@cejel/cejel 0.1.8 → 0.1.9

package/dist/index.js

@@ -2,6 +2,7 @@
 import {
   WitanReportSchema,
   createWitanAttestation,
+  external_exports,
   formatExternalSourceLine,
   renderWitanBadgeEndpoint,
   renderWitanBadgeSvg,
@@ -9,14 +10,3476 @@ import {
   runCejelScan,
   serializeWitanReport,
   verifyWitanAttestationBinding
-} from "./chunk-SFEPABAX.js";
+} from "./chunk-DVVBWBAA.js";
 
 // src/index.ts
-import { createHash } from "crypto";
-import { mkdirSync, readFileSync, realpathSync, writeFileSync } from "fs";
-import { join, resolve } from "path";
+import { createHash as createHash3 } from "crypto";
+import { mkdirSync, readFileSync as readFileSync2, realpathSync, writeFileSync } from "fs";
+import { join as join2, resolve as resolve3 } from "path";
 import { pathToFileURL } from "url";
 
+// src/packs/llm/detector.ts
+import { createHash } from "crypto";
+import { lstatSync as lstatSync2, readFileSync } from "fs";
+import { extname, resolve as resolve2, sep as sep2 } from "path";
+
+// src/packs/llm/lexical.ts
+function maskJavaScriptNonCode(contents) {
+  const chars = [...contents];
+  let quote = null;
+  let escaped2 = false;
+  let lineComment = false;
+  let blockComment = false;
+  for (let index = 0; index < chars.length; index += 1) {
+    const character = chars[index] ?? "";
+    const next = chars[index + 1] ?? "";
+    if (lineComment) {
+      if (character === "\n") lineComment = false;
+      else chars[index] = " ";
+      continue;
+    }
+    if (blockComment) {
+      if (character === "*" && next === "/") {
+        chars[index] = chars[index + 1] = " ";
+        blockComment = false;
+        index += 1;
+      } else if (character !== "\n") chars[index] = " ";
+      continue;
+    }
+    if (quote) {
+      if (character !== "\n") chars[index] = " ";
+      if (escaped2) escaped2 = false;
+      else if (character === "\\") escaped2 = true;
+      else if (character === quote) quote = null;
+      continue;
+    }
+    if (character === "/" && next === "/") {
+      chars[index] = chars[index + 1] = " ";
+      lineComment = true;
+      index += 1;
+    } else if (character === "/" && next === "*") {
+      chars[index] = chars[index + 1] = " ";
+      blockComment = true;
+      index += 1;
+    } else if (character === "'" || character === '"' || character === "`") {
+      chars[index] = " ";
+      quote = character;
+    }
+  }
+  return chars.join("");
+}
+function maskPythonNonCode(contents) {
+  const chars = [...contents];
+  let quote = null;
+  let triple = false;
+  let escaped2 = false;
+  let comment = false;
+  for (let index = 0; index < chars.length; index += 1) {
+    const character = chars[index] ?? "";
+    if (comment) {
+      if (character === "\n") comment = false;
+      else chars[index] = " ";
+      continue;
+    }
+    if (quote) {
+      if (character !== "\n") chars[index] = " ";
+      if (escaped2) escaped2 = false;
+      else if (character === "\\") escaped2 = true;
+      else if (triple && contents.slice(index, index + 3) === quote.repeat(3)) {
+        chars[index] = chars[index + 1] = chars[index + 2] = " ";
+        quote = null;
+        triple = false;
+        index += 2;
+      } else if (!triple && character === quote) quote = null;
+      continue;
+    }
+    if (character === "#") {
+      chars[index] = " ";
+      comment = true;
+    } else if (character === "'" || character === '"') {
+      triple = contents.slice(index, index + 3) === character.repeat(3);
+      quote = character;
+      chars[index] = " ";
+      if (triple) {
+        chars[index + 1] = chars[index + 2] = " ";
+        index += 2;
+      }
+    }
+  }
+  return chars.join("");
+}
+function isExcludedLlmSourcePath(path) {
+  const normalized = path.replaceAll("\\", "/");
+  return /(?:^|\/)(?:__tests__|test|tests|fixtures?|examples?|docs?|vendor|generated)(?:\/|$)/i.test(
+    normalized
+  ) || /\.(?:test|spec|fixture)\.[cm]?[jt]sx?$/i.test(normalized) || /(?:^|\/)(?:test_[^/]+|[^/]+_test)\.py$/i.test(normalized);
+}
+function hasUnmaskedJavaScriptMatch(contents, pattern) {
+  const masked = maskJavaScriptNonCode(contents);
+  const flags = pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`;
+  for (const match of contents.matchAll(new RegExp(pattern.source, flags))) {
+    if (match.index !== void 0 && (masked[match.index] ?? " ") !== " ") return true;
+  }
+  return false;
+}
+
+// src/packs/llm/javascript-integrations.ts
+function matchingBrace(masked, start) {
+  let depth = 0;
+  for (let index = start; index < masked.length; index += 1) {
+    if (masked[index] === "{") depth += 1;
+    if (masked[index] === "}") {
+      depth -= 1;
+      if (depth === 0) return index;
+    }
+  }
+  return masked.length;
+}
+function splitTopLevel(value, delimiter) {
+  const parts = [];
+  let start = 0;
+  let round = 0;
+  let square = 0;
+  let curly = 0;
+  for (let index = 0; index < value.length; index += 1) {
+    const character = value[index];
+    if (character === "(") round += 1;
+    else if (character === ")") round -= 1;
+    else if (character === "[") square += 1;
+    else if (character === "]") square -= 1;
+    else if (character === "{") curly += 1;
+    else if (character === "}") curly -= 1;
+    else if (character === delimiter && round === 0 && square === 0 && curly === 0) {
+      parts.push(value.slice(start, index));
+      start = index + 1;
+    }
+  }
+  parts.push(value.slice(start));
+  return parts;
+}
+function topLevelCharacter(value, sought) {
+  let round = 0;
+  let square = 0;
+  let curly = 0;
+  for (let index = 0; index < value.length; index += 1) {
+    const character = value[index];
+    if (character === "(") round += 1;
+    else if (character === ")") round -= 1;
+    else if (character === "[") square += 1;
+    else if (character === "]") square -= 1;
+    else if (character === "{") curly += 1;
+    else if (character === "}") curly -= 1;
+    else if (character === sought && round === 0 && square === 0 && curly === 0) return index;
+  }
+  return -1;
+}
+function matchingOpeningDelimiter(value, closeIndex) {
+  const close = value[closeIndex];
+  const open = close === "}" ? "{" : close === "]" ? "[" : "(";
+  let depth = 0;
+  for (let index = closeIndex; index >= 0; index -= 1) {
+    if (value[index] === close) depth += 1;
+    if (value[index] === open) {
+      depth -= 1;
+      if (depth === 0) return index;
+    }
+  }
+  return -1;
+}
+function unwrapBindingParentheses(value) {
+  let normalized = value.trim();
+  while (normalized.startsWith("(") && normalized.endsWith(")")) {
+    if (matchingOpeningDelimiter(normalized, normalized.length - 1) !== 0) break;
+    normalized = normalized.slice(1, -1).trim();
+  }
+  return normalized;
+}
+function bindingNames(pattern) {
+  const names = /* @__PURE__ */ new Set();
+  const collect = (input) => {
+    let normalized = unwrapBindingParentheses(input).trim();
+    if (normalized.startsWith("...")) normalized = normalized.slice(3).trim();
+    const defaultIndex = topLevelCharacter(normalized, "=");
+    if (defaultIndex >= 0) normalized = normalized.slice(0, defaultIndex).trim();
+    if (normalized.startsWith("[") && normalized.endsWith("]")) {
+      for (const element of splitTopLevel(normalized.slice(1, -1), ",")) collect(element);
+      return;
+    }
+    if (normalized.startsWith("{") && normalized.endsWith("}")) {
+      for (const property of splitTopLevel(normalized.slice(1, -1), ",")) {
+        const colon = topLevelCharacter(property, ":");
+        if (colon >= 0) collect(property.slice(colon + 1));
+        else collect(property);
+      }
+      return;
+    }
+    const identifier = normalized.match(/^[A-Za-z_$][\w$]*$/)?.[0];
+    if (identifier) names.add(identifier);
+  };
+  collect(pattern);
+  return names;
+}
+function parameterNames(parameters) {
+  const names = /* @__PURE__ */ new Set();
+  for (const parameter of splitTopLevel(parameters, ",")) {
+    for (const name of bindingNames(parameter)) names.add(name);
+  }
+  return names;
+}
+function destructuringAssignmentEvents(masked, beforeIndex, identifier) {
+  const events = [];
+  const prefix = masked.slice(0, beforeIndex);
+  for (let index = 0; index < prefix.length; index += 1) {
+    if (prefix[index] !== "=" || prefix[index - 1] === "=" || prefix[index + 1] === "=" || prefix[index + 1] === ">" || /[!<>+\-*/%&|^?]/.test(prefix[index - 1] ?? "")) continue;
+    let targetEnd = index - 1;
+    while (/\s/.test(prefix[targetEnd] ?? "")) targetEnd -= 1;
+    if (!["}", "]"].includes(prefix[targetEnd] ?? "")) continue;
+    const targetStart = matchingOpeningDelimiter(prefix, targetEnd);
+    if (targetStart < 0) continue;
+    const target = prefix.slice(targetStart, targetEnd + 1);
+    if (bindingNames(target).has(identifier)) {
+      events.push({ index: targetStart, expression: void 0 });
+    }
+  }
+  return events;
+}
+function functionScopes(masked) {
+  const scopes = [];
+  const patterns = [
+    /\b(?:async\s+)?function(?:\s+[A-Za-z_$][\w$]*)?\s*\(([^)]*)\)\s*\{/g,
+    /(?:\(([^()]*)\)|([A-Za-z_$][\w$]*))\s*=>\s*\{/g,
+    /\b(?:async\s+)?(?!(?:if|for|while|switch|catch|with)\b)[A-Za-z_$][\w$]*\s*\(([^)]*)\)\s*\{/g
+  ];
+  for (const pattern of patterns) {
+    for (const match of masked.matchAll(pattern)) {
+      const relativeBrace = match[0].lastIndexOf("{");
+      const bodyStart = match.index + relativeBrace;
+      scopes.push({
+        bodyStart,
+        bodyEnd: matchingBrace(masked, bodyStart),
+        parameters: parameterNames(match[1] ?? match[2] ?? "")
+      });
+    }
+  }
+  for (const match of masked.matchAll(
+    /(?:\(([^()]*)\)|([A-Za-z_$][\w$]*))\s*=>\s*(?!\{)/g
+  )) {
+    const bodyStart = match.index + match[0].length;
+    const tail = masked.slice(bodyStart);
+    const terminators = [tail.indexOf(";"), tail.indexOf("\n")].filter(
+      (index) => index >= 0
+    );
+    const bodyEnd = bodyStart + (terminators.length > 0 ? Math.min(...terminators) : tail.length);
+    scopes.push({
+      bodyStart,
+      bodyEnd,
+      parameters: parameterNames(match[1] ?? match[2] ?? "")
+    });
+  }
+  return scopes;
+}
+function importedBindings(contents) {
+  const openAiClasses = /* @__PURE__ */ new Set();
+  const anthropicClasses = /* @__PURE__ */ new Set();
+  const vercelCalls = /* @__PURE__ */ new Set();
+  const masked = maskJavaScriptNonCode(contents);
+  for (const match of contents.matchAll(
+    /import\s+([A-Za-z_$][\w$]*)\s+from\s+['"](openai|@anthropic-ai\/sdk)['"]/g
+  )) {
+    if ((masked[match.index] ?? " ") === " ") continue;
+    if (match[2] === "openai" && match[1]) openAiClasses.add(match[1]);
+    if (match[2] === "@anthropic-ai/sdk" && match[1]) anthropicClasses.add(match[1]);
+  }
+  for (const match of contents.matchAll(
+    /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\(\s*['"](openai|@anthropic-ai\/sdk)['"]\s*\)/g
+  )) {
+    if ((masked[match.index] ?? " ") === " ") continue;
+    if (match[2] === "openai" && match[1]) openAiClasses.add(match[1]);
+    if (match[2] === "@anthropic-ai/sdk" && match[1]) anthropicClasses.add(match[1]);
+  }
+  for (const match of contents.matchAll(
+    /import\s*\{([^}]+)\}\s*from\s*['"]ai['"]/g
+  )) {
+    if ((masked[match.index] ?? " ") === " ") continue;
+    for (const member of (match[1] ?? "").split(",")) {
+      const binding = member.trim().match(/^(generateText|streamText)(?:\s+as\s+([A-Za-z_$][\w$]*))?$/);
+      if (binding?.[1]) vercelCalls.add(binding[2] ?? binding[1]);
+    }
+  }
+  return { openAiClasses, anthropicClasses, vercelCalls };
+}
+function supportedJavaScriptModelCallIndices(contents) {
+  const imports = importedBindings(contents);
+  const masked = maskJavaScriptNonCode(contents);
+  const indices = /* @__PURE__ */ new Set();
+  const scopes = functionScopes(masked);
+  const innermostScopeAt = (index) => scopes.filter((scope) => scope.bodyStart < index && index < scope.bodyEnd).sort((left, right) => right.bodyStart - left.bodyStart)[0];
+  const bindingEvents = (identifier, beforeIndex) => {
+    const escaped2 = identifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const pattern = new RegExp(
+      `\\b(?:const|let|var)\\s+${escaped2}\\b(?:\\s*=\\s*(?![=>])([^;\\n]+))?|(?<![.$\\w])${escaped2}\\s*=\\s*(?![=>])([^;\\n]+)|\\b(?:function|class)\\s+${escaped2}\\b`,
+      "g"
+    );
+    const directEvents = [...masked.slice(0, beforeIndex).matchAll(pattern)].map((match) => ({
+      index: match.index,
+      expression: match[1] ?? match[2]
+    }));
+    const destructuringEvents = destructuringAssignmentEvents(masked, beforeIndex, identifier);
+    return [...directEvents, ...destructuringEvents].sort((left, right) => left.index - right.index);
+  };
+  const visibleScopeChain = (callIndex) => [
+    ...scopes.filter((scope) => scope.bodyStart < callIndex && callIndex < scope.bodyEnd).sort((left, right) => right.bodyStart - left.bodyStart),
+    void 0
+  ];
+  const latestEventInScope = (events, scope) => events.filter((event) => innermostScopeAt(event.index) === scope).at(-1);
+  const importedBindingIsVisible = (identifier, callIndex) => {
+    const events = bindingEvents(identifier, callIndex);
+    for (const scope of visibleScopeChain(callIndex)) {
+      if (scope?.parameters.has(identifier)) return false;
+      if (latestEventInScope(events, scope)) return false;
+    }
+    return true;
+  };
+  const supportedClientBinding = (receiver, classes, callIndex) => {
+    const events = bindingEvents(receiver, callIndex);
+    for (const scope of visibleScopeChain(callIndex)) {
+      if (scope?.parameters.has(receiver)) return false;
+      const event = latestEventInScope(events, scope);
+      if (!event) continue;
+      if (!event.expression) return false;
+      return [...classes].some((className) => {
+        const escapedClass = className.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        return new RegExp(`^\\s*new\\s+${escapedClass}\\s*\\(`).test(event.expression ?? "") && importedBindingIsVisible(className, event.index);
+      });
+    }
+    return false;
+  };
+  for (const match of masked.matchAll(
+    /(?:\.responses\.create|\.chat\.completions\.create|\.messages\.create|\b[A-Za-z_$][\w$]*\s*\()/g
+  )) {
+    const token = match[0];
+    if (!token) continue;
+    if (!token.startsWith(".")) {
+      const name = token.match(/^([A-Za-z_$][\w$]*)/)?.[1];
+      if (name && imports.vercelCalls.has(name) && importedBindingIsVisible(name, match.index)) {
+        indices.add(match.index);
+      }
+      continue;
+    }
+    const prefix = masked.slice(0, match.index);
+    const receiver = prefix.match(/([A-Za-z_$][\w$]*)\s*$/)?.[1];
+    const directClass = prefix.match(/new\s+([A-Za-z_$][\w$]*)\s*\(\s*\)\s*$/)?.[1];
+    if (token.startsWith(".messages.create") && (receiver && supportedClientBinding(receiver, imports.anthropicClasses, match.index) || directClass && imports.anthropicClasses.has(directClass) && importedBindingIsVisible(directClass, match.index)) || !token.startsWith(".messages.create") && (receiver && supportedClientBinding(receiver, imports.openAiClasses, match.index) || directClass && imports.openAiClasses.has(directClass) && importedBindingIsVisible(directClass, match.index))) {
+      indices.add(match.index);
+    }
+  }
+  return indices;
+}
+function hasSupportedJavaScriptModelCall(contents) {
+  return supportedJavaScriptModelCallIndices(contents).size > 0;
+}
+
+// src/packs/llm/action-rules.ts
+var MODEL_OUTPUT_PATTERN = /(?:\.output_text\b|\.choices\s*\[[^\]]+\]\s*\.message\s*\.content\b|\.content\s*\[[^\]]+\]\s*\.text\b)/;
+var IDENTIFIER_ASSIGNMENT_PATTERN = /^\s*(?:(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*=\s*(?!=)(.+)$/;
+var STRUCTURED_PARSE_PATTERN = /\bJSON\.parse\s*\(([^)]*)\)/;
+var RUNTIME_PARSE_PATTERN = /\b[A-Za-z_$][\w$]*(?:Schema|schema)\s*(?:\.strict\s*\(\s*\))?\.parse\s*\(/;
+var CONSEQUENTIAL_DISPATCH_PATTERN = /\b(?:deploy|execute|executeAction|runCommand|transferFunds|sendPayment|grantAccess|revokeAccess|updateRole|deleteFile|deleteRecord|writeFile|sendEmail|sendMessage|publish)\s*\(/;
+var TOOL_ASSIGNMENT_PATTERN = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:tool|defineTool|createTool)\s*\(/g;
+var MEMBER_TOOL_REGISTRATION_PATTERN = /\b([A-Za-z_$][\w$]*)\.registerTool\s*\(/g;
+var APPROVAL_FAIL_CLOSED_PATTERN = /if\s*\(\s*!\s*\(?\s*(?:await\s+)?(?:requestApproval|requireApproval|humanApproval|approvalGate|waitForApproval)\s*\([^)]*\)\s*\)?\s*\)\s*(?:\{\s*)?(?:throw\b|return\b)/s;
+var ALLOWLIST_FAIL_CLOSED_PATTERN = /if\s*\(\s*!\s*[A-Za-z_$][\w$]*(?:ALLOWLIST|ALLOW_LIST|ALLOWED|PERMITTED)[A-Za-z0-9_$]*\s*\.(?:includes|has)\s*\([^)]*\)\s*\)\s*(?:\{\s*)?(?:throw\b|return\b)/s;
+function isExcludedSourcePath(path) {
+  return /(?:^|\/)(?:__tests__|test|tests|fixtures?|examples?|vendor|generated)(?:\/|$)/i.test(path) || /\.(?:test|spec|fixture)\.[cm]?[jt]sx?$/i.test(path) || /(?:^|\/)(?:test_[^/]+|[^/]+_test)\.py$/i.test(path);
+}
+function maskNonCode(contents) {
+  const chars = [...contents];
+  let quote = null;
+  let escaped2 = false;
+  let lineComment = false;
+  let blockComment = false;
+  for (let index = 0; index < chars.length; index += 1) {
+    const character = chars[index] ?? "";
+    const next = chars[index + 1] ?? "";
+    if (lineComment) {
+      if (character === "\n") lineComment = false;
+      else chars[index] = " ";
+      continue;
+    }
+    if (blockComment) {
+      if (character === "*" && next === "/") {
+        chars[index] = " ";
+        chars[index + 1] = " ";
+        blockComment = false;
+        index += 1;
+      } else if (character !== "\n") chars[index] = " ";
+      continue;
+    }
+    if (quote) {
+      if (character !== "\n") chars[index] = " ";
+      if (escaped2) escaped2 = false;
+      else if (character === "\\") escaped2 = true;
+      else if (character === quote) quote = null;
+      continue;
+    }
+    if (character === "/" && next === "/") {
+      chars[index] = " ";
+      chars[index + 1] = " ";
+      lineComment = true;
+      index += 1;
+    } else if (character === "/" && next === "*") {
+      chars[index] = " ";
+      chars[index + 1] = " ";
+      blockComment = true;
+      index += 1;
+    } else if (character === "'" || character === '"' || character === "`") {
+      chars[index] = " ";
+      quote = character;
+    }
+  }
+  return chars.join("");
+}
+function lineStartDepths(contents) {
+  const masked = maskNonCode(contents);
+  const depths = [];
+  let depth = 0;
+  for (const line of masked.split("\n")) {
+    depths.push(depth);
+    for (const character of line) {
+      if (character === "{") depth += 1;
+      else if (character === "}") depth = Math.max(0, depth - 1);
+    }
+  }
+  return depths;
+}
+function lineNumberAt(contents, index) {
+  return contents.slice(0, index).split("\n").length;
+}
+function finding(ruleId, file, index, severity, summary, label, confidence) {
+  return {
+    ruleId,
+    severity,
+    confidence,
+    summary,
+    evidence: {
+      path: file.path,
+      line: lineNumberAt(file.contents, index),
+      label
+    }
+  };
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function modelOutputAliasesBeforeLines(maskedLines, depths, lineOffsets, supportedCallIndices) {
+  const aliasesByDepth = /* @__PURE__ */ new Map();
+  const snapshots = [];
+  for (let lineIndex = 0; lineIndex < maskedLines.length; lineIndex += 1) {
+    const depth = depths[lineIndex] ?? 0;
+    for (const knownDepth of aliasesByDepth.keys()) {
+      if (knownDepth > depth) aliasesByDepth.delete(knownDepth);
+    }
+    const aliases = aliasesByDepth.get(depth) ?? /* @__PURE__ */ new Set();
+    aliasesByDepth.set(depth, aliases);
+    snapshots.push(new Set(aliases));
+    const assignment = (maskedLines[lineIndex] ?? "").match(IDENTIFIER_ASSIGNMENT_PATTERN);
+    const identifier = assignment?.[1];
+    const expression = assignment?.[2];
+    if (!identifier || !expression) continue;
+    const lineStart = lineOffsets[lineIndex] ?? 0;
+    const lineHasSupportedResponseAssignment = [...supportedCallIndices].some(
+      (index) => lineStart <= index && index < lineStart + (maskedLines[lineIndex]?.length ?? 0)
+    );
+    if (lineHasSupportedResponseAssignment || expressionContainsModelOutput(expression, aliases)) aliases.add(identifier);
+    else aliases.delete(identifier);
+  }
+  return snapshots;
+}
+function expressionContainsModelOutput(expression, modelOutputAliases) {
+  const output = expression.match(MODEL_OUTPUT_PATTERN);
+  if (output?.index !== void 0) {
+    const receiver = expression.slice(0, output.index);
+    const identifier = receiver.match(/([A-Za-z_$][\w$]*)[.\[\]\w$\s]*$/)?.[1];
+    if (identifier && modelOutputAliases.has(identifier)) return true;
+  }
+  for (const alias of modelOutputAliases) {
