@agent-surface/cli 0.12.0 → 0.13.0

package/dist/{chunk-Q5WOLWEW.js → chunk-UGCLJ5JX.js}

@@ -1,145 +1,19 @@
-import {
-  UsageError,
-  createSurfaceRunner
-} from "./chunk-QIVOZAWX.js";
-
-// src/baseline.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { dirname, join, resolve, sep } from "path";
-import { serializeSurfaceSnapshot } from "@agent-surface/testing";
-var DEFAULT_BASELINE_DIR = ".agent-surface";
-var SCENARIO_MANIFEST_FILE = "scenarios.json";
-function baselineDirFor(configPath, configured) {
-  return resolve(dirname(configPath), configured ?? DEFAULT_BASELINE_DIR);
-}
-function baselinePath(dir, scenario) {
-  const reserved = /* @__PURE__ */ new Set(["scenarios", "coverage-allow", "unresolved-allow"]);
-  if (scenario.length === 0 || scenario === "." || scenario === ".." || scenario.includes("/") || scenario.includes("\\") || scenario.includes("\0") || reserved.has(scenario)) {
-    throw new Error(`invalid scenario name ${JSON.stringify(scenario)} \u2014 use a filename-safe name`);
-  }
-  const root = resolve(dir);
-  const path = resolve(root, `${scenario}.json`);
-  if (!path.startsWith(`${root}${sep}`)) {
-    throw new Error(`scenario ${JSON.stringify(scenario)} escapes the baseline directory`);
-  }
-  return path;
-}
-function scenarioManifestPath(dir) {
-  return join(dir, SCENARIO_MANIFEST_FILE);
-}
-function normalize(snapshot) {
-  return serializeSurfaceSnapshot(snapshot);
-}
-function readBaseline(path) {
-  if (!existsSync(path)) return void 0;
-  try {
-    return JSON.parse(readFileSync(path, "utf8"));
-  } catch (error) {
-    throw new Error(
-      `could not read baseline ${path}: ${error instanceof Error ? error.message : String(error)}`
-    );
-  }
-}
-function writeBaseline(path, value) {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(value, null, 2)}
-`, "utf8");
-}
-function readScenarioManifest(dir) {
-  const path = scenarioManifestPath(dir);
-  const value = readBaseline(path);
-  if (value === void 0) return void 0;
-  if (typeof value !== "object" || value === null || !Array.isArray(value.scenarios) || !value.scenarios.every((name) => typeof name === "string")) {
-    throw new Error(`${path} must contain { "scenarios": string[] }`);
-  }
-  return [...value.scenarios].sort();
-}
-function writeScenarioManifest(dir, scenarios) {
-  writeBaseline(scenarioManifestPath(dir), { scenarios: [...scenarios].sort() });
-}
-var PATH_SEGMENT = /([^.[\]]+)|\[(\d+)\]/g;
-function subjectFor(document, path) {
-  let node = document;
-  let subject;
-  for (const match of path.matchAll(PATH_SEGMENT)) {
-    if (typeof node !== "object" || node === null) return subject;
-    const record = node;
-    const candidate = record["capabilityId"] ?? record["procedureId"];
-    if (typeof candidate === "string") subject = candidate;
-    const key = match[1] ?? match[2];
-    if (key === void 0) return subject;
-    node = record[key];
-  }
-  if (typeof node === "object" && node !== null) {
-    const record = node;
-    const candidate = record["capabilityId"] ?? record["procedureId"];
-    if (typeof candidate === "string") subject = candidate;
-  }
-  return subject;
-}
-function annotate(entries, after, before) {
-  return entries.map((entry) => {
-    const subject = subjectFor(after, entry.path) ?? subjectFor(before, entry.path);
-    return subject ? { ...entry, subject } : entry;
-  });
-}
-function diff(before, after, path = "") {
-  if (Object.is(before, after)) return [];
-  const bothArrays = Array.isArray(before) && Array.isArray(after);
-  const bothObjects = !bothArrays && typeof before === "object" && typeof after === "object" && before !== null && after !== null;
-  if (bothArrays) {
-    const entries = [];
-    const max = Math.max(before.length, after.length);
-    for (let i = 0; i < max; i++) {
-      const at = `${path}[${i}]`;
-      if (i >= before.length) entries.push({ path: at, kind: "added", after: after[i] });
-      else if (i >= after.length) entries.push({ path: at, kind: "removed", before: before[i] });
-      else entries.push(...diff(before[i], after[i], at));
-    }
-    return entries;
-  }
-  if (bothObjects) {
-    const entries = [];
-    const beforeRecord = before;
-    const afterRecord = after;
-    const keys = /* @__PURE__ */ new Set([...Object.keys(beforeRecord), ...Object.keys(afterRecord)]);
-    for (const key of [...keys].sort()) {
-      const at = path ? `${path}.${key}` : key;
-      if (!(key in beforeRecord)) {
-        entries.push({ path: at, kind: "added", after: afterRecord[key] });
-      } else if (!(key in afterRecord)) {
-        entries.push({ path: at, kind: "removed", before: beforeRecord[key] });
-      } else {
-        entries.push(...diff(beforeRecord[key], afterRecord[key], at));
-      }
-    }
-    return entries;
-  }
-  if (JSON.stringify(before) === JSON.stringify(after)) return [];
-  return [{ path: path || "<root>", kind: "changed", before, after }];
-}
-function formatValue(value) {
-  if (value === void 0) return "\u2014";
-  const text = typeof value === "string" ? value : JSON.stringify(value);
-  return text.length > 120 ? `${text.slice(0, 117)}\u2026` : text;
-}
-
 // src/coverage.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { join as join2 } from "path";
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
 var ALLOWLIST_FILE = "coverage-allow.json";
 var UNREAD_ALLOWLIST_FILE = "unresolved-allow.json";
 function allowlistPathFor(baselineDir) {
-  return join2(baselineDir, ALLOWLIST_FILE);
+  return join(baselineDir, ALLOWLIST_FILE);
 }
 function unreadAllowlistPathFor(baselineDir) {
-  return join2(baselineDir, UNREAD_ALLOWLIST_FILE);
+  return join(baselineDir, UNREAD_ALLOWLIST_FILE);
 }
 function readAllowlist(path, keyName = "capabilityId") {
-  if (!existsSync2(path)) return {};
+  if (!existsSync(path)) return {};
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync2(path, "utf8"));
+    parsed = JSON.parse(readFileSync(path, "utf8"));
   } catch (error) {
     throw new Error(
       `could not parse ${path}: ${error instanceof Error ? error.message : String(error)}`
@@ -217,17 +91,17 @@ function coverageExitCode(report, options = {}) {
 
 // src/extract.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname2, isAbsolute, join as join3, relative, resolve as resolve2 } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { dirname, isAbsolute, join as join2, relative, resolve } from "path";
 import ts from "typescript";
 var UNRESOLVED_ID = "<unresolved>";
 function findTsconfig(from) {
-  return ts.findConfigFile(resolve2(from), ts.sys.fileExists, "tsconfig.json");
+  return ts.findConfigFile(resolve(from), ts.sys.fileExists, "tsconfig.json");
 }
 function readLiteralConfigScope(configPath) {
   const source = ts.createSourceFile(
     configPath,
-    readFileSync3(configPath, "utf8"),
+    readFileSync2(configPath, "utf8"),
     ts.ScriptTarget.Latest,
     true,
     configPath.endsWith("x") ? ts.ScriptKind.TSX : ts.ScriptKind.TS
@@ -254,7 +128,7 @@ function readProgramFiles(tsconfigPath) {
   const parsed = ts.parseJsonConfigFileContent(
     read.config,
     ts.sys,
-    dirname2(tsconfigPath)
+    dirname(tsconfigPath)
   );
   if (parsed.errors.length > 0 && parsed.fileNames.length === 0) {
     throw new Error(
@@ -668,21 +542,21 @@ function stableSite(source, node) {
 }
 var packageNameCache = /* @__PURE__ */ new Map();
 function packageNameFor(file) {
-  let dir = dirname2(file);
+  let dir = dirname(file);
   for (; ; ) {
     if (packageNameCache.has(dir)) return packageNameCache.get(dir);
-    const packagePath = join3(dir, "package.json");
-    if (existsSync3(packagePath)) {
+    const packagePath = join2(dir, "package.json");
+    if (existsSync2(packagePath)) {
       let name;
       try {
-        const parsed = JSON.parse(readFileSync3(packagePath, "utf8"));
+        const parsed = JSON.parse(readFileSync2(packagePath, "utf8"));
         if (typeof parsed.name === "string") name = parsed.name;
       } catch {
       }
       packageNameCache.set(dir, name);
       return name;
     }
-    const parent = dirname2(dir);
+    const parent = dirname(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
@@ -699,9 +573,9 @@ function isAgentSurfaceImplementation(file) {
   return IMPLEMENTATION_PACKAGES.has(packageNameFor(file) ?? "");
 }
 function extractCapabilities(options) {
-  const root = resolve2(options.root);
-  const tsconfigPath = options.tsconfig ? isAbsolute(options.tsconfig) ? options.tsconfig : join3(root, options.tsconfig) : findTsconfig(root);
-  if (!tsconfigPath || !existsSync3(tsconfigPath)) {
+  const root = resolve(options.root);
+  const tsconfigPath = options.tsconfig ? isAbsolute(options.tsconfig) ? options.tsconfig : join2(root, options.tsconfig) : findTsconfig(root);
+  if (!tsconfigPath || !existsSync2(tsconfigPath)) {
     throw new Error(
       `no tsconfig.json found from ${root} \u2014 \`capabilities\` reads the TypeScript program, so it needs one (pass --tsconfig to point at it)`
     );
@@ -832,153 +706,19 @@ function unresolved(inventory) {
   return inventory.capabilities.filter((capability) => capability.resolution === "unresolved");
 }
 
-// src/analysis.ts
-import { dirname as dirname3 } from "path";
-import { matchesScope } from "@agent-surface/core/explain";
-function readInventory(options) {
-  if (options.depth === "runtime") return void 0;
-  return extractCapabilities({
-    root: dirname3(options.configPath),
-    ...options.tsconfig ? { tsconfig: options.tsconfig } : {}
-  });
-}
-function staticConfigScope(options) {
-  return options.scope ?? readLiteralConfigScope(options.configPath);
-}
-async function mountScenarios(options, onEach) {
-  if (options.depth === "static") return void 0;
-  const runner = await createSurfaceRunner(options.configPath);
-  try {
-    if (options.scenario && !runner.scenarioNames.includes(options.scenario)) {
-      throw new UsageError(
-        `unknown scenario "${options.scenario}" \u2014 this config defines ` + runner.scenarioNames.map((name) => `"${name}"`).join(", ")
-      );
-    }
-    const scenarios = options.scenario ? [options.scenario] : runner.scenarioNames;
-    const effectiveScope = options.scope ?? runner.config.scope;
-    const results = [];
-    const failures = [];
-    for (const scenario of scenarios) {
-      let result;
-      try {
-        result = await runner.collect({
-          scenario,
-          ...options.scope ? { scope: options.scope } : {}
-        });
-      } catch (error) {
-        failures.push({
-          scenario,
-          message: error instanceof Error ? error.message : String(error)
-        });
-        continue;
-      }
-      results.push(result);
-      await onEach?.(result);
-    }
-    return {
-      scenarios,
-      declaredScenarios: runner.scenarioNames,
-      results,
-      failures,
-      baselineDir: baselineDirFor(
-        options.configPath,
-        options.baselineDir ?? runner.config.baselineDir
-      ),
-      ...effectiveScope ? { scope: effectiveScope } : {},
-      domainCapabilities: Object.keys(runner.config.manifest?.tools ?? {}).map((path) => `domain:${path}`).sort(),
-      domainManifestConfigured: runner.config.manifest !== void 0
-    };
-  } finally {
-    await runner.close();
-  }
-}
-function componentTypeOf(capabilityId) {
-  const withoutPlane = capabilityId.replace(/^(view|domain):/, "");
-  const dot = withoutPlane.lastIndexOf(".");
-  return dot === -1 ? withoutPlane : withoutPlane.slice(0, dot);
-}
-function scopeInventory(inventory, scope) {
-  if (!inventory || !scope) return inventory;
-  return {
-    ...inventory,
-    capabilities: inventory.capabilities.filter(
