sonar.projectKey=TREK
sonar.projectName=TREK
sonar.sourceEncoding=UTF-8

# Sources — one entry per workspace package (plugin-sdk is standalone but lives in-repo)
sonar.sources=client/src,server/src,shared/src,plugin-sdk/src

# Tests — dedicated test dirs per package, plus co-located client tests in src
# and co-located shared schema/sanitize/i18n specs in shared/src
sonar.tests=server/tests,client/tests,client/e2e,client/src,shared/src,plugin-sdk/test
sonar.test.inclusions=\
   server/tests/**/*.test.ts,\
   client/tests/**/*.test.ts,\
   client/tests/**/*.test.tsx,\
   client/e2e/**/*.spec.ts,\
   client/src/**/*.test.ts,\
   client/src/**/*.test.tsx,\
   shared/src/**/*.spec.ts,\
   plugin-sdk/test/**/*.test.ts

# Keep generated output and test files out of source analysis
sonar.exclusions=\
   **/node_modules/**,\
   **/dist/**,\
   **/build/**,\
   **/coverage/**,\
   client/dev-dist/**,\
   **/*.test.ts,\
   **/*.test.tsx,\
   **/*.spec.ts,\
   **/*.d.ts

# Coverage — lcov paths relative to repo root, one per package
# (each package's vitest config emits lcov to <pkg>/coverage/).
sonar.javascript.lcov.reportPaths=\
   server/coverage/lcov.info,\
   client/coverage/lcov.info,\
   shared/coverage/lcov.info,\
   plugin-sdk/coverage/lcov.info

# Infrastructure/bootstrap files plus generated/data files the vitest configs
# exclude from instrumentation (a file absent from lcov would otherwise count
# as 0% covered here — keep these in sync with each package's vitest.config.ts)
sonar.coverage.exclusions=\
   server/src/index.ts,\
   server/src/config.ts,\
   server/src/db/database.ts,\
   server/src/db/migrations.ts,\
   server/src/db/seeds.ts,\
   server/src/demo/**,\
   server/src/nest/plugins/runtime/plugin-host-entry.ts,\
   client/src/main.tsx,\
   client/src/types.ts,\
   shared/src/plugin-permissions.ts,\
   shared/src/i18n/*/**,\
   plugin-sdk/src/generated/**,\
   plugin-sdk/src/lucide-icon-names.ts

# Locale files are large near-identical literal objects — keep them out of duplication metrics
sonar.cpd.exclusions=shared/src/i18n/**

# Locale files are UI copy — strings like "Password", "API key", "token" are labels,
# not credentials, and the secret detectors false-positive on them constantly.
# Ignore the secrets analyzer and the hard-coded-credential rules on i18n only.
sonar.issue.ignore.multicriteria=i18nsec1,i18nsec2,i18nsec3
sonar.issue.ignore.multicriteria.i18nsec1.ruleKey=secrets:*
sonar.issue.ignore.multicriteria.i18nsec1.resourceKey=shared/src/i18n/**
sonar.issue.ignore.multicriteria.i18nsec2.ruleKey=typescript:S2068
sonar.issue.ignore.multicriteria.i18nsec2.resourceKey=shared/src/i18n/**
sonar.issue.ignore.multicriteria.i18nsec3.ruleKey=typescript:S6418
sonar.issue.ignore.multicriteria.i18nsec3.resourceKey=shared/src/i18n/**