+    if (new RegExp(`\\b${escapeRegExp(alias)}\\b`).test(expression)) return true;
+  }
+  return false;
+}
+function hasFailClosedValidation(segment, identifier) {
+  const escaped2 = escapeRegExp(identifier);
+  const explicitParse = new RegExp(
+    `\\b[A-Za-z_$][\\w$]*(?:Schema|schema)\\s*(?:\\.strict\\s*\\(\\s*\\))?\\.parse\\s*\\(\\s*${escaped2}\\s*\\)`
+  );
+  const allowlistGuard = new RegExp(
+    `if\\s*\\(\\s*!\\s*[A-Za-z_$][\\w$]*(?:ALLOWLIST|ALLOW_LIST|ALLOWED|PERMITTED)[A-Za-z0-9_$]*\\s*\\.(?:includes|has)\\s*\\(\\s*${escaped2}\\.[A-Za-z_$][\\w$]*\\s*\\)\\s*\\)\\s*(?:\\{\\s*)?(?:throw\\b|return\\b)`,
+    "s"
+  );
+  return explicitParse.test(segment) || allowlistGuard.test(segment);
+}
+function detectUnvalidatedConsequentialAction(file) {
+  if (file.path.toLowerCase().endsWith(".py")) {
+    return detectPythonUnvalidatedConsequentialAction(file);
+  }
+  if (isExcludedSourcePath(file.path)) return [];
+  const findings = [];
+  const lines = file.contents.split("\n");
+  const maskedLines = maskNonCode(file.contents).split("\n");
+  const depths = lineStartDepths(file.contents);
+  const lineOffsets = [];
+  let runningOffset = 0;
+  for (const line of maskedLines) {
+    lineOffsets.push(runningOffset);
+    runningOffset += line.length + 1;
+  }
+  const aliasesBeforeLines = modelOutputAliasesBeforeLines(
+    maskedLines,
+    depths,
+    lineOffsets,
+    supportedJavaScriptModelCallIndices(file.contents)
+  );
+  let offset = 0;
+  for (let assignmentLine = 0; assignmentLine < lines.length; assignmentLine += 1) {
+    const line = maskedLines[assignmentLine] ?? "";
+    const assignment = line.match(IDENTIFIER_ASSIGNMENT_PATTERN);
+    const identifier = assignment?.[1];
+    const expression = assignment?.[2];
+    const structuredParse = expression?.match(STRUCTURED_PARSE_PATTERN);
+    if (!identifier || !expression || !structuredParse?.[1]) {
+      offset += line.length + 1;
+      continue;
+    }
+    if (!expressionContainsModelOutput(
+      structuredParse[1],
+      aliasesBeforeLines[assignmentLine] ?? /* @__PURE__ */ new Set()
+    )) {
+      offset += line.length + 1;
+      continue;
+    }
+    if (RUNTIME_PARSE_PATTERN.test(expression)) {
+      offset += line.length + 1;
+      continue;
+    }
+    let dispatchOffset = offset + line.length + 1;
+    const assignmentDepth = depths[assignmentLine] ?? 0;
+    for (let dispatchLine = assignmentLine + 1; dispatchLine < lines.length; dispatchLine += 1) {
+      const candidate = maskedLines[dispatchLine] ?? "";
+      const candidateDepth = depths[dispatchLine] ?? 0;
+      if (candidateDepth < assignmentDepth) break;
+      if (candidateDepth !== assignmentDepth) {
+        dispatchOffset += (lines[dispatchLine] ?? "").length + 1;
+        continue;
+      }
+      const dispatch = candidate.match(CONSEQUENTIAL_DISPATCH_PATTERN);
+      const dispatchExpression = dispatch ? candidate.slice((dispatch.index ?? 0) + dispatch[0].length) : "";
+      const fieldUse = new RegExp(
+        `\\b${escapeRegExp(identifier)}\\.([A-Za-z_$][\\w$]*)\\b`
+      ).exec(dispatchExpression);
+      if (dispatch && fieldUse?.[1]) {
+        const between = maskedLines.slice(assignmentLine + 1, dispatchLine).join("\n");
+        if (!hasFailClosedValidation(between, identifier)) {
+          findings.push(
+            finding(
+              "LLM-VAL-001",
+              file,
+              dispatchOffset + (dispatch.index ?? 0),
+              "critical",
+              `Model-produced structured field ${identifier}.${fieldUse[1]} reaches a consequential dispatcher without observable runtime validation.`,
+              `Unvalidated ${identifier}.${fieldUse[1]} reaches consequential dispatch`,
+              "high"
+            )
+          );
+        }
+        break;
+      }
+      dispatchOffset += candidate.length + 1;
+    }
+    offset += line.length + 1;
+  }
+  return findings;
+}
+function pythonModelFacingToolMethods(file) {
+  if (isExcludedSourcePath(file.path)) return [];
+  const masked = maskPythonNonCode(file.contents);
+  const originalLines = file.contents.split("\n");
+  const maskedLines = masked.split("\n");
+  const offsets = [];
+  let offset = 0;
+  for (const line of originalLines) {
+    offsets.push(offset);
+    offset += line.length + 1;
+  }
+  const methods = [];
+  for (let classLine = 0; classLine < maskedLines.length; classLine += 1) {
+    const declaration = (maskedLines[classLine] ?? "").match(
+      /^(\s*)class\s+[A-Za-z_][A-Za-z0-9_]*(?:\([^)]*\))?\s*:/
+    );
+    if (!declaration) continue;
+    const classIndent = declaration[1]?.length ?? 0;
+    let classEndLine = maskedLines.length;
+    for (let later = classLine + 1; later < maskedLines.length; later += 1) {
+      const candidate = maskedLines[later] ?? "";
+      if (candidate.trim().length === 0) continue;
+      const indentation = candidate.match(/^\s*/)?.[0].length ?? 0;
+      if (indentation <= classIndent) {
+        classEndLine = later;
+        break;
+      }
+    }
+    const classOffset = offsets[classLine] ?? 0;
+    const classEndOffset = offsets[classEndLine] ?? file.contents.length;
+    const classBody = file.contents.slice(classOffset, classEndOffset);
+    const classBodyMasked = masked.slice(classOffset, classEndOffset);
+    if (!/\bargs_schema\s*(?::[^=\n]+)?=/.test(classBodyMasked)) continue;
+    for (const method of classBodyMasked.matchAll(
+      /\bdef\s+_run\s*\(([\s\S]{0,1200}?)\)\s*(?:->[^:\n]+)?\s*:/g
+    )) {
+      const methodIndex = method.index ?? 0;
+      const methodLineWithinClass = classBodyMasked.slice(0, methodIndex).split("\n").length - 1;
+      const methodLine = classLine + methodLineWithinClass;
+      const methodDeclarationLines = method[0].split("\n").length;
+      const methodDeclarationLine = maskedLines[methodLine] ?? "";
+      const methodIndent = methodDeclarationLine.match(/^\s*/)?.[0].length ?? 0;
+      let methodEndLine = classEndLine;
+      for (let later = methodLine + methodDeclarationLines; later < classEndLine; later += 1) {
+        const candidate = maskedLines[later] ?? "";
+        if (candidate.trim().length === 0) continue;
+        const indentation = candidate.match(/^\s*/)?.[0].length ?? 0;
+        if (indentation <= methodIndent) {
+          methodEndLine = later;
+          break;
+        }
+      }
+      const bodyOffset = offsets[methodLine] ?? classOffset + methodIndex;
+      const bodyEndOffset = offsets[methodEndLine] ?? classEndOffset;
+      const parameters = /* @__PURE__ */ new Set();
+      for (const parameter of (method[1] ?? "").split(",")) {
+        const identifier = parameter.trim().match(/^([A-Za-z_][A-Za-z0-9_]*)/)?.[1];
+        if (identifier && identifier !== "self") parameters.add(identifier);
+      }
+      methods.push({
+        constraintScope: classBody,
+        body: file.contents.slice(bodyOffset, bodyEndOffset),
+        bodyMasked: masked.slice(bodyOffset, bodyEndOffset),
+        bodyOffset,
+        parameters
+      });
+    }
+  }
+  return methods;
+}
+function pythonToolExecution(method) {
+  for (const invocation of method.bodyMasked.matchAll(
+    /\b[A-Za-z_][A-Za-z0-9_.]*\.invoke\s*\(/g
+  )) {
+    const openParen = (invocation.index ?? 0) + invocation[0].lastIndexOf("(");
+    const end = matchingCallEnd(method.body, openParen);
+    if (end === null) continue;
+    const call = method.body.slice(invocation.index, end);
+    if (!/\bmethod\s*=\s*['"][^'"]*execute[_-]?code[^'"]*['"]/i.test(call)) {
+      continue;
+    }
+    for (const parameter of method.parameters) {
+      if (!/^code$/i.test(parameter)) continue;
+      const escaped2 = escapeRegExp(parameter);
+      if (!new RegExp(`['"][A-Za-z_][A-Za-z0-9_]*['"]\\s*:\\s*${escaped2}\\b`).test(call)) {
+        continue;
+      }
+      const constrainedAnnotation = new RegExp(
+        `\\b${escaped2}\\s*:\\s*(?:Literal|Enum|Annotated)\\s*\\[`
+      );
+      const localValidator = new RegExp(
+        `\\bfield_validator\\s*\\(\\s*['"]${escaped2}['"]`
+      );
+      if (constrainedAnnotation.test(method.body) || localValidator.test(method.constraintScope)) {
+        continue;
+      }
+      return {
+        // The defect is introduced at the model-facing input declaration; the downstream
+        // dispatcher merely demonstrates consequence. Anchoring the finding here also avoids
+        // implying that every later invocation in the same toolkit is a separate defect.
+        index: method.bodyOffset,
+        parameter
+      };
+    }
+  }
+  return null;
+}
+function detectPythonUnvalidatedConsequentialAction(file) {
+  const findings = [];
+  for (const method of pythonModelFacingToolMethods(file)) {
+    const execution = pythonToolExecution(method);
+    if (!execution) continue;
+    findings.push(
+      finding(
+        "LLM-VAL-001",
+        file,
+        execution.index,
+        "critical",
+        `A model-facing structured tool parameter reaches a supported execution dispatcher without an observable closed constraint.`,
+        `Unconstrained structured field ${execution.parameter} reaches execution dispatch`,
+        "high"
+      )
+    );
+  }
+  return findings;
+}
+function hasConsequentialStructuredActionSurface(file) {
+  if (file.path.toLowerCase().endsWith(".py")) {
+    return pythonModelFacingToolMethods(file).some(
+      (method) => pythonToolExecution(method) !== null
+    );
+  }
+  if (isExcludedSourcePath(file.path)) return false;
+  const maskedLines = maskNonCode(file.contents).split("\n");
+  const depths = lineStartDepths(file.contents);
+  const lineOffsets = [];
+  let runningOffset = 0;
+  for (const line of maskedLines) {
+    lineOffsets.push(runningOffset);
+    runningOffset += line.length + 1;
+  }
+  const aliasesBeforeLines = modelOutputAliasesBeforeLines(
+    maskedLines,
+    depths,
+    lineOffsets,
+    supportedJavaScriptModelCallIndices(file.contents)
+  );
+  for (let lineIndex = 0; lineIndex < maskedLines.length; lineIndex += 1) {
+    const assignment = (maskedLines[lineIndex] ?? "").match(IDENTIFIER_ASSIGNMENT_PATTERN);
+    const expression = assignment?.[2];
+    const parsed = expression?.match(STRUCTURED_PARSE_PATTERN)?.[1];
+    if (!parsed || !expressionContainsModelOutput(parsed, aliasesBeforeLines[lineIndex] ?? /* @__PURE__ */ new Set())) {
+      continue;
+    }
+    const depth = depths[lineIndex] ?? 0;
+    for (let later = lineIndex + 1; later < maskedLines.length; later += 1) {
+      const laterDepth = depths[later] ?? 0;
+      if (laterDepth < depth) break;
+      if (laterDepth === depth && CONSEQUENTIAL_DISPATCH_PATTERN.test(maskedLines[later] ?? "")) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function matchingCallEnd(contents, openParen) {
+  let depth = 0;
+  let quote = null;
+  let escaped2 = false;
+  let lineComment = false;
+  let blockComment = false;
+  for (let index = openParen; index < contents.length; index += 1) {
+    const character = contents[index] ?? "";
+    const next = contents[index + 1] ?? "";
+    if (lineComment) {
+      if (character === "\n") lineComment = false;
+      continue;
+    }
+    if (blockComment) {
+      if (character === "*" && next === "/") {
+        blockComment = false;
+        index += 1;
+      }
+      continue;
+    }
+    if (quote) {
+      if (escaped2) {
+        escaped2 = false;
+      } else if (character === "\\") {
+        escaped2 = true;
+      } else if (character === quote) {
+        quote = null;
+      }
+      continue;
+    }
+    if (character === "/" && next === "/") {
+      lineComment = true;
+      index += 1;
+      continue;
+    }
+    if (character === "/" && next === "*") {
+      blockComment = true;
+      index += 1;
+      continue;
+    }
+    if (character === "'" || character === '"' || character === "`") {
+      quote = character;
+      continue;
+    }
+    if (character === "(") depth += 1;
+    if (character === ")") {
+      depth -= 1;
+      if (depth === 0) return index + 1;
+    }
+  }
+  return null;
+}
+function isToolExposed(contents, maskedContents, toolName, afterIndex) {
+  const escaped2 = escapeRegExp(toolName);
+  const remainder = maskedContents.slice(afterIndex);
+  const supportedCalls = supportedJavaScriptModelCallIndices(contents);
+  for (const match of remainder.matchAll(new RegExp(
+    `\\b(?:generateText|streamText)\\s*\\([\\s\\S]{0,2000}?\\btools\\s*:\\s*\\{[^}]*\\b${escaped2}\\b`,
+    "gs"
+  ))) {
+    if (supportedCalls.has(afterIndex + match.index)) return true;
+  }
+  return false;
+}
+var OBSERVABLE_SIDE_EFFECT_EXPORTS = {
+  fs: /* @__PURE__ */ new Set([
+    "appendFile",
+    "appendFileSync",
+    "rename",
+    "renameSync",
+    "rm",
+    "rmSync",
+    "unlink",
+    "unlinkSync",
+    "writeFile",
+    "writeFileSync"
+  ]),
+  child_process: /* @__PURE__ */ new Set(["execFile", "execFileSync", "spawn", "spawnSync"])
+};
+function observableSideEffectBindings(contents, maskedContents) {
+  const direct = /* @__PURE__ */ new Set();
+  const namespaces = /* @__PURE__ */ new Map();
+  const namedImport = /\bimport\s*\{([^}]*)\}\s*from\s*(['"])(?:node:)?(fs|child_process)\2/g;
+  for (const match of contents.matchAll(namedImport)) {
+    if ((maskedContents[match.index] ?? " ") === " ") continue;
+    const exports = match[3] ? OBSERVABLE_SIDE_EFFECT_EXPORTS[match[3]] : void 0;
+    if (!exports) continue;
+    for (const specifier of (match[1] ?? "").split(",")) {
+      const binding = specifier.trim().match(/^([A-Za-z_$][\w$]*)(?:\s+as\s+([A-Za-z_$][\w$]*))?$/);
+      const imported = binding?.[1];
+      const local = binding?.[2] ?? imported;
+      if (imported && local && exports.has(imported)) direct.add(local);
+    }
+  }
+  const namespaceImport = /\bimport\s*\*\s*as\s*([A-Za-z_$][\w$]*)\s*from\s*(['"])(?:node:)?(fs|child_process)\2/g;
+  for (const match of contents.matchAll(namespaceImport)) {
+    if ((maskedContents[match.index] ?? " ") === " ") continue;
+    const namespace = match[1];
+    const exports = match[3] ? OBSERVABLE_SIDE_EFFECT_EXPORTS[match[3]] : void 0;
+    if (namespace && exports) namespaces.set(namespace, exports);
+  }
+  return { direct, namespaces };
+}
+function observableSideEffectIndex(declaration, bindings, helperNames = /* @__PURE__ */ new Set()) {
+  let earliest = null;
+  const consider = (index) => {
+    if (earliest === null || index < earliest) earliest = index;
+  };
+  for (const binding of bindings.direct) {
+    const match = new RegExp(`\\b${escapeRegExp(binding)}\\s*\\(`).exec(declaration);
+    if (match) consider(match.index);
+  }
+  for (const [namespace, exports] of bindings.namespaces) {
+    const operations = [...exports].map(escapeRegExp).join("|");
+    const match = new RegExp(
+      `\\b${escapeRegExp(namespace)}\\s*\\.\\s*(?:${operations})\\s*\\(`
+    ).exec(declaration);
+    if (match) consider(match.index);
+  }
+  for (const helperName of helperNames) {
+    const match = new RegExp(`\\b${escapeRegExp(helperName)}\\s*\\(`).exec(declaration);
+    if (match) consider(match.index);
+  }
+  return earliest;
+}
+function dynamicOperationSelector(declaration) {
+  const field = /\b(action|operation)\s*:\s*Type\.(?:String|Union|Literal)\s*\(/i.exec(
+    declaration
+  );
+  const name = field?.[1];
+  if (!name) return null;
+  const use = new RegExp(`\\bparams\\.${escapeRegExp(name)}\\b`, "i").exec(declaration);
+  if (!use) return null;
+  return { name, index: field.index };
+}
+function matchingBraceEnd(contents, openBrace) {
+  let depth = 0;
+  for (let index = openBrace; index < contents.length; index += 1) {
+    const character = contents[index];
+    if (character === "{") depth += 1;
+    else if (character === "}") {
+      depth -= 1;
+      if (depth === 0) return index + 1;
+    }
+  }
+  return null;
+}
+function localSideEffectHelpers(maskedContents, bindings) {
+  const helpers = /* @__PURE__ */ new Map();
+  for (const declaration of maskedContents.matchAll(
+    /\bfunction\s+([A-Za-z_$][\w$]*)\s*\([^)]*\)\s*(?::[^{\n]+)?\s*\{/g
+  )) {
+    const name = declaration[1];
+    if (!name) continue;
+    const openBrace = (declaration.index ?? 0) + declaration[0].lastIndexOf("{");
+    const end = matchingBraceEnd(maskedContents, openBrace);
+    if (end === null) continue;
+    const body = maskedContents.slice(openBrace + 1, end - 1);
+    const previous = helpers.get(name) ?? { declarations: 0, sideEffecting: false };
+    helpers.set(name, {
+      declarations: previous.declarations + 1,
+      sideEffecting: previous.sideEffecting || observableSideEffectIndex(body, bindings) !== null
+    });
+  }
+  return new Set(
+    [...helpers].filter(([, value]) => value.declarations === 1 && value.sideEffecting).map(([name]) => name)
+  );
+}
+function importedApiParameterScopes(contents, maskedContents) {
+  const importedTypes = /* @__PURE__ */ new Set();
+  for (const declaration of contents.matchAll(
+    /\bimport\s+(?:type\s+)?\{([^}]+)\}\s+from\s+['"]([^.'"][^'"]*)['"]/g
+  )) {
+    if ((maskedContents[declaration.index] ?? " ") === " ") continue;
+    for (const member of (declaration[1] ?? "").split(",")) {
+      const binding = member.trim().match(
+        /^(?:type\s+)?([A-Za-z_$][\w$]*)(?:\s+as\s+([A-Za-z_$][\w$]*))?$/
+      );
+      const local = binding?.[2] ?? binding?.[1];
+      if (local) importedTypes.add(local);
+    }
+  }
+  const scopes = [];
+  for (const declaration of maskedContents.matchAll(
+    /\bfunction(?:\s+[A-Za-z_$][\w$]*)?\s*\(([^)]*)\)\s*(?::[^{\n]+)?\s*\{/g
+  )) {
+    const openBrace = (declaration.index ?? 0) + declaration[0].lastIndexOf("{");
+    const end = matchingBraceEnd(maskedContents, openBrace);
+    if (end === null) continue;
+    for (const parameter of (declaration[1] ?? "").split(",")) {
+      const binding = parameter.trim().match(
+        /^([A-Za-z_$][\w$]*)\s*:\s*([A-Za-z_$][\w$]*)\b/
+      );
+      const receiver = binding?.[1];
+      const typeName = binding?.[2];
+      if (receiver && typeName && importedTypes.has(typeName)) {
+        scopes.push({ receiver, start: openBrace + 1, end: end - 1 });
+      }
+    }
+  }
+  return scopes;
+}
+function memberToolRegistrations(contents, maskedContents) {
+  const apiParameterScopes = importedApiParameterScopes(contents, maskedContents);
+  const registrations = [];
+  for (const registration of maskedContents.matchAll(MEMBER_TOOL_REGISTRATION_PATTERN)) {
+    const receiver = registration[1];
+    const registrationIndex = registration.index ?? 0;
+    if (!receiver || !apiParameterScopes.some(
+      (scope) => scope.receiver === receiver && registrationIndex >= scope.start && registrationIndex < scope.end
+    )) {
+      continue;
+    }
+    const openParen = (registration.index ?? 0) + registration[0].lastIndexOf("(");
+    const end = matchingCallEnd(maskedContents, openParen);
+    if (end === null) continue;
+    registrations.push({
+      receiver,
+      index: registrationIndex,
+      end,
+      declaration: maskedContents.slice(registration.index, end)
+    });
+  }
+  return registrations;
+}
+function registeredToolSideEffectSurface(file) {
+  if (isExcludedSourcePath(file.path)) return false;
+  const maskedContents = maskNonCode(file.contents);
+  const bindings = observableSideEffectBindings(file.contents, maskedContents);
+  const helpers = localSideEffectHelpers(maskedContents, bindings);
+  return memberToolRegistrations(file.contents, maskedContents).some((registration) => {
+    if (!/\b(?:execute|handler)\s*(?::|[=(])/.test(registration.declaration)) return false;
+    if (dynamicOperationSelector(registration.declaration) === null) return false;
+    const direct = observableSideEffectIndex(registration.declaration, bindings);
+    if (direct !== null) return true;
+    return observableSideEffectIndex(registration.declaration, bindings, helpers) !== null && dynamicOperationSelector(registration.declaration) !== null;
+  });
+}
+function hasSideEffectingToolSurface(file) {
+  if (isExcludedSourcePath(file.path)) return false;
+  const masked = maskNonCode(file.contents);
+  const bindings = observableSideEffectBindings(file.contents, masked);
+  for (const registration of masked.matchAll(TOOL_ASSIGNMENT_PATTERN)) {
+    const toolName = registration[1];
+    if (!toolName) continue;
+    const openParen = (registration.index ?? 0) + registration[0].lastIndexOf("(");
+    const end = matchingCallEnd(file.contents, openParen);
+    if (end === null) continue;
+    if (observableSideEffectIndex(masked.slice(registration.index, end), bindings) !== null && isToolExposed(file.contents, masked, toolName, end)) {
+      return true;
+    }
+  }
+  return registeredToolSideEffectSurface(file);
+}
+function detectSideEffectingToolWithoutAuthorityBoundary(file) {
+  if (isExcludedSourcePath(file.path)) return [];
