trimference 0.3.0

package/dist/rules/index.d.ts

@@ -0,0 +1,14 @@
+import type { Rule } from "../types.js";
+import { noLlmCacheRule } from "./noLlmCache.js";
+import { hugeContextRule } from "./hugeContext.js";
+import { expensiveModelSimpleTaskRule } from "./expensiveModelSimpleTask.js";
+import { repeatedEmbeddingsRule } from "./repeatedEmbeddings.js";
+import { imageGenerationLoopRule } from "./imageGenerationLoop.js";
+import { frequentCronRule } from "./frequentCron.js";
+import { noTokenLimitRule } from "./noTokenLimit.js";
+import { sequentialLlmCallsRule } from "./sequentialLlmCalls.js";
+import { agentLoopWithoutBudgetRule } from "./agentLoopWithoutBudget.js";
+import { missingRateLimitRule } from "./missingRateLimit.js";
+export declare const rules: Rule[];
+export { noLlmCacheRule, hugeContextRule, expensiveModelSimpleTaskRule, repeatedEmbeddingsRule, imageGenerationLoopRule, frequentCronRule, noTokenLimitRule, sequentialLlmCallsRule, agentLoopWithoutBudgetRule, missingRateLimitRule, };
+//# sourceMappingURL=index.d.ts.map

package/dist/rules/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/rules/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,eAAO,MAAM,KAAK,EAAE,IAAI,EAWvB,CAAC;AAEF,OAAO,EACL,cAAc,EACd,eAAe,EACf,4BAA4B,EAC5B,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,GACrB,CAAC"}

package/dist/rules/index.js

@@ -0,0 +1,24 @@
+import { noLlmCacheRule } from "./noLlmCache.js";
+import { hugeContextRule } from "./hugeContext.js";
+import { expensiveModelSimpleTaskRule } from "./expensiveModelSimpleTask.js";
+import { repeatedEmbeddingsRule } from "./repeatedEmbeddings.js";
+import { imageGenerationLoopRule } from "./imageGenerationLoop.js";
+import { frequentCronRule } from "./frequentCron.js";
+import { noTokenLimitRule } from "./noTokenLimit.js";
+import { sequentialLlmCallsRule } from "./sequentialLlmCalls.js";
+import { agentLoopWithoutBudgetRule } from "./agentLoopWithoutBudget.js";
+import { missingRateLimitRule } from "./missingRateLimit.js";
+export const rules = [
+    noLlmCacheRule,
+    hugeContextRule,
+    expensiveModelSimpleTaskRule,
+    repeatedEmbeddingsRule,
+    imageGenerationLoopRule,
+    frequentCronRule,
+    noTokenLimitRule,
+    sequentialLlmCallsRule,
+    agentLoopWithoutBudgetRule,
+    missingRateLimitRule,
+];
+export { noLlmCacheRule, hugeContextRule, expensiveModelSimpleTaskRule, repeatedEmbeddingsRule, imageGenerationLoopRule, frequentCronRule, noTokenLimitRule, sequentialLlmCallsRule, agentLoopWithoutBudgetRule, missingRateLimitRule, };
+//# sourceMappingURL=index.js.map

package/dist/rules/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rules/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,CAAC,MAAM,KAAK,GAAW;IAC3B,cAAc;IACd,eAAe;IACf,4BAA4B;IAC5B,sBAAsB;IACtB,uBAAuB;IACvB,gBAAgB;IAChB,gBAAgB;IAChB,sBAAsB;IACtB,0BAA0B;IAC1B,oBAAoB;CACrB,CAAC;AAEF,OAAO,EACL,cAAc,EACd,eAAe,EACf,4BAA4B,EAC5B,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,GACrB,CAAC"}

package/dist/rules/missingRateLimit.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from "../types.js";
+export declare const missingRateLimitRule: Rule;
+//# sourceMappingURL=missingRateLimit.d.ts.map

package/dist/rules/missingRateLimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"missingRateLimit.d.ts","sourceRoot":"","sources":["../../src/rules/missingRateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,IAAI,EAAc,MAAM,aAAa,CAAC;AA6C7D,eAAO,MAAM,oBAAoB,EAAE,IA6ClC,CAAC"}

