react-native-doctor-ci 0.1.0

package/dist/cli.js

@@ -0,0 +1,1654 @@
+#!/usr/bin/env node
+
+// src/cli-main.ts
+import { join as join4 } from "path";
+import { parseArgs } from "util";
+
+// src/changed-deps.ts
+function diffDependencies(base, current) {
+  if (base === null) return current.map((entry) => entry.name);
+  const baseSpecs = new Map(base.map((entry) => [entry.name, entry.spec]));
+  return current.filter((entry) => baseSpecs.get(entry.name) !== entry.spec).map((entry) => entry.name);
+}
+
+// src/cache.ts
+import * as fs from "fs";
+import * as path from "path";
+var CACHE_VERSION = 1;
+var TTL_MS = 24 * 60 * 60 * 1e3;
+function isDegraded(entry) {
+  const transientReasons = /* @__PURE__ */ new Set([
+    "github-rate-limited",
+    "github-error",
+    "npm-lookup-failed"
+  ]);
+  const dep = entry.enriched;
+  const signals = [
+    dep.npm.deprecated,
+    dep.npm.hasCodegenConfig,
+    dep.npm.hasReactNativePeerDep,
+    dep.npm.hasNativeDirsHint,
+    dep.github.archived,
+    dep.github.pushedAt,
+    dep.lastPublish
+  ];
+  return signals.some((s) => !s.known && transientReasons.has(s.reason));
+}
+async function readCacheFile(cacheDir) {
+  const cacheFile = path.join(cacheDir, ".rn-doctor-cache.json");
+  try {
+    const content = await fs.promises.readFile(cacheFile, "utf-8");
+    const parsed = JSON.parse(content);
+    if (parsed.version !== CACHE_VERSION) {
+      return { version: CACHE_VERSION, entries: {} };
+    }
+    return parsed;
+  } catch {
+    return { version: CACHE_VERSION, entries: {} };
+  }
+}
+async function writeCacheFile(cacheDir, cache) {
+  const cacheFile = path.join(cacheDir, ".rn-doctor-cache.json");
+  await fs.promises.writeFile(cacheFile, JSON.stringify(cache, null, 2), "utf-8");
+}
+function getFreshEntry(cache, packageName, now = /* @__PURE__ */ new Date()) {
+  const entry = cache.entries[packageName];
+  if (!entry) {
+    return void 0;
+  }
+  const age = now.getTime() - new Date(entry.fetchedAt).getTime();
+  if (age >= TTL_MS || isDegraded(entry)) {
+    return void 0;
+  }
+  return entry;
+}
+function putEntry(cache, entry) {
+  return {
+    version: CACHE_VERSION,
+    entries: {
+      ...cache.entries,
+      [entry.enriched.name]: entry
+    }
+  };
+}
+function isEntryDegraded(entry) {
+  return isDegraded(entry);
+}
+
+// src/concurrency.ts
+async function mapWithConcurrency(items, fn, concurrency = 8) {
+  if (items.length === 0) {
+    return [];
+  }
+  const results = Array.from({ length: items.length });
+  let index = 0;
+  const worker = async () => {
+    let currentIndex = index++;
+    while (currentIndex < items.length) {
+      results[currentIndex] = await fn(items[currentIndex]);
+      currentIndex = index++;
+    }
+  };
+  const workers = Array(Math.min(concurrency, items.length)).fill(null).map(() => worker());
+  await Promise.all(workers);
+  return results;
+}
+
+// src/http.ts
+async function fetchJson(url, options = {}) {
+  const controller = new AbortController();
+  const timeoutMs = options.timeout ?? 1e4;
+  const timeoutHandle = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(url, {
+      headers: {
+        "user-agent": "rn-doctor/0.0.0",
+        ...options.headers
+      },
+      signal: controller.signal
+    });
+    clearTimeout(timeoutHandle);
+    if (response.status === 404) {
+      return { status: "not-found" };
+    }
+    if (response.status === 403 || response.status === 429) {
+      return { status: "rate-limited" };
+    }
+    if (!response.ok) {
+      return { status: "error", message: `HTTP ${response.status}` };
+    }
+    const data = await response.json();
+    return { status: "ok", data };
+  } catch (err) {
+    clearTimeout(timeoutHandle);
+    if (err instanceof Error && err.name === "AbortError") {
+      return { status: "error", message: "Request timeout" };
+    }
+    if (err instanceof SyntaxError) {
+      return { status: "error", message: "Invalid JSON response" };
+    }
+    return {
+      status: "error",
+      message: err instanceof Error ? err.message : "Unknown error"
+    };
+  }
+}
+
+// src/sources/directory.ts
+async function checkLibraries(packageNames) {
+  if (packageNames.length === 0) {
+    return { status: "ok", data: {} };
+  }
+  const chunks = [];
+  for (let i = 0; i < packageNames.length; i += 200) {
+    chunks.push(Array.from(packageNames.slice(i, i + 200)));
+  }
+  const results = {};
+  for (const chunk of chunks) {
+    const url = new URL("https://reactnative.directory/api/libraries/check");
+    url.searchParams.set("packages", chunk.join(","));
+    const outcome = await fetchJson(url.toString());
+    if (outcome.status !== "ok") {
+      return outcome;
+    }
+    Object.assign(results, outcome.data);
+  }
+  return { status: "ok", data: results };
+}
+async function fetchLibraryDetail(packageName) {
+  const url = new URL("https://reactnative.directory/api/library");
+  url.searchParams.set("name", packageName);
+  const outcome = await fetchJson(url.toString());
+  if (outcome.status !== "ok") {
+    return outcome;
+  }
+  if (Object.keys(outcome.data).length === 0) {
+    return { status: "ok", data: {} };
+  }
+  return outcome;
+}
+async function fetchLibraryDetails(packageNames, concurrency = 8) {
+  const outcomes = await mapWithConcurrency(
+    packageNames,
+    (name) => fetchLibraryDetail(name),
+    concurrency
+  );
+  const results = {};
+  for (let i = 0; i < outcomes.length; i++) {
+    const outcome = outcomes[i];
+    if (outcome?.status === "ok") {
+      results[packageNames[i]] = outcome.data;
+    }
+  }
+  return results;
+}
+
+// src/sources/npm.ts
+async function fetchNpmLatestManifest(packageName) {
+  const encoded = encodeURIComponent(packageName);
+  const url = `https://registry.npmjs.org/${encoded}/latest`;
+  return fetchJson(url);
+}
+async function searchNpmForPackage(packageName) {
+  const url = new URL("https://registry.npmjs.org/-/v1/search");
+  url.searchParams.set("text", packageName);
+  url.searchParams.set("size", "1");
+  const outcome = await fetchJson(url.toString());
+  if (outcome.status !== "ok") {
+    return outcome;
+  }
+  const topResult = outcome.data.objects?.[0];
+  if (!topResult) {
+    return { status: "error", message: "No search results" };
+  }
+  return {
+    status: "ok",
+    data: {
+      name: topResult.package.name,
+      date: topResult.package.date
+    }
+  };
+}
+function parseGithubUrl(repoUrl) {
+  if (!repoUrl) {
+    return void 0;
+  }
+  const match = repoUrl.match(/github\.com[/:]([\w.-]+)\/([\w.-]+?)(?:\.git)?$/i);
+  if (!match || !match[1] || !match[2]) {
+    return void 0;
+  }
+  return { owner: match[1], repo: match[2] };
+}
+
+// src/sources/github.ts
+var GitHubCircuitBreaker = class {
+  tripped = false;
+  /**
+   * Check if the circuit breaker is currently tripped.
+   */
+  isTripped() {
+    return this.tripped;
+  }
+  /**
+   * Trip the circuit breaker (call this on a 403/429 response).