+  const findings = [];
+  const maskedContents = maskNonCode(file.contents);
+  const sideEffectBindings = observableSideEffectBindings(file.contents, maskedContents);
+  const sideEffectHelpers = localSideEffectHelpers(maskedContents, sideEffectBindings);
+  for (const registration of maskedContents.matchAll(TOOL_ASSIGNMENT_PATTERN)) {
+    const toolName = registration[1];
+    if (!toolName) continue;
+    const openParen = (registration.index ?? 0) + registration[0].lastIndexOf("(");
+    const end = matchingCallEnd(file.contents, openParen);
+    if (end === null) continue;
+    const declaration = maskedContents.slice(registration.index, end);
+    const sideEffectIndex = observableSideEffectIndex(declaration, sideEffectBindings);
+    if (sideEffectIndex === null || !isToolExposed(file.contents, maskedContents, toolName, end)) continue;
+    const beforeSideEffect = declaration.slice(0, sideEffectIndex);
+    if (APPROVAL_FAIL_CLOSED_PATTERN.test(beforeSideEffect) || ALLOWLIST_FAIL_CLOSED_PATTERN.test(beforeSideEffect)) {
+      continue;
+    }
+    findings.push(
+      finding(
+        "LLM-AGY-001",
+        file,
+        (registration.index ?? 0) + sideEffectIndex,
+        "critical",
+        `Exposed tool ${toolName} performs a recognized side effect without an observable fail-closed allowlist or human approval gate.`,
+        `Exposed ${toolName} tool reaches side-effecting operation`,
+        "high"
+      )
+    );
+  }
+  for (const registration of memberToolRegistrations(file.contents, maskedContents)) {
+    if (!/\b(?:execute|handler)\s*(?::|[=(])/.test(registration.declaration)) continue;
+    const directSideEffectIndex = observableSideEffectIndex(
+      registration.declaration,
+      sideEffectBindings
+    );
+    const helperSideEffectIndex = directSideEffectIndex === null ? observableSideEffectIndex(
+      registration.declaration,
+      sideEffectBindings,
+      sideEffectHelpers
+    ) : null;
+    const selector = dynamicOperationSelector(registration.declaration);
+    const sideEffectIndex = directSideEffectIndex ?? helperSideEffectIndex;
+    if (sideEffectIndex === null) continue;
+    if (selector === null) continue;
+    const beforeSideEffect = registration.declaration.slice(0, sideEffectIndex);
+    if (APPROVAL_FAIL_CLOSED_PATTERN.test(beforeSideEffect) || ALLOWLIST_FAIL_CLOSED_PATTERN.test(beforeSideEffect)) {
+      continue;
+    }
+    findings.push(
+      finding(
+        "LLM-AGY-001",
+        file,
+        registration.index,
+        "critical",
+        `A locally registered model-facing tool performs a recognized side effect without an observable fail-closed allowlist or human approval gate.`,
+        "Registered tool reaches an import-resolved side-effecting operation",
+        "high"
+      )
+    );
+  }
+  return findings;
+}
+var CEJEL_LLM_ACTION_RULES = [
+  {
+    id: "LLM-VAL-001",
+    title: "Consequential structured action lacks validation",
+    detectorConfidence: "high",
+    evidenceContract: "A direct local JSON.parse of recognized model output supplies an object field to a named consequential dispatcher without an intervening fail-closed runtime parse or allowlist guard.",
+    exclusions: [
+      "Inter-procedural or dynamically assembled dispatch",
+      "Read-only rendering and fixed operations",
+      "Runtime validation whose implementation is external or cannot be resolved locally"
+    ],
+    applies: hasConsequentialStructuredActionSurface,
+    detect: detectUnvalidatedConsequentialAction
+  },
+  {
+    id: "LLM-AGY-001",
+    title: "Side-effecting tool lacks an authority boundary",
+    detectorConfidence: "high",
+    evidenceContract: "A complete local tool declaration calls an import-resolved Node filesystem or child-process mutation API and is exposed through a local tools registry without a preceding fail-closed approval or operation-allowlist guard.",
+    exclusions: [
+      "Read-only and pure tools",
+      "Unbound business-operation names whose side effects cannot be established locally",
+      "Dynamic or remotely supplied registries and policy middleware",
+      "Tool declarations not observably exposed to a model or agent",
+      "Generic registerTool calls or agent objects without an import-resolved supported model call"
+    ],
+    applies: hasSideEffectingToolSurface,
+    detect: detectSideEffectingToolWithoutAuthorityBoundary
+  }
+];
+
+// src/packs/llm/evaluation-rules.ts
+import { isAbsolute } from "path";
+
+// src/packs/llm/python-evaluation-rules.ts
+function lineNumberAt2(contents, index) {
+  return contents.slice(0, index).split("\n").length;
+}
+function escaped(identifier) {
+  return identifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function pythonClassBlocks(masked) {
+  const declarations = [...masked.matchAll(
+    /^([ \t]*)class\s+[A-Za-z_][A-Za-z0-9_]*(?:\([^)]*\))?\s*:/gm
+  )];
+  return declarations.map((declaration, declarationIndex) => {
+    const indentation = declaration[1]?.length ?? 0;
+    const next = declarations.slice(declarationIndex + 1).find(
+      (candidate) => (candidate[1]?.length ?? 0) <= indentation
+    );
+    return {
+      index: declaration.index,
+      contents: masked.slice(declaration.index, next?.index ?? masked.length)
+    };
+  });
+}
+function detectPythonConfiguredSelfJudge(file) {
+  if (!file.path.toLowerCase().endsWith(".py") || isExcludedLlmSourcePath(file.path)) return [];
+  const masked = maskPythonNonCode(file.contents);
+  for (const classBlock of pythonClassBlocks(masked)) {
+    const classContents = classBlock.contents;
+    for (const alias of classContents.matchAll(
+      /\bif\s+([A-Za-z_][A-Za-z0-9_]*)\s+is\s+None\s*:\s*\n[ \t]+\1\s*=\s*([A-Za-z_][A-Za-z0-9_]*)/gi
+    )) {
+      const judgeParameter = alias[1];
+      const producerParameter = alias[2];
+      if (!judgeParameter || !producerParameter) continue;
+      if (!/judge/i.test(judgeParameter) || !/(?:llm|model)/i.test(producerParameter)) {
+        continue;
+      }
+      const invokedAssignment = (parameter) => [...classContents.matchAll(
+        new RegExp(
+          `\\bself\\.([A-Za-z_][A-Za-z0-9_]*)\\s*=\\s*${escaped(parameter)}\\b`,
+          "gi"
+        )
+      )].map((candidate) => candidate[1]).find(
+        (attribute) => Boolean(attribute) && new RegExp(
+          `\\bself\\.${escaped(attribute ?? "")}\\.(?:ainvoke|invoke|acomplete|complete)\\s*\\(`
+        ).test(classContents)
+      );
+      const judgeAttribute = invokedAssignment(judgeParameter);
+      const producerAttribute = invokedAssignment(producerParameter);
+      if (!judgeAttribute || !producerAttribute || judgeAttribute === producerAttribute) continue;
+      if (!/judge/i.test(judgeAttribute)) continue;
+      const judgeInvoked = new RegExp(
+        `\\bself\\.${escaped(judgeAttribute)}\\.(?:ainvoke|invoke|acomplete|complete)\\s*\\(`
+      ).test(classContents);
+      const producerInvoked = new RegExp(
+        `\\bself\\.${escaped(producerAttribute)}\\.(?:ainvoke|invoke|acomplete|complete)\\s*\\(`
+      ).test(classContents);
+      if (!judgeInvoked || !producerInvoked) continue;
+      const verdictAssignment = [...classContents.matchAll(
+        /\b([A-Za-z_][A-Za-z0-9_]*)\s*=\s*await\s+self\.([A-Za-z_][A-Za-z0-9_]*)\s*\(/gi
+      )].find((candidate) => /judge/i.test(candidate[2] ?? ""));
+      const verdictIdentifier = verdictAssignment?.[1];
+      if (!verdictIdentifier || verdictAssignment.index === void 0) continue;
+      const verdictTailWithLaterMethods = classContents.slice(
+        verdictAssignment.index + verdictAssignment[0].length
+      );
+      const nextMethod = /\n[ \t]+(?:async\s+)?def\s+[A-Za-z_][A-Za-z0-9_]*\s*\(/.exec(
+        verdictTailWithLaterMethods
+      );
+      const verdictTail = nextMethod ? verdictTailWithLaterMethods.slice(0, nextMethod.index) : verdictTailWithLaterMethods;
+      const directlyRetainedVerdict = new RegExp(
+        `\\bself\\.[A-Za-z_][A-Za-z0-9_.\\[\\]-]*\\.(?:judgement|judgment|verdict|judge_result)\\s*=\\s*${escaped(verdictIdentifier)}\\b`,
+        "i"
+      ).test(verdictTail);
+      const retainedThroughLocalResult = [...verdictTail.matchAll(
+        /\b([A-Za-z_][A-Za-z0-9_]*)\s*=\s*self\.[A-Za-z_][A-Za-z0-9_.\[\]-]*/g
+      )].some(
+        (resultAlias) => Boolean(resultAlias[1]) && new RegExp(
+          `\\b${escaped(resultAlias[1] ?? "")}\\.(?:judgement|judgment|verdict|judge_result)\\s*=\\s*${escaped(verdictIdentifier)}\\b`,
+          "i"
+        ).test(verdictTail)
+      );
+      const retainedVerdict = directlyRetainedVerdict || retainedThroughLocalResult;
+      if (!retainedVerdict) continue;
+      const completionMatch = [...classContents.matchAll(
+        /\bif\s+self\.[A-Za-z_][A-Za-z0-9_.]*use_judge[A-Za-z0-9_]*\s*:\s*\n[ \t]+await\s+self\.([A-Za-z_][A-Za-z0-9_]*)\s*\(/gi
+      )].at(-1);
+      const completionJudge = Boolean(
+        completionMatch?.[1] && /judge/i.test(completionMatch[1])
+      );
+      if (!completionJudge) continue;
+      const completionIndex = completionMatch?.index;
+      if (completionIndex === void 0) continue;
+      return [{
+        ruleId: "LLM-EVL-002",
+        severity: "warning",
+        confidence: "high",
+        summary: "A Python evaluation instance defaults its judge to the producer model and retains that judge verdict as the completed result without an independently configured judge.",
+        evidence: {
+          path: file.path,
+          line: lineNumberAt2(
+            file.contents,
+            classBlock.index + completionIndex
+          ),
+          label: "Configured judge aliases the producer model through completion"
+        }
+      }];
+    }
+  }
+  return [];
+}
+
+// src/packs/llm/evaluation-rules.ts
+var RESULT_EMITTER_PATTERN = /\b(?:writeFileSync|appendFileSync|Bun\.write)\s*\(/g;
+var MODEL_CALL_PATTERN = /(?:\.responses\.create|\.chat\.completions\.create|\.messages\.create|\b(?:generateText|streamText))\s*\(/g;
+var ASSIGNMENT_PATTERN = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*([^;\n]+)/g;
+var DENOMINATOR_ALIAS_PATTERN = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*([A-Za-z_$][\w$]*)\.length\s*;/g;
+var AGGREGATE_NAME_PATTERN = /(?:rate|score|accuracy|average|mean|percentage|pct)/i;
+var MODEL_LITERAL_PATTERN = /\bmodel\s*:\s*(['"`])([^'"`$]+)\1/;
+var MODEL_IDENTIFIER_PATTERN = /\bmodel\s*:\s*([A-Za-z_$][\w$]*)/;
+var LITERAL_BINDING_PATTERN = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(['"`])([^'"`$]+)\2\s*;/g;
+var LINEAGE_MODEL_KEYS = /* @__PURE__ */ new Set([
+  "model",
+  "modelId",
+  "modelVersion",
+  "providerModelId",
+  "producerModel"
+]);
+var LINEAGE_CONFIG_KEYS = /* @__PURE__ */ new Set([
+  "promptDigest",
+  "promptHash",
+  "policyDigest",
+  "policyHash",
+  "configDigest",
+  "configHash",
+  "configVersion",
+  "evaluationConfigVersion",
+  "evaluationManifest",
+  "repositoryCommit"
+]);
+var DENOMINATOR_KEYS = /* @__PURE__ */ new Set([
+  "eligibleTotal",
+  "eligibleCount",
+  "totalCases",
+  "totalCount",
+  "denominator",
+  "caseResults",
+  "rawResults",
+  "results"
+]);
+var OUTCOME_COUNT_PATTERN = /^(?:error|errors|refusal|refusals|abstention|abstentions|excluded|exclusions|excludedCount)$/i;
+var DISCRETE_CASE_KEY_PATTERN = /^(?:case|caseId|scenario|sample|sampleId|run|runId|input|expected|expectedOutput)$/i;
+var DISCRETE_OUTCOME_KEY_PATTERN = /^(?:ok|passed|success|successful|correct|score|verdict|result|actualOutput|output|latency|duration|error|failedPairs|contentChanged|editReflected)$/i;
+var CASE_COLLECTION_KEY_PATTERN = /^(?:cases|rows|samples|caseResults|results)$/i;
+var CASE_RESULT_KEY_PATTERN = /^(?:status|actualOutput|output|score|verdict|correct|success|error|latency|metrics)$/i;
+function hasIndependentAcceptanceSignal(file) {
+  const masked = maskJavaScriptNonCode(file.contents);
+  const emissions = localEmissions(file);
+  for (const match of masked.matchAll(
+    /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:await\s+)?(?:humanReview|humanAdjudication|manualReview|evidenceVerification|exactMatch|schemaCheck|propertyCheck|deterministicGrade|independentDecision)\s*\(/g
+  )) {
+    const identifier = match[1];
+    if (!identifier) continue;
+    if (emissions.some((emission) => {
+      if (emission.index <= match.index) return false;
+      const callStart = masked.indexOf("(", emission.index);
+      const callEnd = callStart < 0 ? -1 : matchingDelimiter(masked, callStart, "(", ")");
+      if (callEnd < 0) return false;
+      const escaped3 = identifier.replaceAll("$", "\\$");
+      return new RegExp(`\\b${escaped3}\\b`).test(masked.slice(callStart, callEnd + 1));
+    })) return true;
+    const tail = masked.slice(match.index + match[0].length);
+    const escaped2 = identifier.replaceAll("$", "\\$");
+    const gate = new RegExp(
+      `\\bif\\s*\\([^)]*\\b${escaped2}\\b[^)]*\\)\\s*(?:\\{[\\s\\S]{0,300}?\\b(?:throw|return|writeFileSync|appendFileSync|Bun\\.write)\\b|(?:throw|return)\\b)`
+    );
+    if (gate.test(tail)) return true;
+  }
+  return /\bif\s*\([^)]*(?:humanReview|humanAdjudication|manualReview|evidenceVerification|exactMatch|schemaCheck|propertyCheck|deterministicGrade|independentDecision)\s*\([^)]*\)[^)]*\)\s*(?:\{[\s\S]{0,300}?\b(?:throw|return|writeFileSync|appendFileSync|Bun\.write)\b|(?:throw|return)\b)/.test(
+    masked
+  );
+}
+function completeLocalSource(file) {
+  if (!file.path || isAbsolute(file.path)) return false;
+  const segments = file.path.replaceAll("\\", "/").split("/");
+  if (segments.some((segment) => segment === "" || segment === "." || segment === "..")) return false;
+  return !segments.some(
+    (segment) => /^(?:test|tests|__tests__|fixtures?|examples?|docs?|node_modules|vendor|generated)$/i.test(
+      segment
+    )
+  );
+}
+function hasSupportedEvaluationImport(file) {
+  return hasUnmaskedJavaScriptMatch(
+    file.contents,
+    /(?:from\s+['"](?:openai|@anthropic-ai\/sdk|ai)['"]|require\(\s*['"](?:openai|@anthropic-ai\/sdk|ai)['"]\s*\))/
+  );
+}
+function lineNumberAt3(contents, index) {
+  return contents.slice(0, index).split("\n").length;
+}
+function matchingDelimiter(contents, start, open, close) {
+  let depth = 0;
+  let quote = null;
+  let escaped2 = false;
+  for (let index = start; index < contents.length; index += 1) {
+    const character = contents[index];
+    if (!character) break;
+    if (quote) {
+      if (escaped2) escaped2 = false;
+      else if (character === "\\") escaped2 = true;
+      else if (character === quote) quote = null;
+      continue;
+    }
+    if (character === '"' || character === "'" || character === "`") {
+      quote = character;
+      continue;
+    }
+    if (character === open) depth += 1;
+    if (character === close) {
+      depth -= 1;
+      if (depth === 0) return index;
+    }
+  }
+  return -1;
+}
+function objectProperties(objectBody) {
+  const properties = /* @__PURE__ */ new Set();
+  for (const match of objectBody.matchAll(/(?:^|,)\s*([A-Za-z_$][\w$]*)\s*(?=:|,|$)/g)) {
+    const property = match[1];
+    if (property) properties.add(property);
+  }
+  return properties;
+}
+function boundObjectLiterals(contents) {
+  const objects = [];
+  const masked = maskJavaScriptNonCode(contents);
+  for (const match of contents.matchAll(
+    /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)(?:\s*:[^=\n]+)?\s*=\s*\{/g
+  )) {
+    if ((masked[match.index] ?? " ") === " ") continue;
+    const name = match[1];
+    if (!name) continue;
+    const start = contents.indexOf("{", match.index);
+    const end = matchingDelimiter(contents, start, "{", "}");
+    if (end < 0) continue;
+    objects.push({
+      name,
+      index: match.index,
+      end,
+      properties: objectProperties(masked.slice(start + 1, end))
+    });
+  }
+  return objects;
+}
+function resolvedIdentifierEmissionOrReturnIndex(contents, identifier, afterIndex) {
+  const escaped2 = identifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const tail = maskJavaScriptNonCode(contents.slice(afterIndex));
+  const redeclaration = new RegExp(
+    `\\b(?:const|let|var)\\s+${escaped2}\\b`
+  ).exec(tail);
+  const observableTail = redeclaration ? tail.slice(0, redeclaration.index) : tail;
+  const serializedEmission = new RegExp(
+    `\\b(?:writeFileSync|appendFileSync|Bun\\.write|console\\.(?:log|info))\\s*\\([\\s\\S]{0,500}?JSON\\.stringify\\s*\\(\\s*${escaped2}\\b`
+  ).exec(observableTail);
+  const returned = new RegExp(`\\breturn\\s+${escaped2}\\s*;?`).exec(observableTail);
+  const indices = [serializedEmission?.index, returned?.index].filter((index) => index !== void 0).map((index) => afterIndex + index);
+  return indices.length > 0 ? Math.min(...indices) : null;
+}
+function assignedProperties(contents, identifier, afterIndex, beforeIndex = contents.length) {
+  const properties = /* @__PURE__ */ new Set();
+  const escaped2 = identifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const maskedTail = maskJavaScriptNonCode(contents.slice(afterIndex, beforeIndex));
+  const redeclaration = new RegExp(
+    `\\b(?:const|let|var)\\s+${escaped2}\\b`
+  ).exec(maskedTail);
+  const masked = redeclaration ? maskedTail.slice(0, redeclaration.index) : maskedTail;
+  const pattern = new RegExp(`\\b${escaped2}\\.([A-Za-z_$][\\w$]*)\\s*=`, "g");
+  for (const match of masked.matchAll(pattern)) {
+    if (match[1]) properties.add(match[1]);
+  }
+  return properties;
+}
+function configurationInputLocus(contents, beforeIndex) {
+  const masked = maskJavaScriptNonCode(contents);
+  let earliest = null;
+  for (const declaration of contents.matchAll(
+    /\bimport\s*\{([^}]+)\}\s*from\s*['"][^'"]+['"]/g
+  )) {
+    if (declaration.index >= beforeIndex || (masked[declaration.index] ?? " ") === " ") continue;
+    for (const member of (declaration[1] ?? "").split(",")) {
+      const binding = member.trim().match(
+        /^(?:type\s+)?([A-Za-z_$][\w$]*)(?:\s+as\s+([A-Za-z_$][\w$]*))?$/
+      );
+      const local = binding?.[2] ?? binding?.[1];
+      if (!local || !/(?:prompt|policy|config|system)/i.test(local)) continue;
+      const tail = masked.slice(declaration.index + declaration[0].length, beforeIndex);
+      if (!new RegExp(`\\b${local.replaceAll("$", "\\$")}\\b`).test(tail)) continue;
+      earliest = earliest === null ? declaration.index : Math.min(earliest, declaration.index);
+    }
+  }
+  return earliest;
+}
+function javaScriptFunctionScopes(masked) {
+  const scopes = [];
+  const patterns = [
+    /^\s*(?:async\s+)?(?:function\s+)?([A-Za-z_$][\w$]*)\s*\(([^)]*)\)\s*(?::[^{\n]+)?\s*\{/gm,
+    /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s*)?\([^)]*\)\s*(?::[^=\n]+)?=>\s*\{/g
+  ];
+  for (const pattern of patterns) {
+    for (const declaration of masked.matchAll(pattern)) {
+      const functionName = declaration[1];
+      if (!functionName || /^(?:if|for|while|switch|catch|with)$/i.test(functionName)) {
+        continue;
+      }
+      const start = masked.indexOf("{", declaration.index);
+      const end = matchingDelimiter(masked, start, "{", "}");
+      if (start >= 0 && end >= 0) scopes.push({ start, end });
+    }
+  }
+  return scopes;
+}
+function hasScopedInvocationBefore(contents, invocations, resultIndex) {
+  const scopes = javaScriptFunctionScopes(maskJavaScriptNonCode(contents));
+  const resultScope = scopes.filter((scope) => resultIndex > scope.start && resultIndex < scope.end).sort((left, right) => right.start - left.start)[0];
+  if (resultScope) {
+    return invocations.some(
+      (invocation) => invocation.index > resultScope.start && invocation.index < resultIndex && !scopes.some(
+        (scope) => scope.start > resultScope.start && scope.end < resultScope.end && invocation.index > scope.start && invocation.index < scope.end
+      )
+    );
+  }
+  return invocations.some(
+    (invocation) => invocation.index < resultIndex && !scopes.some(
+      (scope) => invocation.index > scope.start && invocation.index < scope.end
+    )
+  );
+}
+function parameterBackedPerCaseProvenanceFinding(file, objects, invocations) {
+  const masked = maskJavaScriptNonCode(file.contents);
+  for (const declaration of masked.matchAll(
+    /^\s*(?:async\s+)?(?:function\s+)?([A-Za-z_$][\w$]*)\s*\(([^)]*)\)\s*(?::[^{\n]+)?\s*\{/gm
+  )) {
+    const functionName = declaration[1];
+    if (!functionName || /^(?:if|for|while|switch|catch|with)$/i.test(functionName)) {
+      continue;
+    }
+    const openBrace = masked.indexOf("{", declaration.index);
+    const end = matchingDelimiter(masked, openBrace, "{", "}");
+    if (end < 0) continue;
+    const body = masked.slice(openBrace + 1, end);
+    const parameters = (declaration[2] ?? "").split(",").map((parameter) => parameter.trim().match(/^([A-Za-z_$][\w$]*)/)?.[1]).filter((parameter) => Boolean(parameter));
