unguard 0.16.0 → 0.16.2

package/dist/engine-C4KGqeYw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine-C4KGqeYw.js","names":[],"sources":["../src/scan/cache.ts","../src/scan/config.ts","../src/scan/discover.ts","../src/scan/baseline.ts","../src/scan/policy.ts","../src/engine.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport type { Diagnostic, Rule } from \"../rules/types.ts\";\nimport type { Severity } from \"./types.ts\";\n\nconst CACHE_VERSION = 1;\nconst CACHE_FILENAME = \"scan-cache.json\";\n\nexport interface ScanCacheEntry {\n  version: number;\n  unguardVersion: string;\n  /** Hash of active rules + ignore globs + paths + severity policy. Mismatch -> cache miss. */\n  scanKey: string;\n  /** `<size>:<mtimeNs>@<contentHash>` per file. Stat fast-path skips hashing when stat matches. */\n  fileHashes: Record<string, string>;\n  diagnostics: Diagnostic[];\n  fileCount: number;\n}\n\nexport interface ScanKeyInput {\n  unguardVersion: string;\n  rules: readonly Rule[];\n  paths: readonly string[];\n  ignore: readonly string[];\n  strict: boolean;\n  failOn: string;\n  showSeverities: ReadonlySet<Severity> | null;\n}\n\nexport interface CacheCheckContext {\n  unguardVersion: string;\n  scanKey: string;\n}\n\n/** Walk up from `startDir` to the nearest `node_modules`, returning its `.cache/unguard/v<N>` subdir. */\nexport function resolveCacheDir(startDir: string): string | null {\n  let dir = startDir;\n  for (;;) {\n    const nm = join(dir, \"node_modules\");\n    if (existsSync(nm)) return join(nm, \".cache\", \"unguard\", `v${CACHE_VERSION}`);\n    const parent = join(dir, \"..\");\n    if (parent === dir) return null;\n    dir = parent;\n  }\n}\n\nexport function computeScanKey(input: ScanKeyInput): string {\n  const ruleSig = [...input.rules]\n    .map((r) => `${r.id}=${r.severity}`)\n    .sort()\n    .join(\",\");\n  const payload = JSON.stringify({\n    unguardVersion: input.unguardVersion,\n    ruleSig,\n    paths: [...input.paths].sort(),\n    ignore: [...input.ignore].sort(),\n    strict: input.strict,\n    failOn: input.failOn,\n    showSeverities: input.showSeverities ? [...input.showSeverities].sort() : null,\n  });\n  return createHash(\"sha256\").update(payload).digest(\"hex\").slice(0, 16);\n}\n\nexport function hashFile(path: string, prevFingerprint: string | undefined): string {\n  const s = statSync(path, { bigint: true });\n  const statTag = `${s.size}:${s.mtimeNs.toString()}`;\n  if (prevFingerprint !== undefined) {\n    const prevStat = prevFingerprint.split(\"@\", 1)[0];\n    if (prevStat === statTag) return prevFingerprint;\n  }\n  const buf = readFileSync(path);\n  const contentHash = createHash(\"sha1\").update(buf).digest(\"hex\").slice(0, 16);\n  return `${statTag}@${contentHash}`;\n}\n\nexport function hashFiles(paths: readonly string[], prev: Record<string, string> | null): Record<string, string> {\n  const result: Record<string, string> = {};\n  for (const path of paths) {\n    result[path] = hashFile(path, prev?.[path]);\n  }\n  return result;\n}\n\nexport function readScanCache(dir: string): ScanCacheEntry | null {\n  const path = join(dir, CACHE_FILENAME);\n  if (!existsSync(path)) return null;\n\n  const text = trySync(() => readFileSync(path, \"utf8\"), \"read failed\");\n  if (text === null) return null;\n\n  const raw = trySync(() => JSON.parse(text) as unknown, \"parse failed\");\n  if (raw === null) return null;\n\n  return validateScanCache(raw);\n}\n\nexport function writeScanCache(dir: string, entry: ScanCacheEntry): void {\n  trySync(() => {\n    mkdirSync(dir, { recursive: true });\n    writeFileSync(join(dir, CACHE_FILENAME), JSON.stringify(entry));\n    return true;\n  }, \"write failed\");\n}\n\n/** Cache hit iff scan config matches and every file's content hash matches. Ignores stat. */\nexport function cacheCovers(\n  cached: ScanCacheEntry,\n  context: CacheCheckContext,\n  currentHashes: Record<string, string>,\n): boolean {\n  if (cached.unguardVersion !== context.unguardVersion) return false;\n  if (cached.scanKey !== context.scanKey) return false;\n\n  const cachedFiles = Object.keys(cached.fileHashes);\n  const currentFiles = Object.keys(currentHashes);\n  if (cachedFiles.length !== currentFiles.length) return false;\n\n  for (const file of currentFiles) {\n    const prev = cached.fileHashes[file];\n    const cur = currentHashes[file];\n    if (prev === undefined || cur === undefined) return false;\n    if (contentHashOf(prev) !== contentHashOf(cur)) return false;\n  }\n  return true;\n}\n\nfunction contentHashOf(fingerprint: string): string {\n  const idx = fingerprint.indexOf(\"@\");\n  return idx >= 0 ? fingerprint.slice(idx + 1) : fingerprint;\n}\n\nfunction validateScanCache(raw: unknown): ScanCacheEntry | null {\n  if (typeof raw !== \"object\" || raw === null) return null;\n  const entry = raw as Record<string, unknown>;\n  if (entry.version !== CACHE_VERSION) return null;\n  if (typeof entry.scanKey !== \"string\") return null;\n  if (typeof entry.unguardVersion !== \"string\") return null;\n  if (typeof entry.fileCount !== \"number\") return null;\n\n  const fileHashes = validateFileHashes(entry.fileHashes);\n  if (fileHashes === null) return null;\n\n  const diagnostics = validateDiagnostics(entry.diagnostics);\n  if (diagnostics === null) return null;\n\n  return {\n    version: entry.version,\n    unguardVersion: entry.unguardVersion,\n    scanKey: entry.scanKey,\n    fileHashes,\n    diagnostics,\n    fileCount: entry.fileCount,\n  };\n}\n\nfunction validateFileHashes(raw: unknown): Record<string, string> | null {\n  if (typeof raw !== \"object\" || raw === null) return null;\n  const result: Record<string, string> = {};\n  for (const [key, value] of Object.entries(raw)) {\n    if (typeof value !== \"string\") return null;\n    result[key] = value;\n  }\n  return result;\n}\n\nfunction validateDiagnostics(raw: unknown): Diagnostic[] | null {\n  if (!Array.isArray(raw)) return null;\n  const list: Diagnostic[] = [];\n  for (const item of raw) {\n    const diag = validateDiagnostic(item);\n    if (diag === null) return null;\n    list.push(diag);\n  }\n  return list;\n}\n\nfunction validateDiagnostic(item: unknown): Diagnostic | null {\n  if (typeof item !== \"object\" || item === null) return null;\n  if (!(\"file\" in item) || typeof item.file !== \"string\") return null;\n  if (!(\"ruleId\" in item) || typeof item.ruleId !== \"string\") return null;\n  if (!(\"line\" in item) || typeof item.line !== \"number\") return null;\n  if (!(\"column\" in item) || typeof item.column !== \"number\") return null;\n  if (!(\"severity\" in item)) return null;\n  if (item.severity !== \"error\" && item.severity !