@filipebraida/adonis-function-points 0.1.0

package/build/pipeline-BzP-ITGN.js

@@ -0,0 +1,2306 @@
+import { a as rootSymbolOf, i as hooksFiredBy, n as resolveCall, r as detectAccess, t as BUILTIN_CALL_RESOLVERS } from "./resolvers-CU9HKYpn.js";
+import { Node, Project, SyntaxKind } from "ts-morph";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+//#region src/inventory/paths.ts
+/**
+* One canonical spelling for every path the inventory emits.
+*
+* Two path styles meet in this package. ts-morph always returns forward
+* slashes, including on Windows; node's `path.join` returns backslashes there.
+* Both end up in `HandlerRef.file`, and the call graph uses that string as a
+* cache key:
+*
+*     const key = `${ref.file}#${ref.member ?? ref.line ?? '*'}`
+*
+* Two spellings of the same file are two keys, so the same body would be
+* analysed twice and pushed twice into the trace and the implementation scope
+* — and a repeated scope entry changes the hash `fp:diff` compares.
+*
+* Forward slashes win because ts-morph cannot be told otherwise, node's `fs`
+* accepts them on Windows, and `path.relative` normalises mixed input anyway.
+* Normalising at the boundary where a path is created costs one call; leaving
+* it to each comparison costs vigilance forever.
+*/
+const toPosix = (value) => value.split("\\").join("/");
+/** Compares two paths that may have come from different sources. */
+const samePath = (a, b) => a !== void 0 && b !== void 0 && toPosix(a) === toPosix(b);
+//#endregion
+//#region src/inventory/app_context.ts
+/** folders naming an artefact TYPE, in either layout */
+const ARTIFACT_KINDS = new Set([
+	"models",
+	"controllers",
+	"services",
+	"actions",
+	"queries",
+	"validators",
+	"transformers",
+	"jobs",
+	"policies",
+	"middleware",
+	"middlewares",
+	"listeners",
+	"events",
+	"exceptions",
+	"mails",
+	"enums",
+	"abilities",
+	"notifications",
+	"dtos",
+	"resources",
+	"mixins",
+	"hooks",
+	"providers",
+	"commands"
+]);
+const GENERATED_MARKER = "automatically generated";
+async function discoverApp(root) {
+	const abs = toPosix(path.resolve(root));
+	const pkg = await readJson(path.join(abs, "package.json"));
+	const subpathImports = readSubpathImports(pkg);
+	const layout = await detectLayout(abs);
+	const resolveSpecifier = (specifier) => resolveWithImports(abs, subpathImports, specifier);
+	const generated = {
+		routeRegistry: await firstExisting(abs, [".adonisjs/client/registry/schema.d.ts"]),
+		controllersMap: await firstExisting(abs, [".adonisjs/server/controllers.ts"]),
+		dataSchema: await findDataSchema(abs, resolveSpecifier)
+	};
+	const scanRoots = await collectScanRoots(abs, subpathImports);
+	const routeFiles = await collectRouteFiles(abs, resolveSpecifier);
+	/**
+	* Normalised here, at the one place every discovered path leaves: `abs` and
+	* `toSource` were normalised at creation, and the roots and generated
+	* artefacts were not — which Windows CI caught and Linux never could.
+	* Covering the whole return is what makes the omission impossible to repeat.
+	*/
+	return {
+		root: abs,
+		subpathImports,
+		generated: {
+			routeRegistry: generated.routeRegistry && toPosix(generated.routeRegistry),
+			controllersMap: generated.controllersMap && toPosix(generated.controllersMap),
+			dataSchema: generated.dataSchema && toPosix(generated.dataSchema)
+		},
+		layout,
+		routeFiles: routeFiles.map(toPosix),
+		scanRoots: scanRoots.map(toPosix),
+		framework: readFramework(pkg),
+		resolveSpecifier,
+		moduleOf: (absPath) => moduleOf(abs, absPath)
+	};
+}
+const majorOf = (range) => {
+	const m = range?.match(/(\d+)\./);
+	return m ? Number(m[1]) : void 0;
+};
+function readFramework(pkg) {
+	const deps = {
+		...pkg?.dependencies ?? {},
+		...pkg?.devDependencies ?? {}
+	};
+	const core = majorOf(deps["@adonisjs/core"]);
+	const lucid = majorOf(deps["@adonisjs/lucid"]);
+	return {
+		core,
+		lucid,
+		orm: lucid ? "lucid" : deps["kysely"] ? "kysely" : "unknown",
+		tuyau: Boolean(deps["@tuyau/core"]),
+		supported: core === 7 && lucid !== void 0 && lucid >= 22
+	};
+}
+/**
+* Derives the directories to scan from the alias TARGETS, collapsing nested
+* ones.
+*
+* Keeping `app/admin` alongside `app` would scan each file twice and, worse,
+* change the computed module: `app/admin/catalog/...` would become "catalog"
+* instead of "admin/catalog".
+*/
+async function collectScanRoots(root, imports) {
+	const candidates = /* @__PURE__ */ new Set();
+	for (const target of imports.values()) {
+		const dir = target.replace(/^\.\//, "").split("*")[0].replace(/\/$/, "");
+		if (!dir || dir.startsWith(".")) continue;
+		if (NON_APPLICATION_ROOTS.some((pattern) => pattern.test(dir))) continue;
+		candidates.add(dir);
+	}
+	const existing = [];
+	for (const dir of candidates) if (await isDirectory(path.join(root, dir))) existing.push(dir);
+	const collapsed = existing.filter((dir) => !existing.some((other) => other !== dir && isInside(dir, other)));
+	return [...new Set(collapsed)].sort().map((dir) => path.join(root, dir));
+}
+const isInside = (child, parent) => child.startsWith(parent + "/");
+/**
+* Roots an alias reaches that are NOT application code.
+*
+* Not pedantry: test factories routinely contain real persistence calls.
+* Scanning them would count test writes as application functions — and the
+* number goes into an invoice.
+*/
+const NON_APPLICATION_ROOTS = [
+	/^tests?(\/|$)/,
+	/^config(\/|$)/,
+	/^database(\/|$)/,
+	/^public(\/|$)/,
+	/^resources(\/|$)/,
+	/^inertia(\/|$)/,
+	/^bin(\/|$)/,
+	/^build(\/|$)/,
+	/^node_modules(\/|$)/
+];
+const ROUTE_CALL = /\brouter\s*\.\s*(get|post|put|patch|delete|any|resource|on|group)\s*\(/;
+/**
+* Starts from the adonisrc `preloads` and follows static imports.
+*
+* A preload may be a hub that defines no route at all and only re-exports.
+* Stopping at the preload would return an empty file.
+*/
+async function collectRouteFiles(root, resolveSpecifier) {
+	const adonisrc = await readFileOrNull(path.join(root, "adonisrc.ts"));
+	if (!adonisrc) return [];
+	const found = [];
+	const seen = /* @__PURE__ */ new Set();
+	const visit = async (file, depth) => {
+		if (seen.has(file) || depth < 0) return;
+		seen.add(file);
+		const source = await readFileOrNull(file);
+		if (source === null) return;
+		if (ROUTE_CALL.test(source)) found.push(file);
+		for (const spec of staticImportsOf(source)) {
+			const target = resolveSpecifier(spec);
+			if (target) await visit(target, depth - 1);
+		}
+	};
+	for (const spec of preloadSpecifiersOf(adonisrc)) {
+		const target = resolveSpecifier(spec);
+		if (target) await visit(target, 3);
+	}
+	return found;
+}
+/** `preloads: [() => import('#start/routes'), ...]` */
+function preloadSpecifiersOf(adonisrc) {
+	const block = adonisrc.match(/preloads\s*:\s*\[([\s\S]*?)\]/);
+	if (!block) return [];
+	return [...block[1].matchAll(/import\(\s*['"]([^'"]+)['"]\s*\)/g)].map((m) => m[1]);
+}
+/** static imports, including `import '#x'` with no binding */
+function staticImportsOf(source) {
+	return [...source.matchAll(/\bimport\s+(?:[^'"]*?\bfrom\s*)?['"]([^'"]+)['"]/g)].map((m) => m[1]);
+}
+function readSubpathImports(pkg) {
+	const map = /* @__PURE__ */ new Map();
+	const imports = pkg?.imports ?? {};
+	for (const [key, value] of Object.entries(imports)) {
+		const target = typeof value === "string" ? value : pickDefault(value);
+		if (target) map.set(key, target);
+	}
+	return map;
+}
+/** conditional entries: { "import": "./x.js", "default": "./x.js" } */
+function pickDefault(value) {
+	if (!value || typeof value !== "object") return null;
+	const obj = value;
+	for (const key of [
+		"import",
+		"default",
+		"node",
+		"require"
+	]) if (typeof obj[key] === "string") return obj[key];
+	return null;
+}
+/**
+* Resolves a specifier against the `imports` map.
+*
+* The map points at `.js` (what Node executes) while we analyse source, hence
+* the translation to `.ts`. More specific entries win over generic ones:
+* `#app/legacy/*` must beat `#app/*` when both match.
+*/
+function resolveWithImports(root, imports, specifier) {
+	if (!specifier.startsWith("#")) return null;
+	let best = null;
+	for (const [pattern, target] of imports) {
+		const star = pattern.indexOf("*");
+		if (star === -1) {
+			if (pattern === specifier) return toSource(root, target);
+			continue;
+		}
+		const prefix = pattern.slice(0, star);
+		const suffix = pattern.slice(star + 1);
+		if (!specifier.startsWith(prefix) || !specifier.endsWith(suffix)) continue;
+		const middle = specifier.slice(prefix.length, specifier.length - suffix.length);
+		const resolved = target.replace("*", middle);
+		if (!best || prefix.length > best.specificity) best = {
+			target: resolved,
+			specificity: prefix.length
+		};
+	}
+	return best ? toSource(root, best.target) : null;
+}
+function toSource(root, target) {
+	const rel = target.replace(/^\.\//, "").replace(/\.js$/, ".ts");
+	return toPosix(path.join(root, rel));
+}
+/**
+* Decides by weight of evidence, not by the first folder encountered.
+*
+* `app/models` directly is evidence of a flat layout; `app/catalog/models` is
+* evidence of module-per-domain. An application can show both (a loose
+* `app/middleware` in a modular project), so both sides are counted.
+*/
+async function detectLayout(root) {
+	const appDir = path.join(root, "app");
+	const top = await listDirs(appDir);
+	if (top.length === 0) return "unknown";
+	let flat = 0;
+	let modular = 0;
+	for (const entry of top) {
+		if (ARTIFACT_KINDS.has(entry)) {
+			flat++;
+			continue;
+		}
+		if ((await listDirs(path.join(appDir, entry))).some((child) => ARTIFACT_KINDS.has(child))) modular++;
+	}
+	if (modular > flat) return "module-per-domain";
+	if (flat > 0) return "flat";
+	return "unknown";
+}
+/** top-level containers that name no domain — they only hold code */
+const CODE_CONTAINERS = new Set(["app", "src"]);
+/**
+* Module = the segments between the top-level container and the first segment
+* naming an artefact TYPE.
