@genn-inc/cluebase-cli 0.0.1

package/src/code-evidence-analyzer.mjs

@@ -0,0 +1,2041 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { basename, join, relative, resolve } from "node:path";
+
+import {
+	CODE_EVIDENCE_ANALYZER_VERSION,
+	CODE_EVIDENCE_DATA_OPERATIONS,
+	CODE_EVIDENCE_OPERATION_DISCRIMINATOR_FIELD,
+	CODE_EVIDENCE_ROUTE_METHODS,
+} from "./generated-code-evidence-contract.mjs";
+import { stripSourceNoise } from "./lifecycle-guard.mjs";
+import { listAllowedSourceFiles } from "./path-policy.mjs";
+import {
+	DEPENDENCY_FILE_CANDIDATES,
+	REQUIRED_LIFECYCLE_APIS,
+	SOURCE_EXTENSIONS,
+	sourceMatchesBackendInit,
+} from "./setup-check-constants.mjs";
+
+const HTTP_METHODS = new Set(CODE_EVIDENCE_ROUTE_METHODS);
+const [DATA_READ, DATA_CREATE, DATA_UPDATE, DATA_DELETE, DATA_UNKNOWN] =
+	CODE_EVIDENCE_DATA_OPERATIONS;
+const ROUTE_METHOD_NAMES = [...HTTP_METHODS]
+	.map((method) => method.toLowerCase())
+	.join("|");
+
+const ROUTE_METHOD_PATTERN = new RegExp(
+	`\\b[A-Za-z_$][\\w$]*\\.(${ROUTE_METHOD_NAMES})\\s*\\(`,
+	"gi",
+);
+const SERVER_ROUTE_DECLARATION_PATTERN = new RegExp(
+	`\\b[A-Za-z_$][\\w$]*\\.(${ROUTE_METHOD_NAMES})\\s*\\(\\s*["']\\/[^"']*["']`,
+	"i",
+);
+const NEST_DECORATOR_PATTERN = new RegExp(
+	`@(${ROUTE_METHOD_NAMES.split("|")
+		.map((method) => method[0].toUpperCase() + method.slice(1))
+		.join("|")})\\s*(?:\\(\\s*(?:(['"\`])([^'"\`]*?)\\2)?\\s*\\))?`,
+	"g",
+);
+const CONTROLLER_DECORATOR_PATTERN =
+	/@Controller\s*\(\s*(?:(['"`])([^'"`]*)\1)?\s*\)/g;
+
+const PYTHON_ROUTE_PATTERN =
+	/\b(?:[A-Za-z_]\w*)\.(get|post|put|patch|delete|options|head|trace|api_route)\s*\(\s*(['"])([^'"\n]+)\2([^\n]*)\)/gi;
+
+const EXPRESS_FRAMEWORK_PATTERN =
+	/\bfrom\s+["']express["']|\brequire\(\s*["']express["']\s*\)|\bexpress\s*\(/;
+const NEST_FRAMEWORK_PATTERN = /@Controller\s*\(/;
+const FASTAPI_FRAMEWORK_PATTERN =
+	/\bfrom\s+fastapi\b|\bimport\s+fastapi\b|\b(?:FastAPI|APIRouter)\s*\(/;
+
+const JS_DISCRIMINATOR_PATTERNS = [
+	/\b(?:req|request|ctx)\.(?:body|query|params)\.([A-Za-z_$][\w$]*)\s*={2,3}\s*(["'])([^"']+)\2/g,
+	/\b(?:req|request|ctx)\.(?:body|query|params)\[\s*(["'])([^"']+)\1\s*\]\s*={2,3}\s*(["'])([^"']+)\3/g,
+	/\b(?:body|payload|input)\[\s*(["'])([^"']+)\1\s*\]\s*={2,3}\s*(["'])([^"']+)\3/g,
+];
+
+const PYTHON_DISCRIMINATOR_PATTERNS = [
+	/\b(?:request|payload|body|data|input)\s*\.\s*([A-Za-z_]\w*)\s*={2,3}\s*(["'])([^"']+)\2/g,
+	/\b(?:request|payload|body|data|input)\s*\[\s*(["'])([^"']+)\1\s*\]\s*={2,3}\s*(["'])([^"']+)\3/g,
+];
+
+const LIFECYCLE_PATTERN = new RegExp(
+	`\\b(${REQUIRED_LIFECYCLE_APIS.map((api) => api.replace(".", "\\.")).join(
+		"|",
+	)})\\s*\\(`,
+	"g",
+);
+
+const EXISTING_EXTERNAL_LINK_PATTERN = /\bcluebase\.link\s*\(/;
+const EXTERNAL_METADATA_ORGANIZATION_PATTERN =
+	/\bmetadata\s*(?:\.\s*organization_id|\[\s*["']organization_id["']\s*\])/i;
+const ORGANIZATION_ID_PATTERN =
+	/\b(?:organization|org)\s*(?:\.\s*id|\[\s*["']id["']\s*\])/i;
+const EXTERNAL_ID_PATTERN = /\b([A-Za-z_$][\w$]*(?:Id|_id))\b/g;
+const NON_EXTERNAL_ID_NAMES = new Set([
+	"id",
+	"organization_id",
+	"organizationId",
+	"user_id",
+	"userId",
+	"anonymous_id",
+	"anonymousId",
+	"session_id",
+	"sessionId",
+	"request_id",
+	"requestId",
+	"trace_id",
+	"traceId",
+]);
+const NON_EXTERNAL_ID_PATTERN = /(?:By|From|With|For)Id$/;
+const RELATIVE_IMPORT_PATTERN =
+	/(?:from\s+|import\s*\(\s*|require\s*\(\s*)(['"])(\.[^'"\n]+)\1/g;
+const CALL_PATTERN = /\b([A-Za-z_$][\w$]*)\s*\(/g;
+const NON_CALLABLE_NAMES = new Set([
+	"if",
+	"for",
+	"while",
+	"switch",
+	"catch",
+	"function",
+	"return",
+	"typeof",
+	"await",
+	"async",
+]);
+
+const normalizePath = (value) => value.replaceAll("\\", "/");
+
+const matchesPattern = (source, pattern) => {
+	pattern.lastIndex = 0;
+	const matched = pattern.test(source);
+	pattern.lastIndex = 0;
+	return matched;
+};
+
+const lineNumberAt = (source, index) =>
+	source.slice(0, index).split("\n").length;
+
+const lineEndAt = (source, index) => {
+	const newline = source.indexOf("\n", index);
+	return newline === -1 ? source.length : newline;
+};
+
+const isQuote = (value) => value === "'" || value === '"' || value === "`";
+
+const findMatchingDelimiter = (source, start, opening = "(", closing = ")") => {
+	let depth = 0;
+	let quote = null;
+	for (let index = start; index < source.length; index += 1) {
+		const current = source[index];
+		const next = source[index + 1];
+		if (quote) {
+			if (current === "\\" && quote !== "`" && index + 1 < source.length) {
+				index += 1;
+				continue;
+			}
+			if (current === quote) quote = null;
+			continue;
+		}
+		if (current === "/" && next === "/") {
+			const newline = source.indexOf("\n", index + 2);
+			index = newline === -1 ? source.length : newline;
+			continue;
+		}
+		if (current === "/" && next === "*") {
+			const end = source.indexOf("*/", index + 2);
+			index = end === -1 ? source.length : end + 1;
+			continue;
+		}
+		if (isQuote(current)) {
+			quote = current;
+			continue;
+		}
+		if (current === opening) depth += 1;
+		if (current === closing) {
+			depth -= 1;
+			if (depth === 0) return index;
+		}
+	}
+	return -1;
+};
+
+const splitTopLevel = (source) => {
+	const values = [];
+	let start = 0;
+	let parenDepth = 0;
+	let braceDepth = 0;
+	let bracketDepth = 0;
+	let quote = null;
+	for (let index = 0; index < source.length; index += 1) {
+		const current = source[index];
+		const next = source[index + 1];
+		if (quote) {
+			if (current === "\\" && quote !== "`" && index + 1 < source.length) {
+				index += 1;
+				continue;
+			}
+			if (current === quote) quote = null;
+			continue;
+		}
+		if (current === "/" && next === "/") {
+			const newline = source.indexOf("\n", index + 2);
+			index = newline === -1 ? source.length : newline;
+			continue;
+		}
+		if (current === "/" && next === "*") {
+			const end = source.indexOf("*/", index + 2);
+			index = end === -1 ? source.length : end + 1;
+			continue;
+		}
+		if (isQuote(current)) {
+			quote = current;
+			continue;
+		}
+		if (current === "(") parenDepth += 1;
+		if (current === ")") parenDepth -= 1;
+		if (current === "{") braceDepth += 1;
+		if (current === "}") braceDepth -= 1;
+		if (current === "[") bracketDepth += 1;
+		if (current === "]") bracketDepth -= 1;
+		if (
+			current === "," &&
+			parenDepth === 0 &&
+			braceDepth === 0 &&
+			bracketDepth === 0
+		) {
+			values.push(source.slice(start, index).trim());
+			start = index + 1;
+		}
+	}
+	values.push(source.slice(start).trim());
+	return values;
+};
+
+const stringLiteralValue = (value) => {
+	const match = value.match(/^(['"`])([^'"`]*)\1$/s);
+	if (!match || (match[1] === "`" && value.includes("${"))) return null;
+	return match[2];
+};
+
+const joinRoutePath = (...parts) => {
+	const path = parts
+		.map((part) => String(part ?? "").trim())
+		.filter(Boolean)
+		.join("/")
+		.replace(/\/+/g, "/");
+	return `/${path}`.replace(/\/+/g, "/").replace(/\/$/, "") || "/";
+};
+
+const resourceFromPath = (path) => {
+	const segment = path
+		.split("/")
+		.map((value) => value.trim())
+		.find((value) => value && !value.startsWith(":") && !value.startsWith("{"));
+	return segment ? segment.replace(/[^A-Za-z0-9_-]/g, "") || null : null;
+};
+const dataOperationForSource = (analysisSource) => {
+	const directCallSuffix = "(?:[A-Z][A-Za-z0-9]*|_[A-Za-z0-9]+)?";
+	if (
+		new RegExp(
+			`\\b(?:delete|destroy|remove|drop|truncate|purge)${directCallSuffix}\\s*\\(`,
+			"i",
+		).test(analysisSource)
+	) {
+		return DATA_DELETE;
+	}
+	if (
+		new RegExp(
+			`\\b(?:update|upsert|patch)${directCallSuffix}\\s*\\(`,
+			"i",
+		).test(analysisSource)
+	) {
+		return DATA_UPDATE;
+	}
+	if (
+		new RegExp(
+			`\\b(?:create|insert|add|save)${directCallSuffix}\\s*\\(`,
+			"i",
+		).test(analysisSource)
+	) {
+		return DATA_CREATE;
+	}
+	if (
+		new RegExp(
+			`\\b(?:select|find|get|read|list|search)${directCallSuffix}\\s*\\(`,
+			"i",
+		).test(analysisSource)