package/dist/rules/missingRateLimit.js

@@ -0,0 +1,78 @@
+import { makeImpact } from "../impact.js";
+import { LLM_CALL_PATTERNS, createFinding, findCodeMatchesInFile, } from "./helpers.js";
+/** Patterns suggesting this file is a public request handler / API route. */
+const ROUTE_INDICATORS = [
+    /export\s+async\s+function\s+(POST|GET|PUT|PATCH|DELETE)\b/,
+    /export\s+function\s+(POST|GET|PUT|PATCH|DELETE)\b/,
+    /NextResponse/,
+    /Response\.json/,
+];
+/** File-path hints for framework route conventions. */
+const ROUTE_PATH_HINTS = ["app/api", "pages/api"];
+/**
+ * Terms that suggest a rate limit / quota / abuse control is already present.
+ * Broad on purpose — a false negative (staying quiet) is safer than noise here.
+ */
+const RATE_LIMIT_TERMS = [
+    "rateLimit",
+    "ratelimit",
+    "rateLimiter",
+    "quota",
+    "throttle",
+    "upstash",
+    "redis",
+];
+const FIX_RECIPE = [
+    "Identify the caller using user ID, API key, or IP.",
+    "Check a rate limit before calling the model.",
+    "Return a 429 response when the limit is exceeded.",
+    "Log excessive usage for review.",
+];
+function looksLikeRoute(file) {
+    if (ROUTE_PATH_HINTS.some((hint) => file.path.includes(hint)))
+        return true;
+    return findCodeMatchesInFile(file, ROUTE_INDICATORS).length > 0;
+}
+export const missingRateLimitRule = {
+    id: "missing-rate-limit",
+    title: "Public AI route without obvious rate limit",
+    severity: "medium",
+    wasteCategory: "repeated-inference",
+    description: "Flags files that look like public API routes and call a model without a nearby rate limit or quota check.",
+    recommendation: "Add per-user/IP rate limits, quotas, or abuse controls around public AI endpoints.",
+    fixRecipe: FIX_RECIPE,
+    scan(file) {
+        if (!looksLikeRoute(file))
+            return [];
+        const llmCalls = findCodeMatchesInFile(file, LLM_CALL_PATTERNS);
+        if (llmCalls.length === 0)
+            return [];
+        // If any rate-limit/quota term appears in the file, assume it's covered.
+        if (findCodeMatchesInFile(file, RATE_LIMIT_TERMS).length > 0)
+            return [];
+        // Report once per file, anchored on the first model call.
+        return [
+            createFinding({
+                ruleId: this.id,
+                title: this.title,
+                severity: this.severity,
+                wasteCategory: this.wasteCategory,
+                file,
+                index: llmCalls[0].index,
+                message: "This public AI route calls a model without an obvious rate limit or quota check.",
+                recommendation: this.recommendation,
+                fixRecipe: this.fixRecipe,
+                impact: makeImpact({
+                    computeWaste: "medium",
+                    carbonImpact: "low",
+                    waterImpact: "low",
+                    costImpact: "high",
+                    confidence: "low",
+                    score: 68,
+                    explanation: "Public AI endpoints without rate limits can be abused into large volumes of avoidable model calls.",
+                }),
+            }),
+        ];
+    },
+};
+//# sourceMappingURL=missingRateLimit.js.map

package/dist/rules/missingRateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"missingRateLimit.js","sourceRoot":"","sources":["../../src/rules/missingRateLimit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAEtB,6EAA6E;AAC7E,MAAM,gBAAgB,GAA2B;IAC/C,2DAA2D;IAC3D,mDAAmD;IACnD,cAAc;IACd,gBAAgB;CACjB,CAAC;AAEF,uDAAuD;AACvD,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AAElD;;;GAGG;AACH,MAAM,gBAAgB,GAA2B;IAC/C,WAAW;IACX,WAAW;IACX,aAAa;IACb,OAAO;IACP,UAAU;IACV,SAAS;IACT,OAAO;CACR,CAAC;AAEF,MAAM,UAAU,GAAG;IACjB,oDAAoD;IACpD,8CAA8C;IAC9C,mDAAmD;IACnD,iCAAiC;CAClC,CAAC;AAEF,SAAS,cAAc,CAAC,IAAgB;IACtC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,OAAO,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAS;IACxC,EAAE,EAAE,oBAAoB;IACxB,KAAK,EAAE,4CAA4C;IACnD,QAAQ,EAAE,QAAQ;IAClB,aAAa,EAAE,oBAAoB;IACnC,WAAW,EACT,2GAA2G;IAC7G,cAAc,EACZ,oFAAoF;IACtF,SAAS,EAAE,UAAU;IACrB,IAAI,CAAC,IAAgB;QACnB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,CAAC;QAErC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAErC,yEAAyE;QACzE,IAAI,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QAExE,0DAA0D;QAC1D,OAAO;YACL,aAAa,CAAC;gBACZ,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,IAAI;gBACJ,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAE,CAAC,KAAK;gBACzB,OAAO,EACL,kFAAkF;gBACpF,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,MAAM,EAAE,UAAU,CAAC;oBACjB,YAAY,EAAE,QAAQ;oBACtB,YAAY,EAAE,KAAK;oBACnB,WAAW,EAAE,KAAK;oBAClB,UAAU,EAAE,MAAM;oBAClB,UAAU,EAAE,KAAK;oBACjB,KAAK,EAAE,EAAE;oBACT,WAAW,EACT,oGAAoG;iBACvG,CAAC;aACH,CAAC;SACH,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/rules/noLlmCache.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from "../types.js";
+export declare const noLlmCacheRule: Rule;
+//# sourceMappingURL=noLlmCache.d.ts.map

