unguard 0.16.0 → 0.16.2

package/dist/index.js

@@ -1,15 +1,3 @@
-import {
-  executeScan,
-  scan
-} from "./chunk-3Y76J2K2.js";
-import {
-  allRules,
-  getRuleMetadata
-} from "./chunk-Z34GRD3S.js";
-export {
-  allRules,
-  executeScan,
-  getRuleMetadata,
-  scan
-};
-//# sourceMappingURL=index.js.map
+import { i as getRuleMetadata, r as allRules } from "./analyze-Cccs9TDD.js";
+import { n as scan, t as executeScan } from "./engine-C4KGqeYw.js";
+export { allRules, executeScan, getRuleMetadata, scan };

package/dist/worker.js

@@ -1,49 +1,51 @@
-import {
-  allRules,
-  analyzeGroup,
-  isTSRule
-} from "./chunk-Z34GRD3S.js";
-
-// src/scan/worker.ts
-import { parentPort } from "worker_threads";
-if (parentPort === null) {
-  throw new Error("unguard worker entry must run in a worker_threads context");
-}
-var port = parentPort;
-var ruleById = new Map(allRules.map((rule) => [rule.id, rule]));
+import { a as isTSRule, n as analyzeGroup, r as allRules } from "./analyze-Cccs9TDD.js";
+import { parentPort } from "node:worker_threads";
+//#region src/scan/worker.ts
+if (parentPort === null) throw new Error("unguard worker entry must run in a worker_threads context");
+const port = parentPort;
+const ruleById = new Map(allRules.map((rule) => [rule.id, rule]));
 port.on("message", (req) => {
-  try {
-    const rules = resolveRules(req.ruleSpecs);
-    const tsRules = rules.filter(isTSRule);
-    const crossFileRules = rules.filter((r) => !isTSRule(r));
-    const indexNeeds = new Set(req.indexNeeds);
-    const result = analyzeGroup(req.groupConfig, tsRules, crossFileRules, indexNeeds);
-    const response = {
-      taskId: req.taskId,
-      ok: true,
-      diagnostics: result.diagnostics,
-      globalFacts: result.globalFacts
-    };
-    port.postMessage(response);
-  } catch (err) {
-    const message = err instanceof Error ? `${err.message}
-${err.stack ?? ""}` : String(err);
-    const response = { taskId: req.taskId, ok: false, error: message };
-    port.postMessage(response);
-  }
+	try {
+		const rules = resolveRules(req.ruleSpecs);
+		const tsRules = rules.filter(isTSRule);
+		const crossFileRules = rules.filter((r) => !isTSRule(r));
+		const indexNeeds = new Set(req.indexNeeds);
+		const result = analyzeGroup(req.groupConfig, tsRules, crossFileRules, indexNeeds);
+		const response = {
+			taskId: req.taskId,
+			ok: true,
+			diagnostics: result.diagnostics,
+			globalFacts: result.globalFacts
+		};
+		port.postMessage(response);
+	} catch (err) {
+		const message = err instanceof Error ? `${err.message}\n${err.stack ?? ""}` : String(err);
+		const response = {
+			taskId: req.taskId,
+			ok: false,
+			error: message
+		};
+		port.postMessage(response);
+	}
 });
 function resolveRules(specs) {
-  const rules = [];
-  for (const spec of specs) {
-    const rule = ruleById.get(spec.id);
-    if (rule === void 0) continue;
-    if (spec.severity === "off") continue;
-    if (rule.severity === spec.severity) {
-      rules.push(rule);
-      continue;
-    }
-    rules.push({ ...rule, severity: spec.severity });
-  }
-  return rules;
+	const rules = [];
+	for (const spec of specs) {
+		const rule = ruleById.get(spec.id);
+		if (rule === void 0) continue;
+		if (spec.severity === "off") continue;
+		if (rule.severity === spec.severity) {
+			rules.push(rule);
+			continue;
+		}
+		rules.push({
+			...rule,
+			severity: spec.severity
+		});
+	}
+	return rules;
 }
+//#endregion
+export {};
+
 //# sourceMappingURL=worker.js.map