+	) {
+		return DATA_READ;
+	}
+	return DATA_UNKNOWN;
+};
+
+const withoutCommentsAndStringLiterals = (source) => {
+	let output = "";
+	let quote = null;
+	let comment = null;
+	for (let index = 0; index < source.length; index += 1) {
+		const current = source[index];
+		const next = source[index + 1];
+		if (comment === "line") {
+			output += current === "\n" ? "\n" : " ";
+			if (current === "\n") comment = null;
+			continue;
+		}
+		if (comment === "block") {
+			output += current === "\n" ? "\n" : " ";
+			if (current === "*" && next === "/") {
+				output += " ";
+				index += 1;
+				comment = null;
+			}
+			continue;
+		}
+		if (quote) {
+			output += current === "\n" ? "\n" : " ";
+			if (current === "\\" && index + 1 < source.length) {
+				output += " ";
+				index += 1;
+			} else if (current === quote) {
+				quote = null;
+			}
+			continue;
+		}
+		if ((current === "/" && next === "/") || current === "#") {
+			output += "  ";
+			index += 1;
+			comment = "line";
+			continue;
+		}
+		if (current === "/" && next === "*") {
+			output += "  ";
+			index += 1;
+			comment = "block";
+			continue;
+		}
+		if (isQuote(current)) {
+			output += " ";
+			quote = current;
+			continue;
+		}
+		output += current;
+	}
+	return output;
+};
+
+const functionNameNear = (source, start, end) => {
+	const declaration = source
+		.slice(start, Math.min(source.length, end + 240))
+		.match(
+			/(?:async\s+)?(?:function\s+([A-Za-z_$][\w$]*)|([A-Za-z_$][\w$]*)\s*=\s*(?:async\s*)?\([^)]*\)\s*=>|([A-Za-z_$][\w$]*)\s*\([^)]*\)\s*\{)/,
+		);
+	return (
+		declaration?.[1] ??
+		declaration?.[2] ??
+		declaration?.[3] ??
+		"anonymous_route"
+	);
+};
+
+const findHandlerEnd = (source, start, fallbackEnd) => {
+	const opening = source.indexOf("{", start);
+	if (opening === -1 || opening > fallbackEnd + 240) return fallbackEnd;
+	const closing = findMatchingDelimiter(source, opening, "{", "}");
+	return closing === -1 ? fallbackEnd : closing;
+};
+
+const escapedRegExp = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+const relativeDependencyPath = (filePath, specifier, sourceByFile) => {
+	const directory = filePath.includes("/")
+		? filePath.slice(0, filePath.lastIndexOf("/"))
+		: "";
+	const base = normalizePath(`${directory}/${specifier}`)
+		.replace(/\/\.\//g, "/")
+		.replace(/^\.\//, "")
+		.replace(/\/+/g, "/");
+	const extension = base.match(/\.[A-Za-z0-9]+$/) ? "" : null;
+	const candidates = extension
+		? [base]
+		: [
+				base,
+				...SOURCE_EXTENSIONS.map((item) => `${base}${item}`),
+				...SOURCE_EXTENSIONS.map((item) => `${base}/index${item}`),
+			];
+	return candidates.find((candidate) => sourceByFile.has(candidate)) ?? null;
+};
+
+const namedFunctionSource = (source, name) => {
+	const escapedName = escapedRegExp(name);
+	const patterns = [
+		new RegExp(
+			`(?:async\\s+)?function\\s+${escapedName}\\s*\\([^)]*\\)\\s*\\{`,
+		),
+		new RegExp(
+			`(?:const|let|var)\\s+${escapedName}\\s*=\\s*(?:async\\s*)?\\([^)]*\\)\\s*=>\\s*\\{`,
+		),
+		new RegExp(
+			`\\b${escapedName}\\s*:\\s*(?:async\\s*)?\\([^)]*\\)\\s*=>\\s*\\{`,
+		),
+		new RegExp(`(?:async\\s+)?${escapedName}\\s*\\([^)]*\\)\\s*\\{`),
+	];
+	for (const pattern of patterns) {
+		const match = pattern.exec(source);
+		if (!match) continue;
+		const opening = source.indexOf("{", match.index);
+		const closing = findMatchingDelimiter(source, opening, "{", "}");
+		if (closing !== -1) return source.slice(match.index, closing + 1);
+	}
+	return null;
+};
+
+const directDependencySourceFor = ({
+	filePath,
+	fileSource,
+	handlerSource,
+	sourceByFile,
+}) => {
+	const dependencyPaths = [];
+	RELATIVE_IMPORT_PATTERN.lastIndex = 0;
+	let importMatch;
+	while ((importMatch = RELATIVE_IMPORT_PATTERN.exec(fileSource))) {
+		const dependencyPath = relativeDependencyPath(
+			filePath,
+			importMatch[2],
+			sourceByFile,
+		);
+		if (dependencyPath) dependencyPaths.push(dependencyPath);
+	}
+	if (dependencyPaths.length === 0) return "";
+
+	const callableNames = new Set();
+	CALL_PATTERN.lastIndex = 0;
+	let callMatch;
+	while ((callMatch = CALL_PATTERN.exec(handlerSource))) {
+		if (!NON_CALLABLE_NAMES.has(callMatch[1])) callableNames.add(callMatch[1]);
+	}
+	return [...new Set(dependencyPaths)]
+		.flatMap((dependencyPath) => {
+			const dependencySource = sourceByFile.get(dependencyPath);
+			if (!dependencySource) return [];
+			const functions = [...callableNames]
+				.map((name) => namedFunctionSource(dependencySource, name))
+				.filter((value) => value !== null);
+			return functions.length > 0 ? functions : [];
+		})
+		.join("\n");
+};
+
+const directDependencyAnalysisFor = ({
+	filePath,
+	fileSource,
+	handlerSource,
+	sourceByFile,
+}) => {
+	const dependencySpecifiers = [];
+	RELATIVE_IMPORT_PATTERN.lastIndex = 0;
+	let importMatch;
+	while ((importMatch = RELATIVE_IMPORT_PATTERN.exec(fileSource))) {
+		dependencySpecifiers.push({
+			specifier: importMatch[2],
+			index: importMatch.index,
+		});
+	}
+	const dependencyPaths = dependencySpecifiers.map(({ specifier }) =>
+		relativeDependencyPath(filePath, specifier, sourceByFile),
+	);
+	const unresolvedImport = dependencyPaths.some((path) => path === null);
+	const importedNames = new Set();
+	const namedImportsPattern = /import\s*\{([^}]+)\}\s*from\s*["']\.[^"']+["']/g;
+	let namedImport;
+	while ((namedImport = namedImportsPattern.exec(fileSource))) {
+		for (const item of namedImport[1].split(",")) {
+			const name = item
+				.trim()
+				.split(/\s+as\s+/i)
+				.at(-1);
+			if (name && /^[A-Za-z_$][\w$]*$/.test(name)) importedNames.add(name);
+		}
+	}
+	const dependencySources = dependencyPaths.flatMap((path) =>
+		path ? [sourceByFile.get(path) ?? ""] : [],
+	);
+	const unresolvedNamedImport = [...importedNames].some((name) => {
+		const matches = dependencySources.filter((source) =>
+			namedFunctionSource(source, name),
+		);
+		return matches.length !== 1;
+	});
+	return {
+		source: directDependencySourceFor({
+			filePath,
+			fileSource,
+			handlerSource,
+			sourceByFile,
+		}),
+		resolved: !unresolvedImport && !unresolvedNamedImport,
+	};
+};
+
+const safeDiscriminator = (_field, value) =>
+	`${CODE_EVIDENCE_OPERATION_DISCRIMINATOR_FIELD}=sha256:${createHash("sha256")
+		.update(`${CODE_EVIDENCE_OPERATION_DISCRIMINATOR_FIELD}=${value}`)
+		.digest("hex")}`;
+
+const branchDiscriminators = (source, language) => {
+	const patterns =
+		language === "python"
+			? PYTHON_DISCRIMINATOR_PATTERNS
+			: JS_DISCRIMINATOR_PATTERNS;
+	const discriminators = [];
+	for (const pattern of patterns) {
+		pattern.lastIndex = 0;
+		let match;
+		while ((match = pattern.exec(source))) {
+			const field = match[4] ? match[2] : match[1];
+			const value = match[4] ? match[4] : match[3];
+			if (!field || !value) continue;
+			discriminators.push({
+				value: safeDiscriminator(field, value),
+				literal: value,
+				index: match.index,
+			});
+		}
+	}
+	return [
+		...new Map(discriminators.map((item) => [item.value, item])).values(),
+	].sort((left, right) => left.index - right.index);
+};
+
+const branchTextFor = (source, discriminator, language) => {
+	if (language === "python") {
+		const lineStart = source.lastIndexOf("\n", discriminator.index) + 1;
+		const lines = source.slice(lineStart).split("\n");
+		const baseIndent = lines[0].match(/^\s*/)?.[0].length ?? 0;
+		const selected = [lines[0]];
+		for (const line of lines.slice(1)) {
+			if (line.trim() && (line.match(/^\s*/)?.[0].length ?? 0) <= baseIndent)
+				break;
+			selected.push(line);
+		}
+		return selected.join("\n");
+	}
+	const branchStart = source.lastIndexOf("if", discriminator.index);
+	const opening = source.indexOf("{", discriminator.index);
+	if (opening === -1) return source;
+	const closing = findMatchingDelimiter(source, opening, "{", "}");
+	return source.slice(
+		branchStart === -1 ? opening : branchStart,
+		closing === -1 ? source.length : closing + 1,
+	);
+};
+
