technical-debt-radar 1.0.2 → 1.0.4

package/dist/index.js

@@ -39,7 +39,7 @@ var require_constants = __commonJS({
   "../../packages/shared/dist/constants/index.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.DEBT_DELTA_WARN_THRESHOLD = exports2.DEBT_DELTA_BLOCK_THRESHOLD = exports2.DEFAULT_COMPLEXITY_THRESHOLD = exports2.MAX_CHANGED_FILES_PER_PR = exports2.FIRST_SCAN_TIMEOUT_MS = exports2.PR_ANALYSIS_TIMEOUT_MS = exports2.MAX_AI_OUTPUT_TOKENS = exports2.MAX_AI_TOKENS_PER_FUNCTION = exports2.MAX_SUSPECT_FUNCTIONS_PER_PR = exports2.MAX_CALLER_TRACE_DEPTH = exports2.MAX_CROSS_FILE_SUSPECTS = exports2.CROSS_FILE_RULES = exports2.ARCHITECTURE_RULES = exports2.MAINTAINABILITY_RULES = exports2.PERFORMANCE_RULES = exports2.RELIABILITY_RULES = exports2.RUNTIME_RISK_RULES = exports2.VOLUME_THRESHOLDS = exports2.DEFAULT_SCORING = exports2.DEFAULT_MODE = void 0;
+    exports2.DEBT_DELTA_WARN_THRESHOLD = exports2.DEBT_DELTA_BLOCK_THRESHOLD = exports2.DEFAULT_LARGE_FILE_THRESHOLD = exports2.DEFAULT_COMPLEXITY_THRESHOLD = exports2.MAX_CHANGED_FILES_PER_PR = exports2.FIRST_SCAN_TIMEOUT_MS = exports2.PR_ANALYSIS_TIMEOUT_MS = exports2.MAX_AI_OUTPUT_TOKENS = exports2.MAX_AI_TOKENS_PER_FUNCTION = exports2.MAX_SUSPECT_FUNCTIONS_PER_PR = exports2.MAX_CALLER_TRACE_DEPTH = exports2.MAX_CROSS_FILE_SUSPECTS = exports2.CROSS_FILE_RULES = exports2.ARCHITECTURE_RULES = exports2.MAINTAINABILITY_RULES = exports2.PERFORMANCE_RULES = exports2.RELIABILITY_RULES = exports2.RUNTIME_RISK_RULES = exports2.VOLUME_THRESHOLDS = exports2.DEFAULT_SCORING = exports2.DEFAULT_MODE = void 0;
     exports2.DEFAULT_MODE = "warn";
     exports2.DEFAULT_SCORING = {
       architecture_violation: 5,
@@ -97,10 +97,12 @@ var require_constants = __commonJS({
       FETCH_ALL_FILTER_MEMORY: "fetch-all-filter-in-memory",
       MISSING_PAGINATION: "missing-pagination-endpoint",
       UNFILTERED_COUNT: "unfiltered-count-large-table",
-      RAW_SQL_NO_LIMIT: "raw-sql-no-limit"
+      RAW_SQL_NO_LIMIT: "raw-sql-no-limit",
+      RAW_SQL_UNSAFE: "raw-sql-unsafe"
     };
     exports2.MAINTAINABILITY_RULES = {
       HIGH_COMPLEXITY: "high-complexity",
+      LARGE_FILE: "large-file",
       CODE_DUPLICATION: "code-duplication",
       MISSING_TEST_FILE: "missing-test-file",
       UNUSED_EXPORT: "unused-export",
@@ -131,6 +133,7 @@ var require_constants = __commonJS({
     exports2.FIRST_SCAN_TIMEOUT_MS = 9e5;
     exports2.MAX_CHANGED_FILES_PER_PR = 100;
     exports2.DEFAULT_COMPLEXITY_THRESHOLD = 10;
+    exports2.DEFAULT_LARGE_FILE_THRESHOLD = 300;
     exports2.DEBT_DELTA_BLOCK_THRESHOLD = 15;
     exports2.DEBT_DELTA_WARN_THRESHOLD = 8;
   }
@@ -495,6 +498,7 @@ var require_parser = __commonJS({
       const exceptions = parseExceptions(raw.exceptions);
       const standards = parseStandards(raw.standards);
       const scoring = parseScoring(raw.scoring);
+      const shared_infrastructure = parseSharedInfrastructure(raw.shared_infrastructure);
       const result = {
         mode,
         stack,
@@ -507,7 +511,8 @@ var require_parser = __commonJS({
         gates,
         exceptions,
         standards,
-        scoring
+        scoring,
+        shared_infrastructure
       };
       if (architecture !== void 0) {
         result.architecture = architecture;
@@ -845,6 +850,19 @@ var require_parser = __commonJS({
       }
       return result;
     }
+    function parseSharedInfrastructure(value) {
+      if (value === void 0 || value === null)
+        return [];
+      if (!Array.isArray(value)) {
+        throw new PolicyValidationError("shared_infrastructure must be an array of folder names");
+      }
+      return value.map((item, i) => {
+        if (typeof item !== "string") {
+          throw new PolicyValidationError(`shared_infrastructure[${i}] must be a string`);
+        }
+        return item;
+      });
+    }
     function parseScoring(value) {
       if (value === void 0 || value === null)
         return {};
@@ -7489,6 +7507,10 @@ var require_validator = __commonJS({
               items: { type: "string", enum: ["ddd", "hexagonal", "clean", "layered", "mvc", "event-driven", "feature-module"] }
             }
           ]
+        },
+        shared_infrastructure: {
+          type: "array",
+          items: { type: "string" }
         }
       },
       additionalProperties: false
@@ -9531,7 +9553,8 @@ var require_compiler = __commonJS({
         exceptions,
         standards: config.standards,
         scoring,
-        architecture: config.architecture
+        architecture: config.architecture,
+        sharedInfrastructure: config.shared_infrastructure ?? []
       };
     }
     function compileLayers(layers) {
@@ -10058,9 +10081,9 @@ var require_layered = __commonJS({
       gates: shared_rules_1.DEFAULT_GATES,
       scoring: shared_rules_1.DEFAULT_PRESET_SCORING,
       layerMapping: {
-        presentation: "api",
-        business: "application",
-        "data-access": "infrastructure"
+        presentation: ["api", "controllers", "routes", "handlers", "web", "rest", "graphql"],
+        business: ["application", "services", "use-cases", "usecases", "domain"],
+        "data-access": ["infrastructure", "repositories", "persistence", "data", "dal", "db"]
       }
     };
   }
@@ -10507,7 +10530,13 @@ var require_project_detector = __commonJS({
       } catch {
         return [];
       }
-      return Array.from(found.values());
+      const uniqueByName = /* @__PURE__ */ new Map();
+      for (const layer of found.values()) {
+        if (!uniqueByName.has(layer.name)) {
+          uniqueByName.set(layer.name, layer);
+        }
+      }
+      return Array.from(uniqueByName.values());
     }
     async function scanForLayers(dirPath, relativePath, found) {
       let entries;
@@ -10618,7 +10647,7 @@ var require_project_detector = __commonJS({
       for (const [pattern, scoreMap] of Object.entries(SCORING_TABLE)) {
         if (detectedPatterns.has(pattern)) {
           for (const [arch, points] of Object.entries(scoreMap)) {
-            scores[arch] += points;
+            scores[arch] += points ?? 0;
           }
         }
       }
@@ -11519,9 +11548,12 @@ var require_rules_generator = __commonJS({
       if (placeholder === "contracts_path")
         return null;
       if (presetMapping && placeholder in presetMapping) {
-        const mappedName = presetMapping[placeholder];
-        if (layerMap.has(mappedName)) {
-          return layerMap.get(mappedName);
+        const mapped = presetMapping[placeholder];