package/dist/worker.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/scan/worker.ts"],"sourcesContent":["import { parentPort } from \"node:worker_threads\";\nimport { allRules } from \"../rules/index.ts\";\nimport { isTSRule, type CrossFileRule, type ProjectIndexNeed, type Rule } from \"../rules/types.ts\";\nimport { analyzeGroup } from \"./analyze.ts\";\nimport type { WorkerRequest, WorkerResponse, RuleSpec } from \"./worker-pool.ts\";\n\nif (parentPort === null) {\n  throw new Error(\"unguard worker entry must run in a worker_threads context\");\n}\n\nconst port = parentPort;\nconst ruleById = new Map<string, Rule>(allRules.map((rule) => [rule.id, rule]));\n\nport.on(\"message\", (req: WorkerRequest) => {\n  try {\n    const rules = resolveRules(req.ruleSpecs);\n    const tsRules = rules.filter(isTSRule);\n    const crossFileRules = rules.filter((r): r is CrossFileRule => !isTSRule(r));\n    const indexNeeds: ReadonlySet<ProjectIndexNeed> = new Set(req.indexNeeds);\n    const result = analyzeGroup(req.groupConfig, tsRules, crossFileRules, indexNeeds);\n    const response: WorkerResponse = {\n      taskId: req.taskId,\n      ok: true,\n      diagnostics: result.diagnostics,\n      globalFacts: result.globalFacts,\n    };\n    port.postMessage(response);\n  } catch (err) {\n    // @unguard no-swallowed-catch worker boundary: forwarded as a structured response to the parent thread.\n    const message = err instanceof Error ? `${err.message}\\n${err.stack ?? \"\"}` : String(err);\n    const response: WorkerResponse = { taskId: req.taskId, ok: false, error: message };\n    port.postMessage(response);\n  }\n});\n\nfunction resolveRules(specs: RuleSpec[]): Rule[] {\n  const rules: Rule[] = [];\n  for (const spec of specs) {\n    const rule = ruleById.get(spec.id);\n    if (rule === undefined) continue;\n    if (spec.severity === \"off\") continue;\n    if (rule.severity === spec.severity) {\n      rules.push(rule);\n      continue;\n    }\n    rules.push({ ...rule, severity: spec.severity });\n  }\n  return rules;\n}\n"],"mappings":";;;;;;;AAAA,SAAS,kBAAkB;AAM3B,IAAI,eAAe,MAAM;AACvB,QAAM,IAAI,MAAM,2DAA2D;AAC7E;AAEA,IAAM,OAAO;AACb,IAAM,WAAW,IAAI,IAAkB,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAE9E,KAAK,GAAG,WAAW,CAAC,QAAuB;AACzC,MAAI;AACF,UAAM,QAAQ,aAAa,IAAI,SAAS;AACxC,UAAM,UAAU,MAAM,OAAO,QAAQ;AACrC,UAAM,iBAAiB,MAAM,OAAO,CAAC,MAA0B,CAAC,SAAS,CAAC,CAAC;AAC3E,UAAM,aAA4C,IAAI,IAAI,IAAI,UAAU;AACxE,UAAM,SAAS,aAAa,IAAI,aAAa,SAAS,gBAAgB,UAAU;AAChF,UAAM,WAA2B;AAAA,MAC/B,QAAQ,IAAI;AAAA,MACZ,IAAI;AAAA,MACJ,aAAa,OAAO;AAAA,MACpB,aAAa,OAAO;AAAA,IACtB;AACA,SAAK,YAAY,QAAQ;AAAA,EAC3B,SAAS,KAAK;AAEZ,UAAM,UAAU,eAAe,QAAQ,GAAG,IAAI,OAAO;AAAA,EAAK,IAAI,SAAS,EAAE,KAAK,OAAO,GAAG;AACxF,UAAM,WAA2B,EAAE,QAAQ,IAAI,QAAQ,IAAI,OAAO,OAAO,QAAQ;AACjF,SAAK,YAAY,QAAQ;AAAA,EAC3B;AACF,CAAC;AAED,SAAS,aAAa,OAA2B;AAC/C,QAAM,QAAgB,CAAC;AACvB,aAAW,QAAQ,OAAO;AACxB,UAAM,OAAO,SAAS,IAAI,KAAK,EAAE;AACjC,QAAI,SAAS,OAAW;AACxB,QAAI,KAAK,aAAa,MAAO;AAC7B,QAAI,KAAK,aAAa,KAAK,UAAU;AACnC,YAAM,KAAK,IAAI;AACf;AAAA,IACF;AACA,UAAM,KAAK,EAAE,GAAG,MAAM,UAAU,KAAK,SAAS,CAAC;AAAA,EACjD;AACA,SAAO;AACT;","names":[]}
+{"version":3,"file":"worker.js","names":[],"sources":["../src/scan/worker.ts"],"sourcesContent":["import { parentPort } from \"node:worker_threads\";\nimport { allRules } from \"../rules/index.ts\";\nimport { isTSRule, type CrossFileRule, type ProjectIndexNeed, type Rule } from \"../rules/types.ts\";\nimport { analyzeGroup } from \"./analyze.ts\";\nimport type { WorkerRequest, WorkerResponse, RuleSpec } from \"./worker-pool.ts\";\n\nif (parentPort === null) {\n  throw new Error(\"unguard worker entry must run in a worker_threads context\");\n}\n\nconst port = parentPort;\nconst ruleById = new Map<string, Rule>(allRules.map((rule) => [rule.id, rule]));\n\nport.on(\"message\", (req: WorkerRequest) => {\n  try {\n    const rules = resolveRules(req.ruleSpecs);\n    const tsRules = rules.filter(isTSRule);\n    const crossFileRules = rules.filter((r): r is CrossFileRule => !isTSRule(r));\n    const indexNeeds: ReadonlySet<ProjectIndexNeed> = new Set(req.indexNeeds);\n    const result = analyzeGroup(req.groupConfig, tsRules, crossFileRules, indexNeeds);\n    const response: WorkerResponse = {\n      taskId: req.taskId,\n      ok: true,\n      diagnostics: result.diagnostics,\n      globalFacts: result.globalFacts,\n    };\n    port.postMessage(response);\n  } catch (err) {\n    // @unguard no-swallowed-catch worker boundary: forwarded as a structured response to the parent thread.\n    const message = err instanceof Error ? `${err.message}\\n${err.stack ?? \"\"}` : String(err);\n    const response: WorkerResponse = { taskId: req.taskId, ok: false, error: message };\n    port.postMessage(response);\n  }\n});\n\nfunction resolveRules(specs: RuleSpec[]): Rule[] {\n  const rules: Rule[] = [];\n  for (const spec of specs) {\n    const rule = ruleById.get(spec.id);\n    if (rule === undefined) continue;\n    if (spec.severity === \"off\") continue;\n    if (rule.severity === spec.severity) {\n      rules.push(rule);\n      continue;\n    }\n    rules.push({ ...rule, severity: spec.severity });\n  }\n  return rules;\n}\n"],"mappings":";;;AAMA,IAAI,eAAe,MACjB,MAAM,IAAI,MAAM,2DAA2D;AAG7E,MAAM,OAAO;AACb,MAAM,WAAW,IAAI,IAAkB,SAAS,KAAK,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAE9E,KAAK,GAAG,YAAY,QAAuB;CACzC,IAAI;EACF,MAAM,QAAQ,aAAa,IAAI,SAAS;EACxC,MAAM,UAAU,MAAM,OAAO,QAAQ;EACrC,MAAM,iBAAiB,MAAM,QAAQ,MAA0B,CAAC,SAAS,CAAC,CAAC;EAC3E,MAAM,aAA4C,IAAI,IAAI,IAAI,UAAU;EACxE,MAAM,SAAS,aAAa,IAAI,aAAa,SAAS,gBAAgB,UAAU;EAChF,MAAM,WAA2B;GAC/B,QAAQ,IAAI;GACZ,IAAI;GACJ,aAAa,OAAO;GACpB,aAAa,OAAO;EACtB;EACA,KAAK,YAAY,QAAQ;CAC3B,SAAS,KAAK;EAEZ,MAAM,UAAU,eAAe,QAAQ,GAAG,IAAI,QAAQ,IAAI,IAAI,SAAS,OAAO,OAAO,GAAG;EACxF,MAAM,WAA2B;GAAE,QAAQ,IAAI;GAAQ,IAAI;GAAO,OAAO;EAAQ;EACjF,KAAK,YAAY,QAAQ;CAC3B;AACF,CAAC;AAED,SAAS,aAAa,OAA2B;CAC/C,MAAM,QAAgB,CAAC;CACvB,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,OAAO,SAAS,IAAI,KAAK,EAAE;EACjC,IAAI,SAAS,KAAA,GAAW;EACxB,IAAI,KAAK,aAAa,OAAO;EAC7B,IAAI,KAAK,aAAa,KAAK,UAAU;GACnC,MAAM,KAAK,IAAI;GACf;EACF;EACA,MAAM,KAAK;GAAE,GAAG;GAAM,UAAU,KAAK;EAAS,CAAC;CACjD;CACA,OAAO;AACT"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unguard",
-  "version": "0.16.0",
+  "version": "0.16.2",
   "description": "Detect overdefensive AI-generated code",
   "author": "Seva Maltsev <me@seva.dev> (https://seva.dev)",
   "license": "MIT",
@@ -40,8 +40,8 @@
     "schema.json"
   ],
   "scripts": {
-    "build": "tsup",
-    "typecheck": "tsc",
+    "build": "tsdown",
+    "typecheck": "node ./node_modules/tsc7/bin/tsc",
     "lint:biome": "biome lint src tests/**/*.test.ts tests/harness.ts",
     "lint": "npm run lint:biome",
     "test": "vitest run",
@@ -52,18 +52,19 @@
     "prepublishOnly": "npm run build && npm run test"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "dependencies": {
     "fast-glob": "^3.3.3",
     "ignore": "^7.0.5",
     "picocolors": "^1.1.1",
-    "typescript": "^5.9.3"
+    "typescript": "^6.0.3"
   },
   "devDependencies": {
     "@biomejs/biome": "^1.9.4",
-    "@types/node": "^25.3.0",
-    "tsup": "^8.5.1",
+    "@types/node": "^22.20.1",
+    "tsc7": "npm:typescript@^7.0.2",
+    "tsdown": "^0.22.4",
     "vitest": "^4.0.18"
   }
 }

package/dist/chunk-3Y76J2K2.js

@@ -1,511 +0,0 @@
-import {
