truecourse 0.4.3 → 0.4.5

package/cli.mjs

@@ -3492,9 +3492,7 @@ var require_src = __commonJS({
 
 // node_modules/.pnpm/@clack+core@1.2.0/node_modules/@clack/core/dist/index.mjs
 import { stdout as S, stdin as $ } from "node:process";
-import * as _ from "node:readline";
 import P from "node:readline";
-import { ReadStream as D } from "node:tty";
 function d(r, t2, e) {
   if (!e.some((o) => !o.disabled)) return r;
   const s = r + t2, i = Math.max(e.length - 1, 0), n = s < 0 ? i : s > i ? 0 : s;
@@ -3520,27 +3518,6 @@ function w(r, t2) {
   const e = r;
   e.isTTY && e.setRawMode(t2);
 }
-function z({ input: r = $, output: t2 = S, overwrite: e = true, hideCursor: s = true } = {}) {
-  const i = _.createInterface({ input: r, output: t2, prompt: "", tabSize: 1 });
-  _.emitKeypressEvents(r, i), r instanceof D && r.isTTY && r.setRawMode(true);
-  const n = (o, { name: a, sequence: h }) => {
-    const l = String(o);
-    if (V([l, a, h], "cancel")) {
-      s && t2.write(import_sisteransi.cursor.show), process.exit(0);
-      return;
-    }
-    if (!e) return;
-    const f = a === "return" ? 0 : -1, v = a === "return" ? -1 : 0;
-    _.moveCursor(t2, f, v, () => {
-      _.clearLine(t2, 1, () => {
-        r.once("keypress", n);
-      });
-    });
-  };
-  return s && t2.write(import_sisteransi.cursor.hide), r.once("keypress", n), () => {
-    r.off("keypress", n), s && t2.write(import_sisteransi.cursor.show), r instanceof D && r.isTTY && !Y && r.setRawMode(false), i.terminal = false, i.close();
-  };
-}
 function R(r, t2, e, s = e) {
   const i = O(r ?? S);
   return wrapAnsi(t2, i - e.length, { hard: true, trim: false }).split(`
@@ -3734,7 +3711,7 @@ import P2 from "node:process";
 function Ze() {
   return P2.platform !== "win32" ? P2.env.TERM !== "linux" : !!P2.env.CI || !!P2.env.WT_SESSION || !!P2.env.TERMINUS_SUBLIME || P2.env.ConEmuTask === "{cmd::Cmder}" || P2.env.TERM_PROGRAM === "Terminus-Sublime" || P2.env.TERM_PROGRAM === "vscode" || P2.env.TERM === "xterm-256color" || P2.env.TERM === "alacritty" || P2.env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
-var import_sisteransi2, ee, ae, w2, _e, oe, ue, F, le, d2, E2, Ie, Ee, z2, H2, te, U, J, xe, se, ce, Ge, $e, de, Oe, he, pe, me, ge, V2, ye, et2, Y2, ot2, O2, pt, mt, gt, Ct, fe, Ve, re, _t, je;
+var import_sisteransi2, ee, w2, _e, oe, ue, F, le, d2, E2, Ie, Ee, z2, H2, te, U, J, xe, se, ce, Ge, $e, de, Oe, he, pe, me, ge, V2, ye, et2, Y2, ot2, O2, pt, mt, gt, Ve, re, _t, je;
 var init_dist4 = __esm({
   "node_modules/.pnpm/@clack+prompts@1.2.0/node_modules/@clack/prompts/dist/index.mjs"() {
     init_dist3();
@@ -3743,7 +3720,6 @@ var init_dist4 = __esm({
     init_dist2();
     import_sisteransi2 = __toESM(require_src(), 1);
     ee = Ze();
-    ae = () => process.env.CI === "true";
     w2 = (e, i) => ee ? e : i;
     _e = w2("\u25C6", "*");
     oe = w2("\u25A0", "x");
@@ -3820,7 +3796,7 @@ var init_dist4 = __esm({
       }
       if (f > $2) {
         let b = 0, x = 0, G2 = f;
-        const M2 = e - v, R2 = (j2, D2) => et2(h, G2, j2, D2, $2);
+        const M2 = e - v, R2 = (j2, D) => et2(h, G2, j2, D, $2);
         m ? ({ lineCount: G2, removals: b } = R2(0, M2), G2 > $2 && ({ lineCount: G2, removals: x } = R2(M2 + 1, h.length))) : ({ lineCount: G2, removals: x } = R2(M2 + 1, h.length), G2 > $2 && ({ lineCount: G2, removals: b } = R2(0, M2))), b > 0 && (m = true, h.splice(0, b)), x > 0 && (g = true, h.splice(h.length - x, x));
       }
       const C2 = [];
@@ -3899,59 +3875,6 @@ ${t("gray", E2)}  ` : "";
 
 `);
     };
-    Ct = (e) => t("magenta", e);
-    fe = ({ indicator: e = "dots", onCancel: i, output: s = process.stdout, cancelMessage: r, errorMessage: u2, frames: n = ee ? ["\u25D2", "\u25D0", "\u25D3", "\u25D1"] : ["\u2022", "o", "O", "0"], delay: o = ee ? 80 : 120, signal: c2, ...a } = {}) => {
-      const l = ae();
-      let $2, y, p2 = false, m = false, g = "", S2, h = performance.now();
-      const f = O(s), v = a?.styleFrame ?? Ct, T = (_2) => {
-        const A2 = _2 > 1 ? u2 ?? u.messages.error : r ?? u.messages.cancel;
-        m = _2 === 1, p2 && (W(A2, _2), m && typeof i == "function" && i());
-      }, C2 = () => T(2), b = () => T(1), x = () => {
-        process.on("uncaughtExceptionMonitor", C2), process.on("unhandledRejection", C2), process.on("SIGINT", b), process.on("SIGTERM", b), process.on("exit", T), c2 && c2.addEventListener("abort", b);
-      }, G2 = () => {
-        process.removeListener("uncaughtExceptionMonitor", C2), process.removeListener("unhandledRejection", C2), process.removeListener("SIGINT", b), process.removeListener("SIGTERM", b), process.removeListener("exit", T), c2 && c2.removeEventListener("abort", b);
-      }, M2 = () => {
-        if (S2 === void 0) return;
-        l && s.write(`
-`);
-        const _2 = wrapAnsi(S2, f, { hard: true, trim: false }).split(`
-`);
-        _2.length > 1 && s.write(import_sisteransi2.cursor.up(_2.length - 1)), s.write(import_sisteransi2.cursor.to(0)), s.write(import_sisteransi2.erase.down());
-      }, R2 = (_2) => _2.replace(/\.+$/, ""), j2 = (_2) => {
-        const A2 = (performance.now() - _2) / 1e3, k = Math.floor(A2 / 60), L = Math.floor(A2 % 60);
-        return k > 0 ? `[${k}m ${L}s]` : `[${L}s]`;
-      }, D2 = a.withGuide ?? u.withGuide, ie = (_2 = "") => {
-        p2 = true, $2 = z({ output: s }), g = R2(_2), h = performance.now(), D2 && s.write(`${t("gray", d2)}
-`);
-        let A2 = 0, k = 0;
-        x(), y = setInterval(() => {
-          if (l && g === S2) return;
-          M2(), S2 = g;
-          const L = v(n[A2]);
-          let Z;
-          if (l) Z = `${L}  ${g}...`;
-          else if (e === "timer") Z = `${L}  ${g} ${j2(h)}`;
-          else {
-            const Be = ".".repeat(Math.floor(k)).slice(0, 3);
-            Z = `${L}  ${g}${Be}`;
-          }
-          const Ne = wrapAnsi(Z, f, { hard: true, trim: false });
-          s.write(Ne), A2 = A2 + 1 < n.length ? A2 + 1 : 0, k = k < 4 ? k + 0.125 : 0;
-        }, o);
-      }, W = (_2 = "", A2 = 0, k = false) => {
-        if (!p2) return;
-        p2 = false, clearInterval(y), M2();
-        const L = A2 === 0 ? t("green", F) : A2 === 1 ? t("red", oe) : t("red", ue);
-        g = _2 ?? g, k || (e === "timer" ? s.write(`${L}  ${g} ${j2(h)}
-`) : s.write(`${L}  ${g}
-`)), G2(), $2();
-      };
-      return { start: ie, stop: (_2 = "") => W(_2, 0), message: (_2 = "") => {
-        g = R2(_2 ?? g);
-      }, cancel: (_2 = "") => W(_2, 1), error: (_2 = "") => W(_2, 2), clear: () => W("", 0, true), get isCancelled() {
-        return m;
-      } };
-    };
     Ve = { light: w2("\u2500", "-"), heavy: w2("\u2501", "="), block: w2("\u2588", "#") };
     re = (e, i) => e.includes(`
 `) ? e.split(`
@@ -4425,32 +4348,184 @@ var init_helpers = __esm({
   }
 });
 