+        const candidates = Array.isArray(mapped) ? mapped : [mapped];
+        for (const candidate of candidates) {
+          if (layerMap.has(candidate)) {
+            return layerMap.get(candidate);
+          }
         }
       }
       if (layerMap.has(placeholder)) {
@@ -12567,7 +12599,11 @@ var require_import_graph = __commonJS({
           const specifier = decl.getModuleSpecifierValue();
           const resolved = resolveModuleSpecifier(sourcePath, specifier, project);
           if (resolved) {
-            edges.push(buildEdge(sourcePath, resolved, "static", policy));
+            const isTypeOnly = decl.isTypeOnly();
+            const edge = buildEdge(sourcePath, resolved, "static", policy);
+            if (isTypeOnly)
+              edge.typeOnly = true;
+            edges.push(edge);
           }
         }
         for (const decl of sourceFile.getExportDeclarations()) {
@@ -12762,10 +12798,14 @@ var require_boundary_checker = __commonJS({
       const patterns = Array.isArray(policy.architecture) ? policy.architecture : [policy.architecture];
       return patterns.includes("feature-module");
     }
-    function isFeatureModuleExemptImport(sourcePath, targetPath) {
+    function isNestJSFramework(policy) {
+      return /nestjs/i.test(policy.stack.framework);
+    }
+    var suffixPattern = (suffix) => new RegExp(`\\.${suffix}(\\.(ts|tsx|js|jsx))?$`);
+    var NESTJS_SHARED_INFRA_FOLDERS = ["guards", "decorators", "interceptors", "pipes", "filters", "middleware", "shared"];
+    function isNestJSExemptImport(sourcePath, targetPath, customSharedFolders = []) {
       const srcBase = sourcePath.replace(/\\/g, "/");
       const tgtBase = targetPath.replace(/\\/g, "/");
-      const suffixPattern = (suffix) => new RegExp(`\\.${suffix}(\\.(ts|tsx|js|jsx))?$`);
       if (suffixPattern("module").test(srcBase))
         return true;
       if (suffixPattern("module").test(tgtBase))
@@ -12776,10 +12816,24 @@ var require_boundary_checker = __commonJS({
         return true;
       if (suffixPattern("decorator").test(tgtBase))
         return true;
-      if (/\/dto\//.test(tgtBase) || suffixPattern("dto").test(tgtBase))
+      if (suffixPattern("guard").test(tgtBase))
+        return true;
+      if (suffixPattern("interceptor").test(tgtBase))
         return true;
-      if (/\/shared\//.test(tgtBase))
+      if (suffixPattern("pipe").test(tgtBase))
         return true;
+      if (suffixPattern("filter").test(tgtBase))
+        return true;
+      if (/\/dto\//.test(tgtBase) || suffixPattern("dto").test(tgtBase))
+        return true;
+      for (const folder of NESTJS_SHARED_INFRA_FOLDERS) {
+        if (new RegExp(`/${folder}/`).test(tgtBase))
+          return true;
+      }
+      for (const folder of customSharedFolders) {
+        if (new RegExp(`/${folder.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}/`).test(tgtBase))
+          return true;
+      }
       return false;
     }
     var NPM_PACKAGE_LAYER_MAP = {
@@ -12814,6 +12868,10 @@ var require_boundary_checker = __commonJS({
       const violations = [];
       const activeExceptions = policy.exceptions.filter((e) => e.isActive);
       for (const edge of edges) {
+        if (edge.typeOnly)
+          continue;
+        if (/\.module(\.(ts|tsx|js|jsx))?$/.test(edge.source))
+          continue;
         const violation = checkEdge(edge, policy, activeExceptions);
         if (violation) {
           violations.push(violation);
@@ -12873,20 +12931,23 @@ var require_boundary_checker = __commonJS({
             continue;
           const hasDenyRule = policy.rules.some((r) => r.type === "deny" && matchesPattern(sourceLayer, r.source) && (matchesPattern(targetLayer, r.target) || r.target === "__db__" && targetLayer === "infrastructure"));
           if (hasDenyRule) {
-            if (isExcepted(shared_1.ARCHITECTURE_RULES.LAYER_VIOLATION, filePath, activeExceptions))
+            const isFrameworkImport = targetLayer === "api";
+            const effectiveRuleId = isFrameworkImport ? shared_1.ARCHITECTURE_RULES.FORBIDDEN_FRAMEWORK : shared_1.ARCHITECTURE_RULES.LAYER_VIOLATION;
+            const effectiveType = isFrameworkImport ? "forbidden-framework-in-layer" : "layer-boundary-violation";
+            if (isExcepted(effectiveRuleId, filePath, activeExceptions))
               continue;
             violations.push({
               category: "architecture",
-              type: "layer-boundary-violation",
-              ruleId: shared_1.ARCHITECTURE_RULES.LAYER_VIOLATION,
+              type: effectiveType,
+              ruleId: effectiveRuleId,
               severity: "critical",
               source: "deterministic",
               confidence: "high",
               file: filePath,
               line,
               layer: sourceLayer,
-              message: `Forbidden dependency: "${sourceLayer}" \u2192 "${targetLayer}" \u2014 import '${pkgName}' violates layer boundary (${filePath})`,
-              explanation: `The ${sourceLayer} layer must not depend on ${targetLayer} packages. Move this import to the ${targetLayer} layer.`,
+              message: isFrameworkImport ? `Forbidden framework import: "${sourceLayer}" imports '${pkgName}' \u2014 framework symbols not allowed in ${sourceLayer} layer (${filePath})` : `Forbidden dependency: "${sourceLayer}" \u2192 "${targetLayer}" \u2014 import '${pkgName}' violates layer boundary (${filePath})`,
+              explanation: isFrameworkImport ? `The ${sourceLayer} layer must not import framework packages. Move this import to the api/controller layer.` : `The ${sourceLayer} layer must not depend on ${targetLayer} packages. Move this import to the ${targetLayer} layer.`,
               debtPoints: 5,
               gateAction: "block"
             });
@@ -12896,6 +12957,95 @@ var require_boundary_checker = __commonJS({
       }
       return violations;
     }
+    function isInConstructorShorthandParam(node) {
+      let current = node;
+      while (current) {
+        if (current.getKind() === ts_morph_1.SyntaxKind.Parameter) {
+          const paramText = current.getText();
+          if (/^\s*(private|protected|public|readonly)\s/.test(paramText)) {
+            const paramParent = current.getParent();
+            if (paramParent && paramParent.getKind() === ts_morph_1.SyntaxKind.Constructor) {
+              return true;
+            }
+          }
+          return false;
+        }
+        current = current.getParent();
+      }
+      return false;
+    }
+    function isTypePosition(node) {