-  allRules,
-  analyzeFiles,
-  getRuleMetadata
-} from "./chunk-Z34GRD3S.js";
-
-// src/scan/config.ts
-var BUILTIN_IGNORE = [
-  "**/node_modules/**",
-  "**/dist/**",
-  "**/.git/**",
-  "**/*.d.ts",
-  "**/*.d.cts",
-  "**/*.d.mts"
-];
-var GENERATED_IGNORE = [
-  "**/*.gen.*",
-  "**/*.generated.*"
-];
-var DEFAULT_FAIL_ON = "info";
-function resolveScanConfig(options) {
-  const paths = options.paths.length > 0 ? options.paths : ["."];
-  const ignore3 = [...BUILTIN_IGNORE, ...GENERATED_IGNORE, ...options.ignore ?? []];
-  return {
-    paths,
-    mode: options.mode ?? "scan",
-    strict: options.strict ?? false,
-    rules: options.rules ? [...options.rules] : null,
-    ignore: ignore3,
-    rulePolicy: toRulePolicyEntries(options.rulePolicy),
-    overrides: toResolvedOverrides(options.overrides),
-    showSeverities: normalizeSeveritySet(options.showSeverities),
-    failOn: options.failOn ?? DEFAULT_FAIL_ON,
-    useGitIgnore: options.useGitIgnore ?? true,
-    concurrency: options.concurrency,
-    cache: options.cache ?? true,
-    baseline: options.baseline ?? null
-  };
-}
-function toResolvedOverrides(overrides) {
-  if (overrides === void 0) return [];
-  return overrides.map((entry) => ({
-    files: [...entry.files],
-    rulePolicy: toRulePolicyEntries(entry.rules)
-  }));
-}
-function toRulePolicyEntries(policy) {
-  if (policy === void 0) return [];
-  if (Array.isArray(policy)) return [...policy];
-  const entries = [];
-  for (const [selector, severity] of Object.entries(policy)) {
-    entries.push({ selector, severity });
-  }
-  return entries;
-}
-function normalizeSeveritySet(levels) {
-  if (levels === void 0 || levels.length === 0) return null;
-  return new Set(levels);
-}
-function isRulePolicySeverity(value) {
-  return value === "off" || value === "info" || value === "warning" || value === "error";
-}
-function isSeverity(value) {
-  return value === "info" || value === "warning" || value === "error";
-}
-function isFailOn(value) {
-  return value === "none" || isSeverity(value);
-}
-
-// src/scan/baseline.ts
-import { existsSync, readFileSync, writeFileSync } from "fs";
-import { relative, resolve } from "path";
-var BASELINE_FILENAME = "unguard.baseline.json";
-function buildBaseline(diagnostics, cwd) {
-  const rules = {};
-  for (const diagnostic of diagnostics) {
-    const file = relative(cwd, diagnostic.file);
-    rules[file] ??= {};
-    const forFile = rules[file];
-    forFile[diagnostic.ruleId] = (forFile[diagnostic.ruleId] ?? 0) + 1;
-  }
-  return { version: 1, rules };
-}
-function writeBaseline(baseline, cwd) {
-  const path = resolve(cwd, BASELINE_FILENAME);
-  writeFileSync(path, `${JSON.stringify(baseline, null, 2)}
-`, "utf8");
-  return path;
-}
-function loadBaseline(cwd) {
-  const path = resolve(cwd, BASELINE_FILENAME);
-  if (!existsSync(path)) return null;
-  const parsed = JSON.parse(readFileSync(path, "utf8"));
-  if (!isBaselineData(parsed)) {
-    throw new Error(`Invalid baseline in ${BASELINE_FILENAME}: expected {"version": 1, "rules": {<file>: {<ruleId>: count}}}.`);
-  }
-  return parsed;
-}
-function isBaselineData(value) {
-  if (typeof value !== "object" || value === null) return false;
-  if (!("version" in value) || value.version !== 1) return false;
-  if (!("rules" in value) || typeof value.rules !== "object" || value.rules === null) return false;
-  return Object.values(value.rules).every(
-    (forFile) => typeof forFile === "object" && forFile !== null && Object.values(forFile).every((count) => typeof count === "number")
-  );
-}
-function applyBaseline(diagnostics, baseline, cwd) {