== \"warning\" && item.severity !== \"info\") return null;\n  if (!(\"message\" in item) || typeof item.message !== \"string\") return null;\n  const annotation = \"annotation\" in item ? item.annotation : undefined;\n  if (annotation !== undefined && typeof annotation !== \"string\") return null;\n  return {\n    file: item.file,\n    ruleId: item.ruleId,\n    line: item.line,\n    column: item.column,\n    severity: item.severity,\n    message: item.message,\n    annotation,\n  };\n}\n\nfunction trySync<T>(fn: () => T, label: string): T | null {\n  try {\n    return fn();\n  } catch (err) {\n    return debugLog(label, err);\n  }\n}\n\nfunction debugLog(label: string, err: unknown): null {\n  if (process.env.UNGUARD_DEBUG !== undefined) {\n    console.error(`[unguard] cache ${label}:`, err);\n  }\n  return null;\n}\n","import type {\n  FailOn,\n  ResolvedRuleOverride,\n  ResolvedScanConfig,\n  RuleOverride,\n  RulePolicy,\n  RulePolicyEntry,\n  RulePolicySeverity,\n  ScanOptions,\n  Severity,\n} from \"./types.ts\";\n\nconst BUILTIN_IGNORE = [\n  \"**/node_modules/**\",\n  \"**/dist/**\",\n  \"**/.git/**\",\n  \"**/*.d.ts\",\n  \"**/*.d.cts\",\n  \"**/*.d.mts\",\n];\n\nconst GENERATED_IGNORE = [\n  \"**/*.gen.*\",\n  \"**/*.generated.*\",\n];\n\nconst DEFAULT_FAIL_ON: FailOn = \"info\";\n\nexport function resolveScanConfig(options: ScanOptions): ResolvedScanConfig {\n  const paths = options.paths.length > 0 ? options.paths : [\".\"];\n  const ignore = [...BUILTIN_IGNORE, ...GENERATED_IGNORE, ...(options.ignore ?? [])];\n  return {\n    paths,\n    mode: options.mode ?? \"scan\",\n    strict: options.strict ?? false,\n    rules: options.rules ? [...options.rules] : null,\n    ignore,\n    rulePolicy: toRulePolicyEntries(options.rulePolicy),\n    overrides: toResolvedOverrides(options.overrides),\n    showSeverities: normalizeSeveritySet(options.showSeverities),\n    failOn: options.failOn ?? DEFAULT_FAIL_ON,\n    useGitIgnore: options.useGitIgnore ?? true,\n    concurrency: options.concurrency,\n    cache: options.cache ?? true,\n    baseline: options.baseline ?? null,\n  };\n}\n\nfunction toResolvedOverrides(overrides: RuleOverride[] | undefined): ResolvedRuleOverride[] {\n  if (overrides === undefined) return [];\n  return overrides.map((entry) => ({\n    files: [...entry.files],\n    rulePolicy: toRulePolicyEntries(entry.rules),\n  }));\n}\n\nexport function toRulePolicyEntries(policy: RulePolicy | undefined): RulePolicyEntry[] {\n  if (policy === undefined) return [];\n  if (Array.isArray(policy)) return [...policy];\n\n  const entries: RulePolicyEntry[] = [];\n  for (const [selector, severity] of Object.entries(policy)) {\n    entries.push({ selector, severity });\n  }\n  return entries;\n}\n\nfunction normalizeSeveritySet(levels: Severity[] | undefined): Set<Severity> | null {\n  if (levels === undefined || levels.length === 0) return null;\n  return new Set(levels);\n}\n\nexport function isRulePolicySeverity(value: string): value is RulePolicySeverity {\n  return value === \"off\" || value === \"info\" || value === \"warning\" || value === \"error\";\n}\n\nexport function isSeverity(value: string): value is Severity {\n  return value === \"info\" || value === \"warning\" || value === \"error\";\n}\n\nexport function isFailOn(value: string): value is FailOn {\n  return value === \"none\" || isSeverity(value);\n}\n","import fg from \"fast-glob\";\nimport ignore from \"ignore\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { relative, resolve, sep } from \"node:path\";\nimport type { ResolvedScanConfig } from \"./types.ts\";\n\nexport async function discoverFiles(config: ResolvedScanConfig): Promise<string[]> {\n  const globs = expandGlobs(config.paths);\n  const discoveredFiles = await fg(globs, {\n    ignore: config.ignore,\n    absolute: true,\n  });\n  if (!config.useGitIgnore) return discoveredFiles;\n  return applyGitIgnore(discoveredFiles);\n}\n\nfunction expandGlobs(paths: string[]): string[] {\n  return paths.map((p) => {\n    if (p === \".\") return \"./**/*.{ts,cts,mts,tsx}\";\n    if (p.endsWith(\"/\")) return `${p}**/*.{ts,cts,mts,tsx}`;\n    if (!p.includes(\"*\") && !p.endsWith(\".ts\") && !p.endsWith(\".tsx\") && !p.endsWith(\".cts\") && !p.endsWith(\".mts\")) {\n      return `${p}/**/*.{ts,cts,mts,tsx}`;\n    }\n    return p;\n  });\n}\n\nfunction applyGitIgnore(files: string[]): string[] {\n  const gitIgnorePath = resolve(process.cwd(), \".gitignore\");\n  if (!existsSync(gitIgnorePath)) return files;\n\n  const matcher = ignore().add(readFileSync(gitIgnorePath, \"utf8\"));\n  return files.filter((file) => {\n    const rel = relative(process.cwd(), file);\n    if (rel.startsWith(\"..\")) return true;\n    const normalized = rel.split(sep).join(\"/\");\n    return !matcher.ignores(normalized);\n  });\n}\n","import { existsSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { relative, resolve } from \"node:path\";\nimport type { Diagnostic } from \"../rules/types.ts\";\n\nexport const BASELINE_FILENAME = \"unguard.baseline.json\";\n\n/**\n * Ratchet file: known-issue counts per (file, rule). A scan suppresses a\n * group while its count stays at or below the recorded number; the moment it\n * exceeds the baseline, the whole group surfaces — line numbers shift too\n * easily to pin individual diagnostics, counts only ratchet downward.\n */\nexport interface BaselineData {\n  version: 1;\n  rules: Record<string, Record<string, number>>;\n}\n\nexport function buildBaseline(diagnostics: Diagnostic[], cwd: string): BaselineData {\n  const rules: Record<string, Record<string, number>> = {};\n  for (const diagnostic of diagnostics) {\n    const file = relative(cwd, diagnostic.file);\n    rules[file] ??= {};\n    const forFile = rules[file];\n    forFile[diagnostic.ruleId] = (forFile[diagnostic.ruleId] ?? 0) + 1;\n  }\n  return { version: 1, rules };\n}\n\nexport function writeBaseline(baseline: BaselineData, cwd: string): string {\n  const path = resolve(cwd, BASELINE_FILENAME);\n  writeFileSync(path, `${JSON.stringify(baseline, null, 2)}\\n`, \"utf8\");\n  return path;\n}\n\nexport function loadBaseline(cwd: string): BaselineData | null {\n  const path = resolve(cwd, BASELINE_FILENAME);\n  if (!existsSync(path)) return null;\n  const parsed: unknown = JSON.parse(readFileSync(path, \"utf8\"));\n  if (!isBaselineData(parsed)) {\n    throw new Error(`Invalid baseline in ${BASELINE_FILENAME}: expected {\"version\": 1, \"rules\": {<file>: {<ruleId>: count}}}.`);\n  }\n  return parsed;\n}\n\nfunction isBaselineData(value: unknown): value is BaselineData {\n  if (typeof value !== \"object\" || value === null) return false;\n  if (!(\"version\" in value) || value.version !