+const hasRuntimeDiscriminatorCall = (source, language) =>
+	(language === "python"
+		? /set_operation_discriminator\s*\(/u
+		: /setOperationDiscriminator\s*\(/u
+	).test(source);
+
+const effectsFor = ({ source, path }) => {
+	const analysisSource = withoutCommentsAndStringLiterals(source);
+	const persistenceWrite =
+		/\b(?:save|create|update|upsert|insert|delete|destroy|remove|clear)\s*\(/i.test(
+			analysisSource,
+		) ||
+		/\b(?:INSERT|UPDATE|DELETE)\s+INTO?\b/i.test(analysisSource) ||
+		/\b(?:prisma|repository|repo|model)\.[A-Za-z_$][\w$]*\.(?:create|update|upsert|delete|deleteMany|updateMany)\s*\(/i.test(
+			analysisSource,
+		);
+	const externalSideEffect =
+		/\b(?:fetch|axios|httpx|requests|urllib|sendMail|send_mail|notify|publish|stripe)\b/i.test(
+			analysisSource,
+		);
+	const notificationSideEffect =
+		/\b(?:sendMail|send_mail|notify|notification|publish)\b/i.test(
+			analysisSource,
+		);
+	const downstreamDependency =
+		/\b(?:service|repository|repo|client|gateway|useCase|use_case)\.[A-Za-z_$][\w$]*\s*\(/i.test(
+			analysisSource,
+		) ||
+		/\b[A-Za-z_$][\w$]*(?:Service|Repository|Client|Gateway)\.[A-Za-z_$][\w$]*\s*\(/.test(
+			analysisSource,
+		) ||
+		/\b[A-Za-z_$][\w$]*(?:_service|_repository|_client|_gateway)\.[A-Za-z_$][\w$]*\s*\(/i.test(
+			analysisSource,
+		) ||
+		/\b(?:await\s+)?[A-Za-z_$][\w$]*(?:Service|Repository|Client|Gateway)\s*\(/.test(
+			analysisSource,
+		);
+	const destructiveReference =
+		/\b(?:delete|destroy|remove|drop|truncate|purge)(?:_[A-Za-z0-9]+)?\s*\(/i.test(
+			analysisSource,
+		) || /\b(?:DELETE|DROP|TRUNCATE)\b/i.test(analysisSource);
+	const reversibleReference =
+		/\b(?:restore|undo|rollback|revert|unarchive|softDelete|soft_delete)(?:_[A-Za-z0-9]+)?\s*\(/i.test(
+			analysisSource,
+		);
+	const successPath =
+		/\breturn\b/.test(analysisSource) ||
+		/\bres\.(?:json|send|end|status)\s*\(/.test(analysisSource) ||
+		/\b(?:JSONResponse|Response|HTTPException)\s*\(/.test(analysisSource);
+	const dataOperation = dataOperationForSource(analysisSource);
+	return {
+		resource: resourceFromPath(path),
+		data_operation: dataOperation,
+		persistence_write: persistenceWrite,
+		external_side_effect: externalSideEffect,
+		notification_side_effect: notificationSideEffect,
+		downstream_dependency: downstreamDependency,
+		success_path: successPath,
+		destructive_reference: destructiveReference,
+		reversible_reference: reversibleReference,
+	};
+};
+
+const confidenceFor = ({
+	deterministicDiscriminator,
+	dataOperation,
+	handlerResolved = true,
+	dependencyResolved = true,
+	operationBoundaryResolved = true,
+}) => {
+	if (!handlerResolved || !dependencyResolved || !operationBoundaryResolved) {
+		return deterministicDiscriminator ? 0.4 : 0.3;
+	}
+	if (dataOperation === DATA_UNKNOWN)
+		return deterministicDiscriminator ? 0.4 : 0.3;
+	return deterministicDiscriminator ? 0.95 : 0.85;
+};
+
+const insertionsByFile = () => new Map();
+
+const addInsertion = (insertions, filePath, index, text) => {
+	const fileInsertions = insertions.get(filePath) ?? [];
+	fileInsertions.push({ index, text });
+	insertions.set(filePath, fileInsertions);
+};
+
+const applyInsertions = (source, insertions) =>
+	[...insertions]
+		.sort((left, right) => right.index - left.index)
+		.reduce(
+			(result, insertion) =>
+				`${result.slice(0, insertion.index)}${insertion.text}${result.slice(insertion.index)}`,
+			source,
+		);
+
+const lifecycleRepairText = (api, anchor) => {
+	const python = anchor.filePath?.endsWith(".py");
+	const typescript = /\.tsx?$/.test(anchor.filePath ?? "");
+	if (api === "cluebase.init") {
+		const serviceKey = JSON.stringify(anchor.serviceKey ?? "backend");
+		const endpoint = `process.env.CLUEBASE_INGEST_ENDPOINT${typescript ? "!" : ""}`;
+		const projectKey = `process.env.CLUEBASE_PROJECT_KEY${typescript ? "!" : ""}`;
+		const apiKey = `process.env.CLUEBASE_API_KEY${typescript ? "!" : ""}`;
+		if (python && anchor.framework === "fastapi") {
+			return `_cluebase_endpoint = os.getenv("CLUEBASE_INGEST_ENDPOINT")\n_cluebase_project_key = os.getenv("CLUEBASE_PROJECT_KEY")\n_cluebase_api_key = os.getenv("CLUEBASE_API_KEY")\nif _cluebase_endpoint and _cluebase_project_key and _cluebase_api_key:\n    cluebase_init_fastapi(app, project_key=_cluebase_project_key, api_key=_cluebase_api_key, service_key=${serviceKey})`;
+		}
+		return python
+			? `if os.getenv("CLUEBASE_INGEST_ENDPOINT") and os.getenv("CLUEBASE_PROJECT_KEY") and os.getenv("CLUEBASE_API_KEY"):\n    cluebase.init({"endpoint": os.getenv("CLUEBASE_INGEST_ENDPOINT"), "project_key": os.getenv("CLUEBASE_PROJECT_KEY"), "api_key": os.getenv("CLUEBASE_API_KEY"), "service_key": ${serviceKey}})`
+			: `cluebase.init({ endpoint: ${endpoint}, projectKey: ${projectKey}, apiKey: ${apiKey}, serviceKey: ${serviceKey} });`;
+	}
+	if (api === "cluebase.group") {
+		return python
+			? `cluebase.group("organization", ${anchor.idExpression}${anchor.nameExpression ? `, {"name": ${anchor.nameExpression}}` : ""})`
+			: `cluebase.group("organization", ${anchor.idExpression}${anchor.nameExpression ? `, { name: ${anchor.nameExpression} }` : ""});`;
+	}
+	if (api === "cluebase.identify") {
+		return python
+			? `cluebase.identify(${anchor.idExpression}${anchor.nameExpression ? `, {"name": ${anchor.nameExpression}}` : ""})`
+			: `cluebase.identify(${anchor.idExpression}${anchor.nameExpression ? `, { name: ${anchor.nameExpression} }` : ""});`;
+	}
+	if (api === "cluebase.reset")
+		return python ? "cluebase.reset()" : "cluebase.reset();";
+	return null;
+};
+
+const DISCOVERY_SITE_KEYS = {
+	"cluebase.identify": "identifySites",
+	"cluebase.group": "groupSites",
+	"cluebase.reset": "resetSites",
+};
+const SAFE_EXPRESSION_PATTERN =
+	/^[A-Za-z_$][\w$]*(?:(?:\.[A-Za-z_$][\w$]*)|(?:\[\s*["'][^"']+["']\s*\])|(?:\[\s*\d+\s*\]))*$/;
+
+const discoveryAnchorsFor = ({ api, setupDiscovery, sourceByFile }) => {
+	if (!setupDiscovery) return null;
+	const ambiguousApis = setupDiscovery.ambiguousLifecycleApis;
+	if (
+		Array.isArray(ambiguousApis) &&
+		ambiguousApis.includes(api)
+	)
+		return null;
+	if (setupDiscovery.hasUnclearPoints && !Array.isArray(ambiguousApis))
+		return null;
+	const sites =
+		api === "cluebase.init"
+			? [setupDiscovery.cluebaseInitBackend].filter(Boolean)
+			: (setupDiscovery[DISCOVERY_SITE_KEYS[api]] ?? []);
+	if (!Array.isArray(sites) || sites.length === 0) return null;
+	const anchors = [];
+	for (const site of sites) {
+		if (!site || site.createsNewFile === true) return null;
+		const source = sourceByFile.get(site.file);
+		if (source === undefined || !Number.isInteger(site.line) || site.line < 1)
+			return null;
+		const lines = source.split("\n");
+		if (site.line > lines.length) return null;
+		const index = lines
+			.slice(0, site.line - 1)
+			.reduce((sum, line) => sum + line.length + 1, 0);
+		const lineEnd = index + lines[site.line - 1].length;
+		let insertionIndex = index;
+		let insertionIndent =
+			source.slice(index, lineEnd).match(/^\s*/)?.[0] ?? "";
+		let insertBefore = false;
+		if (api === "cluebase.init" || api === "cluebase.reset") {
+			if (api === "cluebase.init" && setupDiscovery.framework === "fastapi") {
+				const constructorStart = source.lastIndexOf("FastAPI", lineEnd);
+				const opening =
+					constructorStart === -1
+						? -1
+						: source.indexOf("(", constructorStart);
+				const closing =
+					opening === -1
+						? -1
+						: findMatchingDelimiter(source, opening);
+				if (closing !== -1) insertionIndex = lineEndAt(source, closing) + 1;
+			}
+			anchors.push({
+				filePath: site.file,
+				source,
+				index: insertionIndex,
+				indent: insertionIndent,
+				lineEnd,
+				idExpression: null,
+				nameExpression: null,
+				serviceKey: site.serviceKey,
+				framework: setupDiscovery.framework,
+			});
+			continue;
+		}
+		if (site.file.endsWith(".py")) {
+			const functionStart = source.lastIndexOf("def ", index);
+			if (functionStart !== -1) {