+   */
+  trip() {
+    this.tripped = true;
+  }
+};
+async function fetchGithubRepo(owner, repo, token) {
+  const url = `https://api.github.com/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`;
+  const headers = {};
+  if (token) {
+    headers["authorization"] = `Bearer ${token}`;
+  }
+  return fetchJson(url, { headers });
+}
+function parseGithubUrl2(url) {
+  if (!url) {
+    return void 0;
+  }
+  const match = url.match(
+    /(?:https:\/\/github\.com|git@github\.com:)\/?([^/]+)\/([^/.]+)(?:\.git|\/|$)/i
+  );
+  if (!match || !match[1] || !match[2]) {
+    return void 0;
+  }
+  return { owner: match[1], repo: match[2] };
+}
+
+// src/enrich.ts
+function computeNewArchTier(dep) {
+  const { directoryVerdict, hasCodegenConfig } = dep;
+  if (directoryVerdict === "supported" || directoryVerdict === "new-arch-only") {
+    return "supported";
+  }
+  if (directoryVerdict === "unsupported") {
+    return "unsupported";
+  }
+  if (hasCodegenConfig.known && hasCodegenConfig.value) {
+    return "passWithNote";
+  }
+  return "unknown";
+}
+async function enrichDependencies(names, options = {}) {
+  const cacheDir = options.cacheDir || process.cwd();
+  const concurrency = options.concurrency ?? 8;
+  const githubToken = options.githubToken || process.env.GITHUB_TOKEN;
+  const warnings = [];
+  const enriched = [];
+  let cache = { version: 1, entries: {} };
+  if (!options.noCache) {
+    try {
+      cache = await readCacheFile(cacheDir);
+    } catch {
+      warnings.push({
+        source: "cache",
+        message: "Failed to read cache file; proceeding without cache"
+      });
+    }
+  }
+  const cached = [];
+  const toFetch = [];
+  for (const name of names) {
+    const entry = options.noCache ? void 0 : getFreshEntry(cache, name);
+    if (entry) {
+      cached.push(entry.enriched);
+    } else {
+      toFetch.push(name);
+    }
+  }
+  enriched.push(...cached);
+  if (toFetch.length === 0) {
+    return { dependencies: enriched, warnings };
+  }
+  const directoryCheckOutcome = await checkLibraries(toFetch);
+  const directoryCheckData = directoryCheckOutcome.status === "ok" ? directoryCheckOutcome.data : {};
+  if (directoryCheckOutcome.status === "error") {
+    warnings.push({
+      source: "directory",
+      message: `Failed to check RN Directory: ${directoryCheckOutcome.message}`
+    });
+  }
+  const npmManifests = await mapWithConcurrency(
+    toFetch,
+    async (name) => {
+      const outcome = await fetchNpmLatestManifest(name);
+      return { name, outcome };
+    },
+    concurrency
+  );
+  const npmData = {};
+  for (const { name, outcome } of npmManifests) {
+    if (outcome.status === "ok") {
+      npmData[name] = outcome.data;
+    } else if (outcome.status === "not-found") {
+      npmData[name] = { found: false };
+    } else if (outcome.status === "error") {
+      npmData[name] = { error: outcome.message };
+    } else if (outcome.status === "rate-limited") {
+      npmData[name] = { rateLimited: true };
+    }
+  }
+  const dirListed = toFetch.filter((name) => directoryCheckData[name]);
+  const directoryDetails = await (dirListed.length > 0 ? fetchLibraryDetails(dirListed, concurrency) : Promise.resolve({}));
+  const dirNotListed = toFetch.filter((name) => !directoryCheckData[name]);
+  const npmSearchResults = {};
+  for (const name of dirNotListed) {
+    const outcome = await searchNpmForPackage(name);
+    if (outcome.status === "ok" && outcome.data.name === name) {
+      npmSearchResults[name] = outcome.data;
+    }
+  }
+  const githubBreaker = new GitHubCircuitBreaker();
+  const githubCalls = [];
+  const packagesWithRepoUrl = /* @__PURE__ */ new Set();
+  for (const name of toFetch) {
+    let repoUrl;
+    const dirDetail = directoryDetails[name];
+    if (dirDetail && typeof dirDetail === "object" && "githubUrl" in dirDetail) {
+      repoUrl = dirDetail.githubUrl;
+    }
+    if (!repoUrl && npmData[name]?.repository?.url) {
+      repoUrl = npmData[name].repository.url;
+    }
+    if (!repoUrl) {
+      continue;
+    }
+    packagesWithRepoUrl.add(name);
+    let parsed = parseGithubUrl2(repoUrl);
+    if (!parsed) {
+      parsed = parseGithubUrl(repoUrl);
+    }
+    if (parsed) {
+      githubCalls.push({ name, owner: parsed.owner, repo: parsed.repo });
+    }
+  }
+  const githubData = {};
+  for (const { name, owner, repo } of githubCalls) {
+    if (githubBreaker.isTripped()) {
+      break;
+    }
+    const outcome = await fetchGithubRepo(owner, repo, githubToken);
+    if (outcome.status === "ok") {
+      githubData[name] = outcome.data;
+    } else if (outcome.status === "rate-limited") {
+      githubBreaker.trip();
+      warnings.push({
+        source: "github",
+        message: "GitHub API rate-limited after checking dependencies; remaining packages fall back to cached GitHub data or unknown"
+      });
+      break;
+    } else if (outcome.status === "error") {
+      githubData[name] = { error: outcome.message };
+    }
+  }
+  for (const name of toFetch) {
+    const npm = npmData[name] || {};
+    const dirCheck = directoryCheckData[name] || {};
+    const listedInDirectory = Object.prototype.hasOwnProperty.call(directoryCheckData, name);
+    const dirDetail = directoryDetails[name] || {};
+    const github = githubData[name];
+    const npmFound = npm.found !== false && !npm.rateLimited && !npm.error;
+    const npmNotFound = npm.found === false;
+    const deprecated = npmFound ? {
+      known: true,
+      value: {
+        deprecated: Boolean(npm.deprecated),
+        message: npm.deprecated ? String(npm.deprecated) : null
+      },
+      source: "npm"
+    } : { known: false, reason: npmNotFound ? "npm-not-found" : "npm-lookup-failed" };
+    const hasCodegenConfig = npmFound ? { known: true, value: Boolean(npm.codegenConfig), source: "npm" } : { known: false, reason: npmNotFound ? "npm-not-found" : "npm-lookup-failed" };
+    const hasReactNativePeerDep = npmFound ? {
+      known: true,
+      value: Boolean(npm.peerDependencies?.["react-native"]),
+      source: "npm"
+    } : { known: false, reason: npmNotFound ? "npm-not-found" : "npm-lookup-failed" };
+    const hasNativeDirsHint = npmFound ? {
+      known: true,
+      value: Boolean(
+        npm.files && Array.isArray(npm.files) && npm.files.some((f) => /^(android|ios)(\/.*)?$/.test(f))
+      ),
+      source: "npm"
+    } : { known: false, reason: npmNotFound ? "npm-not-found" : "npm-lookup-failed" };
+    let archivedSignal;
+    let pushedAtSignal;
+    let githubSource = null;
+    if (github && !github.error) {
+      archivedSignal = { known: true, value: github.archived === true, source: "github-api" };
+      if (github.pushed_at) {
+        pushedAtSignal = { known: true, value: github.pushed_at, source: "github-api" };
+      } else {
+        pushedAtSignal = { known: false, reason: "github-error" };
+      }
+      githubSource = "github-api";
+    } else if (dirDetail && typeof dirDetail === "object" && "github" in dirDetail) {
+      const dir = dirDetail;