-      (capability) => capability.resolution === "unresolved" || matchesScope(componentTypeOf(capability.capabilityId), scope)
-    )
-  };
-}
-function scopeCapabilityIds(ids, scope) {
-  return scope ? ids.filter((id) => matchesScope(componentTypeOf(id), scope)) : ids;
-}
-function joinCoverage(inventory, runtime, options) {
-  if (!inventory || !runtime) return void 0;
-  if (runtime.failures.length > 0) return void 0;
-  const effectiveScope = options.scope ?? runtime.scope;
-  const inScope = (capabilityId) => matchesScope(componentTypeOf(capabilityId), effectiveScope);
-  const origins = /* @__PURE__ */ new Map();
-  for (const capability of inventory.capabilities) {
-    if (!origins.has(capability.capabilityId)) {
-      origins.set(capability.capabilityId, capability.origin);
-    }
-  }
-  const authored = new Set([...authoredIds(inventory)].filter(inScope));
-  for (const capabilityId of runtime.domainCapabilities) {
-    if (inScope(capabilityId)) authored.add(capabilityId);
-    if (!origins.has(capabilityId)) {
-      origins.set(capabilityId, { file: "oRPC manifest", line: 0 });
-    }
-  }
-  const reachedIds = /* @__PURE__ */ new Set();
-  for (const result of runtime.results) {
-    for (const capability of result.explanation.capabilities) {
-      reachedIds.add(capability.capabilityId);
-    }
-  }
-  const allowlistPath = allowlistPathFor(runtime.baselineDir);
-  const wholeAllowlist = readAllowlist(allowlistPath);
-  const allowlist = Object.fromEntries(
-    Object.entries(wholeAllowlist).filter(([id]) => inScope(id))
-  );
-  const unreadAllowlistPath = unreadAllowlistPathFor(runtime.baselineDir);
-  return buildCoverageReport({
-    unreadAllowlist: readAllowlist(unreadAllowlistPath, "file#reason#site"),
-    unreadAllowlistPath,
-    domainAuthoritative: runtime.domainManifestConfigured,
-    authored,
-    origins,
-    reachedIds,
-    scenarios: runtime.scenarios,
-    ...effectiveScope ? { scope: effectiveScope } : {},
-    unresolved: unresolved(inventory),
-    allowlist,
-    allowlistOutOfScope: Object.keys(wholeAllowlist).length - Object.keys(allowlist).length,
-    allowlistPath
-  });
-}
-
 export {
-  SCENARIO_MANIFEST_FILE,
-  baselinePath,
-  normalize,
-  readBaseline,
-  writeBaseline,
-  readScenarioManifest,
-  writeScenarioManifest,
-  annotate,
-  diff,
-  formatValue,
   ALLOWLIST_FILE,
   UNREAD_ALLOWLIST_FILE,
+  allowlistPathFor,
+  unreadAllowlistPathFor,
+  readAllowlist,
   unreadKey,
+  buildCoverageReport,
   coverageExitCode,
   findTsconfig,
+  readLiteralConfigScope,
   extractCapabilities,
   authoredIds,
-  unresolved,
-  readInventory,
-  staticConfigScope,
-  mountScenarios,
-  scopeInventory,
-  scopeCapabilityIds,
-  joinCoverage
+  unresolved
 };
-//# sourceMappingURL=chunk-Q5WOLWEW.js.map
+//# sourceMappingURL=chunk-UGCLJ5JX.js.map

package/dist/chunk-UGCLJ5JX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/coverage.ts","../src/extract.ts"],"sourcesContent":["/**\n * `coverage` — authored minus reached (`AS-COVER-004…005`, D36).\n *\n * The inventory says what the codebase authors; the scenarios say what a mount\n * surfaces. Neither half alone answers \"which authored capability does no\n * scenario reach\", because that is a set difference no command computed.\n */\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport type { AuthoredCapability } from \"./extract.js\";\n\nexport const ALLOWLIST_FILE = \"coverage-allow.json\";\nexport const UNREAD_ALLOWLIST_FILE = \"unresolved-allow.json\";\n\n/**\n * A committed list of unreached capabilities a repository has decided not to\n * fix yet, each with a reason. Adoption has to ratchet rather than gate: a\n * codebase turning this on with 200 unreached capabilities cannot fix them in\n * one pull request, and a check that can only be adopted big-bang is a check\n * that never gets adopted.\n */\nexport type CoverageAllowlist = Record<string, string>;\n\nexport function allowlistPathFor(baselineDir: string): string {\n  return join(baselineDir, ALLOWLIST_FILE);\n}\n\nexport function unreadAllowlistPathFor(baselineDir: string): string {\n  return join(baselineDir, UNREAD_ALLOWLIST_FILE);\n}\n\nexport function readAllowlist(path: string, keyName = \"capabilityId\"): CoverageAllowlist {\n  if (!existsSync(path)) return {};\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(readFileSync(path, \"utf8\"));\n  } catch (error) {\n    throw new Error(\n      `could not parse ${path}: ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n  if (typeof parsed !== \"object\" || parsed === null || Array.isArray(parsed)) {\n    throw new Error(`${path} must be a JSON object of { \"${keyName}\": \"reason\" }`);\n  }\n  const allowlist: CoverageAllowlist = {};\n  for (const [id, reason] of Object.entries(parsed as Record<string, unknown>)) {\n    if (typeof reason !== \"string\" || reason.trim() === \"\") {\n      throw new Error(`${path}: \"${id}\" needs a non-empty reason string`);\n    }\n    allowlist[id] = reason;\n  }\n  return allowlist;\n}\n\n/**\n * The key an unread call site is allowlisted under: `file#reason#site`.\n *\n * Neither half alone works. The line number churns on every edit above the call\n * site, so a ratchet keyed on it fails for a reason that has nothing to do with\n * the surface. The `note` is prose written for a human and gets reworded — the\n * spread note changed in the release that introduced it — so a key built from it\n * would invalidate committed entries on an edit nobody thought was behavioural.\n *\n * The site fingerprint is built from the call's own text and the named\n * enclosures around it, and from nothing positional — so an edit above it, or\n * beside it, or a reformat, leaves a committed entry matching, while a second\n * site in the same file receives its own key. See `stableSite`.\n */\nexport function unreadKey(entry: AuthoredCapability): string {\n  return `${entry.origin.file}#${entry.reason ?? \"unknown\"}#${entry.origin.site}`;\n}\n\nexport interface UnreachedCapability {\n  capabilityId: string;\n  origin: { file: string; line: number };\n}\n\nexport interface CoverageReport {\n  /** Distinct capability ids the inventory resolved, within any active scope. */\n  authored: number;\n  /** How many of them at least one scenario surfaced. */\n  reached: number;\n  scenarios: string[];\n  /**\n   * The scope every number here was computed under (`AS-CLI-007`). A scope\n   * filters the catalog *and* the mount, so `10 authored` without it on screen\n   * reads as a claim about the whole codebase when it is a claim about one\n   * prefix of it.\n   */\n  scope?: string[];\n  /**\n   * Allowlist entries outside the active scope, which a scoped run cannot\n   * judge: not unreached (nothing looked), not stale (nothing reached them).\n   * Counted rather than silently dropped, so a scoped run never reads as a\n   * verdict on the whole allowlist.\n   */\n  allowlistOutOfScope: number;\n  /** Authored, surfaced by no scenario, and not allowlisted — the finding. */\n  unreached: UnreachedCapability[];\n  /**\n   * Present at runtime with no static origin: a dynamic registration, or a gap\n   * in the extractor. `view:` only — see `domainReached`.\n   */\n  undeclared: string[];\n  /**\n   * `domain:` capabilities a scenario surfaced. Held apart from `undeclared`\n   * because the inventory never claimed to analyze that plane: filing them as\n   * \"no static origin\" would report the design's own stated boundary as a\n   * defect, which is the misleading check this whole command rejects.\n   */\n  domainReached: string[];\n  /** Runtime domain entries absent from an explicitly configured manifest. */\n  unmanifestedDomain: string[];\n  domainAuthoritative: boolean;\n  /** Carried forward from the inventory, minus anything allowlisted. */\n  unresolved: AuthoredCapability[];\n  /** Unreached, but listed in the allowlist. */\n  allowed: string[];\n  /** Listed in the allowlist and reached anyway — the list has rotted. */\n  staleAllowlist: string[];\n  allowlistPath: string;\n  /** Unread, but listed in `unresolved-allow.json`. Keys, not entries. */\n  allowedUnread: string[];\n  /** Listed there and no longer unread — that list has rotted too. */\n  staleUnreadAllowlist: string[];\n  unreadAllowlistPath: string;\n}\n\nexport interface BuildCoverageInput {\n  authored: Set<string>;\n  /** First origin seen for each authored id, for the report. */\n  origins: Map<string, { file: string; line: number }>;\n  /**\n   * Every capability id any scenario's *explanation* held.\n   *\n   * The explanation, not the snapshot. A capability a policy hid **was**\n   * reached: a scenario mounted it and the policy made a deliberate decision\n   * about it. Classifying those as unreached would flood the report with the\n   * library's own correct behaviour — in the example app the `anonymous`\n   * scenario alone would contribute eleven false gaps.\n   */\n  reachedIds: Set<string>;\n  scenarios: string[];\n  scope?: string[];\n  unresolved: AuthoredCapability[];\n  /**\n   * Already filtered to the active scope by the caller, which owns the scope\n   * predicate. Entries outside it are counted in `allowlistOutOfScope`.\n   */\n  allowlist: CoverageAllowlist;\n  allowlistOutOfScope?: number;\n  allowlistPath: string;\n  /** Keyed by `unreadKey()`. Absent is an empty list, not \"accept everything\". */\n  unreadAllowlist?: CoverageAllowlist;\n  unreadAllowlistPath: string;\n  domainAuthoritative?: boolean;\n}\n\nexport function buildCoverageReport(input: BuildCoverageInput): CoverageReport {\n  const unreached: UnreachedCapability[] = [];\n  const allowed: string[] = [];\n\n  for (const id of [...input.authored].sort()) {\n    if (input.reachedIds.has(id)) continue;\n    if (id in input.allowlist) {\n      allowed.push(id);\n      continue;\n    }\n    unreached.push({ capabilityId: id, origin: input.origins.get(id) ?? { file: \"?\", line: 0 } });\n  }\n\n  // An allowlist entry that is no longer unreached fails the command, so the\n  // list shrinks and cannot silently rot — the same idiom as the baselines\n  // `check` already commits.\n  const staleAllowlist = Object.keys(input.allowlist)\n    .filter((id) => input.reachedIds.has(id) || !input.authored.has(id))\n    .sort();\n\n  // The same ratchet, one bucket over. An unread call site a repository has\n  // decided to live with — a shared wrapper hook, say — stops failing `check`\n  // without turning the whole bucket off, and an entry that stops being unread\n  // fails so the list shrinks.\n  const unreadAllowlist = input.unreadAllowlist ?? {};\n  const unread: AuthoredCapability[] = [];\n  const allowedUnread = new Set<string>();\n  for (const entry of input.unresolved) {\n    const key = unreadKey(entry);\n    if (key in unreadAllowlist) allowedUnread.add(key);\n    else unread.push(entry);\n  }\n  const stillUnread = new Set(input.unresolved.map(unreadKey));\n  const staleUnreadAllowlist = Object.keys(unreadAllowlist)\n    .filter((key) => !stillUnread.has(key))\n    .sort();\n\n  const unaccounted = [...input.reachedIds].filter((id) => !input.authored.has(id)).sort();\n  const domainReached = [...input.reachedIds].filter((id) => id.startsWith(\"domain:\")).sort();\n  const unmanifestedDomain = input.domainAuthoritative\n    ? unaccounted.filter((id) => id.startsWith(\"domain:\"))\n    : [];\n  const undeclared = unaccounted.filter((id) => !id.startsWith(\"domain:\"));\n\n  return {\n    authored: input.authored.size,\n    reached: [...input.authored].filter((id) => input.reachedIds.has(id)).length,\n    scenarios: input.scenarios,\n    ...(input.scope ? { scope: input.scope } : {}),\n    allowlistOutOfScope: input.allowlistOutOfScope ?? 