-// apps/server/dist/lib/logger.js
+// apps/server/dist/lib/atomic-write.js
 import fs4 from "node:fs";
 import path4 from "node:path";
+function atomicWriteJson(targetPath, data) {
+  fs4.mkdirSync(path4.dirname(targetPath), { recursive: true });
+  const tmp = `${targetPath}.tmp-${process.pid}-${Date.now()}`;
+  fs4.writeFileSync(tmp, JSON.stringify(data, null, 2));
+  fs4.renameSync(tmp, targetPath);
+}
+function lockPath(repoPath) {
+  return path4.join(repoPath, ".truecourse", LOCK_FILENAME);
+}
+function acquireAnalyzeLock(repoPath) {
+  const file = lockPath(repoPath);
+  fs4.mkdirSync(path4.dirname(file), { recursive: true });
+  try {
+    const fd = fs4.openSync(file, "wx");
+    fs4.writeSync(fd, `${process.pid}
+${(/* @__PURE__ */ new Date()).toISOString()}
+`);
+    fs4.closeSync(fd);
+  } catch (err) {
+    if (err.code === "EEXIST") {
+      let owner = null;
+      try {
+        owner = parseInt(fs4.readFileSync(file, "utf-8").split("\n")[0], 10) || null;
+      } catch {
+      }
+      throw new AnalyzeLockError(repoPath, owner);
+    }
+    throw err;
+  }
+}
+function releaseAnalyzeLock(repoPath) {
+  try {
+    fs4.unlinkSync(lockPath(repoPath));
+  } catch (err) {
+    if (err.code !== "ENOENT")
+      throw err;
+  }
+}
+var LOCK_FILENAME, AnalyzeLockError;
+var init_atomic_write = __esm({
+  "apps/server/dist/lib/atomic-write.js"() {
+    "use strict";
+    LOCK_FILENAME = ".analyze.lock";
+    AnalyzeLockError = class extends Error {
+      constructor(repoPath, ownerPid) {
+        const who = ownerPid != null ? ` (held by pid ${ownerPid})` : "";
+        super(`Another analyze is already running for ${repoPath}${who}. If you're sure no analyze is in progress, remove ${lockPath(repoPath)} and retry.`);
+        this.name = "AnalyzeLockError";
+      }
+    };
+  }
+});
+
+// apps/server/dist/lib/analysis-store.js
+import fs5 from "node:fs";
+import path5 from "node:path";
+function storeDir(repoPath) {
+  return path5.join(repoPath, TRUECOURSE_DIR2);
+}
+function analysesDir(repoPath) {
+  return path5.join(storeDir(repoPath), ANALYSES_DIR);
+}
+function analysisFilePath(repoPath, filename) {
+  return path5.join(analysesDir(repoPath), filename);
+}
+function latestPath(repoPath) {
+  return path5.join(storeDir(repoPath), LATEST_FILE);
+}
+function historyPath(repoPath) {
+  return path5.join(storeDir(repoPath), HISTORY_FILE);
+}
+function diffPath(repoPath) {
+  return path5.join(storeDir(repoPath), DIFF_FILE);
+}
+function buildAnalysisFilename(analysisId, createdAt) {
+  const iso = createdAt.replace(/[:.]/g, "-").replace(/-\d{3}Z$/, "Z");
+  const shortId = analysisId.replace(/-/g, "").slice(0, 8);
+  return `${iso}_${shortId}.json`;
+}
+function readLatest(repoPath) {
+  const file = latestPath(repoPath);
+  let mtime;
+  try {
+    mtime = fs5.statSync(file).mtimeMs;
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      latestCache.delete(repoPath);
+      return null;
+    }
+    throw err;
+  }
+  const cached = latestCache.get(repoPath);
+  if (cached && cached.mtime === mtime)
+    return cached.data;
+  const data = JSON.parse(fs5.readFileSync(file, "utf-8"));
+  latestCache.set(repoPath, { mtime, data });
+  return data;
+}
+function writeLatest(repoPath, latest) {
+  atomicWriteJson(latestPath(repoPath), latest);
+  latestCache.delete(repoPath);
+}
+function writeAnalysis(repoPath, snapshot) {
+  const filename = buildAnalysisFilename(snapshot.id, snapshot.createdAt);
+  atomicWriteJson(analysisFilePath(repoPath, filename), snapshot);
+  return { filename, snapshot };
+}
+function readHistory(repoPath) {
+  const file = historyPath(repoPath);
+  if (!fs5.existsSync(file))
+    return { analyses: [] };
+  return JSON.parse(fs5.readFileSync(file, "utf-8"));
+}
+function appendHistory(repoPath, entry) {
+  const history = readHistory(repoPath);
+  history.analyses.push(entry);
+  atomicWriteJson(historyPath(repoPath), history);
+}
+function readDiff(repoPath) {
+  const file = diffPath(repoPath);
+  if (!fs5.existsSync(file))
+    return null;
+  return JSON.parse(fs5.readFileSync(file, "utf-8"));
+}
+function writeDiff(repoPath, diff) {
+  atomicWriteJson(diffPath(repoPath), diff);
+}
+function deleteDiff(repoPath) {
+  try {
+    fs5.unlinkSync(diffPath(repoPath));
+  } catch (err) {
+    if (err.code !== "ENOENT")
+      throw err;
+  }
+}
+var TRUECOURSE_DIR2, ANALYSES_DIR, LATEST_FILE, HISTORY_FILE, DIFF_FILE, latestCache;
+var init_analysis_store = __esm({
+  "apps/server/dist/lib/analysis-store.js"() {
+    "use strict";
+    init_atomic_write();
+    TRUECOURSE_DIR2 = ".truecourse";
+    ANALYSES_DIR = "analyses";
+    LATEST_FILE = "LATEST.json";
+    HISTORY_FILE = "history.json";
+    DIFF_FILE = "diff.json";
+    latestCache = /* @__PURE__ */ new Map();
+  }
+});
+
+// apps/server/dist/lib/logger.js
+import fs6 from "node:fs";
+import path6 from "node:path";
 function rotateLog(filePath) {
-  if (!fs4.existsSync(filePath))
+  if (!fs6.existsSync(filePath))
     return;
-  const stats = fs4.statSync(filePath);
+  const stats = fs6.statSync(filePath);
   if (stats.size < MAX_LOG_SIZE)
     return;
   for (let i = MAX_LOG_FILES; i >= 1; i--) {
     const older = `${filePath}.${i}`;
     if (i === MAX_LOG_FILES) {
-      if (fs4.existsSync(older))
-        fs4.unlinkSync(older);
+      if (fs6.existsSync(older))
+        fs6.unlinkSync(older);
     } else {
       const newer = `${filePath}.${i + 1}`;
-      if (fs4.existsSync(older))
-        fs4.renameSync(older, newer);
+      if (fs6.existsSync(older))
+        fs6.renameSync(older, newer);
     }
   }
-  fs4.renameSync(filePath, `${filePath}.1`);
+  fs6.renameSync(filePath, `${filePath}.1`);
 }
 function openSink(config2) {
-  fs4.mkdirSync(path4.dirname(config2.filePath), { recursive: true });
+  fs6.mkdirSync(path6.dirname(config2.filePath), { recursive: true });
   rotateLog(config2.filePath);
-  const stream = fs4.createWriteStream(config2.filePath, { flags: "a" });
+  const stream = fs6.createWriteStream(config2.filePath, { flags: "a" });
   stream.write(`
 --- ${(/* @__PURE__ */ new Date()).toISOString()} ---
 `);
@@ -5082,7 +5157,7 @@ var require_node = __commonJS({
     exports.inspectOpts = Object.keys(process.env).filter((key) => {
       return /^debug_/i.test(key);
     }).reduce((obj, key) => {
-      const prop = key.substring(6).toLowerCase().replace(/_([a-z])/g, (_2, k) => {
+      const prop = key.substring(6).toLowerCase().replace(/_([a-z])/g, (_, k) => {
         return k.toUpperCase();
       });
       let val = process.env[key];
@@ -6558,7 +6633,7 @@ function deleteBranchTask(branch, forceDelete = false) {
     parser(stdOut, stdErr) {
       return parseBranchDeletions(stdOut, stdErr).branches[branch];
     },
-    onError({ exitCode, stdErr, stdOut }, error, _2, fail) {
+    onError({ exitCode, stdErr, stdOut }, error, _, fail) {
       if (!hasBranchDeletionError(String(error), exitCode)) {
         return fail(error);
       }
@@ -9762,20 +9837,20 @@ var init_git = __esm({
 });
 
 // apps/server/dist/config/project-config.js
-import fs5 from "node:fs";
+import fs7 from "node:fs";
 function readProjectConfig(repoDir) {
   const file = getRepoConfigPath(repoDir);
-  if (!fs5.existsSync(file))
+  if (!fs7.existsSync(file))
     return { ...EMPTY };
   try {
-    return JSON.parse(fs5.readFileSync(file, "utf-8"));
+    return JSON.parse(fs7.readFileSync(file, "utf-8"));
   } catch {
     return { ...EMPTY };
   }
 }
 function writeProjectConfig(repoDir, config2) {
   ensureRepoTruecourseDir(repoDir);
-  fs5.writeFileSync(getRepoConfigPath(repoDir), JSON.stringify(config2, null, 2), "utf-8");
+  fs7.writeFileSync(getRepoConfigPath(repoDir), JSON.stringify(config2, null, 2), "utf-8");
 }
 function updateProjectConfig(repoDir, patch) {
   const current = readProjectConfig(repoDir);
@@ -9844,7 +9919,7 @@ var require_ignore = __commonJS({
         // (a ) -> (a)
         // (a \ ) -> (a  )
         /((?:\\\\)*?)(\\?\s+)$/,
-        (_2, m1, m2) => m1 + (m2.indexOf("\\") === 0 ? SPACE : EMPTY2)
+        (_, m1, m2) => m1 + (m2.indexOf("\\") === 0 ? SPACE : EMPTY2)
       ],
       // Replace (\ ) with ' '
       // (\ ) -> ' '
@@ -9852,7 +9927,7 @@ var require_ignore = __commonJS({
       // (\\\ ) -> '\\ '
       [
         /(\\+?)\s/g,
-        (_2, m1) => {
+        (_, m1) => {
           const { length } = m1;
           return m1.slice(0, length - length % 2) + SPACE;
         }
@@ -9923,7 +9998,7 @@ var require_ignore = __commonJS({
         // Zero, one or several directories
         // should not use '*', or it will be replaced by the next replacer
         // Check if it is not the last `'/**'`
-        (_2, index, str2) => index + 6 < str2.length ? "(?:\\/[^\\/]+)*" : "\\/.+"
+        (_, index, str2) => index + 6 < str2.length ? "(?:\\/[^\\/]+)*" : "\\/.+"
       ],
       // normal intermediate wildcards
       [
@@ -9935,7 +10010,7 @@ var require_ignore = __commonJS({
         /(^|[^\\]+)(\\\*)+(?=.+)/g,
         // '*.js' matches '.js'
         // '*.js' doesn't match 'abc'
-        (_2, p1, p2) => {
+        (_, p1, p2) => {
           const unescaped = p2.replace(/\\\*/g, "[^\\/]*");
           return p1 + unescaped;
         }
@@ -9982,11 +10057,11 @@ var require_ignore = __commonJS({
     var MODE_CHECK_IGNORE = "checkRegex";
     var UNDERSCORE = "_";
     var TRAILING_WILD_CARD_REPLACERS = {
-      [MODE_IGNORE](_2, p1) {
+      [MODE_IGNORE](_, p1) {
         const prefix = p1 ? `${p1}[^/]+` : "[^/]*";
         return `${prefix}(?=$|\\/$)`;
       },
-      [MODE_CHECK_IGNORE](_2, p1) {
+      [MODE_CHECK_IGNORE](_, p1) {
         const prefix = p1 ? `${p1}[^/]*` : "[^/]*";
         return `${prefix}(?=$|\\/$)`;
       }
@@ -14772,7 +14847,7 @@ var init_ast = __esm({
         if (!isExtglobAST(this)) {
           const noEmpty = this.isStart() && this.isEnd() && !this.#parts.some((s) => typeof s !== "string");
           const src = this.#parts.map((p2) => {
-            const [re2, _2, hasMagic, uflag] = typeof p2 === "string" ? _a2.#parseGlob(p2, this.#hasMagic, noEmpty) : p2.toRegExpSource(allowDot);
+            const [re2, _, hasMagic, uflag] = typeof p2 === "string" ? _a2.#parseGlob(p2, this.#hasMagic, noEmpty) : p2.toRegExpSource(allowDot);
             this.#hasMagic = this.#hasMagic || hasMagic;
             this.#uflag = this.#uflag || uflag;
             return re2;
@@ -14878,7 +14953,7 @@ var init_ast = __esm({
           if (typeof p2 === "string") {
             throw new Error("string type in extglob ast??");
           }
-          const [re2, _2, _hasMagic, uflag] = p2.toRegExpSource(dot);
+          const [re2, _, _hasMagic, uflag] = p2.toRegExpSource(dot);
           this.#uflag = this.#uflag || uflag;
           return re2;
         }).filter((p2) => !(this.isStart() && this.isEnd()) || !!p2).join("|");
@@ -14951,7 +15026,7 @@ var init_escape = __esm({
 });
 