+      if (dir.github?.isArchived !== void 0) {
+        archivedSignal = { known: true, value: dir.github.isArchived, source: "directory-fallback" };
+        if (dir.github.stats?.pushedAt) {
+          pushedAtSignal = { known: true, value: dir.github.stats.pushedAt, source: "directory-fallback" };
+        } else {
+          pushedAtSignal = { known: false, reason: "github-error" };
+        }
+        githubSource = "directory-fallback";
+      } else {
+        archivedSignal = { known: false, reason: githubBreaker.isTripped() ? "github-rate-limited" : "no-github-token" };
+        pushedAtSignal = { known: false, reason: githubBreaker.isTripped() ? "github-rate-limited" : "no-github-token" };
+      }
+    } else {
+      const noGithubReason = githubBreaker.isTripped() ? "github-rate-limited" : packagesWithRepoUrl.has(name) ? "no-github-token" : "no-repo-url";
+      archivedSignal = { known: false, reason: noGithubReason };
+      pushedAtSignal = { known: false, reason: noGithubReason };
+    }
+    let githubUrl = null;
+    if (dirDetail && typeof dirDetail === "object" && "githubUrl" in dirDetail) {
+      githubUrl = dirDetail.githubUrl || null;
+    } else if (npm.repository?.url) {
+      const parsed = parseGithubUrl(npm.repository.url) || parseGithubUrl2(npm.repository.url);
+      if (parsed) {
+        githubUrl = `https://github.com/${parsed.owner}/${parsed.repo}`;
+      }
+    }
+    let lastPublish;
+    if (dirDetail && typeof dirDetail === "object" && "npm" in dirDetail) {
+      const dir = dirDetail;
+      if (dir.npm?.latestReleaseDate) {
+        lastPublish = { known: true, value: { date: dir.npm.latestReleaseDate }, source: "directory" };
+      } else if (npmSearchResults[name]?.date) {
+        lastPublish = { known: true, value: { date: npmSearchResults[name].date }, source: "npm-search" };
+      } else {
+        lastPublish = { known: false, reason: "not-in-directory" };
+      }
+    } else if (npmSearchResults[name]?.date) {
+      lastPublish = { known: true, value: { date: npmSearchResults[name].date }, source: "npm-search" };
+    } else {
+      lastPublish = { known: false, reason: "not-in-directory" };
+    }
+    const rnNativeReasons = [];
+    if (listedInDirectory) {
+      rnNativeReasons.push("directory-listed");
+    }
+    if (hasReactNativePeerDep.known && hasReactNativePeerDep.value) {
+      rnNativeReasons.push("peer-dependency");
+    }
+    if (hasNativeDirsHint.known && hasNativeDirsHint.value) {
+      rnNativeReasons.push("native-files-hint");
+    }
+    const isRnNative = listedInDirectory || hasReactNativePeerDep.known && hasReactNativePeerDep.value || hasNativeDirsHint.known && hasNativeDirsHint.value;
+    const newArchTier = computeNewArchTier({
+      directoryVerdict: dirCheck.newArchitecture || null,
+      hasCodegenConfig
+    });
+    const depWarnings = [];
+    if (npmNotFound) {
+      depWarnings.push({
+        source: "npm",
+        dependency: name,
+        message: `Package not found on npm registry \u2014 verify the package name is correct`
+      });
+    }
+    if (npm.error) {
+      depWarnings.push({
+        source: "npm",
+        dependency: name,
+        message: `Failed to fetch npm data: ${npm.error}`
+      });
+    }
+    if (github?.error) {
+      depWarnings.push({
+        source: "github",
+        dependency: name,
+        message: `Failed to fetch GitHub data: ${github.error}`
+      });
+    }
+    const enrichedDep = {
+      name,
+      warnings: depWarnings,
+      npm: {
+        found: npmFound && !npmNotFound,
+        latestVersion: npmFound ? npm.version : null,
+        deprecated,
+        hasCodegenConfig,
+        hasReactNativePeerDep,
+        hasNativeDirsHint,
+        repositoryUrl: npm.repository?.url ? String(npm.repository.url).replace(/^git\+/, "") : null
+      },
+      directory: {
+        listed: listedInDirectory,
+        unmaintained: Boolean(dirCheck.unmaintained),
+        newArchitectureRaw: dirCheck.newArchitecture || null,
+        // Directory-sourced URL only; the npm-derived fallback belongs to `github.repoUrl`.
+        githubUrl: dirDetail && typeof dirDetail === "object" ? dirDetail.githubUrl || null : null,
+        lastPublishedAt: dirDetail && typeof dirDetail === "object" && dirDetail.npm?.latestReleaseDate || null,
+        // `?? null` (not `|| null`) so a genuine `false` (repo not archived) survives.
+        githubArchived: dirDetail && typeof dirDetail === "object" && typeof dirDetail.github?.isArchived === "boolean" ? dirDetail.github.isArchived : null,
+        githubPushedAt: dirDetail && typeof dirDetail === "object" && dirDetail.github?.stats?.pushedAt || null,
+        matchingScoreModifiers: dirDetail && typeof dirDetail === "object" && dirDetail.matchingScoreModifiers || []
+      },
+      github: {
+        archived: archivedSignal,
+        pushedAt: pushedAtSignal,
+        repoUrl: githubUrl,
+        source: githubSource
+      },
+      isRnNative,
+      rnNativeReasons,
+      newArch: {
+        tier: newArchTier,
+        evidence: {
+          directoryVerdict: dirCheck.newArchitecture || null,
+          hasCodegenConfig: hasCodegenConfig.known ? hasCodegenConfig.value : null
+        }
+      },
+      lastPublish
+    };
+    enriched.push(enrichedDep);
+    if (!options.noCache) {
+      const candidate = { fetchedAt: (/* @__PURE__ */ new Date()).toISOString(), enriched: enrichedDep };
+      if (!isEntryDegraded(candidate)) {
+        cache = putEntry(cache, candidate);
+      }
+    }
+  }
+  if (!options.noCache && toFetch.length > 0) {
+    try {
+      await writeCacheFile(cacheDir, cache);
+    } catch {
+      warnings.push({
+        source: "cache",
+        message: "Failed to write cache file"
+      });
+    }
+  }
+  return { dependencies: enriched, warnings };
+}
+
+// src/git.ts
+import { execFile } from "child_process";
+var GitError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GitError";
+  }
+};
+function createGitRunner() {
+  return (args, cwd) => new Promise((resolve2, reject) => {
+    execFile(
+      "git",
+      [...args],
+      { cwd, encoding: "utf8", windowsHide: true, maxBuffer: 16 * 1024 * 1024 },
+      (err, stdout, stderr) => {
+        if (err && err.code === "ENOENT") {
+          reject(
+            new GitError("git executable not found on PATH \u2014 --changed-only requires git.")
+          );
+          return;
+        }
+        const code = err ? err.code ?? 1 : 0;
+        resolve2({ code: typeof code === "number" ? code : 1, stdout, stderr });
+      }
+    );
+  });
+}
+async function resolveBaseCommit(git, cwd, baseRef) {
+  const result = await git(["merge-base", "HEAD", baseRef], cwd);
+  if (result.code === 0) {
+    const sha = result.stdout.trim();
+    if (sha !== "") return sha;
+  }
+  const stderr = result.stderr;
+  if (/not a git repository/i.test(stderr)) {
+    throw new GitError(
+      "--changed-only requires running inside a git repository (or drop the flag to check all dependencies)."