== 1) return false;\n  if (!(\"rules\" in value) || typeof value.rules !== \"object\" || value.rules === null) return false;\n  return Object.values(value.rules).every(\n    (forFile) =>\n      typeof forFile === \"object\" &&\n      forFile !== null &&\n      Object.values(forFile).every((count) => typeof count === \"number\"),\n  );\n}\n\n/** Drop diagnostic groups still within their baselined count. */\nexport function applyBaseline(diagnostics: Diagnostic[], baseline: BaselineData, cwd: string): Diagnostic[] {\n  const groups = new Map<string, Diagnostic[]>();\n  for (const diagnostic of diagnostics) {\n    const key = `${relative(cwd, diagnostic.file)}\\0${diagnostic.ruleId}`;\n    let list = groups.get(key);\n    if (list === undefined) {\n      list = [];\n      groups.set(key, list);\n    }\n    list.push(diagnostic);\n  }\n\n  const kept: Diagnostic[] = [];\n  for (const [key, group] of groups) {\n    const [file, ruleId] = key.split(\"\\0\") as [string, string];\n    const allowed = baseline.rules[file]?.[ruleId] ?? 0;\n    if (group.length <= allowed) continue;\n    kept.push(...group);\n  }\n  return kept;\n}\n","import { relative } from \"node:path\";\nimport ignore from \"ignore\";\nimport type { Diagnostic, Rule } from \"../rules/types.ts\";\nimport { getRuleMetadata } from \"../rules/index.ts\";\nimport { applyBaseline } from \"./baseline.ts\";\nimport type {\n  ResolvedRuleOverride,\n  ResolvedScanConfig,\n  RuleDescriptor,\n  RulePolicySeverity,\n  ScanExecutionResult,\n  ScanResult,\n  Severity,\n} from \"./types.ts\";\n\nexport function buildRuleDescriptors(rules: Rule[]): RuleDescriptor[] {\n  return rules.map((rule) => {\n    const metadata = getRuleMetadata(rule.id);\n    return {\n      rule,\n      category: metadata.category,\n      tags: metadata.tags,\n      confidence: metadata.confidence,\n    };\n  });\n}\n\nexport function resolveActiveRules(\n  descriptors: RuleDescriptor[],\n  config: ResolvedScanConfig,\n): Rule[] {\n  const selectedRules = config.rules ? new Set(config.rules) : null;\n  const wantedConfidence = config.mode === \"audit\" ? \"heuristic\" : \"proven\";\n  const active: Rule[] = [];\n\n  for (const descriptor of descriptors) {\n    if (selectedRules) {\n      // An explicit rule filter names what to run; the mode split is moot.\n      if (!selectedRules.has(descriptor.rule.id)) continue;\n    } else if (descriptor.confidence !== wantedConfidence) {\n      continue;\n    }\n    const resolvedSeverity = resolveRuleSeverity(descriptor, config);\n    if (resolvedSeverity === \"off\") continue;\n    if (descriptor.rule.severity === resolvedSeverity) {\n      active.push(descriptor.rule);\n      continue;\n    }\n    active.push({ ...descriptor.rule, severity: resolvedSeverity });\n  }\n\n  return active;\n}\n\nfunction resolveRuleSeverity(descriptor: RuleDescriptor, config: ResolvedScanConfig): RulePolicySeverity {\n  let severity: RulePolicySeverity = descriptor.rule.severity;\n  for (const entry of config.rulePolicy) {\n    if (!matchesSelector(descriptor, entry.selector)) continue;\n    severity = entry.severity;\n  }\n\n  if (severity === \"off\") return \"off\";\n  if (config.strict) return \"error\";\n  return severity;\n}\n\nfunction matchesSelector(\n  descriptor: Pick<RuleDescriptor, \"category\" | \"tags\" | \"confidence\"> & { rule: { id: string } },\n  selector: string,\n): boolean {\n  if (selector.startsWith(\"category:\")) {\n    return descriptor.category === selector.slice(\"category:\".length);\n  }\n  if (selector.startsWith(\"tag:\")) {\n    return descriptor.tags.includes(selector.slice(\"tag:\".length));\n  }\n  if (selector.startsWith(\"confidence:\")) {\n    return descriptor.confidence === selector.slice(\"confidence:\".length);\n  }\n  if (selector === descriptor.rule.id) return true;\n  if (!selector.includes(\"*\")) return false;\n  const regex = new RegExp(`^${escapeRegex(selector).replaceAll(\"\\\\*\", \".*\")}$`);\n  return regex.test(descriptor.rule.id);\n}\n\nfunction escapeRegex(value: string): string {\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n\nexport function finalizeScanResult(\n  diagnostics: Diagnostic[],\n  fileCount: number,\n  config: ResolvedScanConfig,\n): ScanExecutionResult {\n  // `diagnostics` stays raw (and cached raw); overrides and the baseline\n  // ratchet only shape what is reported and what fails the run.\n  const afterOverrides = applyOverrides(diagnostics, config.overrides, process.cwd());\n  const effective = config.baseline\n    ? applyBaseline(afterOverrides, config.baseline, process.cwd())\n    : afterOverrides;\n  const visibleDiagnostics = config.showSeverities\n    ? effective.filter((d) => config.showSeverities?.has(d.severity))\n    : effective;\n\n  return {\n    diagnostics,\n    visibleDiagnostics,\n    fileCount,\n    exitCode: computeExitCode(effective, config.failOn),\n  };\n}\n\n/**\n * Re-resolve severities per file: each override whose globs (gitignore\n * syntax, matched against the cwd-relative path) cover the diagnostic's file\n * applies its rule policy on top of the already-resolved severity. `off`\n * drops the diagnostic.\n */\nexport function applyOverrides(\n  diagnostics: Diagnostic[],\n  overrides: ResolvedRuleOverride[],\n  cwd: string,\n): Diagnostic[] {\n  if (overrides.length === 0) return diagnostics;\n  const matchers = overrides.map((entry) => ({\n    matcher: ignore().add(entry.files),\n    rulePolicy: entry.rulePolicy,\n  }));\n\n  const result: Diagnostic[] = [];\n  for (const diagnostic of diagnostics) {\n    const relPath = relative(cwd, diagnostic.file).replaceAll(\"\\\\\", \"/\");\n    const metadata = getRuleMetadata(diagnostic.ruleId);\n    const descriptor = {\n      rule: { id: diagnostic.ruleId },\n      category: metadata.category,\n      tags: metadata.tags,\n      confidence: metadata.confidence,\n    };\n\n    let severity: RulePolicySeverity = diagnostic.severity;\n    for (const { matcher, rulePolicy } of matchers) {\n      if (relPath.startsWith(\"..\") || !matcher.ignores(relPath)) continue;\n      for (const entry of rulePolicy) {\n        if (!matchesSelector(descriptor, entry.selector)) continue;\n        severity = entry.severity;\n      }\n    }\n\n    if (severity === \"off\") continue;\n    result.push(severity === diagnostic.severity ? diagnostic : { ...diagnostic, severity });\n  }\n  return result;\n}\n\nexport function toScanResult(execution: ScanExecutionResult): ScanResult {\n  return {\n    diagnostics: execution.diagnostics,\n    fileCount: execution.fileCount,\n  };\n}\n\nexport function computeExitCode(diagnostics: Diagnostic[], failOn: \"none\" | Severity): number {\n  if (failOn === \"none\") return 0;\n\n  const hasError = diagnostics.some((d) => d.severity === \"error\");\n  const hasWarning = diagnostics.some((d) => d.severity === \"warning\");\n  const hasInfo = diagnostics.some((d) => d.severity === \"info\");\n\n  if (failOn === \"error\") return hasError ? 