@yoonion/mimi-seed-mcp 0.21.2 → 0.21.4

package/dist/core/checks/gradle-text.js

@@ -0,0 +1,212 @@
+// Gradle build-script text helpers shared by the Release Doctor checks.
+/** Characters after which a Groovy `/` starts a slashy string rather than a division (`~ = ( , :` and `?:`). */
+const SLASHY_CONTEXT = new Set(['~', '=', '(', ',', ':', '?']);
+/**
+ * Scans Gradle (Groovy or Kotlin DSL) source and reports each token span to `visit`: `code` (outside strings and
+ * comments), `string` (any string literal, copied verbatim), or `comment`. String-aware: `'…'`, `"…"`, `'''…'''`,
+ * `"""…"""` (escapes, `${…}` templates with nested strings), Groovy slashy `/…/` (after `~ = ( , :` or `?:`, as in
+ * `exclude group: /a{/`) and dollar-slashy `$/…/$` strings. Degrades safely: an unterminated single-line string or
+ * template ends at the line break, and a `/*` with no closing `*\/` is text, not a comment that deletes the rest of
+ * the file.
+ */
+function scanGradle(text, visit) {
+    const length = text.length;
+    /** Index after the string literal starting at `start` (a quote). */
+    function stringEnd(start) {
+        const quote = text[start];
+        const triple = text.startsWith(quote.repeat(3), start);
+        const delimiter = triple ? quote.repeat(3) : quote;
+        let cursor = start + delimiter.length;
+        while (cursor < length) {
+            const char = text[cursor];
+            if (char === '\\' && !triple) {
+                cursor += 2;
+                continue;
+            }
+            if (text.startsWith(delimiter, cursor))
+                return cursor + delimiter.length;
+            if (quote === '"' && char === '$' && text[cursor + 1] === '{') {
+                cursor = templateEnd(cursor + 2, !triple);
+                continue;
+            }
+            if (!triple && char === '\n')
+                return cursor;
+            cursor++;
+        }
+        return cursor;
+    }
+    /** Index after the `}` closing a template expression starting at `start` (or at the line break, single-line). */
+    function templateEnd(start, singleLine) {
+        let depth = 1;
+        let cursor = start;
+        while (cursor < length && depth > 0) {
+            const char = text[cursor];
+            if (singleLine && char === '\n')
+                return cursor;
+            if (char === '"' || char === "'") {
+                cursor = stringEnd(cursor);
+                continue;
+            }
+            if (char === '{')
+                depth++;
+            else if (char === '}')
+                depth--;
+            cursor++;
+        }
+        return cursor;
+    }
+    let index = 0;
+    let codeStart = 0;
+    let lastSignificant = '';
+    const flushCode = (end) => {
+        if (end > codeStart)
+            visit('code', codeStart, end);
+    };
+    while (index < length) {
+        const char = text[index];
+        const next = text[index + 1];
+        let tokenEnd = -1;
+        let kind = 'string';
+        if (char === '/' && next === '/') {
+            tokenEnd = text.indexOf('\n', index);
+            if (tokenEnd < 0)
+                tokenEnd = length;
+            kind = 'comment';
+        }
+        else if (char === '/' && next === '*') {
+            const close = text.indexOf('*/', index + 2);
+            if (close >= 0) {
+                tokenEnd = close + 2;
+                kind = 'comment';
+            }
+        }
+        else if (char === '"' || char === "'") {
+            tokenEnd = stringEnd(index);
+        }
+        else if (char === '$' && next === '/') {
+            const close = text.indexOf('/$', index + 2);
+            if (close >= 0)
+                tokenEnd = close + 2;
+        }
+        else if (char === '/' && SLASHY_CONTEXT.has(lastSignificant)) {
+            let cursor = index + 1;
+            while (cursor < length && text[cursor] !== '/')
+                cursor += text[cursor] === '\\' ? 2 : 1;
+            if (cursor < length)
+                tokenEnd = cursor + 1;
+        }
+        if (tokenEnd < 0) {
+            if (!/\s/.test(char))
+                lastSignificant = char;
+            index++;
+            continue;
+        }
+        flushCode(index);
+        visit(kind, index, tokenEnd);
+        if (kind === 'string')
+            lastSignificant = '"';
+        index = tokenEnd;
+        codeStart = tokenEnd;
+    }
+    flushCode(length);
+}
+/**
+ * Gradle source with comments removed and strings kept verbatim, so `/*` in a glob such as `pickFirst '**\/*.so'`
+ * or `//` in a URL is text, not a comment. Block comments become the newlines they spanned, so line-based matching
+ * keeps working.