package/dist/rules/noLlmCache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"noLlmCache.d.ts","sourceRoot":"","sources":["../../src/rules/noLlmCache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,IAAI,EAAc,MAAM,aAAa,CAAC;AA2C7D,eAAO,MAAM,cAAc,EAAE,IA+C5B,CAAC"}

package/dist/rules/noLlmCache.js

@@ -0,0 +1,71 @@
+import { makeImpact } from "../impact.js";
+import { LLM_CALL_PATTERNS, createFinding, dedupeFindings, findCodeMatchesInFile, hasNearby, hasNearbyCode, isTestFile, } from "./helpers.js";
+const CACHE_TERMS = [
+    "cache",
+    "cached",
+    "redis",
+    "kv",
+    "upstash",
+    "unstable_cache",
+    "memoize",
+    "dedupe",
+    "lru",
+    "Map(",
+    "getCached",
+    "setCached",
+];
+const FIX_RECIPE = [
+    "Create a cache key from model, system prompt, user prompt, and relevant parameters.",
+    "Check Redis, KV, or an in-memory cache before calling the provider.",
+    "Store successful deterministic responses with a sensible TTL.",
+    "Skip caching for highly personalized, sensitive, or rapidly changing outputs.",
+];
+const REUSE_SIGNALS = [
+    /classif/i,
+    /extract/i,
+    /categor/i,
+    /tag/i,
+    /template/i,
+    /deterministic/i,
+];
+export const noLlmCacheRule = {
+    id: "no-llm-cache",
+    title: "LLM call without obvious caching",
+    severity: "medium",
+    wasteCategory: "repeated-inference",
+    description: "Flags likely LLM calls that have no nearby caching, deduping, or memoization terms.",
+    recommendation: "Add request-level or semantic caching for repeated prompts, deterministic tasks, and expensive generations.",
+    fixRecipe: FIX_RECIPE,
+    scan(file) {
+        const findings = [];
+        const testFile = isTestFile(file.path);
+        for (const match of findCodeMatchesInFile(file, LLM_CALL_PATTERNS)) {
+            if (hasNearbyCode(file, match.index, CACHE_TERMS, 20))
+                continue;
+            const likelyReusable = hasNearby(file, match.index, REUSE_SIGNALS, 12);
+            findings.push(createFinding({
+                ruleId: this.id,
+                title: this.title,
+                // Downgrade noisy hits in test files instead of over-reporting.
+                severity: testFile ? "low" : likelyReusable ? "high" : "medium",
+                wasteCategory: this.wasteCategory,
+                file,
+                index: match.index,
+                message: "This LLM call does not appear to use caching. Repeated prompts may trigger avoidable model inference.",
+                recommendation: this.recommendation,
+                fixRecipe: this.fixRecipe,
+                impact: makeImpact({
+                    computeWaste: "high",
+                    carbonImpact: "medium",
+                    waterImpact: "medium",
+                    costImpact: "high",
+                    confidence: testFile || !likelyReusable ? "low" : "medium",
+                    score: testFile ? 30 : likelyReusable ? 80 : 55,
+                    explanation: "Repeated uncached model calls can create avoidable token processing and infrastructure demand.",
+                }),
+            }));
+        }
+        return dedupeFindings(findings);
+    },
+};
+//# sourceMappingURL=noLlmCache.js.map