+      if (isInConstructorShorthandParam(node))
+        return false;
+      const parent = node.getParent();
+      if (!parent)
+        return false;
+      const parentKind = parent.getKind();
+      if (parentKind === ts_morph_1.SyntaxKind.TypeReference || parentKind === ts_morph_1.SyntaxKind.TypeQuery || parentKind === ts_morph_1.SyntaxKind.TypeAliasDeclaration || parentKind === ts_morph_1.SyntaxKind.InterfaceDeclaration || parentKind === ts_morph_1.SyntaxKind.AsExpression || parentKind === ts_morph_1.SyntaxKind.TypeAssertionExpression || parentKind === ts_morph_1.SyntaxKind.ExpressionWithTypeArguments || parentKind === ts_morph_1.SyntaxKind.MappedType || parentKind === ts_morph_1.SyntaxKind.ConditionalType || parentKind === ts_morph_1.SyntaxKind.IntersectionType || parentKind === ts_morph_1.SyntaxKind.UnionType || parentKind === ts_morph_1.SyntaxKind.TupleType || parentKind === ts_morph_1.SyntaxKind.ArrayType || parentKind === ts_morph_1.SyntaxKind.IndexedAccessType || parentKind === ts_morph_1.SyntaxKind.TypeOperator || parentKind === ts_morph_1.SyntaxKind.ParenthesizedType) {
+        return true;
+      }
+      if (parentKind === ts_morph_1.SyntaxKind.Parameter || parentKind === ts_morph_1.SyntaxKind.PropertyDeclaration || parentKind === ts_morph_1.SyntaxKind.PropertySignature || parentKind === ts_morph_1.SyntaxKind.VariableDeclaration || parentKind === ts_morph_1.SyntaxKind.FunctionDeclaration || parentKind === ts_morph_1.SyntaxKind.MethodDeclaration || parentKind === ts_morph_1.SyntaxKind.MethodSignature || parentKind === ts_morph_1.SyntaxKind.ArrowFunction || parentKind === ts_morph_1.SyntaxKind.GetAccessor || parentKind === ts_morph_1.SyntaxKind.SetAccessor) {
+        const colonToken = parent.getFirstChildByKind(ts_morph_1.SyntaxKind.ColonToken);
+        if (colonToken && node.getPos() > colonToken.getPos()) {
+          const equalsToken = parent.getFirstChildByKind(ts_morph_1.SyntaxKind.EqualsToken);
+          if (!equalsToken || node.getPos() < equalsToken.getPos()) {
+            return true;
+          }
+        }
+      }
+      if (parentKind === ts_morph_1.SyntaxKind.HeritageClause) {
+        return true;
+      }
+      if (parentKind === ts_morph_1.SyntaxKind.QualifiedName) {
+        const grandParent = parent.getParent();
+        if (grandParent && grandParent.getKind() === ts_morph_1.SyntaxKind.TypeReference) {
+          return true;
+        }
+      }
+      return false;
+    }
+    function isImplicitlyTypeOnly(decl, sourceFile) {
+      if (decl.isTypeOnly())
+        return false;
+      if (decl.getNamespaceImport())
+        return false;
+      const defaultImport = decl.getDefaultImport();
+      const namedImports = decl.getNamedImports();
+      if (!defaultImport && namedImports.length === 0)
+        return false;
+      const importedNames = [];
+      if (defaultImport) {
+        importedNames.push(defaultImport.getText());
+      }
+      for (const named of namedImports) {
+        if (named.isTypeOnly())
+          continue;
+        importedNames.push(named.getName());
+      }
+      if (importedNames.length === 0)
+        return true;
+      for (const name of importedNames) {
+        const identifiers = sourceFile.getDescendantsOfKind(ts_morph_1.SyntaxKind.Identifier).filter((id) => id.getText() === name);
+        const usages = identifiers.filter((id) => {
+          const parent = id.getParent();
+          if (!parent)
+            return false;
+          const parentKind = parent.getKind();
+          if (parentKind === ts_morph_1.SyntaxKind.ImportSpecifier || parentKind === ts_morph_1.SyntaxKind.ImportClause) {
+            return false;
+          }
+          return true;
+        });
+        if (usages.length === 0)
+          return false;
+        for (const usage of usages) {
+          if (!isTypePosition(usage)) {
+            return false;
+          }
+        }
+      }
+      return true;
+    }
     function checkCrossModuleDirectImports(input, policy, activeExceptions) {
       const violations = [];
       const hasCrossModuleDeny = policy.rules.some((r) => r.type === "deny" && /cross-module/i.test(r.description ?? "") || /cross-module/i.test(r.source));
@@ -12918,12 +13068,18 @@ var require_boundary_checker = __commonJS({
         }
         const specifiers = [];
         for (const decl of sourceFile.getImportDeclarations()) {
-          specifiers.push({ specifier: decl.getModuleSpecifierValue(), line: decl.getStartLineNumber() });
+          const explicitTypeOnly = decl.isTypeOnly();
+          const implicitTypeOnly = !explicitTypeOnly && isImplicitlyTypeOnly(decl, sourceFile);
+          specifiers.push({
+            specifier: decl.getModuleSpecifierValue(),
+            line: decl.getStartLineNumber(),
+            typeOnly: explicitTypeOnly || implicitTypeOnly
+          });
         }
         for (const reqSpec of extractRequireSpecifiers(sourceFile)) {
           specifiers.push(reqSpec);
         }
-        for (const { specifier, line } of specifiers) {
+        for (const { specifier, line, typeOnly } of specifiers) {
           if (!specifier.startsWith(".") && !specifier.startsWith("/"))
             continue;
           const sourceDir = filePath.replace(/\/[^/]+$/, "");
@@ -12940,9 +13096,14 @@ var require_boundary_checker = __commonJS({
           if (isExcepted(shared_1.ARCHITECTURE_RULES.MODULE_BOUNDARY, filePath, activeExceptions))
             continue;
           const isFeatureModule = isFeatureModuleArchitecture(policy);
+          const isNestJS = isNestJSFramework(policy);
           if (isEntityCrossModuleImport(filePath, resolvedTarget, isFeatureModule))
             continue;
-          if (isFeatureModule && isFeatureModuleExemptImport(filePath, resolvedTarget))
+          if (isNestJS && isNestJSExemptImport(filePath, resolvedTarget, policy.sharedInfrastructure))
+            continue;
+          if (!isNestJS && isFeatureModule && isNestJSExemptImport(filePath, resolvedTarget, policy.sharedInfrastructure))
+            continue;
+          if (typeOnly)
             continue;
           violations.push({
             category: "architecture",
@@ -12971,7 +13132,7 @@ var require_boundary_checker = __commonJS({
         const isTargetEntity2 = entityFilePattern.test(targetPath);
         return isSourceEntity2 && isTargetEntity2;
       }
-      const entityDirPattern = /\/entities?\//;
+      const entityDirPattern = /\/(entities?|domain)\//;
