overrides must be an array of { files, rules } entries; ignoring.`);
-		return [];
-	}
-	return overrides.flatMap((entry, index) => {
-		const validated = validateOverrideEntry(entry, index);
-		if (!validated) return [];
-		const filePatterns = compileGlobPatternsLenient(collectStringList(validated.files), (error) => warnConfigIssue(`ignore.overrides[${index}]: ${error.message}`));
-		if (filePatterns.length === 0) return [];
-		return [{
-			filePatterns,
-			ruleIds: new Set(collectStringList(validated.rules))
-		}];
-	});
-};
-const isDiagnosticIgnoredByOverrides = (diagnostic, rootDirectory, overrides) => {
-	if (overrides.length === 0) return false;
-	const relativeFilePath = toRelativePath(diagnostic.filePath, rootDirectory);
-	const ruleIdentifier = `${diagnostic.plugin}/${diagnostic.rule}`;
-	return overrides.some((override) => override.filePatterns.some((pattern) => pattern.test(relativeFilePath)) && (override.ruleIds.size === 0 || override.ruleIds.has(ruleIdentifier)));
-};
-const SEVERITY_FOR_OVERRIDE = {
-	error: "error",
-	warn: "warning"
-};
-const restampSeverity = (diagnostic, override) => {
-	const targetSeverity = SEVERITY_FOR_OVERRIDE[override];
-	if (diagnostic.severity === targetSeverity) return diagnostic;
-	return {
-		...diagnostic,
-		severity: targetSeverity
-	};
-};
-/**
-* Assembles the internal `RuleSeverityControls` shape from a user
-* config's top-level `rules` and `categories` fields — the
-* ESLint / oxlint-shaped severity surface.
-*
-* Returns `undefined` when neither field is present so the common
-* path (no severity config at all) stays allocation-free for
-* downstream consumers.
-*/
-const buildRuleSeverityControls = (config) => {
-	if (!config) return void 0;
-	if (config.rules === void 0 && config.categories === void 0 && config.buckets === void 0) return;
-	return {
-		...config.rules !== void 0 ? { rules: config.rules } : {},
-		...config.categories !== void 0 ? { categories: config.categories } : {},
-		...config.buckets !== void 0 ? { buckets: config.buckets } : {}
-	};
-};
-const FOREIGN_INLINE_DISABLE_PATTERN = /(?:\/\/|\/\*)[ \t]*(eslint|oxlint)-disable-(next-line|line)(?![\w-])([^\r\n]*)/;
-const FOREIGN_BLOCK_DISABLE_PATTERN = /\/\*[ \t]*(eslint|oxlint)-disable(?![\w-])([^*\r\n]*)/;
-const FOREIGN_BLOCK_ENABLE_PATTERN = /\/\*[ \t]*(?:eslint|oxlint)-enable(?![\w-])([^*\r\n]*)/;
 const LEGACY_RULE_KEY_TO_NATIVE_RULE_KEY = {
 	"effect/no-adjust-state-on-prop-change": "react-doctor/no-adjust-state-on-prop-change",
 	"effect/no-chain-state-updates": "react-doctor/no-chain-state-updates",
@@ -65433,6 +65591,139 @@ const getEquivalentRuleKeys = (ruleKey) => {
 	const nativeRuleKey = canonicalizeRuleKey(ruleKey);
 	return [nativeRuleKey, ...getLegacyRuleKeysForNative(nativeRuleKey)];
 };
+const messageFromUnknown = (error) => error instanceof Error ? error.message : String(error);
+var InvalidGlobPatternError = class extends Error {
+	pattern;
+	reason;
+	constructor(pattern, reason) {
+		super(`Invalid glob pattern ${JSON.stringify(pattern)}: ${reason}`);
+		this.name = "InvalidGlobPatternError";
+		this.pattern = pattern;
+		this.reason = reason;
+	}
+};
+const assertGlobPattern = (condition, pattern, reason) => {
+	if (!condition) throw new InvalidGlobPatternError(pattern, reason);
+};
+const countGlobWildcards = (pattern) => (pattern.match(/[*?]/g) ?? []).length;
+const normalizeGlobPattern = (pattern) => pattern.replace(/\\/g, "/").replace(/^\//, "");
+const PICOMATCH_OPTIONS = {
+	dot: true,
+	strictSlashes: false,
+	windows: false
+};
+const compileGlobPattern = (rawPattern) => {
+	assertGlobPattern(typeof rawPattern === "string" && rawPattern.length > 0, String(rawPattern), "pattern must be a non-empty string.");
+	assertGlobPattern(rawPattern.length <= MAX_GLOB_PATTERN_LENGTH_CHARS, rawPattern, `pattern length ${rawPattern.length} exceeds the maximum of ${MAX_GLOB_PATTERN_LENGTH_CHARS} characters.`);
+	const wildcardCount = countGlobWildcards(rawPattern);
+	assertGlobPattern(wildcardCount <= 24, rawPattern, `pattern uses ${wildcardCount} wildcards (\`*\` / \`?\`), exceeding the maximum of 24. This guards against catastrophic backtracking from pathological patterns; split the pattern into multiple smaller entries.`);
+	try {
+		return import_picomatch.default.makeRe(normalizeGlobPattern(rawPattern), PICOMATCH_OPTIONS);
+	} catch (caughtError) {
+		throw new InvalidGlobPatternError(rawPattern, messageFromUnknown(caughtError));
+	}
+};
+const compileGlobPatternsLenient = (patterns, onInvalid) => {
+	const compiled = [];
+	for (const pattern of patterns) try {
+		compiled.push(compileGlobPattern(pattern));
+	} catch (caughtError) {
+		if (!(caughtError instanceof InvalidGlobPatternError)) throw caughtError;
+		onInvalid(caughtError);
+	}
+	return compiled;
+};
+const toRelativePath = (filePath, rootDirectory) => {
+	const normalizedFilePath = filePath.replace(/\\/g, "/");
+	const normalizedRoot = rootDirectory.replace(/\\/g, "/").replace(/\/$/, "") + "/";
+	if (normalizedFilePath.startsWith(normalizedRoot)) return normalizedFilePath.slice(normalizedRoot.length);
+	return normalizedFilePath.replace(/^\.\//, "");
+};
+const warnConfigIssue = (message) => {
+	process.stderr.write(`[react-doctor] ${message}\n`);
+};
+const isStringArray = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string");
+const collectStringList = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+const hasMatchingRuleOverride = (ruleIds, ruleIdentifier) => {
+	if (ruleIds.size === 0) return true;
+	for (const ruleId of ruleIds) if (isSameRuleKey(ruleId, ruleIdentifier)) return true;
+	return false;
+};
+const validateOverrideEntry = (entry, index) => {
+	if (!isPlainObject(entry)) {
+		warnConfigIssue(`ignore.overrides[${index}] must be an object with { files, rules }; ignoring this entry.`);
+		return null;
+	}
+	if (!isStringArray(entry.files)) {
+		warnConfigIssue(`ignore.overrides[${index}].files must be an array of strings; ignoring this entry.`);
+		return null;
+	}
+	if (entry.rules !== void 0 && !isStringArray(entry.rules)) {
+		warnConfigIssue(`ignore.overrides[${index}].rules must be an array of "plugin/rule" strings or omitted; treating as missing (override would suppress every rule for the matched files).`);
+		return { files: entry.files };
+	}
+	return entry.rules === void 0 ? { files: entry.files } : {
+		files: entry.files,
+		rules: entry.rules
+	};
+};
+const compileIgnoreOverrides = (userConfig) => {
+	const overrides = userConfig?.ignore?.overrides;
+	if (overrides === void 0) return [];
+	if (!Array.isArray(overrides)) {
+		warnConfigIssue(`ignore.overrides must be an array of { files, rules } entries; ignoring.`);
+		return [];
+	}
+	return overrides.flatMap((entry, index) => {
+		const validated = validateOverrideEntry(entry, index);
+		if (!validated) return [];
+		const filePatterns = compileGlobPatternsLenient(collectStringList(validated.files), (error) => warnConfigIssue(`ignore.overrides[${index}]: ${error.message}`));
+		if (filePatterns.length === 0) return [];
+		return [{
+			filePatterns,
+			ruleIds: new Set(collectStringList(validated.rules))
+		}];
+	});
+};
+const isDiagnosticIgnoredByOverrides = (diagnostic, rootDirectory, overrides) => {
+	if (overrides.length === 0) return false;
+	const relativeFilePath = toRelativePath(diagnostic.filePath, rootDirectory);
+	const ruleIdentifier = `${diagnostic.plugin}/${diagnostic.rule}`;
+	return overrides.some((override) => override.filePatterns.some((pattern) => pattern.test(relativeFilePath)) && hasMatchingRuleOverride(override.ruleIds, ruleIdentifier));
+};
+const SEVERITY_FOR_OVERRIDE = {
+	error: "error",
+	warn: "warning"
+};
+const restampSeverity = (diagnostic, override) => {
+	const targetSeverity = SEVERITY_FOR_OVERRIDE[override];
+	if (diagnostic.severity === targetSeverity) return diagnostic;
+	return {
+		...diagnostic,
+		severity: targetSeverity
+	};
+};
+/**
+* Assembles the internal `RuleSeverityControls` shape from a user
+* config's top-level `rules` and `categories` fields — the
+* ESLint / oxlint-shaped severity surface.
+*
+* Returns `undefined` when neither field is present so the common
+* path (no severity config at all) stays allocation-free for
+* downstream consumers.