package/dist/rules/noLlmCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"noLlmCache.js","sourceRoot":"","sources":["../../src/rules/noLlmCache.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,SAAS,EACT,aAAa,EACb,UAAU,GACX,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,GAA2B;IAC1C,OAAO;IACP,QAAQ;IACR,OAAO;IACP,IAAI;IACJ,SAAS;IACT,gBAAgB;IAChB,SAAS;IACT,QAAQ;IACR,KAAK;IACL,MAAM;IACN,WAAW;IACX,WAAW;CACZ,CAAC;AAEF,MAAM,UAAU,GAAG;IACjB,qFAAqF;IACrF,qEAAqE;IACrE,+DAA+D;IAC/D,+EAA+E;CAChF,CAAC;AAEF,MAAM,aAAa,GAA2B;IAC5C,UAAU;IACV,UAAU;IACV,UAAU;IACV,MAAM;IACN,WAAW;IACX,gBAAgB;CACjB,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAS;IAClC,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,kCAAkC;IACzC,QAAQ,EAAE,QAAQ;IAClB,aAAa,EAAE,oBAAoB;IACnC,WAAW,EACT,qFAAqF;IACvF,cAAc,EACZ,6GAA6G;IAC/G,SAAS,EAAE,UAAU;IACrB,IAAI,CAAC,IAAgB;QACnB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEvC,KAAK,MAAM,KAAK,IAAI,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,CAAC;YACnE,IAAI,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,CAAC;gBAAE,SAAS;YAChE,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;YAEvE,QAAQ,CAAC,IAAI,CACX,aAAa,CAAC;gBACZ,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,gEAAgE;gBAChE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;gBAC/D,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,IAAI;gBACJ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EACL,uGAAuG;gBACzG,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,MAAM,EAAE,UAAU,CAAC;oBACjB,YAAY,EAAE,MAAM;oBACpB,YAAY,EAAE,QAAQ;oBACtB,WAAW,EAAE,QAAQ;oBACrB,UAAU,EAAE,MAAM;oBAClB,UAAU,EAAE,QAAQ,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;oBAC1D,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;oBAC/C,WAAW,EACT,gGAAgG;iBACnG,CAAC;aACH,CAAC,CACH,CAAC;QACJ,CAAC;QAED,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;CACF,CAAC"}

package/dist/rules/noTokenLimit.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from "../types.js";
+export declare const noTokenLimitRule: Rule;
+//# sourceMappingURL=noTokenLimit.d.ts.map

package/dist/rules/noTokenLimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"noTokenLimit.d.ts","sourceRoot":"","sources":["../../src/rules/noTokenLimit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,IAAI,EAAc,MAAM,aAAa,CAAC;AAyB7D,eAAO,MAAM,gBAAgB,EAAE,IAkD9B,CAAC"}

package/dist/rules/noTokenLimit.js

@@ -0,0 +1,59 @@
+import { makeImpact } from "../impact.js";
+import { LLM_CALL_PATTERNS, createFinding, dedupeFindings, findCodeMatchesInFile, hasNearbyCode, } from "./helpers.js";
+const TOKEN_LIMIT_TERMS = [
+    "max_tokens",
+    "maxTokens",
+    "max_output_tokens",
+    "maxOutputTokens",
+    "max_completion_tokens",
+];
+const FIX_RECIPE = [
+    "Add an explicit output token limit.",
+    "Pick the limit based on the task type.",
+    "Use stricter limits for classification and extraction.",
+    "Add tests for runaway or unexpectedly long outputs.",
+];
+export const noTokenLimitRule = {
+    id: "no-token-limit",
+    title: "No obvious output token limit",
+    severity: "low",
+    wasteCategory: "unbounded-generation",
+    description: "Flags LLM calls that have no explicit output token limit set nearby.",
+    recommendation: "Set an output token cap appropriate for the task to reduce runaway generations.",
+    fixRecipe: FIX_RECIPE,
+    scan(file) {
+        const findings = [];
+        const llmCalls = findCodeMatchesInFile(file, LLM_CALL_PATTERNS);
+        // Only flag when the file clearly contains at least one LLM call.
+        if (llmCalls.length === 0)
+            return findings;
+        for (const match of llmCalls) {
+            // A token limit anywhere within ~25 lines counts as covered.
+            if (hasNearbyCode(file, match.index, TOKEN_LIMIT_TERMS, 25))
+                continue;
+            findings.push(createFinding({
+                ruleId: this.id,
+                title: this.title,
+                severity: this.severity,
+                wasteCategory: this.wasteCategory,
+                file,
+                index: match.index,
+                message: "No explicit output token limit was detected near this model call.",
+                recommendation: this.recommendation,
+                fixRecipe: this.fixRecipe,
+                impact: makeImpact({
+                    computeWaste: "medium",
+                    carbonImpact: "low",
+                    waterImpact: "low",
+                    costImpact: "medium",
+                    confidence: "medium",
+                    score: 45,
+                    explanation: "Output limits help prevent unnecessarily long generations and unexpected token usage.",
+                }),
+            }));
+        }
+        // Keep this rule quiet: at most one finding per file.
+        return dedupeFindings(findings).slice(0, 1);
+    },
+};
+//# sourceMappingURL=noTokenLimit.js.map