0,\n    unreached,\n    undeclared,\n    domainReached,\n    unmanifestedDomain,\n    domainAuthoritative: input.domainAuthoritative === true,\n    unresolved: unread,\n    allowed,\n    staleAllowlist,\n    allowlistPath: input.allowlistPath,\n    allowedUnread: [...allowedUnread].sort(),\n    staleUnreadAllowlist,\n    unreadAllowlistPath: input.unreadAllowlistPath,\n  };\n}\n\n/**\n * `0` clean, `1` a gap.\n *\n * `undeclared` deliberately does not fail (OQ-4): a dynamically registered\n * capability is legitimate, and from the outside it is indistinguishable from\n * an extractor that missed something. Failing on it would punish the honest\n * case to catch the other one. It is reported, loudly, and revisited when a\n * codebase does it deliberately.\n *\n * `unresolved` does fail, and `--allow-unresolved` is the only way past it\n * (`AS-COVER-003`). A partial understanding of a codebase that reports itself\n * as complete is the failure the whole static half exists to remove: `unreached`\n * is computed against the catalog, so a catalog with holes in it makes that\n * count a floor rather than an answer. Accepting the gap still prints it.\n */\nexport function coverageExitCode(\n  report: CoverageReport,\n  options: { allowUnresolved?: boolean } = {},\n): number {\n  if (report.unreached.length > 0) return 1;\n  if (report.unmanifestedDomain.length > 0) return 1;\n  // `report.unresolved` already excludes allowlisted entries, so the per-entry\n  // ratchet and the blanket flag compose: the list holds the sites you have\n  // accepted, and the flag is still there for a codebase not ready to enumerate\n  // them. Both stale lists fail regardless of either — a ratchet that can rot\n  // is a ratchet that stops meaning anything.\n  if (report.unresolved.length > 0 && !options.allowUnresolved) return 1;\n  if (report.staleAllowlist.length > 0) return 1;\n  if (report.staleUnreadAllowlist.length > 0) return 1;\n  return 0;\n}\n","/**\n * The static capability inventory (`AS-COVER-001…003`, D35).\n *\n * `inspect` answers *what can an agent do on this page right now*. It cannot\n * answer *did we author something no scenario ever reaches*, because a surface\n * is a projection of what is mounted: a route no scenario visits registers\n * nothing, so there is nothing to report and nothing to diff. The denominator\n * has to come from somewhere that does not require mounting.\n *\n * It comes from here. A registration call site is far more static than the\n * surface it produces:\n *\n * ```tsx\n * useAgentComponent({\n *   type: \"devices.table\",                       // string literal\n *   actions: { sort: action({ … }) },            // capability name is a key\n * });\n * ```\n *\n * `view:devices.table.sort` is fully determined by source text. What is\n * genuinely dynamic — availability, policy outcome, binding — is the\n * *projection*, and none of it is claimed here.\n *\n * ## This creates no exposure path (directive §2.1)\n *\n * No DOM is scanned, nothing is registered, no annotation is suggested. This\n * module *reads the same reviewed registration code* a human reads and counts\n * what is already there. It lives in `@agent-surface/cli` — which no adapter\n * imports and no application ships — and must never be re-exported from\n * `@agent-surface/core`, mirroring `AS-EXPLAIN-004` (`AS-COVER-006`).\n *\n * ## Failure discipline is the substance, not a detail\n *\n * > Better a missing check than a misleading check.\n *\n * A call site this module cannot understand is **reported with its file and\n * line**, never dropped. An inventory that silently omitted the constructs it\n * failed to parse would understate the denominator, and a coverage number built\n * on it would claim completeness it never had.\n */\nimport { createHash } from \"node:crypto\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { dirname, isAbsolute, join, relative, resolve } from \"node:path\";\nimport ts from \"typescript\";\n\n/** Identity could not be recovered from the call site at all. */\nexport const UNRESOLVED_ID = \"<unresolved>\";\n\nexport interface AuthoredCapability {\n  /** Canonical id, instance-independent: `view:devices.table.sort`. */\n  capabilityId: string;\n  kind: \"observation\" | \"action\" | \"procedure\";\n  /** Where a human can go and read it. */\n  origin: { file: string; line: number; site: string };\n  /** Literals recovered from the call site; absent when not statically known. */\n  description?: string;\n  effect?: string;\n  /**\n   * How much of this call site the extractor understood.\n   *\n   * `static` — identity and metadata both recovered from literals.\n   * `partial` — identity resolved, some metadata dynamic. The common case: a\n   *   spread `instanceId`, or a description built from a template.\n   * `unresolved` — identity NOT resolved. Reported, never dropped.\n   */\n  resolution: \"static\" | \"partial\" | \"unresolved\";\n  /** Present on `partial`/`unresolved`: what defeated the extractor. */\n  note?: string;\n  /**\n   * Present on `unresolved`: *which* construct defeated the extractor, as a\n   * stable code rather than prose.\n   *\n   * `note` is written for a human and gets reworded — the spread note changed\n   * in the same release that introduced it. Anything keyed on that prose would\n   * silently invalidate itself on an edit no one thought was behavioural, which\n   * is exactly what `unresolved-allow.json` must not do. This is the key.\n   */\n  reason?: UnreadReason;\n}\n\n/**\n * Why a registration could not be fully read. Stable identifiers: adding one is\n * fine, renaming one invalidates committed allowlists and is a breaking change.\n */\nexport type UnreadReason =\n  | \"dynamic-type\"\n  | \"dynamic-config\"\n  | \"dynamic-group\"\n  | \"dynamic-callee\"\n  | \"spread-members\"\n  | \"computed-name\"\n  | \"granular-hook\";\n\nexport interface CapabilityInventory {\n  capabilities: AuthoredCapability[];\n  /** Absolute path to the tsconfig whose file list was analyzed. */\n  tsconfig: string;\n  /** Directory the analysis was rooted at — the surface config's own. */\n  root: string;\n  /** Files the program actually walked — the inventory's blast radius. */\n  filesAnalyzed: number;\n  /**\n   * Agent-surface implementation files excluded outside `root`. First-party\n   * workspace sources are analyzed; the implementation behind the authored\n   * hooks is not a second app registration.\n   */\n  filesOutsideRoot: number;\n  /**\n   * The `domain:` plane is deliberately *not* analyzed here. Those capabilities\n   * come from the oRPC router, which is already a static export (OQ-1), and\n   * reporting zero of them would read as \"there are none\" rather than \"nobody\n   * looked\".\n   */\n  domain: \"not-analyzed\";\n}\n\n/* ── locating the program ─────────────────────────────────────────────── */\n\nexport function findTsconfig(from: string): string | undefined {\n  return ts.findConfigFile(resolve(from), ts.sys.fileExists, \"tsconfig.json\");\n}\n\n/** Reads a literal config `scope: [\"...\"]` without executing or mounting it. */\nexport function readLiteralConfigScope(configPath: string): string[] | undefined {\n  const source = ts.createSourceFile(\n    configPath,\n    readFileSync(configPath, \"utf8\"),\n    ts.ScriptTarget.Latest,\n    true,\n    configPath.endsWith(\"x\") ? ts.ScriptKind.TSX : ts.ScriptKind.TS,\n  );\n  let scope: string[] | undefined;\n  const visit = (node: ts.Node): void => {\n    if (scope) return;\n    if (\n      ts.isPropertyAssignment(node) &&\n      propertyName(node.name) === \"scope\" &&\n      ts.isArrayLiteralExpression(node.initializer)\n    ) {\n      const values = node.initializer.elements.map((entry) => literalText(entry));\n      if (values.every((value): value is string => value !== undefined)) scope = values;\n    }\n    ts.forEachChild(node, visit);\n  };\n  visit(source);\n  return scope;\n}\n\ninterface ProgramFiles {\n  fileNames: string[];\n  options: ts.CompilerOptions;\n}\n\nfunction readProgramFiles(tsconfigPath: string): ProgramFiles {\n  const read = ts.readConfigFile(tsconfigPath, ts.sys.readFile);\n  if (read.error) {\n    throw new Error(\n      `could not read ${tsconfigPath}: ${ts.flattenDiagnosticMessageText(read.error.messageText, \" \")}`,\n    );\n  }\n  const parsed = ts.parseJsonConfigFileContent(\n    read.config as object,\n    ts.sys,\n    dirname(tsconfigPath),\n  );\n  if (parsed.errors.length > 0 && parsed.fileNames.length === 0) {\n    throw new Error(\n      `could not resolve any files from ${tsconfigPath}: ${parsed.errors\n        .map((error) => ts.flattenDiagnosticMessageText(error.messageText, \" \"))\n        .join(\"; \")}`,\n    );\n  }\n  return { fileNames: parsed.fileNames, options: parsed.options };\n}\n\n/* ── which local name is a registration API ───────────────────────────── */\n\n/**\n * The hooks a registration is written with, under the names *this library\n * exports them as* — not the names a codebase happens to call them by.\n *\n * `register` is deliberately absent. It is a method on a registry instance\n * rather than an import, so there is no binding to read; it stays matched by\n * name, with the extra `type` check `visitCall` already applies to it.\n */\nconst REGISTRATION_HOOKS = new Set([\"useAgentComponent\", \"useAgentAction\", \"useAgentObservation\"]);\n\n/** `@agent-surface/react`, `@agent-surface/core`, and any subpath of either. */\nfunction isRegistrationModule(specifier: string): boolean {\n  return specifier.startsWith(\"@agent-surface/\");\n}\n\n/**\n * What a file's own import declarations say about which local names are ours.\n *\n * A registration is identified by *what was imported*, not by what this file\n * calls it. Matching the local identifier alone lost a whole registration to a\n * rename:\n *\n * ```tsx\n * import { useAgentComponent as useAC } from \"@agent-surface/react\";\n * useAC({ type: \"alias.panel\", … });\n * ```\n *\n * — no capability in the catalog, and no unread call site saying the catalog\n * was short. Every other gap in this module *reports*: a dynamic `type`, an\n * unreadable spread, a granular hook, a wrapper it cannot prove. This one was\n * silent, and a silent gap is the only kind that makes a coverage number lie.\n */\ninterface ImportedApi {\n  /** Local name → the registration hook it is bound to. */\n  locals: Map<string, string>;\n  /** Locals bound to a whole module of ours by `import * as ns`. */\n  namespaces: Set<string>;\n}\n\nconst NO_IMPORTS: ImportedApi = { locals: new Map(), namespaces: new Set() };\n\nfunction importedRegistrations(source: ts.SourceFile): ImportedApi {\n  const locals = new Map<string, string>();\n  const namespaces = new Set<string>();\n\n  for (const statement of source.statements) {\n    if (!ts.isImportDeclaration(statement)) continue;\n    if (!ts.isStringLiteral(statement.moduleSpecifier)) continue;\n    if (!isRegistrationModule(statement.moduleSpecifier.text)) continue;\n\n    // `import type { … }` binds no value, so it can call nothing. A default\n    // import binds nothing of ours either: none of these packages has one.\n    const clause = statement.importClause;\n    if (!clause || clause.isTypeOnly || !clause.namedBindings) continue;\n\n    if (ts.isNamespaceImport(clause.namedBindings)) {\n      namespaces.add(clause.namedBindings.name.text);\n      continue;\n    }\n    for (const element of clause.namedBindings.elements) {\n      if (element.isTypeOnly) continue;\n      const imported = (element.propertyName ?? element.name).text;\n      if (REGISTRATION_HOOKS.has(imported)) locals.set(element.name.text, imported);\n    }\n  }\n  return { locals, namespaces };\n}\n\n/**\n * Registration hooks this file re-exports under a name that is not their own.