+*/
+const buildRuleSeverityControls = (config) => {
+	if (!config) return void 0;
+	if (config.rules === void 0 && config.categories === void 0 && config.buckets === void 0) return;
+	return {
+		...config.rules !== void 0 ? { rules: config.rules } : {},
+		...config.categories !== void 0 ? { categories: config.categories } : {},
+		...config.buckets !== void 0 ? { buckets: config.buckets } : {}
+	};
+};
+const FOREIGN_INLINE_DISABLE_PATTERN = /(?:\/\/|\/\*)[ \t]*(eslint|oxlint)-disable-(next-line|line)(?![\w-])([^\r\n]*)/;
+const FOREIGN_BLOCK_DISABLE_PATTERN = /\/\*[ \t]*(eslint|oxlint)-disable(?![\w-])([^*\r\n]*)/;
+const FOREIGN_BLOCK_ENABLE_PATTERN = /\/\*[ \t]*(?:eslint|oxlint)-enable(?![\w-])([^*\r\n]*)/;
 const stripDescriptionTail = (ruleList) => {
 	const descriptionMatch = ruleList.match(/(?:^|\s)--\s/);
 	if (!descriptionMatch || descriptionMatch.index === void 0) return ruleList;
@@ -65845,6 +66136,10 @@ const classifyByDirectoryCohort = (packageDirectory) => {
 		current = parent;
 	}
 };
+const clearPackageRoleCache = () => {
+	cachedRoleByPackageDirectory.clear();
+	cachedPackageDirectoryByFilename.clear();
+};
 const classifyPackageRole = (filename) => {
 	if (!filename) return "unknown";
 	const packageDirectory = findNearestPackageDirectory(filename);
@@ -66079,12 +66374,8 @@ const buildDiagnosticPipeline = (input) => {
 		if (rule.tags.includes("migration-hint")) return false;
 		return getFileContext(diagnostic.filePath) !== "production";
 	};
-	const isRuleIgnored = (ruleIdentifier) => {
-		for (const ignored of ignoredRules) if (isSameRuleKey(ignored, ruleIdentifier)) return true;
-		return false;
-	};
-	const isAppOnlyRule = (ruleIdentifier) => {
-		for (const appOnlyRuleKey of APP_ONLY_RULE_KEYS) if (isSameRuleKey(appOnlyRuleKey, ruleIdentifier)) return true;
+	const matchesRuleKey = (ruleIdentifier, candidates) => {
+		for (const candidate of candidates) if (isSameRuleKey(candidate, ruleIdentifier)) return true;
 		return false;
 	};
 	const isRnRawTextSuppressedByConfig = (diagnostic) => {
@@ -66126,12 +66417,13 @@ const buildDiagnosticPipeline = (input) => {
 				if (explicitSeverityOverride === "off") return suppress(current, "config");
 				if (explicitSeverityOverride !== void 0) current = restampSeverity(current, explicitSeverityOverride);
 			}
+			const ruleIdentifier = `${current.plugin}/${current.rule}`;
 			if (explicitRuleOverride === void 0) {
-				if (isAppOnlyRule(`${current.plugin}/${current.rule}`) && isLibraryFile(current.filePath)) return null;
+				if (matchesRuleKey(ruleIdentifier, APP_ONLY_RULE_KEYS) && isLibraryFile(current.filePath)) return null;
 			}
 			if (!showWarnings && current.severity === "warning" && explicitSeverityOverride !== "warn") return null;
 			if (userConfig) {
-				if (isRuleIgnored(`${current.plugin}/${current.rule}`)) return suppress(current, "config");
+				if (matchesRuleKey(ruleIdentifier, ignoredRules)) return suppress(current, "config");
 				if (isFileIgnoredByPatterns(current.filePath, rootDirectory, ignoredFilePatterns)) return null;
 				if (isDiagnosticIgnoredByOverrides(current, rootDirectory, compiledOverrides)) return suppress(current, "override");
 				if (isRnRawTextSuppressedByConfig(current)) return null;
@@ -66140,7 +66432,6 @@ const buildDiagnosticPipeline = (input) => {
 			if (respectInlineDisables && current.line > 0) {
 				const lines = getFileLines(current.filePath);
 				if (lines) {
-					const ruleIdentifier = `${current.plugin}/${current.rule}`;
 					const evaluation = evaluateSuppression(lines, current.line - 1, ruleIdentifier);
 					if (evaluation.isSuppressed) return suppress(current, evaluation.isForeignDirective ? "foreign-inline" : "inline");
 					if (evaluation.nearMissHint) current = {
@@ -66394,7 +66685,8 @@ const readSystemFacts$1 = () => ({
 /**
 * Auto lint-worker count: the smaller of the (cgroup-CPU-aware) core count and
 * the number of `PER_WORKER_MEM_BUDGET_BYTES` workers that fit in available
-* memory, then clamped to `[MIN, HARD_MAX]` by `resolveScanConcurrency`.
+* memory, and the measured automatic parallel-efficiency ceiling, then clamped
+* to `[MIN, HARD_MAX]` by `resolveScanConcurrency`.
 *
 * `os.availableParallelism()` already respects cgroup CPU quotas, so the core
 * term needs no help. Available memory is `os.totalmem()` floored by the cgroup
@@ -66410,7 +66702,7 @@ const readSystemFacts$1 = () => ({
 const resolveAutoScanConcurrency = (facts = readSystemFacts$1()) => {
 	const availableMemoryBytes = Math.min(facts.totalMemoryBytes, facts.cgroupMemoryLimitBytes ?? Number.POSITIVE_INFINITY);
 	const memoryBoundedWorkers = Math.floor(availableMemoryBytes / PER_WORKER_MEM_BUDGET_BYTES);
-	return resolveScanConcurrency(Math.min(facts.availableCores, memoryBoundedWorkers));
+	return resolveScanConcurrency(Math.min(facts.availableCores, memoryBoundedWorkers, 10));
 };
 const resolveLintBatchOrdering = () => {
 	return process.env["REACT_DOCTOR_LINT_BATCH_ORDERING"]?.trim().toLowerCase() === "arrival" ? "arrival" : "cost";
@@ -66423,24 +66715,22 @@ const resolveLintBatchOrdering = () => {
 */
 var OxlintSpawnTimeoutMs = class extends Reference("react-doctor/OxlintSpawnTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_OXLINT_SPAWN_TIMEOUT_MS", OXLINT_SPAWN_TIMEOUT_MS) }) {};
 /**
-* Effect-side cap on the lint phase. The env var lets CI / eval runners
-* raise the phase budget for slow large repos without recompiling.
+* Optional Effect-side cap on the lint phase. Unbounded unless explicitly
+* configured through the env var or a test layer.
 * Tests override via `Layer.succeed(LintPhaseTimeoutMs, ...)`.
 */
-var LintPhaseTimeoutMs = class extends Reference("react-doctor/LintPhaseTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_LINT_PHASE_TIMEOUT_MS", LINT_PHASE_TIMEOUT_MS) }) {};
+var LintPhaseTimeoutMs = class extends Reference("react-doctor/LintPhaseTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_LINT_PHASE_TIMEOUT_MS", null) }) {};
 /**
-* Effect-side cap on the dead-code phase, sitting above the in-worker
-* timeout as a runtime-independent backstop. The env var raises it for
-* type-heavy projects; tests override via
+* Optional Effect-side cap on the dead-code phase. Unbounded unless explicitly
+* configured through the env var or a test layer. Tests override via
 * `Layer.succeed(DeadCodePhaseTimeoutMs, ...)`.
 */
-var DeadCodePhaseTimeoutMs = class extends Reference("react-doctor/DeadCodePhaseTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_DEAD_CODE_PHASE_TIMEOUT_MS", DEAD_CODE_PHASE_TIMEOUT_MS) }) {};
+var DeadCodePhaseTimeoutMs = class extends Reference("react-doctor/DeadCodePhaseTimeoutMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_DEAD_CODE_PHASE_TIMEOUT_MS", null) }) {};
 /**
-* Overall scan deadline backstop, bounding everything the per-phase
-* timeouts don't (wedged git / IO). The env var raises it for very
-* large repos; tests override via `Layer.succeed(ScanDeadlineMs, ...)`.
+* Optional overall scan deadline. Unbounded unless explicitly configured
+* through the env var or a test layer.
 */
-var ScanDeadlineMs = class extends Reference("react-doctor/ScanDeadlineMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_SCAN_DEADLINE_MS", SCAN_TOTAL_DEADLINE_MS) }) {};
+var ScanDeadlineMs = class extends Reference("react-doctor/ScanDeadlineMs", { defaultValue: () => readPositiveEnvMs("REACT_DOCTOR_SCAN_DEADLINE_MS", null) }) {};
 /**
 * Wall-clock budget for the supply-chain check when it runs on a background
 * fiber overlapping the lint pass. Reads from the env var on startup so the
@@ -66513,14 +66803,14 @@ var DeadCodeOverlap = class extends Reference("react-doctor/DeadCodeOverlap", {
 /**
 * How the full-scan lint pass plans its file batches. `"cost"` (the default)
 * builds size-balanced LPT batches (`planLintBatches`): the same mandatory
-* batch count as greedy chunking (`ceil(files / 100)`), but every batch gets
-* an even share of files AND bytes, so no 100-file chunk is a straggler while
+* batch count as greedy chunking, but every batch gets an even share of files
+* AND bytes, so no full chunk is a straggler while
 * the remainder-batch worker idles — and the heavy files are SPREAD across
 * batches, the precondition the old sort-desc-then-chunk-100 `cost` mode
 * lacked (it packed the heaviest files into one wave-1 straggler batch,
 * measurably regressing size-skewed repos, which is why it never earned the
 * default). `"arrival"` (`REACT_DOCTOR_LINT_BATCH_ORDERING=arrival`) is the
-* rollback hatch to plain greedy 100-file chunking in discovery order. Tests
+* rollback hatch to plain greedy fixed-size chunking in discovery order. Tests
 * override via `Layer.succeed(LintBatchOrdering, ...)`. Diff / staged scans
 * never reach this — they pass user-scoped `includePaths` that skip discovery
 * and stay in arrival order; only the full-scan branch reads it.