package/dist/rules/noTokenLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"noTokenLimit.js","sourceRoot":"","sources":["../../src/rules/noTokenLimit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,aAAa,GACd,MAAM,cAAc,CAAC;AAEtB,MAAM,iBAAiB,GAA2B;IAChD,YAAY;IACZ,WAAW;IACX,mBAAmB;IACnB,iBAAiB;IACjB,uBAAuB;CACxB,CAAC;AAEF,MAAM,UAAU,GAAG;IACjB,qCAAqC;IACrC,wCAAwC;IACxC,wDAAwD;IACxD,qDAAqD;CACtD,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAS;IACpC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,+BAA+B;IACtC,QAAQ,EAAE,KAAK;IACf,aAAa,EAAE,sBAAsB;IACrC,WAAW,EACT,sEAAsE;IACxE,cAAc,EACZ,iFAAiF;IACnF,SAAS,EAAE,UAAU;IACrB,IAAI,CAAC,IAAgB;QACnB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAEhE,kEAAkE;QAClE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAE3C,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,6DAA6D;YAC7D,IAAI,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,iBAAiB,EAAE,EAAE,CAAC;gBAAE,SAAS;YAEtE,QAAQ,CAAC,IAAI,CACX,aAAa,CAAC;gBACZ,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,IAAI;gBACJ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EACL,mEAAmE;gBACrE,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,MAAM,EAAE,UAAU,CAAC;oBACjB,YAAY,EAAE,QAAQ;oBACtB,YAAY,EAAE,KAAK;oBACnB,WAAW,EAAE,KAAK;oBAClB,UAAU,EAAE,QAAQ;oBACpB,UAAU,EAAE,QAAQ;oBACpB,KAAK,EAAE,EAAE;oBACT,WAAW,EACT,uFAAuF;iBAC1F,CAAC;aACH,CAAC,CACH,CAAC;QACJ,CAAC;QAED,sDAAsD;QACtD,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;CACF,CAAC"}

package/dist/rules/repeatedEmbeddings.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from "../types.js";
+export declare const repeatedEmbeddingsRule: Rule;
+//# sourceMappingURL=repeatedEmbeddings.d.ts.map

package/dist/rules/repeatedEmbeddings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repeatedEmbeddings.d.ts","sourceRoot":"","sources":["../../src/rules/repeatedEmbeddings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,IAAI,EAAc,MAAM,aAAa,CAAC;AAiD7D,eAAO,MAAM,sBAAsB,EAAE,IAkDpC,CAAC"}