+    );
+  }
+  if (/not a valid object name|unknown revision|bad revision|needed a single revision/i.test(stderr)) {
+    throw new GitError(
+      `base ref "${baseRef}" was not found. Fetch it first (git fetch origin) or pass --base <ref>. In GitHub Actions, check out with fetch-depth: 0.`
+    );
+  }
+  if (stderr.trim() === "") {
+    throw new GitError(
+      `no merge base between HEAD and "${baseRef}" \u2014 histories are unrelated or the clone is too shallow. In GitHub Actions, check out with fetch-depth: 0.`
+    );
+  }
+  throw new GitError(`git merge-base HEAD ${baseRef} failed \u2014 ${stderr.trim()}`);
+}
+async function readFileAtCommit(git, cwd, commit, relPath) {
+  const posixPath = relPath.replaceAll("\\", "/");
+  const result = await git(["show", `${commit}:./${posixPath}`], cwd);
+  if (result.code === 0) {
+    let text = result.stdout;
+    if (text.charCodeAt(0) === 65279) text = text.slice(1);
+    return text;
+  }
+  if (/does not exist in|exists on disk, but not in|but not in the working tree|path .* does not exist/i.test(result.stderr)) {
+    return null;
+  }
+  throw new GitError(`git show ${commit}:./${posixPath} failed \u2014 ${result.stderr.trim()}`);
+}
+
+// src/package-json.ts
+import { readFile } from "fs/promises";
+import { join as join2 } from "path";
+var ManifestError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ManifestError";
+  }
+};
+function listDependencyEntries(parsed, where = "package.json") {
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new ManifestError(`${where} is not a JSON object.`);
+  }
+  const deps = parsed["dependencies"];
+  if (deps === void 0) return [];
+  if (typeof deps !== "object" || deps === null || Array.isArray(deps)) {
+    throw new ManifestError(`${where} has a "dependencies" field that is not an object.`);
+  }
+  return Object.entries(deps).map(([name, spec]) => {
+    if (typeof spec !== "string") {
+      throw new ManifestError(`${where} has a non-string version for dependency "${name}".`);
+    }
+    return { name, spec };
+  });
+}
+function entriesFromManifestText(text, where) {
+  const stripped = text.charCodeAt(0) === 65279 ? text.slice(1) : text;
+  let parsed;
+  try {
+    parsed = JSON.parse(stripped);
+  } catch (err) {
+    throw new ManifestError(
+      `${where} is not valid JSON \u2014 ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  return listDependencyEntries(parsed, where);
+}
+async function readManifestAt(path2, missingMessage) {
+  let text;
+  try {
+    text = await readFile(path2, "utf8");
+    if (text.charCodeAt(0) === 65279) text = text.slice(1);
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") {
+      throw new ManifestError(missingMessage ?? `No package.json found at ${path2}.`);
+    }
+    throw new ManifestError(
+      `Could not read ${path2} \u2014 ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (err) {
+    throw new ManifestError(
+      `${path2} is not valid JSON \u2014 ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const entries = listDependencyEntries(parsed, path2);
+  return { path: path2, text, dependencies: entries.map((entry) => entry.name), entries };
+}
+async function readPackageJson(cwd) {
+  return readManifestAt(
+    join2(cwd, "package.json"),
+    `No package.json found in ${cwd}. Run rn-doctor from the project root (the directory containing package.json).`
+  );
+}
+function findDependencyLine(text, name) {
+  let line = 1;
+  let depth = 0;
+  let inDependencies = false;
+  let i = 0;
+  while (i < text.length) {
+    const ch = text[i];
+    if (ch === "\n") {
+      line++;
+      i++;
+      continue;
+    }
+    if (ch === '"') {
+      const stringLine = line;
+      let value = "";
+      i++;
+      while (i < text.length) {
+        const c = text[i];
+        if (c === "\\") {
+          value += text.slice(i, i + 2);
+          i += 2;
+          continue;
+        }
+        if (c === "\n") line++;
+        if (c === '"') {
+          i++;
+          break;
+        }
+        value += c;
+        i++;
+      }
+      let j = i;
+      while (j < text.length && (text[j] === " " || text[j] === "	" || text[j] === "\r" || text[j] === "\n")) j++;
+      const isKey = text[j] === ":";
+      if (isKey) {
+        if (depth === 1 && value === "dependencies") {
+          let k = j + 1;
+          while (k < text.length && (text[k] === " " || text[k] === "	" || text[k] === "\r" || text[k] === "\n")) k++;
+          if (text[k] === "{") inDependencies = true;
+        } else if (inDependencies && depth === 2 && value === name) {
+          return stringLine;
+        }
+      }
+      continue;
+    }
+    if (ch === "{" || ch === "[") {
+      depth++;
+    } else if (ch === "}" || ch === "]") {
+      depth--;
+      if (inDependencies && depth <= 1) inDependencies = false;
+    }
+    i++;
+  }
+  return null;
+}
+
+// src/policy.ts
+var DEFAULT_POLICY = {
+  rules: {
+    newArchitecture: "error",
+    newArchUnknown: "warn",
+    lastPublish: { warnMonths: 12, errorMonths: 24 },
+    githubArchived: "error",
+    npmDeprecated: "error",
+    directoryUnmaintained: "warn"
+  },
+  scope: "rn-native-only",
+  allow: []
+};
+var MEAN_MONTH_MS = 365.2425 / 12 * 24 * 60 * 60 * 1e3;
+function allowStateFor(name, allow, now) {
+  const entry = allow.find((a) => a.package === name);
+  if (!entry) return { kind: "none" };
+  if (entry.expires === null) return { kind: "active", entry };
+  const expiryEnd = Date.parse(`${entry.expires}T23:59:59.999Z`);
+  return now.getTime() <= expiryEnd ? { kind: "active", entry } : { kind: "expired", entry };
+}
+function allowHint(name) {
+  return `If this is intentional, allowlist it in .rn-doctor.yml: { package: ${name}, reason: "<why>", expires: YYYY-MM-DD }.`;
+}
+function directoryUrl(name) {
+  return `https://reactnative.directory/?search=${encodeURIComponent(name)}`;
+}
+function npmUrl(name) {
+  return `https://www.npmjs.com/package/${name}`;
+}
+function evaluateRules(dep, rules, now) {
+  const hits = [];
+  const name = dep.name;
+  if (rules.newArchitecture !== "off") {
+    if (dep.newArch.tier === "unsupported") {
+      hits.push({
+        rule: "newArchitecture",
+        severity: rules.newArchitecture,
+        message: `${name} does not support the React Native New Architecture (RN Directory verdict: unsupported). Look for a maintained alternative or check the repo for New Architecture plans. ${allowHint(name)}`,
+        evidenceUrl: directoryUrl(name)
+      });
+    } else if (dep.newArch.tier === "passWithNote") {
+      hits.push({
+        rule: "newArchitecture",
+        severity: "note",
+        message: `${name} is not listed in the RN Directory, but its npm package ships a codegenConfig, which indicates New Architecture support. Treating as a pass; verify manually if this dependency is critical.`,
+        evidenceUrl: npmUrl(name)
+      });
+    }
+  }
+  if (rules.newArchUnknown !== "off" && dep.newArch.tier === "unknown") {
+    hits.push({
+      rule: "newArchUnknown",
+      severity: rules.newArchUnknown,
+      message: `New Architecture support for ${name} is unknown: it is not listed in the RN Directory and its npm package has no codegen hints. Verify support manually (check the repo README/releases). ${allowHint(name)}`,
+      evidenceUrl: directoryUrl(name)
+    });
+  }
+  if (rules.lastPublish !== "off" && dep.lastPublish.known) {
+    const publishedAt = Date.parse(dep.lastPublish.value.date);
+    if (!Number.isNaN(publishedAt)) {
+      const ageMonths = (now.getTime() - publishedAt) / MEAN_MONTH_MS;
+      const { warnMonths, errorMonths } = rules.lastPublish;
+      const band = ageMonths >= errorMonths ? "error" : ageMonths >= warnMonths ? "warn" : null;
+      if (band !== null) {
+        const threshold = band === "error" ? errorMonths : warnMonths;