@@ -66615,6 +66905,7 @@ const DEFAULT_SURFACE_EXCLUDED_TAGS = {
 	score: ["design"],
 	ciFailure: ["design"]
 };
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const VALID_RULE_SEVERITIES = [
 	"error",
 	"warn",
@@ -66657,7 +66948,6 @@ const SURFACE_CONTROL_FIELD_NAMES = [
 ];
 const isIncludedFileContext = (value) => VALID_INCLUDED_FILE_CONTEXTS.some((fileContext) => fileContext === value);
 const SEVERITY_FIELD_NAMES = ["rules", "categories"];
-const isPlainObject$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const formatType = (value) => typeof value === "string" ? `"${value}"` : typeof value;
 const isRuleSeverity = (value) => typeof value === "string" && VALID_RULE_SEVERITIES.includes(value);
 const coerceMaybeBooleanString = (fieldName, value) => {
@@ -66684,8 +66974,45 @@ const validateStringArrayField = (fieldName, value) => {
 		return false;
 	});
 };
+const validateIgnoreOverride = (rawOverride, index) => {
+	const fieldName = `ignore.overrides[${index}]`;
+	if (!isRecord(rawOverride)) {
+		warnConfigIssue(`config field "${fieldName}" must be an object (got ${typeof rawOverride}); ignoring this override.`);
+		return;
+	}
+	const files = validateStringArrayField(`${fieldName}.files`, rawOverride.files);
+	if (files === void 0) return void 0;
+	const validatedOverride = { files };
+	if (rawOverride.rules !== void 0) {
+		const rules = validateStringArrayField(`${fieldName}.rules`, rawOverride.rules);
+		if (rules !== void 0) validatedOverride.rules = rules;
+	}
+	return validatedOverride;
+};
+const validateIgnoreField = (rawIgnore) => {
+	if (!isRecord(rawIgnore)) {
+		warnConfigIssue(`config field "ignore" must be an object (got ${typeof rawIgnore}); ignoring this field.`);
+		return;
+	}
+	const validatedIgnore = {};
+	for (const fieldName of [
+		"rules",
+		"files",
+		"tags"
+	]) {
+		if (rawIgnore[fieldName] === void 0) continue;
+		const validatedValues = validateStringArrayField(`ignore.${fieldName}`, rawIgnore[fieldName]);
+		if (validatedValues !== void 0) validatedIgnore[fieldName] = validatedValues;
+	}
+	if (rawIgnore.overrides !== void 0) if (!Array.isArray(rawIgnore.overrides)) warnConfigIssue(`config field "ignore.overrides" must be an array (got ${typeof rawIgnore.overrides}); ignoring this field.`);
+	else validatedIgnore.overrides = rawIgnore.overrides.flatMap((rawOverride, index) => {
+		const validatedOverride = validateIgnoreOverride(rawOverride, index);
+		return validatedOverride ? [validatedOverride] : [];
+	});
+	return validatedIgnore;
+};
 const validateSurfaceControls = (surface, rawControls) => {
-	if (!isPlainObject$1(rawControls)) {
+	if (!isRecord(rawControls)) {
 		warnConfigIssue(`config field "surfaces.${surface}" must be an object (got ${typeof rawControls}); ignoring this surface.`);
 		return;
 	}
@@ -66709,7 +67036,7 @@ const validateSurfaceControls = (surface, rawControls) => {
 	return validatedSurfaceControls;
 };
 const validateSurfacesField = (rawSurfaces) => {
-	if (!isPlainObject$1(rawSurfaces)) {
+	if (!isRecord(rawSurfaces)) {
 		warnConfigIssue(`config field "surfaces" must be an object (got ${typeof rawSurfaces}); ignoring this field.`);
 		return;
 	}
@@ -66725,7 +67052,7 @@ const validateSurfacesField = (rawSurfaces) => {
 	return validated;
 };
 const validateSeverityMap = (fieldName, rawMap, keysAreCategories = false) => {
-	if (!isPlainObject$1(rawMap)) {
+	if (!isRecord(rawMap)) {
 		warnConfigIssue(`config field "${fieldName}" must be an object (got ${typeof rawMap}); ignoring this field.`);
 		return;
 	}
@@ -66759,6 +67086,7 @@ const validateConfigTypes = (config) => {
 	for (const fieldName of BOOLEAN_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => coerceMaybeBooleanString(fieldName, value));
 	for (const fieldName of STRING_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateString(fieldName, value));
 	for (const fieldName of STRING_ARRAY_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateStringArrayField(fieldName, value));
+	applyFieldValidator(config, validated, "ignore", validateIgnoreField);
 	applyFieldValidator(config, validated, "surfaces", validateSurfacesField);
 	for (const fieldName of SEVERITY_FIELD_NAMES) applyFieldValidator(config, validated, fieldName, (value) => validateSeverityMap(fieldName, value, fieldName === "categories"));
 	applyFieldValidator(config, validated, "plugins", (value) => validateStringArrayField("plugins", value));
@@ -67010,6 +67338,10 @@ const dedupeRelatedDiagnostics = (diagnostics) => {
 	}
 	return uniqueDiagnostics;
 };
+const isPathInsideDirectory = (childAbsolutePath, parentAbsolutePath) => {
+	const relativePath = Path.relative(parentAbsolutePath, childAbsolutePath);
+	return Boolean(relativePath) && !relativePath.startsWith("..") && !Path.isAbsolute(relativePath);
+};
 const compareStrings = (left, right) => left < right ? -1 : left > right ? 1 : 0;
 const sortDiagnosticsStable = (diagnostics) => [...diagnostics].sort((left, right) => compareStrings(left.filePath, right.filePath) || left.line - right.line || left.column - right.column || compareStrings(left.plugin, right.plugin) || compareStrings(left.rule, right.rule) || compareStrings(left.severity, right.severity) || compareStrings(left.message, right.message));
 const getDirectDependencyNames = (packageJson) => new Set([...Object.keys(packageJson.dependencies ?? {}), ...Object.keys(packageJson.devDependencies ?? {})]);
@@ -68371,7 +68703,7 @@ const collectScriptMotionEvidence = (sourceFile, typeChecker, program) => {
 			if (calleeEvidence.isReducedMotionHook && isExpressionValueConsumed(node)) evidence.hasReducedMotionHandling = true;
 		}
 		if (ts.isJsxOpeningElement(node) || ts.isJsxSelfClosingElement(node)) {
-			const tagEvidence = ts.isJsxNamespacedName(node.tagName) ? EMPTY_MOTION_EXPRESSION_EVIDENCE : resolveMotionExpressionEvidence(node.tagName, typeChecker, program);
+			const tagEvidence = ts.isIdentifier(node.tagName) || ts.isPropertyAccessExpression(node.tagName) ? resolveMotionExpressionEvidence(node.tagName, typeChecker, program) : EMPTY_MOTION_EXPRESSION_EVIDENCE;
 			if (tagEvidence.isMotionComponent || tagEvidence.isMotionComponentFactory) evidence.hasMotionUse = true;
 			if (tagEvidence.isMotionConfig && jsxElementHasReducedMotionConfiguration(node.attributes, typeChecker)) evidence.hasReducedMotionHandling = true;
 		}
@@ -68586,7 +68918,7 @@ const readScannedFile = (candidate) => {
 		return null;
 	}
 };
-function* collectSecurityScanFiles(rootDirectory) {
+function* collectSecurityScanFiles(rootDirectory, excludedDirectories = /* @__PURE__ */ new Set()) {
 	const priorityCandidates = [];
 	const artifactCandidates = [];
 	const otherCandidates = [];
@@ -68601,7 +68933,7 @@ function* collectSecurityScanFiles(rootDirectory) {
 		for (const entry of readDirectoryEntries(current.absolutePath)) {
 			const absolutePath = Path.join(current.absolutePath, entry.name);
 			if (entry.isDirectory()) {
-				if (!SKIPPED_DIRECTORY_NAMES.has(entry.name)) stack.push({
+				if (!SKIPPED_DIRECTORY_NAMES.has(entry.name) && !excludedDirectories.has(Path.resolve(absolutePath))) stack.push({
 					absolutePath,
 					depth: current.depth + 1
 				});
@@ -68782,10 +69114,8 @@ const shouldEnableRule = (requires, tags, capabilities, ignoredTags, disabledWhe
 	}
 	return true;
 };
+const remainingDeadlineBudgetMs = (deadlineEpochMs) => Math.max(deadlineEpochMs - Date.now(), 0);
 const shouldEnableRuleByDefaultStatus = (options) => options.defaultEnabled !== false || options.hasExplicitOverride === true || options.includeTagDefaults && options.hasIncludedTags;
-const yieldToEventLoop = () => new Promise((resolve) => {
-	setImmediate(resolve);
-});
 const createSecurityScanSession = (rootDirectory, options) => {
 	const capabilities = options.project ? getCapabilities(options.project) : /* @__PURE__ */ new Set();
 	const ignoredTags = options.ignoredTags ?? /* @__PURE__ */ new Set();
@@ -68838,19 +69168,35 @@ const createSecurityScanSession = (rootDirectory, options) => {
 	};
 };
 const checkSecurityScanCooperative = async (rootDirectory, options = {}) => {
+	const throwIfScanAborted = () => {
+		options.signal?.throwIfAborted();
+	};
+	const didReachDeadline = () => {
+		const hasDeadlineElapsed = options.deadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(options.deadlineEpochMs) === 0;
+		if (hasDeadlineElapsed) options.onDeadlineExceeded?.();
+		return hasDeadlineElapsed;
+	};
+	throwIfScanAborted();
 	const session = createSecurityScanSession(rootDirectory, options);
 	if (session === null) return [];
+	if (didReachDeadline()) return [];
 	let sliceStartedAt = performance.now();
-	for (const file of collectSecurityScanFiles(rootDirectory)) {
+	for (const file of collectSecurityScanFiles(rootDirectory, options.excludedDirectories)) {
+		throwIfScanAborted();
+		if (didReachDeadline()) return session.diagnostics;
 		if (file === null) {
 			if (performance.now() - sliceStartedAt >= 12) {
 				await yieldToEventLoop();
+				throwIfScanAborted();
+				if (didReachDeadline()) return session.diagnostics;