-  const groups = /* @__PURE__ */ new Map();
-  for (const diagnostic of diagnostics) {
-    const key = `${relative(cwd, diagnostic.file)}\0${diagnostic.ruleId}`;
-    let list = groups.get(key);
-    if (list === void 0) {
-      list = [];
-      groups.set(key, list);
-    }
-    list.push(diagnostic);
-  }
-  const kept = [];
-  for (const [key, group] of groups) {
-    const [file, ruleId] = key.split("\0");
-    const allowed = baseline.rules[file]?.[ruleId] ?? 0;
-    if (group.length <= allowed) continue;
-    kept.push(...group);
-  }
-  return kept;
-}
-
-// src/scan/policy.ts
-import { relative as relative2 } from "path";
-import ignore from "ignore";
-function buildRuleDescriptors(rules) {
-  return rules.map((rule) => {
-    const metadata = getRuleMetadata(rule.id);
-    return {
-      rule,
-      category: metadata.category,
-      tags: metadata.tags,
-      confidence: metadata.confidence
-    };
-  });
-}
-function resolveActiveRules(descriptors, config) {
-  const selectedRules = config.rules ? new Set(config.rules) : null;
-  const wantedConfidence = config.mode === "audit" ? "heuristic" : "proven";
-  const active = [];
-  for (const descriptor of descriptors) {
-    if (selectedRules) {
-      if (!selectedRules.has(descriptor.rule.id)) continue;
-    } else if (descriptor.confidence !== wantedConfidence) {
-      continue;
-    }
-    const resolvedSeverity = resolveRuleSeverity(descriptor, config);
-    if (resolvedSeverity === "off") continue;
-    if (descriptor.rule.severity === resolvedSeverity) {
-      active.push(descriptor.rule);
-      continue;
-    }
-    active.push({ ...descriptor.rule, severity: resolvedSeverity });
-  }
-  return active;
-}
-function resolveRuleSeverity(descriptor, config) {
-  let severity = descriptor.rule.severity;
-  for (const entry of config.rulePolicy) {
-    if (!matchesSelector(descriptor, entry.selector)) continue;
-    severity = entry.severity;
-  }
-  if (severity === "off") return "off";
-  if (config.strict) return "error";
-  return severity;
-}
-function matchesSelector(descriptor, selector) {
-  if (selector.startsWith("category:")) {
-    return descriptor.category === selector.slice("category:".length);
-  }
-  if (selector.startsWith("tag:")) {
-    return descriptor.tags.includes(selector.slice("tag:".length));
-  }
-  if (selector.startsWith("confidence:")) {
-    return descriptor.confidence === selector.slice("confidence:".length);
-  }
-  if (selector === descriptor.rule.id) return true;
-  if (!selector.includes("*")) return false;
-  const regex = new RegExp(`^${escapeRegex(selector).replaceAll("\\*", ".*")}$`);
-  return regex.test(descriptor.rule.id);
-}
-function escapeRegex(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function finalizeScanResult(diagnostics, fileCount, config) {
-  const afterOverrides = applyOverrides(diagnostics, config.overrides, process.cwd());
-  const effective = config.baseline ? applyBaseline(afterOverrides, config.baseline, process.cwd()) : afterOverrides;
-  const visibleDiagnostics = config.showSeverities ? effective.filter((d) => config.showSeverities?.has(d.severity)) : effective;
-  return {
-    diagnostics,
-    visibleDiagnostics,
-    fileCount,
-    exitCode: computeExitCode(effective, config.failOn)
-  };
-}
-function applyOverrides(diagnostics, overrides, cwd) {
-  if (overrides.length === 0) return diagnostics;
-  const matchers = overrides.map((entry) => ({
-    matcher: ignore().add(entry.files),
-    rulePolicy: entry.rulePolicy
-  }));
-  const result = [];