 // node_modules/.pnpm/minimatch@10.2.4/node_modules/minimatch/dist/esm/index.js
-var minimatch, starDotExtRE, starDotExtTest, starDotExtTestDot, starDotExtTestNocase, starDotExtTestNocaseDot, starDotStarRE, starDotStarTest, starDotStarTestDot, dotStarRE, dotStarTest, starRE, starTest, starTestDot, qmarksRE, qmarksTestNocase, qmarksTestNocaseDot, qmarksTestDot, qmarksTest, qmarksTestNoExt, qmarksTestNoExtDot, defaultPlatform, path5, sep, GLOBSTAR, qmark2, star2, twoStarDot, twoStarNoDot, filter, ext, defaults, braceExpand, makeRe, match, globMagic, regExpEscape2, Minimatch;
+var minimatch, starDotExtRE, starDotExtTest, starDotExtTestDot, starDotExtTestNocase, starDotExtTestNocaseDot, starDotStarRE, starDotStarTest, starDotStarTestDot, dotStarRE, dotStarTest, starRE, starTest, starTestDot, qmarksRE, qmarksTestNocase, qmarksTestNocaseDot, qmarksTestDot, qmarksTest, qmarksTestNoExt, qmarksTestNoExtDot, defaultPlatform, path7, sep, GLOBSTAR, qmark2, star2, twoStarDot, twoStarNoDot, filter, ext, defaults, braceExpand, makeRe, match, globMagic, regExpEscape2, Minimatch;
 var init_esm4 = __esm({
   "node_modules/.pnpm/minimatch@10.2.4/node_modules/minimatch/dist/esm/index.js"() {
     init_esm3();
@@ -15020,11 +15095,11 @@ var init_esm4 = __esm({
       return (f) => f.length === len && f !== "." && f !== "..";
     };
     defaultPlatform = typeof process === "object" && process ? typeof process.env === "object" && process.env && process.env.__MINIMATCH_TESTING_PLATFORM__ || process.platform : "posix";
-    path5 = {
+    path7 = {
       win32: { sep: "\\" },
       posix: { sep: "/" }
     };
-    sep = defaultPlatform === "win32" ? path5.win32.sep : path5.posix.sep;
+    sep = defaultPlatform === "win32" ? path7.win32.sep : path7.posix.sep;
     minimatch.sep = sep;
     GLOBSTAR = Symbol("globstar **");
     minimatch.GLOBSTAR = GLOBSTAR;
@@ -15151,7 +15226,7 @@ var init_esm4 = __esm({
         }
         return false;
       }
-      debug(..._2) {
+      debug(..._) {
       }
       make() {
         const pattern = this.pattern;
@@ -15173,7 +15248,7 @@ var init_esm4 = __esm({
         const rawGlobParts = this.globSet.map((s) => this.slashSplit(s));
         this.globParts = this.preprocess(rawGlobParts);
         this.debug(this.pattern, this.globParts);
-        let set2 = this.globParts.map((s, _2, __) => {
+        let set2 = this.globParts.map((s, _, __) => {
           if (this.isWindows && this.windowsNoMagicRoot) {
             const isUNC = s[0] === "" && s[1] === "" && (s[2] === "?" || !globMagic.test(s[2])) && !globMagic.test(s[3]);
             const isDrive = /^[a-z]:/i.test(s[0]);
@@ -17070,7 +17145,7 @@ var init_database_detector = __esm({
 });
 
 // packages/analyzer/dist/module-extractor.js
-import path6 from "path";
+import path8 from "path";
 function extractModulesAndMethods(analyses, layerDetails, fileDependencies) {
   const modules = [];
   const methods = [];
@@ -17217,7 +17292,7 @@ function deriveModuleName(analysis) {
     return localExports[0].name;
   }
   const baseName = fileBaseName(analysis.filePath);
-  const strippedName = stripExtension(path6.basename(analysis.filePath));
+  const strippedName = stripExtension(path8.basename(analysis.filePath));
   if (INDEX_NAMES.has(strippedName)) {
     return baseName;
   }
@@ -17234,10 +17309,10 @@ function deriveModuleName(analysis) {
   return baseName;
 }
 function deriveNextjsRouteName(filePath) {
-  const base = path6.basename(filePath).replace(/\.(ts|tsx|js|jsx)$/, "");
+  const base = path8.basename(filePath).replace(/\.(ts|tsx|js|jsx)$/, "");
   if (base !== "route" && base !== "page")
     return null;
-  const parts = filePath.split(path6.sep);
+  const parts = filePath.split(path8.sep);
   const appIdx = parts.lastIndexOf("app");
   if (appIdx === -1)
     return null;
@@ -17255,9 +17330,9 @@ function stripExtension(filename) {
   return filename;
 }
 function fileBaseName(filePath) {
-  const name = stripExtension(path6.basename(filePath));
+  const name = stripExtension(path8.basename(filePath));
   if (INDEX_NAMES.has(name)) {
-    return path6.basename(path6.dirname(filePath));
+    return path8.basename(path8.dirname(filePath));
   }
   return name;
 }
@@ -44020,10 +44095,10 @@ var init_secret_rules = __esm({
 });
 
 // packages/analyzer/dist/rules/security/secret-scanner.js
-import path7 from "node:path";
+import path9 from "node:path";
 function isSensitiveFile(filePath) {
-  const basename2 = path7.basename(filePath);
-  const ext2 = path7.extname(filePath);
+  const basename2 = path9.basename(filePath);
+  const ext2 = path9.extname(filePath);
   if (basename2.startsWith(".env")) {
     const envVariant = basename2;
     if (SENSITIVE_FILE_EXTENSIONS.has(envVariant)) {
@@ -86706,7 +86781,7 @@ var init_js_naming_convention = __esm({
           return null;
         }
         if (funcName.includes("_") && !funcName.startsWith("_")) {
-          return makeViolation(this.ruleKey, node, filePath, "low", "Function uses snake_case naming", `Function '${funcName}' uses snake_case. JavaScript convention is camelCase.`, sourceCode, `Rename to camelCase: ${funcName.replace(/_([a-z])/g, (_2, c2) => c2.toUpperCase())}.`);
+          return makeViolation(this.ruleKey, node, filePath, "low", "Function uses snake_case naming", `Function '${funcName}' uses snake_case. JavaScript convention is camelCase.`, sourceCode, `Rename to camelCase: ${funcName.replace(/_([a-z])/g, (_, c2) => c2.toUpperCase())}.`);
         }
         return null;
       }
@@ -93624,7 +93699,7 @@ var init_dist6 = __esm({
 });
 
 // apps/server/dist/services/analyzer.service.js
-import path8 from "node:path";
+import path10 from "node:path";
 function runDeterministicModuleChecks(result, enabledDeterministic) {
   if (!result.modules || !result.methods)
     return [];
@@ -93667,7 +93742,7 @@ async function runAnalysis(repoPath, _branch, onProgress, options) {
     const statusResult = await git.status();
     hasChanges = !statusResult.isClean();
     const gitRoot = (await git.revparse(["--show-toplevel"])).trim();
-    isSubdirectory = path8.resolve(repoPath) !== path8.resolve(gitRoot);
+    isSubdirectory = path10.resolve(repoPath) !== path10.resolve(gitRoot);
   }
   if (hasChanges && !options?.skipStash && !isSubdirectory && git) {
     onProgress({ step: "stash", percent: 2, detail: "Stashing pending changes to analyze committed state..." });
@@ -94001,155 +94076,210 @@ var init_analysis_persistence_service = __esm({
   }
 });
 