\n *\n * ```ts\n * export { useAgentComponent as useAC } from \"@agent-surface/react\";\n * ```\n *\n * Downstream every call site is spelled `useAC` and imported from a module that\n * is not ours, so nothing there proves it registers anything — and following\n * the chain to find out is the hop `callsWrapper` already refuses to take, for\n * the same reason: a wrong attribution fabricates catalog entries.\n *\n * So the gap is reported *here*, on the line that opens it, rather than left\n * unsaid at each of the call sites it hides. Re-exported under its own name it\n * needs no report at all — downstream then reads a name this module knows.\n */\nfunction renamedRegistrationExports(\n  source: ts.SourceFile,\n  imports: ImportedApi,\n): { node: ts.Node; hook: string; exported: string }[] {\n  const renamed: { node: ts.Node; hook: string; exported: string }[] = [];\n\n  for (const statement of source.statements) {\n    if (!ts.isExportDeclaration(statement) || statement.isTypeOnly) continue;\n    const clause = statement.exportClause;\n    if (!clause || !ts.isNamedExports(clause)) continue;\n\n    const from = statement.moduleSpecifier;\n    // `export … from` some other module says nothing about our API; the local\n    // form is read against what this file imported.\n    const fromOurs =\n      from !== undefined && ts.isStringLiteral(from) && isRegistrationModule(from.text);\n    if (from && !fromOurs) continue;\n\n    for (const element of clause.elements) {\n      if (element.isTypeOnly) continue;\n      const local = (element.propertyName ?? element.name).text;\n      const hook = fromOurs\n        ? REGISTRATION_HOOKS.has(local)\n          ? local\n          : undefined\n        : imports.locals.get(local);\n      // Renaming *back* to the hook's own name closes the gap rather than\n      // opening one, so the comparison is against the export, not the local.\n      if (hook === undefined || element.name.text === hook) continue;\n      renamed.push({ node: element, hook, exported: element.name.text });\n    }\n  }\n  return renamed;\n}\n\n/* ── small AST helpers ────────────────────────────────────────────────── */\n\n/** Whether `object.member` reads a registration hook off a namespace of ours. */\nfunction namespaceMember(object: ts.Expression, member: string, imports: ImportedApi): boolean {\n  return (\n    ts.isIdentifier(object) && imports.namespaces.has(object.text) && REGISTRATION_HOOKS.has(member)\n  );\n}\n\nfunction calleeName(call: ts.CallExpression, imports: ImportedApi = NO_IMPORTS): string | undefined {\n  const callee = call.expression;\n\n  // An alias is the same API under another name, and the binding says which.\n  if (ts.isIdentifier(callee)) return imports.locals.get(callee.text) ?? callee.text;\n\n  if (ts.isPropertyAccessExpression(callee)) {\n    // `AS.useAgentComponent()`: the namespace binding is what *proves* this one\n    // is ours. It resolved before this existed, but only because the property\n    // name happened to be spelled like the hook — a coincidence that would have\n    // attributed `anything.useAgentComponent()` just as readily.\n    if (namespaceMember(callee.expression, callee.name.text, imports)) return callee.name.text;\n    // Otherwise the plain name, which is what reads `registry.register(…)`.\n    // Narrowing this to proven bindings would *drop* registrations that resolve\n    // today — a re-export under its own name, most of all — and a silent loss\n    // is the failure this whole change exists to remove.\n    return callee.name.text;\n  }\n\n  // `AS[\"useAgentComponent\"]()` is as readable as the dotted form.\n  if (ts.isElementAccessExpression(callee)) {\n    const member = literalText(callee.argumentExpression);\n    if (member !== undefined && namespaceMember(callee.expression, member, imports)) return member;\n  }\n  return undefined;\n}\n\nfunction propertyName(name: ts.PropertyName): string | undefined {\n  if (ts.isIdentifier(name) || ts.isStringLiteral(name)) return name.text;\n  return undefined;\n}\n\nfunction propertyOf(\n  object: ts.ObjectLiteralExpression,\n  wanted: string,\n): ts.Expression | undefined {\n  for (const property of object.properties) {\n    if (ts.isPropertyAssignment(property) && propertyName(property.name) === wanted) {\n      return property.initializer;\n    }\n    // `{ type }` is `{ type: type }`, and the shorthand is what a wrapper hook\n    // forwarding a parameter actually writes. Reading only the long form made\n    // every such config look like it had no `type` at all.\n    if (ts.isShorthandPropertyAssignment(property) && property.name.text === wanted) {\n      return property.name;\n    }\n  }\n  return undefined;\n}\n\nfunction hasSpread(object: ts.ObjectLiteralExpression): boolean {\n  return object.properties.some((property) => ts.isSpreadAssignment(property));\n}\n\n/** The capability groups a spread would have to contribute to matter here. */\nconst CAPABILITY_GROUPS = [\"observations\", \"actions\"] as const;\n\n/**\n * Every key a spread could contribute, or `undefined` when that is not knowable.\n *\n * This exists to separate two spreads that look alike and are not:\n *\n * ```tsx\n * ...(props.instance ? { instanceId: props.instance } : {})   // keys: instanceId\n * ...buildMembers()                                            // keys: unknown\n * ```\n *\n * The first cannot contribute a capability, because its key set is written out\n * and `instanceId` is not part of a capability id. The second could contribute\n * any number of them. Reporting both would flood the documented common case;\n * reporting neither is what let a whole registration disappear.\n *\n * Resolution is deliberately shallow, matching `objectLiteralFor`'s one hop: a\n * literal, a conditional over two knowable branches, or a same-module `const`.\n * Anything else is unknown, and unknown is reported rather than assumed empty.\n */\nfunction spreadKeys(\n  expression: ts.Expression,\n  source: ts.SourceFile,\n  depth = 0,\n): string[] | undefined {\n  if (depth > 1) return undefined;\n\n  if (ts.isParenthesizedExpression(expression)) {\n    return spreadKeys(expression.expression, source, depth);\n  }\n\n  // `cond ? { a } : {}` contributes whichever branch runs, so the key set is\n  // the union — knowable only if both branches are.\n  if (ts.isConditionalExpression(expression)) {\n    const whenTrue = spreadKeys(expression.whenTrue, source, depth);\n    const whenFalse = spreadKeys(expression.whenFalse, source, depth);\n    if (!whenTrue || !whenFalse) return undefined;\n    return [...whenTrue, ...whenFalse];\n  }\n\n  const resolved = objectLiteralFor(expression, source);\n  if (!resolved.object) return undefined;\n\n  const keys: string[] = [];\n  for (const property of resolved.object.properties) {\n    // A spread inside a spread: recurse while the hop budget allows, then admit\n    // defeat rather than reporting a partial key set as a complete one.\n    if (ts.isSpreadAssignment(property)) {\n      const nested = spreadKeys(property.expression, source, depth + 1);\n      if (!nested) return undefined;\n      keys.push(...nested);\n      continue;\n    }\n    const name =\n      ts.isPropertyAssignment(property) || ts.isMethodDeclaration(property)\n        ? propertyName(property.name)\n        : ts.isShorthandPropertyAssignment(property)\n          ? property.name.text\n          : undefined;\n    // A computed key could be anything, including a capability group.\n    if (name === undefined) return undefined;\n    keys.push(name);\n  }\n  return keys;\n}\n\nfunction literalText(node: ts.Expression | undefined): string | undefined {\n  if (!node) return undefined;\n  if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) return node.text;\n  if (ts.isParenthesizedExpression(node)) return literalText(node.expression);\n  // `\"one long \" + \"description split over two lines\"` is as statically known\n  // as either half. Descriptions are the provider's cached prompt prefix (D28),\n  // so they are long enough that authors wrap them — calling that `partial`\n  // would report the codebase's most common formatting choice as a defect.\n  if (ts.isBinaryExpression(node) && node.operatorToken.kind === ts.SyntaxKind.PlusToken) {\n    const left = literalText(node.left);\n    const right = literalText(node.right);\n    if (left !== undefined && right !== undefined) return left + right;\n  }\n  return undefined;\n}\n\n/** A short name for whatever construct defeated us, for the `note`. */\nfunction describeConstruct(node: ts.Expression): string {\n  if (ts.isCallExpression(node)) {\n    const callee = calleeName(node);\n    return callee ? `built by ${callee}()` : \"built by a call expression\";\n  }\n  if (ts.isIdentifier(node)) return `a variable (${node.text}) this extractor could not follow`;\n  if (ts.isConditionalExpression(node)) return \"a conditional expression\";\n  if (ts.isTemplateExpression(node)) return \"a template with substitutions\";\n  if (ts.isPropertyAccessExpression(node)) return \"a property access\";\n  return \"a non-literal expression\";\n}\n\n/**\n * Resolves a config argument to an object literal, following **one hop** to a\n * same-module `const`.\n *\n * One hop is the whole rule. `useAgentComponent(CONFIG)` where `CONFIG` is a\n * module constant is common and cheap; `useAgentComponent(buildConfig(props))`\n * is not resolvable at any depth worth implementing. Stopping at one hop keeps\n * the limit *visible in the output* rather than buried in the implementation —\n * the deeper case is reported as `unresolved` with the construct named, which\n * is the behaviour this module exists to guarantee.\n */\nfunction objectLiteralFor(\n  expression: ts.Expression,\n  source: ts.SourceFile,\n): { object?: ts.ObjectLiteralExpression; note?: string } {\n  if (ts.isObjectLiteralExpression(expression)) return { object: expression };\n\n  if (ts.isIdentifier(expression)) {\n    const target = expression.text;\n    let found: ts.ObjectLiteralExpression | undefined;\n    const visit = (node: ts.Node): void => {\n      if (found) return;\n      if (\n        ts.isVariableDeclaration(node) &&\n        ts.isIdentifier(node.name) &&\n        node.name.text === target &&\n        node.initializer &&\n        ts.isObjectLiteralExpression(node.initializer)\n      ) {\n        found = node.initializer;\n        return;\n      }\n      ts.forEachChild(node, visit);\n    };\n    visit(source);\n    if (found) return { object: found };\n    return {\n      note: `the config is \\`${target}\\`, which is not a same-module object literal — the extractor follows one hop only`,\n    };\n  }\n\n  return { note: `the config is ${describeConstruct(expression)}` };\n}\n\n/* ── the extraction itself ────────────────────────────────────────────── */\n\n/** Hooks that register one capability against the enclosing render scope. */\nconst GRANULAR_HOOKS = new Set([\"useAgentAction\", \"useAgentObservation\"]);\n\ninterface Emitter {\n  push(capability: AuthoredCapability): void;\n  origin(node: ts.Node): { file: string; line: number; site: string };\n}\n\nfunction capabilitiesFromGroup(\n  group: ts.Expression | undefined,\n  kind: \"observation\" | \"action\",\n  componentType: string,\n  componentPartial: string | undefined,\n  emit: Emitter,\n  source: ts.SourceFile,\n): void {\n  if (!group) return;\n\n  const resolved = objectLiteralFor(group, source);\n  if (!resolved.object) {\n    emit.push({\n      capabilityId: `view:${componentType}.