package/dist/rules/repeatedEmbeddings.js

@@ -0,0 +1,81 @@
+import { makeImpact } from "../impact.js";
+import { createFinding, dedupeFindings, findCodeMatchesInFile, hasNearbyCode, } from "./helpers.js";
+const EMBEDDING_PATTERNS = [
+    /embeddings\.create/i,
+    /createEmbedding/i,
+    /\bembedMany\s*\(/i,
+    /\bembed\s*\(/i,
+];
+const LOOP_TERMS = [
+    /for\s*\(/i,
+    /for\s+await/i,
+    /while\s*\(/i,
+    /\.map\s*\(/i,
+    /forEach\s*\(/i,
+];
+const PERSISTENCE_TERMS = [
+    "vectorStore",
+    "pinecone",
+    "weaviate",
+    "qdrant",
+    "chroma",
+    "supabase",
+    "pgvector",
+    "db.",
+    "database",
+    "insert",
+    "upsert",
+    "cache",
+    "exists",
+    "findUnique",
+    "findFirst",
+];
+const FIX_RECIPE = [
+    "Hash the source text or document ID.",
+    "Check whether an embedding already exists before generating a new one.",
+    "Persist embeddings in a vector store or database.",
+    "Re-embed only when the source content changes.",
+];
+export const repeatedEmbeddingsRule = {
+    id: "repeated-embeddings",
+    title: "Embeddings may be regenerated repeatedly",
+    severity: "high",
+    wasteCategory: "redundant-embedding",
+    description: "Flags embedding calls near loops that have no obvious persistence, reuse, or existence check.",
+    recommendation: "Persist embeddings for unchanged text and check for existing vectors before generating new ones.",
+    fixRecipe: FIX_RECIPE,
+    scan(file) {
+        const findings = [];
+        for (const match of findCodeMatchesInFile(file, EMBEDDING_PATTERNS)) {
+            const inLoop = hasNearbyCode(file, match.index, LOOP_TERMS, 20);
+            const persisted = hasNearbyCode(file, match.index, PERSISTENCE_TERMS, 20);
+            // If embeddings are persisted / reused nearby, there's no waste to flag.
+            if (persisted)
+                continue;
+            // Highest concern is embeddings inside a loop; a lone uncached call is a
+            // lower-confidence nudge.
+            findings.push(createFinding({
+                ruleId: this.id,
+                title: this.title,
+                severity: this.severity,
+                wasteCategory: this.wasteCategory,
+                file,
+                index: match.index,
+                message: "Embeddings appear to be generated repeatedly without obvious persistence or reuse.",
+                recommendation: this.recommendation,
+                fixRecipe: this.fixRecipe,
+                impact: makeImpact({
+                    computeWaste: "high",
+                    carbonImpact: "medium",
+                    waterImpact: "medium",
+                    costImpact: "medium",
+                    confidence: inLoop ? "medium" : "low",
+                    score: inLoop ? 80 : 60,
+                    explanation: "Re-embedding unchanged content creates avoidable repeated compute.",
+                }),
+            }));
+        }
+        return dedupeFindings(findings);
+    },
+};
+//# sourceMappingURL=repeatedEmbeddings.js.map

package/dist/rules/repeatedEmbeddings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repeatedEmbeddings.js","sourceRoot":"","sources":["../../src/rules/repeatedEmbeddings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,aAAa,EACb,cAAc,EACd,qBAAqB,EACrB,aAAa,GACd,MAAM,cAAc,CAAC;AAEtB,MAAM,kBAAkB,GAA2B;IACjD,qBAAqB;IACrB,kBAAkB;IAClB,mBAAmB;IACnB,eAAe;CAChB,CAAC;AAEF,MAAM,UAAU,GAA2B;IACzC,WAAW;IACX,cAAc;IACd,aAAa;IACb,aAAa;IACb,eAAe;CAChB,CAAC;AAEF,MAAM,iBAAiB,GAA2B;IAChD,aAAa;IACb,UAAU;IACV,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,UAAU;IACV,KAAK;IACL,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,YAAY;IACZ,WAAW;CACZ,CAAC;AAEF,MAAM,UAAU,GAAG;IACjB,sCAAsC;IACtC,wEAAwE;IACxE,mDAAmD;IACnD,gDAAgD;CACjD,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAS;IAC1C,EAAE,EAAE,qBAAqB;IACzB,KAAK,EAAE,0CAA0C;IACjD,QAAQ,EAAE,MAAM;IAChB,aAAa,EAAE,qBAAqB;IACpC,WAAW,EACT,+FAA+F;IACjG,cAAc,EACZ,kGAAkG;IACpG,SAAS,EAAE,UAAU;IACrB,IAAI,CAAC,IAAgB;QACnB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,KAAK,MAAM,KAAK,IAAI,qBAAqB,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE,CAAC;YACpE,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;YAChE,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;YAE1E,yEAAyE;YACzE,IAAI,SAAS;gBAAE,SAAS;YAExB,yEAAyE;YACzE,0BAA0B;YAC1B,QAAQ,CAAC,IAAI,CACX,aAAa,CAAC;gBACZ,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,IAAI;gBACJ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EACL,oFAAoF;gBACtF,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,MAAM,EAAE,UAAU,CAAC;oBACjB,YAAY,EAAE,MAAM;oBACpB,YAAY,EAAE,QAAQ;oBACtB,WAAW,EAAE,QAAQ;oBACrB,UAAU,EAAE,QAAQ;oBACpB,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;oBACrC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;oBACvB,WAAW,EACT,oEAAoE;iBACvE,CAAC;aACH,CAAC,CACH,CAAC;QACJ,CAAC;QAED,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;CACF,CAAC"}