+    for (const root of parameters) {
+      const escapedRoot = root.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const returned = new RegExp(`\\breturn\\s+${escapedRoot}\\s*;?`).exec(body);
+      if (!returned) continue;
+      const returnIndex = openBrace + 1 + returned.index;
+      if (!invocations.some(
+        (invocation) => invocation.index > openBrace && invocation.index < returnIndex
+      )) {
+        continue;
+      }
+      for (const candidate of objects) {
+        if (candidate.index <= openBrace || candidate.index >= end) continue;
+        const escapedCase = candidate.name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        const push = new RegExp(
+          `\\b${escapedRoot}(?:\\.[A-Za-z_$][\\w$]*|\\[[^\\]]+\\]){1,5}\\.push\\s*\\(\\s*${escapedCase}\\s*\\)`
+        ).exec(body);
+        if (!push) continue;
+        const pushIndex = openBrace + 1 + push.index;
+        const properties = assignedProperties(
+          file.contents,
+          candidate.name,
+          candidate.end,
+          pushIndex
+        );
+        const hasEvaluationIdentity = [...properties].some(
+          (property) => /^(?:uuid|evaluationId|evaluationRunId|runId|caseId)$/i.test(property)
+        );
+        const resultPropertyCount = [...properties].filter(
+          (property) => CASE_RESULT_KEY_PATTERN.test(property)
+        ).length;
+        if (!hasEvaluationIdentity || resultPropertyCount < 3) continue;
+        const allProperties = /* @__PURE__ */ new Set([...candidate.properties, ...properties]);
+        if (hasAny(allProperties, LINEAGE_CONFIG_KEYS)) continue;
+        return finding2(
+          "LLM-PRV-001",
+          file,
+          candidate.index,
+          "info",
+          "A parameter-backed evaluation collection retains per-case results without prompt/policy evaluation-configuration lineage.",
+          "Per-case evaluation record stored without reproducible configuration provenance"
+        );
+      }
+    }
+  }
+  return null;
+}
+function detectBoundedEvaluationResultProvenance(files) {
+  const findings = [];
+  for (const file of files) {
+    if (!completeLocalSource(file) || !hasSupportedEvaluationImport(file)) continue;
+    const invocations = modelInvocations(file.contents);
+    if (invocations.length === 0) continue;
+    const findingsBeforeFile = findings.length;
+    const objects = boundObjectLiterals(file.contents);
+    let found = false;
+    for (const object of objects) {
+      const emissionIndex = resolvedIdentifierEmissionOrReturnIndex(
+        file.contents,
+        object.name,
+        object.end
+      );
+      if (emissionIndex === null || !hasScopedInvocationBefore(file.contents, invocations, emissionIndex)) {
+        continue;
+      }
+      const hasModel = hasAny(object.properties, LINEAGE_MODEL_KEYS);
+      const hasCase = [...object.properties].some(
+        (property) => DISCRETE_CASE_KEY_PATTERN.test(property)
+      );
+      const outcomeCount = [...object.properties].filter(
+        (property) => DISCRETE_OUTCOME_KEY_PATTERN.test(property)
+      ).length;
+      const hasConfiguration = hasAny(object.properties, LINEAGE_CONFIG_KEYS);
+      if (!hasModel || !hasCase || outcomeCount < 2 || hasConfiguration) continue;
+      findings.push(
+        finding2(
+          "LLM-PRV-001",
+          file,
+          configurationInputLocus(file.contents, object.index) ?? object.index,
+          "info",
+          "A locally emitted discrete LLM evaluation result does not retain prompt/policy evaluation-configuration lineage.",
+          "Discrete evaluation result emitted without reproducible configuration provenance"
+        )
+      );
+      found = true;
+      break;
+    }
+    if (found) continue;
+    for (const root of objects) {
+      const rootProperties = assignedProperties(file.contents, root.name, root.end);
+      const hasEvaluationIdentity = [...rootProperties].some(
+        (property) => /^(?:evaluationId|evaluationRunId|runId|datasetId)$/i.test(property)
+      );
+      if (!hasEvaluationIdentity) continue;
+      const collection = [...rootProperties].find(
+        (property) => CASE_COLLECTION_KEY_PATTERN.test(property)
+      );
+      if (!collection) continue;
+      const escapedRoot = root.name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const escapedCollection = collection.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      if (!new RegExp(`\\b${escapedRoot}\\.${escapedCollection}\\s*=\\s*\\[\\s*\\]`).test(
+        maskJavaScriptNonCode(file.contents)
+      )) continue;
+      const emissionIndex = resolvedIdentifierEmissionOrReturnIndex(
+        file.contents,
+        root.name,
+        root.end
+      );
+      if (emissionIndex === null || !hasScopedInvocationBefore(file.contents, invocations, emissionIndex)) {
+        continue;
+      }
+      const perCase = objects.find((candidate) => {
+        if (candidate.index <= root.index) return false;
+        const properties = assignedProperties(file.contents, candidate.name, candidate.end);
+        const resultPropertyCount = [...properties].filter(
+          (property) => CASE_RESULT_KEY_PATTERN.test(property)
+        ).length;
+        if (resultPropertyCount < 3) return false;
+        const escapedCase = candidate.name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        return new RegExp(
+          `\\b${escapedRoot}\\.${escapedCollection}(?:\\[[^\\]]+\\])?(?:\\.[A-Za-z_$][\\w$]*)?\\.push\\s*\\(\\s*${escapedCase}\\s*\\)`
+        ).test(maskJavaScriptNonCode(file.contents));
+      });
+      if (!perCase) continue;
+      const allProperties = /* @__PURE__ */ new Set([
+        ...rootProperties,
+        ...assignedProperties(file.contents, perCase.name, perCase.end)
+      ]);
+      if (hasAny(allProperties, LINEAGE_CONFIG_KEYS)) continue;
+      findings.push(
+        finding2(
+          "LLM-PRV-001",
+          file,
+          perCase.index,
+          "info",
+          "A locally returned per-case LLM evaluation result does not retain prompt/policy evaluation-configuration lineage.",
+          "Per-case evaluation results returned without reproducible configuration provenance"
+        )
+      );
+      break;
+    }
+    if (findings.length > findingsBeforeFile) continue;
+    const parameterBacked = parameterBackedPerCaseProvenanceFinding(
+      file,
+      objects,
+      invocations
+    );
+    if (parameterBacked) findings.push(parameterBacked);
+  }
+  return findings;
+}
+function directObjectEmission(contents, emitterIndex) {
+  const callStart = contents.indexOf("(", emitterIndex);
+  if (callStart < 0) return null;
+  const callEnd = matchingDelimiter(contents, callStart, "(", ")");
+  if (callEnd < 0) return null;
+  const call = contents.slice(callStart + 1, callEnd);
+  const stringifyIndex = call.indexOf("JSON.stringify");
+  if (stringifyIndex < 0) return null;
+  const objectStart = call.indexOf("{", stringifyIndex);
+  if (objectStart < 0) return null;
+  const objectEnd = matchingDelimiter(call, objectStart, "{", "}");
+  if (objectEnd < 0) return null;
+  return {
+    index: emitterIndex,
+    properties: objectProperties(call.slice(objectStart + 1, objectEnd))
+  };
+}
+function localEmissions(file) {
+  const emissions = [];
+  const masked = maskJavaScriptNonCode(file.contents);
+  for (const match of file.contents.matchAll(RESULT_EMITTER_PATTERN)) {
+    if ((masked[match.index] ?? " ") === " ") continue;
+    const emission = directObjectEmission(file.contents, match.index);
+    if (emission) emissions.push(emission);
+  }
+  return emissions;
+}
+function hasAny(properties, candidates) {
+  for (const property of properties) if (candidates.has(property)) return true;
+  return false;
+}
+function finding2(ruleId, file, index, severity, summary, label) {
+  return {
+    ruleId,
+    severity,
+    confidence: "high",
+    summary,
+    evidence: {
+      path: file.path,
+      line: lineNumberAt3(file.contents, index),
+      label
+    }
+  };
+}
+function detectMissingProvenance(files) {
+  const findings = [];
+  for (const file of files) {
+    if (!completeLocalSource(file) || !hasSupportedEvaluationImport(file)) continue;
+    const aggregateAssignments = aggregateAssignmentsIn(file.contents);
+    if (aggregateAssignments.size === 0) continue;
+    for (const emission of localEmissions(file)) {
+      const emittedAggregates = [...aggregateAssignments].filter(
+        ([name]) => emission.properties.has(name)
+      );
+      if (emittedAggregates.length === 0) continue;
+      const firstAggregateIndex = Math.min(
+        ...emittedAggregates.map(([, assignment]) => assignment.index)
+      );
+      if (!hasLocalLlmEvaluationInvocation(file, firstAggregateIndex)) continue;
+      const hasModelLineage = hasAny(emission.properties, LINEAGE_MODEL_KEYS);
+      const hasConfigurationLineage = hasAny(emission.properties, LINEAGE_CONFIG_KEYS);
+      if (hasModelLineage && hasConfigurationLineage) continue;
+      findings.push(
+        finding2(
+          "LLM-PRV-001",
+          file,
+          emission.index,
+          "info",
+          "A locally emitted LLM evaluation aggregate does not retain both model and prompt/policy evaluation-configuration lineage.",
+          "Evaluation result emitted without complete reproducible system provenance"
+        )
+      );
+    }
+  }
+  return findings;
+}
+function detectMissingProvenanceIncludingBoundedResults(files) {
+  const aggregateFindings = detectMissingProvenance(files);
+  const aggregatePaths = new Set(aggregateFindings.map((item) => item.evidence.path));
+  return [
+    ...aggregateFindings,
+    ...detectBoundedEvaluationResultProvenance(files).filter(
+      (item) => !aggregatePaths.has(item.evidence.path)
+    )
+  ];
+}
+function aggregateAssignmentsIn(contents) {
+  const assignments = /* @__PURE__ */ new Map();
+  const masked = maskJavaScriptNonCode(contents);
+  for (const match of contents.matchAll(ASSIGNMENT_PATTERN)) {
+    if ((masked[match.index] ?? " ") === " ") continue;
+    const name = match[1];
+    const expression = match[2];
+    if (!name || !expression) continue;
+    if (!AGGREGATE_NAME_PATTERN.test(name)) continue;
+    if (/\.length\s*\/|\/\s*[A-Za-z_$][\w$]*\.length\b|\.reduce\s*\(/.test(expression)) {
+      const denominatorCollections = /* @__PURE__ */ new Set();
+      for (const denominator of expression.matchAll(
+        /\/\s*([A-Za-z_$][\w$]*)\.length\b/g
+      )) {
+        if (denominator[1]) denominatorCollections.add(denominator[1]);
+      }
+      assignments.set(name, { index: match.index, denominatorCollections });
+    }
+  }
+  return assignments;
+}
+function denominatorAliasAssignments(contents) {
+  const assignments = /* @__PURE__ */ new Map();
+  const masked = maskJavaScriptNonCode(contents);
+  for (const match of contents.matchAll(DENOMINATOR_ALIAS_PATTERN)) {
+    if ((masked[match.index] ?? " ") === " ") continue;
+    const alias = match[1];
+    const collection = match[2];
+    if (alias && collection) assignments.set(alias, { index: match.index, collection });
+  }
+  return assignments;
+}
+function hasOutcomeCounts(properties) {
+  return [...properties].some((property) => OUTCOME_COUNT_PATTERN.test(property));
+}
+function hasLocalLlmEvaluationInvocation(file, beforeIndex) {
+  return modelInvocations(file.contents).some((invocation) => invocation.index < beforeIndex);
+}
+function detectMissingDenominator(files) {
+  const findings = [];
+  for (const file of files) {
+    if (!completeLocalSource(file) || !hasSupportedEvaluationImport(file)) continue;
+    const aggregateAssignments = aggregateAssignmentsIn(file.contents);
+    const denominatorAliases = denominatorAliasAssignments(file.contents);
+    if (aggregateAssignments.size === 0) continue;
+    const iteratesCases = /\.(?:map|filter|reduce|forEach)\s*\(|\bfor\s*\([^)]*\bof\b/.test(
+      file.contents
+    );
+    if (!iteratesCases) continue;
+    for (const emission of localEmissions(file)) {
+      const emittedAggregates = [...aggregateAssignments].filter(
+        ([name]) => emission.properties.has(name)
+      );
+      if (emittedAggregates.length === 0) continue;
+      const firstAggregateIndex = Math.min(
+        ...emittedAggregates.map(([, assignment]) => assignment.index)
+      );
+      if (!hasLocalLlmEvaluationInvocation(file, firstAggregateIndex)) continue;
+      if (hasAny(emission.properties, DENOMINATOR_KEYS)) continue;
+      const emittedAliasHasLineage = [...emission.properties].some((property) => {
+        const alias = denominatorAliases.get(property);
+        if (!alias || alias.index >= emission.index) return false;
+        return emittedAggregates.some(
+          ([, aggregate]) => aggregate.denominatorCollections.has(alias.collection)
+        );
+      });
+      if (emittedAliasHasLineage) continue;
+      if (hasOutcomeCounts(emission.properties)) continue;
+      findings.push(
+        finding2(
+          "LLM-EVL-001",
+          file,
+          emission.index,
+          "warning",
+          "A locally computed evaluation aggregate is emitted without its eligible-case denominator or raw case-level results.",
+          "Evaluation aggregate emitted without reproducible denominator"
+        )
+      );
+    }
+  }
+  return findings;
+}
+function literalBindings(contents) {
+  const bindings = /* @__PURE__ */ new Map();
+  for (const match of contents.matchAll(LITERAL_BINDING_PATTERN)) {
+    const identifier = match[1];
+    const value = match[3];
+    if (identifier && value) bindings.set(identifier, value);
+  }
+  return bindings;
+}
+function modelIdentity(call, bindings) {
+  const literal = call.match(MODEL_LITERAL_PATTERN)?.[2];
+  if (literal) return literal;
+  const identifier = call.match(MODEL_IDENTIFIER_PATTERN)?.[1];
+  return identifier ? bindings.get(identifier) ?? null : null;
+}
+function modelInvocations(contents) {
+  const bindings = literalBindings(contents);
+  const invocations = [];
+  const masked = maskJavaScriptNonCode(contents);
+  const supportedIndices = supportedJavaScriptModelCallIndices(contents);
+  for (const match of contents.matchAll(MODEL_CALL_PATTERN)) {
+    if ((masked[match.index] ?? " ") === " ") continue;
+    if (!supportedIndices.has(match.index)) continue;
+    const callStart = contents.indexOf("(", match.index);
+    if (callStart < 0) continue;
+    const callEnd = matchingDelimiter(contents, callStart, "(", ")");
+    if (callEnd < 0) continue;
+    const call = contents.slice(match.index, callEnd + 1);
+    const judge = /\b(?:system|instructions?)\s*:\s*(['"`])[^'"`]*(?:judge|grader|evaluate|score)[^'"`]*\1/i.test(
+      call
+    );
+    invocations.push({ index: match.index, identity: modelIdentity(call, bindings), judge });
+  }
+  return invocations;
+}
+function detectSoleSelfJudge(files) {
+  const findings = [];
+  for (const file of files) {
+    if (!completeLocalSource(file) || !hasSupportedEvaluationImport(file)) continue;
+    if (hasIndependentAcceptanceSignal(file)) continue;
+    const invocations = modelInvocations(file.contents);
+    const judges = invocations.filter((invocation) => invocation.judge);
+    const producers = invocations.filter((invocation) => !invocation.judge);
+    if (judges.length !== 1 || producers.length !== 1) continue;
+    const judge = judges[0];
+    const producer = producers[0];
+    if (!judge?.identity || !producer?.identity || judge.identity !== producer.identity) continue;
+    if (localEmissions(file).length === 0) continue;
+    findings.push(
+      finding2(
+        "LLM-EVL-002",
+        file,
+        judge.index,
+        "warning",
+        `The producer and sole model-assisted judge resolve to the same configured model (${judge.identity}), with no local independent adjudicator.`,
+        `Judge invocation reuses producer model ${judge.identity}`
+      )
+    );
+  }
+  return findings;
+}
+function detectSoleSelfJudgeAcrossLanguages(files) {
+  return [
+    ...detectSoleSelfJudge(files),
+    ...files.flatMap((file) => detectPythonConfiguredSelfJudge(file))
+  ];
+}
+function hasAggregateEvaluationSurface(files) {
+  return files.some((file) => {
+    if (!completeLocalSource(file) || !hasSupportedEvaluationImport(file)) return false;
+    const aggregates = aggregateAssignmentsIn(file.contents);
+    if (aggregates.size === 0) return false;
+    return localEmissions(file).some((emission) => {
+      const emitted = [...aggregates].filter(([name]) => emission.properties.has(name));
+      if (emitted.length === 0) return false;
+      const first = Math.min(...emitted.map(([, assignment]) => assignment.index));
+      return hasLocalLlmEvaluationInvocation(file, first);
+    });
+  });
+}
+function hasProvenanceEvaluationSurface(files) {
+  return hasAggregateEvaluationSurface(files) || detectBoundedEvaluationResultProvenance(files).length > 0;
+}
+function hasModelJudgeSurface(files) {
+  return files.some((file) => {
+    if (!completeLocalSource(file) || !hasSupportedEvaluationImport(file)) return false;
+    const invocations = modelInvocations(file.contents);
+    return invocations.some((invocation) => invocation.judge) && invocations.some((invocation) => !invocation.judge) && localEmissions(file).length > 0;
+  }) || files.some((file) => detectPythonConfiguredSelfJudge(file).length > 0);
+}
+var CEJEL_LLM_EVALUATION_RULES = [
+  {
+    id: "LLM-PRV-001",
+    title: "Declared evaluation lacks reproducible system provenance",
+    detectorConfidence: "high",
+    evidenceContract: "A recognized local model invocation precedes a complete local evaluation result that is emitted or returned while lacking model or prompt/policy evaluation-configuration lineage. Supported forms are aggregate-to-emitter paths, identifier-bound discrete results with model/case/outcome fields, and incrementally built per-case collections with an evaluation identity and resolved return.",
+    exclusions: [
+      "External or dynamically assembled result reporters",
+      "Exploratory code without a locally emitted or returned evaluation result",
+      "Generic returned objects and model metadata without declared case/outcome semantics",
+      "Tests, examples, fixtures, documentation, generated code, and unresolved paths"
+    ],
+    applies: hasProvenanceEvaluationSurface,
+    detect: detectMissingProvenanceIncludingBoundedResults
+  },
+  {
+    id: "LLM-EVL-001",
+    title: "Evaluation result omits its eligible denominator or exclusions",
+    detectorConfidence: "high",
+    evidenceContract: "A complete local case-iteration, aggregate-calculation, and direct result-emission path is visible, while the emitted object lacks a denominator or raw case results.",
+    exclusions: [
+      "Counts without an aggregate rate or average",
+      "External or dynamically assembled result reporters",
+      "Tests, examples, fixtures, documentation, generated code, and unresolved paths"
+    ],
+    applies: hasAggregateEvaluationSurface,
+    detect: detectMissingDenominator
+  },
+  {
+    id: "LLM-EVL-002",
+    title: "Evaluated system is its own sole judge",
+    detectorConfidence: "high",
+    evidenceContract: "Exactly one local producer and one explicit model-assisted judge resolve to the same literal model identity, a result is locally emitted, and no observable independent review signal participates in evaluation acceptance or gating.",
+    exclusions: [
+      "Unresolved or provider-managed model identities",
+      "Distinct judge models and locally declared independent adjudication",
+      "Tests, examples, fixtures, documentation, generated code, and unresolved paths"
+    ],
+    applies: hasModelJudgeSurface,
+    detect: detectSoleSelfJudgeAcrossLanguages
+  }
+];
+function detectCejelLlmEvaluationRules(files) {
+  return CEJEL_LLM_EVALUATION_RULES.flatMap((rule) => rule.detect(files));
+}
+
+// src/packs/llm/files.ts
+import { execFileSync } from "child_process";
+import { lstatSync, readdirSync, statSync } from "fs";
+import { join, relative, resolve, sep } from "path";
+var SKIPPED_DIRECTORIES = /* @__PURE__ */ new Set([
+  ".git",
+  ".next",
+  ".terraform",
+  ".venv",
+  "__pycache__",
+  "build",
+  "coverage",
+  "dist",
+  "node_modules",
+  "site-packages",
+  "target",
+  "vendor",
+  "venv"
+]);
+var HARD_EXCLUDED_PATH_PATTERN = /(^|\/)(?:\.git|\.venv|venv|site-packages|node_modules|dist|build|\.next|__pycache__|vendor|\.terraform|coverage)(?:\/|$)/;
+var MAX_ENUMERATED_FILE_BYTES = 512e3;
+function isInsideRoot(root, path) {
+  const resolved = resolve(path);
+  return resolved === root || resolved.startsWith(`${root}${sep}`);
+}
+function isRegularFile(path) {
+  try {
+    return lstatSync(path).isFile();
+  } catch {
+    return false;
+  }
+}