${UNRESOLVED_ID}`,\n      kind,\n      origin: emit.origin(group),\n      resolution: \"unresolved\",\n      reason: \"dynamic-group\",\n      note: `\\`${kind}s\\` on \"${componentType}\" is not an object literal: ${resolved.note}`,\n    });\n    return;\n  }\n\n  for (const property of resolved.object.properties) {\n    // A spread inside the capability map can add capabilities this extractor\n    // cannot name. That is an identity gap, not a metadata gap.\n    if (ts.isSpreadAssignment(property)) {\n      emit.push({\n        capabilityId: `view:${componentType}.${UNRESOLVED_ID}`,\n        kind,\n        origin: emit.origin(property),\n        resolution: \"unresolved\",\n        reason: \"spread-members\",\n      note: `\\`${kind}s\\` on \"${componentType}\" spreads another object, which may contribute capabilities this inventory cannot name`,\n      });\n      continue;\n    }\n\n    const name =\n      ts.isPropertyAssignment(property) || ts.isMethodDeclaration(property)\n        ? propertyName(property.name)\n        : ts.isShorthandPropertyAssignment(property)\n          ? property.name.text\n          : undefined;\n\n    if (name === undefined) {\n      emit.push({\n        capabilityId: `view:${componentType}.${UNRESOLVED_ID}`,\n        kind,\n        origin: emit.origin(property),\n        resolution: \"unresolved\",\n        reason: \"computed-name\",\n      note: `a capability on \"${componentType}\" has a computed name`,\n      });\n      continue;\n    }\n\n    // Identity is recovered from the key alone; the value only carries metadata.\n    const capability: AuthoredCapability = {\n      capabilityId: `view:${componentType}.${name}`,\n      kind,\n      origin: emit.origin(property),\n      resolution: \"static\",\n    };\n    const notes: string[] = [];\n    if (componentPartial) notes.push(componentPartial);\n\n    const value = ts.isPropertyAssignment(property) ? property.initializer : undefined;\n    const definition =\n      value && ts.isCallExpression(value) && value.arguments.length > 0\n        ? value.arguments[0]\n        : value;\n\n    if (definition && ts.isObjectLiteralExpression(definition)) {\n      const description = literalText(propertyOf(definition, \"description\"));\n      if (description !== undefined) capability.description = description;\n      else notes.push(\"description is not a string literal\");\n\n      if (kind === \"action\") {\n        const effect = literalText(propertyOf(definition, \"effect\"));\n        if (effect !== undefined) capability.effect = effect;\n        else notes.push(\"effect is not a string literal\");\n      }\n      if (hasSpread(definition)) notes.push(\"the definition spreads another object\");\n    } else {\n      notes.push(\n        value\n          ? `the definition is ${describeConstruct(value)}`\n          : \"the definition is not an object literal\",\n      );\n    }\n\n    if (notes.length > 0) {\n      capability.resolution = \"partial\";\n      capability.note = notes.join(\"; \");\n    }\n    emit.push(capability);\n  }\n}\n\nfunction visitCall(\n  call: ts.CallExpression,\n  emit: Emitter,\n  source: ts.SourceFile,\n  imports: ImportedApi,\n  deferred: DeferredWrapper[],\n  enclosing: EnclosingFunction | undefined,\n): void {\n  const callee = calleeName(call, imports);\n  if (callee === undefined) {\n    // The callee is not a name at all. Where it reads a computed member of a\n    // namespace of ours, that much *is* known: a call into the registration API\n    // whose export cannot be named, and so whose registration — if it is one —\n    // is nowhere in this catalog. Anywhere else it is simply not our call.\n    const object = ts.isElementAccessExpression(call.expression)\n      ? call.expression.expression\n      : undefined;\n    if (object && ts.isIdentifier(object) && imports.namespaces.has(object.text)) {\n      emit.push({\n        capabilityId: UNRESOLVED_ID,\n        kind: \"action\",\n        origin: emit.origin(call),\n        resolution: \"unresolved\",\n        reason: \"dynamic-callee\",\n        note: `a call reads a computed member of \\`${object.text}\\`, a namespace of this library — which export it calls, and so whether it registers anything, cannot be read here`,\n      });\n    }\n    return;\n  }\n\n  if (GRANULAR_HOOKS.has(callee)) {\n    // OQ-3: the granular hooks register through a render-scope link rather than\n    // one aggregated descriptor, so the component `type` is not at this call\n    // site at all. Reporting the call site as unresolved is the honest state\n    // until that join key is settled — silently ignoring it would make a\n    // codebase that uses them look fully covered.\n    emit.push({\n      capabilityId: UNRESOLVED_ID,\n      kind: callee === \"useAgentAction\" ? \"action\" : \"observation\",\n      origin: emit.origin(call),\n      resolution: \"unresolved\",\n      reason: \"granular-hook\",\n      note: `${callee}() registers against a render-scope link, so its component type is not at this call site`,\n    });\n    return;\n  }\n\n  if (callee !== \"useAgentComponent\" && callee !== \"register\") return;\n  const argument = call.arguments[0];\n  if (!argument) return;\n\n  const resolved = objectLiteralFor(argument, source);\n  if (!resolved.object) {\n    emit.push({\n      capabilityId: UNRESOLVED_ID,\n      kind: \"action\",\n      origin: emit.origin(call),\n      resolution: \"unresolved\",\n      reason: \"dynamic-config\",\n      note: `${callee}() call site could not be read: ${resolved.note}`,\n    });\n    return;\n  }\n\n  const config = resolved.object;\n  const typeNode = propertyOf(config, \"type\");\n  const type = literalText(typeNode);\n  if (type === undefined) {\n    // `register` is a common method name; only treat it as ours once the call\n    // actually looks like a registration. A `type` that exists but is dynamic\n    // *is* ours, and is a genuine finding.\n    if (callee === \"register\" && typeNode === undefined) return;\n\n    // A `type` that is a parameter of the enclosing function is not dynamic —\n    // it is decided one frame up, at the wrapper's call sites, and those are\n    // string literals often enough to be worth following (OQ-13). Defer it;\n    // the second pass either resolves it or reports it unread as before.\n    const slot =\n      enclosing && typeNode && ts.isIdentifier(typeNode)\n        ? parameterSlot(typeNode.text, enclosing.fn)\n        : undefined;\n    if (slot && enclosing?.name) {\n      deferred.push({ config, source, emit, wrapperName: enclosing.name, slot, site: call });\n      return;\n    }\n\n    emit.push({\n      capabilityId: UNRESOLVED_ID,\n      kind: \"action\",\n      origin: emit.origin(call),\n      resolution: \"unresolved\",\n      reason: \"dynamic-type\",\n      note: `\\`type\\` is not a string literal, so no capability id on this component can be determined`,\n    });\n    return;\n  }\n\n  // A spread at the component level is the documented common case — the\n  // conditional `...(props.instance ? { instanceId } : {})`. `instanceId` is not\n  // part of a capability id, so identity survives; metadata may not.\n  const componentPartial = hasSpread(config)\n    ? \"the component config spreads another object, so some metadata here may be dynamic\"\n    : undefined;\n\n  // A spread whose key set cannot be read may carry `observations` or `actions`,\n  // and those capabilities are then nowhere in this program's reach. Left\n  // unreported, the registration disappears from *both* lists: absent from the\n  // catalog, and absent from the unread call sites that exist to say the catalog\n  // is incomplete. The count then claims a completeness it does not have, which\n  // is the one failure this whole module is built to prevent.\n  //\n  // Enumerating the literal groups below is not enough on its own, either: a\n  // config with a literal `observations` *and* an unreadable spread is missing\n  // whatever `actions` the spread contributes, and the half that resolved would\n  // otherwise read as the whole.\n  for (const property of config.properties) {\n    if (!ts.isSpreadAssignment(property)) continue;\n    const keys = spreadKeys(property.expression, source);\n    if (keys && !keys.some((key) => CAPABILITY_GROUPS.includes(key as \"observations\" | \"actions\"))) {\n      continue;\n    }\n    emit.push({\n      capabilityId: `view:${type}.${UNRESOLVED_ID}`,\n      kind: \"action\",\n      origin: emit.origin(property),\n      resolution: \"unresolved\",\n      reason: \"spread-members\",\n      note: keys\n        ? `\"${type}\" spreads ${describeConstruct(property.expression)}, which contributes \\`${keys\n            .filter((key) => CAPABILITY_GROUPS.includes(key as \"observations\" | \"actions\"))\n            .join(\"`/`\")}\\` this inventory cannot name`\n        : `\"${type}\" spreads ${describeConstruct(property.expression)}, whose keys this inventory cannot read — it may contribute capabilities not listed here`,\n    });\n  }\n\n  capabilitiesFromGroup(\n    propertyOf(config, \"observations\"),\n    \"observation\",\n    type,\n    componentPartial,\n    emit,\n    source,\n  );\n  capabilitiesFromGroup(\n    propertyOf(config, \"actions\"),\n    \"action\",\n    type,\n    componentPartial,\n    emit,\n    source,\n  );\n}\n\n/* ── wrapper hooks: one hop *up* the call graph (OQ-13) ───────────────── */\n\n/**\n * A registration whose `type` is a parameter of the enclosing function.\n *\n * ```tsx\n * function useRegisteredPanel(type: string) {\n *   useAgentComponent({ type, observations: { … } });   // ← here\n * }\n * useRegisteredPanel(\"devices.table\");                  // ← type lives here\n * ```\n *\n * The capability ids are still fully determined by source text; they are just\n * determined *one frame up*. Reported unread, a single such wrapper hides the\n * whole surface built on it — 91% of one real application's capabilities\n * ([#31](https://github.com/Wiseair-srl/agent-surface/issues/31)).\n *\n * Resolution is deferred to a second pass because a call site may live in a\n * file walked before the wrapper's own.\n */\ninterface DeferredWrapper {\n  config: ts.ObjectLiteralExpression;\n  source: ts.SourceFile;\n  emit: Emitter;\n  /** The name a call site would use. */\n  wrapperName: string;\n  /** Where `type` sits in the wrapper's signature. */\n  slot: { index: number; property?: string };\n  /** The node to blame when this cannot be resolved. */\n  site: ts.Node;\n}\n\ninterface CallSite {\n  call: ts.CallExpression;\n  source: ts.SourceFile;\n}\n\n/**\n * The function a call sits inside, and the name a caller would use for it.\n *\n * Tracked on the way *down* the tree rather than read from `node.parent`:\n * `ts.createProgram` leaves parent pointers unset until something forces the\n * binder to run, and forcing it means constructing a type checker — real work\n * on a large program, for an answer the walk already has in hand.\n */\ninterface EnclosingFunction {\n  fn: ts.SignatureDeclaration;\n  /** `function useX()` and `const useX = () => {}` both name the wrapper. */\n  name?: string;\n}\n\nfunction functionLike(node: ts.Node): ts.SignatureDeclaration | undefined {\n  if (\n    ts.isFunctionDeclaration(node) ||\n    ts.isFunctionExpression(node) ||\n    ts.isArrowFunction(node) ||\n    ts.isMethodDeclaration(node)\n  ) {\n    return node;\n  }\n  return undefined;\n}\n\n/**\n * Where a `type` identifier comes from in the enclosing signature, if it is a\n * parameter at all. Both spellings authors actually use:\n *\n * ```ts\n * function useX(type: string)          // { index: 0 }\n * function useX({ type }: Props)       // { index: 0, property: \"type\" }\n * ```\n */\nfunction parameterSlot(\n  name: string,\n  fn: ts.SignatureDeclaration,\n): { index: number; property?: string } | undefined {\n  for (const [index, parameter] of fn.parameters.entries()) {\n    if (ts.isIdentifier(parameter.name)) {\n      if (parameter.name.text === name) return { index };\n      continue;\n    }\n    if (ts.isObjectBindingPattern(parameter.name)) {\n      for (const element of parameter.name.elements) {\n        if (!ts.isIdentifier(element.name) || element.name.text !