+				const beforeAnchor = source.slice(functionStart, index);
+				const returnMatch = [
+					...beforeAnchor.matchAll(/(?:^|\n)([ \t]*)return\b/g),
+				].at(-1);
+				if (returnMatch?.index !== undefined) {
+					insertionIndex =
+						functionStart +
+						returnMatch.index +
+						(returnMatch[0].startsWith("\n") ? 1 : 0);
+					insertionIndent = returnMatch[1] ?? insertionIndent;
+					insertBefore = true;
+				}
+			}
+		}
+		const fields = site.availableFields ?? {};
+		const idExpression = fields.id ?? fields.groupKey;
+		const nameExpression = fields.name ?? null;
+		if (
+			typeof idExpression !== "string" ||
+			!SAFE_EXPRESSION_PATTERN.test(idExpression) ||
+			!source.includes(idExpression) ||
+			(nameExpression !== null &&
+				(typeof nameExpression !== "string" ||
+					!SAFE_EXPRESSION_PATTERN.test(nameExpression) ||
+					!source.includes(nameExpression)))
+		)
+			return null;
+		anchors.push({
+			filePath: site.file,
+			source,
+			index: insertionIndex,
+			indent: insertionIndent,
+			insertBefore,
+			lineEnd,
+			idExpression,
+			nameExpression,
+			serviceKey: site.serviceKey,
+			framework: setupDiscovery.framework,
+		});
+	}
+	return anchors;
+};
+
+const operationRepairInsertions = ({ filePath, source, rows, language }) => {
+	if (!/\bcluebase\s*\./.test(source)) return null;
+	const branches = branchDiscriminators(source, language);
+	const insertions = [];
+	for (const row of rows) {
+		if (!row.operation_discriminator) return null;
+		const branch = branches.find(
+			(candidate) =>
+				candidate.value === row.operation_discriminator &&
+				lineNumberAt(source, candidate.index) ===
+					row.source_location.line_start,
+		);
+		if (!branch) return null;
+		if (
+			hasRuntimeDiscriminatorCall(
+				branchTextFor(source, branch, language),
+				language,
+			)
+		)
+			continue;
+		if (language === "python") {
+			const lineStart = source.lastIndexOf("\n", branch.index) + 1;
+			const indent =
+				source.slice(lineStart, branch.index).match(/^\s*/)?.[0] ?? "";
+			insertions.push({
+				index: lineEndAt(source, branch.index) + 1,
+				text: `\n${indent}    cluebase.set_operation_discriminator(${JSON.stringify(branch.literal)})`,
+			});
+			continue;
+		}
+		const opening = source.indexOf("{", branch.index);
+		if (opening === -1) return null;
+		const insertionLineEnd = source.indexOf("\n", opening);
+		if (insertionLineEnd === -1) return null;
+		const lineStart = source.lastIndexOf("\n", branch.index) + 1;
+		const indent =
+			source.slice(lineStart, branch.index).match(/^\s*/)?.[0] ?? "";
+		insertions.push({
+			index: insertionLineEnd + 1,
+			text: `${indent}  cluebase.setOperationDiscriminator(${JSON.stringify(branch.literal)});\n`,
+		});
+	}
+	return insertions;
+};
+
+const sdkImportTextFor = (filePath, source) => {
+	const python = filePath.endsWith(".py");
+	const alreadyImported = python
+		? /\bfrom\s+cluebase_backend_sdk\s+import\s+cluebase\b/.test(source)
+		: /\bfrom\s+["']@genn-inc\/cluebase-backend-sdk["']|\bimport\s+cluebase\s+from\s+["']@genn-inc\/cluebase-backend-sdk["']/.test(
+				source,
+			);
+	if (alreadyImported) return null;
+	return python
+		? `${/\bimport\s+os\b/.test(source) ? "" : "import os\n"}from cluebase_backend_sdk import cluebase\n`
+		: 'import cluebase from "@genn-inc/cluebase-backend-sdk";\n';
+};
+
+const addSdkImport = ({ insertions, sourceByFile, filePath }) => {
+	const source = sourceByFile.get(filePath);
+	if (source === undefined) return false;
+	const pendingInsertions = insertions.get(filePath) ?? [];
+	if (
+		pendingInsertions.some(
+			(item) =>
+				item.index === 0 &&
+				/\bfrom\s+cluebase_backend_sdk\s+import\s+cluebase\b|\bfrom\s+["']@genn-inc\/cluebase-backend-sdk["']|\bimport\s+cluebase\s+from\s+["']@genn-inc\/cluebase-backend-sdk["']/.test(
+					item.text,
+				),
+			)
+	)
+		return true;
+	let importText = sdkImportTextFor(filePath, source);
+	if (
+		filePath.endsWith(".py") &&
+		pendingInsertions.some(
+			(item) => item.index === 0 && /\bimport\s+os\b/.test(item.text),
+		)
+	) {
+		importText = importText?.replace(/^import os\n/u, "") ?? null;
+	}
+	if (importText === null) return true;
+	addInsertion(insertions, filePath, 0, importText);
+	return true;
+};
+
+const sdkInitImportTextFor = ({ filePath, source, framework }) => {
+	if (!filePath.endsWith(".py") || framework !== "fastapi") {
+		return sdkImportTextFor(filePath, source);
+	}
+	const imports = [];
+	if (!/\bimport\s+os\b/.test(source)) imports.push("import os");
+	if (
+		!/\bfrom\s+cluebase_backend_sdk\._integrations\.fastapi\s+import\s+cluebase_init_fastapi\b/.test(
+			source,
+		)
+	) {
+		imports.push(
+			"from cluebase_backend_sdk._integrations.fastapi import cluebase_init_fastapi",
+		);
+	}
+	return imports.length > 0 ? `${imports.join("\n")}\n` : null;
+};
+
+const packageDependencyFields = [
+	"dependencies",
+	"devDependencies",
+	"optionalDependencies",
+	"peerDependencies",
+];
+
+const hasSdkDependency = ({
+	sourceByFile,
+	packageManifest,
+	sdkPackageName,
+}) => {
+	if (
+		packageManifest &&
+		typeof packageManifest === "object" &&
+		packageDependencyFields.some(
+			(field) =>
+				packageManifest[field] &&
+				typeof packageManifest[field] === "object" &&
+				typeof packageManifest[field][sdkPackageName] === "string",
+		)
+	)
+		return true;
+	for (const [filePath, source] of sourceByFile) {
+		if (basename(filePath) === "package.json") {
+			try {
+				const manifest = JSON.parse(source);
+				if (
+					packageDependencyFields.some(
+						(field) =>
+							manifest?.[field] &&
+							typeof manifest[field] === "object" &&
+							typeof manifest[field][sdkPackageName] === "string",
+					)
+				)
+					return true;
+			} catch {
+				continue;
+			}
+		}
+		if (
+			(filePath.endsWith(".txt") || basename(filePath) === "pyproject.toml") &&
+			new RegExp(
+				`(?:^|[\\s"'])${sdkPackageName.replace(/[.*+?^${}()|[\\]\\]/g, "\\\\$&")}(?:$|[\\s"'<>=])`,
+				"m",
+			).test(source)
+		)
+			return true;
+	}
+	return false;
+};
+
+const packageRepairFile = ({
+	packageManifest,
+	sdkPackageName,
+	packageManifestPath = "package.json",
+}) => {
+	if (!packageManifest || typeof packageManifest !== "object") return null;
+	const dependencyField = packageDependencyFields.find(
+		(field) =>
+			packageManifest[field] &&
+			typeof packageManifest[field] === "object" &&
+			typeof packageManifest[field][sdkPackageName] === "string",
+	);
+	if (dependencyField)
+		return null;
+	const targetField = dependencyField ?? "dependencies";
+	const dependencies =
+		packageManifest[targetField] &&
+		typeof packageManifest[targetField] === "object"
+			? { ...packageManifest[targetField] }
+			: {};
+	dependencies[sdkPackageName] = sdkPackageName.startsWith("@")
+		? "latest"
+		: sdkPackageName;
+	return {
+		path: packageManifestPath,
+		content: `${JSON.stringify({ ...packageManifest, [targetField]: dependencies }, null, 2)}\n`,
+		operation: "update",
+	};
+};
+
+
+const pythonDependencyRepairFile = ({
+	sourceByFile,
+	sdkPackageName,
+	backendRootPath,
+}) => {
+	const allCandidates = [...sourceByFile.entries()].filter(([filePath]) =>
+		["requirements.txt", "requirements-dev.txt", "pyproject.toml"].includes(
+			basename(filePath),
+		),
+	);
+	const candidates = preferredDependencyCandidates(
+		allCandidates,
+		backendRootPath,
+	);
+	if (candidates.some(([, source]) => source.includes(sdkPackageName)))
+		return null;
+	if (candidates.length !== 1) return undefined;
+	const [filePath, source] = candidates[0];
+	if (filePath.endsWith(".txt")) {
+		return {
+			path: filePath,
+			content: `${source.trimEnd()}\n${sdkPackageName}\n`,
+			operation: "update",
+		};
+	}
+	const dependencyArrays = [
+		...source.matchAll(/(^\s*dependencies\s*=\s*\[)([\s\S]*?)(^\s*\])/gm),
+	];
+	if (dependencyArrays.length !== 1) return undefined;
+	const match = dependencyArrays[0];
+	const closingIndex = (match.index ?? 0) + match[0].lastIndexOf("]");