+*
+*   app/models/book.ts                 -> 'app'            (nothing before the type)
+*   app/catalog/models/book.ts         -> 'catalog'
+*   app/admin/catalog/models/book.ts   -> 'admin/catalog'  (nested)
+*   src/catalog/actions/create_book.ts -> 'catalog'        (outside app/)
+*
+* Deliberately does NOT use `scanRoots`: in a flat layout there is no `#app/*`
+* alias, so the roots end up being the artefact-type folders themselves
+* (`app/models`), which would make the module "models".
+*
+* Used only to group the report. Never to find a file.
+*/
+function moduleOf(root, absPath) {
+	const segments = path.relative(root, absPath).split(path.sep).slice(0, -1);
+	const body = CODE_CONTAINERS.has(segments[0]) ? segments.slice(1) : segments;
+	const kindAt = body.findIndex((segment) => ARTIFACT_KINDS.has(segment));
+	const moduleSegments = kindAt === -1 ? body : body.slice(0, kindAt);
+	return moduleSegments.length > 0 ? moduleSegments.join("/") : "app";
+}
+/**
+* Finds `database/schema.ts` by what it IS, not by where it sits.
+*
+* It appears as `database/schema.ts` and as `app/core/database/schema.ts`
+* depending on the project. The `#database/schema` alias is tried first, then
+* the known paths, then a shallow scan for the generation header — because the
+* path is the least reliable signal.
+*/
+async function findDataSchema(root, resolveSpecifier) {
+	const viaAlias = resolveSpecifier("#database/schema");
+	if (viaAlias && await isGeneratedSchema(viaAlias)) return viaAlias;
+	for (const candidate of [
+		"database/schema.ts",
+		"app/core/database/schema.ts",
+		"app/database/schema.ts"
+	]) {
+		const full = path.join(root, candidate);
+		if (await isGeneratedSchema(full)) return full;
+	}
+	return scanForSchema(root, 4);
+}
+async function isGeneratedSchema(file) {
+	try {
+		const head = (await fs.readFile(file, "utf8")).slice(0, 2e3);
+		return head.includes(GENERATED_MARKER) && /class\s+\w+Schema\b/.test(head);
+	} catch {
+		return false;
+	}
+}
+const SKIP_DIRS = new Set([
+	"node_modules",
+	".git",
+	"build",
+	"dist",
+	"coverage",
+	"tmp"
+]);
+async function scanForSchema(dir, depth) {
+	if (depth < 0) return void 0;
+	const entries = await readEntries(dir);
+	for (const entry of entries) {
+		const full = path.join(dir, entry.name);
+		if (entry.isFile() && entry.name === "schema.ts") {
+			if (await isGeneratedSchema(full)) return full;
+		}
+	}
+	for (const entry of entries) {
+		if (!entry.isDirectory() || SKIP_DIRS.has(entry.name)) continue;
+		const found = await scanForSchema(path.join(dir, entry.name), depth - 1);
+		if (found) return found;
+	}
+}
+async function readJson(file) {
+	try {
+		return JSON.parse(await fs.readFile(file, "utf8"));
+	} catch {
+		return null;
+	}
+}
+async function readEntries(dir) {
+	try {
+		return await fs.readdir(dir, { withFileTypes: true });
+	} catch {
+		return [];
+	}
+}
+async function listDirs(dir) {
+	return (await readEntries(dir)).filter((e) => e.isDirectory()).map((e) => e.name);
+}
+async function isDirectory(dir) {
+	try {
+		return (await fs.stat(dir)).isDirectory();
+	} catch {
+		return false;
+	}
+}
+async function readFileOrNull(file) {
+	try {
+		return await fs.readFile(file, "utf8");
+	} catch {
+		return null;
+	}
+}
+async function firstExisting(root, candidates) {
+	for (const candidate of candidates) {
+		const full = path.join(root, candidate);
+		try {
+			await fs.access(full);
+			return full;
+		} catch {}
+	}
+}
+//#endregion
+//#region src/inventory/sources/data_stores.ts
+const LUCID_ORM = "@adonisjs/lucid/orm";
+const BASE_MODEL = "BaseModel";
+/** decorators marking a composition relation — RET subgroup candidates */
+const COMPOSITION_RELATIONS = new Set(["hasMany", "hasOne"]);
+/** every Lucid relation decorator */
+const ALL_RELATIONS = new Set([
+	"belongsTo",
+	"hasMany",
+	"hasOne",
+	"manyToMany",
+	"hasManyThrough"
+]);
+async function collectDataStores(app) {
+	const project = new Project({
+		skipAddingFilesFromTsConfig: true,
+		skipFileDependencyResolution: true,
+		compilerOptions: { allowJs: false }
+	});
+	for (const root of app.scanRoots) project.addSourceFilesAtPaths(`${root}/**/*.ts`);
+	if (app.generated.dataSchema) project.addSourceFileAtPathIfExists(app.generated.dataSchema);
+	const candidates = [];
+	const unresolved = [];
+	/**
+	* Classes appearing as an ANCESTOR of some model.
+	*
+	* A base class has no table; counting it invents a data store that does not
+	* exist. Applications commonly define their own `BaseModel`, so this is the
+	* normal case rather than an edge case.
+	*/
+	const ancestors = /* @__PURE__ */ new Set();
+	for (const file of project.getSourceFiles()) {
+		if (samePath(file.getFilePath(), app.generated.dataSchema)) continue;
+		for (const cls of file.getClasses()) {
+			const described = describeStore(cls, app, project, unresolved);
+			if (!described) continue;
+			candidates.push(described.store);
+			for (const ancestor of described.ancestors) ancestors.add(ancestor);
+		}
+	}
+	return {
+		stores: candidates.filter((store) => !ancestors.has(store.id)).sort(byName),
+		unresolved
+	};
+}
+/** stable identity of a class, to separate a base from a store */
+const classKey = (cls) => `${cls.getSourceFile().getFilePath()}#${cls.getName()}`;
+const byName = (a, b) => a.name.localeCompare(b.name);
+function describeStore(cls, app, project, unresolved) {
+	const name = cls.getName();
+	if (!name) return null;
+	const chain = walkChain(cls, app, project);
+	if (!chain.reachesLucid) return null;
+	unresolved.push(...chain.unresolved);
+	const file = cls.getSourceFile().getFilePath();
+	return {
+		store: {
+			id: classKey(cls),
+			name,
+			module: app.moduleOf(file),
+			table: tableOf(cls) ?? tableFromName(name),
+			attributes: chain.attributes,
+			subgroups: subgroupsOf(chain.classes),
+			relations: relationsOf(chain.classes),
+			maintainedExternally: false,
+			columnSource: chain.columnSource,
+			provenance: {
+				file,
+				line: cls.getStartLineNumber(),
+				by: "data-stores"
+			}
+		},
+		ancestors: chain.classes.slice(1).map(classKey)
+	};
+}
+/**
+* Walks up the inheritance chain accumulating columns.
+*
+* `extends compose(A, B)` has more than one parent: both are followed. Anything
+* not resolvable inside the application becomes an unresolved entry — that is
+* not a detail, it is the difference between "has no column" and "I don't know
+* whether it has one".
+*/
+function walkChain(start, app, project) {
+	const classes = [];
+	const attributes = /* @__PURE__ */ new Map();
+	const seen = /* @__PURE__ */ new Set();
+	/**
+	* Unresolved entries stay local to the chain and only bubble up if the chain
+	* really is a model's. Otherwise every application class extending something
+	* from a package — controller, exception, middleware — would become noise in
+	* the coverage report.
+	*/
+	const unresolved = [];
+	let reachesLucid = false;
+	let columnSource = "ast";
+	const visit = (cls) => {
+		const key = `${cls.getSourceFile().getFilePath()}#${cls.getName()}`;
+		if (seen.has(key)) return;
+		seen.add(key);
+		classes.push(cls);
+		if (samePath(cls.getSourceFile().getFilePath(), app.generated.dataSchema)) columnSource = "generated-schema";
+		for (const attribute of columnsOf(cls)) if (!attributes.has(attribute.name)) attributes.set(attribute.name, attribute);
+		for (const parent of parentsOf(cls)) {
+			const origin = originOf(parent.getText(), cls.getSourceFile());
+			if (origin?.specifier === LUCID_ORM && origin.exportedName === BASE_MODEL) {
+				reachesLucid = true;
+				continue;
+			}
+			const resolved = resolveClass(parent.getText(), cls.getSourceFile(), app, project);
+			if (resolved) {
+				visit(resolved);
+				continue;
+			}
+			unresolved.push({
+				file: cls.getSourceFile().getFilePath(),
+				line: parent.getStartLineNumber(),
+				expression: parent.getText(),
+				reason: reasonFor(parent, cls.getSourceFile(), app)
+			});
+		}
+	};
+	visit(start);
+	return {
+		reachesLucid,
+		classes,
+		attributes: [...attributes.values()],
+		columnSource,
+		unresolved
+	};
+}
+/**
+* Why the base class could not be resolved.
+*
+* The right reason matters as much as the fact: saying "outside the
+* application" about code that is inside it sends the reader to the wrong
+* place, and the coverage report exists precisely to be actionable.
+*/
+function reasonFor(parent, file, app) {
+	if (Node.isCallExpression(parent)) return "mixin factory: the column only exists on the class the function returns, and evaluating that return is beyond the current static analysis";
+	const origin = originOf(parent.getText(), file);
+	if (origin && !app.resolveSpecifier(origin.specifier)) return `base class outside the application (${origin.specifier}): the package cannot know which columns it adds`;
+	return "base class not found in the application";
+}
+/**
+* Parents of a class. `extends compose(A, B)` yields A and B; `extends X`
+* yields X.
+*/
+function parentsOf(cls) {
+	const extended = cls.getExtends();
+	if (!extended) return [];
+	const expression = extended.getExpression();
+	if (Node.isCallExpression(expression) && expression.getExpression().getText() === "compose") return expression.getArguments();
+	return [expression];
+}
+function resolveClass(name, from, app, project) {
+	const local = from.getClass(name);
+	if (local) return local;
+	const origin = originOf(name, from);
+	if (!origin) return null;
+	const target = app.resolveSpecifier(origin.specifier);
+	if (!target) return null;
+	const file = project.getSourceFile(target) ?? project.addSourceFileAtPathIfExists(target);
+	if (!file) return null;
+	if (origin.exportedName === "default") return file.getClasses().find((candidate) => candidate.isDefaultExport()) ?? null;
+	return file.getClass(origin.exportedName) ?? null;
+}
+function originOf(local, file) {
+	for (const declaration of file.getImportDeclarations()) {
+		const specifier = declaration.getModuleSpecifierValue();
+		if (declaration.getDefaultImport()?.getText() === local) return {
+			specifier,
+			exportedName: "default"
+		};
+		for (const named of declaration.getNamedImports()) if ((named.getAliasNode()?.getText() ?? named.getName()) === local) return {
+			specifier,
+			exportedName: named.getName()
+		};
+	}
+	return null;
+}
+/**
+* `@column()`, `@column({ isPrimary: true })` and `@column.dateTime(...)`.