-// apps/server/dist/lib/atomic-write.js
-import fs6 from "node:fs";
-import path9 from "node:path";
-function atomicWriteJson(targetPath, data) {
-  fs6.mkdirSync(path9.dirname(targetPath), { recursive: true });
-  const tmp = `${targetPath}.tmp-${process.pid}-${Date.now()}`;
-  fs6.writeFileSync(tmp, JSON.stringify(data, null, 2));
-  fs6.renameSync(tmp, targetPath);
-}
-function lockPath(repoPath) {
-  return path9.join(repoPath, ".truecourse", LOCK_FILENAME);
-}
-function acquireAnalyzeLock(repoPath) {
-  const file = lockPath(repoPath);
-  fs6.mkdirSync(path9.dirname(file), { recursive: true });
-  try {
-    const fd = fs6.openSync(file, "wx");
-    fs6.writeSync(fd, `${process.pid}
-${(/* @__PURE__ */ new Date()).toISOString()}
-`);
-    fs6.closeSync(fd);
-  } catch (err) {
-    if (err.code === "EEXIST") {
-      let owner = null;
-      try {
-        owner = parseInt(fs6.readFileSync(file, "utf-8").split("\n")[0], 10) || null;
-      } catch {
+// apps/server/dist/services/flow.service.js
+import { randomUUID as randomUUID2 } from "node:crypto";
+function detectFlows(result) {
+  const dbTypeMap = /* @__PURE__ */ new Map();
+  for (const db of result.databaseResult.databases) {
+    dbTypeMap.set(db.name, db.type);
+  }
+  const functionsByFile = /* @__PURE__ */ new Map();
+  if (result.fileAnalyses) {
+    for (const fa of result.fileAnalyses) {
+      const entries = [];
+      for (const fn of fa.functions) {
+        entries.push({ name: fn.name, startLine: fn.location.startLine, endLine: fn.location.endLine });
       }
-      throw new AnalyzeLockError(repoPath, owner);
+      for (const cls of fa.classes) {
+        for (const method of cls.methods) {
+          entries.push({ name: method.name, startLine: method.location.startLine, endLine: method.location.endLine });
+        }
+      }
+      if (entries.length > 0)
+        functionsByFile.set(fa.filePath, entries);
     }
-    throw err;
   }
-}
-function releaseAnalyzeLock(repoPath) {
-  try {
-    fs6.unlinkSync(lockPath(repoPath));
-  } catch (err) {
-    if (err.code !== "ENOENT")
-      throw err;
+  const crossServiceCalls = [];
+  const fileToModule = /* @__PURE__ */ new Map();
+  for (const mod of result.modules) {
+    fileToModule.set(mod.filePath, `${mod.serviceName}::${mod.name}`);
   }
-}
-var LOCK_FILENAME, AnalyzeLockError;
-var init_atomic_write = __esm({
-  "apps/server/dist/lib/atomic-write.js"() {
-    "use strict";
-    LOCK_FILENAME = ".analyze.lock";
-    AnalyzeLockError = class extends Error {
-      constructor(repoPath, ownerPid) {
-        const who = ownerPid != null ? ` (held by pid ${ownerPid})` : "";
-        super(`Another analyze is already running for ${repoPath}${who}. If you're sure no analyze is in progress, remove ${lockPath(repoPath)} and retry.`);
-        this.name = "AnalyzeLockError";
+  const fileToLanguage = /* @__PURE__ */ new Map();
+  if (result.fileAnalyses) {
+    for (const fa of result.fileAnalyses) {
+      fileToLanguage.set(fa.filePath, fa.language);
+    }
+  }
+  for (const dep of result.dependencies) {
+    if (!dep.httpCalls || dep.httpCalls.length === 0)
+      continue;
+    for (const call of dep.httpCalls) {
+      const moduleKey = fileToModule.get(call.location.filePath);
+      if (!moduleKey)
+        continue;
+      const [sourceService, sourceModule] = moduleKey.split("::");
+      let sourceMethod;
+      const fileFunctions = functionsByFile.get(call.location.filePath);
+      if (fileFunctions) {
+        for (const fn of fileFunctions) {
+          if (call.location.startLine >= fn.startLine && call.location.startLine <= fn.endLine) {
+            sourceMethod = fn.name;
+            break;
+          }
+        }
       }
-    };
+      const language = fileToLanguage.get(call.location.filePath);
+      const normalizedUrl = language ? normalizeUrl(call.url, language) : call.url;
+      crossServiceCalls.push({
+        sourceService,
+        sourceModule,
+        sourceMethod,
+        httpMethod: call.method,
+        url: normalizedUrl,
+        targetService: dep.target
+      });
+    }
   }
-});
-
-// apps/server/dist/lib/analysis-store.js
-import fs7 from "node:fs";
-import path10 from "node:path";
-function storeDir(repoPath) {
-  return path10.join(repoPath, TRUECOURSE_DIR2);
-}
-function analysesDir(repoPath) {
-  return path10.join(storeDir(repoPath), ANALYSES_DIR);
-}
-function analysisFilePath(repoPath, filename) {
-  return path10.join(analysesDir(repoPath), filename);
-}
-function latestPath(repoPath) {
-  return path10.join(storeDir(repoPath), LATEST_FILE);
-}
-function historyPath(repoPath) {
-  return path10.join(storeDir(repoPath), HISTORY_FILE);
-}
-function diffPath(repoPath) {
-  return path10.join(storeDir(repoPath), DIFF_FILE);
-}
-function buildAnalysisFilename(analysisId, createdAt) {
-  const iso = createdAt.replace(/[:.]/g, "-").replace(/-\d{3}Z$/, "Z");
-  const shortId = analysisId.replace(/-/g, "").slice(0, 8);
-  return `${iso}_${shortId}.json`;
+  const routeHandlers = buildRouteHandlerLookup(result);
+  const graph = new AnalysisGraph({
+    methods: result.methods,
+    methodDependencies: result.methodLevelDependencies,
+    modules: result.modules,
+    services: result.services.map((s) => ({ name: s.name, type: s.type })),
+    crossServiceCalls: crossServiceCalls.length > 0 ? crossServiceCalls : void 0,
+    databaseConnections: result.databaseResult.connections.map((c2) => ({
+      serviceName: c2.serviceName,
+      databaseName: c2.databaseName,
+      databaseType: dbTypeMap.get(c2.databaseName) || "unknown"
+    })),
+    routeHandlers: routeHandlers.size > 0 ? routeHandlers : void 0
+  });
+  const traced = traceFlows(graph);
+  const out = traced.map((flow) => ({
+    id: randomUUID2(),
+    name: flow.name,
+    description: null,
+    entryService: flow.entryService,
+    entryMethod: flow.entryMethod,
+    category: flow.category,
+    trigger: flow.trigger,
+    stepCount: flow.steps.length,
+    steps: flow.steps.map((step) => ({
+      stepOrder: step.stepOrder,
+      sourceService: step.sourceService,
+      sourceModule: step.sourceModule,
+      sourceMethod: step.sourceMethod,
+      targetService: step.targetService,
+      targetModule: step.targetModule,
+      targetMethod: step.targetMethod,
+      stepType: step.stepType,
+      dataDescription: null,
+      isAsync: step.isAsync,
+      isConditional: step.isConditional
+    }))
+  }));
+  log.info(`[Flows] Detected ${out.length} flows`);
+  return out;
 }
-function readLatest(repoPath) {
-  const file = latestPath(repoPath);
-  let mtime;
-  try {
-    mtime = fs7.statSync(file).mtimeMs;
-  } catch (err) {
-    if (err.code === "ENOENT") {
-      latestCache.delete(repoPath);
-      return null;
+function buildRouteHandlerLookup(result) {
+  const handlers = /* @__PURE__ */ new Map();
+  if (!result.fileAnalyses)
+    return handlers;
+  const fileToService = /* @__PURE__ */ new Map();
+  const fileToModuleName = /* @__PURE__ */ new Map();
+  for (const mod of result.modules) {
+    fileToService.set(mod.filePath, mod.serviceName);
+    fileToModuleName.set(mod.filePath, mod.name);
+  }
+  for (const ld of result.layerDetails) {
+    for (const fp of ld.filePaths) {
+      if (!fileToService.has(fp))
+        fileToService.set(fp, ld.serviceName);
     }
-    throw err;
   }
-  const cached = latestCache.get(repoPath);
-  if (cached && cached.mtime === mtime)
-    return cached.data;
-  const data = JSON.parse(fs7.readFileSync(file, "utf-8"));
-  latestCache.set(repoPath, { mtime, data });
-  return data;
-}
-function writeLatest(repoPath, latest) {
-  atomicWriteJson(latestPath(repoPath), latest);
-  latestCache.delete(repoPath);
-}
-function writeAnalysis(repoPath, snapshot) {
-  const filename = buildAnalysisFilename(snapshot.id, snapshot.createdAt);
-  atomicWriteJson(analysisFilePath(repoPath, filename), snapshot);
-  return { filename, snapshot };
-}
-function readHistory(repoPath) {
-  const file = historyPath(repoPath);
-  if (!fs7.existsSync(file))
-    return { analyses: [] };
-  return JSON.parse(fs7.readFileSync(file, "utf-8"));
-}
-function appendHistory(repoPath, entry) {
-  const history = readHistory(repoPath);
-  history.analyses.push(entry);
-  atomicWriteJson(historyPath(repoPath), history);
-}
-function readDiff(repoPath) {
-  const file = diffPath(repoPath);
-  if (!fs7.existsSync(file))
-    return null;
-  return JSON.parse(fs7.readFileSync(file, "utf-8"));
-}
-function writeDiff(repoPath, diff) {
-  atomicWriteJson(diffPath(repoPath), diff);
+  const fileMountPrefix = /* @__PURE__ */ new Map();
+  for (const fa of result.fileAnalyses) {
+    if (!fa.routerMounts || fa.routerMounts.length === 0)
+      continue;
+    for (const mount of fa.routerMounts) {
+      for (const imp of fa.imports) {
+        const spec = imp.specifiers.find((s) => s.name === mount.routerName || s.alias === mount.routerName);
+        if (spec) {
+          for (const dep of result.moduleDependencies) {
+            if (dep.source === fa.filePath && dep.importedNames.includes(spec.name)) {
+              fileMountPrefix.set(dep.target, mount.path);
+            }
+          }
+        }
+      }
+      const hasLocal = fa.functions.some((f) => f.name === mount.routerName) || fa.exports.some((e) => e.name === mount.routerName);
+      if (hasLocal)
+        fileMountPrefix.set(fa.filePath, mount.path);
+    }
+  }
+  for (const fa of result.fileAnalyses) {
+    if (!fa.routeRegistrations || fa.routeRegistrations.length === 0)
+      continue;
+    const serviceName = fileToService.get(fa.filePath);
+    if (!serviceName)
+      continue;
+    const mountPrefix = fileMountPrefix.get(fa.filePath) || "";
+    for (const route of fa.routeRegistrations) {
+      const fullPath = composePath(mountPrefix, route.path);
+      const moduleName = resolveHandlerModule(route.handlerName, fa, result.fileAnalyses, fileToModuleName);
+      const key = `${serviceName}::${route.httpMethod}::${fullPath}`;
+      handlers.set(key, { handlerName: route.handlerName, moduleName });
+    }
+  }
+  return handlers;
 }
-function deleteDiff(repoPath) {
-  try {
-    fs7.unlinkSync(diffPath(repoPath));
-  } catch (err) {
-    if (err.code !== "ENOENT")
-      throw err;
+function resolveHandlerModule(handlerName, routeFile, allFiles, fileToModuleName) {
+  for (const cls of routeFile.classes) {
+    for (const method of cls.methods) {
+      if (method.name === handlerName)
+        return fileToModuleName.get(routeFile.filePath) || handlerName;
+    }
+  }
+  for (const fn of routeFile.functions) {
+    if (fn.name === handlerName)
+      return fileToModuleName.get(routeFile.filePath) || handlerName;
+  }
+  for (const imp of routeFile.imports) {
+    const spec = imp.specifiers.find((s) => s.name === handlerName || s.alias === handlerName);
+    if (spec) {
+      for (const targetFile of allFiles) {
+        const hasExport = targetFile.exports.some((e) => e.name === (spec.alias || spec.name) || e.name === spec.name);
+        const hasFunction = targetFile.functions.some((f) => f.name === spec.name);
+        const hasClassMethod = targetFile.classes.some((c2) => c2.methods.some((m) => m.name === spec.name));
+        if (hasExport || hasFunction || hasClassMethod) {
+          return fileToModuleName.get(targetFile.filePath) || handlerName;
+        }
+      }
+    }
+    for (const s of imp.specifiers) {
+      for (const targetFile of allFiles) {
+        for (const cls of targetFile.classes) {
+          if (cls.name === s.name && cls.methods.some((m) => m.name === handlerName)) {
+            return fileToModuleName.get(targetFile.filePath) || cls.name;
+          }
+        }
+      }
+    }
   }
+  return fileToModuleName.get(routeFile.filePath) || handlerName;
 }
-var TRUECOURSE_DIR2, ANALYSES_DIR, LATEST_FILE, HISTORY_FILE, DIFF_FILE, latestCache;
-var init_analysis_store = __esm({
-  "apps/server/dist/lib/analysis-store.js"() {
+function composePath(prefix, routePath) {
+  const p2 = prefix.endsWith("/") ? prefix.slice(0, -1) : prefix;
+  const r = routePath.startsWith("/") ? routePath : `/${routePath}`;
+  const full = `${p2}${r}`;
+  return full.length > 1 && full.endsWith("/") ? full.slice(0, -1) : full || "/";
+}
+var init_flow_service = __esm({
+  "apps/server/dist/services/flow.service.js"() {
     "use strict";
-    init_atomic_write();
-    TRUECOURSE_DIR2 = ".truecourse";
-    ANALYSES_DIR = "analyses";
-    LATEST_FILE = "LATEST.json";
-    HISTORY_FILE = "history.json";
-    DIFF_FILE = "diff.json";
-    latestCache = /* @__PURE__ */ new Map();
+    init_logger();
+    init_dist6();
+    init_analysis_store();
   }
 });
 
@@ -107145,7 +107275,7 @@ var require_sender = __commonJS({
         const perMessageDeflate = this._extensions[PerMessageDeflate.extensionName];
         this._bufferedBytes += options[kByteLength];
         this._state = DEFLATING;
-        perMessageDeflate.compress(data, options.fin, (_2, buf) => {
+        perMessageDeflate.compress(data, options.fin, (_, buf) => {
           if (this._socket.destroyed) {
             const err = new Error(
               "The socket was closed while data was being compressed"
@@ -115969,7 +116099,7 @@ var util, objectUtil, ZodParsedType, getParsedType;
 var init_util3 = __esm({
   "node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js"() {
     (function(util2) {
-      util2.assertEqual = (_2) => {
+      util2.assertEqual = (_) => {
       };
       function assertIs(_arg) {
       }
@@ -116019,7 +116149,7 @@ var init_util3 = __esm({
         return array.map((val) => typeof val === "string" ? `'${val}'` : val).join(separator);
       }
       util2.joinValues = joinValues;
-      util2.jsonStringifyReplacer = (_2, value) => {
+      util2.jsonStringifyReplacer = (_, value) => {
         if (typeof value === "bigint") {
           return value.toString();
         }
@@ -120632,9 +120762,12 @@ var init_schemas = __esm({
       path: external_exports.string().min(1)
     });
     AnalyzeRepoSchema = external_exports.object({
-      branch: external_exports.string().optional(),
-      enabledCategories: external_exports.array(external_exports.string()).optional().default([]),
-      enableLlmRules: external_exports.boolean().optional().default(true),
+      /** Which mode to run — full analyze (HEAD committed state) or diff (working tree
+       *  vs LATEST). Required; no silent default. */
+      mode: external_exports.enum(["full", "diff"]),
+      /** Skip git ops (branch detection, commit hash read, pre-parse stash). Useful
+       *  for non-git dirs or test environments. No per-repo-config equivalent —
+       *  only way to opt out for a single run. */
       skipGit: external_exports.boolean().optional().default(false)
     });
     GenerateViolationsSchema = external_exports.object({
@@ -121328,7 +121461,7 @@ function parseStringDef(def, refs) {
         case "trim":
           break;
         default:
-          /* @__PURE__ */ ((_2) => {
+          /* @__PURE__ */ ((_) => {
           })(check);
       }
     }
@@ -122176,7 +122309,7 @@ var init_selectParser = __esm({
         case ZodFirstPartyTypeKind.ZodSymbol:
           return void 0;
         default:
-          return /* @__PURE__ */ ((_2) => void 0)(typeName);
+          return /* @__PURE__ */ ((_) => void 0)(typeName);
       }
     };
   }
@@ -125880,422 +126013,6 @@ var init_violation_pipeline_service = __esm({
   }
 });
 