       const isSourceEntity = entityFilePattern.test(sourcePath) && entityDirPattern.test(sourcePath);
       const isTargetEntity = entityFilePattern.test(targetPath) && entityDirPattern.test(targetPath);
       return isSourceEntity && isTargetEntity;
@@ -13051,10 +13212,15 @@ var require_boundary_checker = __commonJS({
         return void 0;
       if (edge.sourceModule === edge.targetModule)
         return void 0;
+      if (edge.typeOnly)
+        return void 0;
       const isFeatureModule = policy ? isFeatureModuleArchitecture(policy) : false;
+      const isNestJS = policy ? isNestJSFramework(policy) : false;
       if (isEntityCrossModuleImport(edge.source, edge.target, isFeatureModule))
         return void 0;
-      if (isFeatureModule && isFeatureModuleExemptImport(edge.source, edge.target))
+      if (isNestJS && isNestJSExemptImport(edge.source, edge.target, policy?.sharedInfrastructure))
+        return void 0;
+      if (!isNestJS && isFeatureModule && isNestJSExemptImport(edge.source, edge.target, policy?.sharedInfrastructure))
         return void 0;
       const matchingRules = rules.filter((r) => matchesPattern(edge.sourceModule, r.source) && matchesPattern(edge.targetModule, r.target));
       if (matchingRules.some((r) => r.type === "allow"))
@@ -14075,16 +14241,22 @@ var require_runtime_risk_detector = __commonJS({
         }
         if (ts_morph_1.Node.isForStatement(node)) {
           const condText = node.getCondition()?.getText() ?? "";
+          const bodyText = body.getText();
+          const hasAwait = /\bawait\b/.test(bodyText);
+          const hasCpuWork = /Math\.|\.sqrt|\.pow|\.random|\.toString|\.charCodeAt|parseInt|parseFloat|\+\+|--|\*|\//.test(bodyText);
           const largeBoundMatch = condText.match(/[<]=?\s*(\d+)/);
           if (largeBoundMatch) {
             const bound = parseInt(largeBoundMatch[1], 10);
-            if (bound >= 1e4) {
-              const bodyText = body.getText();
-              const hasAwait = /\bawait\b/.test(bodyText);
-              const hasCpuWork = /Math\.|\.sqrt|\.pow|\.random|\.toString|\.charCodeAt|parseInt|parseFloat|\+\+|--|\*|\//.test(bodyText);
-              if (!hasAwait && hasCpuWork) {
-                violations.push(makeViolation(shared_1.RUNTIME_RISK_RULES.CPU_HEAVY_LOOP_IN_HANDLER, filePath, node.getStartLineNumber(), `CPU-heavy loop (${bound.toLocaleString()} iterations) inside handler '${handler.name}' blocks the event loop`, policy, handler.name, "Move heavy computation to a worker thread or break into chunks with setImmediate"));
-              }
+            if (bound >= 1e4 && !hasAwait && hasCpuWork) {
+              violations.push(makeViolation(shared_1.RUNTIME_RISK_RULES.CPU_HEAVY_LOOP_IN_HANDLER, filePath, node.getStartLineNumber(), `CPU-heavy loop (${bound.toLocaleString()} iterations) inside handler '${handler.name}' blocks the event loop`, policy, handler.name, "Move heavy computation to a worker thread or break into chunks with setImmediate"));
+              return;
+            }
+          }
+          if (!largeBoundMatch && !hasAwait && hasCpuWork) {
+            const dynamicBound = condText.match(/[<]=?\s*([a-zA-Z_]\w*)/);
+            if (dynamicBound) {
+              violations.push(makeViolation(shared_1.RUNTIME_RISK_RULES.CPU_HEAVY_LOOP_IN_HANDLER, filePath, node.getStartLineNumber(), `CPU-heavy loop with dynamic bound '${dynamicBound[1]}' inside handler '${handler.name}' \u2014 user-controlled iteration count blocks event loop`, policy, handler.name, "Cap the iteration count, move to a worker thread, or break into chunks with setImmediate"));
+              return;
             }
           }
         }
@@ -14364,7 +14536,13 @@ var require_perf_pattern_detector = __commonJS({
       }
       if (ts_morph_1.Node.isIdentifier(obj)) {
         const name = obj.getText();
-        return name.replace(/Repo(sitory)?|Service|Model|Dao$/i, "").toLowerCase() || void 0;
+        const stripped = name.replace(/Repo(sitory)?|Service|Model|Dao$/i, "");
+        if (stripped && stripped !== name)
+          return stripped.toLowerCase();
+        const sourceFile = callExpr.getSourceFile();
+        const fromVar = extractEntityFromVariable(name, sourceFile);
+        if (fromVar)
+          return fromVar;
       }
       return void 0;
     }
@@ -14405,6 +14583,56 @@ var require_perf_pattern_detector = __commonJS({
       }
       return void 0;
     }
+    function extractEntityAny(callExpr, sourceFile) {
+      let entity = extractEntity(callExpr);
+      if (entity)
+        return entity;
+      entity = extractTypeORMEntity(callExpr);
+      if (entity)
+        return entity;
+      entity = extractSequelizeEntity(callExpr);
+      if (entity)
+        return entity;
+      const expr = callExpr.getExpression();
+      if (ts_morph_1.Node.isPropertyAccessExpression(expr)) {
+        const obj = expr.getExpression();
+        if (ts_morph_1.Node.isIdentifier(obj)) {
+          entity = extractEntityFromVariable(obj.getText(), sourceFile);
+          if (entity)
+            return entity;
+        }
+        if (ts_morph_1.Node.isPropertyAccessExpression(obj)) {
+          const propName = obj.getName();
+          entity = extractEntityFromVariable(propName, sourceFile);
+          if (entity)
+            return entity;
+          const stripped = propName.replace(/Repo(sitory)?$/i, "");
+          if (stripped && stripped !== propName)
+            return stripped.toLowerCase();
+        }
+      }
+      return void 0;
+    }
+    function extractEntityFromVariable(varName, sourceFile) {
+      const fileText = sourceFile.getFullText();
+      const typeAnnotation = new RegExp(`\\b${escapeRegex(varName)}\\s*[:\\!]\\s*Repository\\s*<\\s*(\\w+)\\s*>`);
+      const typeMatch = fileText.match(typeAnnotation);
+      if (typeMatch)
+        return typeMatch[1];
+      const asTypeAssert = new RegExp(`\\b${escapeRegex(varName)}\\s*=\\s*[^;]*\\bas\\s+Repository\\s*<\\s*(\\w+)\\s*>`);
+      const asMatch = fileText.match(asTypeAssert);
+      if (asMatch)
+        return asMatch[1];
+      const getRepoAssign = new RegExp(`\\b${escapeRegex(varName)}\\s*=\\s*getRepository\\s*\\(\\s*(\\w+)\\s*\\)`);
+      const getRepoMatch = fileText.match(getRepoAssign);
+      if (getRepoMatch)
+        return getRepoMatch[1];
+      const connRepoAssign = new RegExp(`\\b${escapeRegex(varName)}\\s*=\\s*\\w+\\.getRepository\\s*\\(\\s*(\\w+)\\s*\\)`);
+      const connMatch = fileText.match(connRepoAssign);
+      if (connMatch)
+        return connMatch[1];