+*
+* `static $columns` is the canonical list generated from migrations, but it
+* says nothing about which field is the primary key nor where each one is
+* declared — so it serves to CROSS-CHECK, while the decorators remain the
+* primary reading.
+*/
+function columnsOf(cls) {
+	const file = cls.getSourceFile().getFilePath();
+	const attributes = [];
+	for (const property of cls.getProperties()) for (const decorator of property.getDecorators()) {
+		const full = decorator.getFullName();
+		if (full !== "column" && !full.startsWith("column.")) continue;
+		const isIdentifier = /isPrimary\s*:\s*true/.test(decorator.getExpression().getText());
+		attributes.push({
+			name: property.getName(),
+			type: property.getTypeNode()?.getText(),
+			isIdentifier,
+			provenance: {
+				file,
+				line: property.getStartLineNumber(),
+				by: "column-decorator"
+			}
+		});
+	}
+	return attributes;
+}
+/**
+* Declared relations: property -> target store.
+*
+* `@belongsTo(() => Author) declare author` yields `{ author: 'Author' }`,
+* which is what lets `.preload('author')` resolve later.
+*/
+function relationsOf(classes) {
+	const relations = {};
+	for (const cls of classes) for (const property of cls.getProperties()) for (const decorator of property.getDecorators()) {
+		if (!ALL_RELATIONS.has(decorator.getName())) continue;
+		const target = decorator.getExpression().getText().match(/=>\s*([A-Za-z_$][\w$]*)/);
+		if (target) relations[property.getName()] = target[1];
+	}
+	return relations;
+}
+/** composition relations, candidates for a logical subgroup (RET) */
+function subgroupsOf(classes) {
+	const subgroups = /* @__PURE__ */ new Set();
+	for (const cls of classes) for (const property of cls.getProperties()) for (const decorator of property.getDecorators()) {
+		if (!COMPOSITION_RELATIONS.has(decorator.getName())) continue;
+		const target = decorator.getExpression().getText().match(/=>\s*([A-Za-z_$][\w$]*)/);
+		if (target) subgroups.add(target[1]);
+	}
+	return [...subgroups].sort();
+}
+function tableOf(cls) {
+	const declared = cls.getStaticProperty("table");
+	if (!declared || !Node.isPropertyDeclaration(declared)) return void 0;
+	return declared.getInitializer()?.asKind(SyntaxKind.StringLiteral)?.getLiteralValue();
+}
+/** Lucid convention when `static table` is not declared */
+function tableFromName(name) {
+	const snake = name.replace(/([a-z\d])([A-Z])/g, "$1_$2").toLowerCase();
+	return snake.endsWith("s") ? snake : `${snake}s`;
+}
+//#endregion
+//#region src/inventory/sources/routes_ast.ts
+const VERBS = new Set([
+	"get",
+	"post",
+	"put",
+	"patch",
+	"delete",
+	"any"
+]);
+/** resource action -> verb and path suffix */
+const RESOURCE_ACTIONS = {
+	index: {
+		verb: "GET",
+		suffix: ""
+	},
+	create: {
+		verb: "GET",
+		suffix: "/create"
+	},
+	store: {
+		verb: "POST",
+		suffix: ""
+	},
+	show: {
+		verb: "GET",
+		suffix: "/:id"
+	},
+	edit: {
+		verb: "GET",
+		suffix: "/:id/edit"
+	},
+	update: {
+		verb: "PUT",
+		suffix: "/:id"
+	},
+	destroy: {
+		verb: "DELETE",
+		suffix: "/:id"
+	}
+};
+const API_ACTIONS = [
+	"index",
+	"store",
+	"show",
+	"update",
+	"destroy"
+];
+async function collectEntryPoints(app) {
+	const project = new Project({
+		skipAddingFilesFromTsConfig: true,
+		skipFileDependencyResolution: true,
+		compilerOptions: { allowJs: false }
+	});
+	const entryPoints = [];
+	const unresolved = [];
+	const controllers = app.generated.controllersMap ? readControllersMap(project, app.generated.controllersMap) : /* @__PURE__ */ new Map();
+	for (const routeFile of app.routeFiles) {
+		const file = project.addSourceFileAtPathIfExists(routeFile);
+		if (!file) continue;
+		const resolver = handlerResolver(file, app, controllers);
+		for (const call of file.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+			const verb = verbOf(call);
+			if (!verb) continue;
+			const prefix = prefixFor(call);
+			const args = call.getArguments();
+			const pattern = literalOf(args[0]);
+			if (pattern === null) continue;
+			if (verb === "resource") {
+				entryPoints.push(...expandResource(call, prefix + pattern, args[1], resolver, app, unresolved));
+				continue;
+			}
+			if (verb === "on") {
+				entryPoints.push(describe("GET", prefix + pattern, null, call, app, nameOf(call)));
+				continue;
+			}
+			const { handler, problem } = resolver(args[1], call);
+			if (problem) unresolved.push(problem);
+			entryPoints.push(describe(verb.toUpperCase(), prefix + pattern, handler, call, app, nameOf(call)));
+		}
+	}
+	return {
+		entryPoints,
+		unresolved
+	};
+}
+/**
+* `router.get`, even when broken across several lines.
+*
+* Normalising the whitespace is what separates seeing a fraction of the routes
+* from seeing all of them.
+*/
+function verbOf(call) {
+	const match = call.getExpression().getText().replace(/\s+/g, "").match(/^router\.(\w+)$/);
+	if (!match) return null;
+	const verb = match[1];
+	if (VERBS.has(verb) || verb === "resource" || verb === "on") return verb;
+	return null;
+}
+/**
+* Methods chained AFTER a call: `.prefix('/x')`, `.as('y')`, `.only([...])`.
+*
+* This has to be structural, never a regex over the statement text. The text of
+* an outer group contains the groups nested inside it, and the inner
+* `.prefix()` appears BEFORE the outer one — so the first occurrence is the
+* wrong one, and `/admin/trash/books` comes out as `/trash/trash/books`.
+*/
+function chainOf(call) {
+	const applied = /* @__PURE__ */ new Map();
+	let current = call;
+	for (let depth = 0; depth < 40; depth++) {
+		const access = current.getParent();
+		if (!access || !Node.isPropertyAccessExpression(access)) break;
+		if (access.getExpression() !== current) break;
+		const invocation = access.getParent();
+		if (!invocation || !Node.isCallExpression(invocation)) break;
+		if (!applied.has(access.getName())) applied.set(access.getName(), invocation.getArguments());
+		current = invocation;
+	}
+	return applied;
+}
+/**
+* Prefix accumulated from the groups enclosing this call.
+*
+* `.prefix()` is applied to the group, after the callback — the information
+* sits ABOVE in the AST, not beside it. Nested groups accumulate outside in.
+*/
+function prefixFor(call) {
+	const prefixes = [];
+	let current = call;
+	for (let depth = 0; depth < 20; depth++) {
+		const group = current.getAncestors().find((ancestor) => Node.isCallExpression(ancestor) && ancestor.getExpression().getText().replace(/\s+/g, "") === "router.group");
+		if (!group) break;
+		const declared = literalOf(chainOf(group).get("prefix")?.[0]);
+		if (declared) prefixes.unshift(normalizePrefix(declared));
+		current = group;
+	}
+	return prefixes.join("");
+}
+const normalizePrefix = (value) => {
+	const trimmed = value.replace(/\/+$/, "");
+	return trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
+};
+/**
+* Route name: the call's own `.as()`, prefixed by the groups' `.as()`.
+*
+* AdonisJS composes `group.route`, so an `.as('admin')` on the group turns
+* `books.index` into `admin.books.index`.
+*/
+function nameOf(call) {
+	const own = literalOf(chainOf(call).get("as")?.[0]);
+	if (!own) return void 0;
+	const groups = [];
+	let current = call;
+	for (let depth = 0; depth < 20; depth++) {
+		const group = current.getAncestors().find((ancestor) => Node.isCallExpression(ancestor) && ancestor.getExpression().getText().replace(/\s+/g, "") === "router.group");
+		if (!group) break;
+		const declared = literalOf(chainOf(group).get("as")?.[0]);
+		if (declared) groups.unshift(declared);
+		current = group;
+	}
+	return [...groups, own].join(".");
+}
+function literalOf(node) {
+	return node?.asKind(SyntaxKind.StringLiteral)?.getLiteralValue() ?? null;
+}
+function expandResource(call, base, handlerArg, resolve, app, unresolved) {
+	const chain = chainOf(call);
+	let actions = Object.keys(RESOURCE_ACTIONS);
+	const only = arrayOf(chain.get("only")?.[0]);
+	const except = arrayOf(chain.get("except")?.[0]);
+	if (only) actions = only;
+	else if (chain.has("apiOnly")) actions = API_ACTIONS;
+	if (except) actions = actions.filter((action) => !except.includes(action));
+	const { handler, problem } = resolve(handlerArg, call);
+	if (problem) unresolved.push(problem);
+	const name = nameOf(call);
+	return actions.filter((action) => RESOURCE_ACTIONS[action]).map((action) => {
+		const { verb, suffix } = RESOURCE_ACTIONS[action];
+		return describe(verb, base + suffix, handler ? {
+			...handler,
+			member: action
+		} : null, call, app, name ? `${name}.${action}` : void 0);
+	});
+}
+/** `['index', 'show']` as a list of strings, straight from the AST */
+function arrayOf(node) {
+	const array = node?.asKind(SyntaxKind.ArrayLiteralExpression);
+	if (!array) return null;
+	return array.getElements().map((element) => literalOf(element)).filter((value) => value !== null);
+}
+/**
+* Resolves `[Controller, 'method']` to a file and a method.
+*
+* Two forms coexist in the same application: a local alias via lazy import
+* (`const X = () => import('...')`) and the generated map (`controllers.mod.Name`,
+* possibly destructured). The map is indexed by the DOTTED PATH, not by the
+* bare name — modular applications routinely have several controllers sharing a
+* name across modules.
+*/
+function handlerResolver(file, app, controllers) {
+	const lazyImports = /* @__PURE__ */ new Map();
+	const destructured = /* @__PURE__ */ new Map();
+	for (const declaration of file.getVariableDeclarations()) {
+		const text = declaration.getInitializer()?.getText().replace(/\s+/g, "") ?? "";
+		const lazy = text.match(/import\(['"]([^'"]+)['"]\)/);
+		if (lazy && Node.isIdentifier(declaration.getNameNode())) {
+			lazyImports.set(declaration.getName(), lazy[1]);
+			continue;
+		}
+		const binding = declaration.getNameNode().asKind(SyntaxKind.ObjectBindingPattern);
+		if (binding && text.startsWith("controllers")) {
+			const base = text === "controllers" ? "" : text.replace(/^controllers\.?/, "");
+			for (const element of binding.getElements()) destructured.set(element.getName(), base ? `${base}.${element.getName()}` : element.getName());
+		}
+	}
+	return (handlerArg, call) => {
+		if (handlerArg && isInlineHandler(handlerArg)) return {
+			handler: {
+				file: call.getSourceFile().getFilePath(),
+				line: handlerArg.getStartLineNumber()
+			},
+			problem: null
+		};
+		const { reference, member } = referenceOf(handlerArg);
+		if (!reference) return {
+			handler: null,
+			problem: problemAt(call, handlerArg?.getText() ?? "?", "unrecognised handler")
+		};
+		const specifier = specifierFor(reference, lazyImports, destructured, controllers);
+		if (!specifier) return {
+			handler: null,
+			problem: problemAt(call, reference, "unresolved controller")
+		};
+		const target = app.resolveSpecifier(specifier);
+		if (!target) return {
+			handler: null,
+			problem: problemAt(call, reference, `unresolved path: ${specifier}`)
+		};
+		return {
+			handler: {
+				file: target,
+				member
+			},
+			problem: null
+		};
+	};
+}
+/**
+* `({ response }) => …` or `function (ctx) { … }` passed straight to the route.