-  for (const diagnostic of diagnostics) {
-    const relPath = relative2(cwd, diagnostic.file).replaceAll("\\", "/");
-    const metadata = getRuleMetadata(diagnostic.ruleId);
-    const descriptor = {
-      rule: { id: diagnostic.ruleId },
-      category: metadata.category,
-      tags: metadata.tags,
-      confidence: metadata.confidence
-    };
-    let severity = diagnostic.severity;
-    for (const { matcher, rulePolicy } of matchers) {
-      if (relPath.startsWith("..") || !matcher.ignores(relPath)) continue;
-      for (const entry of rulePolicy) {
-        if (!matchesSelector(descriptor, entry.selector)) continue;
-        severity = entry.severity;
-      }
-    }
-    if (severity === "off") continue;
-    result.push(severity === diagnostic.severity ? diagnostic : { ...diagnostic, severity });
-  }
-  return result;
-}
-function toScanResult(execution) {
-  return {
-    diagnostics: execution.diagnostics,
-    fileCount: execution.fileCount
-  };
-}
-function computeExitCode(diagnostics, failOn) {
-  if (failOn === "none") return 0;
-  const hasError = diagnostics.some((d) => d.severity === "error");
-  const hasWarning = diagnostics.some((d) => d.severity === "warning");
-  const hasInfo = diagnostics.some((d) => d.severity === "info");
-  if (failOn === "error") return hasError ? 2 : 0;
-  if (failOn === "warning") {
-    if (hasError) return 2;
-    return hasWarning ? 1 : 0;
-  }
-  if (hasError) return 2;
-  if (hasWarning || hasInfo) return 1;
-  return 0;
-}
-
-// src/engine.ts
-import { availableParallelism } from "os";
-
-// src/scan/cache.ts
-import { createHash } from "crypto";
-import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, statSync, writeFileSync as writeFileSync2 } from "fs";
-import { join } from "path";
-var CACHE_VERSION = 1;
-var CACHE_FILENAME = "scan-cache.json";
-function resolveCacheDir(startDir) {
-  let dir = startDir;
-  for (; ; ) {
-    const nm = join(dir, "node_modules");
-    if (existsSync2(nm)) return join(nm, ".cache", "unguard", `v${CACHE_VERSION}`);
-    const parent = join(dir, "..");
-    if (parent === dir) return null;
-    dir = parent;
-  }
-}
-function computeScanKey(input) {
-  const ruleSig = [...input.rules].map((r) => `${r.id}=${r.severity}`).sort().join(",");
-  const payload = JSON.stringify({
-    unguardVersion: input.unguardVersion,
-    ruleSig,
-    paths: [...input.paths].sort(),
-    ignore: [...input.ignore].sort(),
-    strict: input.strict,
-    failOn: input.failOn,
-    showSeverities: input.showSeverities ? [...input.showSeverities].sort() : null
-  });
-  return createHash("sha256").update(payload).digest("hex").slice(0, 16);
-}
-function hashFile(path, prevFingerprint) {
-  const s = statSync(path, { bigint: true });
-  const statTag = `${s.size}:${s.mtimeNs.toString()}`;
-  if (prevFingerprint !== void 0) {
-    const prevStat = prevFingerprint.split("@", 1)[0];
-    if (prevStat === statTag) return prevFingerprint;
-  }
-  const buf = readFileSync2(path);
-  const contentHash = createHash("sha1").update(buf).digest("hex").slice(0, 16);
-  return `${statTag}@${contentHash}`;
-}
-function hashFiles(paths, prev) {
-  const result = {};
-  for (const path of paths) {
-    result[path] = hashFile(path, prev?.[path]);
-  }
-  return result;
-}
-function readScanCache(dir) {
-  const path = join(dir, CACHE_FILENAME);
-  if (!existsSync2(path)) return null;
-  const text = trySync(() => readFileSync2(path, "utf8"), "read failed");
-  if (text === null) return null;
-  const raw = trySync(() => JSON.parse(text), "parse failed");
-  if (raw === null) return null;