+	return {
+		path: filePath,
+		content: `${source.slice(0, closingIndex)}    "${sdkPackageName}",\n${source.slice(closingIndex)}`,
+		operation: "update",
+	};
+};
+
+const preferredDependencyCandidates = (candidates, backendRootPath) => {
+	if (typeof backendRootPath !== "string" || !backendRootPath.trim())
+		return candidates;
+	const backendParts = backendRootPath.split("/").filter(Boolean);
+	const scoped = candidates
+		.map(([filePath, source]) => {
+			const directory = filePath.includes("/")
+				? filePath.slice(0, filePath.lastIndexOf("/"))
+				: ".";
+			const directoryParts = directory === "." ? [] : directory.split("/");
+			const isAncestor = directoryParts.every(
+				(part, index) => backendParts[index] === part,
+			);
+			return isAncestor
+				? { filePath, source, depth: directoryParts.length }
+				: null;
+		})
+		.filter(Boolean);
+	if (scoped.length === 0) return candidates;
+	const deepest = Math.max(...scoped.map((candidate) => candidate.depth));
+	return scoped
+		.filter((candidate) => candidate.depth === deepest)
+		.map((candidate) => [candidate.filePath, candidate.source]);
+};
+
+const sdkDependencyRepairFile = ({
+	sourceByFile,
+	packageManifest,
+	sdkPackageName,
+	packageManifestPath,
+	backendRootPath,
+}) => {
+	if (packageManifest && typeof packageManifest === "object") {
+		return packageRepairFile({
+			packageManifest,
+			sdkPackageName,
+			packageManifestPath,
+		});
+	}
+	return pythonDependencyRepairFile({
+		sourceByFile,
+		sdkPackageName,
+		backendRootPath,
+	});
+};
+
+const repairProposalFor = ({
+	sourceByFile,
+	evidence,
+	missingLifecycleApis,
+	operationDiscriminatorRequired,
+	identityIntegration,
+	setupDiscovery,
+	packageManifest,
+	packageManifestPath,
+	backendRootPath,
+}) => {
+	const insertions = insertionsByFile();
+	const replacementFiles = new Map();
+	for (const api of missingLifecycleApis) {
+		const anchors = discoveryAnchorsFor({ api, setupDiscovery, sourceByFile });
+		if (!anchors)
+			return {
+				proposal: null,
+				reason: `ambiguous_${api.replace("cluebase.", "")}_boundary`,
+			};
+		for (const anchor of anchors) {
+			const lineStart = anchor.source.lastIndexOf("\n", anchor.index) + 1;
+			const indent =
+				anchor.indent ??
+				anchor.source.slice(lineStart, anchor.index).match(/^\s*/)?.[0] ??
+				"";
+			const text = lifecycleRepairText(api, anchor);
+			if (!text) return { proposal: null, reason: `unsupported_${api}` };
+			if (api === "cluebase.init") {
+				const importText = sdkInitImportTextFor({
+					filePath: anchor.filePath,
+					source: anchor.source,
+					framework: anchor.framework,
+				});
+				if (importText) {
+					addInsertion(
+						insertions,
+						anchor.filePath,
+						0,
+						anchor.index === 0
+							? `${importText}${indent}${text}\n`
+							: importText,
+					);
+				}
+				if (!importText || anchor.index !== 0) {
+					addInsertion(
+						insertions,
+						anchor.filePath,
+						anchor.index,
+						`${indent}${text}\n`,
+					);
+				}
+				continue;
+			}
+			if (
+				!addSdkImport({ insertions, sourceByFile, filePath: anchor.filePath })
+			) {
+				return { proposal: null, reason: "missing_sdk_import_boundary" };
+			}
+			addInsertion(
+				insertions,
+				anchor.filePath,
+				anchor.insertBefore ? anchor.index : anchor.lineEnd + 1,
+				anchor.insertBefore ? `${indent}${text}\n` : `\n${indent}${text}\n`,
+			);
+		}
+	}
+	if (identityIntegration.status === "instrumentation_required") {
+		const candidate = identityIntegration.candidates[0];
+		if (
+			!candidate?.external_namespace ||
+			!candidate.subject_id_expression ||
+			!candidate.external_id_expression
+		) {
+			return {
+				proposal: null,
+				reason: "external_identity_mapping_requires_external_context",
+			};
+		}
+		const source = sourceByFile.get(candidate.source_location.file_path);
+		if (source === undefined) {
+			return { proposal: null, reason: "identity_mapping_source_missing" };
+		}
+		if (
+			!addSdkImport({
+				insertions,
+				sourceByFile,
+				filePath: candidate.source_location.file_path,
+			})
+		) {
+			return { proposal: null, reason: "missing_sdk_import_boundary" };
+		}
+		const lineStart = source
+			.split("\n")
+			.slice(0, candidate.source_location.line_start - 1)
+			.reduce((sum, line) => sum + line.length + 1, 0);
+		const lineEnd = lineEndAt(source, lineStart);
+		const indent = source.slice(lineStart, lineEnd).match(/^\s*/)?.[0] ?? "";
+		const python = candidate.source_location.file_path.endsWith(".py");
+		const linkText = python
+			? `cluebase.link({"subject": {"type": "organization", "id": ${candidate.subject_id_expression}}, "external": {"namespace": ${JSON.stringify(candidate.external_namespace)}, "id": ${candidate.external_id_expression}}})`
+			: `cluebase.link({ subject: { type: "organization", id: ${candidate.subject_id_expression} }, external: { namespace: ${JSON.stringify(candidate.external_namespace)}, id: ${candidate.external_id_expression} } });`;
+		addInsertion(
+			insertions,
+			candidate.source_location.file_path,
+			lineEnd + 1,
+			`\n${indent}${linkText}\n`,
+		);
+	}
+	const requiredRoutes = new Set(operationDiscriminatorRequired);
+	for (const [filePath, source] of sourceByFile) {
+		const rows = evidence.filter(
+			(row) =>
+				requiredRoutes.has(`${row.route.method}:${row.route.path}`) &&
+				row.source_location.file_path === filePath,
+		);
+		if (rows.length === 0) continue;
+		const branchInsertions = operationRepairInsertions({
+			filePath,
+			source,
+			rows,
+			language: filePath.endsWith(".py") ? "python" : "javascript",
+		});
+		if (!branchInsertions)
+			return { proposal: null, reason: "ambiguous_operation_boundary" };
+		for (const insertion of branchInsertions)
+			addInsertion(insertions, filePath, insertion.index, insertion.text);
+	}
+	const requiresSdkDependency =
+		missingLifecycleApis.length > 0 ||
+		identityIntegration.status === "instrumentation_required";
+	if (requiresSdkDependency) {
+		const sdkPackageName =
+			setupDiscovery?.sdkPackageName ?? "@genn-inc/cluebase-backend-sdk";
+		const dependency = sdkDependencyRepairFile({
+			sourceByFile,
+			packageManifest,
+			sdkPackageName,
+			packageManifestPath,
+			backendRootPath,
+		});
+		if (dependency) replacementFiles.set(dependency.path, dependency.content);
+		if (
+			!dependency &&
+			!hasSdkDependency({ sourceByFile, packageManifest, sdkPackageName })
+		) {
+			return { proposal: null, reason: "missing_sdk_dependency_boundary" };
+		}
+	}
+	if (insertions.size === 0)
+		return { proposal: null, reason: "no_deterministic_repair" };
+	const files = [...insertions.entries()].map(([path, fileInsertions]) => ({
+		path: normalizePath(path),
+		content: replacementFiles.has(path)
+			? replacementFiles.get(path)
+			: applyInsertions(sourceByFile.get(path), fileInsertions),
+		operation: "update",
+	}));
+	for (const [path, content] of replacementFiles) {
+		if (insertions.has(path)) continue;
+		files.push({
+			path: normalizePath(path),
+			content,
+			operation: "update",
+		});
+	}
+	return {
+		proposal: {
+			allowedPaths: files.map((file) => file.path),
+			files,
+			title: "Repair Cluebase SDK operation instrumentation",
+			body: "Add only deterministic Cluebase lifecycle and operation discriminator observations at existing setup boundaries.",
+		},
+		reason: null,
+	};
+};
+
+const operationKeyFor = ({ method, path }) => `route.${method}.${path}`;
+
+const identityMappingLocation = ({ filePath, source, index, symbol }) => ({
+	file_path: normalizePath(filePath),
+	line_start: lineNumberAt(source, index),
+	line_end: lineNumberAt(source, lineEndAt(source, index)),
+	symbol,
+});
+
+const identityExpressionAt = ({ source, index, identifier }) => {
+	const receiver = source
+		.slice(0, index)
+		.match(/\b([A-Za-z_$][\w$]*)\s*\.\s*$/)?.[1];
+	return receiver ? `${receiver}.${identifier}` : identifier;
+};
+
+const identityMappingCandidate = ({