+        hits.push({
+          rule: "lastPublish",
+          severity: band,
+          message: `${name} was last published ${String(Math.floor(ageMonths))} months ago (${dep.lastPublish.value.date.slice(0, 10)}), exceeding the ${String(threshold)}-month threshold. Check whether it is abandoned; consider a maintained fork, or let renovate surface a replacement. ` + allowHint(name),
+          evidenceUrl: npmUrl(name)
+        });
+      }
+    }
+  }
+  if (rules.githubArchived !== "off" && dep.github.archived.known && dep.github.archived.value) {
+    hits.push({
+      rule: "githubArchived",
+      severity: rules.githubArchived,
+      message: `The GitHub repository for ${name} is archived (read-only): no fixes or releases will land. Replace it or pin a fork. ${allowHint(name)}`,
+      evidenceUrl: dep.github.repoUrl ?? npmUrl(name)
+    });
+  }
+  if (rules.npmDeprecated !== "off" && dep.npm.deprecated.known && dep.npm.deprecated.value.deprecated) {
+    const upstream = dep.npm.deprecated.value.message;
+    hits.push({
+      rule: "npmDeprecated",
+      severity: rules.npmDeprecated,
+      message: `${name} is deprecated on npm` + (upstream ? `: "${upstream}"` : "") + `. Follow the deprecation notice to migrate. ${allowHint(name)}`,
+      evidenceUrl: npmUrl(name)
+    });
+  }
+  if (rules.directoryUnmaintained !== "off" && dep.directory.listed && dep.directory.unmaintained) {
+    hits.push({
+      rule: "directoryUnmaintained",
+      severity: rules.directoryUnmaintained,
+      message: `${name} is flagged as unmaintained in the RN Directory. Plan a migration to a maintained alternative. ${allowHint(name)}`,
+      evidenceUrl: directoryUrl(name)
+    });
+  }
+  return hits;
+}
+function evaluatePolicy(dependencies, policy, options = {}) {
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const findings = [];
+  for (const dep of dependencies) {
+    if (policy.scope === "rn-native-only" && !dep.isRnNative) continue;
+    const allowState = allowStateFor(dep.name, policy.allow, now);
+    for (const hit of evaluateRules(dep, policy.rules, now)) {
+      if (hit.severity === "note" || allowState.kind === "none") {
+        findings.push({ package: dep.name, ...hit, suppressedBy: null });
+      } else if (allowState.kind === "active") {
+        findings.push({
+          package: dep.name,
+          ...hit,
+          suppressedBy: {
+            reason: allowState.entry.reason,
+            expires: allowState.entry.expires
+          }
+        });
+      } else {
+        const { entry } = allowState;
+        findings.push({
+          package: dep.name,
+          rule: hit.rule,
+          severity: "error",
+          message: `${hit.message} NOTE: the allowlist entry for ${dep.name}` + (entry.reason ? ` ("${entry.reason}")` : "") + ` expired on ${entry.expires ?? "?"} \u2014 escalated to error. Renew the entry with a new expiry, or remove the dependency.`,
+          evidenceUrl: hit.evidenceUrl,
+          suppressedBy: null
+        });
+      }
+    }
+  }
+  return findings;
+}
+
+// src/policy-file.ts
+import { readFile as readFile2 } from "fs/promises";
+import { resolve } from "path";
+import { parse } from "yaml";
+var DEFAULT_POLICY_FILENAME = ".rn-doctor.yml";
+var PolicyError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PolicyError";
+  }
+};
+var RULE_SEVERITIES = ["error", "warn", "off"];
+var SCOPES = ["rn-native-only", "all-deps"];
+var RULE_KEYS = [
+  "newArchitecture",
+  "newArchUnknown",
+  "lastPublish",
+  "githubArchived",
+  "npmDeprecated",
+  "directoryUnmaintained"
+];
+var TOP_LEVEL_KEYS = ["rules", "scope", "allow"];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isList(value) {
+  return Array.isArray(value);
+}
+function fail(where, problem) {
+  throw new PolicyError(`Invalid policy${where}: ${problem}`);
+}
+function parseSeverity(value, key, where) {
+  if (typeof value === "string" && RULE_SEVERITIES.includes(value)) {
+    return value;
+  }
+  return fail(where, `rules.${key} must be one of ${RULE_SEVERITIES.join(" | ")}, got ${JSON.stringify(value)}`);
+}
+function parseLastPublish(value, where) {
+  if (value === "off") return "off";
+  if (isRecord(value)) {
+    const keys = Object.keys(value);
+    const unknown = keys.filter((k) => k !== "warnMonths" && k !== "errorMonths");
+    if (unknown.length > 0) {
+      fail(where, `rules.lastPublish has unknown key(s): ${unknown.join(", ")} (expected warnMonths, errorMonths)`);
+    }
+    const { warnMonths, errorMonths } = value;
+    if (typeof warnMonths !== "number" || typeof errorMonths !== "number") {
+      fail(where, `rules.lastPublish.warnMonths and .errorMonths must both be numbers`);
+    }
+    if (warnMonths < 0 || errorMonths < 0 || errorMonths < warnMonths) {
+      fail(where, `rules.lastPublish thresholds must be >= 0 with errorMonths >= warnMonths`);
+    }
+    return { warnMonths, errorMonths };
+  }
+  return fail(where, `rules.lastPublish must be "off" or { warnMonths, errorMonths }, got ${JSON.stringify(value)}`);
+}
+function parseRules(value, where) {
+  if (!isRecord(value)) {
+    return fail(where, `"rules" must be a mapping, got ${JSON.stringify(value)}`);
+  }
+  const unknown = Object.keys(value).filter((k) => !RULE_KEYS.includes(k));
+  if (unknown.length > 0) {
+    fail(where, `unknown rule(s): ${unknown.join(", ")} (known rules: ${RULE_KEYS.join(", ")})`);
+  }
+  const defaults = DEFAULT_POLICY.rules;
+  const severity = (key, fallback) => key in value ? parseSeverity(value[key], key, where) : fallback;
+  return {
+    newArchitecture: severity("newArchitecture", defaults.newArchitecture),
+    newArchUnknown: severity("newArchUnknown", defaults.newArchUnknown),
+    lastPublish: "lastPublish" in value ? parseLastPublish(value.lastPublish, where) : defaults.lastPublish,
+    githubArchived: severity("githubArchived", defaults.githubArchived),
+    npmDeprecated: severity("npmDeprecated", defaults.npmDeprecated),
+    directoryUnmaintained: severity("directoryUnmaintained", defaults.directoryUnmaintained)
+  };
+}
+var EXPIRES_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
+function parseAllowEntry(value, index, where) {
+  const at = `allow[${String(index)}]`;
+  if (!isRecord(value)) {
+    return fail(where, `${at} must be a mapping with a "package" key, got ${JSON.stringify(value)}`);
+  }
+  const unknown = Object.keys(value).filter((k) => k !== "package" && k !== "reason" && k !== "expires");
+  if (unknown.length > 0) {
+    fail(where, `${at} has unknown key(s): ${unknown.join(", ")} (expected package, reason, expires)`);
+  }
+  const pkg = value.package;
+  if (typeof pkg !== "string" || pkg.length === 0) {
+    fail(where, `${at}.package must be a non-empty string`);
+  }
+  const reason = value.reason;
+  if (reason !== void 0 && typeof reason !== "string") {
+    fail(where, `${at}.reason must be a string when present`);
+  }
+  let expires = value.expires;
+  if (expires instanceof Date && !Number.isNaN(expires.getTime())) {
+    expires = expires.toISOString().slice(0, 10);
+  }
+  if (expires !== void 0 && (typeof expires !== "string" || !EXPIRES_PATTERN.test(expires))) {
+    fail(where, `${at}.expires must be a YYYY-MM-DD date when present, got ${JSON.stringify(value.expires)}`);
+  }
+  return {
+    package: pkg,
+    reason: typeof reason === "string" ? reason : null,
+    expires: typeof expires === "string" ? expires : null
+  };
+}
+function parsePolicy(yamlText, filePath) {
+  const where = filePath ? ` (${filePath})` : "";
+  let raw;
+  try {
+    raw = parse(yamlText);
+  } catch (err) {
+    return fail(where, `YAML syntax error \u2014 ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (raw === null || raw === void 0) return DEFAULT_POLICY;
+  if (!isRecord(raw)) {