+*
+* This is not "unresolved controller": it is a handler with a body, and filing
+* it as unresolved would lose the whole transaction and point at the wrong
+* reason as well.
+*/
+function isInlineHandler(node) {
+	return Node.isArrowFunction(node) || Node.isFunctionExpression(node);
+}
+/** `[X, 'method']`, `[X]` or `X` */
+function referenceOf(node) {
+	if (!node) return { reference: null };
+	const array = node.asKind(SyntaxKind.ArrayLiteralExpression);
+	if (array) {
+		const elements = array.getElements();
+		return {
+			reference: elements[0]?.getText().replace(/\s+/g, "") ?? null,
+			member: literalOf(elements[1]) ?? void 0
+		};
+	}
+	return { reference: node.getText().replace(/\s+/g, "") };
+}
+function specifierFor(reference, lazyImports, destructured, controllers) {
+	if (lazyImports.has(reference)) return lazyImports.get(reference);
+	if (reference.startsWith("controllers.")) return controllers.get(reference.slice(12)) ?? null;
+	const [head, ...rest] = reference.split(".");
+	const base = destructured.get(head);
+	if (base) {
+		const key = rest.length > 0 ? `${base}.${rest.join(".")}` : base;
+		return controllers.get(key) ?? null;
+	}
+	return null;
+}
+/** generated map, indexed by the full dotted path */
+function readControllersMap(project, file) {
+	const map = /* @__PURE__ */ new Map();
+	const source = project.addSourceFileAtPathIfExists(file);
+	if (!source) return map;
+	const root = source.getVariableDeclaration("controllers")?.getInitializer()?.asKind(SyntaxKind.ObjectLiteralExpression);
+	if (!root) return map;
+	const walk = (object, prefix) => {
+		for (const property of object.getProperties()) {
+			if (!Node.isPropertyAssignment(property)) continue;
+			const key = property.getName().replace(/['"]/g, "");
+			const dotted = prefix ? `${prefix}.${key}` : key;
+			const initializer = property.getInitializer();
+			const nested = initializer?.asKind(SyntaxKind.ObjectLiteralExpression);
+			if (nested) {
+				walk(nested, dotted);
+				continue;
+			}
+			const specifier = initializer?.getText().match(/import\(['"]([^'"]+)['"]\)/);
+			if (specifier) map.set(dotted, specifier[1]);
+		}
+	};
+	walk(root, "");
+	return map;
+}
+function describe(verb, pattern, handler, call, app, name) {
+	const signature = normalizePattern(pattern);
+	const file = call.getSourceFile().getFilePath();
+	return {
+		id: `${verb} ${signature}`,
+		kind: "http",
+		module: handler ? app.moduleOf(handler.file) : app.moduleOf(file),
+		trigger: verb,
+		signature,
+		name,
+		handler,
+		identity: `${verb} ${anonymizeParams(signature)}`,
+		provenance: {
+			file,
+			line: call.getStartLineNumber(),
+			by: "routes-ast"
+		}
+	};
+}
+const normalizePattern = (pattern) => {
+	const withSlash = pattern.startsWith("/") ? pattern : `/${pattern}`;
+	return withSlash.length > 1 ? withSlash.replace(/\/+$/, "") : withSlash;
+};
+/**
+* `/books/:id` and `/books/:uuid` are the same function to the user.
+*
+* Without this, renaming a parameter would read as a deletion plus an addition
+* in `fp:diff` and bill twice — counting-decisions §5.
+*/
+const anonymizeParams = (pattern) => pattern.replace(/:[A-Za-z_][\w]*/g, ":param");
+const problemAt = (call, expression, reason) => ({
+	file: call.getSourceFile().getFilePath(),
+	line: call.getStartLineNumber(),
+	expression,
+	reason
+});
+//#endregion
+//#region src/inventory/sources/json_schemas.ts
+function collectJsonSchemas(app) {
+	const project = new Project({
+		skipAddingFilesFromTsConfig: true,
+		skipFileDependencyResolution: true,
+		compilerOptions: { allowJs: false }
+	});
+	for (const root of app.scanRoots) project.addSourceFilesAtPaths(`${root}/**/*.ts`);
+	const found = /* @__PURE__ */ new Map();
+	for (const file of project.getSourceFiles()) for (const declaration of file.getVariableDeclarations()) {
+		const literal = unwrap(declaration.getInitializer())?.asKind(SyntaxKind.ObjectLiteralExpression);
+		if (!literal || !isJsonSchema(literal)) continue;
+		const leaves = leavesOf$1(literal);
+		if (leaves.length === 0) continue;
+		found.set(declaration.getName(), {
+			name: declaration.getName(),
+			fields: leaves.length,
+			leaves,
+			provenance: {
+				file: toPosix(file.getFilePath()),
+				line: declaration.getStartLineNumber(),
+				by: "json-schema"
+			}
+		});
+	}
+	return found;
+}
+/** `{ … } as const` and `{ … } satisfies X` still hold the literal */
+function unwrap(node) {
+	if (!node) return void 0;
+	if (Node.isAsExpression(node) || Node.isSatisfiesExpression(node)) return unwrap(node.getExpression());
+	return node;
+}
+/**
+* Recognised by shape, never by name.
+*
+* A const called `schema` may be anything; an object declaring `type: 'object'`
+* with a `properties` map is a JSON Schema whatever it is called.
+*/
+function isJsonSchema(literal) {
+	return (literal.getProperty("type")?.asKind(SyntaxKind.PropertyAssignment))?.getInitializer()?.asKind(SyntaxKind.StringLiteral)?.getLiteralValue() === "object" && literal.getProperty("properties") !== void 0;
+}
+/**
+* Leaves of a JSON Schema, by the table in counting-decisions §7.
+*
+*   scalar                  1
+*   nested object           leaves counted individually
+*   array of scalar         1  (repeating group)
+*   array of object         the object's leaves, once
+*   enum / const            1
+*/
+function leavesOf$1(literal, prefix = "") {
+	const properties = literal.getProperty("properties")?.asKind(SyntaxKind.PropertyAssignment);
+	const items = literal.getProperty("items")?.asKind(SyntaxKind.PropertyAssignment);
+	if (properties) {
+		const map = properties.getInitializer()?.asKind(SyntaxKind.ObjectLiteralExpression);
+		if (!map) return [];
+		return map.getProperties().flatMap((property) => {
+			const assignment = property.asKind(SyntaxKind.PropertyAssignment);
+			if (!assignment) return [];
+			const name = assignment.getName().replace(/['"]/g, "");
+			const path = prefix ? `${prefix}.${name}` : name;
+			const nested = unwrap(assignment.getInitializer())?.asKind(SyntaxKind.ObjectLiteralExpression);
+			const inner = nested ? leavesOf$1(nested, path) : [];
+			return inner.length > 0 ? inner : [path];
+		});
+	}
+	if (items) {
+		const element = unwrap(items.getInitializer())?.asKind(SyntaxKind.ObjectLiteralExpression);
+		const inner = element ? leavesOf$1(element, prefix) : [];
+		return inner.length > 0 ? inner : [prefix];
+	}
+	return [];
+}
+//#endregion
+//#region src/inventory/graph/noise.ts
+/**
+* Calls that cannot be a data access, and so must not count against coverage.
+*
+* Coverage is all-or-nothing per transaction — one unresolved call sinks the
+* whole thing — so reporting a `Map.get()` costs a transaction, not a line. On
+* a production application that dragged the metric from what the tracing
+* actually achieves down to 53%, and a gate that fails spuriously does not
+* protect: it teaches people to switch the gate off.
+*
+* The bar for silencing anything here is high, because a silent drop is the
+* worst defect this package can have. So the rule is to decide by what the
+* RECEIVER IS, resolved from the code, rather than by what the method is
+* called: `get`, `find` and `has` are Map methods and repository methods alike,
+* and a list of method names would hide real gaps to buy coverage.
+*/
+/** built-ins whose methods are never an application data access */
+const NATIVE_TYPES = new Set([
+	"Map",
+	"Set",
+	"WeakMap",
+	"WeakSet",
+	"Array",
+	"Date",
+	"RegExp",
+	"Promise",
+	"Intl",
+	"URL",
+	"URLSearchParams"
+]);
+/**
+* Methods that cannot be a data access whatever the receiver.
+*
+* Deliberately short, and deliberately excludes `get`, `set`, `has`, `find`,
+* `first`, `all`, `create`, `update`, `delete`, `save` and `count` — every one
+* of those is as plausible on a repository as on a collection.
+*/
+const NEVER_DATA_METHODS = new Set([
+	"includes",
+	"indexOf",
+	"join",
+	"split",
+	"trim",
+	"toLowerCase",
+	"toUpperCase",
+	"padStart",
+	"padEnd",
+	"toISO",
+	"toISODate",
+	"toFormat",
+	"toUTC",
+	"toSQL",
+	"toJSDate",
+	"toRelative",
+	"useTransaction",
+	"serialize",
+	"serializeAttributes",
+	"toJSON",
+	"validate",
+	"catch",
+	"then",
+	"finally",
+	"pick",
+	"whenLoaded",
+	"whenNotNull",
+	"primitive"
+]);
+/**
+* AdonisJS services, which reach the tracer through an application alias.
+*
+* `env` is imported from `#start/env`, an application module, so the symbol
+* resolves and then no body is found — the implementation lives in the
+* package. They are named by convention and unambiguous in an AdonisJS app.
+*/
+const FRAMEWORK_SERVICES = new Set([
+	"env",
+	"logger",
+	"health",
+	"hash",
+	"mail",
+	"drive",
+	"emitter",
+	"router",
+	"encryption",
+	"i18n",
+	"ally",
+	"bouncer"
+]);
+/** Is this call one that cannot reach a data store? */
+function isNoise(call, owner) {
+	const expression = call.getExpression();
+	if (!Node.isPropertyAccessExpression(expression)) return false;
+	if (NEVER_DATA_METHODS.has(expression.getName())) return true;
+	const receiver = expression.getExpression();
+	if (Node.isIdentifier(receiver) && FRAMEWORK_SERVICES.has(receiver.getText())) return true;
+	/**
+	* `this.logger?.error(…)`: the same services also arrive as class properties,
+	* injected or assigned, and then the receiver is a property access rather
+	* than a bare identifier.