+	filePath,
+	source,
+	index,
+	externalFieldReference,
+	externalNamespace,
+	subjectIdExpression,
+	externalIdExpression,
+}) => ({
+	canonical_sdk_field_key: "organization_id",
+	canonical_subject_type: "subject:organization",
+	external_field_reference: externalFieldReference,
+	...(externalNamespace ? { external_namespace: externalNamespace } : {}),
+	...(subjectIdExpression
+		? { subject_id_expression: subjectIdExpression }
+		: {}),
+	...(externalIdExpression
+		? { external_id_expression: externalIdExpression }
+		: {}),
+	source_location: identityMappingLocation({
+		filePath,
+		source,
+		index,
+		symbol: "external_identity_mapping",
+	}),
+});
+
+const identityIntegrationFor = (sourceByFile, externalIdentityContext) => {
+	const contextFields = Array.isArray(externalIdentityContext?.fields)
+		? externalIdentityContext.fields.filter(
+				(field) =>
+					field &&
+					field.reviewResult === "approved" &&
+					((field.identityRole === "canonical_subject" &&
+						field.semanticType === "subject:organization") ||
+						(field.identityRole === "external_key" &&
+							typeof field.namespace === "string" &&
+							field.namespace.trim())),
+				)
+			: [];
+	const approvedCanonicalOrganizationFields = contextFields.filter(
+		(field) =>
+			field.identityRole === "canonical_subject" &&
+			field.semanticType === "subject:organization" &&
+			/organization_id|organizationid|metadata/i.test(
+				String(field.fieldReference ?? ""),
+			),
+	);
+	const namespaces = [
+		...new Set(
+			contextFields
+				.filter(
+					(field) =>
+						field.identityRole === "external_key" &&
+						typeof field.namespace === "string",
+				)
+				.map((field) => field.namespace),
+		),
+	];
+	const externalContextNamespaceCounts = new Map();
+	for (const field of contextFields) {
+		if (
+			field.identityRole !== "external_key" ||
+			typeof field.namespace !== "string"
+		)
+			continue;
+		externalContextNamespaceCounts.set(
+			field.namespace,
+			(externalContextNamespaceCounts.get(field.namespace) ?? 0) + 1,
+		);
+	}
+	const ambiguousContextNamespace = [
+		...externalContextNamespaceCounts.values(),
+	].some((count) => count > 1);
+	const candidates = [];
+	let existingLink = false;
+	let hasMetadataCandidate = false;
+	for (const [filePath, source] of sourceByFile) {
+		if (EXISTING_EXTERNAL_LINK_PATTERN.test(source)) {
+			existingLink = true;
+			candidates.push(
+				identityMappingCandidate({
+					filePath,
+					source,
+					index: source.search(EXISTING_EXTERNAL_LINK_PATTERN),
+					externalFieldReference: "existing_cluebase_link",
+				}),
+			);
+		}
+		let metadataMatch;
+		EXTERNAL_METADATA_ORGANIZATION_PATTERN.lastIndex = 0;
+		metadataMatch = EXTERNAL_METADATA_ORGANIZATION_PATTERN.exec(source);
+		if (metadataMatch) {
+			hasMetadataCandidate = true;
+			candidates.push(
+				identityMappingCandidate({
+					filePath,
+					source,
+					index: metadataMatch.index,
+					externalFieldReference: "external.metadata.organization_id",
+				}),
+			);
+		}
+		if (!ORGANIZATION_ID_PATTERN.test(source)) continue;
+		const subjectIdExpression = source.match(
+			/\b(?:organization|org)\s*(?:\.\s*id|\[\s*["']id["']\s*\])|\b(?:organizationId|organization_id|orgId|org_id)\b/i,
+		)?.[0];
+		EXTERNAL_ID_PATTERN.lastIndex = 0;
+		for (const match of source.matchAll(EXTERNAL_ID_PATTERN)) {
+			const externalFieldReference = match[1];
+			if (
+				NON_EXTERNAL_ID_NAMES.has(externalFieldReference) ||
+				NON_EXTERNAL_ID_PATTERN.test(externalFieldReference)
+			)
+				continue;
+			candidates.push(
+				identityMappingCandidate({
+					filePath,
+					source,
+					index: match.index ?? 0,
+					externalFieldReference,
+					externalNamespace:
+						namespaces.length === 1 ? namespaces[0] : undefined,
+					subjectIdExpression,
+					externalIdExpression: identityExpressionAt({
+						source,
+						index: match.index ?? 0,
+						identifier: externalFieldReference,
+					}),
+				}),
+			);
+		}
+	}
+
+	const candidatesByLocation = new Map();
+	for (const candidate of candidates) {
+		const key = `${candidate.source_location.file_path}:${candidate.external_field_reference}`;
+		if (!candidatesByLocation.has(key))
+			candidatesByLocation.set(key, candidate);
+	}
+	const uniqueCandidates = [...candidatesByLocation.values()];
+	const candidatesByReference = new Map();
+	for (const candidate of uniqueCandidates) {
+		const current =
+			candidatesByReference.get(candidate.external_field_reference) ?? [];
+		current.push(candidate);
+		candidatesByReference.set(candidate.external_field_reference, current);
+	}
+	const duplicateCandidate = [...candidatesByReference.values()].some(
+		(matches) =>
+			new Set(matches.map((candidate) => candidate.source_location.file_path))
+				.size > 1,
+	);
+	if (
+		existingLink ||
+		(hasMetadataCandidate &&
+			(!externalIdentityContext ||
+				approvedCanonicalOrganizationFields.length === 1) &&
+			uniqueCandidates.some(
+				(candidate) =>
+					candidate.external_field_reference ===
+					"external.metadata.organization_id",
+			))
+	) {
+		return {
+			status: "no_code_change",
+			candidates: uniqueCandidates,
+			reason: null,
+		};
+	}
+	if (
+		duplicateCandidate ||
+		(externalIdentityContext &&
+			(namespaces.length !== 1 || ambiguousContextNamespace))
+	) {
+		return {
+			status: "blocked",
+			candidates: uniqueCandidates,
+			reason: "ambiguous_external_identity_mapping",
+		};
+	}
+	if (uniqueCandidates.length === 1) {
+		return {
+			status: "instrumentation_required",
+			candidates: uniqueCandidates,
+			reason: null,
+		};
+	}
+	if (uniqueCandidates.length > 1) {
+		return {
+			status: "blocked",
+			candidates: uniqueCandidates,
+			reason: "ambiguous_external_identity_mapping",
+		};
+	}
+	return { status: "no_code_change", candidates: [], reason: null };
+};
+
+const buildEvidence = ({
+	filePath,
+	lineStart,
+	lineEnd,
+	symbol,
+	method,
+	path,
+	operationDiscriminator,
+	handlerText,
+	sourceRevisionSha,
+	fileSource,
+	sourceByFile,
+}) => {
+	const dependencyAnalysis = directDependencyAnalysisFor({
+		filePath,
+		fileSource,
+		handlerSource: handlerText,
+		sourceByFile,
+	});
+	const effects = effectsFor({
+		source: `${handlerText}\n${dependencyAnalysis.source}`,
+		path,
+	});
+	const value = {
+		operation_source_key: operationKeyFor({
+			method,
+			path,
+			discriminator: operationDiscriminator,
+		}),
+		operation_discriminator: operationDiscriminator,
+		route: { method, path },
+		source_location: {
+			file_path: normalizePath(filePath),
+			line_start: lineStart,
+			line_end: lineEnd,
+			symbol: operationDiscriminator
+				? `${symbol}#${operationDiscriminator}`
+				: symbol,
+		},
+		effects: {
+			resource: effects.resource,
+			data_operation: effects.data_operation,
+			persistence_write: effects.persistence_write,
+			external_side_effect: effects.external_side_effect,
+			notification_side_effect: effects.notification_side_effect,
+			downstream_dependency: effects.downstream_dependency,
+		},
+		outcome: {
+			success_path: effects.success_path,
+			destructive_reference: effects.destructive_reference,
+			reversible_reference: effects.reversible_reference,
+		},
+		confidence: confidenceFor({
+			deterministicDiscriminator: Boolean(operationDiscriminator),
+			dataOperation: effects.data_operation,
+			dependencyResolved: dependencyAnalysis.resolved,
+			handlerResolved: !hasUnresolvedNamedHandler(fileSource, sourceByFile),
+		}),
+		source_revision_sha: sourceRevisionSha,
+		analyzer_version: CODE_EVIDENCE_ANALYZER_VERSION,
+	};
+	return value;
+};
+
+const evidenceForRoute = ({
+	source,
+	filePath,
+	start,
+	end,
+	method,
+	path,
+	symbol,
+	sourceRevisionSha,
+	language,
+	sourceByFile,
+}) => {
+	const routeSource = source.slice(start, end + 1);
+	const discriminators = branchDiscriminators(routeSource, language).map(
+		(item) => ({
+			...item,
+			index: item.index + start,
+		}),
+	);