-// apps/server/dist/commands/diff-in-process.js
-var diff_in_process_exports = {};
-__export(diff_in_process_exports, {
-  diffInProcess: () => diffInProcess
-});
-import path14 from "node:path";
-import { randomUUID as randomUUID7 } from "node:crypto";
-async function diffInProcess(project, options = {}) {
-  const latest = readLatest(project.path);
-  if (!latest) {
-    throw new Error("Run a full analysis first before checking a diff.");
-  }
-  const projectConfig = readProjectConfig(project.path);
-  const enabledCategories = options.enabledCategoriesOverride ?? projectConfig.enabledCategories ?? void 0;
-  const enableLlmRules = options.enableLlmRulesOverride ?? projectConfig.enableLlmRules ?? false;
-  const git = await getGit(project.path);
-  const statusResult = await git.status();
-  const changedFiles = [];
-  for (const f of statusResult.not_added)
-    changedFiles.push({ path: f, status: "new" });
-  for (const f of statusResult.created)
-    changedFiles.push({ path: f, status: "new" });
-  for (const f of statusResult.modified)
-    changedFiles.push({ path: f, status: "modified" });
-  for (const f of statusResult.staged) {
-    if (!changedFiles.some((cf) => cf.path === f)) {
-      changedFiles.push({ path: f, status: "modified" });
-    }
-  }
-  for (const f of statusResult.deleted)
-    changedFiles.push({ path: f, status: "deleted" });
-  const commitHash = (await git.revparse(["HEAD"])).trim() || null;
-  options.tracker?.start("parse", "Analyzing working tree...");
-  const result = await runAnalysis(project.path, latest.analysis.branch ?? void 0, (progress) => {
-    options.tracker?.detail("parse", progress.detail ?? "Analyzing...");
-    options.onProgress?.({ detail: progress.detail });
-  }, { signal: options.signal, skipStash: true });
-  if (options.signal?.aborted)
-    throw new DOMException("Diff cancelled", "AbortError");
-  const { graph, serviceIdMap, moduleIdMap, methodIdMap, dbIdMap } = buildGraph(result);
-  const analysisId = randomUUID7();
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  options.tracker?.done("parse", `${result.services.length} services, ${result.fileAnalyses?.length ?? 0} files`);
-  const pipelineResult = await runViolationPipeline({
-    repoPath: project.path,
-    analysisId,
-    now,
-    result,
-    serviceIdMap,
-    moduleIdMap,
-    methodIdMap,
-    dbIdMap,
-    previousActiveViolations: latest.violations,
-    enabledCategories,
-    enableLlmRules,
-    tracker: options.tracker,
-    signal: options.signal
-  });
-  const diff = buildDiffSnapshot({
-    latest,
-    graph,
-    analysisId,
-    now,
-    branch: latest.analysis.branch,
-    commitHash,
-    changedFiles,
-    pipelineResult,
-    repoPath: project.path
-  });
-  writeDiff(project.path, diff);
-  log.info(`[Diff] Done \u2014 ${diff.summary.newCount} new, ${diff.summary.unchangedCount} unchanged, ${diff.summary.resolvedCount} resolved across ${diff.changedFiles.length} changed files`);
-  return { diff, isStale: false };
-}
-function buildDiffSnapshot(params) {
-  const { latest, graph, analysisId, branch, commitHash, changedFiles, pipelineResult, repoPath } = params;
-  const serviceById = new Map(graph.services.map((s) => [s.id, s.name]));
-  const moduleById = new Map(graph.modules.map((m) => [m.id, m.name]));
-  const methodById = new Map(graph.methods.map((m) => [m.id, m.name]));
-  const databaseById = new Map(graph.databases.map((d3) => [d3.id, d3.name]));
-  const denormalize = (v) => ({
-    ...v,
-    targetServiceName: v.targetServiceId ? serviceById.get(v.targetServiceId) ?? null : null,
-    targetModuleName: v.targetModuleId ? moduleById.get(v.targetModuleId) ?? null : null,
-    targetMethodName: v.targetMethodId ? methodById.get(v.targetMethodId) ?? null : null,
-    targetDatabaseName: v.targetDatabaseId ? databaseById.get(v.targetDatabaseId) ?? null : null
-  });
-  const newViolations = pipelineResult.added.map(denormalize);
-  const latestById = new Map(latest.violations.map((v) => [v.id, v]));
-  const resolvedViolations = pipelineResult.resolvedRefs.map((r) => latestById.get(r.id)).filter((v) => !!v);
-  const changedAbs = new Set(changedFiles.map((c2) => path14.resolve(repoPath, c2.path)));
-  const matchesChanged = (p2) => !!p2 && (changedAbs.has(p2) || changedAbs.has(path14.resolve(repoPath, p2)));
-  const affectedModules = graph.modules.filter((m) => matchesChanged(m.filePath));
-  const affectedModuleIdSet = new Set(affectedModules.map((m) => m.id));
-  const serviceNameById = new Map(graph.services.map((s) => [s.id, s.name]));
-  const layerKeyById = new Map(graph.layers.map((l) => [l.id, `${l.serviceName}::${l.layer}`]));
-  const affectedServices = /* @__PURE__ */ new Set();
-  const affectedLayers = /* @__PURE__ */ new Set();
-  const affectedModuleKeys = /* @__PURE__ */ new Set();
-  for (const mod of affectedModules) {
-    const svcName = serviceNameById.get(mod.serviceId);
-    if (svcName) {
-      affectedServices.add(svcName);
-      affectedModuleKeys.add(`${svcName}::${mod.name}`);
-    }
-    const layerKey = layerKeyById.get(mod.layerId);
-    if (layerKey)
-      affectedLayers.add(layerKey);
-  }
-  const moduleNameById = new Map(graph.modules.map((m) => [m.id, m.name]));
-  const affectedMethodKeys = [];
-  for (const method of graph.methods) {
-    if (!affectedModuleIdSet.has(method.moduleId))
-      continue;
-    const modName = moduleNameById.get(method.moduleId);
-    const mod = graph.modules.find((m) => m.id === method.moduleId);
-    const svcName = mod ? serviceNameById.get(mod.serviceId) : void 0;
-    if (svcName && modName)
-      affectedMethodKeys.push(`${svcName}::${modName}::${method.name}`);
-  }
-  return {
-    id: analysisId,
-    baseAnalysisId: latest.analysis.id,
-    createdAt: params.now,
-    branch,
-    commitHash,
-    graph,
-    changedFiles,
-    newViolations,
-    resolvedViolations,
-    affectedNodeIds: {
-      services: [...affectedServices],
-      layers: [...affectedLayers],
-      modules: [...affectedModuleKeys],
-      methods: affectedMethodKeys
-    },
-    summary: {
-      newCount: newViolations.length,
-      unchangedCount: pipelineResult.unchanged.length,
-      resolvedCount: resolvedViolations.length
-    }
-  };
-}
-var init_diff_in_process = __esm({
-  "apps/server/dist/commands/diff-in-process.js"() {
-    "use strict";
-    init_git();
-    init_logger();
-    init_project_config();
-    init_analyzer_service();
-    init_analysis_persistence_service();
-    init_violation_pipeline_service();
-    init_analysis_store();
-  }
-});
-
-// node_modules/.pnpm/commander@12.1.0/node_modules/commander/esm.mjs
-var import_index = __toESM(require_commander(), 1);
-var {
-  program,
-  createCommand,
-  createArgument,
-  createOption,
-  CommanderError,
-  InvalidArgumentError,
-  InvalidOptionArgumentError,
-  // deprecated old name
-  Command,
-  Argument,
-  Option,
-  Help
-} = import_index.default;
-
-// tools/cli/src/index.ts
-init_dist4();
-
-// tools/cli/src/commands/add.ts
-init_dist4();
-init_paths();
-init_registry();
-init_helpers();
-async function runAdd() {
-  const repoPath = resolveRepoDir(process.cwd()) ?? process.cwd();
-  mt("Adding repository to TrueCourse");
-  O2.step(repoPath);
-  ensureRepoTruecourseDir(repoPath);
-  const existing = getProjectByPath(repoPath);
-  const entry = registerProject(repoPath);
-  if (existing) {
-    O2.info(`Repository "${entry.name}" is already registered.`);
-  } else {
-    O2.success(`Repository "${entry.name}" added.`);
-  }
-  await promptInstallSkills(repoPath);
-  gt("Run `truecourse analyze` to generate analysis data.");
-}
-
-// tools/cli/src/commands/analyze.ts
-init_dist4();
-import { execSync } from "node:child_process";
-import path15 from "node:path";
-
-// apps/server/dist/commands/analyze-in-process.js
-init_logger();
-init_git();
-init_project_config();
-init_registry();
-init_analyzer_service();
-init_analysis_persistence_service();
-import { randomUUID as randomUUID6 } from "node:crypto";
-
-// apps/server/dist/services/flow.service.js
-init_logger();
-init_dist6();
-init_analysis_store();
-import { randomUUID as randomUUID2 } from "node:crypto";
-function detectFlows(result) {
-  const dbTypeMap = /* @__PURE__ */ new Map();
-  for (const db of result.databaseResult.databases) {
-    dbTypeMap.set(db.name, db.type);
-  }
-  const functionsByFile = /* @__PURE__ */ new Map();
-  if (result.fileAnalyses) {
-    for (const fa of result.fileAnalyses) {
-      const entries = [];
-      for (const fn of fa.functions) {
-        entries.push({ name: fn.name, startLine: fn.location.startLine, endLine: fn.location.endLine });
-      }
-      for (const cls of fa.classes) {
-        for (const method of cls.methods) {
-          entries.push({ name: method.name, startLine: method.location.startLine, endLine: method.location.endLine });
-        }
-      }
-      if (entries.length > 0)
-        functionsByFile.set(fa.filePath, entries);
-    }
-  }
-  const crossServiceCalls = [];
-  const fileToModule = /* @__PURE__ */ new Map();
-  for (const mod of result.modules) {
-    fileToModule.set(mod.filePath, `${mod.serviceName}::${mod.name}`);
-  }
-  const fileToLanguage = /* @__PURE__ */ new Map();
-  if (result.fileAnalyses) {
-    for (const fa of result.fileAnalyses) {
-      fileToLanguage.set(fa.filePath, fa.language);
-    }
-  }
-  for (const dep of result.dependencies) {
-    if (!dep.httpCalls || dep.httpCalls.length === 0)
-      continue;
-    for (const call of dep.httpCalls) {
-      const moduleKey = fileToModule.get(call.location.filePath);
-      if (!moduleKey)
-        continue;
-      const [sourceService, sourceModule] = moduleKey.split("::");
-      let sourceMethod;
-      const fileFunctions = functionsByFile.get(call.location.filePath);
-      if (fileFunctions) {
-        for (const fn of fileFunctions) {
-          if (call.location.startLine >= fn.startLine && call.location.startLine <= fn.endLine) {
-            sourceMethod = fn.name;
-            break;
-          }
-        }
-      }
-      const language = fileToLanguage.get(call.location.filePath);
-      const normalizedUrl = language ? normalizeUrl(call.url, language) : call.url;
-      crossServiceCalls.push({
-        sourceService,
-        sourceModule,
-        sourceMethod,
-        httpMethod: call.method,
-        url: normalizedUrl,
-        targetService: dep.target
-      });
-    }
-  }
-  const routeHandlers = buildRouteHandlerLookup(result);
-  const graph = new AnalysisGraph({
-    methods: result.methods,
-    methodDependencies: result.methodLevelDependencies,
-    modules: result.modules,
-    services: result.services.map((s) => ({ name: s.name, type: s.type })),
-    crossServiceCalls: crossServiceCalls.length > 0 ? crossServiceCalls : void 0,
-    databaseConnections: result.databaseResult.connections.map((c2) => ({
-      serviceName: c2.serviceName,
-      databaseName: c2.databaseName,
-      databaseType: dbTypeMap.get(c2.databaseName) || "unknown"
-    })),
-    routeHandlers: routeHandlers.size > 0 ? routeHandlers : void 0
-  });
-  const traced = traceFlows(graph);
-  const out = traced.map((flow) => ({
-    id: randomUUID2(),
-    name: flow.name,
-    description: null,
-    entryService: flow.entryService,
-    entryMethod: flow.entryMethod,
-    category: flow.category,
-    trigger: flow.trigger,
-    stepCount: flow.steps.length,
-    steps: flow.steps.map((step) => ({
-      stepOrder: step.stepOrder,
-      sourceService: step.sourceService,
-      sourceModule: step.sourceModule,
-      sourceMethod: step.sourceMethod,
-      targetService: step.targetService,
-      targetModule: step.targetModule,
-      targetMethod: step.targetMethod,
-      stepType: step.stepType,
-      dataDescription: null,
-      isAsync: step.isAsync,
-      isConditional: step.isConditional
-    }))
-  }));
-  log.info(`[Flows] Detected ${out.length} flows`);
-  return out;
-}
-function buildRouteHandlerLookup(result) {
-  const handlers = /* @__PURE__ */ new Map();
-  if (!result.fileAnalyses)
-    return handlers;
-  const fileToService = /* @__PURE__ */ new Map();
-  const fileToModuleName = /* @__PURE__ */ new Map();
-  for (const mod of result.modules) {
-    fileToService.set(mod.filePath, mod.serviceName);
-    fileToModuleName.set(mod.filePath, mod.name);
-  }
-  for (const ld of result.layerDetails) {
-    for (const fp of ld.filePaths) {
-      if (!fileToService.has(fp))
-        fileToService.set(fp, ld.serviceName);
-    }
-  }
-  const fileMountPrefix = /* @__PURE__ */ new Map();
-  for (const fa of result.fileAnalyses) {
-    if (!fa.routerMounts || fa.routerMounts.length === 0)
-      continue;
-    for (const mount of fa.routerMounts) {
-      for (const imp of fa.imports) {
-        const spec = imp.specifiers.find((s) => s.name === mount.routerName || s.alias === mount.routerName);
-        if (spec) {
-          for (const dep of result.moduleDependencies) {
-            if (dep.source === fa.filePath && dep.importedNames.includes(spec.name)) {
-              fileMountPrefix.set(dep.target, mount.path);
-            }
-          }
-        }
-      }
-      const hasLocal = fa.functions.some((f) => f.name === mount.routerName) || fa.exports.some((e) => e.name === mount.routerName);
-      if (hasLocal)
-        fileMountPrefix.set(fa.filePath, mount.path);
-    }
-  }
-  for (const fa of result.fileAnalyses) {
-    if (!fa.routeRegistrations || fa.routeRegistrations.length === 0)
-      continue;
-    const serviceName = fileToService.get(fa.filePath);
-    if (!serviceName)
-      continue;
-    const mountPrefix = fileMountPrefix.get(fa.filePath) || "";
-    for (const route of fa.routeRegistrations) {
-      const fullPath = composePath(mountPrefix, route.path);
-      const moduleName = resolveHandlerModule(route.handlerName, fa, result.fileAnalyses, fileToModuleName);
-      const key = `${serviceName}::${route.httpMethod}::${fullPath}`;
-      handlers.set(key, { handlerName: route.handlerName, moduleName });
-    }
-  }
-  return handlers;
-}
-function resolveHandlerModule(handlerName, routeFile, allFiles, fileToModuleName) {
-  for (const cls of routeFile.classes) {
-    for (const method of cls.methods) {
-      if (method.name === handlerName)
-        return fileToModuleName.get(routeFile.filePath) || handlerName;
-    }
-  }
-  for (const fn of routeFile.functions) {
-    if (fn.name === handlerName)
-      return fileToModuleName.get(routeFile.filePath) || handlerName;
-  }
-  for (const imp of routeFile.imports) {
-    const spec = imp.specifiers.find((s) => s.name === handlerName || s.alias === handlerName);
-    if (spec) {
-      for (const targetFile of allFiles) {
-        const hasExport = targetFile.exports.some((e) => e.name === (spec.alias || spec.name) || e.name === spec.name);
-        const hasFunction = targetFile.functions.some((f) => f.name === spec.name);
-        const hasClassMethod = targetFile.classes.some((c2) => c2.methods.some((m) => m.name === spec.name));
-        if (hasExport || hasFunction || hasClassMethod) {
-          return fileToModuleName.get(targetFile.filePath) || handlerName;
-        }
-      }
-    }
-    for (const s of imp.specifiers) {
-      for (const targetFile of allFiles) {
-        for (const cls of targetFile.classes) {
-          if (cls.name === s.name && cls.methods.some((m) => m.name === handlerName)) {
-            return fileToModuleName.get(targetFile.filePath) || cls.name;
-          }
-        }
-      }
-    }
-  }
-  return fileToModuleName.get(routeFile.filePath) || handlerName;
-}
-function composePath(prefix, routePath) {
-  const p2 = prefix.endsWith("/") ? prefix.slice(0, -1) : prefix;
-  const r = routePath.startsWith("/") ? routePath : `/${routePath}`;
-  const full = `${p2}${r}`;
-  return full.length > 1 && full.endsWith("/") ? full.slice(0, -1) : full || "/";
-}
-
-// apps/server/dist/commands/analyze-in-process.js
-init_violation_pipeline_service();
-init_provider();
-
 // apps/server/dist/services/usage.service.js
 function toUsageRecords(records) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -126312,11 +126029,15 @@ function toUsageRecords(records) {
     createdAt: now
   }));
 }
+var init_usage_service = __esm({
+  "apps/server/dist/services/usage.service.js"() {
+    "use strict";
+  }
+});
 