 				sliceStartedAt = performance.now();
 			}
 			continue;
 		}
 		for (const _ruleStep of session.scanFileByRule(file)) if (performance.now() - sliceStartedAt >= 12) {
 			await yieldToEventLoop();
+			throwIfScanAborted();
+			if (didReachDeadline()) return session.diagnostics;
 			sliceStartedAt = performance.now();
 		}
 	}
@@ -69013,25 +69359,18 @@ const collectIgnorePatterns = (rootDirectory) => {
 	cachedPatternsByRoot.set(rootDirectory, patterns);
 	return patterns;
 };
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const KNIP_JSON_FILENAME = "knip.json";
-const readJsonFileSafe = (filePath) => {
-	let rawContents;
-	try {
-		rawContents = fs.readFileSync(filePath, "utf-8");
-	} catch {
-		return null;
-	}
+const failOpenReadJson = (filePath, fallback) => {
 	try {
-		return JSON.parse(rawContents);
+		return JSON.parse(NFS.readFileSync(filePath, "utf8"));
 	} catch {
-		return null;
+		return fallback;
 	}
 };
+const KNIP_JSON_FILENAME = "knip.json";
 const readKnipConfig = (rootDirectory) => {
-	const knipJson = readJsonFileSafe(path.join(rootDirectory, KNIP_JSON_FILENAME));
+	const knipJson = failOpenReadJson(path.join(rootDirectory, KNIP_JSON_FILENAME), null);
 	if (isRecord(knipJson)) return knipJson;
-	const packageJson = readJsonFileSafe(path.join(rootDirectory, "package.json"));
+	const packageJson = failOpenReadJson(path.join(rootDirectory, "package.json"), null);
 	const packageKnipConfig = isRecord(packageJson) ? packageJson.knip : null;
 	return isRecord(packageKnipConfig) ? packageKnipConfig : null;
 };
@@ -69079,13 +69418,6 @@ const atomicWriteJson = (filePath, value) => {
 		return;
 	}
 };
-const failOpenReadJson = (filePath, fallback) => {
-	try {
-		return JSON.parse(NFS.readFileSync(filePath, "utf8"));
-	} catch {
-		return fallback;
-	}
-};
 const hashFileContents = (filePath) => {
 	try {
 		return crypto.createHash("sha1").update(NFS.readFileSync(filePath)).digest("hex");
@@ -69764,7 +70096,6 @@ const isDiagnosticOnSurface = (diagnostic, surface, config) => {
 	return true;
 };
 const filterDiagnosticsForSurface = (diagnostics, surface, config) => diagnostics.filter((diagnostic) => isDiagnosticOnSurface(diagnostic, surface, config));
-const remainingDeadlineBudgetMs = (deadlineEpochMs) => Math.max(deadlineEpochMs - Date.now(), 0);
 /**
 * Budget for the dead-code phase, scaled to the work. deslop's graph build is
 * CPU-bound and roughly linear in file count, so a fixed 120s cap is too tight
@@ -69772,25 +70103,28 @@ const remainingDeadlineBudgetMs = (deadlineEpochMs) => Math.max(deadlineEpochMs
 * tipped over by any concurrent load — silently dropping every dead-code
 * finding. Scaling the budget with file count (and inversely with the core
 * share when overlapped) lets the pass complete, while the ceiling still
-* reclaims a genuinely wedged worker. Returns the in-worker SIGKILL deadline
-* and the Effect-side phase backstop that sits a margin above it.
+* reclaims a genuinely wedged worker.
 */
 const resolveDeadCodeTimeout = (input) => {
 	const coreShareFactor = Math.max(1, input.fullConcurrency / Math.max(1, input.deadCodeConcurrency));
-	const workerTimeoutMs = Math.min(DEAD_CODE_TIMEOUT_CEILING_MS, Math.max(DEAD_CODE_WORKER_TIMEOUT_MS, Math.ceil(input.sourceFileCount * 30 * coreShareFactor)));
-	return {
-		workerTimeoutMs,
-		phaseTimeoutMs: workerTimeoutMs + DEAD_CODE_PHASE_TIMEOUT_OVER_WORKER_MS
-	};
+	return { workerTimeoutMs: Math.min(DEAD_CODE_TIMEOUT_CEILING_MS, Math.max(DEAD_CODE_WORKER_TIMEOUT_MS, Math.ceil(input.sourceFileCount * 30 * coreShareFactor))) };
 };
-const resolveLintIncludePaths = (rootDirectory, userConfig) => {
+const resolveLintIncludePaths = (rootDirectory, userConfig, sourceFiles) => {
 	if (!Array.isArray(userConfig?.ignore?.files) || userConfig.ignore.files.length === 0) return;
 	const ignoredPatterns = compileIgnoredFilePatterns(userConfig);
-	return listSourceFiles(rootDirectory).filter((filePath) => {
+	return (sourceFiles ?? listSourceFiles(rootDirectory)).filter((filePath) => {
 		if (!isLintableSourceFile(filePath)) return false;
 		return !isFileIgnoredByPatterns(filePath, rootDirectory, ignoredPatterns);
 	});
 };
+const filterPathsOutsideDirectories = (input) => {
+	const excludedPrefixes = input.excludedDirectories.map((excludedDirectory) => Path.resolve(excludedDirectory)).filter((excludedDirectory) => isPathInsideDirectory(excludedDirectory, input.rootDirectory)).map((excludedDirectory) => Path.relative(input.rootDirectory, excludedDirectory).replaceAll("\\", "/")).sort((left, right) => left.length - right.length).filter((candidatePrefix, index, prefixes) => !prefixes.slice(0, index).some((prefix) => candidatePrefix.startsWith(`${prefix}/`)));
+	if (excludedPrefixes.length === 0) return [...input.relativePaths];
+	return input.relativePaths.filter((relativePath) => {
+		const normalizedRelativePath = relativePath.replaceAll("\\", "/").replace(/^\.\//, "");
+		return !excludedPrefixes.some((excludedPrefix) => normalizedRelativePath === excludedPrefix || normalizedRelativePath.startsWith(`${excludedPrefix}/`));
+	});
+};
 var Config = class Config extends Service()("react-doctor/Config") {
 	static layerNode = effect(Config, gen(function* () {
 		const cache = yield* make$3({
@@ -69852,6 +70186,7 @@ var Files = class Files extends Service()("react-doctor/Files") {
 	static layerNode = succeed$3(Files, Files.of({
 		readLines: (input) => sync(() => createNodeReadFileLinesSync(input.rootDirectory)(input.filePath)),
 		listSourceFiles: (rootDirectory) => sync(() => listSourceFiles(rootDirectory)),
+		listSourceFilesCooperative: (input) => promise(() => listSourceFilesCooperative(input.rootDirectory, input.signal)),
 		isFile: (filePath) => sync(() => isFile(filePath)),
 		isDirectory: (filePath) => sync(() => isDirectory(filePath))
 	}));
@@ -69878,6 +70213,16 @@ var Files = class Files extends Service()("react-doctor/Files") {
 				}
 				return files;
 			}),
+			listSourceFilesCooperative: (input) => sync(() => {
+				const rootDirectory = input.rootDirectory;
+				const prefix = rootDirectory.endsWith("/") ? rootDirectory : `${rootDirectory}/`;
+				const files = [];
+				for (const absolute of tree.keys()) {
+					if (!absolute.startsWith(prefix)) continue;
+					files.push(absolute.slice(prefix.length));
+				}
+				return files;
+			}),
 			isFile: (filePath) => sync(() => tree.has(filePath)),
 			isDirectory: (filePath) => sync(() => {
 				const prefix = filePath.endsWith("/") ? filePath : `${filePath}/`;
@@ -70342,7 +70687,7 @@ var Git = class Git extends Service()("react-doctor/Git") {
 					changedFiles: yield* mergeUntracked(directory, splitNullSeparated(diff.stdout), includeUntracked),
 					isCurrentChanges: false
 				};
-			}).pipe(withSpan("Git.diffSelection")),
+			}).pipe(catchReasons("ReactDoctorError", { GitInvocationFailed: () => succeed$2(null) }, (_reason, error) => fail$4(error)), withSpan("Git.diffSelection")),
 			stagedFilePaths: (directory) => runGit(directory, [
 				"diff",
 				"--no-ext-diff",
@@ -70453,7 +70798,7 @@ const batchIncludePaths = (baseArgs, includePaths) => {
 	for (const filePath of includePaths) {
 		const entryLength = filePath.length + 1;
 		const exceedsArgLength = currentBatch.length > 0 && currentBatchLength + entryLength > 24e3;
-		const exceedsFileCount = currentBatch.length >= 100;
+		const exceedsFileCount = currentBatch.length >= 200;
 		if (exceedsArgLength || exceedsFileCount) {
 			batches.push(currentBatch);
 			currentBatch = [];
@@ -70800,7 +71145,7 @@ const buildUserPluginRules = (userPlugin, severityControls) => {
 	}
 	return enabled;
 };
-const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, extendsPaths = [], ignoredTags = /* @__PURE__ */ new Set(), includedTags = /* @__PURE__ */ new Set(), includeTagDefaults = false, runtimeGlobals, unpluginAutoImportGlobalScopes, serverAuthFunctionNames, severityControls, userPlugins = [], disableReactHooksJsPlugin = false, ruleSelection, sidecarRuleIdFilter }) => {
+const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, extendsPaths = [], ignoredTags = /* @__PURE__ */ new Set(), includedTags = /* @__PURE__ */ new Set(), includeTagDefaults = false, runtimeGlobals, unpluginAutoImportGlobalScopes, serverAuthFunctionNames, projectIndexModuleSources, severityControls, userPlugins = [], disableReactHooksJsPlugin = false, ruleSelection, sidecarRuleIdFilter }) => {
 	const hasIncludedTags = includedTags.size > 0;
 	const reactHooksJsPlugin = disableReactHooksJsPlugin || ruleSelection === "sidecar" || hasIncludedTags ? null : resolveReactHooksJsPlugin(project.hasReactCompiler || project.hasReactCompilerLintPlugin === true, customRulesOnly);
 	const reactCompilerRules = reactHooksJsPlugin ? applyRuleSeverityControls(filterRulesToAvailable(REACT_COMPILER_RULES, "react-hooks-js", reactHooksJsPlugin.availableRuleNames), severityControls) : {};
@@ -70864,7 +71209,8 @@ const createOxlintConfig = ({ pluginPath, project, customRulesOnly = false, exte
 				}))
 			} : {},