+	const candidates = discriminators.length > 0 ? discriminators : [null];
+	return candidates.map((discriminator) => {
+		const branchSource = discriminator
+			? branchTextFor(source, discriminator, language)
+			: routeSource;
+		const lineStart = discriminator
+			? lineNumberAt(source, discriminator.index)
+			: lineNumberAt(source, start);
+		return buildEvidence({
+			filePath,
+			lineStart,
+			lineEnd: lineNumberAt(source, end),
+			symbol,
+			method,
+			path,
+			operationDiscriminator: discriminator?.value ?? null,
+			handlerText: branchSource,
+			sourceRevisionSha,
+			fileSource: source,
+			sourceByFile,
+		});
+	});
+};
+
+const analyzeJavaScriptSource = ({
+	source,
+	filePath,
+	sourceRevisionSha,
+	sourceByFile,
+}) => {
+	const evidence = [];
+	if (matchesPattern(source, EXPRESS_FRAMEWORK_PATTERN)) {
+		let match;
+		while ((match = ROUTE_METHOD_PATTERN.exec(source))) {
+			const open = source.indexOf("(", match.index);
+			const close = findMatchingDelimiter(source, open);
+			if (close === -1) continue;
+			const argumentsList = splitTopLevel(source.slice(open + 1, close));
+			const path = stringLiteralValue(argumentsList[0] ?? "");
+			const method = match[1].toUpperCase();
+			if (!path || !HTTP_METHODS.has(method)) continue;
+			const handlerStart = open + 1 + (argumentsList[0]?.length ?? 0);
+			const end = findHandlerEnd(source, handlerStart, close);
+			const symbol = functionNameNear(source, handlerStart, end);
+			evidence.push(
+				...evidenceForRoute({
+					source,
+					filePath,
+					start: match.index,
+					end,
+					method,
+					path,
+					symbol,
+					sourceRevisionSha,
+					language: "javascript",
+					sourceByFile,
+				}),
+			);
+		}
+	}
+
+	const controllers = [];
+	if (matchesPattern(source, NEST_FRAMEWORK_PATTERN)) {
+		CONTROLLER_DECORATOR_PATTERN.lastIndex = 0;
+		let controllerMatch;
+		while ((controllerMatch = CONTROLLER_DECORATOR_PATTERN.exec(source))) {
+			controllers.push({
+				index: controllerMatch.index,
+				path: controllerMatch[2] ?? "",
+			});
+		}
+		NEST_DECORATOR_PATTERN.lastIndex = 0;
+		let decoratorMatch;
+		while ((decoratorMatch = NEST_DECORATOR_PATTERN.exec(source))) {
+			const method = decoratorMatch[1].toUpperCase();
+			const controller = [...controllers]
+				.reverse()
+				.find((candidate) => candidate.index < decoratorMatch.index);
+			const path = joinRoutePath(
+				controller?.path ?? "",
+				decoratorMatch[3] ?? "",
+			);
+			const end = findHandlerEnd(
+				source,
+				decoratorMatch.index + decoratorMatch[0].length,
+				source.length,
+			);
+			const symbol = functionNameNear(
+				source,
+				decoratorMatch.index + decoratorMatch[0].length,
+				end,
+			);
+			evidence.push(
+				...evidenceForRoute({
+					source,
+					filePath,
+					start: decoratorMatch.index,
+					end,
+					method,
+					path,
+					symbol,
+					sourceRevisionSha,
+					language: "javascript",
+					sourceByFile,
+				}),
+			);
+		}
+	}
+	return evidence;
+};
+
+const pythonMethodsFromDeclaration = (method, suffix) => {
+	if (method !== "API_ROUTE") return [method];
+	const methods = [...suffix.matchAll(/methods\s*=\s*\[([^\]]+)\]/gi)].flatMap(
+		(match) =>
+			[...match[1].matchAll(/["']([A-Za-z]+)["']/g)].map((item) =>
+				item[1].toUpperCase(),
+			),
+	);
+	return methods.length > 0 ? methods : ["ALL"];
+};
+
+const pythonFunctionEnd = (source, functionStart) => {
+	if (functionStart === -1) return lineEndAt(source, 0) - 1;
+	const functionLineStart = source.lastIndexOf("\n", functionStart) + 1;
+	const functionIndent =
+		source.slice(functionLineStart, functionStart).match(/^\s*/)?.[0].length ??
+		0;
+	const lines = source.slice(functionLineStart).split("\n");
+	let offset = functionLineStart + lines[0].length;
+	for (const line of lines.slice(1)) {
+		offset += 1;
+		if (
+			line.trim() &&
+			(line.match(/^\s*/)?.[0].length ?? 0) <= functionIndent
+		) {
+			return offset - 1;
+		}
+		offset += line.length;
+	}
+	return source.length - 1;
+};
+
+const analyzePythonSource = ({
+	source,
+	filePath,
+	sourceRevisionSha,
+	sourceByFile,
+}) => {
+	const evidence = [];
+	if (!matchesPattern(source, FASTAPI_FRAMEWORK_PATTERN)) return evidence;
+	const matches = [...source.matchAll(PYTHON_ROUTE_PATTERN)];
+	for (const match of matches) {
+		const routeMethod = match[1].toUpperCase();
+		const path = match[3];
+		const methods = pythonMethodsFromDeclaration(routeMethod, match[4] ?? "");
+		const functionStart = source.indexOf("def ", match.index + match[0].length);
+		const functionMatch =
+			functionStart === -1
+				? null
+				: source.slice(functionStart).match(/^def\s+([A-Za-z_]\w*)/);
+		const end = pythonFunctionEnd(source, functionStart);
+		for (const method of methods) {
+			evidence.push(
+				...evidenceForRoute({
+					source,
+					filePath,
+					start: match.index,
+					end,
+					method,
+					path,
+					symbol: functionMatch?.[1] ?? "anonymous_route",
+					sourceRevisionSha,
+					language: "python",
+					sourceByFile,
+				}),
+			);
+		}
+	}
+	return evidence;
+};
+
+const hasUnresolvedNamedHandler = (source, sourceByFile = new Map()) => {
+	if (!matchesPattern(source, EXPRESS_FRAMEWORK_PATTERN)) return false;
+	const routePattern = new RegExp(
+		ROUTE_METHOD_PATTERN.source,
+		ROUTE_METHOD_PATTERN.flags,
+	);
+	let match;
+	while ((match = routePattern.exec(source))) {
+		const open = source.indexOf("(", match.index);
+		const close = findMatchingDelimiter(source, open);
+		if (close === -1) continue;
+		const argumentsList = splitTopLevel(source.slice(open + 1, close));
+		const handler = argumentsList.at(-1)?.trim() ?? "";
+		if (
+			/^[A-Za-z_$][\w$]*$/.test(handler) &&
+			![...sourceByFile.values()].some((candidate) =>
+				namedFunctionSource(candidate, handler),
+			)
+		)
+			return true;
+	}
+	return false;
+};
+
+const lifecycleLocationsFor = ({ source, filePath }) => {
+	const locations = [];
+	LIFECYCLE_PATTERN.lastIndex = 0;
+	let match;
+	while ((match = LIFECYCLE_PATTERN.exec(source))) {
+		locations.push({
+			api: match[1],
+			file_path: normalizePath(filePath),
+			line: lineNumberAt(source, match.index),
+		});
+	}
+	return locations;
+};
+
+const runtimeDiscriminatorMissingFor = ({ row, source, language }) => {
+	const branches = branchDiscriminators(source, language);
+	const branch = branches.find(
+		(candidate) =>
+			candidate.value === row.operation_discriminator &&
+			lineNumberAt(source, candidate.index) === row.source_location.line_start,
+	);
+	return (
+		!branch ||
+		!hasRuntimeDiscriminatorCall(
+			branchTextFor(source, branch, language),
+			language,
+		)
+	);
+};
+
+const sortEvidence = (left, right) =>
+	left.operation_source_key.localeCompare(right.operation_source_key) ||
+	left.source_location.file_path.localeCompare(
+		right.source_location.file_path,
+	) ||
+	left.source_location.line_start - right.source_location.line_start;
+
+const validateSourceRevision = (sourceRevisionSha) => {
+	if (!/^[0-9a-f]{40}$/i.test(sourceRevisionSha ?? "")) {
+		throw new Error("sourceRevisionSha must be a 40-character commit SHA");
+	}
+	return sourceRevisionSha.toLowerCase();
+};
+
+export const analyzeCodeEvidence = async ({
+	repoRoot = ".",
+	allowedSourcePaths,
+	excludedSourcePaths,
+	sourceRevisionSha,
+} = {}) => {
+	const revision = validateSourceRevision(sourceRevisionSha);
+	const resolvedRoot = resolve(repoRoot);
+	const files = await listAllowedSourceFiles({
+		repoRoot: resolvedRoot,
+		allowedSourcePaths,
+		excludedSourcePaths,
+		extensions: SOURCE_EXTENSIONS,
+	});
+	const evidence = [];
+	const sourceByFile = new Map();
+	for (const absolutePath of files) {
+		const filePath = normalizePath(relative(resolvedRoot, absolutePath));
+		sourceByFile.set(filePath, await readFile(absolutePath, "utf8"));
+	}
+	for (const absolutePath of files) {
+		const filePath = normalizePath(relative(resolvedRoot, absolutePath));
+		const source = sourceByFile.get(filePath);