-// apps/server/dist/commands/analyze-in-process.js
-init_analysis_store();
-init_atomic_write();
-async function analyzeInProcess(project, options = {}) {
+// apps/server/dist/commands/analyze-core.js
+import { randomUUID as randomUUID6 } from "node:crypto";
+async function analyzeCore(project, options) {
   try {
     acquireAnalyzeLock(project.path);
   } catch (err) {
@@ -126325,12 +126046,27 @@ async function analyzeInProcess(project, options = {}) {
     throw err;
   }
   try {
-    const start = Date.now();
-    const { skipGit, signal } = options;
+    const { mode, signal } = options;
+    const isDiff = mode === "diff";
+    const skipGit = !isDiff && !!options.skipGit;
     const projectConfig = readProjectConfig(project.path);
+    const latestBaseline = readLatest(project.path);
+    if (isDiff && !latestBaseline) {
+      throw new Error("Run a full analysis first before checking a diff.");
+    }
     let branch = options.branch ?? null;
     let commitHash = options.commitHash ?? null;
-    if (!skipGit && (branch === null || commitHash === null)) {
+    if (isDiff) {
+      branch = latestBaseline.analysis.branch ?? branch;
+      if (commitHash === null) {
+        try {
+          const git = await getGit(project.path);
+          commitHash = (await git.revparse(["HEAD"])).trim() || null;
+        } catch {
+          commitHash = null;
+        }
+      }
+    } else if (!skipGit && (branch === null || commitHash === null)) {
       const git = await getGit(project.path);
       if (branch === null)
         branch = (await git.branch()).current || null;
@@ -126339,39 +126075,62 @@ async function analyzeInProcess(project, options = {}) {
     }
     const analysisId = randomUUID6();
     const now = (/* @__PURE__ */ new Date()).toISOString();
-    const filename = buildAnalysisFilename(analysisId, now);
+    const start = Date.now();
     const effectiveCategories = options.enabledCategoriesOverride?.length ? options.enabledCategoriesOverride : projectConfig.enabledCategories ?? void 0;
     const effectiveLlmRules = projectConfig.enableLlmRules ?? options.enableLlmRulesOverride ?? true;
-    options.tracker?.start("parse", "Starting analysis...");
+    options.tracker?.start("parse", isDiff ? "Analyzing working tree..." : "Starting analysis...");
     const result = await runAnalysis(project.path, branch ?? void 0, (progress) => {
       options.tracker?.detail("parse", progress.detail ?? "Analyzing...");
       options.onProgress?.({ detail: progress.detail });
-    }, { signal });
-    if (signal?.aborted)
-      throw new DOMException("Analysis cancelled", "AbortError");
-    const { graph, serviceIdMap, moduleIdMap, methodIdMap, dbIdMap } = buildGraph(result);
-    const previousLatest = readLatest(project.path);
-    const previousAnalysisId = previousLatest?.analysis.id ?? null;
-    const previousActiveViolations = previousLatest ? previousLatest.violations.filter((v) => branch == null || previousLatest.analysis.branch == null || previousLatest.analysis.branch === branch) : [];
-    try {
-      graph.flows = detectFlows(result);
-    } catch (flowError) {
-      log.error(`[Flows] Detection failed: ${flowError instanceof Error ? flowError.message : String(flowError)}`);
-      graph.flows = [];
+    }, { signal, skipStash: isDiff });
+    if (signal?.aborted) {
+      throw new DOMException(isDiff ? "Diff cancelled" : "Analysis cancelled", "AbortError");
     }
-    touchProject(project.slug);
+    const { graph, serviceIdMap, moduleIdMap, methodIdMap, dbIdMap } = buildGraph(result);
+    let changedFiles = [];
     let changedFileSet;
-    if (previousLatest?.analysis.commitHash && !skipGit) {
+    if (isDiff) {
+      try {
+        const git = await getGit(project.path);
+        const statusResult = await git.status();
+        for (const f of statusResult.not_added)
+          changedFiles.push({ path: f, status: "new" });
+        for (const f of statusResult.created)
+          changedFiles.push({ path: f, status: "new" });
+        for (const f of statusResult.modified)
+          changedFiles.push({ path: f, status: "modified" });
+        for (const f of statusResult.staged) {
+          if (!changedFiles.some((cf) => cf.path === f)) {
+            changedFiles.push({ path: f, status: "modified" });
+          }
+        }
+        for (const f of statusResult.deleted)
+          changedFiles.push({ path: f, status: "deleted" });
+      } catch (err) {
+        log.warn(`[Diff] git status failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    } else if (latestBaseline?.analysis.commitHash && !skipGit) {
       try {
         const git = await getGit(project.path);
-        const diffOutput = await git.diff([previousLatest.analysis.commitHash, "HEAD", "--name-only"]);
+        const diffOutput = await git.diff([latestBaseline.analysis.commitHash, "HEAD", "--name-only"]);
         const files = diffOutput.trim().split("\n").filter(Boolean);
         if (files.length > 0)
           changedFileSet = new Set(files);
       } catch {
       }
     }
+    if (!isDiff) {
+      try {
+        graph.flows = detectFlows(result);
+      } catch (flowError) {
+        log.error(`[Flows] Detection failed: ${flowError instanceof Error ? flowError.message : String(flowError)}`);
+        graph.flows = [];
+      }
+      touchProject(project.slug);
+    }
     options.tracker?.done("parse", `${result.services.length} services, ${result.fileAnalyses?.length ?? 0} files`);
+    const previousActiveViolations = latestBaseline ? latestBaseline.violations.filter((v) => branch == null || latestBaseline.analysis.branch == null || latestBaseline.analysis.branch === branch) : [];
+    const previousAnalysisId = latestBaseline?.analysis.id ?? null;
     const provider = options.provider ?? (effectiveLlmRules ? createLLMProvider() : void 0);
     if (provider) {
       provider.setAnalysisId(analysisId);
@@ -126379,32 +126138,28 @@ async function analyzeInProcess(project, options = {}) {
       if (signal)
         provider.setAbortSignal(signal);
     }
-    let pipelineResult;
-    try {
-      pipelineResult = await runViolationPipeline({
-        repoPath: project.path,
-        analysisId,
-        now,
-        result,
-        serviceIdMap,
-        moduleIdMap,
-        methodIdMap,
-        dbIdMap,
-        previousActiveViolations,
-        changedFileSet,
-        tracker: options.tracker,
-        enabledCategories: effectiveCategories,
-        enableLlmRules: effectiveLlmRules,
-        provider,
-        signal,
-        onLlmEstimate: options.onLlmEstimate ? async (estimate) => {
-          const proceed = await options.onLlmEstimate(estimate);
-          options.onLlmResolved?.(proceed);
-          return proceed;
-        } : void 0
-      });
-    } finally {
-    }
+    const pipelineResult = await runViolationPipeline({
+      repoPath: project.path,
+      analysisId,
+      now,
+      result,
+      serviceIdMap,
+      moduleIdMap,
+      methodIdMap,
+      dbIdMap,
+      previousActiveViolations,
+      changedFileSet,
+      tracker: options.tracker,
+      enabledCategories: effectiveCategories,
+      enableLlmRules: effectiveLlmRules,
+      provider,
+      signal,
+      onLlmEstimate: options.onLlmEstimate ? async (estimate) => {
+        const proceed = await options.onLlmEstimate(estimate);
+        options.onLlmResolved?.(proceed);
+        return proceed;
+      } : void 0
+    });
     if (pipelineResult.serviceDescriptions.length > 0) {
       for (const desc of pipelineResult.serviceDescriptions) {
         const svc = graph.services.find((s) => s.id === desc.id);
@@ -126416,56 +126171,105 @@ async function analyzeInProcess(project, options = {}) {
     enforceLocationInvariant(pipelineResult.added);
     enforceLocationInvariant(pipelineResult.unchanged);
     enforceLocationInvariant(pipelineResult.resolved);
-    const snapshot = {
-      id: analysisId,
-      createdAt: now,
+    log.info(`[${isDiff ? "Diff" : "Analysis"}] core complete in ${Date.now() - start}ms \u2014 ${pipelineResult.added.length} added, ${pipelineResult.unchanged.length} unchanged, ${pipelineResult.resolvedRefs.length} resolved`);
+    return {
+      mode,
+      analysisId,
+      now,
       branch,
       commitHash,
       architecture: result.architecture,
-      status: "completed",
       metadata: result.metadata ?? null,
       graph,
-      violations: {
-        added: pipelineResult.added,
-        resolved: pipelineResult.resolvedRefs,
-        previousAnalysisId
-      },
-      usage
-    };
-    const latest = buildLatestSnapshot(snapshot, filename, pipelineResult.unchanged, pipelineResult.added);
-    const { bySeverity, total } = summarizeActiveViolations(latest.violations);
-    writeAnalysis(project.path, snapshot);
-    writeLatest(project.path, latest);
-    const historyEntry = buildHistoryEntry(snapshot, filename, pipelineResult);
-    appendHistory(project.path, historyEntry);
-    deleteDiff(project.path);
-    setLastAnalyzed(project.slug, now);
-    return {
-      analysisId,
-      filename,
-      serviceCount: result.services.length,
-      fileCount: result.fileAnalyses?.length ?? 0,
-      architecture: result.architecture,
-      durationMs: Date.now() - start,
-      violationsSummary: { total, bySeverity }
+      changedFiles,
+      pipelineResult,
+      usage,
+      latestBaseline,
+      previousAnalysisId,
+      analysisResult: result
     };
   } finally {
     releaseAnalyzeLock(project.path);
   }
 }
+function enforceLocationInvariant(violations) {
+  for (const v of violations) {
+    const hasFile = v.filePath != null;
+    const hasRange = v.lineStart != null && v.lineEnd != null;
+    if (hasFile === hasRange)
+      continue;
+    log.warn(`[Violations] ${v.ruleKey}: partial location (filePath=${v.filePath}, lineStart=${v.lineStart}, lineEnd=${v.lineEnd}) \u2014 dropping to uphold the location invariant`);