+function listTrackedFiles(repoPath) {
+  try {
+    execFileSync("git", ["rev-parse", "--is-inside-work-tree"], {
+      cwd: repoPath,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const output = execFileSync("git", ["ls-files", "--cached"], {
+      cwd: repoPath,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    if (!output) return [];
+    const root = resolve(repoPath);
+    return output.split("\n").filter((path) => {
+      if (path.length === 0 || HARD_EXCLUDED_PATH_PATTERN.test(path)) return false;
+      const fullPath = resolve(root, path);
+      return isInsideRoot(root, fullPath) && isRegularFile(fullPath);
+    }).sort();
+  } catch {
+    return null;
+  }
+}
+function visitDirectory(root, directory, files) {
+  let entries;
+  try {
+    entries = readdirSync(directory, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (SKIPPED_DIRECTORIES.has(entry.name)) continue;
+    const fullPath = join(directory, entry.name);
+    if (!isInsideRoot(root, fullPath)) continue;
+    if (entry.isDirectory()) {
+      visitDirectory(root, fullPath, files);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    try {
+      if (statSync(fullPath).size > MAX_ENUMERATED_FILE_BYTES) continue;
+    } catch {
+      continue;
+    }
+    files.push(relative(root, fullPath));
+  }
+}
+function listCejelLlmPackFiles(repoPath) {
+  const root = resolve(repoPath);
+  let stat;
+  try {
+    stat = lstatSync(root);
+  } catch {
+    throw new Error(`Cejel LLM pack repository path does not exist: ${repoPath}`);
+  }
+  if (!stat.isDirectory()) {
+    throw new Error(`Cejel LLM pack repository path is not a directory: ${repoPath}`);
+  }
+  const tracked = listTrackedFiles(root);
+  if (tracked !== null) return tracked;
+  const files = [];
+  visitDirectory(root, root, files);
+  return files.filter((path) => !HARD_EXCLUDED_PATH_PATTERN.test(path)).sort();
+}
+
+// src/packs/llm/python-rules.ts
+var PYTHON_INTEGRATION_PATTERN = /(?:^|\n)\s*(?:from\s+(?:openai|anthropic)\s+import\s+|import\s+(?:openai|anthropic)\b)/;
+var PYTHON_MODEL_CALL_PATTERN = /\.(?:responses\.create|chat\.completions\.create|messages\.create)\s*\(/;
+var PYTHON_MODEL_OUTPUT_PATTERN = /(?:\.output_text\b|\.choices\s*\[[^\]]+\]\s*\.message\.content\b|\.content\s*\[[^\]]+\]\s*\.text\b)/;
+var PYTHON_IDENTIFIER_ASSIGNMENT_PATTERN = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.+)$/;
+var PYTHON_SENSITIVE_ENV_PATTERN = /(?:os\.environ\s*\[\s*['"]([A-Z0-9_]*(?:PASSWORD|PASSWD|SECRET|PRIVATE_KEY|DATABASE_URL|ACCESS_TOKEN|REFRESH_TOKEN|AUTH_TOKEN|SESSION_TOKEN)[A-Z0-9_]*)['"]\s*\]|os\.getenv\(\s*['"]([A-Z0-9_]*(?:PASSWORD|PASSWD|SECRET|PRIVATE_KEY|DATABASE_URL|ACCESS_TOKEN|REFRESH_TOKEN|AUTH_TOKEN|SESSION_TOKEN)[A-Z0-9_]*)['"])/;
+var PYTHON_DANGEROUS_SINKS = [
+  { name: "dynamic evaluation", pattern: /(?<![.\w])(?:eval|exec)\s*\(/ },
+  { name: "shell execution", pattern: /\bos\.system\s*\(/ },
+  {
+    name: "subprocess execution",
+    pattern: /\bsubprocess\.(?:run|call|check_call|check_output|Popen)\s*\(/
+  }
+];
+function pythonSdkImports(masked) {
+  const constructors = /* @__PURE__ */ new Set();
+  const modules = /* @__PURE__ */ new Set();
+  for (const match of masked.matchAll(
+    /(?:^|\n)\s*from\s+(openai|anthropic)\s+import\s+(OpenAI|Anthropic)(?:\s+as\s+([A-Za-z_][A-Za-z0-9_]*))?/g
+  )) {
+    if (match[2]) constructors.add(match[3] ?? match[2]);
+  }
+  for (const match of masked.matchAll(
+    /(?:^|\n)\s*import\s+(openai|anthropic)(?:\s+as\s+([A-Za-z_][A-Za-z0-9_]*))?/g
+  )) {
+    if (match[1]) modules.add(match[2] ?? match[1]);
+  }
+  return { constructors, modules };
+}
+function pythonParameters(line) {
+  const parameters = line.match(/^\s*(?:async\s+)?def\s+[A-Za-z_][A-Za-z0-9_]*\s*\(([^)]*)\)/)?.[1];
+  if (parameters === void 0) return [];
+  return parameters.split(",").flatMap((parameter) => {
+    const name = parameter.trim().match(/^(?:\*{1,2})?([A-Za-z_][A-Za-z0-9_]*)/)?.[1];
+    return name ? [name] : [];
+  });
+}
+function splitPythonTopLevel(value, delimiter) {
+  const parts = [];
+  let start = 0;
+  let round = 0;
+  let square = 0;
+  let curly = 0;
+  for (let index = 0; index < value.length; index += 1) {
+    const character = value[index];
+    if (character === "(") round += 1;
+    else if (character === ")") round -= 1;
+    else if (character === "[") square += 1;
+    else if (character === "]") square -= 1;
+    else if (character === "{") curly += 1;
+    else if (character === "}") curly -= 1;
+    else if (character === delimiter && round === 0 && square === 0 && curly === 0) {
+      parts.push(value.slice(start, index));
+      start = index + 1;
+    }
+  }
+  parts.push(value.slice(start));
+  return parts;
+}
+function pythonTargetIdentifiers(target) {
+  let normalized = target.trim();
+  while (normalized.startsWith("(") && normalized.endsWith(")") || normalized.startsWith("[") && normalized.endsWith("]")) {
+    normalized = normalized.slice(1, -1).trim();
+  }
+  const tuple = splitPythonTopLevel(normalized, ",");
+  if (tuple.length > 1) {
+    return {
+      identifiers: tuple.flatMap((part) => pythonTargetIdentifiers(part).identifiers),
+      simple: false
+    };
+  }
+  normalized = normalized.replace(/^\*+/, "").trim();
+  const annotation = splitPythonTopLevel(normalized, ":");
+  if (annotation.length > 1) normalized = annotation[0]?.trim() ?? "";
+  const identifier = /^[A-Za-z_][A-Za-z0-9_]*$/.test(normalized) ? normalized : void 0;
+  return { identifiers: identifier ? [identifier] : [], simple: Boolean(identifier) };
+}
+function pythonAssignment(statement) {
+  const equalityIndices = [];
+  let round = 0;
+  let square = 0;
+  let curly = 0;
+  for (let index = 0; index < statement.length; index += 1) {
+    const character = statement[index];
+    if (character === "(") round += 1;
+    else if (character === ")") round -= 1;
+    else if (character === "[") square += 1;
+    else if (character === "]") square -= 1;
+    else if (character === "{") curly += 1;
+    else if (character === "}") curly -= 1;
+    else if (character === "=" && round === 0 && square === 0 && curly === 0 && !/[=<>!:+\-*/%@&|^]/.test(statement[index - 1] ?? "") && statement[index + 1] !== "=") equalityIndices.push(index);
+  }
+  if (equalityIndices.length === 0) return void 0;
+  const targets = equalityIndices.map((equalityIndex, index) => {
+    const start = index === 0 ? 0 : (equalityIndices[index - 1] ?? -1) + 1;
+    return pythonTargetIdentifiers(statement.slice(start, equalityIndex));
+  });
+  return {
+    targets,
+    expression: statement.slice((equalityIndices.at(-1) ?? -1) + 1).trim()
+  };
+}
+function supportedPythonModelCallIndices(contents) {
+  const masked = maskPythonNonCode(contents);
+  const imports = pythonSdkImports(masked);
+  const scopes = [
+    {
+      indent: -1,
+      bindings: new Map([
+        ...[...imports.modules].map((name) => [name, "module"]),
+        ...[...imports.constructors].map((name) => [name, "constructor"])
+      ])
+    }
+  ];
+  const indices = /* @__PURE__ */ new Set();
+  let offset = 0;
+  const visibleBinding = (name) => {
+    for (let index = scopes.length - 1; index >= 0; index -= 1) {
+      const value = scopes[index]?.bindings.get(name);
+      if (value !== void 0) return value;
+    }
+    return void 0;
+  };
+  for (const line of masked.split("\n")) {
+    const indentation = line.match(/^\s*/)?.[0].length ?? 0;
+    if (line.trim().length > 0) {
+      while (scopes.length > 1 && indentation <= (scopes.at(-1)?.indent ?? -1)) scopes.pop();
+    }
+    let statementOffset = 0;
+    for (const statement of line.split(";")) {
+      for (const match of statement.matchAll(new RegExp(PYTHON_MODEL_CALL_PATTERN, "g"))) {
+        const prefix = statement.slice(0, match.index);
+        const receiver = prefix.match(/([A-Za-z_][A-Za-z0-9_]*)\s*$/)?.[1];
+        const directConstructor = prefix.match(/([A-Za-z_][A-Za-z0-9_]*)\s*\(\s*\)\s*$/)?.[1];
+        const receiverBinding = receiver ? visibleBinding(receiver) : void 0;
+        if (receiverBinding === "client" || receiverBinding === "module" || directConstructor && visibleBinding(directConstructor) === "constructor") {
+          indices.add(offset + statementOffset + match.index);
+        }
+      }
+      const assignment = pythonAssignment(statement);
+      if (assignment) {
+        const constructor = [...imports.constructors].some(
+          (name) => visibleBinding(name) === "constructor" && new RegExp(`^${name}\\s*\\(`).test(assignment.expression)
+        );
+        const moduleConstructor = [...imports.modules].some(
+          (name) => visibleBinding(name) === "module" && new RegExp(`^${name}\\.(?:OpenAI|Anthropic)\\s*\\(`).test(assignment.expression)
+        );
+        const establishesClient = constructor || moduleConstructor;
+        for (const target of assignment.targets) {
+          for (const identifier of target.identifiers) {
+            scopes.at(-1)?.bindings.set(
+              identifier,
+              target.simple && establishesClient ? "client" : "other"
+            );
+          }
+        }
+      }
+      statementOffset += statement.length + 1;
+    }
+    const parameters = pythonParameters(line);
+    if (parameters.length > 0) {
+      scopes.push({
+        indent: indentation,
+        bindings: new Map(parameters.map((name) => [name, "other"]))
+      });
+    } else if (/^\s*class\s+[A-Za-z_][A-Za-z0-9_]*\b/.test(line)) {
+      scopes.push({ indent: indentation, bindings: /* @__PURE__ */ new Map() });
+    }
+    offset += line.length + 1;
+  }
+  return indices;
+}
+function isExcludedSourcePath2(path) {
+  return /(?:^|\/)(?:__tests__|test|tests|fixtures?|examples?|vendor|generated)(?:\/|$)/i.test(
+    path
+  ) || /(?:^|\/)(?:test_[^/]+|[^/]+_test)\.py$/i.test(path);
+}
+function lineNumberAt4(contents, index) {
+  return contents.slice(0, index).split("\n").length;
+}
+function pythonFinding(ruleId, file, index, severity, confidence, summary, label) {
+  return {
+    ruleId,
+    severity,
+    confidence,
+    summary,
+    evidence: {
+      path: file.path,
+      line: lineNumberAt4(file.contents, index),
+      label
+    }
+  };
+}
+function containsIdentifier(expression, identifiers) {
+  for (const identifier of identifiers) {
+    const escaped2 = identifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    if (new RegExp(`\\b${escaped2}\\b`).test(expression)) return true;
+  }
+  return false;
+}
+function visiblePythonOutputIdentifiers(scopes) {
+  const visible = /* @__PURE__ */ new Map();
+  for (const scope of scopes) {
+    for (const [identifier, output] of scope.aliases) visible.set(identifier, output);
+  }
+  return new Set([...visible].filter(([, output]) => output).map(([identifier]) => identifier));
+}
+function expressionContainsBoundPythonModelOutput(expression, boundIdentifiers) {
+  const normalized = expression.trim();
+  const output = normalized.match(PYTHON_MODEL_OUTPUT_PATTERN);
+  if (!output || output.index === void 0) return false;
+  const receiver = normalized.slice(0, output.index);
+  const identifier = receiver.match(/([A-Za-z_][A-Za-z0-9_]*)[.\[\]\w\s]*$/)?.[1];
+  return Boolean(identifier && boundIdentifiers.has(identifier));
+}
+function hasSupportedPythonLlmIntegration(file) {
+  const maskedContents = maskPythonNonCode(file.contents);
+  return !isExcludedSourcePath2(file.path) && PYTHON_INTEGRATION_PATTERN.test(maskedContents) && supportedPythonModelCallIndices(file.contents).size > 0;
+}
+function detectPythonUnsafeModelOutputSink(file) {
+  if (!hasSupportedPythonLlmIntegration(file)) return [];
+  const maskedContents = maskPythonNonCode(file.contents);
+  const scopes = [
+    { indent: -1, aliases: /* @__PURE__ */ new Map() }
+  ];
+  const findings = [];
+  const supportedCalls = supportedPythonModelCallIndices(file.contents);
+  let offset = 0;
+  for (const line of maskedContents.split("\n")) {
+    const indentation = line.match(/^\s*/)?.[0].length ?? 0;
+    if (line.trim().length > 0) {
+      while (scopes.length > 1 && indentation <= (scopes.at(-1)?.indent ?? -1)) scopes.pop();
+    }
+    const assignment = line.match(PYTHON_IDENTIFIER_ASSIGNMENT_PATTERN);
+    const identifier = assignment?.[1];
+    const expression = assignment?.[2];
+    const visibleBeforeAssignment = visiblePythonOutputIdentifiers(scopes);
+    if (identifier && expression) {
+      const lineHasSupportedResponseAssignment = [...supportedCalls].some(
+        (index) => offset <= index && index < offset + line.length
+      );
+      scopes.at(-1)?.aliases.set(
+        identifier,
+        lineHasSupportedResponseAssignment || expressionContainsBoundPythonModelOutput(expression, visibleBeforeAssignment)
+      );
+    }
+    const outputIdentifiers = visiblePythonOutputIdentifiers(scopes);
+    for (const sink of PYTHON_DANGEROUS_SINKS) {
+      const sinkMatch = line.match(sink.pattern);
+      if (!sinkMatch) continue;
+      if (!expressionContainsBoundPythonModelOutput(line, outputIdentifiers) && !containsIdentifier(line, outputIdentifiers)) {
+        continue;
+      }
+      findings.push(
+        pythonFinding(
+          "LLM-IOH-001",
+          file,
+          offset + (sinkMatch.index ?? 0),
+          "critical",
+          "high",
+          `Observable model output is passed directly to ${sink.name}.`,
+          `Model output reaches ${sink.name}`
+        )
+      );
+    }
+    if (/^\s*(?:(?:async\s+)?def|class)\s+[A-Za-z_][A-Za-z0-9_]*\b/.test(line)) {
+      scopes.push({ indent: indentation, aliases: /* @__PURE__ */ new Map() });
+    }
+    offset += line.length + 1;
+  }
+  return findings;
+}
+function detectPythonUnboundedAgentLoop(file) {
+  if (!hasSupportedPythonLlmIntegration(file)) return [];
+  const findings = [];
+  const lines = maskPythonNonCode(file.contents).split("\n");
+  const supportedCalls = supportedPythonModelCallIndices(file.contents);
+  let offset = 0;
+  for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
+    const line = lines[lineIndex] ?? "";
+    const loop = line.match(/^(\s*)while\s+True\s*:\s*(?:#.*)?$/);
+    if (!loop) {
+      offset += line.length + 1;
+      continue;
+    }
+    const loopIndent = loop[1]?.length ?? 0;
+    const bodyStartOffset = offset + line.length + 1;
+    let bodyEndOffset = bodyStartOffset;
+    const bodyLines = [];
+    for (let bodyIndex = lineIndex + 1; bodyIndex < lines.length; bodyIndex += 1) {
+      const candidate = lines[bodyIndex] ?? "";
+      if (candidate.trim().length === 0 || candidate.trimStart().startsWith("#")) {
+        bodyEndOffset += candidate.length + 1;
+        bodyLines.push(candidate);
+        continue;
+      }
+      const indent = candidate.match(/^\s*/)?.[0].length ?? 0;
+      if (indent <= loopIndent) break;
+      bodyEndOffset += candidate.length + 1;
+      bodyLines.push(candidate);
+    }
+    if (![...supportedCalls].some((index) => bodyStartOffset <= index && index < bodyEndOffset)) {
+      offset += line.length + 1;
+      continue;
+    }
+    const significant = bodyLines.filter((candidate) => candidate.trim().length > 0);
+    const topIndent = Math.min(...significant.map(
+      (candidate) => candidate.match(/^\s*/)?.[0].length ?? Number.POSITIVE_INFINITY
+    ));
+    const hasObservableExit = bodyLines.some((candidate, candidateIndex) => {
+      const indent = candidate.match(/^\s*/)?.[0].length ?? 0;
+      const guard = candidate.trim().match(/^if\b(.+):\s*(.*)$/);
+      if (indent !== topIndent || !guard) return false;
+      if (/^(?:break|return|raise)\b/.test(guard[2] ?? "")) return true;
+      const next = bodyLines.slice(candidateIndex + 1).find((item) => item.trim().length > 0);
+      if (!next) return false;
+      const nextIndent = next.match(/^\s*/)?.[0].length ?? 0;
+      return nextIndent > topIndent && /^(?:break|return|raise)\b/.test(next.trim());
+    });
+    if (hasObservableExit) {
+      offset += line.length + 1;
+      continue;
+    }
+    findings.push(
+      pythonFinding(
+        "LLM-AGY-002",
+        file,
+        offset + (line.indexOf("while") >= 0 ? line.indexOf("while") : 0),
+        "warning",
+        "medium",
+        "An official SDK model call occurs inside a literal while True loop; no static step bound is observable.",
+        "Model call inside unconditional Python loop body"
+      )
+    );
+    offset += line.length + 1;
+  }
+  return findings;
+}
+function matchingPythonCallEnd(contents, openParen) {
+  let depth = 0;
+  let quote = null;
+  let escaped2 = false;
+  let comment = false;
+  for (let index = openParen; index < contents.length; index += 1) {
+    const character = contents[index] ?? "";
+    if (comment) {
+      if (character === "\n") comment = false;
+      continue;
+    }
+    if (quote) {
+      if (quote.length === 3 && contents.startsWith(quote, index)) {
+        quote = null;
+        index += 2;
+      } else if (quote.length === 1) {
+        if (escaped2) escaped2 = false;
+        else if (character === "\\") escaped2 = true;
+        else if (character === quote) quote = null;
+      }
+      continue;
+    }
+    if (character === "#") {
+      comment = true;
+      continue;
+    }
+    const triple = contents.slice(index, index + 3);
+    if (triple === "'''" || triple === '"""') {
+      quote = triple;
+      index += 2;
+      continue;
+    }
+    if (character === "'" || character === '"') {
+      quote = character;
+      continue;
+    }
+    if (character === "(") depth += 1;
+    if (character === ")") {
+      depth -= 1;
+      if (depth === 0) return index + 1;
+    }
+  }
+  return null;
+}
+function pythonModelCallArguments(contents) {
+  const calls = [];
+  const masked = maskPythonNonCode(contents);
+  const supportedCalls = supportedPythonModelCallIndices(contents);
+  for (const match of masked.matchAll(new RegExp(PYTHON_MODEL_CALL_PATTERN, "g"))) {
+    if (!supportedCalls.has(match.index)) continue;
+    const openParen = match.index + match[0].lastIndexOf("(");
+    const end = matchingPythonCallEnd(contents, openParen);
+    if (end === null) continue;
+    calls.push({ text: contents.slice(openParen + 1, end - 1), index: openParen + 1 });
+  }
+  return calls;
+}
+function detectPythonSensitivePromptData(file) {
+  if (!hasSupportedPythonLlmIntegration(file)) return [];
+  const findings = [];
+  for (const call of pythonModelCallArguments(file.contents)) {
+    const masked = maskPythonNonCode(call.text);
+    const sensitive = [...call.text.matchAll(new RegExp(PYTHON_SENSITIVE_ENV_PATTERN, "g"))].find(
+      (candidate) => candidate.index !== void 0 && (masked[candidate.index] ?? " ") !== " "
+    );
+    if (!sensitive) continue;
+    const variable = sensitive[1] ?? sensitive[2] ?? "secret-like environment value";
+    findings.push(
+      pythonFinding(
+        "LLM-DAT-001",
+        file,
+        call.index + (sensitive.index ?? 0),
+        "critical",
+        "high",
+        "A secret-like environment value is placed directly in a model request.",
+        `Sensitive environment value ${variable} in model request`
+      )
+    );
+  }
+  return findings;
+}
+var CEJEL_LLM_PYTHON_RULES = [
+  {
+    id: "LLM-IOH-001",
+    title: "Python model output passed to a consequential sink",
+    detectorConfidence: "high",
+    evidenceContract: "An official OpenAI or Anthropic Python integration, a supported response-output shape or still-live direct alias in the visible function or class scope, and a direct eval, exec, os.system, or subprocess sink are observable in one non-test source file.",
+    exclusions: [
+      "Inter-procedural or cross-file data flow",
+      "Identifiers transformed or reassigned after model-output extraction",
+      "Shell wrappers and sink APIs outside the enumerated Python standard-library forms"
+    ],
+    applies: (file) => detectPythonUnsafeModelOutputSink(file).length > 0,
+    detect: detectPythonUnsafeModelOutputSink
+  },
+  {
+    id: "LLM-AGY-002",
+    title: "Unbounded Python agent loop",
+    detectorConfidence: "medium",
+    evidenceContract: "A literal while True loop has a complete local indentation-delimited body containing an official OpenAI or Anthropic Python SDK model call and no observable conditional counter, deadline, cancellation, budget, return, raise, or break guard.",
+    exclusions: [
+      "Runtime bounds or cancellation enforced outside the source file",
+      "Framework-specific iteration controls not visible in loop syntax"
+    ],
+    applies: (file) => detectPythonUnboundedAgentLoop(file).length > 0,
+    detect: detectPythonUnboundedAgentLoop
+  },
+  {
+    id: "LLM-DAT-001",
+    title: "Sensitive Python environment data passed to a model request",
+    detectorConfidence: "high",