+ */
+export function stripGradleComments(text) {
+    let out = '';
+    scanGradle(text, (kind, start, end) => {
+        const slice = text.slice(start, end);
+        out += kind === 'comment' ? slice.replace(/[^\n]/g, '') : slice;
+    });
+    return out;
+}
+/** Gradle source with comments blanked to spaces (same length and line breaks, so indexes still line up). */
+export function blankComments(text) {
+    let out = '';
+    scanGradle(text, (kind, start, end) => {
+        const slice = text.slice(start, end);
+        out += kind === 'comment' ? slice.replace(/[^\n]/g, ' ') : slice;
+    });
+    return out;
+}
+/**
+ * Gradle source with comments and string contents blanked (same length, line breaks kept): only code is left to
+ * match tokens against, so `"targetSdk 33"` in a string or a comment is never read as an assignment. Each string
+ * literal keeps its first and last character so `x = "…"` still shows a value is there.
+ */
+export function maskStrings(text) {
+    let out = '';
+    scanGradle(text, (kind, start, end) => {
+        const slice = text.slice(start, end);
+        if (kind === 'code')
+            out += slice;
+        else if (kind === 'comment' || slice.length < 2)
+            out += slice.replace(/[^\n]/g, ' ');
+        else
+            out += slice[0] + slice.slice(1, -1).replace(/[^\n]/g, ' ') + slice.at(-1);
+    });
+    return out;
+}
+/**
+ * Like `maskStrings`, but string literals for which `keep(literal)` is true stay verbatim (`literal` includes its
+ * quotes). Comments are blanked. Same length and line breaks as `text`.
+ */
+export function keepStrings(text, keep) {
+    let out = '';
+    scanGradle(text, (kind, start, end) => {
+        const slice = text.slice(start, end);
+        if (kind === 'code' || (kind === 'string' && keep(slice)))
+            out += slice;
+        else if (kind === 'comment' || slice.length < 2)
+            out += slice.replace(/[^\n]/g, ' ');
+        else
+            out += slice[0] + slice.slice(1, -1).replace(/[^\n]/g, ' ') + slice.at(-1);
+    });
+    return out;
+}
+/**
+ * Index of the `}` that closes the `{` at `open`, counting braces only in code (not inside strings or comments);
+ * -1 when it is never closed.
+ */
+export function closingBrace(text, open) {
+    let depth = 0;
+    let result = -1;
+    scanGradle(text.slice(open), (kind, start, end) => {
+        if (kind !== 'code' || result >= 0)
+            return;
+        for (let index = start; index < end; index++) {
+            const char = text[open + index];
+            if (char === '{')
+                depth++;
+            else if (char === '}' && --depth === 0) {
+                result = open + index;
+                return;
+            }
+        }
+    });
+    return result;
+}
+/** `text` without every block opened by `opener` (a regex ending at `{`), braces matched with `closingBrace`. */
+export function removeBlocks(text, opener) {
+    let result = text;
+    for (;;) {
+        const start = new RegExp(opener.source).exec(result);
+        if (!start)
+            return result;
+        const close = closingBrace(result, start.index + start[0].length - 1);
+        // An unclosed block (malformed or truncated script) loses only its opener, never the rest of the file.
+        result = result.slice(0, start.index) + result.slice(close < 0 ? start.index + start[0].length : close + 1);
+    }
+}
+/** The contents of the first block opened by `opener` (a regex ending at `{`), or undefined. */
+export function blockContents(text, opener) {
+    const start = new RegExp(opener.source).exec(text);
+    if (!start)
+        return undefined;
+    const open = start.index + start[0].length - 1;
+    const close = closingBrace(text, open);
+    return close < 0 ? undefined : text.slice(open + 1, close);
+}

package/dist/core/checks/lockfile.d.ts

@@ -0,0 +1,21 @@
+export declare function readText(file: string): Promise<string | undefined>;
+/** The nearest directory at or above `start` that holds a `.git` entry (a checkout or a worktree), if any. */
+export declare function repositoryRoot(start: string): Promise<string | undefined>;
+/**
+ * Directories that may hold the lockfile (or the hoisted `node_modules`) for the package in `packageDir`: every
+ * ancestor up to the scan root, then — when the scan root sits inside a repository (`--path` into a workspace
+ * monorepo) — on up to that repository's root, where Yarn/npm/pnpm workspaces keep the one lockfile.