+      return void 0;
+    }
     function extractSequelizeEntity(callExpr) {
       const expr = callExpr.getExpression();
       if (!ts_morph_1.Node.isPropertyAccessExpression(expr))
@@ -15079,15 +15307,30 @@ var require_perf_pattern_detector = __commonJS({
         const relationsProp = objArg.getProperty("relations");
         if (relationsProp) {
           const relText = relationsProp.getText();
-          const dotMatches = relText.match(/['"][^'"]*\.[^'"]*\.[^'"]*['"]/g);
-          if (dotMatches && dotMatches.length > 0) {
+          const allRelations = relText.match(/['"][^'"]+['"]/g) ?? [];
+          const dottedRelations = allRelations.filter((m) => m.includes("."));
+          const totalRelCount = allRelations.length;
+          const maxDepth = allRelations.length > 0 ? Math.max(...allRelations.map((m) => m.replace(/['"]/g, "").split(".").length)) : 0;
+          if (dottedRelations.length > 0 || totalRelCount >= 4) {
             let entity = extractEntity(node);
             if (!entity)
               entity = extractTypeORMEntity(node);
             const vol = entity ? resolveVolume(entity, policy) : void 0;
             const fn = getEnclosingFn(node, fns);
-            const maxDepth = Math.max(...dotMatches.map((m) => m.split(".").length));
-            pushIfNotNull(violations, makeViolation(shared_1.PERFORMANCE_RULES.NESTED_INCLUDE_LARGE, filePath, node.getStartLineNumber(), `Deeply nested relations (depth ${maxDepth})${vol ? ` on '${entity}' (${vol.size} volume)` : ""} \u2014 may cause cartesian explosion`, policy, vol, fn?.name, "Flatten relations or use separate queries to avoid loading excessive data"));
+            pushIfNotNull(violations, makeViolation(shared_1.PERFORMANCE_RULES.NESTED_INCLUDE_LARGE, filePath, node.getStartLineNumber(), `Deeply nested relations (depth ${maxDepth}, ${totalRelCount} relations)${vol ? ` on '${entity}' (${vol.size} volume)` : ""} \u2014 may cause cartesian explosion`, policy, vol, fn?.name, "Flatten relations or use separate queries to avoid loading excessive data"));
+          }
+          const seqIncludeProp = objArg.getProperty("include");
+          if (seqIncludeProp) {
+            const seqIncText = seqIncludeProp.getText();
+            const nestCount = countNestedIncludes(seqIncText);
+            if (nestCount >= 2) {
+              let entity = extractEntity(node);
+              if (!entity)
+                entity = extractSequelizeEntity(node);
+              const vol = entity ? resolveVolume(entity, policy) : void 0;
+              const fn = getEnclosingFn(node, fns);
+              pushIfNotNull(violations, makeViolation(shared_1.PERFORMANCE_RULES.NESTED_INCLUDE_LARGE, filePath, node.getStartLineNumber(), `Deeply nested include (depth ${nestCount})${vol ? ` on '${entity}' (${vol.size} volume)` : ""} \u2014 may cause cartesian explosion`, policy, vol, fn?.name, "Flatten includes or use separate queries to avoid loading excessive data"));
+            }
           }
         }
       });
@@ -15134,6 +15377,7 @@ var require_perf_pattern_detector = __commonJS({
       "countDocuments",
       "estimatedDocumentCount"
     ]);
+    var DB_CALL_METHOD_PATTERN_EXTENDED = /^(find|get|fetch|load|search|query|count|list)(By|All|Many|One|First|Where|With)?/i;
     function detectNPlusOne(sourceFile, filePath, fns, policy, violations) {
       sourceFile.forEachDescendant((node) => {
         if (!ts_morph_1.Node.isAwaitExpression(node))
@@ -15147,7 +15391,7 @@ var require_perf_pattern_detector = __commonJS({
         const callMethodName = callExpr.getName();
         let isDrizzleOrKnexChain = false;
         let chainEntity;
-        if (!DB_CALL_METHODS.has(callMethodName)) {
+        if (!DB_CALL_METHODS.has(callMethodName) && !DB_CALL_METHOD_PATTERN_EXTENDED.test(callMethodName)) {
           const drizzle = traceDrizzleChain(awaited);
           if (drizzle.isDrizzle) {
             isDrizzleOrKnexChain = true;
@@ -15235,7 +15479,7 @@ var require_perf_pattern_detector = __commonJS({
         });
       });
     }
-    var DB_CALL_METHODS_PATTERN = /\.(findMany|findFirst|findUnique|findOne|find|findById|create|update|delete|upsert|count|countDocuments|estimatedDocumentCount|aggregate|query|execute|save|remove|insert|getMany|getOne|findAll|findByPk|findAndCountAll|findOrCreate|destroy|from|select|first|raw)\s*\(/;
+    var DB_CALL_METHODS_PATTERN = /\.(findMany|findFirst|findUnique|findOne|find|findById|findBy\w+|getBy\w+|fetchBy\w+|create|update|delete|upsert|count|countDocuments|estimatedDocumentCount|aggregate|query|execute|save|remove|insert|getMany|getOne|findAll|findByPk|findAndCountAll|findOrCreate|destroy|from|select|first|raw)\s*\(/;
     function detectRecursiveNPlusOne(sourceFile, filePath, fns, policy, violations) {
       const DB_METHOD_NAMES = /* @__PURE__ */ new Set([
         "find",
@@ -15307,6 +15551,7 @@ var require_perf_pattern_detector = __commonJS({
       }
       return false;
     }
+    var IN_MEMORY_OPERATIONS = /* @__PURE__ */ new Set(["filter", "sort", "map", "reduce", "flatMap"]);
     function detectFetchAllFilterMemory(sourceFile, filePath, fns, policy, violations) {
       sourceFile.forEachDescendant((node) => {
         if (!ts_morph_1.Node.isCallExpression(node))
@@ -15314,7 +15559,7 @@ var require_perf_pattern_detector = __commonJS({
         const expr = node.getExpression();
         if (!ts_morph_1.Node.isPropertyAccessExpression(expr))
           return;
-        if (expr.getName() !== "filter")
+        if (!IN_MEMORY_OPERATIONS.has(expr.getName()))
           return;
         const obj = expr.getExpression();
         if (ts_morph_1.Node.isParenthesizedExpression(obj)) {
@@ -15342,26 +15587,65 @@ var require_perf_pattern_detector = __commonJS({
           const block = node.getFirstAncestorByKind(ts_morph_1.SyntaxKind.Block);
           if (!block)
             return;
-          const blockText = block.getText();
-          const nodePos = node.getStart() - block.getStart();
-          const textBefore = blockText.substring(0, nodePos);
-          const assignPattern = new RegExp(`${escapeRegex(varName)}\\s*=\\s*await\\s+(?:\\S+\\.(findMany|find|getMany|findAll|from|select)\\s*\\(|(?:knex|db)\\s*\\()`);
-          const assignMatch = textBefore.match(new RegExp(`(\\w+)\\.${escapeRegex(varName)}|\\b(\\w+)\\.(findMany|find|getMany|findAll)\\s*\\(`));
-          if (assignPattern.test(textBefore)) {
-            let entity;
-            const chain = textBefore.match(/(\w+)\.(\w+)\.(findMany|find|getMany|findAll)\s*\(/);