+    return fail(where, `top level must be a mapping, got ${JSON.stringify(raw)}`);
+  }
+  const unknown = Object.keys(raw).filter((k) => !TOP_LEVEL_KEYS.includes(k));
+  if (unknown.length > 0) {
+    fail(where, `unknown top-level key(s): ${unknown.join(", ")} (expected ${TOP_LEVEL_KEYS.join(", ")})`);
+  }
+  const rules = "rules" in raw ? parseRules(raw.rules, where) : DEFAULT_POLICY.rules;
+  let scope = DEFAULT_POLICY.scope;
+  if ("scope" in raw) {
+    const value = raw.scope;
+    if (typeof value !== "string" || !SCOPES.includes(value)) {
+      fail(where, `"scope" must be one of ${SCOPES.join(" | ")}, got ${JSON.stringify(value)}`);
+    }
+    scope = value;
+  }
+  let allow = DEFAULT_POLICY.allow;
+  if ("allow" in raw) {
+    const value = raw.allow;
+    if (!isList(value)) {
+      return fail(where, `"allow" must be a list of entries, got ${JSON.stringify(value)}`);
+    }
+    allow = value.map((entry, i) => parseAllowEntry(entry, i, where));
+  }
+  return { rules, scope, allow };
+}
+async function loadPolicy(path2, cwd = process.cwd()) {
+  const explicit = path2 !== void 0;
+  const filePath = explicit ? resolve(cwd, path2) : resolve(cwd, DEFAULT_POLICY_FILENAME);
+  let text;
+  try {
+    text = await readFile2(filePath, "utf8");
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT" && !explicit) return DEFAULT_POLICY;
+    throw new PolicyError(
+      explicit && code === "ENOENT" ? `Policy file not found: ${filePath}. Check the --policy path.` : `Could not read policy file ${filePath}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  return parsePolicy(text, filePath);
+}
+
+// src/report-annotations.ts
+function escapeData(value) {
+  return value.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
+}
+function escapeProperty(value) {
+  return escapeData(value).replaceAll(":", "%3A").replaceAll(",", "%2C");
+}
+function commandFor(f) {
+  if (f.suppressedBy !== null || f.severity === "note") return "notice";
+  return f.severity === "error" ? "error" : "warning";
+}
+function renderAnnotations(report, lineOf) {
+  const lines = [];
+  for (const f of report.findings) {
+    const command = commandFor(f);
+    const line = lineOf(f.file, f.package);
+    const properties = [
+      `file=${escapeProperty(f.file)}`,
+      ...line !== null ? [`line=${String(line)}`] : [],
+      `title=${escapeProperty(`rn-doctor: ${f.rule} (${f.package})`)}`
+    ].join(",");
+    const suffix = f.suppressedBy !== null ? ` [allowed${f.suppressedBy.reason ? `: ${f.suppressedBy.reason}` : ""}${f.suppressedBy.expires ? `, expires ${f.suppressedBy.expires}` : ""}]` : "";
+    lines.push(`::${command} ${properties}::${escapeData(f.message + suffix)}`);
+  }
+  return lines.length > 0 ? `${lines.join("\n")}
+` : "";
+}
+
+// src/report.ts
+function summarize(findings) {
+  let errors = 0;
+  let warnings = 0;
+  let notes = 0;
+  let suppressed = 0;
+  for (const f of findings) {
+    if (f.suppressedBy !== null) {
+      suppressed++;
+    } else if (f.severity === "error") {
+      errors++;
+    } else if (f.severity === "warn") {
+      warnings++;
+    } else {
+      notes++;
+    }
+  }
+  return { errors, warnings, notes, suppressed };
+}
+function computeExitCode(findings) {
+  return findings.some((f) => f.severity === "error" && f.suppressedBy === null) ? 1 : 0;
+}
+
+// src/report-json.ts
+function renderJson(report) {
+  const summary = summarize(report.findings);
+  const doc = {
+    version: 1,
+    summary: {
+      checked: report.checkedCount,
+      errors: summary.errors,
+      warnings: summary.warnings,
+      notes: summary.notes,
+      suppressed: summary.suppressed
+    },
+    findings: report.findings.map((f) => ({
+      file: f.file,
+      package: f.package,
+      rule: f.rule,
+      severity: f.severity,
+      message: f.message,
+      evidenceUrl: f.evidenceUrl,
+      suppressedBy: f.suppressedBy === null ? null : { reason: f.suppressedBy.reason, expires: f.suppressedBy.expires }
+    })),
+    warnings: report.warnings.map((w) => ({
+      ...w.dependency !== void 0 ? { dependency: w.dependency } : {},
+      source: w.source,
+      message: w.message
+    }))
+  };
+  return `${JSON.stringify(doc, null, 2)}
+`;
+}
+
+// src/report-pretty.ts
+var ESC = String.fromCharCode(27);
+var ANSI = {
+  red: "31",
+  yellow: "33",
+  cyan: "36",
+  green: "32",
+  dim: "2",
+  bold: "1"
+};
+function paint(code, text, on) {
+  return on ? `${ESC}[${code}m${text}${ESC}[0m` : text;
+}
+function badge(f, color) {
+  if (f.suppressedBy !== null) return paint(ANSI.dim, `allowed(${f.severity})`, color);
+  if (f.severity === "error") return paint(ANSI.red, "error", color);
+  if (f.severity === "warn") return paint(ANSI.yellow, "warn", color);
+  return paint(ANSI.cyan, "note", color);
+}
+function plural(n, word) {
+  return `${String(n)} ${word}${n === 1 ? "" : "s"}`;
+}
+function renderPretty(report, options) {
+  const { color } = options;
+  const lines = [];
+  const multiManifest = (report.manifestCount ?? 1) > 1;
+  let currentFile = null;
+  for (const f of report.findings) {
+    if (multiManifest && f.file !== currentFile) {
+      currentFile = f.file;
+      lines.push(paint(ANSI.dim, `${f.file}:`, color));
+      lines.push("");
+    }
+    lines.push(`${badge(f, color)}  ${paint(ANSI.bold, f.package, color)}  [${f.rule}]`);
+    lines.push(`    ${f.message}`);
+    if (f.suppressedBy !== null) {
+      const reason = f.suppressedBy.reason ?? "no reason given";
+      const expires = f.suppressedBy.expires ? `, expires ${f.suppressedBy.expires}` : "";
+      lines.push(paint(ANSI.dim, `    allowed by .rn-doctor.yml: ${reason}${expires}`, color));
+    }
+    if (f.evidenceUrl !== null) {
+      lines.push(paint(ANSI.dim, `    evidence: ${f.evidenceUrl}`, color));
+    }
+    lines.push("");
+  }
+  if (report.warnings.length > 0) {
+    lines.push("Data warnings (missing or degraded lookups - findings may be incomplete):");
+    for (const w of report.warnings) {
+      const scope = w.dependency !== void 0 ? `${w.dependency}: ` : "";
+      lines.push(paint(ANSI.dim, `  - [${w.source}] ${scope}${w.message}`, color));
+    }
+    lines.push("");
+  }
+  const s = summarize(report.findings);
+  const n = report.checkedCount;
+  const checked = `${String(n)} ${n === 1 ? "dependency" : "dependencies"}` + (multiManifest ? ` in ${String(report.manifestCount)} manifests` : "");
+  if (s.errors === 0 && s.warnings === 0 && s.notes === 0 && s.suppressed === 0) {
+    lines.push(paint(ANSI.green, `No findings across ${checked}.`, color));
+  } else {
+    const parts = [
+      paint(ANSI.red, plural(s.errors, "error"), color),
+      paint(ANSI.yellow, plural(s.warnings, "warning"), color),
+      plural(s.notes, "note"),
+      `${String(s.suppressed)} allowed`
+    ];
+    lines.push(`${parts.join(", ")} across ${checked}.`);
+  }
+  return `${lines.join("\n")}
+`;
+}
+
+// src/version.ts
+var VERSION = "0.0.0";
+
+// src/report-sarif.ts
+var INFORMATION_URI = "https://www.npmjs.com/package/react-native-doctor-ci";
+var RULE_IDS = [
+  "newArchitecture",
+  "newArchUnknown",
+  "lastPublish",
+  "githubArchived",
+  "npmDeprecated",
+  "directoryUnmaintained"
+];
+var RULE_DESCRIPTIONS = {
+  newArchitecture: "The package does not support the React Native New Architecture, per the React Native Directory.",
+  newArchUnknown: "New Architecture support for the package could not be determined from the React Native Directory or npm codegen hints.",
+  lastPublish: "The package's latest npm publish is older than the configured staleness threshold.",
+  githubArchived: "The package's GitHub repository is archived (read-only).",
+  npmDeprecated: "The package is marked deprecated on the npm registry.",
+  directoryUnmaintained: "The React Native Directory flags the package as unmaintained."