+	*/
+	if (Node.isPropertyAccessExpression(receiver) && Node.isThisExpression(receiver.getExpression()) && FRAMEWORK_SERVICES.has(receiver.getName())) return true;
+	return isNativeReceiver(receiver, owner);
+}
+/** Does the receiver resolve to a built-in, by its declaration? */
+function isNativeReceiver(receiver, owner) {
+	if (Node.isArrayLiteralExpression(receiver) || Node.isStringLiteral(receiver)) return true;
+	if (Node.isPropertyAccessExpression(receiver) && receiver.getExpression().getKind()) {
+		const inner = receiver.getExpression();
+		if (Node.isThisExpression(inner) && owner) return isNativeProperty(owner, receiver.getName());
+	}
+	return false;
+}
+function isNativeProperty(owner, name) {
+	/**
+	* Both shapes declare a field: a class property, and a constructor parameter
+	* property. Reading only the first missed every `Map` handed in through the
+	* constructor, which is how a transformer usually receives its lookups.
+	*/
+	const property = owner.getProperty(name) ?? owner.getConstructors()[0]?.getParameters().find((parameter) => parameter.getName() === name);
+	if (!property) return false;
+	const typeNode = property.getTypeNode()?.getText();
+	if (typeNode && NATIVE_TYPES.has(typeNode.replace(/<.*/, "").trim())) return true;
+	const initializer = property.getInitializer();
+	if (initializer && Node.isNewExpression(initializer)) return NATIVE_TYPES.has(initializer.getExpression().getText());
+	return initializer !== void 0 && (Node.isArrayLiteralExpression(initializer) || Node.isStringLiteral(initializer));
+}
+/**
+* The body-not-found path: a symbol resolved to an application file whose
+* member is not there. For a framework service that is expected — the
+* implementation is in the package — and says nothing about tracing quality.
+*/
+function isNoiseMember(file, member) {
+	if (member && NEVER_DATA_METHODS.has(member)) return true;
+	const base = file.split("/").pop()?.replace(/\.[jt]s$/, "");
+	return base !== void 0 && FRAMEWORK_SERVICES.has(base);
+}
+//#endregion
+//#region src/inventory/graph/call_graph.ts
+/**
+* Fields declared by the validators used in this body.
+*
+* `request.validateUsing(createBookValidator)` -> resolve the validator ->
+* count the leaves of the `vine.object`, per the table in counting-decisions §7:
+*
+*   scalar                           1
+*   nested object                    leaves counted individually
+*   array of scalar                  1  (repeating group)
+*   array of object                  leaves, counted once
+*   unresolved spread                0, and reported — never guessed
+*/
+function validatorFieldsIn(body, file, app) {
+	const fields = [];
+	for (const call of body.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+		const expression = call.getExpression();
+		if (!Node.isPropertyAccessExpression(expression)) continue;
+		if (expression.getName() !== "validateUsing") continue;
+		const argument = call.getArguments()[0];
+		if (!argument || !Node.isIdentifier(argument)) continue;
+		const name = argument.getText();
+		const declaration = findValidator(name, file, app);
+		if (!declaration) continue;
+		for (const leaf of leavesOf(declaration)) fields.push(`${name}.${leaf}`);
+	}
+	return fields;
+}
+/** validator declaration: in this file, or imported from the application */
+function findValidator(name, file, app) {
+	const local = file.getVariableDeclaration(name)?.getInitializer();
+	if (local) return local;
+	for (const declaration of file.getImportDeclarations()) {
+		if (!declaration.getNamedImports().map((named) => named.getName()).includes(name)) continue;
+		const target = app.resolveSpecifier(declaration.getModuleSpecifierValue());
+		if (!target) continue;
+		const initializer = file.getProject().getSourceFile(target)?.getVariableDeclaration(name)?.getInitializer();
+		if (initializer) return initializer;
+	}
+	return null;
+}
+/** leaves of a VineJS schema, per the table in §7 */
+function leavesOf(node) {
+	const object = node.getFirstDescendantByKind(SyntaxKind.ObjectLiteralExpression);
+	if (!object) return [];
+	const leaves = [];
+	const walk = (literal, prefix) => {
+		for (const property of literal.getProperties()) {
+			if (!Node.isPropertyAssignment(property)) continue;
+			const name = property.getName().replace(/['"]/g, "");
+			const text = property.getText();
+			const nested = property.getFirstDescendantByKind(SyntaxKind.ObjectLiteralExpression);
+			if (nested && /vine\.object/.test(text)) {
+				walk(nested, prefix ? `${prefix}.${name}` : name);
+				continue;
+			}
+			leaves.push(prefix ? `${prefix}.${name}` : name);
+		}
+	};
+	walk(object, "");
+	return leaves;
+}
+/** file name, to identify the unresolved call without dumping the full path */
+const pathOf = (file) => file.split("/").pop()?.replace(/\.ts$/, "") ?? file;
+const DEFAULT_MAX_DEPTH = 3;
+/**
+* Analyzer with state shared across handlers.
+*
+* The ts-morph `Project` and the symbol cache are expensive to build and
+* identical for every handler of the same application. Creating one per handler
+* multiplies the cost by the number of routes, which is the difference between
+* minutes and seconds on an application of a few hundred routes.
+*/
+function createAnalyzer(app, stores, options = {}) {
+	const project = new Project({
+		skipAddingFilesFromTsConfig: true,
+		skipFileDependencyResolution: true,
+		compilerOptions: { allowJs: false }
+	});
+	/**
+	* Every file is loaded up front.
+	*
+	* Adding a file part-way through the analysis invalidates the TypeScript
+	* program, and the next query to the checker rebuilds it — a cost paid once
+	* per route, uniformly. Loading everything first trades N rebuilds for one.
+	*/
+	for (const root of app.scanRoots) project.addSourceFilesAtPaths(`${root}/**/*.ts`);
+	const storesByName = new Map(stores.map((store) => [store.name, store]));
+	const relationsByStore = new Map(stores.map((store) => [store.name, store.relations]));
+	const maxDepth = options.maxDepth ?? DEFAULT_MAX_DEPTH;
+	const resolvers = [...options.callResolvers ?? [], ...BUILTIN_CALL_RESOLVERS].sort((a, b) => (a.order ?? 100) - (b.order ?? 100));
+	const files = /* @__PURE__ */ new Map();
+	const sourceFile = (absPath) => {
+		if (!files.has(absPath)) files.set(absPath, project.getSourceFile(absPath) ?? project.addSourceFileAtPathIfExists(absPath) ?? null);
+		return files.get(absPath) ?? null;
+	};
+	/** imports per file, computed once */
+	const importCache = /* @__PURE__ */ new Map();
+	const importsFor = (file) => {
+		const key = file.getFilePath();
+		let cached = importCache.get(key);
+		if (!cached) {
+			cached = importsOf(file, app);
+			importCache.set(key, cached);
+		}
+		return cached;
+	};
+	/**
+	* Facts about a body: what it accesses and where it calls into.
+	*
+	* They are INDEPENDENT of the caller — only the decision to follow depends on
+	* depth. Without this cache a shared service is re-analysed once per route
+	* that reaches it, and the cost grows with routes × depth.
+	*/
+	/**
+	* Hook methods of a model, by the decorators an access fires.
+	*
+	* The model file comes from the store's own provenance, so this asks the
+	* inventory rather than guessing a path. Cached per store and method because
+	* a transaction can touch the same model many times.
+	*/
+	const hookCache = /* @__PURE__ */ new Map();
+	const hookRefsFor = (access) => {
+		const decorators = hooksFiredBy(access);
+		if (decorators.length === 0) return [];
+		const key = `${access.store}#${access.method}`;
+		const cached = hookCache.get(key);
+		if (cached) return cached;
+		const store = storesByName.get(access.store);
+		const modelFile = store ? sourceFile(store.provenance.file) : null;
+		const wanted = new Set(decorators);
+		const refs = [];
+		for (const cls of modelFile?.getClasses() ?? []) for (const method of cls.getMethods()) if (method.getDecorators().some((decorator) => wanted.has(decorator.getName()))) refs.push({
+			file: store.provenance.file,
+			member: method.getName()
+		});
+		hookCache.set(key, refs);
+		return refs;
+	};
+	const factsCache = /* @__PURE__ */ new Map();
+	const factsFor = (ref) => {
+		const key = `${ref.file}#${ref.member ?? ref.line ?? "*"}`;
+		if (factsCache.has(key)) return factsCache.get(key) ?? null;
+		const facts = computeFacts(ref);
+		factsCache.set(key, facts);
+		return facts;
+	};
+	function computeFacts(ref) {
+		const file = sourceFile(ref.file);
+		if (!file) return null;
+		const body = findBody(file, ref);
+		if (!body) return null;
+		const imports = importsFor(file);
+		/** the class this body belongs to: how `this.something` resolves */
+		const owner = body.getFirstAncestorByKind(SyntaxKind.ClassDeclaration);
+		const injected = injectedFor(owner, file, app);
+		const symbols = storeSymbolsFor(body, file, app, storesByName);
+		const accesses = [];
+		const followUps = [];
+		const unresolved = [];
+		const validators = validatorFieldsIn(body, file, app);
+		for (const call of body.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+			const access = detectAccess(call, symbols, relationsByStore);
+			if (access) {
+				accesses.push({
+					store: access.store,
+					write: access.mode === "write"
+				});
+				if (access.viaRelation) accesses.push({
+					store: access.viaRelation,
+					write: false
+				});
+				/**
+				* counting-decisions §3: a hook belongs to the transaction that fired
+				* it. It crosses no boundary — it fires inside one that already did —
+				* so its accesses are this transaction's, and AFP §6.5.3 requires
+				* aggregating every path reached.
+				*/
+				for (const hook of hookRefsFor(access)) followUps.push({
+					ref: hook,
+					by: "model-hook"
+				});
+				continue;
+			}
+			const resolved = resolveCall(call, {
+				file,
+				depth: 0,
+				imports,
+				injected,
+				dataStoresBySymbol: storesByName,
+				resolveSpecifier: app.resolveSpecifier,
+				sourceFile
+			}, resolvers);
+			if (resolved) {
+				for (const next of resolved.refs) followUps.push({
+					ref: next,
+					by: resolved.by
+				});
+				continue;
+			}
+			if (isWorthReporting(call, symbols, imports) && !isNoise(call, owner)) unresolved.push({
+				file: ref.file,
+				line: call.getStartLineNumber(),
+				expression: call.getExpression().getText().replace(/\s+/g, ""),
+				reason: "call that no strategy knew how to follow"
+			});
+		}
+		return {
+			accesses,
+			followUps,
+			unresolved,
+			validators,
+			bodyHash: hashOf(body)
+		};
+	}
+	return {
+		analyze: (handler) => run(handler),
+		/** how many files the project loaded — used to prove it does not grow */
+		fileCount: () => project.getSourceFiles().length
+	};
+	function run(handler) {
+		const touches = /* @__PURE__ */ new Set();
+		const inputFields = /* @__PURE__ */ new Set();
+		const trace = [];
+		const scope = [];
+		const unresolved = [];
+		const visited = /* @__PURE__ */ new Set();
+		let writes = false;
+		const visit = (ref, depth) => {
+			const key = `${ref.file}#${ref.member ?? ref.line ?? "*"}`;
+			if (visited.has(key) || depth > maxDepth) return;
+			visited.add(key);
+			const facts = factsFor(ref);
+			if (!facts) {
+				/**
+				* The resolver got the file right, but the body is not there — an
+				* inherited method from a package class, for example
+				* (`Transformer.transform()` coming from `BaseTransformer`).