2 : 0;\n  if (failOn === \"warning\") {\n    if (hasError) return 2;\n    return hasWarning ? 1 : 0;\n  }\n\n  if (hasError) return 2;\n  if (hasWarning || hasInfo) return 1;\n  return 0;\n}\n","import { availableParallelism } from \"node:os\";\nimport { createRequire } from \"node:module\";\nimport { allRules } from \"./rules/index.ts\";\nimport { analyzeFiles } from \"./scan/analyze.ts\";\nimport { cacheCovers, computeScanKey, hashFiles, readScanCache, resolveCacheDir, writeScanCache } from \"./scan/cache.ts\";\nimport { resolveScanConfig } from \"./scan/config.ts\";\nimport { discoverFiles } from \"./scan/discover.ts\";\nimport { buildRuleDescriptors, finalizeScanResult, resolveActiveRules, toScanResult } from \"./scan/policy.ts\";\nimport type { ScanExecutionResult, ScanOptions, ScanResult } from \"./scan/types.ts\";\n\nexport type {\n  FailOn,\n  RulePolicy,\n  RulePolicyEntry,\n  RulePolicySeverity,\n  ScanExecutionResult,\n  ScanOptions,\n  ScanResult,\n  Severity,\n} from \"./scan/types.ts\";\n\nconst UNGUARD_VERSION: string = createRequire(import.meta.url)(\"../package.json\").version;\n\nexport async function executeScan(options: ScanOptions): Promise<ScanExecutionResult> {\n  const config = resolveScanConfig(options);\n  const files = await discoverFiles(config);\n  const descriptors = buildRuleDescriptors(allRules);\n  const activeRules = resolveActiveRules(descriptors, config);\n\n  const cacheDir = config.cache ? resolveCacheDir(process.cwd()) : null;\n  if (cacheDir !== null) {\n    const scanKey = computeScanKey({\n      unguardVersion: UNGUARD_VERSION,\n      rules: activeRules,\n      paths: config.paths,\n      ignore: config.ignore,\n      strict: config.strict,\n      failOn: config.failOn,\n      showSeverities: config.showSeverities,\n    });\n    const cached = readScanCache(cacheDir);\n    const sortedFiles = [...files].sort();\n    const currentHashes = hashFiles(sortedFiles, cached?.fileHashes ?? null);\n\n    if (cached !== null && cacheCovers(cached, { unguardVersion: UNGUARD_VERSION, scanKey }, currentHashes)) {\n      return finalizeScanResult(cached.diagnostics, cached.fileCount, config);\n    }\n\n    const concurrency = resolveDefaultConcurrency(config.concurrency);\n    const diagnostics = await analyzeFiles(files, activeRules, { concurrency });\n    writeScanCache(cacheDir, {\n      version: 1,\n      unguardVersion: UNGUARD_VERSION,\n      scanKey,\n      fileHashes: currentHashes,\n      diagnostics,\n      fileCount: files.length,\n    });\n    return finalizeScanResult(diagnostics, files.length, config);\n  }\n\n  const concurrency = resolveDefaultConcurrency(config.concurrency);\n  const diagnostics = await analyzeFiles(files, activeRules, { concurrency });\n  return finalizeScanResult(diagnostics, files.length, config);\n}\n\nfunction resolveDefaultConcurrency(requested: number | undefined): number {\n  if (requested !== undefined) {\n    if (!Number.isFinite(requested) || requested < 1) return 1;\n    return Math.floor(requested);\n  }\n  // Each worker holds its own ts.Program; cap at half the CPUs to avoid memory blow-up on shared CI.\n  const cores = availableParallelism();\n  return Math.min(8, Math.max(1, Math.ceil(cores / 2)));\n}\n\nexport async function scan(options: ScanOptions): Promise<ScanResult> {\n  const execution = await executeScan(options);\n  return toScanResult(execution);\n}\n"],"mappings":";;;;;;;;;AAMA,MAAM,gBAAgB;AACtB,MAAM,iBAAiB;;AA6BvB,SAAgB,gBAAgB,UAAiC;CAC/D,IAAI,MAAM;CACV,SAAS;EACP,MAAM,KAAK,KAAK,KAAK,cAAc;EACnC,IAAI,WAAW,EAAE,GAAG,OAAO,KAAK,IAAI,UAAU,WAAW,IAAI,eAAe;EAC5E,MAAM,SAAS,KAAK,KAAK,IAAI;EAC7B,IAAI,WAAW,KAAK,OAAO;EAC3B,MAAM;CACR;AACF;AAEA,SAAgB,eAAe,OAA6B;CAC1D,MAAM,UAAU,CAAC,GAAG,MAAM,KAAK,CAAC,CAC7B,KAAK,MAAM,GAAG,EAAE,GAAG,GAAG,EAAE,UAAU,CAAC,CACnC,KAAK,CAAC,CACN,KAAK,GAAG;CACX,MAAM,UAAU,KAAK,UAAU;EAC7B,gBAAgB,MAAM;EACtB;EACA,OAAO,CAAC,GAAG,MAAM,KAAK,CAAC,CAAC,KAAK;EAC7B,QAAQ,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,KAAK;EAC/B,QAAQ,MAAM;EACd,QAAQ,MAAM;EACd,gBAAgB,MAAM,iBAAiB,CAAC,GAAG,MAAM,cAAc,CAAC,CAAC,KAAK,IAAI;CAC5E,CAAC;CACD,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAAE;AACvE;AAEA,SAAgB,SAAS,MAAc,iBAA6C;CAClF,MAAM,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,CAAC;CACzC,MAAM,UAAU,GAAG,EAAE,KAAK,GAAG,EAAE,QAAQ,SAAS;CAChD,IAAI,oBAAoB,KAAA;MACL,gBAAgB,MAAM,KAAK,CAAC,CAAC,CAAC,OAC9B,SAAS,OAAO;CAAA;CAEnC,MAAM,MAAM,aAAa,IAAI;CAE7B,OAAO,GAAG,QAAQ,GADE,WAAW,MAAM,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAC3C;AACjC;AAEA,SAAgB,UAAU,OAA0B,MAA6D;CAC/G,MAAM,SAAiC,CAAC;CACxC,KAAK,MAAM,QAAQ,OACjB,OAAO,QAAQ,SAAS,MAAM,OAAO,KAAK;CAE5C,OAAO;AACT;AAEA,SAAgB,cAAc,KAAoC;CAChE,MAAM,OAAO,KAAK,KAAK,cAAc;CACrC,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO;CAE9B,MAAM,OAAO,cAAc,aAAa,MAAM,MAAM,GAAG,aAAa;CACpE,IAAI,SAAS,MAAM,OAAO;CAE1B,MAAM,MAAM,cAAc,KAAK,MAAM,IAAI,GAAc,cAAc;CACrE,IAAI,QAAQ,MAAM,OAAO;CAEzB,OAAO,kBAAkB,GAAG;AAC9B;AAEA,SAAgB,eAAe,KAAa,OAA6B;CACvE,cAAc;EACZ,UAAU,KAAK,EAAE,WAAW,KAAK,CAAC;EAClC,cAAc,KAAK,KAAK,cAAc,GAAG,KAAK,UAAU,KAAK,CAAC;EAC9D,OAAO;CACT,GAAG,cAAc;AACnB;;AAGA,SAAgB,YACd,QACA,SACA,eACS;CACT,IAAI,OAAO,mBAAmB,QAAQ,gBAAgB,OAAO;CAC7D,IAAI,OAAO,YAAY,QAAQ,SAAS,OAAO;CAE/C,MAAM,cAAc,OAAO,KAAK,OAAO,UAAU;CACjD,MAAM,eAAe,OAAO,KAAK,aAAa;CAC9C,IAAI,YAAY,WAAW,aAAa,QAAQ,OAAO;CAEvD,KAAK,MAAM,QAAQ,cAAc;EAC/B,MAAM,OAAO,OAAO,WAAW;EAC/B,MAAM,MAAM,cAAc;EAC1B,IAAI,SAAS,KAAA,KAAa,QAAQ,KAAA,GAAW,OAAO;EACpD,IAAI,cAAc,IAAI,MAAM,cAAc,GAAG,GAAG,OAAO;CACzD;CACA,OAAO;AACT;AAEA,SAAS,cAAc,aAA6B;CAClD,MAAM,MAAM,YAAY,QAAQ,GAAG;CACnC,OAAO,OAAO,IAAI,YAAY,MAAM,MAAM,CAAC,IAAI;AACjD;AAEA,SAAS,kBAAkB,KAAqC;CAC9D,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO;CACpD,MAAM,QAAQ;CACd,IAAI,MAAM,YAAY,eAAe,OAAO;CAC5C,IAAI,OAAO,MAAM,YAAY,UAAU,OAAO;CAC9C,IAAI,OAAO,MAAM,mBAAmB,UAAU,OAAO;CACrD,IAAI,OAAO,MAAM,cAAc,UAAU,OAAO;CAEhD,MAAM,aAAa,mBAAmB,MAAM,UAAU;CACtD,IAAI,eAAe,MAAM,OAAO;CAEhC,MAAM,cAAc,oBAAoB,MAAM,WAAW;CACzD,IAAI,gBAAgB,MAAM,OAAO;CAEjC,OAAO;EACL,SAAS,MAAM;EACf,gBAAgB,MAAM;EACtB,SAAS,MAAM;EACf;EACA;EACA,WAAW,MAAM;CACnB;AACF;AAEA,SAAS,mBAAmB,KAA6C;CACvE,IAAI,OAAO,QAAQ,YAAY,QAAQ,MAAM,OAAO;CACpD,MAAM,SAAiC,CAAC;CACxC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,GAAG,GAAG;EAC9C,IAAI,OAAO,UAAU,UAAU,OAAO;EACtC,OAAO,OAAO;CAChB;CACA,OAAO;AACT;AAEA,SAAS,oBAAoB,KAAmC;CAC9D,IAAI,CAAC,MAAM,QAAQ,GAAG,GAAG,OAAO;CAChC,MAAM,OAAqB,CAAC;CAC5B,KAAK,MAAM,QAAQ,KAAK;EACtB,MAAM,OAAO,mBAAmB,IAAI;EACpC,IAAI,SAAS,MAAM,