+    evidenceContract: "A narrowly named os.environ or os.getenv secret-like value occurs inside the executable, syntactically matched arguments of an official SDK model call after comments and strings are excluded from call extraction.",
+    exclusions: [
+      "Provider API keys used only for client construction",
+      "Values passed through aliases, helpers, or external configuration layers",
+      "General personal-data or semantic sensitivity classification"
+    ],
+    applies: (file) => detectPythonSensitivePromptData(file).length > 0,
+    detect: detectPythonSensitivePromptData
+  }
+];
+
+// src/packs/llm/rules.ts
+var MODEL_OUTPUT_PATTERN2 = /(?:\.output_text\b|\.choices\s*\[[^\]]+\]\s*\.message\s*\.content\b|\.content\s*\[[^\]]+\]\s*\.text\b)/;
+var MODEL_CALL_PATTERN2 = /(?:\.responses\.create\s*\(|\.chat\.completions\.create\s*\(|\.messages\.create\s*\(|\bgenerateText\s*\(|\bstreamText\s*\()/;
+var BASE_DANGEROUS_SINKS = [
+  {
+    name: "dynamic evaluation",
+    pattern: /(?<![.\w$])(?:eval|Function)\s*\(/,
+    severity: "critical"
+  },
+  {
+    name: "raw HTML assignment",
+    pattern: /(?:\.innerHTML\s*=|dangerouslySetInnerHTML\s*=)/,
+    severity: "warning"
+  }
+];
+function escapeRegExp2(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function importedProcessSinks(contents, maskedContents) {
+  const identifiers = /* @__PURE__ */ new Set();
+  const namespaces = /* @__PURE__ */ new Set();
+  const childProcessMembers = /* @__PURE__ */ new Set(["exec", "execSync", "spawn", "spawnSync"]);
+  for (const match of contents.matchAll(
+    /import\s*\{([^}]+)\}\s*from\s*['"](?:node:)?child_process['"]/g
+  )) {
+    if ((maskedContents[match.index] ?? " ") === " ") continue;
+    for (const member of (match[1] ?? "").split(",")) {
+      const binding = member.trim().match(/^([A-Za-z_$][\w$]*)(?:\s+as\s+([A-Za-z_$][\w$]*))?$/);
+      if (binding?.[1] && childProcessMembers.has(binding[1])) identifiers.add(binding[2] ?? binding[1]);
+    }
+  }
+  for (const match of contents.matchAll(
+    /import\s+\*\s+as\s+([A-Za-z_$][\w$]*)\s+from\s*['"](?:node:)?child_process['"]/g
+  )) {
+    if ((maskedContents[match.index] ?? " ") === " ") continue;
+    if (match[1]) namespaces.add(match[1]);
+  }
+  for (const match of contents.matchAll(
+    /(?:const|let|var)\s+\{([^}]+)\}\s*=\s*require\s*\(\s*['"](?:node:)?child_process['"]\s*\)/g
+  )) {
+    if ((maskedContents[match.index] ?? " ") === " ") continue;
+    for (const member of (match[1] ?? "").split(",")) {
+      const binding = member.trim().match(/^([A-Za-z_$][\w$]*)(?:\s*:\s*([A-Za-z_$][\w$]*))?$/);
+      if (binding?.[1] && childProcessMembers.has(binding[1])) identifiers.add(binding[2] ?? binding[1]);
+    }
+  }
+  for (const match of contents.matchAll(
+    /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\s*\(\s*['"](?:node:)?child_process['"]\s*\)/g
+  )) {
+    if ((maskedContents[match.index] ?? " ") === " ") continue;
+    if (match[1]) namespaces.add(match[1]);
+  }
+  for (const match of contents.matchAll(
+    /import\s*\{([^}]+)\}\s*from\s*['"]execa['"]/g
+  )) {
+    if ((maskedContents[match.index] ?? " ") === " ") continue;
+    for (const member of (match[1] ?? "").split(",")) {
+      const binding = member.trim().match(/^(execa)(?:\s+as\s+([A-Za-z_$][\w$]*))?$/);
+      if (binding?.[1]) identifiers.add(binding[2] ?? binding[1]);
+    }
+  }
+  const alternatives = [
+    ...[...identifiers].map((identifier) => `(?<![.\\w$])${escapeRegExp2(identifier)}`),
+    ...[...namespaces].map(
+      (namespace) => `\\b${escapeRegExp2(namespace)}\\.(?:exec|execSync|spawn|spawnSync)`
+    )
+  ];
+  return alternatives.length === 0 ? [] : [{
+    name: "shell execution",
+    pattern: new RegExp(`(?:${alternatives.join("|")})\\s*\\(`),
+    severity: "critical"
+  }];
+}
+function javaScriptExecutableHelperParameterSinks(file) {
+  if (isExcludedSourcePath3(file.path)) return [];
+  const sinks = [];
+  const masked = maskJavaScriptNonCode(file.contents);
+  const declaration = /(?:\bexport\s+)?\bfunction\s+([A-Za-z_$][\w$]*)\s*\(([^)]*)\)\s*(?::[^{\n]+)?\s*\{/g;
+  for (const match of file.contents.matchAll(declaration)) {
+    if ((masked[match.index] ?? " ") === " ") continue;
+    const functionName = match[1];
+    if (!functionName) continue;
+    const openBrace = file.contents.indexOf("{", match.index);
+    const end = matchingDelimiterEnd(file.contents, openBrace, "{", "}");
+    if (end === null) continue;
+    const body = file.contents.slice(openBrace + 1, end - 1);
+    const parameters = (match[2] ?? "").split(",").map((parameter) => parameter.trim().match(/^([A-Za-z_$][\w$]*)/)?.[1]).filter((parameter) => Boolean(parameter));
+    for (const parameterName of parameters) {
+      const escaped2 = escapeRegExp2(parameterName);
+      const directDynamicEvaluation = new RegExp(
+        `(?:eval|Function)\\s*\\([^)]*\\b${escaped2}\\b|\\(\\s*0\\s*,\\s*eval\\s*\\)\\s*\\([^)]*\\b${escaped2}\\b`
+      ).test(body);
+      const executableTemplate = [...body.matchAll(/`(?:\\[\s\S]|\$\{[\s\S]*?\}|[^`])*`/g)].some((template) => {
+        const text = template[0];
+        const tainted = /* @__PURE__ */ new Set();
+        const assignments = [...text.matchAll(
+          /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*([\s\S]*?);/g
+        )];
+        for (const assignment of assignments) {
+          const name = assignment[1];
+          const expression = assignment[2];
+          if (name && expression && new RegExp(`\\$\\{[^}]{0,160}\\b${escaped2}\\b[^}]*\\}`).test(expression)) {
+            tainted.add(name);
+          }
+        }
+        for (let pass = 0; pass < assignments.length; pass += 1) {
+          for (const assignment of assignments) {
+            const name = assignment[1];
+            const expression = assignment[2];
+            if (name && expression && containsIdentifier2(expression, tainted)) {
+              tainted.add(name);
+            }
+          }
+        }
+        if (tainted.size === 0) return false;
+        return [...text.matchAll(
+          /(?:(?:eval|Function)\s*|\(\s*0\s*,\s*eval\s*\)\s*)\(([\s\S]{0,500}?);/g
+        )].some((evaluation) => containsIdentifier2(evaluation[1] ?? "", tainted));
+      });
+      if (!directDynamicEvaluation && !executableTemplate) continue;
+      sinks.push({ functionName, parameterName, index: match.index });
+    }
+  }
+  return sinks;
+}
+var SENSITIVE_ENV_PATTERN = /process\.env\.(?:[A-Z0-9_]*(?:PASSWORD|PASSWD|SECRET|PRIVATE_KEY|DATABASE_URL|ACCESS_TOKEN|REFRESH_TOKEN|AUTH_TOKEN|SESSION_TOKEN)[A-Z0-9_]*)\b/;
+var UNBOUNDED_LOOP_PATTERN = /\bwhile\s*\(\s*true\s*\)|\bfor\s*\(\s*;\s*;\s*\)/g;
+var IDENTIFIER_ASSIGNMENT_PATTERN2 = /^\s*(?:(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*=\s*(.+)$/;
+function isExcludedSourcePath3(path) {
+  return /(?:^|\/)(?:__tests__|test|tests|fixtures?|examples?|vendor|generated)(?:\/|$)/i.test(
+    path
+  ) || /\.(?:test|spec|fixture)\.[cm]?[jt]sx?$/i.test(path);
+}
+function lineNumberAt5(contents, index) {
+  return contents.slice(0, index).split("\n").length;
+}
+function finding3(ruleId, file, index, severity, summary, label, confidence) {
+  return {
+    ruleId,
+    severity,
+    confidence,
+    summary,
+    evidence: {
+      path: file.path,
+      line: lineNumberAt5(file.contents, index),
+      label
+    }
+  };
+}
+function containsIdentifier2(expression, identifiers) {
+  for (const identifier of identifiers) {
+    const escaped2 = identifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    if (new RegExp(`\\b${escaped2}\\b`).test(expression)) return true;
+  }
+  return false;
+}
+function visibleOutputIdentifiers(scopes) {
+  const visible = /* @__PURE__ */ new Map();
+  for (const scope of scopes) for (const [identifier, output] of scope) visible.set(identifier, output);
+  return new Set([...visible].filter(([, output]) => output).map(([identifier]) => identifier));
+}
+function expressionContainsBoundModelOutput(expression, boundIdentifiers) {
+  const normalized = expression.trim().replace(/;$/, "").trim();
+  const output = normalized.match(MODEL_OUTPUT_PATTERN2);
+  if (!output || output.index === void 0) return false;
+  const receiver = normalized.slice(0, output.index);
+  const identifier = receiver.match(/([A-Za-z_$][\w$]*)[.\[\]\w$\s]*$/)?.[1];
+  return Boolean(identifier && boundIdentifiers.has(identifier));
+}
+function detectUnsafeSink(file) {
+  if (isExcludedSourcePath3(file.path)) return [];
+  const maskedContents = maskJavaScriptNonCode(file.contents);
+  const executableHelpers = javaScriptExecutableHelperParameterSinks(file);
+  const scopes = [/* @__PURE__ */ new Map()];
+  const dangerousSinks = [
+    ...BASE_DANGEROUS_SINKS,
+    ...importedProcessSinks(file.contents, maskedContents),
+    ...executableHelpers.map(
+      (helper) => ({
+        name: `local executable helper ${helper.functionName}`,
+        pattern: new RegExp(`\\b${escapeRegExp2(helper.functionName)}\\s*\\(`),
+        severity: "critical"
+      })
+    )
+  ];
+  const findings = [];
+  const supportedCallIndices = supportedJavaScriptModelCallIndices(file.contents);
+  let offset = 0;
+  for (const line of maskedContents.split("\n")) {
+    const assignment = line.match(IDENTIFIER_ASSIGNMENT_PATTERN2);
+    const identifier = assignment?.[1];
+    const expression = assignment?.[2];
+    const visibleBeforeAssignment = visibleOutputIdentifiers(scopes);
+    if (identifier && expression) {
+      const lineHasSupportedResponseAssignment = [...supportedCallIndices].some(
+        (index) => offset <= index && index < offset + line.length
+      );
+      scopes.at(-1)?.set(
+        identifier,
+        lineHasSupportedResponseAssignment || expressionContainsBoundModelOutput(expression, visibleBeforeAssignment)
+      );
+    }
+    const outputIdentifiers = visibleOutputIdentifiers(scopes);
+    for (const sink of dangerousSinks) {
+      const sinkMatch = line.match(sink.pattern);
+      if (!sinkMatch) continue;
+      const containsModelOutput = expressionContainsBoundModelOutput(line, outputIdentifiers) || containsIdentifier2(line, outputIdentifiers);
+      if (!containsModelOutput) continue;
+      findings.push(
+        finding3(
+          "LLM-IOH-001",
+          file,
+          offset + (sinkMatch.index ?? 0),
+          sink.severity,
+          `Observable model output is passed directly to ${sink.name}.`,
+          `Model output reaches ${sink.name}`,
+          "high"
+        )
+      );
+    }
+    for (const character of line) {
+      if (character === "{") scopes.push(/* @__PURE__ */ new Map());
+      else if (character === "}" && scopes.length > 1) scopes.pop();
+    }
+    offset += line.length + 1;
+  }
+  return findings;
+}
+function matchingDelimiterEnd(contents, start, open, close) {
+  let depth = 0;
+  let quote = null;
+  let escaped2 = false;
+  let lineComment = false;
+  let blockComment = false;
+  for (let index = start; index < contents.length; index += 1) {
+    const character = contents[index] ?? "";
+    const next = contents[index + 1] ?? "";
+    if (lineComment) {
+      if (character === "\n") lineComment = false;
+      continue;
+    }
+    if (blockComment) {
+      if (character === "*" && next === "/") {
+        blockComment = false;
+        index += 1;
+      }
+      continue;
+    }
+    if (quote) {
+      if (escaped2) escaped2 = false;
+      else if (character === "\\") escaped2 = true;
+      else if (character === quote) quote = null;
+      continue;
+    }
+    if (character === "/" && next === "/") {
+      lineComment = true;
+      index += 1;
+      continue;
+    }
+    if (character === "/" && next === "*") {
+      blockComment = true;
+      index += 1;
+      continue;
+    }
+    if (character === "'" || character === '"' || character === "`") {
+      quote = character;
+      continue;
+    }
+    if (character === open) depth += 1;
+    if (character === close) {
+      depth -= 1;
+      if (depth === 0) return index + 1;
+    }
+  }
+  return null;
+}
+function hasObservableJavaScriptLoopExit(body) {
+  let braceDepth = 0;
+  for (let index = 0; index < body.length; index += 1) {
+    const character = body[index];
+    if (character === "{") {
+      braceDepth += 1;
+      continue;
+    }
+    if (character === "}") {
+      braceDepth -= 1;
+      continue;
+    }
+    if (braceDepth !== 0 || body.slice(index, index + 2) !== "if" || /[\w$]/.test(body[index - 1] ?? "") || /[\w$]/.test(body[index + 2] ?? "")) continue;
+    const conditionStart = body.indexOf("(", index + 2);
+    if (conditionStart < 0) continue;
+    const conditionEnd = matchingDelimiterEnd(body, conditionStart, "(", ")");
+    if (conditionEnd === null) continue;
+    let statementStart = conditionEnd;
+    while (/\s/.test(body[statementStart] ?? "")) statementStart += 1;
+    if (body[statementStart] === "{") {
+      const statementEnd = matchingDelimiterEnd(body, statementStart, "{", "}");
+      if (statementEnd === null) continue;
+      const statement = body.slice(statementStart + 1, statementEnd - 1);
+      const exit = statement.search(/\b(?:break|return|throw)\b/);
+      if (exit >= 0 && !/\b(?:for|while|switch)\b/.test(statement.slice(0, exit))) return true;
+      continue;
+    }
+    if (/^(?:break|return|throw)\b/.test(body.slice(statementStart))) return true;
+  }
+  return false;
+}
+function detectUnboundedLoop(file) {
+  if (isExcludedSourcePath3(file.path)) return [];
+  const maskedContents = maskJavaScriptNonCode(file.contents);
+  const findings = [];
+  for (const match of maskedContents.matchAll(UNBOUNDED_LOOP_PATTERN)) {
+    let bodyStart = match.index + match[0].length;
+    while (/\s/.test(maskedContents[bodyStart] ?? "")) bodyStart += 1;
+    if (maskedContents[bodyStart] !== "{") continue;
+    const bodyEnd = matchingDelimiterEnd(maskedContents, bodyStart, "{", "}");
+    if (bodyEnd === null) continue;
+    const body = maskedContents.slice(bodyStart + 1, bodyEnd - 1);
+    if (hasObservableJavaScriptLoopExit(body)) continue;
+    const supportedCalls = supportedJavaScriptModelCallIndices(file.contents);
+    if (![...supportedCalls].some((index) => bodyStart < index && index < bodyEnd)) continue;
+    findings.push(
+      finding3(
+        "LLM-AGY-002",
+        file,
+        match.index,
+        "warning",
+        "A recognized model call occurs inside a literal unconditional loop; no static step bound is observable.",
+        "Model call inside unconditional loop body",
+        "medium"
+      )
+    );
+  }
+  return findings;
+}
+function modelCallArguments(contents) {
+  const calls = [];
+  const masked = maskJavaScriptNonCode(contents);
+  const supportedCalls = supportedJavaScriptModelCallIndices(contents);
+  for (const match of masked.matchAll(new RegExp(MODEL_CALL_PATTERN2, "g"))) {
+    if (!supportedCalls.has(match.index)) continue;
+    const openParen = match.index + match[0].lastIndexOf("(");
+    const end = matchingDelimiterEnd(contents, openParen, "(", ")");
+    if (end === null) continue;
+    calls.push({ text: contents.slice(openParen + 1, end - 1), index: openParen + 1 });
+  }
+  return calls;
+}
+function detectSensitivePromptData(file) {
+  if (isExcludedSourcePath3(file.path)) return [];
+  const findings = [];
+  for (const call of modelCallArguments(file.contents)) {
+    const masked = maskJavaScriptNonCode(call.text);
+    const candidates = [...call.text.matchAll(new RegExp(SENSITIVE_ENV_PATTERN, "g"))];
+    const sensitive = candidates.find((candidate) => {
+      const index = candidate.index;
+      if (index === void 0) return false;
+      if ((masked[index] ?? " ") !== " ") return true;
+      const prefix = call.text.slice(0, index);
+      const backticks = [...prefix.matchAll(/(?<!\\)`/g)].length;
+      return backticks % 2 === 1 && prefix.lastIndexOf("${") > prefix.lastIndexOf("}");
+    });
+    if (!sensitive) continue;
+    const relativeIndex = sensitive.index ?? 0;
+    findings.push(
+      finding3(
+        "LLM-DAT-001",
+        file,
+        call.index + relativeIndex,
+        "critical",
+        "A secret-like environment value is placed directly in a model request.",
+        `Sensitive environment value ${sensitive[0]} in model request`,
+        "high"
+      )
+    );
+  }
+  return findings;
+}
+function hasUnsafeSinkSurface(file) {
+  return detectUnsafeSink(file).length > 0;
+}
+var CEJEL_LLM_V1_RULES = [
+  {
+    id: "LLM-IOH-001",
+    title: "Model output passed to a consequential sink",
+    detectorConfidence: "high",
+    evidenceContract: "A supported model-output expression, or an identifier whose latest assignment in the visible lexical scope is directly from one, appears on the same line as a supported sink; process sinks additionally require a recognized local import or require binding. A local helper is also supported when one of its parameters is observably interpolated into an executable template or passed to dynamic evaluation.",
+    exclusions: [
+      "Inter-procedural data flow",
+      "Identifiers transformed, reassigned, or referenced outside their observable lexical scope",
+      "Method calls named exec without recognized child_process or execa import evidence, including RegExp.prototype.exec",
+      "Sinks other than the enumerated dynamic-evaluation, shell, and raw-HTML forms",
+      "Executable helpers whose model-output argument is not observable in the same source file"
+    ],
+    applies: hasUnsafeSinkSurface,
+    detect: detectUnsafeSink
+  },
+  {
+    id: "LLM-AGY-002",
+    title: "Unbounded agent loop",
+    detectorConfidence: "medium",
+    evidenceContract: "A literal while(true) or for(;;) loop has a complete local brace-delimited body containing a recognized model call and no observable conditional counter, deadline, cancellation, budget, return, throw, or break guard.",
+    exclusions: [
+      "Loops bounded by runtime controls outside the source file",
+      "Framework-specific iteration limits not visible in the loop syntax",
+      "Local unconditional-loop bodies with an observable conditional finite counter, deadline, cancellation, budget, return, throw, or break guard"
+    ],
+    applies: (file) => detectUnboundedLoop(file).length > 0,
+    detect: detectUnboundedLoop
+  },
+  {
+    id: "LLM-DAT-001",
+    title: "Sensitive data passed to a model request",
+    detectorConfidence: "high",
+    evidenceContract: "A narrowly named secret-like process.env value occurs inside the executable, syntactically matched arguments of a recognized model call; comments and string-literal lookalikes are masked before call extraction.",
+    exclusions: [
+      "Provider API keys used only to construct a client",
+      "Sensitive values passed through helpers or aliases",
+      "General personal-data classification"
+    ],
+    applies: (file) => detectSensitivePromptData(file).length > 0,
+    detect: detectSensitivePromptData
+  }
+];
+
+// src/packs/llm/types.ts
+var CEJEL_LLM_PACK_ID = "free-llm";
+var CEJEL_LLM_PACK_VERSION = "cejel-free-llm-v0-alpha-1";
+var CEJEL_LLM_RULE_IDS = [
+  "LLM-IOH-001",
+  "LLM-VAL-001",
+  "LLM-AGY-001",
+  "LLM-AGY-002",
+  "LLM-DAT-001",
+  "LLM-PRV-001",
+  "LLM-EVL-001",
+  "LLM-EVL-002"
+];
+var CEJEL_LLM_ENABLED_RULE_IDS = [
+  "LLM-IOH-001",
+  "LLM-VAL-001",
+  "LLM-AGY-001",
+  "LLM-AGY-002",
+  "LLM-DAT-001",
+  "LLM-PRV-001",
+  "LLM-EVL-001",
+  "LLM-EVL-002"
+];
+var CejelLlmRuleIdSchema = external_exports.enum(CEJEL_LLM_RULE_IDS);
+var CejelLlmEnabledRuleIdSchema = external_exports.enum(CEJEL_LLM_ENABLED_RULE_IDS);
+var CejelLlmSeveritySchema = external_exports.enum(["critical", "warning", "info"]);
+var CejelLlmConfidenceSchema = external_exports.enum(["high", "medium", "low"]);
+var CejelLlmRuleStateSchema = external_exports.enum([
+  "finding",
+  "verified_control",
+  "not_applicable",
+  "insufficient_data"
+]);
+var CejelLlmPackStatusSchema = external_exports.enum([
+  "assessed",
+  "assessed_with_limitations",
+  "not_applicable"
+]);
+var CejelLlmEvidenceSchema = external_exports.object({
+  path: external_exports.string().min(1).max(700).refine(
+    (path) => !path.startsWith("/") && !/^[A-Za-z]:[\\/]/.test(path) && !path.split(/[\\/]/).some((member) => member === ".."),
+    { message: "Evidence paths must be repository-relative and cannot traverse parents." }
+  ),
+  line: external_exports.number().int().positive().nullable(),
+  label: external_exports.string().min(1).max(180)
+}).strict();
+var CejelLlmFindingSchema = external_exports.object({
+  // The finding schema represents the complete frozen catalogue. Whether a rule is enabled for
+  // a detector version is recorded separately in coverage.enabledRuleIds; coupling the artifact
+  // shape to today's subset would make adding a calibrated rule a schema-breaking change.