== name) continue;\n        // `{ type: kind }` binds `kind` locally but reads the `type` property.\n        const property =\n          element.propertyName && ts.isIdentifier(element.propertyName)\n            ? element.propertyName.text\n            : name;\n        return { index, property };\n      }\n    }\n  }\n  return undefined;\n}\n\n/**\n * Whether `site` is provably a call of `wrapper`, and not of something else\n * that happens to share its name.\n *\n * This predicate is the whole safety argument. Attributing a wrapper's\n * capabilities to the wrong call site would put ids in the catalog that no\n * component authors — **fabricating** entries, a failure this package has never\n * had and must not acquire. Reporting unread is always the safe answer, so\n * anything short of certainty returns `false`:\n *\n * - declared in the same file — lexically certain;\n * - imported, and the specifier resolves to the wrapper's own file;\n * - anything else — a re-export chain, a namespace import, a dynamic import —\n *   is not certain, and is left unread.\n */\nfunction callsWrapper(\n  site: CallSite,\n  wrapper: DeferredWrapper,\n  compilerOptions: ts.CompilerOptions,\n): boolean {\n  const callee = site.call.expression;\n  if (!ts.isIdentifier(callee) || callee.text !== wrapper.wrapperName) return false;\n\n  if (site.source.fileName === wrapper.source.fileName) {\n    // Same file: the only way this is a different function is a local shadow,\n    // which would also shadow it for the reader.\n    return true;\n  }\n\n  for (const statement of site.source.statements) {\n    if (!ts.isImportDeclaration(statement)) continue;\n    const clause = statement.importClause;\n    if (!clause) continue;\n\n    const named =\n      clause.name?.text === wrapper.wrapperName ||\n      (clause.namedBindings &&\n        ts.isNamedImports(clause.namedBindings) &&\n        clause.namedBindings.elements.some((element) => element.name.text === wrapper.wrapperName));\n    if (!named) continue;\n    if (!ts.isStringLiteral(statement.moduleSpecifier)) continue;\n\n    const resolved = ts.resolveModuleName(\n      statement.moduleSpecifier.text,\n      site.source.fileName,\n      compilerOptions,\n      ts.sys,\n    ).resolvedModule;\n    if (resolved?.resolvedFileName === wrapper.source.fileName) return true;\n  }\n  return false;\n}\n\nexport interface ExtractOptions {\n  /** Directory the analysis is rooted at — normally the surface config's dir. */\n  root: string;\n  /** Explicit tsconfig; found upward from `root` when omitted. */\n  tsconfig?: string;\n}\n\n/** Whitespace-insensitive source text, so a reformat is not a different site. */\nfunction normalizedText(node: ts.Node, source: ts.SourceFile): string {\n  return node.getText(source).replace(/\\s+/g, \" \").trim();\n}\n\ninterface SiteIdentity {\n  /** Named enclosures, outermost first. */\n  labels: string[];\n  enclosingCall: string;\n  /** Innermost named enclosure, or the file — the subtree a twin could be in. */\n  scope: ts.Node;\n}\n\nfunction siteIdentity(source: ts.SourceFile, node: ts.Node): SiteIdentity {\n  const labels: string[] = [];\n  let enclosingCall = \"\";\n  let scope: ts.Node | undefined;\n\n  for (let parent = node.parent; parent && parent !== source; parent = parent.parent) {\n    if (!enclosingCall && ts.isCallExpression(parent)) {\n      enclosingCall = normalizedText(parent, source);\n    }\n    const named =\n      (ts.isFunctionDeclaration(parent) || ts.isMethodDeclaration(parent)) &&\n      parent.name &&\n      (ts.isIdentifier(parent.name) || ts.isStringLiteral(parent.name))\n        ? parent.name.text\n        : ts.isVariableDeclaration(parent) && ts.isIdentifier(parent.name)\n          ? parent.name.text\n          : undefined;\n    if (named !== undefined) {\n      labels.push(named);\n      scope ??= parent;\n    }\n  }\n  return { labels: labels.reverse(), enclosingCall, scope: scope ?? source };\n}\n\n/**\n * How many identical nodes precede this one inside its named enclosure.\n *\n * Read from source *positions*, never from the order this module visits them:\n * the deferred wrapper pass emits origins for one file while walking another,\n * so a running counter would hand out a different answer depending on which ran\n * first — and a fingerprint that depends on traversal order is not one.\n */\nfunction occurrence(scope: ts.Node, node: ts.Node, source: ts.SourceFile): number {\n  const text = normalizedText(node, source);\n  const start = node.getStart(source);\n  let rank = 0;\n  const visit = (candidate: ts.Node): void => {\n    if (\n      candidate.kind === node.kind &&\n      candidate.getStart(source) < start &&\n      normalizedText(candidate, source) === text\n    ) {\n      rank += 1;\n    }\n    ts.forEachChild(candidate, visit);\n  };\n  ts.forEachChild(scope, visit);\n  return rank;\n}\n\n/**\n * Which site this is, as something a committed allowance can be keyed on.\n *\n * Identity is the node's own text and the named enclosures around it. Nothing\n * positional goes in: not the line, and — the bug this replaces — not the\n * surrounding source either. An earlier version hashed a window of neighbouring\n * lines to tell two otherwise identical sites apart. It did tell them apart,\n * and it also moved the fingerprint whenever a comment changed within ten\n * lines, silently invalidating the entry and failing `check` for an edit nobody\n * thought was behavioural. That is the exact churn this key exists to survive,\n * and `file#reason` survived it before.\n *\n * Genuine twins — byte-identical calls in the same named enclosure — are told\n * apart by their rank within it instead. Inserting a third after them leaves\n * both keys alone; only a twin inserted *before* one shifts it, which is a\n * change to the very thing the key names.\n */\nfunction stableSite(source: ts.SourceFile, node: ts.Node): string {\n  const { labels, enclosingCall, scope } = siteIdentity(source, node);\n  return createHash(\"sha256\")\n    .update(\n      `${labels.join(\"/\")}\\0${enclosingCall}\\0${normalizedText(node, source)}\\0${occurrence(\n        scope,\n        node,\n        source,\n      )}`,\n    )\n    .digest(\"hex\")\n    .slice(0, 12);\n}\n\nconst packageNameCache = new Map<string, string | undefined>();\n\nfunction packageNameFor(file: string): string | undefined {\n  let dir = dirname(file);\n  for (;;) {\n    if (packageNameCache.has(dir)) return packageNameCache.get(dir);\n    const packagePath = join(dir, \"package.json\");\n    if (existsSync(packagePath)) {\n      let name: string | undefined;\n      try {\n        const parsed = JSON.parse(readFileSync(packagePath, \"utf8\")) as { name?: unknown };\n        if (typeof parsed.name === \"string\") name = parsed.name;\n      } catch {\n        // A malformed package boundary cannot make a file trusted/excluded.\n      }\n      packageNameCache.set(dir, name);\n      return name;\n    }\n    const parent = dirname(dir);\n    if (parent === dir) return undefined;\n    dir = parent;\n  }\n}\n\nconst IMPLEMENTATION_PACKAGES = new Set([\n  \"@agent-surface/core\",\n  \"@agent-surface/react\",\n  \"@agent-surface/orpc\",\n  \"@agent-surface/testing\",\n  \"@agent-surface/webmcp\",\n  \"@agent-surface/cli\",\n]);\n\nfunction isAgentSurfaceImplementation(file: string): boolean {\n  return IMPLEMENTATION_PACKAGES.has(packageNameFor(file) ?? \"\");\n}\n\n/**\n * Reads the program and returns every capability its registration call sites\n * author. Nothing is executed: no Vite server, no jsdom, no scenarios, no mount.\n */\nexport function extractCapabilities(options: ExtractOptions): CapabilityInventory {\n  const root = resolve(options.root);\n  const tsconfigPath = options.tsconfig\n    ? isAbsolute(options.tsconfig)\n      ? options.tsconfig\n      : join(root, options.tsconfig)\n    : findTsconfig(root);\n\n  if (!tsconfigPath || !existsSync(tsconfigPath)) {\n    throw new Error(\n      `no tsconfig.json found from ${root} — \\`capabilities\\` reads the TypeScript program, ` +\n        \"so it needs one (pass --tsconfig to point at it)\",\n    );\n  }\n\n  const { fileNames, options: compilerOptions } = readProgramFiles(tsconfigPath);\n  const program = ts.createProgram(fileNames, compilerOptions);\n\n  const capabilities: AuthoredCapability[] = [];\n  let filesAnalyzed = 0;\n\n  let filesOutsideRoot = 0;\n\n  // Registrations whose `type` comes from a parameter, and every call that\n  // could supply it. Both are filled during the single walk below; the join\n  // happens after, because a call site may live in a file walked earlier.\n  const deferred: DeferredWrapper[] = [];\n  const callsByName = new Map<string, CallSite[]>();\n\n  for (const source of program.getSourceFiles()) {\n    if (source.isDeclarationFile) continue;\n    if (source.fileName.includes(\"/node_modules/\")) continue;\n    // Workspace sources are part of the authored denominator even when they\n    // live beside the config package. Only agent-surface's own implementation\n    // packages are excluded: their `registry.register(definition)` is the hook\n    // implementation, not another authored registration.\n    if (!isInside(root, source.fileName) && isAgentSurfaceImplementation(source.fileName)) {\n      filesOutsideRoot += 1;\n      continue;\n    }\n    filesAnalyzed += 1;\n\n    const emit: Emitter = {\n      push: (capability) => capabilities.push(capability),\n      origin: (node) => ({\n        file: relative(root, source.fileName),\n        line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,\n        site: stableSite(source, node),\n      }),\n    };\n\n    // Read once per file: every call site in it is identified against these.\n    const imports = importedRegistrations(source);\n    for (const renamed of renamedRegistrationExports(source, imports)) {\n      emit.push({\n        capabilityId: UNRESOLVED_ID,\n        kind: \"action\",\n        origin: emit.origin(renamed.node),\n        resolution: \"unresolved\",\n        reason: \"dynamic-callee\",\n        note: `${renamed.hook}() leaves this module as \\`${renamed.exported}\\`, so nothing at its call sites elsewhere proves they register anything — whatever they author is not in this catalog`,\n      });\n    }\n\n    let pendingName: string | undefined;\n    const visit = (node: ts.Node, enclosing?: EnclosingFunction): void => {\n      const fn = functionLike(node);\n      if (fn) {\n        // A variable declaration names the arrow it initialises, and the walk\n        // sees the declaration first — so the name is already in hand here.\n        const named = ts.isFunctionDeclaration(node) && node.name ? node.name.text : pendingName;\n        enclosing = { fn, ...(named ? { name: named } : {}) };\n        pendingName = undefined;\n      } else if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name)) {\n        pendingName = node.name.text;\n      }\n\n      if (ts.isCallExpression(node)) {\n        visitCall(node, emit, source, imports, deferred, enclosing);\n        // Every identifier-callee call is a potential wrapper call site. Indexed\n        // by name here so the second pass does not re-walk the program.