 			...project.shopifyFlashListMajorVersion !== null ? { shopifyFlashListMajorVersion: project.shopifyFlashListMajorVersion } : {},
-			...serverAuthFunctionNames && serverAuthFunctionNames.length > 0 ? { serverAuthFunctionNames: [...serverAuthFunctionNames] } : {}
+			...serverAuthFunctionNames && serverAuthFunctionNames.length > 0 ? { serverAuthFunctionNames: [...serverAuthFunctionNames] } : {},
+			...projectIndexModuleSources !== void 0 ? { projectIndexModuleSources: [...projectIndexModuleSources] } : {}
 		} },
 		rules: {
 			...reactCompilerRules,
@@ -71113,11 +71459,17 @@ const collectUnpluginAutoImportGlobalScopes = ({ rootDirectory, candidateFiles }
 	return scopes.some((scope) => scope.names.length > 0) ? scopes : [];
 };
 const validateDiagnostic$1 = decodeUnknownSync(Diagnostic);
+const decodeDiagnostic = (raw) => {
+	const diagnostic = validateDiagnostic$1(raw);
+	return {
+		...diagnostic,
+		relatedLocations: diagnostic.relatedLocations?.map((location) => ({ ...location }))
+	};
+};
 const decodeFileDiagnostics = (raw) => {
 	if (!Array.isArray(raw)) return null;
 	try {
-		for (const entry of raw) validateDiagnostic$1(entry);
-		return raw;
+		return raw.map((entry) => decodeDiagnostic(entry));
 	} catch {
 		return null;
 	}
@@ -72349,6 +72701,12 @@ const buildProfiledNodeArguments = (input) => [
 	...input.heapProfileDirectory ? ["--heap-prof", `--heap-prof-dir=${input.heapProfileDirectory}`] : [],
 	...input.argumentsList
 ];
+const lowerChildProcessPriority = (processId) => {
+	if (processId === void 0) return;
+	try {
+		OS.setPriority(processId, OS.constants.priority.PRIORITY_BELOW_NORMAL);
+	} catch {}
+};
 const SANITIZED_ENV = buildOxlintChildEnv(process.env);
 /**
 * Spawn one oxlint subprocess with hard ceilings on wall time and
@@ -72387,6 +72745,7 @@ const spawnOxlint = (args, rootDirectory, nodeBinaryPath, spawnTimeoutMs = OXLIN
 			"pipe"
 		]
 	});
+	lowerChildProcessPriority(child.pid);
 	const onAbort = () => {
 		child.kill("SIGKILL");
 		reject(new ReactDoctorError({ reason: new OxlintSpawnFailed({ cause: "lint phase aborted" }) }));
@@ -72509,7 +72868,7 @@ const isParallelismRelatedSpawnError = (error) => {
 * loop with a slimmer config in that case.
 */
 const spawnLintBatches = async (input) => {
-	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, sourcePathByLintPath, sourceMapByLintPath, onPartialFailure, onFileProgress, spawnTimeoutMs, outputMaxBytes, splitTotalBudgetMs = OXLINT_SPLIT_TOTAL_BUDGET_MS, splitMaxDepth = 8, signal, deadlineEpochMs } = input;
+	const { baseArgs, fileBatches, rootDirectory, nodeBinaryPath, project, sourcePathByLintPath, sourceMapByLintPath, onPartialFailure, onFileProgress, spawnTimeoutMs, outputMaxBytes, splitTotalBudgetMs = OXLINT_SPLIT_TOTAL_BUDGET_MS, splitMaxDepth = 9, signal, deadlineEpochMs } = input;
 	const resolveSourcePath = (filePath) => {
 		const absoluteFilePath = Path.isAbsolute(filePath) ? filePath : Path.resolve(rootDirectory, filePath);
 		return sourcePathByLintPath?.get(Path.normalize(absoluteFilePath)) ?? filePath;
@@ -72517,6 +72876,12 @@ const spawnLintBatches = async (input) => {
 	const requestedConcurrency = resolveScanConcurrency(input.concurrency ?? 1);
 	let rescueDeadlineEpochMs;
 	const isPastDeadline = () => deadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(deadlineEpochMs) === 0 || rescueDeadlineEpochMs !== void 0 && remainingDeadlineBudgetMs(rescueDeadlineEpochMs) === 0;
+	const resolveSpawnTimeoutMs = () => {
+		const deadlineBudgets = [deadlineEpochMs, rescueDeadlineEpochMs].filter((deadline) => deadline !== void 0).map(remainingDeadlineBudgetMs);
+		if (deadlineBudgets.length === 0) return spawnTimeoutMs;
+		const remainingDeadlineMs = Math.min(...deadlineBudgets);
+		return spawnTimeoutMs === void 0 ? remainingDeadlineMs : Math.min(spawnTimeoutMs, remainingDeadlineMs);
+	};
 	const runBatchPass = async (concurrency, passBatches, passOnFileProgress) => {
 		const totalFileCount = passBatches.reduce((sum, batch) => sum + batch.length, 0);
 		const allDiagnostics = [];
@@ -72534,12 +72899,13 @@ const spawnLintBatches = async (input) => {
 			const batchArgs = [...baseArgs, ...batch];
 			try {
 				const spawnBatch = () => {
-					if (isPastDeadline()) {
+					const effectiveSpawnTimeoutMs = resolveSpawnTimeoutMs();
+					if (effectiveSpawnTimeoutMs === 0) {
 						deadlineSkippedFiles.push(...batch);
 						batchState.deadlineSkippedFileCount += batch.length;
 						return Promise.resolve(null);
 					}
-					return spawnOxlint(batchArgs, rootDirectory, nodeBinaryPath, spawnTimeoutMs, outputMaxBytes, signal, () => {
+					return spawnOxlint(batchArgs, rootDirectory, nodeBinaryPath, effectiveSpawnTimeoutMs, outputMaxBytes, signal, () => {
 						if (batchState.didStart) return;
 						batchState.didStart = true;
 						startedFileCount += batchState.initialFileCount;
@@ -72694,11 +73060,36 @@ const validateRuleRegistration = () => {
 	].filter((entry) => entry !== null).join("; ");
 	console.warn(`[react-doctor] rule-registration drift: ${detail}`);
 };
+const PROJECT_INDEX_MODULE_SOURCES = [
+	"next/og",
+	"@vercel/og",
+	"satori",
+	"remotion"
+];
+const collectProjectIndexModuleSources = async (rootDirectory, candidateFiles) => {
+	const foundModuleSources = /* @__PURE__ */ new Set();
+	let sliceStartedAt = performance.now();
+	for (const candidateFile of candidateFiles) {
+		let sourceBuffer;
+		try {
+			sourceBuffer = NFS.readFileSync(Path.isAbsolute(candidateFile) ? candidateFile : Path.resolve(rootDirectory, candidateFile));
+		} catch {
+			continue;
+		}
+		for (const moduleSource of PROJECT_INDEX_MODULE_SOURCES) if (sourceBuffer.includes(`"${moduleSource}"`) || sourceBuffer.includes(`'${moduleSource}'`)) foundModuleSources.add(moduleSource);
+		if (foundModuleSources.size === PROJECT_INDEX_MODULE_SOURCES.length) break;
+		if (performance.now() - sliceStartedAt >= 12) {
+			await yieldToEventLoop();
+			sliceStartedAt = performance.now();
+		}
+	}
+	return [...foundModuleSources].sort();
+};
 /**
 * Balanced LPT (longest-processing-time-first) lint batch planner. Where
-* `batchIncludePaths` greedily fills 100-file batches and leaves a small
-* remainder batch (617 files → 6×100 + 17, so the parallel pool's wall clock
-* is set by whichever 100-file chunk happened to collect the most work while
+* `batchIncludePaths` greedily fills fixed-size batches and leaves a small
+* remainder batch, so the parallel pool's wall clock is set by whichever
+* full chunk happened to collect the most work while
 * the remainder's worker idles), this planner keeps the SAME mandatory batch
 * count — `ceil(files / OXLINT_MAX_FILES_PER_BATCH)`, the JS-plugin
 * perf-cliff / native-binding SIGABRT guard — and assigns files largest-first,
@@ -72727,7 +73118,7 @@ const validateRuleRegistration = () => {
 */
 const planLintBatches = ({ baseArgs, files, sizeByFile }) => {
 	if (files.length === 0) return [];
-	const batchCount = Math.ceil(files.length / 100);
+	const batchCount = Math.ceil(files.length / 200);
 	const maxFilesPerBatch = Math.ceil(files.length / batchCount);
 	const baseArgsLengthChars = estimateArgsLength(baseArgs);
 	const descendingSizeIndexes = [...files.keys()].sort((leftIndex, rightIndex) => (sizeByFile.get(files[rightIndex]) ?? 0) - (sizeByFile.get(files[leftIndex]) ?? 0));
@@ -73256,6 +73647,7 @@ const runOxlint = async (options) => {
 		await yieldToEventLoop();
 		const sizedScanFiles = includePaths === void 0 ? listSourceFilesWithSize(rootDirectory) : null;
 		const candidateFiles = includePaths !== void 0 ? includePaths : (sizedScanFiles ?? []).map((entry) => entry.path);
+		const projectIndexModuleSources = includePaths === void 0 && options.deadlineEpochMs === void 0 ? await collectProjectIndexModuleSources(rootDirectory, candidateFiles) : void 0;
 		unpluginAutoImportGlobalScopes = collectUnpluginAutoImportGlobalScopes({
 			rootDirectory,
 			candidateFiles
@@ -73278,6 +73670,7 @@ const runOxlint = async (options) => {
 			runtimeGlobals,
 			unpluginAutoImportGlobalScopes,
 			serverAuthFunctionNames,
+			projectIndexModuleSources,
 			severityControls,
 			userPlugins,
 			disableReactHooksJsPlugin: overrides.disableReactHooksJsPlugin,
@@ -73745,10 +74138,10 @@ const translateProjectInfoError = (cause, directory) => {
 	}) });
 };
 var Project = class Project extends Service()("react-doctor/Project") {
-	static layerNode = succeed$3(Project, Project.of({ discover: fn("Project.discover")(function* (directory) {
+	static layerNode = succeed$3(Project, Project.of({ discover: fn("Project.discover")(function* (input) {
 		return yield* try_({
-			try: () => discoverProject(directory),
-			catch: (cause) => translateProjectInfoError(cause, directory)
+			try: () => discoverProject(input.directory, { sourceFileCount: input.sourceFileCount }),
+			catch: (cause) => translateProjectInfoError(cause, input.directory)
 		});
 	}) }));
 	static layerOf = (projectInfo) => succeed$3(Project, Project.of({ discover: () => succeed$2(projectInfo) }));
@@ -74333,9 +74726,10 @@ const checkSupplyChain = (input) => gen(function* () {
 * outage.