+};
+function sarifLevel(severity) {
+  return severity === "warn" ? "warning" : severity;
+}
+function renderSarif(report, options = {}) {
+  const lineOf = options.lineOf ?? (() => null);
+  const summary = summarize(report.findings);
+  const results = report.findings.map((f) => {
+    const line = lineOf(f.file, f.package);
+    return {
+      ruleId: f.rule,
+      ruleIndex: RULE_IDS.indexOf(f.rule),
+      level: sarifLevel(f.severity),
+      message: { text: f.message },
+      locations: [
+        {
+          physicalLocation: {
+            artifactLocation: { uri: f.file },
+            ...line !== null ? { region: { startLine: line } } : {}
+          }
+        }
+      ],
+      ...f.suppressedBy !== null ? {
+        suppressions: [
+          {
+            kind: "external",
+            status: "accepted",
+            justification: `Allowlisted in .rn-doctor.yml` + (f.suppressedBy.reason ? `: ${f.suppressedBy.reason}` : "") + (f.suppressedBy.expires ? ` (expires ${f.suppressedBy.expires})` : "")
+          }
+        ]
+      } : {},
+      ...f.evidenceUrl !== null ? { hostedViewerUri: f.evidenceUrl } : {}
+    };
+  });
+  const doc = {
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "rn-doctor",
+            informationUri: INFORMATION_URI,
+            version: VERSION,
+            rules: RULE_IDS.map((id) => ({
+              id,
+              shortDescription: { text: RULE_DESCRIPTIONS[id] },
+              helpUri: INFORMATION_URI
+            }))
+          }
+        },
+        invocations: [
+          {
+            executionSuccessful: true,
+            toolExecutionNotifications: report.warnings.map((w) => ({
+              level: "warning",
+              message: {
+                text: (w.dependency !== void 0 ? `${w.dependency}: ` : "") + w.message
+              }
+            }))
+          }
+        ],
+        results,
+        properties: {
+          checked: report.checkedCount,
+          errors: summary.errors,
+          warnings: summary.warnings,
+          notes: summary.notes,
+          suppressed: summary.suppressed
+        }
+      }
+    ]
+  };
+  return `${JSON.stringify(doc, null, 2)}
+`;
+}
+
+// src/workspaces.ts
+import { readdir, readFile as readFile3, stat } from "fs/promises";
+import { join as join3, relative, sep } from "path";
+import { parse as parse2 } from "yaml";
+var WorkspaceError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "WorkspaceError";
+  }
+};
+function segmentToRegExp(segment) {
+  const escaped = segment.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replaceAll("*", "[^/\\\\]*");
+  return new RegExp(`^${escaped}$`);
+}
+async function isDirectory(path2) {
+  try {
+    return (await stat(path2)).isDirectory();
+  } catch {
+    return false;
+  }
+}
+async function listSubdirs(dir) {
+  let entries;
+  try {
+    entries = await readdir(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  return entries.filter((e) => e.isDirectory() && e.name !== "node_modules" && !e.name.startsWith(".")).map((e) => e.name);
+}
+async function walkDirs(dir) {
+  const out = [dir];
+  for (const name of await listSubdirs(dir)) {
+    out.push(...await walkDirs(join3(dir, name)));
+  }
+  return out;
+}
+async function expandPattern(rootDir, pattern) {
+  const segments = pattern.replaceAll("\\", "/").replace(/\/+$/, "").split("/").filter((s) => s !== "" && s !== ".");
+  let dirs = [rootDir];
+  for (const [index, segment] of segments.entries()) {
+    if (segment === "**") {
+      const rest = segments.slice(index + 1).join("/");
+      const under = (await Promise.all(dirs.map((d) => walkDirs(d)))).flat();
+      if (rest === "") return under;
+      return (await Promise.all(under.map((d) => expandPattern(d, rest)))).flat();
+    }
+    if (segment.includes("*")) {
+      const re = segmentToRegExp(segment);
+      const next = [];
+      for (const dir of dirs) {
+        for (const name of await listSubdirs(dir)) {
+          if (re.test(name)) next.push(join3(dir, name));
+        }
+      }
+      dirs = next;
+    } else {
+      const next = [];
+      for (const dir of dirs) {
+        const candidate = join3(dir, segment);
+        if (await isDirectory(candidate)) next.push(candidate);
+      }
+      dirs = next;
+    }
+    if (dirs.length === 0) return [];
+  }
+  return dirs;
+}
+function relPosix(rootDir, dir) {
+  return relative(rootDir, dir).split(sep).join("/");
+}
+async function expandWorkspacePatterns(rootDir, patterns) {
+  const included = /* @__PURE__ */ new Map();
+  const exclusions = [];
+  for (const pattern of patterns) {
+    if (pattern.startsWith("!")) {
+      exclusions.push(pattern.slice(1));
+      continue;
+    }
+    for (const dir of await expandPattern(rootDir, pattern)) {
+      const rel = relPosix(rootDir, dir);
+      if (rel !== "") included.set(rel, dir);
+    }
+  }
+  for (const exclusion of exclusions) {
+    const excluded = new Set(
+      (await expandPattern(rootDir, exclusion)).map((dir) => relPosix(rootDir, dir))
+    );
+    for (const rel of [...included.keys()]) {
+      if (excluded.has(rel)) included.delete(rel);
+    }
+  }
+  return [...included.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([, dir]) => dir);
+}
+async function readPnpmWorkspacePatterns(rootDir) {
+  let text;
+  try {
+    text = await readFile3(join3(rootDir, "pnpm-workspace.yaml"), "utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = parse2(text);
+  } catch (err) {
+    throw new WorkspaceError(
+      `pnpm-workspace.yaml is not valid YAML \u2014 ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const packages = parsed["packages"];
+  if (packages === void 0) return null;
+  if (!Array.isArray(packages) || !packages.every((p) => typeof p === "string")) {
+    throw new WorkspaceError('pnpm-workspace.yaml has a "packages" field that is not a list of strings.');
+  }
+  return packages;
+}
+function readManifestWorkspacePatterns(parsed) {
+  if (typeof parsed !== "object" || parsed === null) return null;
+  let field = parsed["workspaces"];
+  if (field === void 0) return null;
+  if (typeof field === "object" && field !== null && !Array.isArray(field)) {
+    field = field["packages"];
+    if (field === void 0) return null;
+  }
+  if (!Array.isArray(field) || !field.every((p) => typeof p === "string")) {
+    throw new WorkspaceError('package.json has a "workspaces" field that is not a list of strings.');
+  }
+  return field;
+}
+async function discoverWorkspaces(rootDir, rootManifestParsed) {
+  const patterns = await readPnpmWorkspacePatterns(rootDir) ?? readManifestWorkspacePatterns(rootManifestParsed);
+  if (patterns === null) {
+    throw new WorkspaceError(
+      '--workspaces requires a "workspaces" field in package.json or a packages list in pnpm-workspace.yaml.'
+    );
+  }
+  const result = [{ dir: rootDir, manifestRelPath: "package.json" }];
+  for (const dir of await expandWorkspacePatterns(rootDir, patterns)) {
+    try {
+      await stat(join3(dir, "package.json"));
+    } catch {
+      continue;
+    }
+    result.push({ dir, manifestRelPath: `${relPosix(rootDir, dir)}/package.json` });
+  }
+  return result;
+}
+
+// src/cli-main.ts
+var USAGE = `rn-doctor - React Native dependency health gate for CI
+
+Usage:
+  rn-doctor [options]
+
+Checks the "dependencies" of the package.json in the current directory
+against the policy in .rn-doctor.yml (or the built-in default policy).