package/dist/rules/sequentialLlmCalls.d.ts

@@ -0,0 +1,3 @@
+import type { Rule } from "../types.js";
+export declare const sequentialLlmCallsRule: Rule;
+//# sourceMappingURL=sequentialLlmCalls.d.ts.map

package/dist/rules/sequentialLlmCalls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sequentialLlmCalls.d.ts","sourceRoot":"","sources":["../../src/rules/sequentialLlmCalls.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,IAAI,EAAc,MAAM,aAAa,CAAC;AAiB7D,eAAO,MAAM,sBAAsB,EAAE,IAuCpC,CAAC"}

package/dist/rules/sequentialLlmCalls.js

@@ -0,0 +1,69 @@
+import { makeImpact } from "../impact.js";
+import { LLM_CALL_PATTERNS, createFinding, findCodeMatchesInFile, } from "./helpers.js";
+const WINDOW_LINES = 80;
+const FIX_RECIPE = [
+    "Check whether the calls can be combined into one prompt.",
+    "Cache intermediate outputs.",
+    "Parallelize independent calls.",
+    "Replace simple follow-up calls with rules or smaller models.",
+];
+export const sequentialLlmCallsRule = {
+    id: "sequential-llm-calls",
+    title: "Nearby LLM calls may multiply work",
+    severity: "medium",
+    wasteCategory: "repeated-inference",
+    description: "Flags files where two or more likely LLM calls appear within a close range of each other.",
+    recommendation: "Consider combining prompts, batching, parallelizing independent calls, or caching intermediate results.",
+    fixRecipe: FIX_RECIPE,
+    scan(file) {
+        const calls = findCodeMatchesInFile(file, LLM_CALL_PATTERNS);
+        if (calls.length < 2)
+            return [];
+        // Report once per cluster of >= 2 calls within WINDOW_LINES, anchored on
+        // the second call in the cluster.
+        const findings = [];
+        let clusterStartLine = calls[0].line;
+        let clusterCount = 1;
+        let reported = false;
+        for (let i = 1; i < calls.length; i++) {
+            const call = calls[i];
+            if (call.line - clusterStartLine <= WINDOW_LINES) {
+                clusterCount++;
+                if (clusterCount === 2 && !reported) {
+                    findings.push(buildFinding(file, call.index));
+                    reported = true;
+                }
+            }
+            else {
+                // Start a new cluster.
+                clusterStartLine = call.line;
+                clusterCount = 1;
+                reported = false;
+            }
+        }
+        return findings;
+    },
+};
+function buildFinding(file, index) {
+    return createFinding({
+        ruleId: sequentialLlmCallsRule.id,
+        title: sequentialLlmCallsRule.title,
+        severity: sequentialLlmCallsRule.severity,
+        wasteCategory: sequentialLlmCallsRule.wasteCategory,
+        file,
+        index,
+        message: "Multiple LLM calls appear close together. Verify whether they run in the same execution flow.",
+        recommendation: sequentialLlmCallsRule.recommendation,
+        fixRecipe: sequentialLlmCallsRule.fixRecipe,
+        impact: makeImpact({
+            computeWaste: "medium",
+            carbonImpact: "medium",
+            waterImpact: "medium",
+            costImpact: "high",
+            confidence: "low",
+            score: 70,
+            explanation: "Multi-call chains can multiply token usage and latency if not carefully designed.",
+        }),
+    });
+}
+//# sourceMappingURL=sequentialLlmCalls.js.map