 */
 var SupplyChain = class SupplyChain extends Service()("react-doctor/SupplyChain") {
-	static layerNode = succeed$3(SupplyChain, SupplyChain.of({ run: (input) => unwrap(flatMap$2(SupplyChainOverlapTimeoutMs, (totalTimeoutMs) => checkSupplyChain({
-		...input,
-		totalTimeoutMs
+	static layerNode = succeed$3(SupplyChain, SupplyChain.of({ run: (input) => unwrap(flatMap$2(SupplyChainOverlapTimeoutMs, (configuredTimeoutMs) => checkSupplyChain({
+		rootDirectory: input.rootDirectory,
+		userConfig: input.userConfig,
+		totalTimeoutMs: input.timeoutMs ?? configuredTimeoutMs
 	})).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)), withSpan("SupplyChain.run"))) }));
 	static layerOf = (diagnostics) => succeed$3(SupplyChain, SupplyChain.of({ run: () => fromIterable$1(diagnostics) }));
 };
@@ -74370,10 +74764,6 @@ const NO_HOOKS = {
 	beforeLint: () => void_,
 	afterLint: () => void_
 };
-const filterMapNullable = (transform) => fromPredicateOption((value) => {
-	const result = transform(value);
-	return result === null ? none() : some(result);
-});
 const fileReader = (filesService, rootDirectory) => (filePath) => {
 	const lines = runSync(filesService.readLines({
 		filePath,
@@ -74397,7 +74787,7 @@ const formatLintFailText = (reasonTag, nodeVersion) => {
 *      The GitHub viewer-permission lookup is forked onto a background
 *      fiber here and joined late (it feeds score metadata, not
 *      diagnostics).
-*   2. beforeLint hook (e.g. CLI renders the project-detection block)
+*   2. beforeLint hook (e.g. CLI records project telemetry)
 *   3. environment checks (reduced-motion + pnpm hardening +
 *      expo/react-native), collected synchronously. The heavier
 *      content-regex security scan is forked instead (like supply-chain
@@ -74410,13 +74800,11 @@ const formatLintFailText = (reasonTag, nodeVersion) => {
 *      `SupplyChainOverlapTimeoutMs` (measured from fork) so a hung
 *      socket can't drag out its join; on timeout it fails open to no
 *      diagnostics — the same outcome class as a Socket outage.
-*   5. Linter.run runs; DeadCode.run runs concurrently (forked child
-*      fiber) ONLY when the memory gate has headroom to run the 8 GB
-*      dead-code child alongside the oxlint workers — or when overlap is
-*      forced via REACT_DOCTOR_DEAD_CODE_OVERLAP. Otherwise dead-code
-*      runs sequentially after lint, exactly as it did pre-overlap. The
-*      fiber is joined (or interrupted, SIGKILLing its worker, on lint
-*      failure) before diagnostics are concatenated. The afterLint hook
+*   5. Linter.run runs; DeadCode.run forks only when
+*      REACT_DOCTOR_DEAD_CODE_OVERLAP=on. The default "auto" and explicit
+*      "off" paths stay sequential. The fiber is joined (or interrupted,
+*      SIGKILLing its worker, on lint failure) before diagnostics are
+*      concatenated. The afterLint hook
 *      fires between lint and dead-code. Progress spinner labels AND the
 *      final diagnostic / score order stay independent of execution
 *      order, so terminal output is identical either way; supply-chain
@@ -74451,8 +74839,28 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	const partialFailuresRef = yield* LintPartialFailures;
 	const resolvedConfig = yield* configService.resolve(input.directory);
 	const scanDirectory = resolvedConfig.resolvedDirectory;
-	const project = yield* projectService.discover(scanDirectory);
+	const excludedProjectDirectories = (input.excludedProjectDirectories ?? []).map((excludedDirectory) => Path.resolve(excludedDirectory)).filter((excludedDirectory) => isPathInsideDirectory(excludedDirectory, scanDirectory));
+	const excludedProjectRelativePaths = excludedProjectDirectories.map((excludedDirectory) => Path.relative(scanDirectory, excludedDirectory).replaceAll("\\", "/"));
+	const isExcludedProjectDiagnostic = (diagnostic) => {
+		const relativeFilePath = toNormalizedRelativePath(diagnostic.filePath, scanDirectory);
+		return excludedProjectRelativePaths.some((excludedRelativePath) => relativeFilePath === excludedRelativePath || relativeFilePath.startsWith(`${excludedRelativePath}/`));
+	};
+	const precomputedSourceFiles = input.suppressScanSummary === true || excludedProjectDirectories.length > 0 ? yield* filesService.listSourceFilesCooperative({
+		rootDirectory: scanDirectory,
+		signal: input.signal
+	}) : null;
+	const includedPrecomputedSourceFiles = precomputedSourceFiles !== null && excludedProjectDirectories.length > 0 ? filterPathsOutsideDirectories({
+		rootDirectory: scanDirectory,
+		relativePaths: precomputedSourceFiles,
+		excludedDirectories: excludedProjectDirectories
+	}) : precomputedSourceFiles;
+	const sourceFileCount = excludedProjectDirectories.length > 0 ? includedPrecomputedSourceFiles?.length : input.precomputedSourceFileCount ?? includedPrecomputedSourceFiles?.length;
+	const project = yield* projectService.discover({
+		directory: scanDirectory,
+		sourceFileCount
+	});
 	if (!isAnalyzableProject(project)) return yield* new ReactDoctorError({ reason: new NoReactDependency({ directory: scanDirectory }) });
+	const deadCodeSourceFileCount = input.retainExcludedProjectDeadCodeDiagnostics === true && precomputedSourceFiles !== null ? precomputedSourceFiles.length : project.sourceFileCount;
 	const [repo, sha, defaultBranch] = yield* all([
 		gitService.githubRepo(scanDirectory).pipe(orElseSucceed(() => null)),
 		gitService.headSha(scanDirectory).pipe(orElseSucceed(() => null)),
@@ -74463,11 +74871,16 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		directory: scanDirectory,
 		repo
 	}).pipe(orElseSucceed(() => null)) : succeed$2(null));
-	const lintIncludePaths = (input.skipExplicitIncludePathFilter ? input.includePaths.length > 0 ? [...input.includePaths] : void 0 : computeExplicitLintIncludePaths([...input.includePaths])) ?? resolveLintIncludePaths(scanDirectory, resolvedConfig.config);
-	const fallbackScannedFilePaths = input.suppressScanSummary ? (lintIncludePaths ?? (yield* filesService.listSourceFiles(scanDirectory))).map((relativePath) => Path.resolve(scanDirectory, relativePath)) : [];
+	let lintIncludePaths = (input.skipExplicitIncludePathFilter ? input.includePaths.length > 0 ? [...input.includePaths] : void 0 : computeExplicitLintIncludePaths([...input.includePaths])) ?? resolveLintIncludePaths(scanDirectory, resolvedConfig.config, includedPrecomputedSourceFiles ?? void 0);
+	if (excludedProjectDirectories.length > 0) lintIncludePaths = filterPathsOutsideDirectories({
+		rootDirectory: scanDirectory,
+		relativePaths: lintIncludePaths ?? includedPrecomputedSourceFiles ?? (yield* filesService.listSourceFiles(scanDirectory)),
+		excludedDirectories: excludedProjectDirectories
+	});
+	const fallbackScannedFilePaths = input.suppressScanSummary ? (lintIncludePaths ?? includedPrecomputedSourceFiles ?? (yield* filesService.listSourceFiles(scanDirectory))).map((relativePath) => Path.resolve(scanDirectory, relativePath)) : [];
 	const beforeLint = hooks.beforeLint ?? NO_HOOKS.beforeLint;
 	const afterLint = hooks.afterLint ?? NO_HOOKS.afterLint;
-	yield* beforeLint(project, lintIncludePaths ?? void 0);
+	yield* beforeLint(project);
 	const isDiffMode = input.includePaths.length > 0;
 	const showWarnings = input.warnings ?? resolvedConfig.config?.warnings ?? true;
 	const transform = buildDiagnosticPipeline({
@@ -74477,7 +74890,10 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		respectInlineDisables: input.respectInlineDisables,
 		showWarnings
 	});
-	const filterPerElementPipeline = (rawStream) => rawStream.pipe(filterMap(filterMapNullable(transform.apply)));
+	const filterPerElementPipeline = (rawStream) => rawStream.pipe(filterMap(fromPredicateOption((diagnostic) => {
+		const filteredDiagnostic = transform.apply(diagnostic);
+		return filteredDiagnostic === null ? none() : some(filteredDiagnostic);
+	})));
 	const applyPerElementPipeline = (rawStream) => filterPerElementPipeline(rawStream).pipe(tap((diagnostic) => reporterService.emit(diagnostic)));
 	const envCollected = yield* runCollect(applyPerElementPipeline(fromIterable$1(isDiffMode ? [] : [
 		...checkReducedMotion(scanDirectory),