-  return validateScanCache(raw);
-}
-function writeScanCache(dir, entry) {
-  trySync(() => {
-    mkdirSync(dir, { recursive: true });
-    writeFileSync2(join(dir, CACHE_FILENAME), JSON.stringify(entry));
-    return true;
-  }, "write failed");
-}
-function cacheCovers(cached, context, currentHashes) {
-  if (cached.unguardVersion !== context.unguardVersion) return false;
-  if (cached.scanKey !== context.scanKey) return false;
-  const cachedFiles = Object.keys(cached.fileHashes);
-  const currentFiles = Object.keys(currentHashes);
-  if (cachedFiles.length !== currentFiles.length) return false;
-  for (const file of currentFiles) {
-    const prev = cached.fileHashes[file];
-    const cur = currentHashes[file];
-    if (prev === void 0 || cur === void 0) return false;
-    if (contentHashOf(prev) !== contentHashOf(cur)) return false;
-  }
-  return true;
-}
-function contentHashOf(fingerprint) {
-  const idx = fingerprint.indexOf("@");
-  return idx >= 0 ? fingerprint.slice(idx + 1) : fingerprint;
-}
-function validateScanCache(raw) {
-  if (typeof raw !== "object" || raw === null) return null;
-  const entry = raw;
-  if (entry.version !== CACHE_VERSION) return null;
-  if (typeof entry.scanKey !== "string") return null;
-  if (typeof entry.unguardVersion !== "string") return null;
-  if (typeof entry.fileCount !== "number") return null;
-  const fileHashes = validateFileHashes(entry.fileHashes);
-  if (fileHashes === null) return null;
-  const diagnostics = validateDiagnostics(entry.diagnostics);
-  if (diagnostics === null) return null;
-  return {
-    version: entry.version,
-    unguardVersion: entry.unguardVersion,
-    scanKey: entry.scanKey,
-    fileHashes,
-    diagnostics,
-    fileCount: entry.fileCount
-  };
-}
-function validateFileHashes(raw) {
-  if (typeof raw !== "object" || raw === null) return null;
-  const result = {};
-  for (const [key, value] of Object.entries(raw)) {
-    if (typeof value !== "string") return null;
-    result[key] = value;
-  }
-  return result;
-}
-function validateDiagnostics(raw) {
-  if (!Array.isArray(raw)) return null;
-  const list = [];
-  for (const item of raw) {
-    const diag = validateDiagnostic(item);
-    if (diag === null) return null;
-    list.push(diag);
-  }
-  return list;
-}
-function validateDiagnostic(item) {
-  if (typeof item !== "object" || item === null) return null;
-  if (!("file" in item) || typeof item.file !== "string") return null;
-  if (!("ruleId" in item) || typeof item.ruleId !== "string") return null;
-  if (!("line" in item) || typeof item.line !== "number") return null;
-  if (!("column" in item) || typeof item.column !== "number") return null;
-  if (!("severity" in item)) return null;
-  if (item.severity !== "error" && item.severity !== "warning" && item.severity !== "info") return null;
-  if (!("message" in item) || typeof item.message !== "string") return null;
-  const annotation = "annotation" in item ? item.annotation : void 0;
-  if (annotation !== void 0 && typeof annotation !== "string") return null;
-  return {
-    file: item.file,
-    ruleId: item.ruleId,
-    line: item.line,
-    column: item.column,
-    severity: item.severity,
-    message: item.message,
-    annotation
-  };
-}
-function trySync(fn, label) {
-  try {
-    return fn();
-  } catch (err) {
-    return debugLog(label, err);
-  }
-}
-function debugLog(label, err) {
-  if (process.env.UNGUARD_DEBUG !== void 0) {
-    console.error(`[unguard] cache ${label}:`, err);
-  }
-  return null;
-}
-
-// src/scan/discover.ts
-import fg from "fast-glob";
-import ignore2 from "ignore";