+ */
+export declare function lockfileDirectories(packageDir: string, root: string): Promise<string[]>;
+export interface LockedVersion {
+    version: string;
+    /** The lockfile's base name, for evidence text. */
+    lockfile: 'package-lock.json' | 'pnpm-lock.yaml' | 'yarn.lock';
+    /**
+     * The package actually installed under the dependency's name when it differs — an `npm:` alias such as
+     * `"react-native-iap": "npm:@fork/react-native-iap@^12"`. The version is then that package's, not `name`'s.
+     */
+    aliasOf?: string;
+}
+/** The version a lockfile in `lockDir` resolved for dependency `name` (declared as `declared`) of the package in `packageDir`. */
+export declare function lockedPackageVersion(name: string, packageDir: string, lockDir: string, declared: string): Promise<LockedVersion | undefined>;

package/dist/core/checks/lockfile.js

@@ -0,0 +1,185 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+// Lockfile and repository-root lookups shared by the Release Doctor checks (firebase-admin, react-native-iap).
+// Repository-only: these read files, never the network.
+export async function readText(file) {
+    try {
+        return await fs.readFile(file, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+}
+async function exists(file) {
+    try {
+        await fs.stat(file);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/** The nearest directory at or above `start` that holds a `.git` entry (a checkout or a worktree), if any. */
+export async function repositoryRoot(start) {
+    let current = path.resolve(start);
+    for (;;) {
+        if (await exists(path.join(current, '.git')))
+            return current;
+        const parent = path.dirname(current);
+        if (parent === current)
+            return undefined;
+        current = parent;
+    }
+}
+function isWithin(scope, target) {
+    const relative = path.relative(scope, target);
+    return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+}
+/**
+ * Directories that may hold the lockfile (or the hoisted `node_modules`) for the package in `packageDir`: every
+ * ancestor up to the scan root, then — when the scan root sits inside a repository (`--path` into a workspace
+ * monorepo) — on up to that repository's root, where Yarn/npm/pnpm workspaces keep the one lockfile.
+ */
+export async function lockfileDirectories(packageDir, root) {
+    const result = [];
+    const repo = await repositoryRoot(root);
+    const limit = repo && isWithin(repo, root) ? repo : root;
+    let current = path.resolve(packageDir);
+    for (;;) {
+        result.push(current);
+        if (current === limit || !isWithin(limit, current))
+            break;
+        const parent = path.dirname(current);
+        if (parent === current)
+            break;
+        current = parent;
+    }
+    return result;
+}
+/** `npm:@scope/pkg@^1.2.3` -> `@scope/pkg`. */
+function aliasTarget(spec) {
+    return spec.match(/^npm:((?:@[^/@]+\/)?[^@]+)(?:@|$)/)?.[1];
+}
+const SEMVER_PREFIX = /^(\d+\.\d+\.\d+[^\s_('"]*)/;
+/**
+ * pnpm-lock.yaml: the importer block for the package (v6+ workspaces, and v5 workspaces), or the top level for a
+ * single-project lockfile without `importers:` (v5 and v6). Entries are either `name: 1.2.3_peer@x` (v5 inline) or a
+ * nested `specifier:` / `version: 1.2.3(peer@x)` pair (v6+).