\n        if (ts.isIdentifier(node.expression)) {\n          const name = node.expression.text;\n          const sites = callsByName.get(name) ?? [];\n          sites.push({ call: node, source });\n          callsByName.set(name, sites);\n        }\n      }\n      ts.forEachChild(node, (child) => visit(child, enclosing));\n    };\n    visit(source);\n  }\n\n  // Second pass: one hop *up* the call graph. The first pass follows one hop\n  // sideways to a same-module `const`; this is the same budget pointed the\n  // other way, and it is what turns a shared wrapper hook from a single unread\n  // line into the capabilities it actually authors.\n  for (const wrapper of deferred) {\n    const sites = (callsByName.get(wrapper.wrapperName) ?? []).filter((site) =>\n      callsWrapper(site, wrapper, compilerOptions),\n    );\n\n    const types = new Map<string, ts.CallExpression>();\n    const dynamic: CallSite[] = [];\n    for (const site of sites) {\n      const argument = site.call.arguments[wrapper.slot.index];\n      const value =\n        wrapper.slot.property && argument && ts.isObjectLiteralExpression(argument)\n          ? propertyOf(argument, wrapper.slot.property)\n          : argument;\n      const text = value ? literalText(value) : undefined;\n      if (text !== undefined) types.set(text, site.call);\n      else dynamic.push(site);\n    }\n\n    // Partial resolution beats all-or-nothing: 15 literals plus 2 unread lines\n    // is a truer catalog than 17 unread lines, and it stays honest about which\n    // two it could not read.\n    for (const type of [...types.keys()].sort()) {\n      const componentPartial = hasSpread(wrapper.config)\n        ? \"the component config spreads another object, so some metadata here may be dynamic\"\n        : undefined;\n      for (const [group, kind] of [\n        [\"observations\", \"observation\"],\n        [\"actions\", \"action\"],\n      ] as const) {\n        capabilitiesFromGroup(\n          propertyOf(wrapper.config, group),\n          kind,\n          type,\n          componentPartial,\n          wrapper.emit,\n          wrapper.source,\n        );\n      }\n    }\n\n    if (types.size === 0 || dynamic.length > 0) {\n      // Nothing resolved, or some call sites pass a non-literal. Either way the\n      // catalog is a floor here and has to say so.\n      wrapper.emit.push({\n        capabilityId: UNRESOLVED_ID,\n        kind: \"action\",\n        origin: wrapper.emit.origin(wrapper.site),\n        resolution: \"unresolved\",\n        reason: \"dynamic-type\",\n        note:\n          types.size === 0\n            ? `\\`type\\` is a parameter of ${wrapper.wrapperName}(), and no call site of it in this program passes a string literal`\n            : `\\`type\\` is a parameter of ${wrapper.wrapperName}(); ${types.size} call site${\n                types.size === 1 ? \"\" : \"s\"\n              } resolved, ${dynamic.length} pass${dynamic.length === 1 ? \"es\" : \"\"} a non-literal`,\n      });\n    }\n  }\n\n  capabilities.sort(\n    (a, b) =>\n      a.capabilityId.localeCompare(b.capabilityId) ||\n      a.origin.file.localeCompare(b.origin.file) ||\n      a.origin.line - b.origin.line,\n  );\n\n  return {\n    capabilities,\n    tsconfig: tsconfigPath,\n    root,\n    filesAnalyzed,\n    filesOutsideRoot,\n    domain: \"not-analyzed\",\n  };\n}\n\n/** True when `file` lives under `root` — the analyzed boundary. */\nfunction isInside(root: string, file: string): boolean {\n  const rel = relative(root, file);\n  return rel !== \"\" && !rel.startsWith(\"..\") && !isAbsolute(rel);\n}\n\n/** Distinct capability ids the inventory resolved — the coverage denominator. */\nexport function authoredIds(inventory: CapabilityInventory): Set<string> {\n  const ids = new Set<string>();\n  for (const capability of inventory.capabilities) {\n    if (capability.resolution === \"unresolved\") continue;\n    if (capability.capabilityId.endsWith(UNRESOLVED_ID)) continue;\n    ids.add(capability.capabilityId);\n  }\n  return ids;\n}\n\nexport function unresolved(inventory: CapabilityInventory): AuthoredCapability[] {\n  return inventory.capabilities.filter((capability) => capability.resolution === \"unresolved\");\n}\n"],"mappings":";AAOA,SAAS,YAAY,oBAAoB;AACzC,SAAS,YAAY;AAGd,IAAM,iBAAiB;AACvB,IAAM,wBAAwB;AAW9B,SAAS,iBAAiB,aAA6B;AAC5D,SAAO,KAAK,aAAa,cAAc;AACzC;AAEO,SAAS,uBAAuB,aAA6B;AAClE,SAAO,KAAK,aAAa,qBAAqB;AAChD;AAEO,SAAS,cAAc,MAAc,UAAU,gBAAmC;AACvF,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO,CAAC;AAC/B,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AAAA,EAChD,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR,mBAAmB,IAAI,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACpF;AAAA,EACF;AACA,MAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,MAAM,QAAQ,MAAM,GAAG;AAC1E,UAAM,IAAI,MAAM,GAAG,IAAI,gCAAgC,OAAO,eAAe;AAAA,EAC/E;AACA,QAAM,YAA+B,CAAC;AACtC,aAAW,CAAC,IAAI,MAAM,KAAK,OAAO,QAAQ,MAAiC,GAAG;AAC5E,QAAI,OAAO,WAAW,YAAY,OAAO,KAAK,MAAM,IAAI;AACtD,YAAM,IAAI,MAAM,GAAG,IAAI,MAAM,EAAE,mCAAmC;AAAA,IACpE;AACA,cAAU,EAAE,IAAI;AAAA,EAClB;AACA,SAAO;AACT;AAgBO,SAAS,UAAU,OAAmC;AAC3D,SAAO,GAAG,MAAM,OAAO,IAAI,IAAI,MAAM,UAAU,SAAS,IAAI,MAAM,OAAO,IAAI;AAC/E;AAwFO,SAAS,oBAAoB,OAA2C;AAC7E,QAAM,YAAmC,CAAC;AAC1C,QAAM,UAAoB,CAAC;AAE3B,aAAW,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,KAAK,GAAG;AAC3C,QAAI,MAAM,WAAW,IAAI,EAAE,EAAG;AAC9B,QAAI,MAAM,MAAM,WAAW;AACzB,cAAQ,KAAK,EAAE;AACf;AAAA,IACF;AACA,cAAU,KAAK,EAAE,cAAc,IAAI,QAAQ,MAAM,QAAQ,IAAI,EAAE,KAAK,EAAE,MAAM,KAAK,MAAM,EAAE,EAAE,CAAC;AAAA,EAC9F;AAKA,QAAM,iBAAiB,OAAO,KAAK,MAAM,SAAS,EAC/C,OAAO,CAAC,OAAO,MAAM,WAAW,IAAI,EAAE,KAAK,CAAC,MAAM,SAAS,IAAI,EAAE,CAAC,EAClE,KAAK;AAMR,QAAM,kBAAkB,MAAM,mBAAmB,CAAC;AAClD,QAAM,SAA+B,CAAC;AACtC,QAAM,gBAAgB,oBAAI,IAAY;AACtC,aAAW,SAAS,MAAM,YAAY;AACpC,UAAM,MAAM,UAAU,KAAK;AAC3B,QAAI,OAAO,gBAAiB,eAAc,IAAI,GAAG;AAAA,QAC5C,QAAO,KAAK,KAAK;AAAA,EACxB;AACA,QAAM,cAAc,IAAI,IAAI,MAAM,WAAW,IAAI,SAAS,CAAC;AAC3D,QAAM,uBAAuB,OAAO,KAAK,eAAe,EACrD,OAAO,CAAC,QAAQ,CAAC,YAAY,IAAI,GAAG,CAAC,EACrC,KAAK;AAER,QAAM,cAAc,CAAC,GAAG,MAAM,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,SAAS,IAAI,EAAE,CAAC,EAAE,KAAK;AACvF,QAAM,gBAAgB,CAAC,GAAG,MAAM,UAAU,EAAE,OAAO,CAAC,OAAO,GAAG,WAAW,SAAS,CAAC,EAAE,KAAK;AAC1F,QAAM,qBAAqB,MAAM,sBAC7B,YAAY,OAAO,CAAC,OAAO,GAAG,WAAW,SAAS,CAAC,IACnD,CAAC;AACL,QAAM,aAAa,YAAY,OAAO,CAAC,OAAO,CAAC,GAAG,WAAW,SAAS,CAAC;AAEvE,SAAO;AAAA,IACL,UAAU,MAAM,SAAS;AAAA,IACzB,SAAS,CAAC,GAAG,MAAM,QAAQ,EAAE,OAAO,CAAC,OAAO,MAAM,WAAW,IAAI,EAAE,CAAC,EAAE;AAAA,IACtE,WAAW,MAAM;AAAA,IACjB,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,IAC5C,qBAAqB,MAAM,uBAAuB;AAAA,IAClD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,qBAAqB,MAAM,wBAAwB;AAAA,IACnD,YAAY;AAAA,IACZ;AAAA,IACA;AAAA,IACA,eAAe,MAAM;AAAA,IACrB,eAAe,CAAC,GAAG,aAAa,EAAE,KAAK;AAAA,IACvC;AAAA,IACA,qBAAqB,MAAM;AAAA,EAC7B;AACF;AAiBO,SAAS,iBACd,QACA,UAAyC,CAAC,GAClC;AACR,MAAI,OAAO,UAAU,SAAS,EAAG,QAAO;AACxC,MAAI,OAAO,mBAAmB,SAAS,EAAG,QAAO;AAMjD,MAAI,OAAO,WAAW,SAAS,KAAK,CAAC,QAAQ,gBAAiB,QAAO;AACrE,MAAI,OAAO,eAAe,SAAS,EAAG,QAAO;AAC7C,MAAI,OAAO,qBAAqB,SAAS,EAAG,QAAO;AACnD,SAAO;AACT;;;ACrNA,SAAS,kBAAkB;AAC3B,SAAS,cAAAA,aAAY,gBAAAC,qBAAoB;AACzC,SAAS,SAAS,YAAY,QAAAC,OAAM,UAAU,eAAe;AAC7D,OAAO,QAAQ;AAGR,IAAM,gBAAgB;AAwEtB,SAAS,aAAa,MAAkC;AAC7D,SAAO,GAAG,eAAe,QAAQ,IAAI,GAAG,GAAG,IAAI,YAAY,eAAe;AAC5E;AAGO,SAAS,uBAAuB,YAA0C;AAC/E,QAAM,SAAS,GAAG;AAAA,IAChB;AAAA,IACAD,cAAa,YAAY,MAAM;AAAA,IAC/B,GAAG,aAAa;AAAA,IAChB;AAAA,IACA,WAAW,SAAS,GAAG,IAAI,GAAG,WAAW,MAAM,GAAG,WAAW;AAAA,EAC/D;AACA,MAAI;AACJ,QAAM,QAAQ,CAAC,SAAwB;AACrC,QAAI,MAAO;AACX,QACE,GAAG,qBAAqB,IAAI,KAC5B,aAAa,KAAK,IAAI,MAAM,WAC5B,GAAG,yBAAyB,KAAK,WAAW,GAC5C;AACA,YAAM,SAAS,KAAK,YAAY,SAAS,IAAI,CAAC,UAAU,YAAY,KAAK,CAAC;AAC1E,UAAI,OAAO,MAAM,CAAC,UAA2B,UAAU,MAAS,EAAG,SAAQ;AAAA,IAC7E;AACA,OAAG,aAAa,MAAM,KAAK;AAAA,EAC7B;AACA,QAAM,MAAM;AACZ,SAAO;AACT;AAOA,SAAS,iBAAiB,cAAoC;AAC5D,QAAM,OAAO,GAAG,eAAe,cAAc,GAAG,IAAI,QAAQ;AAC5D,MAAI,KAAK,OAAO;AACd,UAAM,IAAI;AAAA,MACR,kBAAkB,YAAY,KAAK,GAAG,6BAA6B,KAAK,MAAM,aAAa,GAAG,CAAC;AAAA,IACjG;AAAA,EACF;AACA,QAAM,SAAS,GAAG;AAAA,IAChB,KAAK;AAAA,IACL,GAAG;AAAA,IACH,QAAQ,YAAY;AAAA,EACtB;AACA,MAAI,OAAO,OAAO,SAAS,KAAK,OAAO,UAAU,WAAW,GAAG;AAC7D,UAAM,IAAI;AAAA,MACR,oCAAoC,YAAY,KAAK,OAAO,OACzD,IAAI,CAAC,UAAU,GAAG,6BAA6B,MAAM,aAAa,GAAG,CAAC,EACtE,KAAK,IAAI,CAAC;AAAA,IACf;AAAA,EACF;AACA,SAAO,EAAE,WAAW,OAAO,WAAW,SAAS,OAAO,QAAQ;AAChE;AAYA,IAAM,qBAAqB,oBAAI,IAAI,CAAC,qBAAqB,kBAAkB,qBAAqB,CAAC;AAGjG,SAAS,qBAAqB,WAA4B;AACxD,SAAO,UAAU,WAAW,iBAAiB;AAC/C;AA0BA,IAAM,aAA0B,EAAE,QAAQ,oBAAI,IAAI,GAAG,YAAY,oBAAI,IAAI,EAAE;AAE3E,SAAS,sBAAsB,QAAoC;AACjE,QAAM,SAAS,oBAAI,IAAoB;AACvC,QAAM,aAAa,oBAAI,IAAY;AAEnC,aAAW,aAAa,OAAO,YAAY;AACzC,QAAI,CAAC,GAAG,oBAAoB,SAAS,EAAG;AACxC,QAAI,CAAC,GAAG,gBAAgB,UAAU,eAAe,EAAG;AACpD,QAAI,CAAC,qBAAqB,UAAU,gBAAgB,IAAI,EAAG;AAI3D,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,UAAU,OAAO,cAAc,CAAC,OAAO,cAAe;AAE3D,QAAI,GAAG,kBAAkB,OAAO,aAAa,GAAG;AAC9C,iBAAW,IAAI,OAAO,cAAc,KAAK,IAAI;AAC7C;AAAA,IACF;AACA,eAAW,WAAW,OAAO,cAAc,UAAU;AACnD,UAAI,QAAQ,WAAY;AACxB,YAAM,YAAY,QAAQ,gBAAgB,QAAQ,MAAM;AACxD,UAAI,mBAAmB,IAAI,QAAQ,EAAG,QAAO,IAAI,QAAQ,KAAK,MAAM,QAAQ;AAAA,IAC9E;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,WAAW;AAC9B;AAkBA,SAAS,2BACP,QACA,SACqD;AACrD,QAAM,UAA+D,CAAC;AAEtE,aAAW,aAAa,OAAO,YAAY;AACzC,QAAI,CAAC,GAAG,oBAAoB,SAAS,KAAK,UAAU,WAAY;AAChE,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,UAAU,CAAC,GAAG,eAAe,MAAM,EAAG;AAE3C,UAAM,OAAO,UAAU;AAGvB,UAAM,WACJ,SAAS,UAAa,GAAG,gBAAgB,IAAI,KAAK,qBAAqB,KAAK,IAAI;AAClF,QAAI,QAAQ,CAAC,SAAU;AAEvB,eAAW,WAAW,OAAO,UAAU;AACrC,UAAI,QAAQ,WAAY;AACxB,YAAM,SAAS,QAAQ,gBAAgB,QAAQ,MAAM;AACrD,YAAM,OAAO,WACT,mBAAmB,IAAI,KAAK,IAC1B,QACA,SACF,QAAQ,OAAO,IAAI,KAAK;AAG5B,UAAI,SAAS,UAAa,QAAQ,KAAK,SAAS,KAAM;AACtD,cAAQ,KAAK,EAAE,MAAM,SAAS,MAAM,UAAU,QAAQ,KAAK,KAAK,CAAC;AAAA,IACnE;AAAA,EACF;AACA,SAAO;AACT;AAKA,SAAS,gBAAgB,QAAuB,QAAgB,SAA+B;AAC7F,SACE,GAAG,aAAa,MAAM,KAAK,QAAQ,WAAW,IAAI,OAAO,IAAI,KAAK,mBAAmB,IAAI,MAAM;AAEnG;AAEA,SAAS,WAAW,MAAyB,UAAuB,YAAgC;AAClG,QAAM,SAAS,KAAK;AAGpB,MAAI,GAAG,aAAa,MAAM,EAAG,QAAO,QAAQ,OAAO,IAAI,OAAO,IAAI,KAAK,OAAO;AAE9E,MAAI,GAAG,2BAA2B,MAAM,GAAG;AAKzC,QAAI,gBAAgB,OAAO,YAAY,OAAO,KAAK,MAAM,OAAO,EAAG,QAAO,OAAO,KAAK;AAKtF,WAAO,OAAO,KAAK;AAAA,EACrB;AAGA,MAAI,GAAG,0BAA0B,MAAM,GAAG;AACxC,UAAM,SAAS,YAAY,OAAO,kBAAkB;AACpD,QAAI,WAAW,UAAa,gBAAgB,OAAO,YAAY,QAAQ,OAAO,EAAG,QAAO;AAAA,EAC1F;AACA,SAAO;AACT;AAEA,SAAS,aAAa,MAA2C;AAC/D,MAAI,GAAG,aAAa,IAAI,KAAK,GAAG,gBAAgB,IAAI,EAAG,QAAO,KAAK;AACnE,SAAO;AACT;AAEA,SAAS,WACP,QACA,QAC2B;AAC3B,aAAW,YAAY,OAAO,YAAY;AACxC,QAAI,GAAG,qBAAqB,QAAQ,KAAK,aAAa,SAAS,IAAI,MAAM,QAAQ;AAC/E,aAAO,SAAS;AAAA,IAClB;AAIA,QAAI,GAAG,8BAA8B,QAAQ,KAAK,SAAS,KAAK,SAAS,QAAQ;AAC/E,aAAO,SAAS;AAAA,IAClB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,UAAU,QAA6C;AAC9D,SAAO,OAAO,WAAW,KAAK,CAAC,aAAa,GAAG,mBAAmB,QAAQ,CAAC;AAC7E;AAGA,IAAM,oBAAoB,CAAC,gBAAgB,SAAS;AAqBpD,SAAS,WACP,YACA,QACA,QAAQ,GACc;AACtB,MAAI,QAAQ,EAAG,QAAO;AAEtB,MAAI,GAAG,0BAA0B,UAAU,GAAG;AAC5C,WAAO,WAAW,WAAW,YAAY,QAAQ,KAAK;AAAA,EACxD;AAIA,MAAI,GAAG,wBAAwB,UAAU,GAAG;AAC1C,UAAM,WAAW,WAAW,WAAW,UAAU,QAAQ,KAAK;AAC9D,UAAM,YAAY,WAAW,WAAW,WAAW,QAAQ,KAAK;AAChE,QAAI,CAAC,YAAY,CAAC,UAAW,QAAO;AACpC,WAAO,CAAC,GAAG,UAAU,GAAG,SAAS;AAAA,EACnC;AAEA,QAAM,WAAW,iBAAiB,YAAY,MAAM;AACpD,MAAI,CAAC,SAAS,OAAQ,QAAO;AAE7B,QAAM,OAAiB,CAAC;AACxB,aAAW,YAAY,SAAS,OAAO,YAAY;AAGjD,QAAI,GAAG,mBAAmB,QAAQ,GAAG;AACnC,YAAM,SAAS,WAAW,SAAS,YAAY,QAAQ,QAAQ,CAAC;AAChE,UAAI,CAAC,OAAQ,QAAO;AACpB,WAAK,KAAK,GAAG,MAAM;AACnB;AAAA,IACF;AACA,UAAM,OACJ,GAAG,qBAAqB,QAAQ,KAAK,GAAG,oBAAoB,QAAQ,IAChE,aAAa,SAAS,IAAI,IAC1B,GAAG,8BAA8B,QAAQ,IACvC,SAAS,KAAK,OACd;AAER,QAAI,SAAS,OAAW,QAAO;AAC/B,SAAK,KAAK,IAAI;AAAA,EAChB;AACA,SAAO;AACT;AAEA,SAAS,YAAY,MAAqD;AACxE,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,GAAG,gBAAgB,IAAI,KAAK,GAAG,gCAAgC,IAAI,EAAG,QAAO,KAAK;AACtF,MAAI,GAAG,0BAA0B,IAAI,EAAG,QAAO,YAAY,KAAK,UAAU;AAK1E,MAAI,GAAG,mBAAmB,IAAI,KAAK,KAAK,cAAc,SAAS,GAAG,WAAW,WAAW;AACtF,UAAM,OAAO,YAAY,KAAK,IAAI;AAClC,UAAM,QAAQ,YAAY,KAAK,KAAK;AACpC,QAAI,SAAS,UAAa,UAAU,