+				*
+				* Dropping it silently is the worst possible defect: the transaction
+				* loses a path and nobody knows.
+				*/
+				if (!isNoiseMember(ref.file, ref.member)) unresolved.push({
+					file: ref.file,
+					line: ref.line ?? 0,
+					expression: `${pathOf(ref.file)}.${ref.member ?? "handle"}`,
+					reason: "body not found in the resolved file: probably inherited from a package class"
+				});
+				return;
+			}
+			let bodyWrites = false;
+			for (const access of facts.accesses) {
+				touches.add(access.store);
+				if (access.write) {
+					bodyWrites = true;
+					writes = true;
+				}
+			}
+			unresolved.push(...facts.unresolved);
+			for (const field of facts.validators) inputFields.add(field);
+			trace.push({
+				file: ref.file,
+				member: ref.member,
+				depth,
+				by: ref.member ?? "entry",
+				writes: bodyWrites
+			});
+			scope.push({
+				file: ref.file,
+				member: ref.member,
+				bodyHash: facts.bodyHash
+			});
+			if (depth >= maxDepth) return;
+			for (const followUp of facts.followUps) {
+				const before = trace.length;
+				visit(followUp.ref, depth + 1);
+				if (trace.length > before) trace[before].by = followUp.by;
+			}
+		};
+		visit(handler, 0);
+		return {
+			writes,
+			touches: [...touches].sort(),
+			inputFields: [...inputFields].sort(),
+			trace,
+			scope,
+			unresolved
+		};
+	}
+}
+/**
+* Resolves a `HandlerRef` to the corresponding body.
+*
+* Three forms coexist: a named method, a single-action handler (`handle`), and
+* an inline closure declared on the route itself — the last one located by
+* line, because it has no name.
+*/
+function findBody(file, ref) {
+	if (ref.line !== void 0) {
+		const inline = file.getDescendants().find((node) => (Node.isArrowFunction(node) || Node.isFunctionExpression(node)) && node.getStartLineNumber() === ref.line);
+		if (inline) return inline;
+	}
+	if (ref.member) {
+		for (const cls of file.getClasses()) {
+			const method = cls.getMethod(ref.member);
+			if (method) return method;
+		}
+		const fn = file.getFunction(ref.member);
+		if (fn) return fn;
+		return null;
+	}
+	for (const cls of file.getClasses()) {
+		const handle = cls.getMethod("handle");
+		if (handle) return handle;
+		const publicMethods = cls.getMethods().filter((method) => !method.hasModifier("private"));
+		if (publicMethods.length === 1) return publicMethods[0];
+	}
+	return null;
+}
+/**
+* Builds the symbol map valid INSIDE this body.
+*
+* It includes the models imported in the file and the local variables derived
+* from them: `const invite = await Invite.findOrFail(...)` makes `invite.save()`
+* count as a write to `Invite`.
+*/
+function storeSymbolsFor(body, file, app, stores) {
+	const symbols = /* @__PURE__ */ new Map();
+	for (const declaration of file.getImportDeclarations()) {
+		if (!app.resolveSpecifier(declaration.getModuleSpecifierValue())) continue;
+		const local = declaration.getDefaultImport()?.getText();
+		if (local && stores.has(local)) symbols.set(local, local);
+		for (const named of declaration.getNamedImports()) {
+			const binding = named.getAliasNode()?.getText() ?? named.getName();
+			if (stores.has(named.getName())) symbols.set(binding, named.getName());
+		}
+	}
+	for (const declaration of body.getDescendantsOfKind(SyntaxKind.VariableDeclaration)) {
+		const initializer = declaration.getInitializer();
+		const name = declaration.getNameNode();
+		if (!initializer || !Node.isIdentifier(name)) continue;
+		const root = rootSymbolOf(initializer);
+		const store = root ? symbols.get(root) : void 0;
+		if (store) symbols.set(name.getText(), store);
+	}
+	if (Node.isMethodDeclaration(body) || Node.isFunctionDeclaration(body)) for (const parameter of body.getParameters()) {
+		const typeNode = parameter.getTypeNode();
+		const nameNode = parameter.getNameNode();
+		const typeName = typeNode?.getText();
+		if (typeName && stores.has(typeName) && Node.isIdentifier(nameNode)) {
+			symbols.set(nameNode.getText(), typeName);
+			continue;
+		}
+		/**
+		* Named type: `handle(input: ExpireInviteInput)` with
+		* `interface ExpireInviteInput { invite: Invite }`.
+		*
+		* Registers the PATH `input.invite`, because that is how the write
+		* appears: `input.invite.save()`.
+		*/
+		if (typeNode && Node.isIdentifier(nameNode)) {
+			for (const [property, propertyType] of membersOfType(typeNode, file, app)) if (stores.has(propertyType)) symbols.set(`${nameNode.getText()}.${property}`, propertyType);
+		}
+		/**
+		* Destructured form: `handle({ invite }: { invite: Invite })`.
+		*
+		* This is the dominant shape in the action-object pattern — the action
+		* receives a named payload. Without it, `invite.save()` inside the action
+		* does not count as a write, and the whole transaction becomes an EO
+		* instead of an EI.
+		*/
+		const binding = nameNode.asKind(SyntaxKind.ObjectBindingPattern);
+		const literal = typeNode?.asKind(SyntaxKind.TypeLiteral);
+		if (!binding || !literal) continue;
+		const propertyTypes = /* @__PURE__ */ new Map();
+		for (const member of literal.getMembers()) {
+			if (!Node.isPropertySignature(member)) continue;
+			const memberType = member.getTypeNode()?.getText();
+			if (memberType) propertyTypes.set(member.getName(), memberType);
+		}
+		for (const element of binding.getElements()) {
+			const property = element.getPropertyNameNode()?.getText() ?? element.getName();
+			const resolved = propertyTypes.get(property);
+			if (resolved && stores.has(resolved)) symbols.set(element.getName(), resolved);
+		}
+	}
+	return symbols;
+}
+/**
+* Injected dependencies visible in the body: property name -> file.
+*
+* Two forms, both with the type annotated explicitly — `@inject()` does not
+* work without it:
+*
+*   constructor(protected billing: BillingService) {}
+*   private declare billing: BillingService
+*
+* Since the type is an imported identifier, it resolves through the same path
+* as any import. No type checker is needed.
+*/
+function injectedFor(owner, file, app) {
+	const injected = /* @__PURE__ */ new Map();
+	if (!owner) return injected;
+	const register = (property, typeName) => {
+		if (!typeName) return;
+		const target = resolveTypeToFile(typeName, file, app);
+		if (target) injected.set(property, target);
+	};
+	for (const parameter of owner.getConstructors()[0]?.getParameters() ?? []) register(parameter.getName(), dependencyTypeOf(parameter));
+	for (const property of owner.getProperties()) register(property.getName(), dependencyTypeOf(property));
+	return injected;
+}
+/**
+* The declared type of a dependency, or the class its default value builds.
+*
+*     constructor(private invites: InviteService) {}        annotation
+*     constructor(private invites = new InviteService()) {} default value
+*
+* The second is injection without the container, and it carries no type
+* annotation at all — the type is inferred from the initialiser. Reading only
+* `getTypeNode()` saw nothing there, and the consequence was not a gap in
+* coverage but a wrong classification: the write inside the service stayed
+* invisible, so the transaction counted as an EO instead of an EI.
+*/
+function dependencyTypeOf(node) {
+	const declared = node.getTypeNode()?.getText();
+	if (declared) return declared;
+	const initializer = node.getInitializer();
+	if (initializer && Node.isNewExpression(initializer)) {
+		const target = initializer.getExpression();
+		if (Node.isIdentifier(target)) return target.getText();
+	}
+}
+/** type identifier -> application file where it is declared */
+function resolveTypeToFile(typeName, file, app) {
+	const bare = typeName.replace(/<.*/, "").trim();
+	for (const declaration of file.getImportDeclarations()) {
+		const specifier = declaration.getModuleSpecifierValue();
+		if (declaration.getDefaultImport()?.getText() === bare) return app.resolveSpecifier(specifier);
+		for (const named of declaration.getNamedImports()) if ((named.getAliasNode()?.getText() ?? named.getName()) === bare) return app.resolveSpecifier(specifier);
+	}
+	return null;
+}
+/**
+* Members of a declared type: `interface X { a: A }` -> { a: 'A' }.
+*
+* Accepts an inline type literal and a named type declared in this file or
+* imported from the application. Anything else yields empty — no guessing.
+*/
+function membersOfType(typeNode, file, app) {
+	const members = /* @__PURE__ */ new Map();
+	const collect = (node) => {
+		const holders = Node.isTypeLiteral(node) ? node.getMembers() : Node.isInterfaceDeclaration(node) ? node.getMembers() : [];
+		for (const member of holders) {
+			if (!Node.isPropertySignature(member)) continue;
+			const memberType = member.getTypeNode()?.getText();
+			if (memberType) members.set(member.getName(), memberType);
+		}
+	};
+	if (Node.isTypeLiteral(typeNode)) {
+		collect(typeNode);
+		return members;
+	}
+	if (!Node.isTypeReference(typeNode)) return members;
+	const name = typeNode.getTypeName().getText();
+	const local = file.getInterface(name) ?? file.getTypeAlias(name);
+	if (local) {
+		collect(Node.isTypeAliasDeclaration(local) ? local.getTypeNode() ?? local : local);
+		return members;
+	}
+	for (const declaration of file.getImportDeclarations()) {
+		const target = app.resolveSpecifier(declaration.getModuleSpecifierValue());
+		if (!target) continue;
+		if (!declaration.getNamedImports().map((named) => named.getName()).includes(name)) continue;
+		const source = file.getProject().addSourceFileAtPathIfExists(target);
+		const declared = source?.getInterface(name) ?? source?.getTypeAlias(name);
+		if (declared) collect(Node.isTypeAliasDeclaration(declared) ? declared.getTypeNode() ?? declared : declared);
+	}
+	return members;
+}
+function importsOf(file, app) {
+	const map = /* @__PURE__ */ new Map();
+	for (const declaration of file.getImportDeclarations()) {
+		const target = app.resolveSpecifier(declaration.getModuleSpecifierValue());
+		if (!target) continue;
+		const defaultImport = declaration.getDefaultImport()?.getText();
+		if (defaultImport) map.set(defaultImport, target);
+		for (const named of declaration.getNamedImports()) map.set(named.getAliasNode()?.getText() ?? named.getName(), target);
+	}
+	return map;
+}
+/**
+* Not every unfollowed call is an unresolved call — but the filter must err on
+* the side of reporting.
+*
+* `response.redirect()` and `inertia.render()` lead to no data at all and would
+* only drown the report. But a call on a symbol imported from the APPLICATION
+* itself may hide a data access, and silencing it is the worst possible defect
+* here: the transaction becomes an EO and nobody knows.