OAAO;EAC1B,KAAK,KAAK,IAAI;CAChB;CACA,OAAO;AACT;AAEA,SAAS,mBAAmB,MAAkC;CAC5D,IAAI,OAAO,SAAS,YAAY,SAAS,MAAM,OAAO;CACtD,IAAI,EAAE,UAAU,SAAS,OAAO,KAAK,SAAS,UAAU,OAAO;CAC/D,IAAI,EAAE,YAAY,SAAS,OAAO,KAAK,WAAW,UAAU,OAAO;CACnE,IAAI,EAAE,UAAU,SAAS,OAAO,KAAK,SAAS,UAAU,OAAO;CAC/D,IAAI,EAAE,YAAY,SAAS,OAAO,KAAK,WAAW,UAAU,OAAO;CACnE,IAAI,EAAE,cAAc,OAAO,OAAO;CAClC,IAAI,KAAK,aAAa,WAAW,KAAK,aAAa,aAAa,KAAK,aAAa,QAAQ,OAAO;CACjG,IAAI,EAAE,aAAa,SAAS,OAAO,KAAK,YAAY,UAAU,OAAO;CACrE,MAAM,aAAa,gBAAgB,OAAO,KAAK,aAAa,KAAA;CAC5D,IAAI,eAAe,KAAA,KAAa,OAAO,eAAe,UAAU,OAAO;CACvE,OAAO;EACL,MAAM,KAAK;EACX,QAAQ,KAAK;EACb,MAAM,KAAK;EACX,QAAQ,KAAK;EACb,UAAU,KAAK;EACf,SAAS,KAAK;EACd;CACF;AACF;AAEA,SAAS,QAAW,IAAa,OAAyB;CACxD,IAAI;EACF,OAAO,GAAG;CACZ,SAAS,KAAK;EACZ,OAAO,SAAS,OAAO,GAAG;CAC5B;AACF;AAEA,SAAS,SAAS,OAAe,KAAoB;CACnD,IAAI,QAAQ,IAAI,kBAAkB,KAAA,GAChC,QAAQ,MAAM,mBAAmB,MAAM,IAAI,GAAG;CAEhD,OAAO;AACT;;;ACxMA,MAAM,iBAAiB;CACrB;CACA;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,mBAAmB,CACvB,cACA,kBACF;AAEA,MAAM,kBAA0B;AAEhC,SAAgB,kBAAkB,SAA0C;CAC1E,MAAM,QAAQ,QAAQ,MAAM,SAAS,IAAI,QAAQ,QAAQ,CAAC,GAAG;CAC7D,MAAM,SAAS;EAAC,GAAG;EAAgB,GAAG;EAAkB,GAAI,QAAQ,UAAU,CAAC;CAAE;CACjF,OAAO;EACL;EACA,MAAM,QAAQ,QAAQ;EACtB,QAAQ,QAAQ,UAAU;EAC1B,OAAO,QAAQ,QAAQ,CAAC,GAAG,QAAQ,KAAK,IAAI;EAC5C;EACA,YAAY,oBAAoB,QAAQ,UAAU;EAClD,WAAW,oBAAoB,QAAQ,SAAS;EAChD,gBAAgB,qBAAqB,QAAQ,cAAc;EAC3D,QAAQ,QAAQ,UAAU;EAC1B,cAAc,QAAQ,gBAAgB;EACtC,aAAa,QAAQ;EACrB,OAAO,QAAQ,SAAS;EACxB,UAAU,QAAQ,YAAY;CAChC;AACF;AAEA,SAAS,oBAAoB,WAA+D;CAC1F,IAAI,cAAc,KAAA,GAAW,OAAO,CAAC;CACrC,OAAO,UAAU,KAAK,WAAW;EAC/B,OAAO,CAAC,GAAG,MAAM,KAAK;EACtB,YAAY,oBAAoB,MAAM,KAAK;CAC7C,EAAE;AACJ;AAEA,SAAgB,oBAAoB,QAAmD;CACrF,IAAI,WAAW,KAAA,GAAW,OAAO,CAAC;CAClC,IAAI,MAAM,QAAQ,MAAM,GAAG,OAAO,CAAC,GAAG,MAAM;CAE5C,MAAM,UAA6B,CAAC;CACpC,KAAK,MAAM,CAAC,UAAU,aAAa,OAAO,QAAQ,MAAM,GACtD,QAAQ,KAAK;EAAE;EAAU;CAAS,CAAC;CAErC,OAAO;AACT;AAEA,SAAS,qBAAqB,QAAsD;CAClF,IAAI,WAAW,KAAA,KAAa,OAAO,WAAW,GAAG,OAAO;CACxD,OAAO,IAAI,IAAI,MAAM;AACvB;AAEA,SAAgB,qBAAqB,OAA4C;CAC/E,OAAO,UAAU,SAAS,UAAU,UAAU,UAAU,aAAa,UAAU;AACjF;AAEA,SAAgB,WAAW,OAAkC;CAC3D,OAAO,UAAU,UAAU,UAAU,aAAa,UAAU;AAC9D;AAEA,SAAgB,SAAS,OAAgC;CACvD,OAAO,UAAU,UAAU,WAAW,KAAK;AAC7C;;;AC5EA,eAAsB,cAAc,QAA+C;CAEjF,MAAM,kBAAkB,MAAM,GADhB,YAAY,OAAO,KACI,GAAG;EACtC,QAAQ,OAAO;EACf,UAAU;CACZ,CAAC;CACD,IAAI,CAAC,OAAO,cAAc,OAAO;CACjC,OAAO,eAAe,eAAe;AACvC;AAEA,SAAS,YAAY,OAA2B;CAC9C,OAAO,MAAM,KAAK,MAAM;EACtB,IAAI,MAAM,KAAK,OAAO;EACtB,IAAI,EAAE,SAAS,GAAG,GAAG,OAAO,GAAG,EAAE;EACjC,IAAI,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC,EAAE,SAAS,KAAK,KAAK,CAAC,EAAE,SAAS,MAAM,KAAK,CAAC,EAAE,SAAS,MAAM,KAAK,CAAC,EAAE,SAAS,MAAM,GAC5G,OAAO,GAAG,EAAE;EAEd,OAAO;CACT,CAAC;AACH;AAEA,SAAS,eAAe,OAA2B;CACjD,MAAM,gBAAgB,QAAQ,QAAQ,IAAI,GAAG,YAAY;CACzD,IAAI,CAAC,WAAW,aAAa,GAAG,OAAO;CAEvC,MAAM,UAAU,OAAO,CAAC,CAAC,IAAI,aAAa,eAAe,MAAM,CAAC;CAChE,OAAO,MAAM,QAAQ,SAAS;EAC5B,MAAM,MAAM,SAAS,QAAQ,IAAI,GAAG,IAAI;EACxC,IAAI,IAAI,WAAW,IAAI,GAAG,OAAO;EACjC,MAAM,aAAa,IAAI,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG;EAC1C,OAAO,CAAC,QAAQ,QAAQ,UAAU;CACpC,CAAC;AACH;;;AClCA,MAAa,oBAAoB;AAajC,SAAgB,cAAc,aAA2B,KAA2B;CAClF,MAAM,QAAgD,CAAC;CACvD,KAAK,MAAM,cAAc,aAAa;EACpC,MAAM,OAAO,SAAS,KAAK,WAAW,IAAI;EAC1C,MAAM,UAAU,CAAC;EACjB,MAAM,UAAU,MAAM;EACtB,QAAQ,WAAW,WAAW,QAAQ,WAAW,WAAW,KAAK;CACnE;CACA,OAAO;EAAE,SAAS;EAAG;CAAM;AAC7B;AAEA,SAAgB,cAAc,UAAwB,KAAqB;CACzE,MAAM,OAAO,QAAQ,KAAK,iBAAiB;CAC3C,cAAc,MAAM,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,EAAE,KAAK,MAAM;CACpE,OAAO;AACT;AAEA,SAAgB,aAAa,KAAkC;CAC7D,MAAM,OAAO,QAAQ,KAAK,iBAAiB;CAC3C,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO;CAC9B,MAAM,SAAkB,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;CAC7D,IAAI,CAAC,eAAe,MAAM,GACxB,MAAM,IAAI,MAAM,uBAAuB,kBAAkB,iEAAiE;CAE5H,OAAO;AACT;AAEA,SAAS,eAAe,OAAuC;CAC7D,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,IAAI,EAAE,aAAa,UAAU,MAAM,YAAY,GAAG,OAAO;CACzD,IAAI,EAAE,WAAW,UAAU,OAAO,MAAM,UAAU,YAAY,MAAM,UAAU,MAAM,OAAO;CAC3F,OAAO,OAAO,OAAO,MAAM,KAAK,CAAC,CAAC,OAC/B,YACC,OAAO,YAAY,YACnB,YAAY,QACZ,OAAO,OAAO,OAAO,CAAC,CAAC,OAAO,UAAU,OAAO,UAAU,QAAQ,CACrE;AACF;;AAGA,SAAgB,cAAc,aAA2B,UAAwB,KAA2B;CAC1G,MAAM,yBAAS,IAAI,IAA0B;CAC7C,KAAK,MAAM,cAAc,aAAa;EACpC,MAAM,MAAM,GAAG,SAAS,KAAK,WAAW,IAAI,EAAE,IAAI,WAAW;EAC7D,IAAI,OAAO,OAAO,IAAI,GAAG;EACzB,IAAI,SAAS,KAAA,GAAW;GACtB,OAAO,CAAC;GACR,OAAO,IAAI,KAAK,IAAI;EACtB;EACA,KAAK,KAAK,UAAU;CACtB;CAEA,MAAM,OAAqB,CAAC;CAC5B,KAAK,MAAM,CAAC,KAAK,UAAU,QAAQ;EACjC,MAAM,CAAC,MAAM,UAAU,IAAI,MAAM,IAAI;EACrC,MAAM,UAAU,SAAS,MAAM,KAAK,GAAG,WAAW;EAClD,IAAI,MAAM,UAAU,SAAS;EAC7B,KAAK,KAAK,GAAG,KAAK;CACpB;CACA,OAAO;AACT;;;AC9DA,SAAgB,qBAAqB,OAAiC;CACpE,OAAO,MAAM,KAAK,SAAS;EACzB,MAAM,WAAW,gBAAgB,KAAK,EAAE;EACxC,OAAO;GACL;GACA,UAAU,SAAS;GACnB,MAAM,SAAS;GACf,YAAY,SAAS;EACvB;CACF,CAAC;AACH;AAEA,SAAgB,mBACd,aACA,QACQ;CACR,MAAM,gBAAgB,OAAO,QAAQ,IAAI,IAAI,OAAO,KAAK,IAAI;CAC7D,MAAM,mBAAmB,OAAO,SAAS,UAAU,cAAc;CACjE,MAAM,SAAiB,CAAC;CAExB,KAAK,MAAM,cAAc,aAAa;EACpC,IAAI;OAEE,CAAC,cAAc,IAAI,WAAW,KAAK,EAAE,GAAG;EAAA,OACvC,IAAI,WAAW,eAAe,kBACnC;EAEF,MAAM,mBAAmB,oBAAoB,YAAY,MAAM;EAC/D,IAAI,qBAAqB,OAAO;EAChC,IAAI,WAAW,KAAK,aAAa,kBAAkB;GACjD,OAAO,KAAK,WAAW,IAAI;GAC3B;EACF;EACA,OAAO,KAAK;GAAE,GAAG,WAAW;GAAM,UAAU;EAAiB,CAAC;CAChE;CAEA,OAAO;AACT;AAEA,SAAS,oBAAoB,YAA4B,QAAgD;CACvG,IAAI,WAA+B,WAAW,KAAK;CACnD,KAAK,MAAM,SAAS,OAAO,YAAY;EACrC,IAAI,CAAC,gBAAgB,YAAY,MAAM,QAAQ,GAAG;EAClD,WAAW,MAAM;CACnB;CAEA,IAAI,aAAa,OAAO,OAAO;CAC/B,IAAI,OAAO,QAAQ,OAAO;CAC1B,OAAO;AACT;AAEA,SAAS,gBACP,YACA,UACS;CACT,IAAI,SAAS,WAAW,WAAW,GACjC,OAAO,WAAW,aAAa,SAAS,MAAM,CAAkB;CAElE,IAAI,SAAS,WAAW,MAAM,GAC5B,OAAO,WAAW,KAAK,SAAS,SAAS,MAAM,CAAa,CAAC;CAE/D,IAAI,SAAS,WAAW,aAAa,GACnC,OAAO,WAAW,eAAe,SAAS,MAAM,EAAoB;CAEtE,IAAI,aAAa,WAAW,KAAK,IAAI,OAAO;CAC5C,IAAI,CAAC,SAAS,SAAS,GAAG,GAAG,OAAO;CAEpC,OAAO,IADW,OAAO,IAAI,YAAY,QAAQ,CAAC,CAAC,WAAW,OAAO,IAAI,EAAE,EAChE,CAAC,CAAC,KAAK,WAAW,KAAK,EAAE;AACtC;AAEA,SAAS,YAAY,OAAuB;CAC1C,OAAO,MAAM,QAAQ,uBAAuB,MAAM;AACpD;AAEA,SAAgB,mBACd,aACA,WACA,QACqB;CAGrB,MAAM,iBAAiB,eAAe,aAAa,OAAO,WAAW,QAAQ,IAAI,CAAC;CAClF,MAAM,YAAY,OAAO,WACrB,cAAc,gBAAgB,OAAO,UAAU,QAAQ,IAAI,CAAC,IAC5D;CAKJ,OAAO;EACL;EACA,oBANyB,OAAO,iBAC9B,UAAU,QAAQ,MAAM,OAAO,gBAAgB,IAAI,EAAE,QAAQ,CAAC,IAC9D;EAKF;EACA,UAAU,gBAAgB,WAAW,OAAO,MAAM;CACpD;AACF;;;;;;;AAQA,SAAgB,eACd,aACA,WACA,KACc;CACd,IAAI,UAAU,WAAW,GAAG,OAAO;CACnC,MAAM,WAAW,UAAU,KAAK,WAAW;EACzC,SAAS,OAAO,CAAC,CAAC,IAAI,MAAM,KAAK;EACjC,YAAY,MAAM;CACpB,EAAE;CAEF,MAAM,SAAuB,CAAC;CAC9B,KAAK,MAAM,cAAc,aAAa;EACpC,MAAM,UAAU,SAAS,KAAK,WAAW,IAAI,CAAC,CAAC,WAAW,MAAM,GAAG;EACnE,MAAM,WAAW,gBAAgB,WAAW,MAAM;EAClD,MAAM,aAAa;GACjB,MAAM,EAAE,IAAI,WAAW,OAAO;GAC9B,UAAU,SAAS;GACnB,MAAM,SAAS;GACf,YAAY,SAAS;EACvB;EAEA,IAAI,WAA+B,WAAW;EAC9C,KAAK,MAAM,EAAE,SAAS,gBAAgB,UAAU;GAC9C,IAAI,QAAQ,WAAW,IAAI,KAAK,CAAC,QAAQ,QAAQ,OAAO,GAAG;GAC3D,KAAK,MAAM,SAAS,YAAY;IAC9B,IAAI,CAAC,gBAAgB,YAAY,MAAM,