-            if (chain)
-              entity = chain[2];
-            if (!entity) {
-              const seqMatch = textBefore.match(/([A-Z]\w+)\.(findAll|find)\s*\(/);
-              if (seqMatch)
-                entity = seqMatch[1];
+          let foundDbAssignment = false;
+          let entity;
+          block.forEachDescendant((child) => {
+            if (foundDbAssignment)
+              return;
+            if (!ts_morph_1.Node.isVariableDeclaration(child))
+              return;
+            if (child.getName() !== varName)
+              return;
+            if (child.getStart() >= node.getStart())
+              return;
+            const init = child.getInitializer();
+            if (!init)
+              return;
+            let awaitedCall;
+            if (ts_morph_1.Node.isAwaitExpression(init)) {
+              const awaited = init.getExpression();
+              if (ts_morph_1.Node.isCallExpression(awaited))
+                awaitedCall = awaited;
+            } else if (ts_morph_1.Node.isCallExpression(init)) {
+              awaitedCall = init;
             }
-            if (!entity) {
-              const typeormMatch = textBefore.match(/getRepository\(\s*(\w+)\s*\)\.(findMany|find|getMany)\s*\(/);
-              if (typeormMatch)
-                entity = typeormMatch[1];
+            if (!awaitedCall)
+              return;
+            const callExpr = awaitedCall.getExpression();
+            if (!ts_morph_1.Node.isPropertyAccessExpression(callExpr))
+              return;
+            const methodName = callExpr.getName();
+            const dbMethods = /* @__PURE__ */ new Set([
+              "findMany",
+              "find",
+              "getMany",
+              "findAll",
+              "findAndCountAll",
+              "from",
+              "select",
+              "getAll",
+              "fetchAll",
+              "findBy",
+              "query"
+            ]);
+            if (!dbMethods.has(methodName) && !/^(find|get|fetch|load)(By|All|Many)/.test(methodName))
+              return;
+            foundDbAssignment = true;
+            entity = extractEntityAny(awaitedCall, sourceFile);
+          });
+          if (!foundDbAssignment) {
+            const blockText = block.getText();
+            const nodePos = node.getStart() - block.getStart();
+            const textBefore = blockText.substring(0, nodePos);
+            const assignPattern = new RegExp(`\\b${escapeRegex(varName)}\\s*=\\s*await\\s+[\\w.]+\\.(findMany|find|getMany|findAll|findBy\\w+|getAll|fetchAll|from|select)\\s*\\(`);
+            if (assignPattern.test(textBefore)) {
+              foundDbAssignment = true;
+              const chain = textBefore.match(/(\w+)\.(\w+)\.(findMany|find|getMany|findAll)\s*\(/);
+              if (chain)
+                entity = chain[2];
             }
+          }
+          if (foundDbAssignment) {
             const vol = entity ? resolveVolume(entity, policy) : void 0;
             const fn = getEnclosingFn(node, fns);
             pushIfNotNull(violations, makeViolation(shared_1.PERFORMANCE_RULES.FETCH_ALL_FILTER_MEMORY, filePath, node.getStartLineNumber(), `Fetching all '${varName}' then filtering in memory${vol ? ` on '${entity}' (${vol.size} volume)` : ""} \u2014 move filter to where clause`, policy, vol, fn?.name, "Use a where clause in the query instead of .filter() in memory"));
@@ -15433,6 +15717,11 @@ var require_perf_pattern_detector = __commonJS({
         if (/\.(controller|handler|route|endpoint)\./i.test(fp))
           return true;
       }
+      if (ts_morph_1.Node.isMethodDeclaration(node)) {
+        const fp = node.getSourceFile().getFilePath();
+        if (/\.(controller|handler)\./i.test(fp))
+          return true;
+      }
       return false;
     }
     function detectMissingPagination(sourceFile, filePath, fns, policy, violations) {
@@ -15445,7 +15734,17 @@ var require_perf_pattern_detector = __commonJS({
         if (/page|skip|offset|cursor|take|limit|per_page|pageSize/i.test(bodyText))
           continue;
         const entityMatch = bodyText.match(/(\w+)\.(findMany|find|getMany|findAll)\s*\(/);
-        const entity = entityMatch ? entityMatch[1] : void 0;
+        let entity = entityMatch ? entityMatch[1] : void 0;
+        if (entity) {
+          const stripped = entity.replace(/Repo(sitory)?|Service|Model|Dao$/i, "");
+          if (stripped && stripped !== entity)
+            entity = stripped;
+        }
+        if (entity) {
+          const varEntity = extractEntityFromVariable(entity, sourceFile);
+          if (varEntity)
+            entity = varEntity;
+        }
         const vol = entity ? resolveVolume(entity, policy) : void 0;
         if (vol && vol.size === "S")
           continue;
@@ -15534,6 +15833,13 @@ var require_perf_pattern_detector = __commonJS({
         const args = node.getArguments();
         if (args.length > 0 && argsContainKey(node, "where"))
           return;
+        {
+          const countObj = expr.getExpression();
+          if (ts_morph_1.Node.isIdentifier(countObj) && /^(em|entityManager|manager|orm)$/i.test(countObj.getText())) {
+            if (args.length > 1)
+              return;
+          }
+        }
         let entity = extractEntity(node);
         if (!entity)
           entity = extractTypeORMEntity(node);
@@ -15587,7 +15893,7 @@ var require_perf_pattern_detector = __commonJS({
           const args = node.getArguments();
           if (args.length === 0)
             return;
-          const isUnsafe = method === "$queryRawUnsafe" || method === "$executeRawUnsafe";
+          let isUnsafe = method === "$queryRawUnsafe" || method === "$executeRawUnsafe";
           let sqlText = "";
           const firstArg = args[0];
           if (ts_morph_1.Node.isStringLiteral(firstArg)) {
@@ -15596,6 +15902,7 @@ var require_perf_pattern_detector = __commonJS({
             sqlText = firstArg.getText();
           } else if (ts_morph_1.Node.isBinaryExpression(firstArg)) {
             sqlText = firstArg.getText();
+            isUnsafe = true;
           }
           if (sqlText) {
             checkSqlForLimit(sqlText, filePath, node.getStartLineNumber(), fns, policy, violations, node, isUnsafe);
@@ -15616,6 +15923,21 @@ var require_perf_pattern_detector = __commonJS({
               debtPoints: policy.scoring.performance_risk_critical,
               gateAction: "block"
             });
+            violations.push({
+              category: "performance",