+ */
+function pnpmLockedVersion(text, name, fromLock) {
+    // (an aliased entry also carries the installed package's version: `react-native-iap@12.16.2`)
+    const lines = text.split(/\r?\n/);
+    const importers = lines.findIndex((line) => /^importers:\s*$/.test(line));
+    let start;
+    let end;
+    let indent;
+    if (importers >= 0) {
+        const importer = lines.findIndex((line, index) => index > importers
+            && new RegExp(`^  ['"]?${escapeRegExp(fromLock || '.')}['"]?:\\s*$`).test(line));
+        if (importer < 0)
+            return undefined;
+        start = importer + 1;
+        end = lines.findIndex((line, index) => index > importer && /^ {0,2}\S/.test(line));
+        if (end < 0)
+            end = lines.length;
+        indent = 4;
+    }
+    else {
+        if (fromLock)
+            return undefined; // a single-project lockfile only describes its own directory
+        start = 0;
+        end = lines.length;
+        indent = 0;
+    }
+    const group = new RegExp(`^ {${indent}}(?:dependencies|devDependencies|optionalDependencies):\\s*$`);
+    const entry = new RegExp(`^ {${indent + 2}}['"]?${escapeRegExp(name)}['"]?:\\s*(.*?)\\s*$`);
+    let inGroup = false;
+    for (let index = start; index < end; index++) {
+        const line = lines[index];
+        if (!line.trim())
+            continue;
+        const lineIndent = line.match(/^ */)[0].length;
+        if (lineIndent <= indent)
+            inGroup = group.test(line);
+        if (!inGroup)
+            continue;
+        const match = entry.exec(line);
+        if (!match)
+            continue;
+        const values = match[1]
+            ? [match[1]]
+            : lines.slice(index + 1, index + 4).map((next) => next.match(/^\s+version:\s*(.*?)\s*$/)?.[1]).filter((value) => Boolean(value));
+        for (const raw of values) {
+            const value = raw.replace(/^['"]|['"]$/g, '');
+            const version = value.match(SEMVER_PREFIX)?.[1];
+            if (version)
+                return { version };
+            // pnpm writes an aliased dependency's version as `/@fork/pkg/1.2.3`, `@fork/pkg@1.2.3`, or `npm:@fork/pkg@1.2.3`.
+            const alias = value.match(/^(?:npm:|\/)?((?:@[^/@]+\/)?[^/@\s]+)[/@](\d+\.\d+\.\d+[^\s_('"]*)/);
+            if (alias)
+                return { alias: alias[1], version: alias[2] };
+        }
+    }
+    return undefined;
+}
+/** The version a lockfile in `lockDir` resolved for dependency `name` (declared as `declared`) of the package in `packageDir`. */
+export async function lockedPackageVersion(name, packageDir, lockDir, declared) {
+    const fromLock = path.relative(lockDir, packageDir).replace(/\\/g, '/');
+    const declaredAlias = aliasTarget(declared);
+    const npmLock = await readText(path.join(lockDir, 'package-lock.json'));
+    if (npmLock) {
+        try {
+            const lock = JSON.parse(npmLock);
+            const keys = [`${fromLock ? `${fromLock}/` : ''}node_modules/${name}`, `node_modules/${name}`];
+            for (const key of keys) {
+                const entry = lock.packages?.[key];
+                if (typeof entry?.version !== 'string')
+                    continue;
+                // An aliased install records the real package's name next to its version.
+                const installed = typeof entry.name === 'string' && entry.name !== name ? entry.name : declaredAlias;
+                return { version: entry.version, lockfile: 'package-lock.json', ...(installed ? { aliasOf: installed } : {}) };
+            }
+            const legacy = lock.dependencies?.[name]?.version;
+            if (typeof legacy === 'string') {
+                const legacyAlias = aliasTarget(legacy) ?? declaredAlias;
+                const version = legacy.replace(/^npm:(?:@[^/@]+\/)?[^@]+@/, '');
+                return { version, lockfile: 'package-lock.json', ...(legacyAlias ? { aliasOf: legacyAlias } : {}) };
+            }
+        }
+        catch {
+            // Malformed lockfile: fall through to the next source.