QAAQ,GAAG;IAClD,WAAW,MAAM;GACnB;EACF;EAEA,IAAI,aAAa,OAAO;EACxB,OAAO,KAAK,aAAa,WAAW,WAAW,aAAa;GAAE,GAAG;GAAY;EAAS,CAAC;CACzF;CACA,OAAO;AACT;AAEA,SAAgB,aAAa,WAA4C;CACvE,OAAO;EACL,aAAa,UAAU;EACvB,WAAW,UAAU;CACvB;AACF;AAEA,SAAgB,gBAAgB,aAA2B,QAAmC;CAC5F,IAAI,WAAW,QAAQ,OAAO;CAE9B,MAAM,WAAW,YAAY,MAAM,MAAM,EAAE,aAAa,OAAO;CAC/D,MAAM,aAAa,YAAY,MAAM,MAAM,EAAE,aAAa,SAAS;CACnE,MAAM,UAAU,YAAY,MAAM,MAAM,EAAE,aAAa,MAAM;CAE7D,IAAI,WAAW,SAAS,OAAO,WAAW,IAAI;CAC9C,IAAI,WAAW,WAAW;EACxB,IAAI,UAAU,OAAO;EACrB,OAAO,aAAa,IAAI;CAC1B;CAEA,IAAI,UAAU,OAAO;CACrB,IAAI,cAAc,SAAS,OAAO;CAClC,OAAO;AACT;;;AC7JA,MAAM,kBAA0B,cAAc,OAAO,KAAK,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAElF,eAAsB,YAAY,SAAoD;CACpF,MAAM,SAAS,kBAAkB,OAAO;CACxC,MAAM,QAAQ,MAAM,cAAc,MAAM;CAExC,MAAM,cAAc,mBADA,qBAAqB,QACQ,GAAG,MAAM;CAE1D,MAAM,WAAW,OAAO,QAAQ,gBAAgB,QAAQ,IAAI,CAAC,IAAI;CACjE,IAAI,aAAa,MAAM;EACrB,MAAM,UAAU,eAAe;GAC7B,gBAAgB;GAChB,OAAO;GACP,OAAO,OAAO;GACd,QAAQ,OAAO;GACf,QAAQ,OAAO;GACf,QAAQ,OAAO;GACf,gBAAgB,OAAO;EACzB,CAAC;EACD,MAAM,SAAS,cAAc,QAAQ;EAErC,MAAM,gBAAgB,UADF,CAAC,GAAG,KAAK,CAAC,CAAC,KACW,GAAG,QAAQ,cAAc,IAAI;EAEvE,IAAI,WAAW,QAAQ,YAAY,QAAQ;GAAE,gBAAgB;GAAiB;EAAQ,GAAG,aAAa,GACpG,OAAO,mBAAmB,OAAO,aAAa,OAAO,WAAW,MAAM;EAIxE,MAAM,cAAc,MAAM,aAAa,OAAO,aAAa,EAAE,aADzC,0BAA0B,OAAO,WACkB,EAAE,CAAC;EAC1E,eAAe,UAAU;GACvB,SAAS;GACT,gBAAgB;GAChB;GACA,YAAY;GACZ;GACA,WAAW,MAAM;EACnB,CAAC;EACD,OAAO,mBAAmB,aAAa,MAAM,QAAQ,MAAM;CAC7D;CAIA,OAAO,mBAAmB,MADA,aAAa,OAAO,aAAa,EAAE,aADzC,0BAA0B,OAAO,WACkB,EAAE,CAAC,GACnC,MAAM,QAAQ,MAAM;AAC7D;AAEA,SAAS,0BAA0B,WAAuC;CACxE,IAAI,cAAc,KAAA,GAAW;EAC3B,IAAI,CAAC,OAAO,SAAS,SAAS,KAAK,YAAY,GAAG,OAAO;EACzD,OAAO,KAAK,MAAM,SAAS;CAC7B;CAEA,MAAM,QAAQ,qBAAqB;CACnC,OAAO,KAAK,IAAI,GAAG,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC;AACtD;AAEA,eAAsB,KAAK,SAA2C;CAEpE,OAAO,aAAa,MADI,YAAY,OAAO,CACd;AAC/B"}

package/dist/index.d.ts

@@ -1,80 +1,84 @@
-import * as ts from 'typescript';
-
+import * as ts from "typescript";
+//#region src/collect/base-registry.d.ts
 declare class BaseRegistry<T> {
-    protected entries: T[];
-    protected byHash: Map<string, T[]>;
-    protected addEntry(entry: T, hash: string): void;
-    getDuplicateGroups(): T[][];
-    getAll(): T[];
+  protected entries: T[];
+  protected byHash: Map<string, T[]>;
+  protected addEntry(entry: T, hash: string): void;
+  getDuplicateGroups(): T[][];
+  getAll(): T[];
 }
 declare class DualHashRegistry<T> extends BaseRegistry<T> {
-    private bySecondaryHash;
-    protected addWithSecondary(entry: T, primaryHash: string, secondaryHash: string): void;
-    getSecondaryDuplicateGroups(): T[][];
+  private bySecondaryHash;
+  protected addWithSecondary(entry: T, primaryHash: string, secondaryHash: string): void;
+  getSecondaryDuplicateGroups(): T[][];
 }
-
+//#endregion
+//#region src/collect/type-registry.d.ts
 interface TypeEntry {
-    name: string;
-    file: string;
-    line: number;
-    column: number;
-    hash: string;
-    node: ts.Node;
-    exported: boolean;
+  name: string;
+  file: string;
+  line: number;
+  column: number;
+  hash: string;
+  node: ts.Node;
+  exported: boolean;
 }
 declare class TypeRegistry extends BaseRegistry<TypeEntry> {
-    add(name: string, file: string, line: number, column: number, typeNode: ts.Node, sourceFile: ts.SourceFile, exported: boolean): void;
-    getNameCollisionGroups(): TypeEntry[][];
+  add(name: string, file: string, line: number, column: number, typeNode: ts.Node, sourceFile: ts.SourceFile, exported: boolean): void;
+  getNameCollisionGroups(): TypeEntry[][];
 }
-
+//#endregion
+//#region src/collect/function-registry.d.ts
 interface ParamInfo {
-    name: string;
-    optional: boolean;
-    hasDefault: boolean;
-    typeText: string | null;
+  name: string;
+  optional: boolean;
+  hasDefault: boolean;
+  typeText: string | null;
 }
 interface FunctionEntry {
-    name: string;
-    file: string;
-    line: number;
-    column: number;
-    hash: string;
-    normalizedHash: string;
-    params: ParamInfo[];
-    node: ts.Node;
-    exported: boolean;
-    /** True when the declaration carries the `default` modifier (export default) */
-    exportedAsDefault?: boolean;
-    symbol?: ts.Symbol;
-    /** Whitespace-normalized body text length (for trivial-body filtering) */
-    bodyLength: number;
-    /** Fully-normalized body text length (strings/numbers/params replaced) */
-    normalizedBodyLength: number;
-    /** Class name for class methods (e.g. "Foo" for "Foo.bar"), undefined for standalone functions */
-    className?: string;
-    /** True if the declaring class has an `implements` clause */
-    implementsInterface?: boolean;
+  name: string;
+  file: string;
+  line: number;
+  column: number;
+  hash: string;
+  normalizedHash: string;
+  params: ParamInfo[];
+  node: ts.Node;
+  exported: boolean;
+  /** True when the declaration carries the `default` modifier (export default) */
+  exportedAsDefault?: boolean;
+  symbol?: ts.Symbol;
+  /** Whitespace-normalized body text length (for trivial-body filtering) */
+  bodyLength: number;
+  /** Fully-normalized body text length (strings/numbers/params replaced) */
+  normalizedBodyLength: number;
+  /** Class name for class methods (e.g. "Foo" for "Foo.bar"), undefined for standalone functions */
+  className?: string;
+  /** True if the declaring class has an `implements` clause */
+  implementsInterface?: boolean;
 }
 declare class FunctionRegistry extends DualHashRegistry<FunctionEntry> {
-    add(entry: FunctionEntry): void;
-    getNearDuplicateGroups(): FunctionEntry[][];
-    getByName(name: string): FunctionEntry[];
-    getNameCollisionGroups(): FunctionEntry[][];
+  add(entry: FunctionEntry): void;
+  getNearDuplicateGroups(): FunctionEntry[][];
+  getByName(name: string): FunctionEntry[];
+  getNameCollisionGroups(): FunctionEntry[][];
 }
-
+//#endregion
+//#region src/collect/constant-registry.d.ts
 interface ConstantEntry {
-    name: string;
-    file: string;
-    line: number;
-    column: number;
-    valueHash: string;
-    valueText: string;
-    exported: boolean;
+  name: string;
+  file: string;
+  line: number;
+  column: number;
+  valueHash: string;
+  valueText: string;
+  exported: boolean;
 }
 declare class ConstantRegistry extends BaseRegistry<ConstantEntry> {
-    add(entry: ConstantEntry): void;
+  add(entry: ConstantEntry): void;
 }
-
+//#endregion
+//#region src/collect/statement-sequence-registry.d.ts
 /**
  * Detect maximal duplicated runs of consecutive statements across all collected
  * blocks. "Maximal" means the run can't be extended in either direction without
@@ -101,108 +105,111 @@ declare class ConstantRegistry extends BaseRegistry<ConstantEntry> {
  *      complete anchor.