+
+Options:
+  --json             Output a machine-readable JSON report (stable-ordered)
+  --sarif            Output a SARIF 2.1.0 report (for code-scanning upload)
+  --policy <path>    Path to the policy file (default: .rn-doctor.yml if present)
+  --changed-only     Check only dependencies added or changed vs the base ref
+                     (compares against the merge-base of HEAD and the base)
+  --base <ref>       Base ref for --changed-only (default: origin/main)
+  --workspaces       Also check every workspace package.json (npm/yarn
+                     "workspaces" or pnpm-workspace.yaml), grouped by manifest
+  --no-cache         Bypass the enrichment cache (read and write)
+  --annotations      Force GitHub annotations on (default: auto in GitHub Actions)
+  --no-annotations   Force GitHub annotations off
+  -v, --version      Print the version and exit
+  -h, --help         Show this help and exit
+
+Exit codes:
+  0  clean (no policy errors; warnings, notes and allowlisted findings are ok)
+  1  policy errors found
+  2  tool failure (bad flags, unreadable package.json, invalid policy file,
+     git failure under --changed-only, missing workspace configuration)
+`;
+function parseCliArgs(argv) {
+  const { values } = parseArgs({
+    args: [...argv],
+    strict: true,
+    allowPositionals: false,
+    options: {
+      json: { type: "boolean", default: false },
+      sarif: { type: "boolean", default: false },
+      policy: { type: "string" },
+      "changed-only": { type: "boolean", default: false },
+      // No parseArgs default: --base without --changed-only must be detectable.
+      base: { type: "string" },
+      workspaces: { type: "boolean", default: false },
+      // Node 20 parseArgs has no allowNegative; model --no-* as literal flags.
+      "no-cache": { type: "boolean", default: false },
+      annotations: { type: "boolean", default: false },
+      "no-annotations": { type: "boolean", default: false },
+      version: { type: "boolean", short: "v", default: false },
+      help: { type: "boolean", short: "h", default: false }
+    }
+  });
+  return {
+    json: values.json,
+    sarif: values.sarif,
+    policy: values.policy,
+    changedOnly: values["changed-only"],
+    base: values.base,
+    workspaces: values.workspaces,
+    noCache: values["no-cache"],
+    annotations: values.annotations,
+    noAnnotations: values["no-annotations"],
+    version: values.version,
+    help: values.help
+  };
+}
+async function runCli(argv, io) {
+  let flags;
+  try {
+    flags = parseCliArgs(argv);
+  } catch (err) {
+    io.stderr.write(`rn-doctor: ${err instanceof Error ? err.message : String(err)}
+
+${USAGE}`);
+    return 2;
+  }
+  if (flags.help) {
+    io.stdout.write(USAGE);
+    return 0;
+  }
+  if (flags.version) {
+    io.stdout.write(`${VERSION}
+`);
+    return 0;
+  }
+  if (flags.json && flags.sarif) {
+    io.stderr.write("rn-doctor: --json and --sarif are mutually exclusive.\n");
+    return 2;
+  }
+  if (flags.annotations && flags.noAnnotations) {
+    io.stderr.write("rn-doctor: --annotations and --no-annotations are mutually exclusive.\n");
+    return 2;
+  }
+  if (flags.base !== void 0 && !flags.changedOnly) {
+    io.stderr.write("rn-doctor: --base requires --changed-only.\n");
+    return 2;
+  }
+  try {
+    const rootManifest = await readPackageJson(io.cwd);
+    const policy = await loadPolicy(flags.policy, io.cwd);
+    const runWarnings = [];
+    let scans;
+    if (flags.workspaces) {
+      const dirs = await discoverWorkspaces(io.cwd, JSON.parse(rootManifest.text));
+      if (dirs.length === 1) {
+        runWarnings.push({
+          source: "workspaces",
+          message: "The workspace configuration matched no directories; checking the root manifest only."
+        });
+      }
+      scans = await Promise.all(
+        dirs.map(async (w) => ({
+          relPath: w.manifestRelPath,
+          manifest: w.manifestRelPath === "package.json" ? rootManifest : await readManifestAt(join4(w.dir, "package.json"))
+        }))
+      );
+    } else {
+      scans = [{ relPath: "package.json", manifest: rootManifest }];
+    }
+    let checks;
+    if (flags.changedOnly) {
+      const git = io.git ?? createGitRunner();
+      const baseRef = flags.base ?? "origin/main";
+      const baseCommit = await resolveBaseCommit(git, io.cwd, baseRef);
+      checks = await Promise.all(
+        scans.map(async ({ relPath, manifest }) => {
+          const baseText = await readFileAtCommit(git, io.cwd, baseCommit, relPath);
+          let baseEntries = null;
+          if (baseText !== null) {
+            try {
+              baseEntries = entriesFromManifestText(baseText, `${relPath} at ${baseRef}`);
+            } catch (err) {
+              if (!(err instanceof ManifestError)) throw err;
+              runWarnings.push({
+                source: "git",
+                message: `${relPath} at ${baseRef} could not be parsed (${err.message}); checking all of its dependencies.`
+              });
+            }
+          }
+          return { relPath, names: diffDependencies(baseEntries, manifest.entries) };
+        })
+      );
+    } else {
+      checks = scans.map(({ relPath, manifest }) => ({ relPath, names: manifest.dependencies }));
+    }
+    const union = [...new Set(checks.flatMap((c) => c.names))];
+    const enriched = union.length > 0 ? await enrichDependencies(union, {
+      noCache: flags.noCache,
+      cacheDir: io.cwd,
+      githubToken: io.env.GITHUB_TOKEN
+    }) : { dependencies: [], warnings: [] };
+    const findings = evaluatePolicy(enriched.dependencies, policy, { now: io.now });
+    const located = [];
+    for (const { relPath, names } of checks) {
+      const declared = new Set(names);
+      for (const f of findings) {
+        if (declared.has(f.package)) located.push({ ...f, file: relPath });
+      }
+    }
+    const report = {
+      findings: located,
+      warnings: [...runWarnings, ...enriched.warnings],
+      checkedCount: checks.reduce((sum, c) => sum + c.names.length, 0),
+      ...flags.workspaces ? { manifestCount: scans.length } : {}
+    };
+    const texts = new Map(scans.map(({ relPath, manifest }) => [relPath, manifest.text]));
+    const lineOf = (file, name) => {
+      const text = texts.get(file);
+      return text === void 0 ? null : findDependencyLine(text, name);
+    };
+    if (flags.json) {
+      io.stdout.write(renderJson(report));
+    } else if (flags.sarif) {
+      io.stdout.write(renderSarif(report, { lineOf }));
+    } else {
+      const color = Boolean(io.stdout.isTTY) && !io.env.NO_COLOR;
+      io.stdout.write(renderPretty(report, { color }));
+      const emitAnnotations = flags.annotations || io.env.GITHUB_ACTIONS === "true" && !flags.noAnnotations;
+      if (emitAnnotations) {
+        io.stdout.write(renderAnnotations(report, lineOf));
+      }
+    }
+    return computeExitCode(report.findings);
+  } catch (err) {
+    if (err instanceof ManifestError || err instanceof PolicyError || err instanceof GitError || err instanceof WorkspaceError) {
+      io.stderr.write(`rn-doctor: ${err.message}
+`);
+      return 2;
+    }
+    io.stderr.write(
+      `rn-doctor: unexpected error - ${err instanceof Error ? err.stack ?? err.message : String(err)}
+`
+    );
+    return 2;
+  }
+}
+
+// src/cli.ts
+void runCli(process.argv.slice(2), {
+  stdout: process.stdout,
+  stderr: process.stderr,
+  cwd: process.cwd(),
+  env: process.env
+}).then((code) => {
+  process.exitCode = code;
+});
+//# sourceMappingURL=cli.js.map