@@ -74487,17 +74903,31 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		...checkReactNativeProject(scanDirectory, project)
 	])));
 	const securityScanFailedRef = yield* make$13(false);
-	const securityScanFiber = yield* forkChild(runCollect(applyPerElementPipeline(isDiffMode ? empty$4 : unwrap(tryPromise(() => checkSecurityScanCooperative(scanDirectory, {
+	let didSecurityScanReachDeadline = false;
+	const securityScanFiber = yield* forkChild(runCollect(applyPerElementPipeline(isDiffMode ? empty$4 : unwrap(tryPromise((signal) => checkSecurityScanCooperative(scanDirectory, {
 		project,
 		ignoredTags: input.ignoredTags,
 		includedTags: input.includedTags,
-		includeTagDefaults: input.includeTagDefaults
+		includeTagDefaults: input.includeTagDefaults,
+		excludedDirectories: new Set(excludedProjectDirectories),
+		deadlineEpochMs: input.deadlineEpochMs,
+		signal,
+		onDeadlineExceeded: () => {
+			didSecurityScanReachDeadline = true;
+		}
 	})).pipe(map$3((diagnostics) => fromIterable$1(diagnostics)), catch_$1(() => set(securityScanFailedRef, true).pipe(as(empty$4))))))).pipe(withSpan("SecurityScan.run")));
+	const capToDeadline = (phaseTimeoutMs) => input.deadlineEpochMs === void 0 ? phaseTimeoutMs : Math.min(phaseTimeoutMs, remainingDeadlineBudgetMs(input.deadlineEpochMs));
+	const capOptionalToDeadline = (phaseTimeoutMs) => {
+		if (input.deadlineEpochMs === void 0) return phaseTimeoutMs;
+		const remainingBudgetMs = remainingDeadlineBudgetMs(input.deadlineEpochMs);
+		return phaseTimeoutMs === null ? remainingBudgetMs : Math.min(phaseTimeoutMs, remainingBudgetMs);
+	};
 	const shouldRunSupplyChain = !isDiffMode || (input.supplyChainManifestChanged ?? false);
-	const supplyChainOverlapTimeout = yield* SupplyChainOverlapTimeoutMs;
+	const supplyChainOverlapTimeout = capToDeadline(yield* SupplyChainOverlapTimeoutMs);
 	const supplyChainFiber = yield* forkChild(shouldRunSupplyChain ? runCollect(applyPerElementPipeline(supplyChainService.run({
 		rootDirectory: scanDirectory,
-		userConfig: resolvedConfig.config
+		userConfig: resolvedConfig.config,
+		timeoutMs: supplyChainOverlapTimeout
 	}))).pipe(map$3((diagnostics) => ({
 		diagnostics,
 		timedOut: false
@@ -74521,46 +74951,49 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	const scanConcurrency = resolveScanConcurrency(yield* OxlintConcurrency);
 	const lintPhaseTimeoutMs = yield* LintPhaseTimeoutMs;
 	const deadCodePhaseTimeoutMs = yield* DeadCodePhaseTimeoutMs;
-	const resolveDeadCodePhaseTimeoutMs = (scaledPhaseTimeoutMs) => deadCodePhaseTimeoutMs === 15e4 ? scaledPhaseTimeoutMs : deadCodePhaseTimeoutMs;
 	const workerCountSuffix = scanConcurrency > 1 ? ` ${highlighter.dim(`[~${scanConcurrency} workers]`)}` : "";
-	const capToDeadline = (phaseTimeoutMs) => input.deadlineEpochMs === void 0 ? phaseTimeoutMs : Math.min(phaseTimeoutMs, remainingDeadlineBudgetMs(input.deadlineEpochMs));
 	const shouldRunDeadCode = input.runDeadCode && !isDiffMode && (showWarnings || deadCodeMaySurfaceWhenWarningsHidden(resolvedConfig.config));
 	const deadCodeOverlapMode = yield* DeadCodeOverlap;
 	const shouldOverlapDeadCode = shouldRunDeadCode && deadCodeOverlapMode === "on";
 	const deadCodeParseConcurrency = shouldOverlapDeadCode ? Math.max(1, Math.floor(scanConcurrency * DEAD_CODE_OVERLAP_PARSE_SHARE)) : void 0;
 	const lintConcurrency = deadCodeParseConcurrency === void 0 ? scanConcurrency : Math.max(1, scanConcurrency - deadCodeParseConcurrency);
-	const buildCollectDeadCode = (deadCodeTimeout) => runCollect(applyPerElementPipeline(deadCodeService.run({
-		rootDirectory: scanDirectory,
-		parseConcurrency: deadCodeParseConcurrency,
-		workerTimeoutMs: deadCodeTimeout.workerTimeoutMs,
-		onCacheOutcome: (didHitCache) => {
-			deadCodeCacheHit = didHitCache;
-		},
-		onSummaryCacheStats: (stats) => {
-			deadCodeSummaryCacheHits = stats.hits;
-			deadCodeSummaryCacheMisses = stats.misses;
-		}
-	}).pipe(catchTag("ReactDoctorError", (error) => unwrap(gen(function* () {
-		yield* set(deadCodeFailure, {
-			didFail: true,
-			reason: error.message
-		});
-		return empty$4;
-	})))))).pipe(timeoutOption(deadCodeTimeout.phaseTimeoutMs), flatMap$2(match$3({
-		onNone: () => set(deadCodeFailure, {
-			didFail: true,
-			reason: `Dead-code analysis exceeded ${Math.round(deadCodeTimeout.phaseTimeoutMs / MILLISECONDS_PER_SECOND)}s and was skipped.`
-		}).pipe(as([])),
-		onSome: succeed$2
-	})));
+	const buildCollectDeadCode = (deadCodeTimeout) => {
+		const collectDeadCode = runCollect(applyPerElementPipeline(deadCodeService.run({
+			rootDirectory: scanDirectory,
+			parseConcurrency: deadCodeParseConcurrency,
+			workerTimeoutMs: deadCodeTimeout.workerTimeoutMs,
+			onCacheOutcome: (didHitCache) => {
+				deadCodeCacheHit = didHitCache;
+			},
+			onSummaryCacheStats: (stats) => {
+				deadCodeSummaryCacheHits = stats.hits;
+				deadCodeSummaryCacheMisses = stats.misses;
+			}
+		}).pipe(filter((diagnostic) => input.retainExcludedProjectDeadCodeDiagnostics === true || !isExcludedProjectDiagnostic(diagnostic)), catchTag("ReactDoctorError", (error) => unwrap(gen(function* () {
+			yield* set(deadCodeFailure, {
+				didFail: true,
+				reason: error.message
+			});
+			return empty$4;
+		}))))));
+		const phaseTimeoutMs = deadCodeTimeout.phaseTimeoutMs;
+		if (phaseTimeoutMs === null) return collectDeadCode;
+		return collectDeadCode.pipe(timeoutOption(phaseTimeoutMs), flatMap$2(match$3({
+			onNone: () => set(deadCodeFailure, {
+				didFail: true,
+				reason: `Dead-code analysis exceeded ${Math.round(phaseTimeoutMs / MILLISECONDS_PER_SECOND)}s and was skipped.`
+			}).pipe(as([])),
+			onSome: succeed$2
+		})));
+	};
 	const overlapDeadCodeTimeout = resolveDeadCodeTimeout({
-		sourceFileCount: project.sourceFileCount,
+		sourceFileCount: deadCodeSourceFileCount,
 		deadCodeConcurrency: deadCodeParseConcurrency ?? scanConcurrency,
 		fullConcurrency: scanConcurrency
 	});
 	const deadCodeFiber = shouldOverlapDeadCode ? yield* forkChild(buildCollectDeadCode({
 		workerTimeoutMs: overlapDeadCodeTimeout.workerTimeoutMs,
-		phaseTimeoutMs: capToDeadline(resolveDeadCodePhaseTimeoutMs(overlapDeadCodeTimeout.phaseTimeoutMs))
+		phaseTimeoutMs: capOptionalToDeadline(deadCodePhaseTimeoutMs)
 	})) : null;
 	const scanProgress = yield* progressService.start("Scanning...");
 	const scanStartTime = Date.now();
@@ -74611,7 +75044,8 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		});
 		return empty$4;
 	}))));
-	const lintCollected = dedupeRelatedDiagnostics(yield* runCollect(filterPerElementPipeline(shouldOverlapDeadCode ? baseLintStream.pipe(provideService(OxlintConcurrency, lintConcurrency)) : baseLintStream)).pipe(timeoutOption(lintPhaseTimeoutMs), flatMap$2(match$3({
+	const collectLintDiagnostics = runCollect(filterPerElementPipeline(shouldOverlapDeadCode ? baseLintStream.pipe(provideService(OxlintConcurrency, lintConcurrency)) : baseLintStream));
+	const lintCollected = dedupeRelatedDiagnostics(yield* lintPhaseTimeoutMs === null ? collectLintDiagnostics : collectLintDiagnostics.pipe(timeoutOption(lintPhaseTimeoutMs), flatMap$2(match$3({
 		onNone: () => set(lintFailure, {
 			didFail: true,
 			reason: `Lint analysis exceeded ${lintPhaseTimeoutMs / MILLISECONDS_PER_SECOND}s and was skipped.`,
@@ -74641,13 +75075,13 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	} else {
 		yield* scanProgress.update(`Scanned ${scannedFilesLabel}, analyzing dead code...`);
 		const sequentialDeadCodeTimeout = resolveDeadCodeTimeout({
-			sourceFileCount: totalFileCount,
+			sourceFileCount: input.retainExcludedProjectDeadCodeDiagnostics === true ? deadCodeSourceFileCount : totalFileCount,
 			deadCodeConcurrency: scanConcurrency,
 			fullConcurrency: scanConcurrency
 		});
 		deadCodeCollected = deadCodeFiber !== null ? yield* join(deadCodeFiber) : yield* buildCollectDeadCode({
 			workerTimeoutMs: sequentialDeadCodeTimeout.workerTimeoutMs,
-			phaseTimeoutMs: capToDeadline(resolveDeadCodePhaseTimeoutMs(sequentialDeadCodeTimeout.phaseTimeoutMs))
+			phaseTimeoutMs: capOptionalToDeadline(deadCodePhaseTimeoutMs)
 		});
 	}
 	const deadCodeFailureState = lintFailureState.didFail ? {