+              type: shared_1.PERFORMANCE_RULES.RAW_SQL_UNSAFE,
+              ruleId: shared_1.PERFORMANCE_RULES.RAW_SQL_UNSAFE,
+              severity: "critical",
+              source: "deterministic",
+              confidence: "high",
+              file: filePath,
+              line: node.getStartLineNumber(),
+              function: fn?.name,
+              message: `${method}() used \u2014 SQL injection risk via string interpolation/concatenation`,
+              suggestion: "Use $queryRaw with tagged template literals and parameterized queries instead",
+              debtPoints: policy.scoring.performance_risk_critical,
+              gateAction: "block"
+            });
           }
         }
         if (ts_morph_1.Node.isTaggedTemplateExpression(node)) {
@@ -15638,15 +15960,15 @@ var require_perf_pattern_detector = __commonJS({
           const fn2 = getEnclosingFn(node, fns);
           violations.push({
             category: "performance",
-            type: shared_1.PERFORMANCE_RULES.RAW_SQL_NO_LIMIT,
-            ruleId: shared_1.PERFORMANCE_RULES.RAW_SQL_NO_LIMIT,
+            type: shared_1.PERFORMANCE_RULES.RAW_SQL_UNSAFE,
+            ruleId: shared_1.PERFORMANCE_RULES.RAW_SQL_UNSAFE,
             severity: "critical",
             source: "deterministic",
             confidence: "high",
             file: filePath,
             line,
             function: fn2?.name,
-            message: `$queryRawUnsafe() used \u2014 SQL injection risk and unbounded query`,
+            message: `$queryRawUnsafe() used \u2014 SQL injection risk`,
             suggestion: "Use $queryRaw with tagged template literals instead of $queryRawUnsafe",
             debtPoints: policy.scoring.performance_risk_critical,
             gateAction: "block"
@@ -15664,22 +15986,24 @@ var require_perf_pattern_detector = __commonJS({
       const vol = entity ? resolveVolume(entity, policy) : void 0;
       const fn = getEnclosingFn(node, fns);
       if (isUnsafe) {
-        const severity = hasLimit ? "warning" : "critical";
         violations.push({
           category: "performance",
-          type: shared_1.PERFORMANCE_RULES.RAW_SQL_NO_LIMIT,
-          ruleId: shared_1.PERFORMANCE_RULES.RAW_SQL_NO_LIMIT,
-          severity,
+          type: shared_1.PERFORMANCE_RULES.RAW_SQL_UNSAFE,
+          ruleId: shared_1.PERFORMANCE_RULES.RAW_SQL_UNSAFE,
+          severity: "critical",
           source: "deterministic",
           confidence: "high",
           file: filePath,
           line,
           function: fn?.name,
-          message: hasLimit ? `$queryRawUnsafe() used${vol ? ` on '${entity}'` : ""} \u2014 SQL injection risk (has LIMIT but uses unsafe method)` : `$queryRawUnsafe() used${vol ? ` on '${entity}'` : ""} \u2014 SQL injection risk and unbounded query`,
+          message: `$queryRawUnsafe() used${vol ? ` on '${entity}'` : ""} \u2014 SQL injection risk`,
           suggestion: "Use $queryRaw with tagged template literals instead of $queryRawUnsafe",
-          debtPoints: severity === "critical" ? policy.scoring.performance_risk_critical : policy.scoring.performance_risk_warning,
-          gateAction: severity === "critical" ? "block" : "warn"
+          debtPoints: policy.scoring.performance_risk_critical,
+          gateAction: "block"
         });
+        if (!hasLimit) {
+          pushIfNotNull(violations, makeViolation(shared_1.PERFORMANCE_RULES.RAW_SQL_NO_LIMIT, filePath, line, `Raw SQL SELECT without LIMIT${vol ? ` on '${entity}' (${vol.size} volume)` : ""} \u2014 may return unbounded results`, policy, vol, fn?.name, "Add LIMIT clause to the SQL query"));
+        }
       } else {
         pushIfNotNull(violations, makeViolation(shared_1.PERFORMANCE_RULES.RAW_SQL_NO_LIMIT, filePath, line, `Raw SQL SELECT without LIMIT${vol ? ` on '${entity}' (${vol.size} volume)` : ""} \u2014 may return unbounded results`, policy, vol, fn?.name, "Add LIMIT clause to the SQL query"));
       }
@@ -15788,7 +16112,7 @@ var require_reliability_detector = __commonJS({
     function isNestJSInjectable(classNode) {
       return classNode.getDecorators().some((d) => {
         const name = d.getName();
-        return name === "Injectable" || name === "Controller" || name === "Resolver";
+        return name === "Injectable";
       });
     }
     function isInsideNestJSInjectable(node) {
@@ -16069,6 +16393,12 @@ var require_reliability_detector = __commonJS({
             violations.push(makeViolation(shared_1.RELIABILITY_RULES.UNHANDLED_PROMISE_REJECTION, filePath, node.getStartLineNumber(), `Fire-and-forget: '${calledName}' called without await \u2014 promise result is silently dropped`, policy, fn?.name, `Add await before the call or handle with .catch()`));
             return;
           }
+          const ASYNC_METHOD_PATTERNS = /^(fetch|get|send|post|put|patch|delete|process|execute|run|dispatch|emit|publish|notify|sync|upload|download|import|export|create|update|remove|find|search|load|save|handle|trigger)/i;
+          if (ASYNC_METHOD_PATTERNS.test(calledName)) {
+            const fn = getEnclosingFn(node, fns);
+            violations.push(makeViolation(shared_1.RELIABILITY_RULES.UNHANDLED_PROMISE_REJECTION, filePath, node.getStartLineNumber(), `Fire-and-forget: '${calledName}' called without await \u2014 promise result is silently dropped`, policy, fn?.name, `Add await before the call or handle with .catch()`));
+            return;
+          }
         } else if (ts_morph_1.Node.isIdentifier(callExpr)) {
           calledName = callExpr.getText();
           const matchFn = fns.find((f) => f.name === calledName && f.isAsync);
@@ -16276,6 +16606,7 @@ var require_reliability_detector = __commonJS({
         violations.push(makeViolation(shared_1.RELIABILITY_RULES.MISSING_ERROR_LOGGING, filePath, node.getStartLineNumber(), "catch block has no error logging or reporting", policy, fn?.name, "Add logger.error(err) or re-throw the error"));
       });
     }
+    var TRANSACTION_METHOD_NAMES = /* @__PURE__ */ new Set(["$transaction", "transaction"]);
     function detectTransactionNoTimeout(sourceFile, filePath, fns, policy, violations) {
       sourceFile.forEachDescendant((node) => {
         if (!ts_morph_1.Node.isCallExpression(node))
@@ -16283,7 +16614,7 @@ var require_reliability_detector = __commonJS({
         const expr = node.getExpression();
         if (!ts_morph_1.Node.isPropertyAccessExpression(expr))
           return;
-        if (expr.getName() !== "$transaction")
+        if (!TRANSACTION_METHOD_NAMES.has(expr.getName()))