package/dist/rules/sequentialLlmCalls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sequentialLlmCalls.js","sourceRoot":"","sources":["../../src/rules/sequentialLlmCalls.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAEtB,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,MAAM,UAAU,GAAG;IACjB,0DAA0D;IAC1D,6BAA6B;IAC7B,gCAAgC;IAChC,8DAA8D;CAC/D,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAS;IAC1C,EAAE,EAAE,sBAAsB;IAC1B,KAAK,EAAE,oCAAoC;IAC3C,QAAQ,EAAE,QAAQ;IAClB,aAAa,EAAE,oBAAoB;IACnC,WAAW,EACT,2FAA2F;IAC7F,cAAc,EACZ,yGAAyG;IAC3G,SAAS,EAAE,UAAU;IACrB,IAAI,CAAC,IAAgB;QACnB,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC7D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QAEhC,yEAAyE;QACzE,kCAAkC;QAClC,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,IAAI,gBAAgB,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC;QACtC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACvB,IAAI,IAAI,CAAC,IAAI,GAAG,gBAAgB,IAAI,YAAY,EAAE,CAAC;gBACjD,YAAY,EAAE,CAAC;gBACf,IAAI,YAAY,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACpC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC9C,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,uBAAuB;gBACvB,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC;gBAC7B,YAAY,GAAG,CAAC,CAAC;gBACjB,QAAQ,GAAG,KAAK,CAAC;YACnB,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,SAAS,YAAY,CAAC,IAAgB,EAAE,KAAa;IACnD,OAAO,aAAa,CAAC;QACnB,MAAM,EAAE,sBAAsB,CAAC,EAAE;QACjC,KAAK,EAAE,sBAAsB,CAAC,KAAK;QACnC,QAAQ,EAAE,sBAAsB,CAAC,QAAQ;QACzC,aAAa,EAAE,sBAAsB,CAAC,aAAa;QACnD,IAAI;QACJ,KAAK;QACL,OAAO,EACL,+FAA+F;QACjG,cAAc,EAAE,sBAAsB,CAAC,cAAc;QACrD,SAAS,EAAE,sBAAsB,CAAC,SAAS;QAC3C,MAAM,EAAE,UAAU,CAAC;YACjB,YAAY,EAAE,QAAQ;YACtB,YAAY,EAAE,QAAQ;YACtB,WAAW,EAAE,QAAQ;YACrB,UAAU,EAAE,MAAM;YAClB,UAAU,EAAE,KAAK;YACjB,KAAK,EAAE,EAAE;YACT,WAAW,EACT,mFAAmF;SACtF,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}

package/dist/scanner.d.ts

@@ -0,0 +1,23 @@
+import type { Provider } from "./models.js";
+import type { Finding, RuleContext, ScanResult, Severity, SourceFile } from "./types.js";
+export type ScannerOptions = {
+    path: string;
+    minSeverity?: Severity;
+    ignoredRules?: string[];
+    ignoredPaths?: string[];
+    provider?: Provider;
+    /** Stable finding fingerprints to suppress as accepted baseline debt. */
+    baselineKeys?: Iterable<string>;
+    /** Optional exact relative paths to scan, used by changed-files mode. */
+    includedPaths?: Iterable<string>;
+};
+/** Discover scannable files under a directory (or a single file). */
+export declare function discoverFiles(rootPath: string): Promise<string[]>;
+/** Run all rules against a single in-memory source file. */
+export declare function runRules(file: SourceFile, context?: RuleContext, ignoredRules?: Set<string>, onRuleError?: (ruleId: string, error: unknown) => void): Finding[];
+export declare function sortFindings(findings: Finding[]): Finding[];
+/** Scan a path and return sorted findings plus a summary. */
+export declare function scan(options: ScannerOptions): Promise<ScanResult>;
+/** Stable-enough key for accepting existing findings in a baseline file. */
+export declare function findingFingerprint(finding: Finding): string;
+//# sourceMappingURL=scanner.d.ts.map

package/dist/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG5C,OAAO,KAAK,EACV,OAAO,EACP,WAAW,EACX,UAAU,EAEV,QAAQ,EACR,UAAU,EAEX,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,yEAAyE;IACzE,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,yEAAyE;IACzE,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAClC,CAAC;AASF,qEAAqE;AACrE,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAqBvE;AAwBD,4DAA4D;AAC5D,wBAAgB,QAAQ,CACtB,IAAI,EAAE,UAAU,EAChB,OAAO,CAAC,EAAE,WAAW,EACrB,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC1B,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,GACrD,OAAO,EAAE,CAiBX;AAiBD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAS3D;AA6ED,6DAA6D;AAC7D,wBAAsB,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAkDvE;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAM3D"}