+		if (source === undefined) continue;
+		const extension = filePath.slice(filePath.lastIndexOf(".")).toLowerCase();
+		if (extension === ".py") {
+			evidence.push(
+				...analyzePythonSource({
+					source,
+					filePath,
+					sourceRevisionSha: revision,
+					sourceByFile,
+				}),
+			);
+		} else {
+			evidence.push(
+				...analyzeJavaScriptSource({
+					source,
+					filePath,
+					sourceRevisionSha: revision,
+					sourceByFile,
+				}),
+			);
+		}
+	}
+	return evidence.sort(sortEvidence);
+};
+
+export const analyzeCodeEvidenceReport = async (options = {}) => {
+	const resolvedRoot = resolve(options.repoRoot ?? ".");
+	const revision = validateSourceRevision(options.sourceRevisionSha);
+	let setupDiscovery = options.setupDiscovery;
+	if (!setupDiscovery && options.setupDiscoveryPath) {
+		try {
+			setupDiscovery = JSON.parse(
+				await readFile(options.setupDiscoveryPath, "utf8"),
+			);
+		} catch {
+			setupDiscovery = undefined;
+		}
+	}
+	let externalIdentityContext = options.externalIdentityContext;
+	if (!externalIdentityContext && options.externalIdentityContextPath) {
+		try {
+			externalIdentityContext = JSON.parse(
+				await readFile(options.externalIdentityContextPath, "utf8"),
+			);
+		} catch {
+			externalIdentityContext = undefined;
+		}
+	}
+	const files = await listAllowedSourceFiles({
+		repoRoot: resolvedRoot,
+		allowedSourcePaths: options.allowedSourcePaths,
+		excludedSourcePaths: options.excludedSourcePaths,
+		extensions: SOURCE_EXTENSIONS,
+	});
+	const lifecycleLocations = [];
+	const insufficientEvidence = [];
+	const sourceByFile = new Map();
+	for (const absolutePath of files) {
+		const filePath = normalizePath(relative(resolvedRoot, absolutePath));
+		const source = await readFile(absolutePath, "utf8");
+		sourceByFile.set(filePath, source);
+		lifecycleLocations.push(...lifecycleLocationsFor({ source, filePath }));
+		const extension = filePath.slice(filePath.lastIndexOf(".")).toLowerCase();
+		if (
+			extension === ".py" &&
+			matchesPattern(source, PYTHON_ROUTE_PATTERN) &&
+			!matchesPattern(source, FASTAPI_FRAMEWORK_PATTERN)
+		) {
+			insufficientEvidence.push({
+				file_path: filePath,
+				reason: "unsupported_framework",
+			});
+		}
+		if (
+			extension !== ".py" &&
+			matchesPattern(source, SERVER_ROUTE_DECLARATION_PATTERN) &&
+			!matchesPattern(source, EXPRESS_FRAMEWORK_PATTERN) &&
+			!matchesPattern(source, NEST_FRAMEWORK_PATTERN)
+		) {
+			insufficientEvidence.push({
+				file_path: filePath,
+				reason: "unsupported_framework",
+			});
+		}
+	}
+	let packageManifest;
+	let packageManifestPath;
+	const dependencyRoots = new Set(["."]);
+	if (typeof setupDiscovery?.backendRootPath === "string") {
+		const rootParts = setupDiscovery.backendRootPath
+			.split("/")
+			.filter(Boolean);
+		for (let index = 1; index <= rootParts.length; index += 1)
+			dependencyRoots.add(rootParts.slice(0, index).join("/"));
+	}
+	for (const dependencyRoot of dependencyRoots) {
+		for (const dependencyFile of DEPENDENCY_FILE_CANDIDATES) {
+			const relativeDependencyFile = normalizePath(
+				join(dependencyRoot, dependencyFile),
+			);
+			try {
+				const source = await readFile(
+					join(resolvedRoot, relativeDependencyFile),
+					"utf8",
+				);
+				sourceByFile.set(
+					relativeDependencyFile,
+					dependencyFile === "package.json" ? "" : source,
+				);
+				if (
+					dependencyFile === "package.json" &&
+					packageManifest === undefined &&
+					(dependencyRoot === setupDiscovery?.backendRootPath ||
+						setupDiscovery?.backendRootPath === undefined)
+				) {
+					packageManifest = JSON.parse(source);
+					packageManifestPath = relativeDependencyFile;
+				}
+			} catch {}
+		}
+	}
+	const evidence = await analyzeCodeEvidence(options);
+	for (const [filePath, source] of sourceByFile) {
+		const fileEvidence = evidence.filter(
+			(row) => row.source_location.file_path === filePath,
+		);
+		const extension = filePath.slice(filePath.lastIndexOf(".")).toLowerCase();
+		const recognizedFramework =
+			(extension === ".py" &&
+				matchesPattern(source, FASTAPI_FRAMEWORK_PATTERN)) ||
+			(extension !== ".py" &&
+				(matchesPattern(source, EXPRESS_FRAMEWORK_PATTERN) ||
+					matchesPattern(source, NEST_FRAMEWORK_PATTERN)));
+		if (!recognizedFramework) continue;
+		if (
+			(fileEvidence.length > 0 &&
+				!fileEvidence.some((row) => row.operation_discriminator) &&
+				(extension === ".py"
+					? /^\s*match\s+.+:\s*$/m.test(source)
+					: /\bswitch\s*\(/.test(source))) ||
+			(extension !== ".py" && hasUnresolvedNamedHandler(source, sourceByFile))
+		) {
+			insufficientEvidence.push({
+				file_path: filePath,
+				reason: "unresolved_operation_boundary",
+			});
+		}
+	}
+	const lifecycleApis = new Set(
+		lifecycleLocations.map((location) => location.api),
+	);
+	if (
+		setupDiscovery?.framework &&
+		[...sourceByFile.values()].some((source) =>
+			sourceMatchesBackendInit(
+				setupDiscovery.framework,
+				stripSourceNoise(source, { stripStrings: true }),
+			),
+		)
+	) {
+		lifecycleApis.add("cluebase.init");
+	}
+	const requiredLifecycleApis = Array.isArray(
+		setupDiscovery?.applicableLifecycleApis,
+	)
+		? setupDiscovery.applicableLifecycleApis
+		: REQUIRED_LIFECYCLE_APIS;
+	const missingLifecycleApis = requiredLifecycleApis.filter(
+		(api) => !lifecycleApis.has(api),
+	);
+	const routeKeys = new Map();
+	for (const row of evidence) {
+		const routeKey = `${row.source_location.file_path}:${row.route.method}:${row.route.path}`;
+		const current = routeKeys.get(routeKey) ?? [];
+		current.push(row);
+		routeKeys.set(routeKey, current);
+	}
+	const operationDiscriminatorRequired = [...routeKeys.values()]
+		.filter(
+			(rows) =>
+				rows.length > 1 &&
+				(rows.some((row) => !row.operation_discriminator) ||
+					rows.some((row) => {
+						const source = sourceByFile.get(row.source_location.file_path);
+						return source !== undefined && row.operation_discriminator
+							? runtimeDiscriminatorMissingFor({
+									row,
+									source,
+									language: row.source_location.file_path.endsWith(".py")
+										? "python"
+										: "javascript",
+								})
+							: false;
+					})),
+		)
+		.map((rows) => `${rows[0].route.method}:${rows[0].route.path}`);
+	const identityIntegration = identityIntegrationFor(
+		sourceByFile,
+		externalIdentityContext,
+	);
+	const repair = repairProposalFor({
+		sourceByFile,
+		evidence,
+		missingLifecycleApis,
+		operationDiscriminatorRequired,
+		identityIntegration,
+		setupDiscovery,
+		packageManifest,
+		packageManifestPath,
+		backendRootPath: setupDiscovery?.backendRootPath,
+	});
+	const requiresRepair =
+		operationDiscriminatorRequired.length > 0 ||
+		missingLifecycleApis.length > 0 ||
+		identityIntegration.status === "instrumentation_required";
+	const blocked =
+		insufficientEvidence.length > 0 ||
+		identityIntegration.status === "blocked" ||
+		(requiresRepair && !repair.proposal);
+	const setupStatus = blocked
+		? "blocked"
+		: requiresRepair
+			? "repairable"
+			: "healthy";
+	return {
+		analyzer_version: CODE_EVIDENCE_ANALYZER_VERSION,
+		source_revision_sha: revision,
+		code_evidence: evidence,
+		setup_plan: {
+			status: setupStatus,
+			minimal_changes: [
+				...missingLifecycleApis.map((api) => ({
+					kind: "lifecycle_wiring",
+					api,
+				})),
+				...(identityIntegration.status === "instrumentation_required"
+					? [{ kind: "external_identity_link", api: "cluebase.link" }]
+					: []),
+			],
+			lifecycle_locations: lifecycleLocations,
+			missing_lifecycle_apis: missingLifecycleApis,
+			operation_discriminator_required: operationDiscriminatorRequired,
+			insufficient_evidence: insufficientEvidence,
+			identity_integration: identityIntegration,
+			repair_proposal: repair.proposal,
+			repair_block_reason: blocked ? repair.reason : null,
+			...(setupDiscovery?.language
+				? { verification_language: setupDiscovery.language }
+				: {}),
+		},
+	};
+};