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { relative as relative3, resolve as resolve2, sep } from "path";
-async function discoverFiles(config) {
-  const globs = expandGlobs(config.paths);
-  const discoveredFiles = await fg(globs, {
-    ignore: config.ignore,
-    absolute: true
-  });
-  if (!config.useGitIgnore) return discoveredFiles;
-  return applyGitIgnore(discoveredFiles);
-}
-function expandGlobs(paths) {
-  return paths.map((p) => {
-    if (p === ".") return "./**/*.{ts,cts,mts,tsx}";
-    if (p.endsWith("/")) return `${p}**/*.{ts,cts,mts,tsx}`;
-    if (!p.includes("*") && !p.endsWith(".ts") && !p.endsWith(".tsx") && !p.endsWith(".cts") && !p.endsWith(".mts")) {
-      return `${p}/**/*.{ts,cts,mts,tsx}`;
-    }
-    return p;
-  });
-}
-function applyGitIgnore(files) {
-  const gitIgnorePath = resolve2(process.cwd(), ".gitignore");
-  if (!existsSync3(gitIgnorePath)) return files;
-  const matcher = ignore2().add(readFileSync3(gitIgnorePath, "utf8"));
-  return files.filter((file) => {
-    const rel = relative3(process.cwd(), file);
-    if (rel.startsWith("..")) return true;
-    const normalized = rel.split(sep).join("/");
-    return !matcher.ignores(normalized);
-  });
-}
-
-// src/engine.ts
-var UNGUARD_VERSION = "0.16.0";
-async function executeScan(options) {
-  const config = resolveScanConfig(options);
-  const files = await discoverFiles(config);
-  const descriptors = buildRuleDescriptors(allRules);
-  const activeRules = resolveActiveRules(descriptors, config);
-  const cacheDir = config.cache ? resolveCacheDir(process.cwd()) : null;
-  if (cacheDir !== null) {
-    const scanKey = computeScanKey({
-      unguardVersion: UNGUARD_VERSION,
-      rules: activeRules,
-      paths: config.paths,
-      ignore: config.ignore,
-      strict: config.strict,
-      failOn: config.failOn,
-      showSeverities: config.showSeverities
-    });
-    const cached = readScanCache(cacheDir);
-    const sortedFiles = [...files].sort();
-    const currentHashes = hashFiles(sortedFiles, cached?.fileHashes ?? null);
-    if (cached !== null && cacheCovers(cached, { unguardVersion: UNGUARD_VERSION, scanKey }, currentHashes)) {
-      return finalizeScanResult(cached.diagnostics, cached.fileCount, config);
-    }
-    const concurrency2 = resolveDefaultConcurrency(config.concurrency);
-    const diagnostics2 = await analyzeFiles(files, activeRules, { concurrency: concurrency2 });
-    writeScanCache(cacheDir, {
-      version: 1,
-      unguardVersion: UNGUARD_VERSION,
-      scanKey,
-      fileHashes: currentHashes,
-      diagnostics: diagnostics2,
-      fileCount: files.length
-    });
-    return finalizeScanResult(diagnostics2, files.length, config);
-  }
-  const concurrency = resolveDefaultConcurrency(config.concurrency);
-  const diagnostics = await analyzeFiles(files, activeRules, { concurrency });
-  return finalizeScanResult(diagnostics, files.length, config);
-}
-function resolveDefaultConcurrency(requested) {
-  if (requested !== void 0) {
-    if (!Number.isFinite(requested) || requested < 1) return 1;
-    return Math.floor(requested);
-  }
-  const cores = availableParallelism();
-  return Math.min(8, Math.max(1, Math.ceil(cores / 2)));
-}
-async function scan(options) {
-  const execution = await executeScan(options);
-  return toScanResult(execution);
-}
-
-export {
-  toRulePolicyEntries,
-  isRulePolicySeverity,
-  isSeverity,
-  isFailOn,
-  BASELINE_FILENAME,
-  buildBaseline,
-  writeBaseline,
-  loadBaseline,
-  computeExitCode,
-  executeScan,
-  scan
-};
-//# sourceMappingURL=chunk-3Y76J2K2.js.map