@@ -74691,7 +75125,11 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		metadata: scoreMetadata
 	});
 	const lintPartialFailures = yield* get$2(partialFailuresRef);
-	const securityScanFailed = yield* get$2(securityScanFailedRef);
+	const didSecurityScanFail = yield* get$2(securityScanFailedRef);
+	const securityScanFailed = didSecurityScanFail || didSecurityScanReachDeadline;
+	let securityScanFailureReason = null;
+	if (didSecurityScanReachDeadline) securityScanFailureReason = "Security scan reached the max scan duration; findings collected before the deadline were preserved.";
+	else if (didSecurityScanFail) securityScanFailureReason = "Security scan failed and was skipped.";
 	return {
 		project,
 		userConfig: resolvedConfig.config,
@@ -74714,6 +75152,7 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 		scanConcurrency,
 		supplyChainOverlapTimedOut: supplyChainResult.timedOut,
 		securityScanFailed,
+		securityScanFailureReason,
 		lintCacheHitFileCount,
 		lintCacheTotalFileCount,
 		lintSidecarReplayedFileCount,
@@ -74729,7 +75168,10 @@ const runInspect = (input, hooks = {}) => gen(function* () {
 	"inspect.runDeadCode": input.runDeadCode,
 	"inspect.isCi": input.isCi,
 	"inspect.scoreSurface": input.scoreSurface ?? "score"
-} }), (scanProgram) => flatMap$2(ScanDeadlineMs, (scanDeadlineMs) => scanProgram.pipe(timeout(scanDeadlineMs), catchTag$1("TimeoutError", () => new ReactDoctorError({ reason: new ScanDeadlineExceeded({ detail: `${scanDeadlineMs / MILLISECONDS_PER_SECOND}s elapsed` }) })))));
+} }), (scanProgram) => flatMap$2(ScanDeadlineMs, (scanDeadlineMs) => {
+	if (scanDeadlineMs === null) return scanProgram;
+	return scanProgram.pipe(timeout(scanDeadlineMs), catchTag$1("TimeoutError", () => new ReactDoctorError({ reason: new ScanDeadlineExceeded({ detail: `${scanDeadlineMs / MILLISECONDS_PER_SECOND}s elapsed` }) })));
+}));
 const parseNodeVersion = (versionString) => {
 	const [major = 0, minor = 0, patch = 0] = versionString.replace(/^v/, "").trim().split(".").map(Number);
 	return {
@@ -74830,16 +75272,6 @@ const resolveNodeForOxlint = () => {
 	});
 });
 /**
-* Zip-Slip defense: relative paths come from git (`diff --name-only`), which
-* normalizes during ordinary adds, but a crafted index/pack/symlinked tree can
-* smuggle `..` segments that escape the temp root. Resolve against the temp dir
-* and reject anything that lands outside before writing.
-*/
-const isPathInsideDirectory = (childAbsolutePath, parentAbsolutePath) => {
-	const relative = path.relative(parentAbsolutePath, childAbsolutePath);
-	return Boolean(relative) && !relative.startsWith("..") && !path.isAbsolute(relative);
-};
-/**
 * Writes a set of source files (supplied by `readContent` — e.g.
 * `git show <ref>:<path>` for a baseline tree, or `git show :<path>` for the
 * index) into a temp tree that mirrors the project layout, copying the
@@ -74875,7 +75307,7 @@ const materializeSourceTree = (input) => gen(function* () {
 			const sourcePath = path.join(input.directory, subdirectory, configFilename);
 			const targetPath = path.resolve(resolvedTempDirectory, subdirectory, configFilename);
 			if (!isPathInsideDirectory(targetPath, resolvedTempDirectory)) continue;
-			if (fs.existsSync(sourcePath) && !fs.existsSync(targetPath)) {
+			if (isFile(sourcePath) && !fs.existsSync(targetPath)) {
 				fs.mkdirSync(path.dirname(targetPath), { recursive: true });
 				fs.cpSync(sourcePath, targetPath);
 			}
@@ -75016,14 +75448,6 @@ const runEditorScan = async (input) => {
 		error: messageFromUnknown(error)
 	};
 };
-/**
-* Back-compat alias: the streaming pipeline holds its caches in
-* per-pipeline closures that are garbage-collected when the pipeline
-* goes out of scope, so there is nothing to clear at module scope. The
-* public CLI's `clearCaches()` still calls this for symmetry with the
-* other `clear*` helpers.
-*/
-const clearAutoSuppressionCaches = () => {};
 const lookupOwnRule = (rule) => Object.hasOwn(REACT_DOCTOR_RULE_REGISTRY, rule) ? REACT_DOCTOR_RULE_REGISTRY[rule] : void 0;
 /**
 * Returns presentation metadata for `<plugin>/<rule>`, or `null` when the
@@ -75063,7 +75487,7 @@ const computeConfigFingerprint = (projectDirectory, version) => {
 /** Display name used in client-facing messages and progress titles. */
 const SERVER_DISPLAY_NAME = "React Doctor";
 /** Server version reported in `serverInfo`; injected at build, `dev` from source. */
-const SERVER_VERSION = "0.9.3";
+const SERVER_VERSION = "0.9.4";
 /** `Diagnostic.source` shown next to every published diagnostic. */
 const DIAGNOSTIC_SOURCE = "react-doctor";
 /**
@@ -75691,10 +76115,7 @@ const createProjectGraph = (options) => {
 		for (const root of roots) try {
 			for (const workspacePackage of discoverReactSubprojects(root)) {
 				const directory = normalizeDirectory(workspacePackage.directory);
-				if (!seen.has(directory)) seen.set(directory, {
-					directory,
-					name: workspacePackage.name
-				});
+				if (!seen.has(directory)) seen.set(directory, { directory });
 			}
 		} catch (error) {
 			logger.warn(`Project discovery failed for ${root}: ${messageFromUnknown(error)}`);
@@ -75719,8 +76140,8 @@ const createProjectGraph = (options) => {
 			clearProjectCache();
 			clearConfigCache();
 			clearPackageJsonCache();
+			clearPackageRoleCache();
 			clearIgnorePatternsCache();
-			clearAutoSuppressionCaches();
 			clearMinifiedFileCache();
 			projects = null;
 		}
@@ -76116,11 +76537,9 @@ const createScheduler = (options) => {
 		timers.clear();
 		queue.length = 0;
 	};
-	const pendingCount = () => queue.length + running + timers.size;
 	return {
 		enqueue,
 		cancelProject,
-		pendingCount,
 		dispose
 	};
 };
@@ -76767,8 +77186,11 @@ const METRIC = {
 	scanPhaseDuration: "scan.phase_duration",
 	scanFiles: "scan.files",
 	scanScore: "scan.score",
+	scanScoreRetry: "scan.score_retry",
 	scanClean: "scan.clean",
 	scanCheckSkipped: "scan.check_skipped",
+	scanProjectSkipped: "scan.project_skipped",
+	scanWorkspaceDeadCodeShared: "scan.workspace_deadcode_shared",
 	scanNoReactDetected: "scan.no_react_detected",
 	baselineDegraded: "baseline.degraded",
 	ruleFired: "rule.fired",
@@ -76795,9 +77217,14 @@ const METRIC = {
 	lspScanCompleted: "lsp.scan.completed",
 	lspScanDuration: "lsp.scan.duration",
 	lspScanDiagnostics: "lsp.scan.diagnostics",
-	tuiActionMenuOpened: "tui.action_menu_opened",
 	tuiCompactReportShown: "tui.compact_report_shown",
 	tuiFindingNavigated: "tui.finding_navigated",
+	tuiIssueStreamShown: "tui.issue_stream_shown",
+	tuiProjectPathContextShown: "tui.project_path_context_shown",
+	tuiProjectSelectInlineShown: "tui.project_select_inline_shown",
+	tuiReportActionSelected: "tui.report_action_selected",
+	tuiCancelled: "tui.cancelled",
+	tuiScanInlineShown: "tui.scan_inline_shown",
 	tuiStackedReportCapped: "tui.stacked_report_capped",
 	aiTrainingWarningShown: "ai.training.warning_shown",
 	jsonOutUsed: "json.out_used"
@@ -76812,6 +77239,9 @@ const METRIC = {
 */
 const toCategoryKey = (category) => category.toLowerCase().replace(/[^a-z0-9]+/g, "_");
 //#endregion
+//#region src/cli/utils/is-env-flag-enabled.ts
+const isEnvFlagEnabled = (value) => value === "1" || value?.toLowerCase() === "true";
+//#endregion
 //#region src/cli/utils/anonymize-text.ts
 /**
 * Free-text fields can carry both a home-directory path (the OS username) and a
@@ -76972,7 +77402,6 @@ const resolveTracesSampleRate = () => {
 * session.
 */
 let lspTracesSampleRate = 0;
-const isEnvFlagEnabled = (value) => value === "1" || value?.toLowerCase() === "true";
 const nodeMajorVersion = () => Number.parseInt(process.versions.node.split(".", 1)[0] ?? "", 10) || 0;
 const shouldEnableLspTelemetry = () => {
 	if (isEnvFlagEnabled(process.env.REACT_DOCTOR_NO_TELEMETRY)) return false;
@@ -77100,5 +77529,5 @@ const startLanguageServer = () => {
 };
 //#endregion
 export { startLanguageServer };
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a07beba2-2d2e-59f0-8edb-430554d791d1")}catch(e){}}();
-//# debugId=a07beba2-2d2e-59f0-8edb-430554d791d1
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2d26cd21-f7f6-5e65-9c29-fabf32208583")}catch(e){}}();
+//# debugId=2d26cd21-f7f6-5e65-9c29-fabf32208583