+    v.filePath = null;
+    v.lineStart = null;
+    v.lineEnd = null;
+  }
+}
+var init_analyze_core = __esm({
+  "apps/server/dist/commands/analyze-core.js"() {
+    "use strict";
+    init_logger();
+    init_git();
+    init_project_config();
+    init_registry();
+    init_analyzer_service();
+    init_analysis_persistence_service();
+    init_flow_service();
+    init_violation_pipeline_service();
+    init_provider();
+    init_usage_service();
+    init_analysis_store();
+    init_atomic_write();
+  }
+});
+
+// apps/server/dist/commands/analyze-persist.js
+import path13 from "node:path";
+function persistFullAnalysis(project, core2, startedAt) {
+  const filename = buildAnalysisFilename(core2.analysisId, core2.now);
+  const snapshot = {
+    id: core2.analysisId,
+    createdAt: core2.now,
+    branch: core2.branch,
+    commitHash: core2.commitHash,
+    architecture: core2.architecture,
+    status: "completed",
+    metadata: core2.metadata,
+    graph: core2.graph,
+    violations: {
+      added: core2.pipelineResult.added,
+      resolved: core2.pipelineResult.resolvedRefs,
+      previousAnalysisId: core2.previousAnalysisId
+    },
+    usage: core2.usage
+  };
+  const latest = buildLatestSnapshot(snapshot, filename, core2.pipelineResult.unchanged, core2.pipelineResult.added);
+  const { bySeverity, total } = summarizeActiveViolations(latest.violations);
+  writeAnalysis(project.path, snapshot);
+  writeLatest(project.path, latest);
+  appendHistory(project.path, buildHistoryEntry(snapshot, filename, core2.pipelineResult));
+  deleteDiff(project.path);
+  setLastAnalyzed(project.slug, core2.now);
+  return {
+    analysisId: core2.analysisId,
+    filename,
+    serviceCount: core2.graph.services.length,
+    fileCount: core2.analysisResult.fileAnalyses?.length ?? 0,
+    architecture: core2.architecture,
+    durationMs: Date.now() - startedAt,
+    violationsSummary: { total, bySeverity }
+  };
+}
+function persistDiffAnalysis(project, core2) {
+  if (!core2.latestBaseline) {
+    throw new Error("Diff persist requires a latestBaseline \u2014 analyzeCore should have enforced this.");
+  }
+  const diff = buildDiffSnapshot(project.path, core2, core2.latestBaseline);
+  writeDiff(project.path, diff);
+  log.info(`[Diff] Done \u2014 ${diff.summary.newCount} new, ${diff.summary.unchangedCount} unchanged, ${diff.summary.resolvedCount} resolved across ${diff.changedFiles.length} changed files`);
+  return { diff, isStale: false };
+}
 function buildLatestSnapshot(snapshot, filename, unchanged, added) {
-  const { graph } = snapshot;
-  const serviceById = new Map(graph.services.map((s) => [s.id, s.name]));
-  const moduleById = new Map(graph.modules.map((m) => [m.id, m.name]));
-  const methodById = new Map(graph.methods.map((m) => [m.id, m.name]));
-  const databaseById = new Map(graph.databases.map((d3) => [d3.id, d3.name]));
-  const denormalize = (v) => ({
-    ...v,
-    targetServiceName: v.targetServiceId ? serviceById.get(v.targetServiceId) ?? null : null,
-    targetModuleName: v.targetModuleId ? moduleById.get(v.targetModuleId) ?? null : null,
-    targetMethodName: v.targetMethodId ? methodById.get(v.targetMethodId) ?? null : null,
-    targetDatabaseName: v.targetDatabaseId ? databaseById.get(v.targetDatabaseId) ?? null : null
-  });
+  const denormalize = makeDenormalizer(snapshot.graph);
   return {
     head: filename,
     analysis: {
@@ -126477,7 +126281,7 @@ function buildLatestSnapshot(snapshot, filename, unchanged, added) {
       metadata: snapshot.metadata,
       status: "completed"
     },
-    graph,
+    graph: snapshot.graph,
     violations: [...added.map(denormalize), ...unchanged.map(denormalize)]
   };
 }
@@ -126541,17 +126345,159 @@ function buildHistoryEntry(snapshot, filename, pipeline) {
     }
   };
 }
-function enforceLocationInvariant(violations) {
-  for (const v of violations) {
-    const hasFile = v.filePath != null;
-    const hasRange = v.lineStart != null && v.lineEnd != null;
-    if (hasFile === hasRange)
+function buildDiffSnapshot(repoPath, core2, baseline) {
+  const { graph, changedFiles, pipelineResult } = core2;
+  const denormalize = makeDenormalizer(graph);
+  const newViolations = pipelineResult.added.map(denormalize);
+  const latestById = new Map(baseline.violations.map((v) => [v.id, v]));
+  const resolvedViolations = pipelineResult.resolvedRefs.map((r) => latestById.get(r.id)).filter((v) => !!v);
+  const changedAbs = new Set(changedFiles.map((c2) => path13.resolve(repoPath, c2.path)));
+  const matchesChanged = (p2) => !!p2 && (changedAbs.has(p2) || changedAbs.has(path13.resolve(repoPath, p2)));
+  const affectedModules = graph.modules.filter((m) => matchesChanged(m.filePath));
+  const affectedModuleIdSet = new Set(affectedModules.map((m) => m.id));
+  const serviceNameById = new Map(graph.services.map((s) => [s.id, s.name]));
+  const layerKeyById = new Map(graph.layers.map((l) => [l.id, `${l.serviceName}::${l.layer}`]));
+  const affectedServices = /* @__PURE__ */ new Set();
+  const affectedLayers = /* @__PURE__ */ new Set();
+  const affectedModuleKeys = /* @__PURE__ */ new Set();
+  for (const mod of affectedModules) {
+    const svcName = serviceNameById.get(mod.serviceId);
+    if (svcName) {
+      affectedServices.add(svcName);
+      affectedModuleKeys.add(`${svcName}::${mod.name}`);
+    }
+    const layerKey = layerKeyById.get(mod.layerId);
+    if (layerKey)
+      affectedLayers.add(layerKey);
+  }
+  const moduleNameById = new Map(graph.modules.map((m) => [m.id, m.name]));
+  const affectedMethodKeys = [];
+  for (const method of graph.methods) {
+    if (!affectedModuleIdSet.has(method.moduleId))
       continue;
-    log.warn(`[Violations] ${v.ruleKey}: partial location (filePath=${v.filePath}, lineStart=${v.lineStart}, lineEnd=${v.lineEnd}) \u2014 dropping to uphold the location invariant`);
-    v.filePath = null;
-    v.lineStart = null;
-    v.lineEnd = null;
+    const modName = moduleNameById.get(method.moduleId);
+    const mod = graph.modules.find((m) => m.id === method.moduleId);
+    const svcName = mod ? serviceNameById.get(mod.serviceId) : void 0;
+    if (svcName && modName)
+      affectedMethodKeys.push(`${svcName}::${modName}::${method.name}`);
+  }
+  return {
+    id: core2.analysisId,
+    baseAnalysisId: baseline.analysis.id,
+    createdAt: core2.now,
+    branch: core2.branch,
+    commitHash: core2.commitHash,
+    graph,
+    changedFiles,
+    newViolations,
+    resolvedViolations,
+    affectedNodeIds: {
+      services: [...affectedServices],
+      layers: [...affectedLayers],
+      modules: [...affectedModuleKeys],
+      methods: affectedMethodKeys
+    },
+    summary: {
+      newCount: newViolations.length,
+      unchangedCount: pipelineResult.unchanged.length,
+      resolvedCount: resolvedViolations.length
+    },
+    usage: core2.usage
+  };
+}
+function makeDenormalizer(graph) {
+  const serviceById = new Map(graph.services.map((s) => [s.id, s.name]));
+  const moduleById = new Map(graph.modules.map((m) => [m.id, m.name]));
+  const methodById = new Map(graph.methods.map((m) => [m.id, m.name]));
+  const databaseById = new Map(graph.databases.map((d3) => [d3.id, d3.name]));
+  return (v) => ({
+    ...v,
+    targetServiceName: v.targetServiceId ? serviceById.get(v.targetServiceId) ?? null : null,
+    targetModuleName: v.targetModuleId ? moduleById.get(v.targetModuleId) ?? null : null,
+    targetMethodName: v.targetMethodId ? methodById.get(v.targetMethodId) ?? null : null,
+    targetDatabaseName: v.targetDatabaseId ? databaseById.get(v.targetDatabaseId) ?? null : null
+  });
+}
+var init_analyze_persist = __esm({
+  "apps/server/dist/commands/analyze-persist.js"() {
+    "use strict";
+    init_logger();
+    init_registry();
+    init_analysis_store();
+  }
+});
+
+// apps/server/dist/commands/diff-in-process.js
+var diff_in_process_exports = {};
+__export(diff_in_process_exports, {
+  diffInProcess: () => diffInProcess
+});
+async function diffInProcess(project, options = {}) {
+  const core2 = await analyzeCore(project, { ...options, mode: "diff" });
+  return persistDiffAnalysis(project, core2);
+}
+var init_diff_in_process = __esm({
+  "apps/server/dist/commands/diff-in-process.js"() {
+    "use strict";
+    init_analyze_core();
+    init_analyze_persist();
   }
+});
+
+// node_modules/.pnpm/commander@12.1.0/node_modules/commander/esm.mjs
+var import_index = __toESM(require_commander(), 1);
+var {
+  program,
+  createCommand,
+  createArgument,
+  createOption,
+  CommanderError,
+  InvalidArgumentError,
+  InvalidOptionArgumentError,
+  // deprecated old name
+  Command,
+  Argument,
+  Option,
+  Help
+} = import_index.default;
+
+// tools/cli/src/index.ts
+init_dist4();
+
+// tools/cli/src/commands/add.ts
+init_dist4();
+init_paths();
+init_registry();
+init_helpers();
+async function runAdd() {
+  const repoPath = resolveRepoDir(process.cwd()) ?? process.cwd();
+  mt("Adding repository to TrueCourse");
+  O2.step(repoPath);
+  ensureRepoTruecourseDir(repoPath);
+  const existing = getProjectByPath(repoPath);
+  const entry = registerProject(repoPath);
+  if (existing) {
+    O2.info(`Repository "${entry.name}" is already registered.`);
+  } else {
+    O2.success(`Repository "${entry.name}" added.`);
+  }
+  await promptInstallSkills(repoPath);
+  gt("Run `truecourse analyze` to generate analysis data.");
+}
+
+// tools/cli/src/commands/analyze.ts
+init_dist4();
+import { execSync } from "node:child_process";
+import path15 from "node:path";
+
+// apps/server/dist/commands/analyze-in-process.js
+init_analysis_store();
+init_analyze_core();
+init_analyze_persist();
+async function analyzeInProcess(project, options = {}) {
+  const startedAt = Date.now();
+  const core2 = await analyzeCore(project, { ...options, mode: "full" });
+  return persistFullAnalysis(project, core2, startedAt);
 }
 