  */
 interface StatementInBlock {
-    hash: string;
-    line: number;
-    column: number;
-    endLine: number;
-    normalizedLength: number;
+  hash: string;
+  line: number;
+  column: number;
+  endLine: number;
+  normalizedLength: number;
 }
 interface MaximalMatchParticipant {
-    file: string;
-    line: number;
-    column: number;
-    endLine: number;
-    /** Number of statements in this match (same for every participant). */
-    statementCount: number;
+  file: string;
+  line: number;
+  column: number;
+  endLine: number;
+  /** Number of statements in this match (same for every participant). */
+  statementCount: number;
 }
 interface MaximalMatch {
-    participants: MaximalMatchParticipant[];
-    statementCount: number;
-    /** Sum of per-statement normalized text lengths across the matched run. */
-    normalizedBodyLength: number;
+  participants: MaximalMatchParticipant[];
+  statementCount: number;
+  /** Sum of per-statement normalized text lengths across the matched run. */
+  normalizedBodyLength: number;
 }
 declare class StatementSequenceRegistry {
-    private blocks;
-    private byHash;
-    addBlock(file: string, stmts: StatementInBlock[]): void;
-    getMaximalMatches(minStatementCount: number, minNormalizedBodyLength: number): MaximalMatch[];
-    private findMatchesFromAnchor;
-}
-
+  private blocks;
+  private byHash;
+  addBlock(file: string, stmts: StatementInBlock[]): void;
+  getMaximalMatches(minStatementCount: number, minNormalizedBodyLength: number): MaximalMatch[];
+  private findMatchesFromAnchor;
+}
+//#endregion
+//#region src/collect/inline-type-registry.d.ts
 interface InlineParamTypeEntry {
-    file: string;
-    line: number;
-    column: number;
-    hash: string;
-    typeText: string;
-    node: ts.Node;
+  file: string;
+  line: number;
+  column: number;
+  hash: string;
+  typeText: string;
+  node: ts.Node;
 }
 declare class InlineParamTypeRegistry extends BaseRegistry<InlineParamTypeEntry> {
-    add(file: string, line: number, column: number, typeNode: ts.TypeLiteralNode, sourceFile: ts.SourceFile): void;
+  add(file: string, line: number, column: number, typeNode: ts.TypeLiteralNode, sourceFile: ts.SourceFile): void;
 }
-
+//#endregion
+//#region src/collect/index.d.ts
 interface ProjectIndex {
-    types: TypeRegistry;
-    functions: FunctionRegistry;
-    constants: ConstantRegistry;
-    callSites: CallSite[];
-    imports: ImportEntry[];
-    files: Map<string, {
-        source: string;
-        sourceFile: ts.SourceFile;
-    }>;
-    /** Whitespace-normalized file content hash -> list of file paths */
-    fileHashes: Map<string, string[]>;
-    statementSequences: StatementSequenceRegistry;
-    inlineParamTypes: InlineParamTypeRegistry;
+  types: TypeRegistry;
+  functions: FunctionRegistry;
+  constants: ConstantRegistry;
+  callSites: CallSite[];
+  imports: ImportEntry[];
+  files: Map<string, {
+    source: string;
+    sourceFile: ts.SourceFile;
+  }>;
+  /** Whitespace-normalized file content hash -> list of file paths */
+  fileHashes: Map<string, string[]>;
+  statementSequences: StatementSequenceRegistry;
+  inlineParamTypes: InlineParamTypeRegistry;
 }
 interface CallSite {
-    calleeName: string;
-    file: string;
-    line: number;
-    argCount: number;
-    node: ts.CallExpression;
-    symbol?: ts.Symbol;
-    resolvedDeclaration?: ts.SignatureDeclaration | ts.JSDocSignature;
+  calleeName: string;
+  file: string;
+  line: number;
+  argCount: number;
+  node: ts.CallExpression;
+  symbol?: ts.Symbol;
+  resolvedDeclaration?: ts.SignatureDeclaration | ts.JSDocSignature;
 }
 interface ImportEntry {
-    file: string;
-    localName: string;
-    importedName: string;
-    source: string;
-    /**
-     * The module specifier resolved to a project source file via the checker.
-     * Handles tsconfig path aliases and workspace packages that textual
-     * resolution cannot. Absent in source-only mode or when the specifier
-     * resolves outside the program (npm package, declaration file).
-     */
-    resolvedFile?: string;
-}
-
+  file: string;
+  localName: string;
+  importedName: string;
+  source: string;
+  /**
+   * The module specifier resolved to a project source file via the checker.
+   * Handles tsconfig path aliases and workspace packages that textual
+   * resolution cannot. Absent in source-only mode or when the specifier
+   * resolves outside the program (npm package, declaration file).
+   */
+  resolvedFile?: string;
+}
+//#endregion
+//#region src/rules/types.d.ts
 interface SemanticServices {
-    checker: ts.TypeChecker;
-    typeAtLocation(node: ts.Node): ts.Type;
-    symbolAtLocation(node: ts.Node): ts.Symbol | undefined;
-    resolvedSignature(node: ts.CallLikeExpression): ts.Signature | undefined;
-    typeFromTypeNode(node: ts.TypeNode): ts.Type;
-    contextualType(node: ts.Expression): ts.Type | undefined;
-    typeOfSymbolAtLocation(symbol: ts.Symbol, node: ts.Node): ts.Type;
-    aliasedSymbol(symbol: ts.Symbol): ts.Symbol;
-    awaitedType(type: ts.Type): ts.Type | undefined;
-    apparentType(type: ts.Type): ts.Type;
-    isArrayType(type: ts.Type): boolean;
-    isTupleType(type: ts.Type): boolean;
-    isTypeAssignableTo(source: ts.Type, target: ts.Type): boolean;
+  checker: ts.TypeChecker;
+  typeAtLocation(node: ts.Node): ts.Type;
+  symbolAtLocation(node: ts.Node): ts.Symbol | undefined;
+  resolvedSignature(node: ts.CallLikeExpression): ts.Signature | undefined;
+  typeFromTypeNode(node: ts.TypeNode): ts.Type;
+  contextualType(node: ts.Expression): ts.Type | undefined;
+  typeOfSymbolAtLocation(symbol: ts.Symbol, node: ts.Node): ts.Type;
+  aliasedSymbol(symbol: ts.Symbol): ts.Symbol;
+  awaitedType(type: ts.Type): ts.Type | undefined;
+  apparentType(type: ts.Type): ts.Type;
+  isArrayType(type: ts.Type): boolean;
+  isTupleType(type: ts.Type): boolean;
+  isTypeAssignableTo(source: ts.Type, target: ts.Type): boolean;
 }
 interface Diagnostic {
-    ruleId: string;
-    severity: "info" | "warning" | "error";
-    message: string;
-    file: string;
-    line: number;
-    column: number;
-    annotation?: string;
-    fix?: FixEdit;
+  ruleId: string;
+  severity: "info" | "warning" | "error";
+  message: string;
+  file: string;
+  line: number;
+  column: number;
+  annotation?: string;
+  fix?: FixEdit;
 }
 /**
  * A single text replacement with absolute offsets into the file's source.
@@ -210,65 +217,65 @@ interface Diagnostic {
  * `--fix` applies these mechanically.