OAAW,QAAO,OAAO;AAAA,EAC/D;AACA,SAAO;AACT;AAGA,SAAS,kBAAkB,MAA6B;AACtD,MAAI,GAAG,iBAAiB,IAAI,GAAG;AAC7B,UAAM,SAAS,WAAW,IAAI;AAC9B,WAAO,SAAS,YAAY,MAAM,OAAO;AAAA,EAC3C;AACA,MAAI,GAAG,aAAa,IAAI,EAAG,QAAO,eAAe,KAAK,IAAI;AAC1D,MAAI,GAAG,wBAAwB,IAAI,EAAG,QAAO;AAC7C,MAAI,GAAG,qBAAqB,IAAI,EAAG,QAAO;AAC1C,MAAI,GAAG,2BAA2B,IAAI,EAAG,QAAO;AAChD,SAAO;AACT;AAaA,SAAS,iBACP,YACA,QACwD;AACxD,MAAI,GAAG,0BAA0B,UAAU,EAAG,QAAO,EAAE,QAAQ,WAAW;AAE1E,MAAI,GAAG,aAAa,UAAU,GAAG;AAC/B,UAAM,SAAS,WAAW;AAC1B,QAAI;AACJ,UAAM,QAAQ,CAAC,SAAwB;AACrC,UAAI,MAAO;AACX,UACE,GAAG,sBAAsB,IAAI,KAC7B,GAAG,aAAa,KAAK,IAAI,KACzB,KAAK,KAAK,SAAS,UACnB,KAAK,eACL,GAAG,0BAA0B,KAAK,WAAW,GAC7C;AACA,gBAAQ,KAAK;AACb;AAAA,MACF;AACA,SAAG,aAAa,MAAM,KAAK;AAAA,IAC7B;AACA,UAAM,MAAM;AACZ,QAAI,MAAO,QAAO,EAAE,QAAQ,MAAM;AAClC,WAAO;AAAA,MACL,MAAM,mBAAmB,MAAM;AAAA,IACjC;AAAA,EACF;AAEA,SAAO,EAAE,MAAM,iBAAiB,kBAAkB,UAAU,CAAC,GAAG;AAClE;AAKA,IAAM,iBAAiB,oBAAI,IAAI,CAAC,kBAAkB,qBAAqB,CAAC;AAOxE,SAAS,sBACP,OACA,MACA,eACA,kBACA,MACA,QACM;AACN,MAAI,CAAC,MAAO;AAEZ,QAAM,WAAW,iBAAiB,OAAO,MAAM;AAC/C,MAAI,CAAC,SAAS,QAAQ;AACpB,SAAK,KAAK;AAAA,MACR,cAAc,QAAQ,aAAa,IAAI,aAAa;AAAA,MACpD;AAAA,MACA,QAAQ,KAAK,OAAO,KAAK;AAAA,MACzB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,MAAM,KAAK,IAAI,WAAW,aAAa,+BAA+B,SAAS,IAAI;AAAA,IACrF,CAAC;AACD;AAAA,EACF;AAEA,aAAW,YAAY,SAAS,OAAO,YAAY;AAGjD,QAAI,GAAG,mBAAmB,QAAQ,GAAG;AACnC,WAAK,KAAK;AAAA,QACR,cAAc,QAAQ,aAAa,IAAI,aAAa;AAAA,QACpD;AAAA,QACA,QAAQ,KAAK,OAAO,QAAQ;AAAA,QAC5B,YAAY;AAAA,QACZ,QAAQ;AAAA,QACV,MAAM,KAAK,IAAI,WAAW,aAAa;AAAA,MACvC,CAAC;AACD;AAAA,IACF;AAEA,UAAM,OACJ,GAAG,qBAAqB,QAAQ,KAAK,GAAG,oBAAoB,QAAQ,IAChE,aAAa,SAAS,IAAI,IAC1B,GAAG,8BAA8B,QAAQ,IACvC,SAAS,KAAK,OACd;AAER,QAAI,SAAS,QAAW;AACtB,WAAK,KAAK;AAAA,QACR,cAAc,QAAQ,aAAa,IAAI,aAAa;AAAA,QACpD;AAAA,QACA,QAAQ,KAAK,OAAO,QAAQ;AAAA,QAC5B,YAAY;AAAA,QACZ,QAAQ;AAAA,QACV,MAAM,oBAAoB,aAAa;AAAA,MACvC,CAAC;AACD;AAAA,IACF;AAGA,UAAM,aAAiC;AAAA,MACrC,cAAc,QAAQ,aAAa,IAAI,IAAI;AAAA,MAC3C;AAAA,MACA,QAAQ,KAAK,OAAO,QAAQ;AAAA,MAC5B,YAAY;AAAA,IACd;AACA,UAAM,QAAkB,CAAC;AACzB,QAAI,iBAAkB,OAAM,KAAK,gBAAgB;AAEjD,UAAM,QAAQ,GAAG,qBAAqB,QAAQ,IAAI,SAAS,cAAc;AACzE,UAAM,aACJ,SAAS,GAAG,iBAAiB,KAAK,KAAK,MAAM,UAAU,SAAS,IAC5D,MAAM,UAAU,CAAC,IACjB;AAEN,QAAI,cAAc,GAAG,0BAA0B,UAAU,GAAG;AAC1D,YAAM,cAAc,YAAY,WAAW,YAAY,aAAa,CAAC;AACrE,UAAI,gBAAgB,OAAW,YAAW,cAAc;AAAA,UACnD,OAAM,KAAK,qCAAqC;AAErD,UAAI,SAAS,UAAU;AACrB,cAAM,SAAS,YAAY,WAAW,YAAY,QAAQ,CAAC;AAC3D,YAAI,WAAW,OAAW,YAAW,SAAS;AAAA,YACzC,OAAM,KAAK,gCAAgC;AAAA,MAClD;AACA,UAAI,UAAU,UAAU,EAAG,OAAM,KAAK,uCAAuC;AAAA,IAC/E,OAAO;AACL,YAAM;AAAA,QACJ,QACI,qBAAqB,kBAAkB,KAAK,CAAC,KAC7C;AAAA,MACN;AAAA,IACF;AAEA,QAAI,MAAM,SAAS,GAAG;AACpB,iBAAW,aAAa;AACxB,iBAAW,OAAO,MAAM,KAAK,IAAI;AAAA,IACnC;AACA,SAAK,KAAK,UAAU;AAAA,EACtB;AACF;AAEA,SAAS,UACP,MACA,MACA,QACA,SACA,UACA,WACM;AACN,QAAM,SAAS,WAAW,MAAM,OAAO;AACvC,MAAI,WAAW,QAAW;AAKxB,UAAM,SAAS,GAAG,0BAA0B,KAAK,UAAU,IACvD,KAAK,WAAW,aAChB;AACJ,QAAI,UAAU,GAAG,aAAa,MAAM,KAAK,QAAQ,WAAW,IAAI,OAAO,IAAI,GAAG;AAC5E,WAAK,KAAK;AAAA,QACR,cAAc;AAAA,QACd,MAAM;AAAA,QACN,QAAQ,KAAK,OAAO,IAAI;AAAA,QACxB,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,uCAAuC,OAAO,IAAI;AAAA,MAC1D,CAAC;AAAA,IACH;AACA;AAAA,EACF;AAEA,MAAI,eAAe,IAAI,MAAM,GAAG;AAM9B,SAAK,KAAK;AAAA,MACR,cAAc;AAAA,MACd,MAAM,WAAW,mBAAmB,WAAW;AAAA,MAC/C,QAAQ,KAAK,OAAO,IAAI;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,MAAM,GAAG,MAAM;AAAA,IACjB,CAAC;AACD;AAAA,EACF;AAEA,MAAI,WAAW,uBAAuB,WAAW,WAAY;AAC7D,QAAM,WAAW,KAAK,UAAU,CAAC;AACjC,MAAI,CAAC,SAAU;AAEf,QAAM,WAAW,iBAAiB,UAAU,MAAM;AAClD,MAAI,CAAC,SAAS,QAAQ;AACpB,SAAK,KAAK;AAAA,MACR,cAAc;AAAA,MACd,MAAM;AAAA,MACN,QAAQ,KAAK,OAAO,IAAI;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,MAAM,GAAG,MAAM,mCAAmC,SAAS,IAAI;AAAA,IACjE,CAAC;AACD;AAAA,EACF;AAEA,QAAM,SAAS,SAAS;AACxB,QAAM,WAAW,WAAW,QAAQ,MAAM;AAC1C,QAAM,OAAO,YAAY,QAAQ;AACjC,MAAI,SAAS,QAAW;AAItB,QAAI,WAAW,cAAc,aAAa,OAAW;AAMrD,UAAM,OACJ,aAAa,YAAY,GAAG,aAAa,QAAQ,IAC7C,cAAc,SAAS,MAAM,UAAU,EAAE,IACzC;AACN,QAAI,QAAQ,WAAW,MAAM;AAC3B,eAAS,KAAK,EAAE,QAAQ,QAAQ,MAAM,aAAa,UAAU,MAAM,MAAM,MAAM,KAAK,CAAC;AACrF;AAAA,IACF;AAEA,SAAK,KAAK;AAAA,MACR,cAAc;AAAA,MACd,MAAM;AAAA,MACN,QAAQ,KAAK,OAAO,IAAI;AAAA,MACxB,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AACD;AAAA,EACF;AAKA,QAAM,mBAAmB,UAAU,MAAM,IACrC,sFACA;AAaJ,aAAW,YAAY,OAAO,YAAY;AACxC,QAAI,CAAC,GAAG,mBAAmB,QAAQ,EAAG;AACtC,UAAM,OAAO,WAAW,SAAS,YAAY,MAAM;AACnD,QAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,QAAQ,kBAAkB,SAAS,GAAiC,CAAC,GAAG;AAC9F;AAAA,IACF;AACA,SAAK,KAAK;AAAA,MACR,cAAc,QAAQ,IAAI,IAAI,aAAa;AAAA,MAC3C,MAAM;AAAA,MACN,QAAQ,KAAK,OAAO,QAAQ;AAAA,MAC5B,YAAY;AAAA,MACZ,QAAQ;AAAA,MACR,MAAM,OACF,IAAI,IAAI,aAAa,kBAAkB,SAAS,UAAU,CAAC,yBAAyB,KACjF,OAAO,CAAC,QAAQ,kBAAkB,SAAS,GAAiC,CAAC,EAC7E,KAAK,KAAK,CAAC,kCACd,IAAI,IAAI,aAAa,kBAAkB,SAAS,UAAU,CAAC;AAAA,IACjE,CAAC;AAAA,EACH;AAEA;AAAA,IACE,WAAW,QAAQ,cAAc;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA;AAAA,IACE,WAAW,QAAQ,SAAS;AAAA,IAC5B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAqDA,SAAS,aAAa,MAAoD;AACxE,MACE,GAAG,sBAAsB,IAAI,KAC7B,GAAG,qBAAqB,IAAI,KAC5B,GAAG,gBAAgB,IAAI,KACvB,GAAG,oBAAoB,IAAI,GAC3B;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAWA,SAAS,cACP,MACA,IACkD;AAClD,aAAW,CAAC,OAAO,SAAS,KAAK,GAAG,WAAW,QAAQ,GAAG;AACxD,QAAI,GAAG,aAAa,UAAU,IAAI,GAAG;AACnC,UAAI,UAAU,KAAK,SAAS,KAAM,QAAO,EAAE,MAAM;AACjD;AAAA,IACF;AACA,QAAI,GAAG,uBAAuB,UAAU,IAAI,GAAG;AAC7C,iBAAW,WAAW,UAAU,KAAK,UAAU;AAC7C,YAAI,CAAC,GAAG,aAAa,QAAQ,IAAI,KAAK,QAAQ,KAAK,SAAS,KAAM;AAElE,cAAM,WACJ,QAAQ,gBAAgB,GAAG,aAAa,QAAQ,YAAY,IACxD,QAAQ,aAAa,OACrB;AACN,eAAO,EAAE,OAAO,SAAS;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAiBA,SAAS,aACP,MACA,SACA,iBACS;AACT,QAAM,SAAS,KAAK,KAAK;AACzB,MAAI,CAAC,GAAG,aAAa,MAAM,KAAK,OAAO,SAAS,QAAQ,YAAa,QAAO;AAE5E,MAAI,KAAK,OAAO,aAAa,QAAQ,OAAO,UAAU;AAGpD,WAAO;AAAA,EACT;AAEA,aAAW,aAAa,KAAK,OAAO,YAAY;AAC9C,QAAI,CAAC,GAAG,oBAAoB,SAAS,EAAG;AACxC,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,OAAQ;AAEb,UAAM,QACJ,OAAO,MAAM,SAAS,QAAQ,eAC7B,OAAO,iBACN,GAAG,eAAe,OAAO,aAAa,KACtC,OAAO,cAAc,SAAS,KAAK,CAAC,YAAY,QAAQ,KAAK,SAAS,QAAQ,WAAW;AAC7F,QAAI,CAAC,MAAO;AACZ,QAAI,CAAC,GAAG,gBAAgB,UAAU,eAAe,EAAG;AAEpD,UAAM,WAAW,GAAG;AAAA,MAClB,UAAU,gBAAgB;AAAA,MAC1B,KAAK,OAAO;AAAA,MACZ;AAAA,MACA,GAAG;AAAA,IACL,EAAE;AACF,QAAI,UAAU,qBAAqB,QAAQ,OAAO,SAAU,QAAO;AAAA,EACrE;AACA,SAAO;AACT;AAUA,SAAS,eAAe,MAAe,QAA+B;AACpE,SAAO,KAAK,QAAQ,MAAM,EAAE,QAAQ,QAAQ,GAAG,EAAE,KAAK;AACxD;AAUA,SAAS,aAAa,QAAuB,MAA6B;AACxE,QAAM,SAAmB,CAAC;AAC1B,MAAI,gBAAgB;AACpB,MAAI;AAEJ,WAAS,SAAS,KAAK,QAAQ,UAAU,WAAW,QAAQ,SAAS,OAAO,QAAQ;AAClF,QAAI,CAAC,iBAAiB,GAAG,iBAAiB,MAAM,GAAG;AACjD,sBAAgB,eAAe,QAAQ,MAAM;AAAA,IAC/C;AACA,UAAM,SACH,GAAG,sBAAsB,MAAM,KAAK,GAAG,oBAAoB,MAAM,MAClE,OAAO,SACN,GAAG,aAAa,OAAO,IAAI,KAAK,GAAG,gBAAgB,OAAO,IAAI,KAC3D,OAAO,KAAK,OACZ,GAAG,sBAAsB,MAAM,KAAK,GAAG,aAAa,OAAO,IAAI,IAC7D,OAAO,KAAK,OACZ;AACR,QAAI,UAAU,QAAW;AACvB,aAAO,KAAK,KAAK;AACjB,gBAAU;AAAA,IACZ;AAAA,EACF;AACA,SAAO,EAAE,QAAQ,OAAO,QAAQ,GAAG,eAAe,OAAO,SAAS,OAAO;AAC3E;AAUA,SAAS,WAAW,OAAgB,MAAe,QAA+B;AAChF,QAAM,OAAO,eAAe,MAAM,MAAM;AACxC,QAAM,QAAQ,KAAK,SAAS,MAAM;AAClC,MAAI,OAAO;AACX,QAAM,QAAQ,CAAC,cAA6B;AAC1C,QACE,UAAU,SAAS,KAAK,QACxB,UAAU,SAAS,MAAM,IAAI,SAC7B,eAAe,WAAW,MAAM,MAAM,MACtC;AACA,cAAQ;AAAA,IACV;AACA,OAAG,aAAa,WAAW,KAAK;AAAA,EAClC;AACA,KAAG,aAAa,OAAO,KAAK;AAC5B,SAAO;AACT;AAmBA,SAAS,WAAW,QAAuB,MAAuB;AAChE,QAAM,EAAE,QAAQ,eAAe,MAAM,IAAI,aAAa,QAAQ,IAAI;AAClE,SAAO,WAAW,QAAQ,EACvB;AAAA,IACC,GAAG,OAAO,KAAK,GAAG,CAAC,KAAK,aAAa,KAAK,eAAe,MAAM,MAAM,CAAC,KAAK;AAAA,MACzE;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,EACC,OAAO,KAAK,EACZ,MAAM,GAAG,EAAE;AAChB;AAEA,IAAM,mBAAmB,oBAAI,IAAgC;AAE7D,SAAS,eAAe,MAAkC;AACxD,MAAI,MAAM,QAAQ,IAAI;AACtB,aAAS;AACP,QAAI,iBAAiB,IAAI,GAAG,EAAG,QAAO,iBAAiB,IAAI,GAAG;AAC9D,UAAM,cAAcC,MAAK,KAAK,cAAc;AAC5C,QAAIF,YAAW,WAAW,GAAG;AAC3B,UAAI;AACJ,UAAI;AACF,cAAM,SAAS,KAAK,MAAMC,cAAa,aAAa,MAAM,CAAC;AAC3D,YAAI,OAAO,OAAO,SAAS,SAAU,QAAO,OAAO;AAAA,MACrD,QAAQ;AAAA,MAER;AACA,uBAAiB,IAAI,KAAK,IAAI;AAC9B,aAAO;AAAA,IACT;AACA,UAAM,SAAS,QAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK,QAAO;AAC3B,UAAM;AAAA,EACR;AACF;AAEA,IAAM,0BAA0B,oBAAI,IAAI;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,6BAA6B,MAAuB;AAC3D,SAAO,wBAAwB,IAAI,eAAe,IAAI,KAAK,EAAE;AAC/D;AAMO,SAAS,oBAAoB,SAA8C;AAChF,QAAM,OAAO,QAAQ,QAAQ,IAAI;AACjC,QAAM,eAAe,QAAQ,WACzB,WAAW,QAAQ,QAAQ,IACzB,QAAQ,WACRC,MAAK,MAAM,QAAQ,QAAQ,IAC7B,aAAa,IAAI;AAErB,MAAI,CAAC,gBAAgB,CAACF,YAAW,YAAY,GAAG;AAC9C,UAAM,IAAI;AAAA,MACR,+BAA+B,IAAI;AAAA,IAErC;AAAA,EACF;AAEA,QAAM,EAAE,WAAW,SAAS,gBAAgB,IAAI,iBAAiB,YAAY;AAC7E,QAAM,UAAU,GAAG,cAAc,WAAW,eAAe;AAE3D,QAAM,eAAqC,CAAC;AAC5C,MAAI,gBAAgB;AAEpB,MAAI,mBAAmB;AAKvB,QAAM,WAA8B,CAAC;AACrC,QAAM,cAAc,oBAAI,IAAwB;AAEhD,aAAW,UAAU,QAAQ,eAAe,GAAG;AAC7C,QAAI,OAAO,kBAAmB;AAC9B,QAAI,OAAO,SAAS,SAAS,gBAAgB,EAAG;AAKhD,QAAI,CAAC,SAAS,MAAM,OAAO,QAAQ,KAAK,6BAA6B,OAAO,QAAQ,GAAG;AACrF,0BAAoB;AACpB;AAAA,IACF;AACA,qBAAiB;AAEjB,UAAM,OAAgB;AAAA,MACpB,MAAM,CAAC,eAAe,aAAa,KAAK,UAAU;AAAA,MAClD,QAAQ,CAAC,UAAU;AAAA,QACjB,MAAM,SAAS,MAAM,OAAO,QAAQ;AAAA,QACpC,MAAM,OAAO,8BAA8B,KAAK,SAAS,MAAM,CAAC,EAAE,OAAO;AAAA,QACzE,MAAM,WAAW,QAAQ,IAAI;AAAA,MAC/B;AAAA,IACF;AAGA,UAAM,UAAU,sBAAsB,MAAM;AAC5C,eAAW,WAAW,2BAA2B,QAAQ,OAAO,GAAG;AACjE,WAAK,KAAK;AAAA,QACR,cAAc;AAAA,QACd,MAAM;AAAA,QACN,QAAQ,KAAK,OAAO,QAAQ,IAAI;AAAA,QAChC,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,MAAM,GAAG,QAAQ,IAAI,8BAA8B,QAAQ,QAAQ;AAAA,MACrE,CAAC;AAAA,IACH;AAEA,QAAI;AACJ,UAAM,QAAQ,CAAC,MAAe,cAAwC;AACpE,YAAM,KAAK,aAAa,IAAI;AAC5B,UAAI,IAAI;AAGN,cAAM,QAAQ,GAAG,sBAAsB,IAAI,KAAK,KAAK,OAAO,KAAK,KAAK,OAAO;AAC7E,oBAAY,EAAE,IAAI,GAAI,QAAQ,EAAE,MAAM,MAAM,IAAI,CAAC,EAAG;AACpD,sBAAc;AAAA,MAChB,WAAW,GAAG,sBAAsB,IAAI,KAAK,GAAG,aAAa,KAAK,IAAI,GAAG;AACvE,sBAAc,KAAK,KAAK;AAAA,MAC1B;AAEA,UAAI,GAAG,iBAAiB,IAAI,GAAG;AAC7B,kBAAU,MAAM,MAAM,QAAQ,SAAS,UAAU,SAAS;AAG1D,YAAI,GAAG,aAAa,KAAK,UAAU,GAAG;AACpC,gBAAM,OAAO,KAAK,WAAW;AAC7B,gBAAM,QAAQ,YAAY,IAAI,IAAI,KAAK,CAAC;AACxC,gBAAM,KAAK,EAAE,MAAM,MAAM,OAAO,CAAC;AACjC,sBAAY,IAAI,MAAM,KAAK;AAAA,QAC7B;AAAA,MACF;AACA,SAAG,aAAa,MAAM,CAAC,UAAU,MAAM,OAAO,SAAS,CAAC;AAAA,IAC1D;AACA,UAAM,MAAM;AAAA,EACd;AAMA,aAAW,WAAW,UAAU;AAC9B,UAAM,SAAS,YAAY,IAAI,QAAQ,WAAW,KAAK,CAAC,GAAG;AAAA,MAAO,CAAC,SACjE,aAAa,MAAM,SAAS,eAAe;AAAA,IAC7C;AAEA,UAAM,QAAQ,oBAAI,IAA+B;AACjD,UAAM,UAAsB,CAAC;AAC7B,eAAW,QAAQ,OAAO;AACxB,YAAM,WAAW,KAAK,KAAK,UAAU,QAAQ,KAAK,KAAK;AACvD,YAAM,QACJ,QAAQ,KAAK,YAAY,YAAY,GAAG,0BAA0B,QAAQ,IACtE,WAAW,UAAU,QAAQ,KAAK,QAAQ,IAC1C;AACN,YAAM,OAAO,QAAQ,YAAY,KAAK,IAAI;AAC1C,UAAI,SAAS,OAAW,OAAM,IAAI,MAAM,KAAK,IAAI;AAAA,UAC5C,SAAQ,KAAK,IAAI;AAAA,IACxB;AAKA,eAAW,QAAQ,CAAC,GAAG,MAAM,KAAK,CAAC,EAAE,KAAK,GAAG;AAC3C,YAAM,mBAAmB,UAAU,QAAQ,MAAM,IAC7C,sFACA;AACJ,iBAAW,CAAC,OAAO,IAAI,KAAK;AAAA,QAC1B,CAAC,gBAAgB,aAAa;AAAA,QAC9B,CAAC,WAAW,QAAQ;AAAA,MACtB,GAAY;AACV;AAAA,UACE,WAAW,QAAQ,QAAQ,KAAK;AAAA,UAChC;AAAA,UACA;AAAA,UACA;AAAA,UACA,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAEA,QAAI,MAAM,SAAS,KAAK,QAAQ,SAAS,GAAG;AAG1C,cAAQ,KAAK,KAAK;AAAA,QAChB,cAAc;AAAA,QACd,MAAM;AAAA,QACN,QAAQ,QAAQ,KAAK,OAAO,QAAQ,IAAI;AAAA,QACxC,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,MACE,MAAM,SAAS,IACX,8BAA8B,QAAQ,WAAW,uEACjD,8BAA8B,QAAQ,WAAW,OAAO,MAAM,IAAI,aAChE,MAAM,SAAS,IAAI,KAAK,GAC1B,cAAc,QAAQ,MAAM,QAAQ,QAAQ,WAAW,IAAI,OAAO,EAAE;AAAA,MAC5E,CAAC;AAAA,IACH;AAAA,EACF;AAEA,eAAa;AAAA,IACX,CAAC,GAAG,MACF,EAAE,aAAa,cAAc,EAAE,YAAY,KAC3C,EAAE,OAAO,KAAK,cAAc,EAAE,OAAO,IAAI,KACzC,EAAE,OAAO,OAAO,EAAE,OAAO;AAAA,EAC7B;AAEA,SAAO;AAAA,IACL;AAAA,IACA,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,EACV;AACF;AAGA,SAAS,SAAS,MAAc,MAAuB;AACrD,QAAM,MAAM,SAAS,MAAM,IAAI;AAC/B,SAAO,QAAQ,MAAM,CAAC,IAAI,WAAW,IAAI,KAAK,CAAC,WAAW,GAAG;AAC/D;AAGO,SAAS,YAAY,WAA6C;AACvE,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,cAAc,UAAU,cAAc;AAC/C,QAAI,WAAW,eAAe,aAAc;AAC5C,QAAI,WAAW,aAAa,SAAS,aAAa,EAAG;AACrD,QAAI,IAAI,WAAW,YAAY;AAAA,EACjC;AACA,SAAO;AACT;AAEO,SAAS,WAAW,WAAsD;AAC/E,SAAO,UAAU,aAAa,OAAO,CAAC,eAAe,WAAW,eAAe,YAAY;AAC7F;","names":["existsSync","readFileSync","join"]}