 // tools/cli/src/commands/analyze.ts
@@ -126562,10 +126508,24 @@ init_project_config();
 init_logger();
 init_helpers();
 
+// tools/cli/src/commands/llm-prompt.ts
+init_dist4();
+async function promptLlmEstimate(estimate) {
+  const totalRules = estimate.uniqueRuleCount ?? estimate.tiers.reduce((s, t2) => s + t2.ruleCount, 0);
+  const totalFiles = estimate.uniqueFileCount ?? estimate.tiers.reduce((s, t2) => s + t2.fileCount, 0);
+  const tokens = estimate.totalEstimatedTokens;
+  const tokenStr = tokens >= 1e6 ? `~${(tokens / 1e6).toFixed(1)}M tokens` : `~${Math.round(tokens / 1e3)}k tokens`;
+  O2.step(`LLM will analyze ${totalFiles} files with ${totalRules} rules (${tokenStr})`);
+  const proceed = await ot2({ message: "Run LLM-powered rules?", initialValue: true });
+  if (q(proceed)) return false;
+  if (!proceed) O2.info("Skipping LLM rules.");
+  return !!proceed;
+}
+
 // tools/cli/src/telemetry.ts
 init_dist4();
 import fs9 from "node:fs";
-import path13 from "node:path";
+import path14 from "node:path";
 import os4 from "node:os";
 import crypto from "node:crypto";
 var DEFAULT_CONFIG2 = {
@@ -126574,7 +126534,7 @@ var DEFAULT_CONFIG2 = {
   noticeShown: false
 };
 function getTelemetryConfigPath() {
-  return path13.join(os4.homedir(), ".truecourse", "telemetry.json");
+  return path14.join(os4.homedir(), ".truecourse", "telemetry.json");
 }
 function readTelemetryConfig() {
   const configPath = getTelemetryConfigPath();
@@ -126599,7 +126559,7 @@ function readTelemetryConfig() {
 }
 function writeTelemetryConfig(partial) {
   const configPath = getTelemetryConfigPath();
-  const dir = path13.dirname(configPath);
+  const dir = path14.dirname(configPath);
   fs9.mkdirSync(dir, { recursive: true });
   let current;
   try {
@@ -126734,16 +126694,9 @@ async function runAnalyze(_options = {}) {
       enableLlmRulesOverride: enableLlmRules,
       onLlmEstimate: async (estimate) => {
         stopSpinner();
-        const totalRules = estimate.uniqueRuleCount ?? estimate.tiers.reduce((s, t2) => s + t2.ruleCount, 0);
-        const totalFiles = estimate.uniqueFileCount ?? estimate.tiers.reduce((s, t2) => s + t2.fileCount, 0);
-        const tokens = estimate.totalEstimatedTokens;
-        const tokenStr = tokens >= 1e6 ? `~${(tokens / 1e6).toFixed(1)}M tokens` : `~${Math.round(tokens / 1e3)}k tokens`;
-        O2.step(`LLM will analyze ${totalFiles} files with ${totalRules} rules (${tokenStr})`);
-        const proceed = await ot2({ message: "Run LLM-powered rules?", initialValue: true });
+        const proceed = await promptLlmEstimate(estimate);
         renderPhase = "post-llm";
-        if (q(proceed)) return false;
-        if (!proceed) O2.info("Skipping LLM rules.");
-        return !!proceed;
+        return proceed;
       }
     });
     stopSpinner();
@@ -126774,19 +126727,32 @@ async function runAnalyzeDiff(_options = {}) {
   configureLogger({
     filePath: path15.join(project.path, ".truecourse/logs/analyze.log")
   });
-  const spinner = fe();
-  spinner.start("Checking changes...");
+  const config2 = readProjectConfig(project.path);
+  const enabledCategories = config2.enabledCategories ?? void 0;
+  const enableLlmRules = config2.enableLlmRules ?? true;
+  renderPhase = enableLlmRules ? "pre-llm" : "all";
+  const stepDefs = buildAnalysisSteps(enabledCategories, enableLlmRules);
+  const tracker = new StepTracker((payload) => {
+    if (payload.steps) renderSteps(payload.steps);
+  }, stepDefs);
   const abortController = new AbortController();
   const onSigint = () => abortController.abort();
   process.on("SIGINT", onSigint);
   try {
     const { diff } = await diffInProcess2(project, {
+      tracker,
       signal: abortController.signal,
-      onProgress: ({ detail }) => {
-        if (detail) spinner.message(detail);
+      enabledCategoriesOverride: enabledCategories,
+      enableLlmRulesOverride: enableLlmRules,
+      onLlmEstimate: async (estimate) => {
+        stopSpinner();
+        const proceed = await promptLlmEstimate(estimate);
+        renderPhase = "post-llm";
+        return proceed;
       }
     });
-    spinner.stop("Diff check complete");
+    stopSpinner();
+    O2.success("Diff check complete");
     renderDiffResultsSummary2({
       changedFiles: diff.changedFiles,
       newViolations: diff.newViolations,
@@ -126796,7 +126762,7 @@ async function runAnalyzeDiff(_options = {}) {
     });
     gt("Diff complete \u2014 view results with: truecourse dashboard");
   } catch (err) {
-    spinner.stop("Diff check failed");
+    stopSpinner();
     if (err instanceof DOMException && err.name === "AbortError") {
       gt("Diff cancelled");
       process.exit(130);
@@ -130474,7 +130440,7 @@ async function runHooksRun() {
 
 // tools/cli/src/index.ts
 var program2 = new Command();
-program2.name("truecourse").version("0.4.3").description("TrueCourse CLI \u2014 analyze your repository and open the dashboard");
+program2.name("truecourse").version("0.4.5").description("TrueCourse CLI \u2014 analyze your repository and open the dashboard");
 var dashboardCmd = program2.command("dashboard").description("Start the TrueCourse dashboard and open it in your browser").option("--reconfigure", "Re-prompt for console vs background service mode").action(async (options) => {
   await runDashboard({ reconfigure: options.reconfigure });
 });