+  ruleId: CejelLlmRuleIdSchema,
+  severity: CejelLlmSeveritySchema,
+  confidence: CejelLlmConfidenceSchema,
+  summary: external_exports.string().min(1).max(500),
+  evidence: CejelLlmEvidenceSchema
+}).strict();
+var CejelLlmRuleResultSchema = external_exports.object({
+  ruleId: CejelLlmRuleIdSchema,
+  state: CejelLlmRuleStateSchema,
+  confidence: CejelLlmConfidenceSchema,
+  findings: external_exports.array(CejelLlmFindingSchema),
+  notes: external_exports.string().min(1).max(1e3)
+}).strict().superRefine((result, context) => {
+  if (result.state === "finding" && result.findings.length === 0) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "A finding state must carry at least one finding.",
+      path: ["findings"]
+    });
+  }
+  if (result.state !== "finding" && result.findings.length > 0) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Only a finding state may carry findings.",
+      path: ["findings"]
+    });
+  }
+  if (result.findings.some((finding4) => finding4.ruleId !== result.ruleId)) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Nested findings must match the rule result id.",
+      path: ["findings"]
+    });
+  }
+});
+var CejelLlmCoverageSchema = external_exports.object({
+  supportedLanguages: external_exports.array(external_exports.enum(["JavaScript/TypeScript", "Python"])).min(1).refine((languages) => new Set(languages).size === languages.length, {
+    message: "Supported languages must be unique."
+  }),
+  sourceFilesConsidered: external_exports.number().int().nonnegative(),
+  sourceFilesWithLlmIndicators: external_exports.number().int().nonnegative(),
+  detectedIntegrations: external_exports.array(external_exports.string().min(1)),
+  enabledRuleIds: external_exports.array(CejelLlmEnabledRuleIdSchema),
+  deferredRuleIds: external_exports.array(CejelLlmRuleIdSchema),
+  limitations: external_exports.array(external_exports.string().min(1))
+}).strict();
+var CejelLlmPackResultSchema = external_exports.object({
+  packId: external_exports.literal(CEJEL_LLM_PACK_ID),
+  packVersion: external_exports.literal(CEJEL_LLM_PACK_VERSION),
+  status: CejelLlmPackStatusSchema,
+  findings: external_exports.array(CejelLlmFindingSchema),
+  ruleResults: external_exports.array(CejelLlmRuleResultSchema),
+  coverage: CejelLlmCoverageSchema,
+  notes: external_exports.string().min(1).max(1e3)
+}).strict().superRefine((result, context) => {
+  const expectedIds = [...CEJEL_LLM_ENABLED_RULE_IDS];
+  const actualIds = result.ruleResults.map((rule) => rule.ruleId);
+  if (actualIds.length !== expectedIds.length || actualIds.some((id, index) => id !== expectedIds[index])) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Rule results must contain every enabled rule exactly once in catalogue order.",
+      path: ["ruleResults"]
+    });
+  }
+  if (result.status === "not_applicable" && result.findings.length > 0) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "A not-applicable pack cannot carry findings.",
+      path: ["findings"]
+    });
+  }
+  const expectedEnabled = [...CEJEL_LLM_ENABLED_RULE_IDS];
+  if (result.coverage.enabledRuleIds.length !== expectedEnabled.length || result.coverage.enabledRuleIds.some((id, index) => id !== expectedEnabled[index])) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Coverage enabled rule ids must match the detector catalogue exactly.",
+      path: ["coverage", "enabledRuleIds"]
+    });
+  }
+  const enabled = new Set(expectedEnabled);
+  const expectedDeferred = CEJEL_LLM_RULE_IDS.filter((id) => !enabled.has(id));
+  if (result.coverage.deferredRuleIds.length !== expectedDeferred.length || result.coverage.deferredRuleIds.some((id, index) => id !== expectedDeferred[index])) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Coverage deferred rule ids must be the catalogue complement in order.",
+      path: ["coverage", "deferredRuleIds"]
+    });
+  }
+  const canonicalFindings = (findings) => findings.map((finding4) => JSON.stringify(finding4)).sort();
+  const nestedFindings = result.ruleResults.flatMap((rule) => rule.findings);
+  if (JSON.stringify(canonicalFindings(result.findings)) !== JSON.stringify(canonicalFindings(nestedFindings))) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Top-level findings must exactly equal the nested rule findings.",
+      path: ["findings"]
+    });
+  }
+  if (result.findings.some((finding4) => finding4.confidence === "low")) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Low-confidence candidates cannot be emitted as public artifact findings.",
+      path: ["findings"]
+    });
+  }
+  const states = result.ruleResults.map((rule) => rule.state);
+  if (result.status === "not_applicable" && states.some((state) => state !== "not_applicable")) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "A not-applicable pack requires every rule to be not_applicable.",
+      path: ["ruleResults"]
+    });
+  }
+  if (result.status === "assessed" && states.some((state) => state === "not_applicable" || state === "insufficient_data")) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "An assessed pack cannot contain unassessed rule states.",
+      path: ["ruleResults"]
+    });
+  }
+});
+
+// src/packs/llm/detector.ts
+var SUPPORTED_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".ts",
+  ".tsx",
+  ".mts",
+  ".cts",
+  ".py"
+]);
+var MAX_SOURCE_BYTES = 1e6;
+var ENABLED_RULE_ID_SET = new Set(CEJEL_LLM_ENABLED_RULE_IDS);
+var INTEGRATION_PATTERNS = [
+  { name: "OpenAI SDK", pattern: /(?:from\s+['"]openai['"]|require\(\s*['"]openai['"]\s*\))/ },
+  {
+    name: "Anthropic SDK",
+    pattern: /(?:from\s+['"]@anthropic-ai\/sdk['"]|require\(\s*['"]@anthropic-ai\/sdk['"]\s*\))/
+  },
+  { name: "Vercel AI SDK", pattern: /(?:from\s+['"]ai['"]|require\(\s*['"]ai['"]\s*\))/ },
+  {
+    name: "LangChain",
+    pattern: /(?:from\s+['"](?:@langchain\/|langchain\/)|require\(\s*['"](?:@langchain\/|langchain\/))/
+  },
+  {
+    name: "OpenAI Python SDK",
+    pattern: /(?:^|\n)\s*(?:from\s+openai\s+import\s+|import\s+openai\b)/
+  },
+  {
+    name: "Anthropic Python SDK",
+    pattern: /(?:^|\n)\s*(?:from\s+anthropic\s+import\s+|import\s+anthropic\b)/
+  }
+];
+var RULE_CONFIDENCE = new Map(
+  [...CEJEL_LLM_V1_RULES, ...CEJEL_LLM_ACTION_RULES, ...CEJEL_LLM_EVALUATION_RULES].map(
+    (rule) => [rule.id, rule.detectorConfidence]
+  )
+);
+function isPythonSource(file) {
+  return extname(file.path).toLowerCase() === ".py";
+}
+function supportedSourcePath(path) {
+  return SUPPORTED_EXTENSIONS.has(extname(path).toLowerCase());
+}
+function readSourceFile(repoPath, relativePath) {
+  const root = resolve2(repoPath);
+  const fullPath = resolve2(root, relativePath);
+  if (fullPath !== root && !fullPath.startsWith(`${root}${sep2}`)) return null;
+  try {
+    const stat = lstatSync2(fullPath);
+    if (!stat.isFile() || stat.size > MAX_SOURCE_BYTES) return null;
+    return { path: relativePath, contents: readFileSync(fullPath, "utf8") };
+  } catch {
+    return null;
+  }
+}
+function detectedIntegrations(files) {
+  const detected = /* @__PURE__ */ new Set();
+  for (const file of files) {
+    if (isExcludedLlmSourcePath(file.path)) continue;
+    for (const integration of INTEGRATION_PATTERNS) {
+      const detectedHere = isPythonSource(file) ? integration.pattern.test(maskPythonNonCode(file.contents)) : hasUnmaskedJavaScriptMatch(file.contents, integration.pattern);
+      if (detectedHere) detected.add(integration.name);
+    }
+  }
+  return [...detected].sort();
+}
+function snapshotCejelLlmPackInput(repoPath) {
+  const repoFiles = listCejelLlmPackFiles(repoPath);
+  const hash = createHash("sha256");
+  for (const path of repoFiles.filter(supportedSourcePath)) {
+    const file = readSourceFile(repoPath, path);
+    if (!file) continue;
+    hash.update(path, "utf8");
+    hash.update("\0");
+    hash.update(file.contents, "utf8");
+    hash.update("\0");
+  }
+  return { repoFiles, sourceSha256: hash.digest("hex") };
+}
+function collectCejelLlmPack(repoPath, repoFiles) {
+  const sourceFiles = repoFiles.filter(supportedSourcePath).map((path) => readSourceFile(repoPath, path)).filter((file) => file !== null);
+  const integrations = detectedIntegrations(sourceFiles);
+  const javascriptSourceFiles = sourceFiles.filter((file) => !isPythonSource(file));
+  const javascriptLlmFiles = javascriptSourceFiles.filter(
+    (file) => !isExcludedLlmSourcePath(file.path) && hasSupportedJavaScriptModelCall(file.contents)
+  );
+  const pythonLlmFiles = sourceFiles.filter(
+    (file) => isPythonSource(file) && hasSupportedPythonLlmIntegration(file)
+  );
+  const actionSurfaceFiles = sourceFiles.filter(
+    (file) => CEJEL_LLM_ACTION_RULES.some((rule) => rule.applies(file))
+  );
+  const evaluationSurfaceFiles = sourceFiles.filter(
+    (file) => CEJEL_LLM_EVALUATION_RULES.some((rule) => rule.applies([file]))
+  );
+  const hasEvaluationSurface = CEJEL_LLM_EVALUATION_RULES.some(
+    (rule) => rule.applies(sourceFiles)
+  );
+  const applicable = javascriptLlmFiles.length > 0 || pythonLlmFiles.length > 0 || actionSurfaceFiles.length > 0 || hasEvaluationSurface;
+  const findings = applicable ? [
+    ...javascriptLlmFiles.flatMap(
+      (file) => CEJEL_LLM_V1_RULES.flatMap((rule) => rule.detect(file))
+    ),
+    // A model-facing tool registration is itself a frozen-contract activator. Action rules
+    // therefore inspect every supported source file rather than depending on an unrelated
+    // direct official-SDK call in the same file.
+    ...sourceFiles.flatMap(
+      (file) => CEJEL_LLM_ACTION_RULES.flatMap((rule) => rule.detect(file))
+    ),
+    ...pythonLlmFiles.flatMap(
+      (file) => CEJEL_LLM_PYTHON_RULES.flatMap((rule) => rule.detect(file))
+    ),
+    // Evaluation rules inspect all supported sources and enforce their own bounded,
+    // language-specific evidence contracts. Repository-level applicability alone is never
+    // evidence that an unrelated metrics writer is an LLM evaluation.
+    ...detectCejelLlmEvaluationRules(sourceFiles)
+  ] : [];
+  const ruleResults = CEJEL_LLM_ENABLED_RULE_IDS.map((ruleId) => {
+    const ruleFindings = findings.filter((finding4) => finding4.ruleId === ruleId);
+    const confidence = RULE_CONFIDENCE.get(ruleId) ?? "low";
+    if (!applicable) {
+      return {
+        ruleId,
+        state: "not_applicable",
+        confidence,
+        findings: [],
+        notes: "No supported LLM call path was detected, so this rule was not assessed."
+      };
+    }
+    if (ruleFindings.length > 0) {
+      return {
+        ruleId,
+        state: "finding",
+        confidence,
+        findings: ruleFindings,
+        notes: "The rule evidence contract matched observable source evidence."
+      };
+    }
+    const ruleApplicable = CEJEL_LLM_V1_RULES.filter((rule) => rule.id === ruleId).some(
+      (rule) => javascriptLlmFiles.some((file) => rule.applies(file))
+    ) || CEJEL_LLM_PYTHON_RULES.filter((rule) => rule.id === ruleId).some(
+      (rule) => pythonLlmFiles.some((file) => rule.applies(file))
+    ) || CEJEL_LLM_ACTION_RULES.filter((rule) => rule.id === ruleId).some(
+      (rule) => sourceFiles.some((file) => rule.applies(file))
+    ) || CEJEL_LLM_EVALUATION_RULES.filter((rule) => rule.id === ruleId).some(
+      (rule) => rule.applies(sourceFiles)
+    );
+    if (!ruleApplicable) {
+      return {
+        ruleId,
+        state: "not_applicable",
+        confidence,
+        findings: [],
+        notes: "The rule-specific surface was not observed in supported local source."
+      };
+    }
+    return {
+      ruleId,
+      state: "insufficient_data",
+      confidence,
+      findings: [],
+      notes: "No finding matched, but this alpha detector does not yet prove that a control exists."
+    };
+  });
+  const status = applicable ? "assessed_with_limitations" : "not_applicable";
+  const indicatorPaths = /* @__PURE__ */ new Set([
+    ...javascriptLlmFiles.map((file) => file.path),
+    ...pythonLlmFiles.map((file) => file.path),
+    ...actionSurfaceFiles.map((file) => file.path),
+    ...evaluationSurfaceFiles.map((file) => file.path)
+  ]);
+  const integrationSet = new Set(integrations);
+  if (actionSurfaceFiles.length > 0) integrationSet.add("Model-facing tool registration");
+  if (hasEvaluationSurface) integrationSet.add("Declared LLM evaluation surface");
+  return CejelLlmPackResultSchema.parse({
+    packId: CEJEL_LLM_PACK_ID,
+    packVersion: CEJEL_LLM_PACK_VERSION,
+    status,
+    findings,
+    ruleResults,
+    coverage: {
+      supportedLanguages: ["JavaScript/TypeScript", "Python"],
+      sourceFilesConsidered: sourceFiles.length,
+      sourceFilesWithLlmIndicators: indicatorPaths.size,
+      detectedIntegrations: [...integrationSet].sort(),
+      enabledRuleIds: [...CEJEL_LLM_ENABLED_RULE_IDS],
+      deferredRuleIds: CEJEL_LLM_RULE_IDS.filter(
+        (ruleId) => !ENABLED_RULE_ID_SET.has(ruleId)
+      ),
+      limitations: [
+        "Alpha coverage is limited to fixture-backed JavaScript, TypeScript, and Python source patterns in files up to 1 MB.",
+        "Rules use bounded, observable source patterns and do not claim whole-program data-flow analysis.",
+        "Action-governance and evaluation-hygiene rules require one of the explicitly supported complete local JavaScript, TypeScript, or Python evidence paths.",
+        "No model-quality, factuality, prompt-injection-resistance, or general hallucination rate is measured."
+      ]
+    },
+    notes: applicable ? "Static LLM application-integrity alpha; findings require calibration before public release." : "No supported LLM application surface was detected; LLM controls were not scored."