+*
+* A filter that only reported `this.` would hide most of the real gap.
+*/
+function isWorthReporting(call, symbols, imports) {
+	const expression = call.getExpression();
+	if (Node.isIdentifier(expression)) return imports.has(expression.getText());
+	if (!Node.isPropertyAccessExpression(expression)) return false;
+	const root = rootSymbolOf(expression.getExpression());
+	if (!root) return false;
+	if (symbols.has(root)) return false;
+	if (root === "this") return true;
+	return imports.has(root);
+}
+/**
+* Hash of the NORMALISED body: comments and whitespace removed.
+*
+* counting-decisions §5 measures modification by a checksum of the
+* implementation scope. If the hash were over the raw bytes, running Prettier
+* would turn into an invoice.
+*/
+function hashOf(body) {
+	const normalized = body.getText().replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/[^\n]*/g, "").replace(/\s+/g, "");
+	return createHash("sha256").update(normalized).digest("hex").slice(0, 16);
+}
+//#endregion
+//#region src/albrecht/tables.ts
+/** shared grid: [ref band][DET band] -> complexity */
+const GRID = [
+	[
+		"low",
+		"low",
+		"average"
+	],
+	[
+		"low",
+		"average",
+		"high"
+	],
+	[
+		"average",
+		"high",
+		"high"
+	]
+];
+const DEFAULT_TABLES = {
+	ILF: {
+		refBands: [1, 5],
+		detBands: [19, 50]
+	},
+	EIF: {
+		refBands: [1, 5],
+		detBands: [19, 50]
+	},
+	EI: {
+		refBands: [1, 2],
+		detBands: [4, 15]
+	},
+	EO: {
+		refBands: [1, 3],
+		detBands: [5, 19]
+	},
+	EQ: {
+		refBands: [1, 3],
+		detBands: [5, 19]
+	}
+};
+const DEFAULT_WEIGHTS = {
+	ILF: {
+		low: 7,
+		average: 10,
+		high: 15
+	},
+	EIF: {
+		low: 5,
+		average: 7,
+		high: 10
+	},
+	EI: {
+		low: 3,
+		average: 4,
+		high: 6
+	},
+	EO: {
+		low: 4,
+		average: 5,
+		high: 7
+	},
+	EQ: {
+		low: 3,
+		average: 4,
+		high: 6
+	}
+};
+const bandOf = (value, [a, b]) => value <= a ? 0 : value <= b ? 1 : 2;
+function complexityOf(type, refs, det, tables = DEFAULT_TABLES) {
+	const table = tables[type];
+	return GRID[bandOf(refs, table.refBands)][bandOf(det, table.detBands)];
+}
+function pointsOf(type, complexity, weights = DEFAULT_WEIGHTS) {
+	return weights[type][complexity];
+}
+//#endregion
+//#region src/albrecht/data_functions.ts
+function countDataFunctions(stores, usage, options) {
+	const counted = [];
+	for (const store of stores) {
+		const use = usage.get(store.name);
+		if (!use?.used) continue;
+		/**
+		* DETs exclude the technical identifier.
+		*
+		* IFPUG defines a DET as a "user recognizable" attribute, and an
+		* auto-increment surrogate key is not something the user recognises.
+		* Counting it would inflate every data function by one.
+		*/
+		const detAttributes = store.attributes.filter((attribute) => !attribute.isIdentifier);
+		const det = detAttributes.length;
+		const refs = options.retStrategy === "composition" ? 1 + store.subgroups.length : 1;
+		const type = options.externallyMaintained.has(store.name) || !use.written ? "EIF" : "ILF";
+		const complexity = complexityOf(type, refs, det, options.tables);
+		counted.push({
+			id: `data:${store.name}`,
+			name: store.name,
+			module: store.module,
+			type,
+			det,
+			refs,
+			complexity,
+			points: pointsOf(type, complexity, options.weights),
+			rationale: {
+				rule: options.externallyMaintained.has(store.name) ? "afp:6.5.4 externally maintained by boundary configuration -> EIF" : use.written ? "afp:6.5.4 maintained by an application transaction -> ILF" : "afp:6.5.4 used but not maintained -> EIF",
+				detSources: detAttributes.map((attribute) => `${store.columnSource}:${store.table ?? store.name}.${attribute.name}`),
+				refSources: options.retStrategy === "composition" ? ["1 (main group)", ...store.subgroups.map((s) => `composition:${s}`)] : ["1 (constant: a logical subgroup is not derivable from code)"]
+			}
+		});
+	}
+	return counted;
+}
+//#endregion
+//#region src/albrecht/transactional_functions.ts
+function countTransactionalFunctions(entryPoints, behaviors, options) {
+	const counted = [];
+	for (const entry of entryPoints) {
+		const behavior = behaviors.get(entry.id);
+		if (!behavior) continue;
+		const touched = behavior.touches.filter((store) => options.countedStores.has(store));
+		/**
+		* No path down to any data function means there is no transaction to
+		* identify (AFP §6.5.3). This falls out of the general rule — no special
+		* case is needed for static routes.
+		*/
+		if (touched.length === 0) continue;
+		const type = behavior.writes ? "EI" : "EO";
+		const refs = touched.length;
+		const { det, sources } = detsFor(entry, behavior, touched, type, options);
+		const complexity = complexityOf(type, refs, det, options.tables);
+		counted.push({
+			id: `tx:${entry.identity}`,
+			name: entry.identity,
+			module: entry.module,
+			type,
+			det,
+			refs,
+			complexity,
+			points: pointsOf(type, complexity, options.weights),
+			scopeHash: scopeHashOf(behavior),
+			rationale: {
+				rule: behavior.writes ? "afp:6.5.3 modifies a data store -> EI" : "afp:6.5.3 uses without modifying -> EO (EQ collapsed per 6.5.3)",
+				detSources: sources,
+				refSources: touched.map((store) => `reaches:${store}`),
+				trace: behavior.trace
+			}
+		});
+	}
+	return counted;
+}
+/**
+* Combined hash of the implementation scope, consumed by `fp:diff`.
+*
+* Sorted before combining: traversal order can vary without the code having
+* changed, and an unstable hash would turn every release into a "change".
+*/
+function scopeHashOf(behavior) {
+	return behavior.scope.map((entry) => `${entry.member ?? "*"}:${entry.bodyHash}`).sort().join("|");
+}
+/**
+* DETs of a transaction — AFP §7.3.
+*
+*   "Count only one DET for each unique field that is required to complete the
+*    External Input. […] Count only one DET for each unique field that is
+*    required to complete the Output Transaction. If a DET both enters and exits
+*    the boundary, count that DET only once."
+*
+* The distinction that matters is the transaction TYPE, not whether input
+* exists:
+*
+*   EI  fields the user supplies — route parameters and validator fields.
+*       What the transaction reads in order to write is not an input DET.
+*   EO  what the user supplies PLUS what the transaction presents. A report has
+*       both: the period queried and the fields displayed.
+*
+* With no `.select()` and no visible transformer, the output fields are the
+* whole table, which **overestimates**. That is the trade AFP makes on purpose,
+* favouring repeatability over fidelity; the origin is recorded in `Rationale`
+* so `fp:calibrate` can measure the bias.
+*/
+function detsFor(entry, behavior, touched, type, options) {
+	const sources = [];
+	const counted = /* @__PURE__ */ new Set();
+	const add = (field, source) => {
+		if (counted.has(field)) return;
+		counted.add(field);
+		sources.push(source);
+	};
+	for (const param of entry.signature.match(/:[A-Za-z_][\w]*/g) ?? []) add(param.slice(1), `param:${param}`);
+	for (const field of behavior.inputFields) add(field.split(".").pop(), `validator:${field}`);
+	if (type === "EO" || type === "EQ") for (const store of touched) {
+		const columns = options.countedStores.get(store).attributes.filter((attribute) => !attribute.isIdentifier);
+		for (const column of columns) add(`${store}.${column.name}`, `output:${store}.${column.name}`);
+	}
+	let det = counted.size + options.messageDet;
+	if (options.messageDet > 0) sources.push("message:1");
+	return {
+		det: Math.max(det, 1),
+		sources
+	};
+}
+//#endregion
+//#region src/albrecht/technical_filter.ts
+/**
+* Temporary and technical data filter — AFP §6.5.2.1.1.
+*
+*   "Database tables identified as temporary or technical shall be marked as
+*    such to be presented in the final report, and shall be ignored in the rest
+*    of this process."
+*
+* Returns the reason when a table is technical, `null` otherwise: the report
+* must say WHY something was excluded, not merely that it was.
+*/
+/**
+* Naming conventions, with the defaults given by the spec itself (§6.5.2.1.3).
+*
+* The standard treats these as user-provided inputs, so they stay overridable
+* through the boundary configuration.
+*/
+const DEFAULT_TECHNICAL_PATTERNS = [
+	{
+		label: "temporary entity",
+		pattern: /^(.+temp|.*session.*|.*error.*|.*search.*|.*login.*|.*logon.*|.*filter.*)$/i
+	},
+	{
+		label: "status entity",
+		pattern: /^(.+status)$/i
+	},
+	{
+		label: "lookup entity",
+		pattern: /^(lkp_.+|.+types?|.+_t)$/i
+	},
+	{
+		label: "template entity",
+		pattern: /^(.*template.*)$/i
+	}
+];
+function isTechnical(store, patterns = DEFAULT_TECHNICAL_PATTERNS) {
+	const table = store.table ?? store.name;
+	for (const { label, pattern } of patterns) if (pattern.test(table)) return `${label} (AFP §6.5.2.1.3: ${pattern.source})`;
+	return null;
+}
+/**
+* Version of the rule set.
+*
+* It appears in every report, and `fp:diff` refuses to compare counts produced
+* by different versions — otherwise the difference would measure the rule
+* change rather than the work.
+*/
+const RULESET_VERSION = "1.0.0";
+function count(input, options = {}) {
+	const warnings = [];
+	const usage = usageOf(input);
+	const tables = {
+		...DEFAULT_TABLES,
+		...options.complexityTables
+	};
+	const weights = {
+		...DEFAULT_WEIGHTS,
+		...options.weights
+	};
+	const infrastructure = new Set(options.boundary?.infrastructure ?? []);
+	const countable = input.stores.filter((store) => {
+		if (infrastructure.has(store.name) || infrastructure.has(store.table ?? "")) {
+			warnings.push(`excluded by boundary configuration: ${store.name}`);
+			return false;
+		}
+		const technical = isTechnical(store);
+		if (technical) warnings.push(`technical, excluded: ${store.name} (${technical})`);
+		return !technical;
+	});
+	const dataFunctions = countDataFunctions(countable, usage, {
+		retStrategy: options.retStrategy ?? "constant",
+		externallyMaintained: new Set(options.boundary?.externallyMaintained ?? []),
+		tables,
+		weights
+	});
+	const countedStores = new Map(dataFunctions.map((fn) => [fn.name, countable.find((store) => store.name === fn.name)]));
+	const ignored = new Set(options.boundary?.ignoreEntryPoints ?? []);
+	const transactionalFunctions = countTransactionalFunctions(input.entryPoints.filter((entry) => !ignored.has(entry.identity) && !ignored.has(entry.name ?? "")), input.behaviors, {
+		countedStores,
+		messageDet: options.messageDet ?? 0,
+		tables,
+		weights
+	});
+	warnings.push(...opaqueColumnWarnings(countable, input));
+	const functions = applyOverrides([...dataFunctions, ...transactionalFunctions], options.overrides ?? {}, input.jsonSchemas ?? /* @__PURE__ */ new Map(), tables, weights, warnings);
+	return {
+		ruleset: "afp",
+		rulesetVersion: RULESET_VERSION,
+		functions,
+		totals: totalsOf(functions),
+		confidence: confidenceOf(input, warnings)
+	};
+}
+/**
+* Columns whose content static analysis cannot read — counting-decisions §8.