+        }
+    }
+    const pnpmLock = await readText(path.join(lockDir, 'pnpm-lock.yaml'));
+    if (pnpmLock) {
+        const locked = pnpmLockedVersion(pnpmLock, name, fromLock);
+        if (locked?.alias)
+            return { version: locked.version ?? '', lockfile: 'pnpm-lock.yaml', aliasOf: locked.alias };
+        if (locked?.version) {
+            return { version: locked.version, lockfile: 'pnpm-lock.yaml', ...(declaredAlias ? { aliasOf: declaredAlias } : {}) };
+        }
+    }
+    const yarnLock = await readText(path.join(lockDir, 'yarn.lock'));
+    if (yarnLock) {
+        const header = new RegExp(`(?:^|[\\s",])${escapeRegExp(name)}@(?:npm:)?${escapeRegExp(declared)}(?=["',:]|$)`);
+        const blocks = yarnLock.split(/\r?\n(?=\S)/);
+        for (const block of blocks) {
+            const [first] = block.split(/\r?\n/, 1);
+            if (!header.test(first))
+                continue;
+            const version = block.match(/^\s+version:?\s+"?(\d+\.\d+\.\d+[^\s"]*)/m)?.[1];
+            if (!version)
+                continue;
+            // Berry: `resolution: "@fork/pkg@npm:1.2.3"`; v1: `resolved "https://registry…/@fork/pkg/-/pkg-1.2.3.tgz"`.
+            const berry = block.match(/^\s+resolution:\s+"?((?:@[^/@"]+\/)?[^@"]+)@/m)?.[1];
+            const classic = block.match(/^\s+resolved\s+"?https?:\/\/[^"\s]*?\/((?:@[^/]+\/)?[^/]+)\/-\//m)?.[1];
+            const installed = [berry, classic].find((candidate) => candidate && decodeURIComponent(candidate) !== name);
+            const aliasOf = installed ? decodeURIComponent(installed) : declaredAlias;
+            return { version, lockfile: 'yarn.lock', ...(aliasOf ? { aliasOf } : {}) };
+        }
+    }
+    return undefined;
+}

package/dist/core/checks/release-doctor-render.js

@@ -3,7 +3,8 @@ const COPY = {
         title: 'Mimi Seed Release Doctor — 로그인 없는 출시 점검',
         platforms: '감지 플랫폼',
         summary: (blockers, warnings) => `결과: 블로커 ${blockers} · 경고 ${warnings}`,
-        labels: { blocker: '블로커', warning: '경고', info: '확인' },
+        // `확인` alone reads as "confirmed"; an undecided check must say it still needs checking.
+        labels: { blocker: '블로커', warning: '경고', info: '정보', unresolved: '확인 필요' },
         evidence: '근거',
         action: '조치',
         source: '출처',
@@ -15,26 +16,31 @@ const COPY = {
             '심사 제출과 단계적 출시 상태',
         ],
         ready: '로컬 검사에서 제출 차단 요인을 찾지 못했습니다.',
+        incomplete: (count, codes) => `블로커는 찾지 못했지만 로컬 검사가 끝나지 않았습니다: ${count}개 항목을 확정하지 못했습니다(${codes}). 위의 [확인 필요]·[경고] 항목을 직접 확인하기 전에는 제출 가능하다고 보지 마세요.`,
         partial: '이 결과는 저장소의 결정적 증거만 검사합니다. 스토어 상태는 연결 후 별도로 확인합니다.',
     },
     en: {
         title: 'Mimi Seed Release Doctor — no-login release check',
         platforms: 'Platforms',
         summary: (blockers, warnings) => `Result: ${blockers} blockers · ${warnings} warnings`,
-        labels: { blocker: 'BLOCKER', warning: 'WARNING', info: 'INFO' },
+        labels: { blocker: 'BLOCKER', warning: 'WARNING', info: 'INFO', unresolved: 'NEEDS CHECK' },
         evidence: 'Evidence',
         action: 'Action',
         source: 'Source',
         connected: 'Checked after connecting stores',
         connectedChecks: undefined,
         ready: 'No submission blocker was found by the local checks.',
+        incomplete: (count, codes) => `No blocker was found, but the local check is incomplete: ${count} item(s) could not be resolved (${codes}). Do not treat this as clear until you have checked the NEEDS CHECK and WARNING items above.`,
         partial: 'This report checks deterministic repository evidence only. Store state is checked separately after connection.',
     },
 };
-function renderFinding(finding, copy, lang) {
+function renderFinding(finding, copy, lang, unresolved) {
     const localized = lang === 'ko' ? finding.ko : undefined;
+    const label = finding.severity === 'info' && unresolved.has(finding.code)
+        ? copy.labels.unresolved
+        : copy.labels[finding.severity];
     const lines = [
-        `[${copy.labels[finding.severity]}] ${localized?.title ?? finding.title}`,
+        `[${label}] ${localized?.title ?? finding.title}`,
         `  ${localized?.detail ?? finding.detail}`,
     ];
     if (finding.file)
@@ -48,6 +54,8 @@ function renderFinding(finding, copy, lang) {
 }
 export function renderReleaseDoctor(report, lang) {
     const copy = COPY[lang];
+    // Reports from older versions (and mocks) may not carry `coverage.unresolved`.
