Using zzop

npm i -D @zzop/cli     # add to your project (or one-off: npx @zzop/cli)
npx zzop init     # writes an annotated zzop.config.jsonc
npx zzop          # analyzes using that config and prints a report

{
  // What to analyze: one or more directory roots. Multiple roots run a
  // cross-layer (multi-tree) analysis.
  "roots": ["."],

  // Or name each tree explicitly (takes precedence over "roots"):
  // "trees": [
  //   { "root": "./api", "sourceId": "api" },
  //   { "root": "./web", "sourceId": "web" }
  // ],

  "packs": {
    // Extra directories of custom DSL rule packs. These MERGE with the
    // bundled packs; a custom pack whose id matches a bundled one wins.
    "extraDirs": ["./zzop-packs"],
    // Whole packs to disable, by pack id.
    "disabled": ["browser"]
  },

  "rules": {
    // "off"                        -> disable the rule
    "no-explicit-any": "off",
    // "info" | "warn" | "critical" -> override severity
    "n-plus-one": "warn",
    // object form -> override severity AND drop findings by file path. Each
    // "exclude" entry is a plain substring, or a glob if it has * ? or {}.
    "toctou": { "severity": "warn", "exclude": ["legacy/", "**/*.gen.ts"] }
  },

  // Enables git-history-derived signals. Omit to use engine defaults.
  "git": { "recentDays": 30 },

  // Analysis cache directory (omit to disable caching).
  "cacheDir": ".zzop-cache",

  // Files larger than this many bytes skip structural parsing.
  "sizeCap": 500000,

  // "pretty" or "json"; overridden by --format / --json.
  "format": "pretty",

  // Persist reports to disk in addition to stdout. Each run writes to
  // /zzop-report./ so runs accumulate. Same as the --out flag.
  // "report": { "dir": "zzop-reports", "formats": ["json", "sarif"] },

  // Exit non-zero when any finding is at or above this severity, or "off".
  "failOn": "warn"
}