+*
+* A JSON column holding a form the user fills counts as 1 DET, because the
+* schema is runtime data. That is the documented trade, and until now it was
+* documented ONLY: the count said nothing, which is the one known blind spot
+* this package reported nowhere. It reports an unresolved call, a technical
+* table, an unresolved mixin and a handler-less route — and stayed silent here.
+*
+* Only columns on a store some transaction reaches are named. An untouched
+* `metadata` column changes no number, and warning about it would be the noise
+* that teaches people to stop reading the confidence block.
+*/
+function opaqueColumnWarnings(stores, input) {
+	const reached = /* @__PURE__ */ new Map();
+	for (const entry of input.entryPoints) for (const store of input.behaviors.get(entry.id)?.touches ?? []) reached.set(store, (reached.get(store) ?? 0) + 1);
+	const found = [];
+	for (const store of stores) {
+		const transactions = reached.get(store.name);
+		if (!transactions) continue;
+		for (const attribute of store.attributes) {
+			if (!attribute.type || !OPAQUE_TYPE.test(attribute.type)) continue;
+			found.push(`  ${store.name}.${attribute.name} (${attribute.type}) — ${transactions} transaction(s)`);
+		}
+	}
+	if (found.length === 0) return [];
+	return [`${found.length} opaque column(s), each counted as 1 DET. If the user recognises fields inside one, declare the count with \`overrides\` — counting-decisions §8:`, ...found];
+}
+/** a column whose shape says nothing about what it holds */
+const OPAQUE_TYPE = /^(object|any|unknown|Record<|Json|JSON)/;
+/**
+* Replaces what the analysis found with what a person declared.
+*
+* Only for facts static analysis cannot reach — a JSON column whose schema
+* lives in the database, per counting-decisions §8. The declared number is
+* reproducible because it comes from a versioned file, and auditable because it
+* travels with its justification into the rationale, which `fp:explain` prints.
+*
+* An override naming no function is a warning, never silence: a typo in the key
+* would otherwise mean the declaration did nothing and nobody was told.
+*/
+function applyOverrides(functions, overrides, schemas, tables, weights, warnings) {
+	const keys = Object.keys(overrides);
+	if (keys.length === 0) return functions;
+	const used = /* @__PURE__ */ new Set();
+	const applied = functions.map((fn) => {
+		const override = overrides[fn.name];
+		if (!override) return fn;
+		used.add(fn.name);
+		const fields = [];
+		if (override.det !== void 0 || override.detFromSchema) fields.push("det");
+		if (override.refs !== void 0) fields.push("refs");
+		let det = override.det ?? fn.det;
+		let by = `config:overrides.${fn.name}`;
+		/**
+		* Read from the schema rather than declared as a number.
+		*
+		* A frozen number goes stale the moment someone adds a field: the count
+		* would not move and `fp:diff` would report no change for real functional
+		* growth. Naming the schema keeps the number coming from the code, and the
+		* only thing maintained by hand is the mapping — which changes when a form
+		* is born, not when a field is.
+		*/
+		if (override.detFromSchema) {
+			const schema = schemas.get(override.detFromSchema);
+			if (schema) {
+				det = Math.max(fn.det - 1, 0) + schema.fields;
+				by = `config:overrides.${fn.name} (from ${schema.name}: ${schema.fields} fields)`;
+			} else warnings.push(`override for "${fn.name}" names schema "${override.detFromSchema}", which is not declared anywhere in the code: the DET count was left as found. A renamed or moved schema breaks the mapping, and this says so rather than counting on silently.`);
+		}
+		const refs = override.refs ?? fn.refs;
+		const complexity = complexityOf(fn.type, refs, det, tables);
+		return {
+			...fn,
+			det,
+			refs,
+			complexity,
+			points: pointsOf(fn.type, complexity, weights),
+			rationale: {
+				...fn.rationale,
+				overrides: [...fn.rationale.overrides ?? [], {
+					by,
+					reason: override.reason,
+					fields
+				}]
+			}
+		};
+	});
+	for (const key of keys) if (!used.has(key)) warnings.push(`override "${key}" matched no counted function: the declaration had no effect`);
+	return applied;
+}
+/**
+* How each store is used by the transactions.
+*
+* `written` decides ILF vs EIF; `used` decides whether it is counted at all.
+*/
+function usageOf(input) {
+	const usage = /* @__PURE__ */ new Map();
+	for (const entry of input.entryPoints) {
+		const behavior = input.behaviors.get(entry.id);
+		if (!behavior) continue;
+		for (const store of behavior.touches) {
+			const current = usage.get(store) ?? {
+				written: false,
+				used: false
+			};
+			usage.set(store, {
+				used: true,
+				written: current.written || behavior.writes
+			});
+		}
+	}
+	return usage;
+}
+const EMPTY_BY_TYPE = {
+	ILF: {
+		count: 0,
+		points: 0
+	},
+	EIF: {
+		count: 0,
+		points: 0
+	},
+	EI: {
+		count: 0,
+		points: 0
+	},
+	EO: {
+		count: 0,
+		points: 0
+	},
+	EQ: {
+		count: 0,
+		points: 0
+	}
+};
+function totalsOf(functions) {
+	const byType = structuredClone(EMPTY_BY_TYPE);
+	const byModule = {};
+	let unadjusted = 0;
+	for (const fn of functions) {
+		byType[fn.type].count++;
+		byType[fn.type].points += fn.points;
+		byModule[fn.module] = (byModule[fn.module] ?? 0) + fn.points;
+		unadjusted += fn.points;
+	}
+	return {
+		unadjusted,
+		byType,
+		byModule
+	};
+}
+/**
+* Confidence of the count.
+*
+* AFP §6.5.3 requires whatever could not be traced to appear in the report. A
+* total resting on many unresolved calls should not become an invoice, and the
+* reader must see that without having to go looking.
+*/
+function confidenceOf(input, warnings) {
+	let unresolvedCalls = 0;
+	let withoutHandler = 0;
+	for (const entry of input.entryPoints) {
+		const behavior = input.behaviors.get(entry.id);
+		if (!behavior) {
+			withoutHandler++;
+			continue;
+		}
+		unresolvedCalls += behavior.unresolved.length;
+	}
+	return {
+		unresolvedCalls,
+		entryPointsWithoutHandler: withoutHandler,
+		warnings
+	};
+}
+//#endregion
+//#region src/inventory/source.ts
+const git = (root, args) => {
+	try {
+		return execFileSync("git", [
+			"-C",
+			root,
+			...args
+		], {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
+	} catch {
+		return;
+	}
+};
+function describeSource(root, config) {
+	/**
+	* Normalised here rather than trusted from the caller. `loadConfig` already
+	* returns a canonical path, but `analyze()` takes `configFile` from anyone
+	* using the package as a library, and whatever arrives is what ships inside
+	* every saved count.
+	*/
+	const revision = git(root, ["rev-parse", "HEAD"]);
+	const status = revision === void 0 ? void 0 : git(root, ["status", "--porcelain"]);
+	return {
+		app: appName(root),
+		revision,
+		branch: revision === void 0 ? void 0 : git(root, [
+			"rev-parse",
+			"--abbrev-ref",
+			"HEAD"
+		]),
+		dirty: status === void 0 ? void 0 : status.length > 0,
+		countedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		config: config === null ? null : toPosix(config)
+	};
+}
+function appName(root) {
+	try {
+		const pkg = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8"));
+		if (pkg.name) return pkg.name;
+	} catch {}
+	return path.basename(root);
+}
+//#endregion
+//#region src/pipeline.ts
+var CoverageTooLowError = class extends Error {
+	constructor(ratio, minimum) {
+		super(`tracing coverage ${(ratio * 100).toFixed(1)}% is below the minimum of ${(minimum * 100).toFixed(0)}%: the count is not reliable enough to become a number. Run \`fp:inventory\` to see what is unresolved.`);
+		this.ratio = ratio;
+		this.minimum = minimum;
+		this.name = "CoverageTooLowError";
+	}
+};
+async function analyze(root, options = {}) {
+	const app = await discoverApp(root);
+	const { stores, unresolved: storeProblems } = await collectDataStores(app);
+	const { entryPoints, unresolved: routeProblems } = await collectEntryPoints(app);
+	/** only read when an override names one — but collected once, like everything else */
+	const jsonSchemas = collectJsonSchemas(app);
+	const analyzer = createAnalyzer(app, stores, {
+		maxDepth: options.maxDepth,
+		callResolvers: options.resolvers?.call
+	});
+	const behaviors = new Map(entryPoints.filter((entry) => entry.handler).map((entry) => [entry.id, analyzer.analyze(entry.handler)]));
+	const resolved = [...behaviors.values()].filter((behavior) => behavior.unresolved.length === 0).length;
+	const unresolvedCalls = storeProblems.length + routeProblems.length + [...behaviors.values()].reduce((total, behavior) => total + behavior.unresolved.length, 0);
+	const inventory = {
+		version: 1,
+		generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		app: app.root,
+		framework: {
+			core: app.framework.core,
+			lucid: app.framework.lucid,
+			orm: app.framework.orm
+		},
+		dataStores: stores,
+		entryPoints,
+		behaviors: [...behaviors.entries()].map(([entryPointId, behavior]) => ({
+			entryPointId,
+			writes: behavior.writes,
+			touches: behavior.touches,
+			inputFields: behavior.inputFields.map((name) => ({
+				name,
+				provenance: {
+					file: app.root,
+					by: "validator"
+				}
+			})),
+			outputFields: [],
+			trace: behavior.trace,
+			unresolved: behavior.unresolved
+		})),
+		coverage: {
+			entryPointsTotal: entryPoints.length,
+			entryPointsResolved: resolved,
+			unresolvedCalls,
+			ratio: entryPoints.length === 0 ? 1 : resolved / entryPoints.length
+		}
+	};
+	const minimum = options.minCoverage ?? 0;
+	if (inventory.coverage.ratio < minimum) throw new CoverageTooLowError(inventory.coverage.ratio, minimum);
+	return {
+		inventory,
+		count: {
+			...count({
+				app,
+				stores,
+				entryPoints,
+				behaviors,
+				jsonSchemas
+			}, options),
+			source: describeSource(root, options.configFile ?? null)
+		}
+	};
+}
+//#endregion
+export { analyze as n, toPosix as r, CoverageTooLowError as t };