+  });
+}
+
+// src/packs/llm/artifact.ts
+import { createHash as createHash2 } from "crypto";
+var CEJEL_LLM_ARTIFACT_SCHEMA_VERSION = "cejel-free-llm-artifact-v1";
+var CEJEL_LLM_RULE_CONTRACT_VERSION = "cejel-free-llm-rules-v1-2026-07-22";
+var CEJEL_LLM_DETECTOR_VERSION = "free-llm-detector-alpha-1";
+var CEJEL_LLM_ATTESTATION_PREDICATE = "https://cejel.dev/attestations/free-llm/v1";
+var CejelLlmPackArtifactSchema = external_exports.object({
+  schemaVersion: external_exports.literal(CEJEL_LLM_ARTIFACT_SCHEMA_VERSION),
+  generatedAt: external_exports.string().datetime({ offset: true }),
+  repo: external_exports.object({
+    path: external_exports.string().min(1).max(700),
+    headSha: external_exports.string().min(7).max(64).optional()
+  }).strict(),
+  baseReportSha256: external_exports.string().regex(/^[a-f0-9]{64}$/),
+  inputSourceSha256: external_exports.string().regex(/^[a-f0-9]{64}$/),
+  lineage: external_exports.object({
+    ruleContractVersion: external_exports.literal(CEJEL_LLM_RULE_CONTRACT_VERSION),
+    detectorVersion: external_exports.literal(CEJEL_LLM_DETECTOR_VERSION),
+    toolVersion: external_exports.string().min(1).max(100),
+    detectorSourceRevision: external_exports.string().min(1).max(160)
+  }).strict(),
+  result: CejelLlmPackResultSchema,
+  assurance: external_exports.object({
+    status: external_exports.literal("unsigned"),
+    issuer: external_exports.literal("self-generated")
+  }).strict(),
+  claimBoundary: external_exports.literal(
+    "Static application-integrity and evaluation-hygiene evidence; not a model hallucination rate or universal safety certificate."
+  )
+}).strict();
+function createCejelLlmPackArtifact(result, options) {
+  return CejelLlmPackArtifactSchema.parse({
+    schemaVersion: CEJEL_LLM_ARTIFACT_SCHEMA_VERSION,
+    generatedAt: options.generatedAt,
+    repo: {
+      path: options.repoPath,
+      ...options.headSha ? { headSha: options.headSha } : {}
+    },
+    baseReportSha256: options.baseReportSha256,
+    inputSourceSha256: options.inputSourceSha256,
+    lineage: {
+      ruleContractVersion: CEJEL_LLM_RULE_CONTRACT_VERSION,
+      detectorVersion: CEJEL_LLM_DETECTOR_VERSION,
+      toolVersion: options.toolVersion,
+      detectorSourceRevision: options.detectorSourceRevision ?? `local-or-unverified-build:@cejel/cejel@${options.toolVersion}`
+    },
+    result,
+    assurance: { status: "unsigned", issuer: "self-generated" },
+    claimBoundary: "Static application-integrity and evaluation-hygiene evidence; not a model hallucination rate or universal safety certificate."
+  });
+}
+function serializeCejelLlmPackArtifact(artifact) {
+  return `${JSON.stringify(CejelLlmPackArtifactSchema.parse(artifact), null, 2)}
+`;
+}
+var CejelLlmPackAttestationSchema = external_exports.object({
+  _type: external_exports.literal("https://in-toto.io/Statement/v1"),
+  subject: external_exports.tuple([
+    external_exports.object({
+      name: external_exports.literal("llm-report.json"),
+      digest: external_exports.object({ sha256: external_exports.string().regex(/^[a-f0-9]{64}$/) }).strict()
+    }).strict()
+  ]),
+  predicateType: external_exports.literal(CEJEL_LLM_ATTESTATION_PREDICATE),
+  predicate: external_exports.object({
+    packId: external_exports.string().min(1),
+    packVersion: external_exports.string().min(1),
+    generatedAt: external_exports.string().datetime({ offset: true }),
+    baseReportSha256: external_exports.string().regex(/^[a-f0-9]{64}$/),
+    inputSourceSha256: external_exports.string().regex(/^[a-f0-9]{64}$/),
+    ruleContractVersion: external_exports.literal(CEJEL_LLM_RULE_CONTRACT_VERSION),
+    detectorVersion: external_exports.literal(CEJEL_LLM_DETECTOR_VERSION),
+    toolVersion: external_exports.string().min(1).max(100),
+    detectorSourceRevision: external_exports.string().min(1).max(160),
+    assurance: external_exports.object({
+      status: external_exports.literal("unsigned"),
+      issuer: external_exports.literal("self-generated")
+    }).strict()
+  }).strict()
+}).strict();
+function createCejelLlmPackAttestation(artifact, serializedArtifact) {
+  const parsed = CejelLlmPackArtifactSchema.parse(artifact);
+  const serializedValue = CejelLlmPackArtifactSchema.parse(JSON.parse(serializedArtifact));
+  if (JSON.stringify(serializedValue) !== JSON.stringify(parsed)) {
+    throw new Error("Serialized LLM artifact bytes do not represent the supplied artifact.");
+  }
+  return CejelLlmPackAttestationSchema.parse({
+    _type: "https://in-toto.io/Statement/v1",
+    subject: [
+      {
+        name: "llm-report.json",
+        digest: { sha256: createHash2("sha256").update(serializedArtifact).digest("hex") }
+      }
+    ],
+    predicateType: CEJEL_LLM_ATTESTATION_PREDICATE,
+    predicate: {
+      packId: parsed.result.packId,
+      packVersion: parsed.result.packVersion,
+      generatedAt: parsed.generatedAt,
+      baseReportSha256: parsed.baseReportSha256,
+      inputSourceSha256: parsed.inputSourceSha256,
+      ruleContractVersion: parsed.lineage.ruleContractVersion,
+      detectorVersion: parsed.lineage.detectorVersion,
+      toolVersion: parsed.lineage.toolVersion,
+      detectorSourceRevision: parsed.lineage.detectorSourceRevision,
+      assurance: parsed.assurance
+    }
+  });
+}
+function verifyCejelLlmPackAttestationBinding(statement, artifact, serializedArtifact) {
+  const parsedStatement = CejelLlmPackAttestationSchema.safeParse(statement);
+  if (!parsedStatement.success) {
+    return {
+      valid: false,
+      errors: parsedStatement.error.issues.map(
+        (issue) => `attestation ${issue.path.join(".") || "<root>"}: ${issue.message}`
+      )
+    };
+  }
+  const parsedArtifact = CejelLlmPackArtifactSchema.parse(artifact);
+  const value = parsedStatement.data;
+  const errors = [];
+  let serializedValue = null;
+  try {
+    serializedValue = CejelLlmPackArtifactSchema.parse(
+      JSON.parse(Buffer.isBuffer(serializedArtifact) ? serializedArtifact.toString("utf8") : serializedArtifact)
+    );
+  } catch {
+    errors.push("serialized llm-report.json is not the supplied valid artifact");
+  }
+  if (serializedValue && JSON.stringify(serializedValue) !== JSON.stringify(parsedArtifact)) {
+    errors.push("serialized llm-report.json does not represent the supplied artifact");
+  }
+  const artifactSha256 = createHash2("sha256").update(serializedArtifact).digest("hex");
+  if (value.subject[0].digest.sha256 !== artifactSha256) {
+    errors.push("subject digest does not match llm-report.json");
+  }
+  if (value.predicate.packId !== parsedArtifact.result.packId) {
+    errors.push("predicate pack id does not match llm-report.json");
+  }
+  if (value.predicate.packVersion !== parsedArtifact.result.packVersion) {
+    errors.push("predicate pack version does not match llm-report.json");
+  }
+  if (value.predicate.generatedAt !== parsedArtifact.generatedAt) {
+    errors.push("predicate generated timestamp does not match llm-report.json");
+  }
+  if (value.predicate.baseReportSha256 !== parsedArtifact.baseReportSha256) {
+    errors.push("predicate base report digest does not match llm-report.json");
+  }
+  if (value.predicate.inputSourceSha256 !== parsedArtifact.inputSourceSha256) {
+    errors.push("predicate input source digest does not match llm-report.json");
+  }
+  if (value.predicate.ruleContractVersion !== parsedArtifact.lineage.ruleContractVersion) {
+    errors.push("predicate rule contract version does not match llm-report.json");
+  }
+  if (value.predicate.detectorVersion !== parsedArtifact.lineage.detectorVersion) {
+    errors.push("predicate detector version does not match llm-report.json");
+  }
+  if (value.predicate.toolVersion !== parsedArtifact.lineage.toolVersion) {
+    errors.push("predicate tool version does not match llm-report.json");
+  }
+  if (value.predicate.detectorSourceRevision !== parsedArtifact.lineage.detectorSourceRevision) {
+    errors.push("predicate detector source revision does not match llm-report.json");
+  }
+  return { valid: errors.length === 0, errors };
+}
+
+// src/packs/llm/render.ts
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
+}
+function renderCejelLlmPackHtml(artifact) {
+  const { result } = artifact;
+  const findings = result.findings.map(
+    (finding4) => `<li><strong>${escapeHtml(finding4.ruleId)}</strong> <span>${escapeHtml(finding4.severity)} / ${escapeHtml(finding4.confidence)}</span><p>${escapeHtml(finding4.summary)}</p><code>${escapeHtml(finding4.evidence.path)}:${finding4.evidence.line}</code></li>`
+  ).join("\n");
+  const limitations = result.coverage.limitations.map((limitation) => `<li>${escapeHtml(limitation)}</li>`).join("\n");
+  return `<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Cejel Free LLM Pack</title>
+<style>body{font:16px/1.5 system-ui,sans-serif;max-width:900px;margin:40px auto;padding:0 20px;color:#17202a}code{background:#f2f4f7;padding:2px 5px}li{margin:14px 0}.boundary{border-left:4px solid #b7791f;padding:10px 14px;background:#fffaf0}</style></head>
+<body><h1>Cejel Free LLM Pack</h1>
+<p><strong>Status:</strong> ${escapeHtml(result.status)} \xB7 <strong>Findings:</strong> ${result.findings.length}</p>
+<p><strong>Pack:</strong> ${escapeHtml(result.packVersion)} \xB7 <strong>Generated:</strong> ${escapeHtml(artifact.generatedAt)}</p>
+<p class="boundary">${escapeHtml(artifact.claimBoundary)}</p>
+<h2>Evidence-backed findings</h2>${findings ? `<ol>${findings}</ol>` : "<p>No rule evidence matched. This is not proof that every control exists.</p>"}
+<h2>Coverage limitations</h2><ul>${limitations}</ul>
+<p>Assurance: unsigned, self-generated. Source snapshot SHA-256: <code>${escapeHtml(artifact.inputSourceSha256)}</code>. Base report SHA-256: <code>${escapeHtml(artifact.baseReportSha256)}</code>.</p>
+</body></html>
+`;
+}
+function renderCejelLlmPackTerminal(artifact) {
+  const { result } = artifact;
+  const lines = [
+    "Free LLM Pack",
+    `  Status: ${result.status}`,
+    `  Findings: ${result.findings.length}`,
+    `  Coverage: ${result.coverage.supportedLanguages.join(", ")}`,
+    "  Boundary: static application-integrity evidence; not a hallucination rate."
+  ];
+  return `${lines.join("\n")}
+`;
+}
+
 // src/terminal.ts
 function renderTerminalCertificate(summary) {
   const abstained = summary.verdict === "Insufficient source";
@@ -50,8 +3513,8 @@ function renderTerminalCertificate(summary) {
     lines.push("No evidence-backed findings.");
   } else {
     lines.push(`Top findings (${summary.findingCount} total):`);
-    for (const finding of summary.topFindings) {
-      lines.push(`  [${finding.severity}] ${finding.criterionId}: ${finding.summary}`);
+    for (const finding4 of summary.topFindings) {
+      lines.push(`  [${finding4.severity}] ${finding4.criterionId}: ${finding4.summary}`);
     }
     const remaining = summary.findingCount - summary.topFindings.length;
     if (remaining > 0) {
@@ -63,9 +3526,9 @@ function renderTerminalCertificate(summary) {
       "",
       `External findings (${summary.externalFindingCount} total, attributed to tool + criterion):`
     );
-    for (const finding of summary.topExternalFindings) {
+    for (const finding4 of summary.topExternalFindings) {
       lines.push(
-        `  [${finding.severity}] ${finding.label} \u2192 ${finding.dimension}: ${finding.ruleId} \u2014 ${finding.message}${finding.location ? ` (${finding.location})` : ""}`
+        `  [${finding4.severity}] ${finding4.label} \u2192 ${finding4.dimension}: ${finding4.ruleId} \u2014 ${finding4.message}${finding4.location ? ` (${finding4.location})` : ""}`
       );
     }
     const remaining = summary.externalFindingCount - summary.topExternalFindings.length;
@@ -102,6 +3565,12 @@ var CLI_FLAG_SPECS = [
     description: "fold in a SARIF/JSON scanner report (repeatable)",
     kind: "ingest"
   },
+  {
+    tokens: ["--pack"],
+    value: "<llm>",
+    description: "run an opt-in pack and write its separate evidence artifact (repeatable)",
+    kind: "pack"
+  },
   {
     tokens: ["--quiet"],
     description: "suppress the terminal summary",
@@ -126,7 +3595,7 @@ var CLI_FLAG_KIND_BY_TOKEN = new Map(
 );
 function readCliManifest() {
   return JSON.parse(
-    readFileSync(new URL("../package.json", import.meta.url), "utf8")
+    readFileSync2(new URL("../package.json", import.meta.url), "utf8")
   );
 }
 function cliVersion() {
@@ -193,29 +3662,69 @@ async function runWitanFreeCli(args) {
     process.stdout.write(USAGE);
     return 0;
   }
+  const initialLlmSnapshot = options.packs.includes("llm") ? snapshotCejelLlmPackInput(options.repoPath) : null;
   const { report, summary } = runCejelScan({
     repoPath: options.repoPath,
     ingestPatterns: options.ingestPatterns,
     warnOnEmptyIngestMatch: !options.quiet
   });
   const attestation = createWitanAttestation(report, { toolVersion: cliVersion() });
+  const serializedReport = serializeWitanReport(report);
   mkdirSync(options.outDir, { recursive: true });
-  writeFileSync(join(options.outDir, "report.json"), serializeWitanReport(report), "utf8");
+  writeFileSync(join2(options.outDir, "report.json"), serializedReport, "utf8");
   writeFileSync(
-    join(options.outDir, "attestation.json"),
+    join2(options.outDir, "attestation.json"),
     JSON.stringify(attestation, null, 2),
     "utf8"
   );
-  writeFileSync(join(options.outDir, "certificate.html"), renderWitanHtmlReport(report), "utf8");
+  writeFileSync(join2(options.outDir, "certificate.html"), renderWitanHtmlReport(report), "utf8");
   writeFileSync(
-    join(options.outDir, "badge.json"),
+    join2(options.outDir, "badge.json"),
     JSON.stringify(renderWitanBadgeEndpoint(report), null, 2),
     "utf8"
   );
-  writeFileSync(join(options.outDir, "badge.svg"), renderWitanBadgeSvg(report), "utf8");
-  writeFileSync(join(options.outDir, "summary.json"), JSON.stringify(summary, null, 2), "utf8");
+  writeFileSync(join2(options.outDir, "badge.svg"), renderWitanBadgeSvg(report), "utf8");
+  writeFileSync(join2(options.outDir, "summary.json"), JSON.stringify(summary, null, 2), "utf8");
+  let llmTerminal = "";
+  if (options.packs.includes("llm")) {
+    const llmSnapshot = snapshotCejelLlmPackInput(options.repoPath);
+    if (!initialLlmSnapshot || initialLlmSnapshot.sourceSha256 !== llmSnapshot.sourceSha256) {
+      throw new Error("Cejel: repository source changed between the base and LLM pack scans; rerun on a stable tree.");
+    }
+    const llmResult = collectCejelLlmPack(options.repoPath, llmSnapshot.repoFiles);
+    const finalLlmSnapshot = snapshotCejelLlmPackInput(options.repoPath);
+    if (finalLlmSnapshot.sourceSha256 !== llmSnapshot.sourceSha256) {
+      throw new Error("Cejel: repository source changed during the LLM pack scan; rerun on a stable tree.");
+    }
+    const llmArtifact = createCejelLlmPackArtifact(llmResult, {
+      generatedAt: report.generatedAt,
+      repoPath: options.repoPath,
+      ...report.repo.headSha ? { headSha: report.repo.headSha } : {},
+      baseReportSha256: createHash3("sha256").update(serializedReport).digest("hex"),
+      inputSourceSha256: llmSnapshot.sourceSha256,
+      toolVersion: cliVersion(),
+      detectorSourceRevision: `local-or-unverified-build:@cejel/cejel@${cliVersion()}`
+    });
+    const serializedLlmArtifact = serializeCejelLlmPackArtifact(llmArtifact);
+    const llmAttestation = createCejelLlmPackAttestation(llmArtifact, serializedLlmArtifact);
+    writeFileSync(join2(options.outDir, "llm-report.json"), serializedLlmArtifact, "utf8");
+    writeFileSync(
+      join2(options.outDir, "llm-attestation.json"),
+      `${JSON.stringify(llmAttestation, null, 2)}
+`,
+      "utf8"
+    );
+    writeFileSync(
+      join2(options.outDir, "llm-certificate.html"),
+      renderCejelLlmPackHtml(llmArtifact),
+      "utf8"
+    );
+    llmTerminal = renderCejelLlmPackTerminal(llmArtifact);
+  }
   if (!options.quiet) {
     process.stdout.write(renderTerminalCertificate(summary));
+    if (llmTerminal) process.stdout.write(`
+${llmTerminal}`);
     process.stdout.write(
       `
 Wrote:
@@ -224,7 +3733,10 @@ Wrote:
   ${options.outDir}/certificate.html
   ${options.outDir}/badge.json
   ${options.outDir}/badge.svg
-`
+${options.packs.includes("llm") ? `  ${options.outDir}/llm-report.json
+  ${options.outDir}/llm-attestation.json
+  ${options.outDir}/llm-certificate.html
+` : ""}`
     );
   }
   if (options.minScore != null) {
@@ -267,14 +3779,45 @@ function parseCliInvocation(args) {
     }
     return {
       command: "verify",
-      reportPath: resolve(reportPath),
-      attestationPath: resolve(attestationPath)
+      reportPath: resolve3(reportPath),
+      attestationPath: resolve3(attestationPath)
     };
   }
   return { command: "scan", options: parseArgs(args) };
 }
 function runVerifyBinding(reportPath, attestationPath) {
   const reportArtifact = readJsonArtifact(reportPath, "report");
+  const statement = readJsonArtifact(attestationPath, "attestation");
+  if (isLlmPackAttestation(statement.value)) {
+    const artifactResult = CejelLlmPackArtifactSchema.safeParse(reportArtifact.value);
+    if (!artifactResult.success) {
+      const members = artifactResult.error.issues.map(
+        (issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`
+      );
+      process.stderr.write(
+        `Cejel: Free LLM Pack artifact validation failed:
+${members.map((member) => `  - ${member}`).join("\n")}
+`
+      );
+      return 1;
+    }
+    const result2 = verifyCejelLlmPackAttestationBinding(
+      statement.value,
+      artifactResult.data,
+      reportArtifact.contents
+    );
+    if (!result2.valid) {
+      process.stderr.write(
+        `Cejel: Free LLM Pack artifact/attestation binding verification failed:
+${result2.errors.map((error) => `  - ${error}`).join("\n")}
+`
+      );
+      return 1;
+    }
+    process.stdout.write("Cejel: Free LLM Pack artifact/attestation binding verified.\n");
+    process.stdout.write("Cejel: signature and signer identity were not verified.\n");
+    return 0;
+  }
   const reportResult = WitanReportSchema.safeParse(reportArtifact.value);
   if (!reportResult.success) {
     const members = reportResult.error.issues.map(
@@ -287,8 +3830,7 @@ ${members.map((member) => `  - ${member}`).join("\n")}
     );
     return 1;
   }
-  const statement = readJsonArtifact(attestationPath, "attestation");
-  const reportSha256 = createHash("sha256").update(reportArtifact.contents).digest("hex");
+  const reportSha256 = createHash3("sha256").update(reportArtifact.contents).digest("hex");
   const result = verifyWitanAttestationBinding(statement.value, reportResult.data, {
     reportSha256
   });
@@ -304,10 +3846,13 @@ ${result.errors.map((error) => `  - ${error}`).join("\n")}
   process.stdout.write("Cejel: signature and signer identity were not verified.\n");
   return 0;
 }
+function isLlmPackAttestation(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && value.predicateType === CEJEL_LLM_ATTESTATION_PREDICATE;
+}
 function readJsonArtifact(path, label) {
   let contents;
   try {
-    contents = readFileSync(path);
+    contents = readFileSync2(path);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`Cejel: could not read ${label} file ${path}: ${message}`);
@@ -327,6 +3872,7 @@ function parseArgs(args) {
   let showHelp = false;
   let showVersion = false;
   const ingestPatterns = [];
+  const packs = [];
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
     if (arg === "--" || arg === void 0) continue;
@@ -370,6 +3916,16 @@ function parseArgs(args) {
           index += 1;
           break;
         }
+        case "pack": {
+          const value = args[index + 1];
+          if (!value) throw new Error("Missing value for --pack");
+          if (value !== "llm") {
+            throw new Error(`Unknown Cejel pack: ${value}. Supported packs: llm`);
+          }
+          if (!packs.includes(value)) packs.push(value);
+          index += 1;
+          break;
+        }
       }
       continue;
     }
@@ -380,13 +3936,14 @@ function parseArgs(args) {
     }
   }
   return {
-    repoPath: resolve(repoPath ?? "."),
+    repoPath: resolve3(repoPath ?? "."),
     outDir,
     ...minScore != null ? { minScore } : {},
     quiet,
     showHelp,
     showVersion,
-    ingestPatterns
+    ingestPatterns,
+    packs
   };
 }
 function isEntryPoint() {