           return;
         const args = node.getArguments();
         const hasTimeout = args.some((arg) => {
@@ -16299,6 +16630,8 @@ var require_reliability_detector = __commonJS({
       });
     }
     function detectMissingNullGuard(sourceFile, filePath, fns, policy, violations) {
+      detectNonNullAssertionOnNullable(sourceFile, filePath, fns, policy, violations);
+      detectUnsafeArrayIndexAccess(sourceFile, filePath, fns, policy, violations);
       sourceFile.forEachDescendant((node) => {
         if (!ts_morph_1.Node.isVariableDeclaration(node))
           return;
@@ -16352,6 +16685,62 @@ var require_reliability_detector = __commonJS({
         }
       });
     }
+    function detectNonNullAssertionOnNullable(sourceFile, filePath, fns, policy, violations) {
+      sourceFile.forEachDescendant((node) => {
+        if (!ts_morph_1.Node.isNonNullExpression(node))
+          return;
+        const inner = node.getExpression();
+        if (!ts_morph_1.Node.isIdentifier(inner))
+          return;
+        const varName = inner.getText();
+        const block = node.getFirstAncestorByKind(ts_morph_1.SyntaxKind.Block);
+        if (!block)
+          return;
+        const blockText = block.getText();
+        const nodePos = node.getStart() - block.getStart();
+        const textBefore = blockText.substring(0, nodePos);
+        const nullableAssign = new RegExp(`\\b${escapeRegex(varName)}\\s*=\\s*await\\s+\\S+\\.(findUnique|findFirst|findOne|findByPk)\\s*\\(`);
+        if (!nullableAssign.test(textBefore))
+          return;
+        const fn = getEnclosingFn(node, fns);
+        violations.push(makeViolation(shared_1.RELIABILITY_RULES.MISSING_NULL_GUARD, filePath, node.getStartLineNumber(), `Non-null assertion on '${varName}!' after nullable query \u2014 may throw at runtime`, policy, fn?.name, `Add a null guard: if (!${varName}) throw new NotFoundException();`));
+      });
+    }
+    function detectUnsafeArrayIndexAccess(sourceFile, filePath, fns, policy, violations) {
+      sourceFile.forEachDescendant((node) => {
+        if (!ts_morph_1.Node.isElementAccessExpression(node))
+          return;
+        const obj = node.getExpression();
+        if (!ts_morph_1.Node.isIdentifier(obj))
+          return;
+        const varName = obj.getText();
+        const indexArg = node.getArgumentExpression();
+        if (!indexArg || !ts_morph_1.Node.isNumericLiteral(indexArg))
+          return;
+        const parent = node.getParent();
+        if (!parent || !ts_morph_1.Node.isPropertyAccessExpression(parent))
+          return;
+        const block = node.getFirstAncestorByKind(ts_morph_1.SyntaxKind.Block);
+        if (!block)
+          return;
+        const blockText = block.getText();
+        const nodePos = node.getStart() - block.getStart();
+        const textBefore = blockText.substring(0, nodePos);
+        const arrayAssign = new RegExp(`\\b${escapeRegex(varName)}\\s*=\\s*await\\s+\\S+\\.(findMany|find|findAll|getMany|query)\\s*\\(`);
+        if (!arrayAssign.test(textBefore))
+          return;
+        const lengthGuard = new RegExp(`${escapeRegex(varName)}\\s*\\.\\s*length|${escapeRegex(varName)}\\s*\\[\\s*0\\s*\\]\\s*&&|if\\s*\\(\\s*!?${escapeRegex(varName)}`);
+        const assignMatch = textBefore.match(arrayAssign);
+        if (assignMatch) {
+          const assignEnd = textBefore.indexOf(assignMatch[0]) + assignMatch[0].length;
+          const textBetween = textBefore.substring(assignEnd);
+          if (lengthGuard.test(textBetween))
+            return;
+        }
+        const fn = getEnclosingFn(node, fns);
+        violations.push(makeViolation(shared_1.RELIABILITY_RULES.MISSING_NULL_GUARD, filePath, node.getStartLineNumber(), `Array index access '${varName}[${indexArg.getText()}]' without length guard \u2014 may throw on empty results`, policy, fn?.name, `Add a guard: if (${varName}.length === 0) throw new NotFoundException();`));
+      });
+    }
     function escapeRegex(str) {
       return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     }
@@ -18054,6 +18443,7 @@ var require_orchestrator = __commonJS({
         crossFileAnalysis = await (0, cross_file_analyzer_1.analyzeCrossFile)(unflaggedPatterns, importGraph, filteredInput, policy);
       }
       const complexityViolations = complexityDeltasToViolations(complexityDeltas, filteredInput);
+      const largeFileViolations = detectLargeFiles(filteredInput);
       const violations = [
         ...boundaryViolations,
         ...circularViolations,
@@ -18061,6 +18451,7 @@ var require_orchestrator = __commonJS({
         ...perfViolations,
         ...reliabilityViolations,
         ...complexityViolations,
+        ...largeFileViolations,
         ...duplicationResult.violations,
         ...missingTestsResult?.violations ?? [],
         ...deadCodeResult.violations,
@@ -18078,6 +18469,34 @@ var require_orchestrator = __commonJS({
         crossFileAnalysis
       };
     }
+    function detectLargeFiles(input) {
+      const threshold = shared_1.DEFAULT_LARGE_FILE_THRESHOLD;
+      const violations = [];
+      for (const file of input.changedFiles) {
+        if (file.status === "deleted")
+          continue;
+        if (!/\.(ts|tsx|js|jsx)$/.test(file.path))
+          continue;
+        const lineCount = file.content.split("\n").length;
+        if (lineCount <= threshold)
+          continue;
+        violations.push({
+          category: "maintainability",
+          type: shared_1.MAINTAINABILITY_RULES.LARGE_FILE,
+          ruleId: shared_1.MAINTAINABILITY_RULES.LARGE_FILE,
+          severity: "warning",
+          source: "deterministic",
+          confidence: "high",
+          file: file.path,
+          line: 1,
+          message: `File has ${lineCount} lines (threshold: ${threshold}) \u2014 consider splitting into smaller modules`,
+          suggestion: "Extract helper functions, types, or constants into separate files",
+          debtPoints: Math.floor((lineCount - threshold) / 50) + 1,
+          gateAction: "warn"
+        });
+      }
+      return violations;
+    }
     function complexityDeltasToViolations(deltas, input) {
       const threshold = shared_1.DEFAULT_COMPLEXITY_THRESHOLD;
       const violations = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "technical-debt-radar",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Stop Node.js production crashes before merge. 47 detection patterns across 5 categories.",
   "bin": {
     "radar": "dist/index.js",