+    const unresolved = new Set(report.coverage.unresolved ?? []);
     const lines = [
         '',
         copy.title,
@@ -57,9 +65,12 @@ export function renderReleaseDoctor(report, lang) {
         '',
     ];
     for (const finding of report.findings)
-        lines.push(...renderFinding(finding, copy, lang), '');
-    if (report.counts.blocker === 0)
-        lines.push(`✓ ${copy.ready}`, '');
+        lines.push(...renderFinding(finding, copy, lang, unresolved), '');
+    if (report.counts.blocker === 0) {
+        lines.push(unresolved.size > 0
+            ? `! ${copy.incomplete(unresolved.size, [...unresolved].join(', '))}`
+            : `✓ ${copy.ready}`, '');
+    }
     const connectedChecks = copy.connectedChecks ?? report.coverage.requiresStoreConnection;
     lines.push(copy.partial, '', `${copy.connected}:`, ...connectedChecks.map((item) => `  - ${item}`), '');
     return lines.join('\n');

package/dist/core/checks/release-doctor.d.ts

@@ -23,11 +23,56 @@ export interface ReleaseDoctorReport {
     };
     counts: Record<ReleaseDoctorSeverity, number>;
     findings: ReleaseDoctorFinding[];
+    /** Per judged Android app module: the targetSdk values proven, or why it is unresolved. */
+    targetSdkModules?: TargetSdkModuleVerdict[];
+    /**
+     * Every targetSdk token in the scanned Gradle scripts and how it was classified (the fail-closed net): an
+     * unrecognised in-scope token, or an unattributable one below the minimum, keeps the verdict from TARGET_SDK_OK.
+     */
+    targetSdkTokens?: TargetSdkToken[];
     coverage: {
         checked: string[];
+        /**
+         * Codes of findings for checks that ran but could not reach a verdict (a blocker could hide behind them). The
+         * report is not an all-clear while this is non-empty.
+         */
+        unresolved: string[];
         requiresStoreConnection: string[];
     };
 }
+/** How one judged module's targetSdk was resolved (also in the JSON report as `targetSdkModules`). */
+export interface TargetSdkModuleVerdict {
+    module: string;
+    /** Values the module was proven to use (several with flavors or inherited every-project settings). */
+    values: Array<{
+        value: number;
+        file: string;
+    }>;
+    /** False when any targetSdk assignment of the module could not be evaluated, or none was found. */
+    resolved: boolean;
+    /** Why the module is unresolved, as written in the build script. */
+    unresolved: string[];
+}
+/**
+ * One `targetSdk` / `targetSdkVersion` / `setTargetSdkVersion` token in a scanned script — the fail-closed net's
+ * inventory (in the JSON report as `targetSdkTokens`).
+ */
+export interface TargetSdkToken {
+    file: string;
+    line: number;
+    /**
+     * `assign`: sets targetSdk. `define`: defines an extra property or local of that name (`ext.targetSdkVersion = 36`,
+     * `def targetSdk = 36`). `read`: reads it on a right-hand side or as an argument. `other`: lint's or the test
+     * runner's own targetSdk. `unknown`: a shape the scanner does not model, which keeps the verdict from TARGET_SDK_OK.
+     */
+    kind: 'assign' | 'define' | 'read' | 'other' | 'unknown';
+    /** The value an `assign` token resolved to, when it did. */
+    value?: number;
+    /** Evaluated as part of a judged app module (its own scripts or its build root's every-project blocks). */
+    attributed: boolean;
+    /** Why the script is out of the net (`sample`, `library`, `specialized`, `template`, `outside`). */
+    excluded?: string;
+}
 export interface ReleaseDoctorScanOptions {
     /** Upper bound on source files read for FCM evidence (tests lower it). */
     maxSourceFiles?: number;