  */
 interface FixEdit {
-    start: number;
-    end: number;
-    text: string;
+  start: number;
+  end: number;
+  text: string;
 }
 interface TSVisitContext {
-    report(node: ts.Node, message?: string, fix?: FixEdit): void;
-    reportAtOffset(offset: number, message?: string): void;
-    filename: string;
-    source: string;
-    sourceFile: ts.SourceFile;
-    checker: ts.TypeChecker;
-    semantics: SemanticServices;
-    compilerOptions: ts.CompilerOptions;
-    isNullable(node: ts.Node): boolean;
-    isExternal(node: ts.Node): boolean;
+  report(node: ts.Node, message?: string, fix?: FixEdit): void;
+  reportAtOffset(offset: number, message?: string): void;
+  filename: string;
+  source: string;
+  sourceFile: ts.SourceFile;
+  checker: ts.TypeChecker;
+  semantics: SemanticServices;
+  compilerOptions: ts.CompilerOptions;
+  isNullable(node: ts.Node): boolean;
+  isExternal(node: ts.Node): boolean;
 }
 interface TSRule {
-    kind: "ts";
-    id: string;
-    severity: "info" | "warning" | "error";
-    message: string;
-    /** Restrict visits to these node kinds. Omit only for rules that truly need every node. */
-    syntaxKinds?: readonly ts.SyntaxKind[];
-    /** Defaults to true. Set false only when the rule never touches checker/isNullable/isExternal. */
-    requiresTypeInfo?: boolean;
-    /**
-     * Set true when the rule's reasoning collapses without `strictNullChecks`:
-     * every type reads as non-nullable, inverting "this guard is dead" into
-     * advice to delete load-bearing guards. Such rules are skipped (with a
-     * notice) when the analyzed project has strictNullChecks off.
-     */
-    requiresStrictNullChecks?: boolean;
-    visit(node: ts.Node, ctx: TSVisitContext): void;
-}
-
+  kind: "ts";
+  id: string;
+  severity: "info" | "warning" | "error";
+  message: string;
+  /** Restrict visits to these node kinds. Omit only for rules that truly need every node. */
+  syntaxKinds?: readonly ts.SyntaxKind[];
+  /** Defaults to true. Set false only when the rule never touches checker/isNullable/isExternal. */
+  requiresTypeInfo?: boolean;
+  /**
+   * Set true when the rule's reasoning collapses without `strictNullChecks`:
+   * every type reads as non-nullable, inverting "this guard is dead" into
+   * advice to delete load-bearing guards. Such rules are skipped (with a
+   * notice) when the analyzed project has strictNullChecks off.
+   */
+  requiresStrictNullChecks?: boolean;
+  visit(node: ts.Node, ctx: TSVisitContext): void;
+}
 type ProjectIndexNeed = "files" | "types" | "functions" | "functionSymbols" | "constants" | "callSites" | "callSiteSymbols" | "overloadCallSignatures" | "imports" | "fileHashes" | "statementSequences" | "inlineParamTypes";
 interface CrossFileRule {
-    id: string;
-    severity: "info" | "warning" | "error";
-    message: string;
-    requires?: readonly ProjectIndexNeed[];
-    analyze(project: ProjectIndex, context?: CrossFileAnalysisContext): Diagnostic[];
-    /**
-     * Cross-group merge, both hooks or neither. Analysis runs one tsconfig
-     * group at a time; a rule that would mistake another group's usage for
-     * absence (e.g. unused-export in a monorepo) implements these instead of
-     * relying on `analyze` alone. `collectGlobalFacts` runs per group — possibly
-     * in a worker, so facts must survive structuredClone (no ts.Node/ts.Symbol).
-     * `finalizeGlobal` runs once on the main thread with every group's facts.
-     */
-    collectGlobalFacts?(project: ProjectIndex, context?: CrossFileAnalysisContext): unknown;
-    finalizeGlobal?(facts: unknown[]): Diagnostic[];
+  id: string;
+  severity: "info" | "warning" | "error";
+  message: string;
+  requires?: readonly ProjectIndexNeed[];
+  analyze(project: ProjectIndex, context?: CrossFileAnalysisContext): Diagnostic[];
+  /**
+   * Cross-group merge, both hooks or neither. Analysis runs one tsconfig
+   * group at a time; a rule that would mistake another group's usage for
+   * absence (e.g. unused-export in a monorepo) implements these instead of
+   * relying on `analyze` alone. `collectGlobalFacts` runs per group — possibly
+   * in a worker, so facts must survive structuredClone (no ts.Node/ts.Symbol).
+   * `finalizeGlobal` runs once on the main thread with every group's facts.
+   */
+  collectGlobalFacts?(project: ProjectIndex, context?: CrossFileAnalysisContext): unknown;
+  finalizeGlobal?(facts: unknown[]): Diagnostic[];
 }
 interface CrossFileAnalysisContext {
-    /** Files explicitly requested by the scan; project context outside this set is non-reportable. */
-    reportableFiles?: ReadonlySet<string>;
+  /** Files explicitly requested by the scan; project context outside this set is non-reportable. */
+  reportableFiles?: ReadonlySet<string>;
 }
 type Rule = CrossFileRule | TSRule;
-
+//#endregion
+//#region src/rules/index.d.ts
 type RuleCategory = "type-evasion" | "defensive-code" | "error-handling" | "interface-design" | "cross-file" | "imports";
 /**
  * The epistemic tier of a rule, orthogonal to severity.
@@ -286,13 +293,14 @@ type RuleCategory = "type-evasion" | "defensive-code" | "error-handling" | "inte
  */
 type RuleConfidence = "proven" | "heuristic";
 interface RuleMetadata {
-    category: RuleCategory;
-    tags: string[];
-    confidence: RuleConfidence;
+  category: RuleCategory;
+  tags: string[];
+  confidence: RuleConfidence;
 }
 declare const allRules: Rule[];
 declare function getRuleMetadata(ruleId: string): RuleMetadata;
-
+//#endregion
+//#region src/scan/baseline.d.ts
 /**
  * Ratchet file: known-issue counts per (file, rule). A scan suppresses a
  * group while its count stays at or below the recorded number; the moment it
@@ -300,10 +308,11 @@ declare function getRuleMetadata(ruleId: string): RuleMetadata;
  * easily to pin individual diagnostics, counts only ratchet downward.
  */
 interface BaselineData {
-    version: 1;
-    rules: Record<string, Record<string, number>>;
+  version: 1;
+  rules: Record<string, Record<string, number>>;
 }
-
+//#endregion
+//#region src/scan/types.d.ts
 type Severity = Diagnostic["severity"];
 type RulePolicySeverity = Severity | "off";
 type FailOn = "none" | Severity;
@@ -314,44 +323,45 @@ type FailOn = "none" | Severity;
  */
 type ScanMode = "scan" | "audit";
 interface RulePolicyEntry {
-    selector: string;
-    severity: RulePolicySeverity;
+  selector: string;
+  severity: RulePolicySeverity;
 }
 type RulePolicy = Record<string, RulePolicySeverity> | RulePolicyEntry[];
 /** Per-path rule policy: applies to diagnostics in files matching the globs. */
 interface RuleOverride {
-    files: string[];
-    rules: RulePolicy;
+  files: string[];
+  rules: RulePolicy;
 }
 interface ScanOptions {
-    paths: string[];
-    mode?: ScanMode;
-    strict?: boolean;
-    rules?: string[];
-    ignore?: string[];
-    rulePolicy?: RulePolicy;
-    /** Path-scoped rule policies, applied after the global policy. */
-    overrides?: RuleOverride[];
-    showSeverities?: Severity[];
-    failOn?: FailOn;
-    useGitIgnore?: boolean;
-    /** Worker threads for tsconfig groups. Auto by default; 1 disables. */
-    concurrency?: number;
-    /** On-disk diagnostic cache under `node_modules/.cache/unguard/`. Default: true. */
-    cache?: boolean;
-    /** Known-issue ratchet: suppress (file, rule) groups within baselined counts. */
-    baseline?: BaselineData;
+  paths: string[];
+  mode?: ScanMode;
+  strict?: boolean;
+  rules?: string[];
+  ignore?: string[];
+  rulePolicy?: RulePolicy;
+  /** Path-scoped rule policies, applied after the global policy. */
+  overrides?: RuleOverride[];
+  showSeverities?: Severity[];
+  failOn?: FailOn;
+  useGitIgnore?: boolean;
+  /** Worker threads for tsconfig groups. Auto by default; 1 disables. */
+  concurrency?: number;
+  /** On-disk diagnostic cache under `node_modules/.cache/unguard/`. Default: true. */
+  cache?: boolean;
+  /** Known-issue ratchet: suppress (file, rule) groups within baselined counts. */
+  baseline?: BaselineData;
 }
 interface ScanResult {
-    diagnostics: Diagnostic[];
-    fileCount: number;
+  diagnostics: Diagnostic[];
+  fileCount: number;
 }
 interface ScanExecutionResult extends ScanResult {
-    visibleDiagnostics: Diagnostic[];
-    exitCode: number;
+  visibleDiagnostics: Diagnostic[];
+  exitCode: number;
 }
-
+//#endregion
+//#region src/engine.d.ts
 declare function executeScan(options: ScanOptions): Promise<ScanExecutionResult>;
 declare function scan(options: ScanOptions): Promise<ScanResult>;
-
+//#endregion
 export { type CrossFileRule, type Diagnostic, type Rule, type RuleCategory, type RuleMetadata, type ScanExecutionResult, type ScanOptions, type ScanResult, type TSRule, type TSVisitContext, allRules, executeScan, getRuleMetadata, scan };