parche-cli 0.0.0-stage → 0.5.1

package/src/engine.js

@@ -0,0 +1,89 @@
+// Motor: recorre el repo, arma el inventario de APIs y corre los packs.
+import fs from 'node:fs';
+import path from 'node:path';
+import { loadPacks, transformFor, languageOf } from './packs.js';
+import { SKIP_DIRS, toPosix } from './paths.js';
+import { scanJs } from './inventory/js-scan.js';
+import { readManifests, buildInventory } from './inventory/index.js';
+import { buildContext } from './context.js';
+
+// JS/TS y PHP (codemods), WSDL (detección de esquemas viejos) y Python, C#, Java, Go, VB.NET (solo detección).
+const EXT = /\.(m?js|cjs|jsx|ts|tsx|php|wsdl|py|cs|java|go|vb)$/i;
+
+export function listFiles(dir) {
+  const out = [];
+  const walk = (d) => {
+    for (const e of fs.readdirSync(d, { withFileTypes: true })) {
+      if (e.isDirectory()) {
+        if (!SKIP_DIRS.has(e.name)) walk(path.join(d, e.name));
+      } else if (EXT.test(e.name) && !/\.d\.ts$/.test(e.name)) {
+        out.push(path.join(d, e.name));
+      }
+    }
+  };
+  walk(dir);
+  // Mismo orden en Windows y en Linux: se ordena por la ruta con "/".
+  return out.sort((a, b) => (toPosix(a) < toPosix(b) ? -1 : 1));
+}
+
+export function run(dir, { write = false, packIds = null, today } = {}) {
+  const root = path.resolve(dir);
+  const packs = loadPacks().filter((p) => !packIds || packIds.includes(p.id));
+  const manifests = readManifests(root);
+  const deps = { ...manifests.npm, ...manifests.composer };
+  const files = listFiles(root);
+  const rels = files.map((abs) => toPosix(path.relative(root, abs)));
+  // Lo que un archivo solo no sabe (versiones instaladas, si el repo ya usa el campo, WSDL viejos).
+  const context = buildContext(root, rels, manifests);
+  const findings = [];
+  const usages = [];
+  const fileScans = []; // inventario de cualquier API (nivel 1), por archivo
+  const changed = new Map(); // archivo relativo → [packs]
+
+  files.forEach((abs, i) => {
+    const rel = rels[i];
+    let source = fs.readFileSync(abs, 'utf8');
+    // El inventario se arma sobre el archivo original, antes de que un pack lo modifique.
+    if (languageOf(rel) === 'js') fileScans.push({ file: rel, scan: scanJs(source, rel) });
+    for (const pack of packs) {
+      const t = transformFor(pack.id, rel);
+      if (!t) continue;
+      let res;
+      try {
+        res = t({ source, file: rel, pack, today, context });
+      } catch (err) {
+        findings.push({ pack: pack.id, file: rel, line: null, status: 'needs-input', message: `Parche no pudo procesar este archivo: ${err.message}` });
+        continue;
+      }
+      findings.push(...res.findings);
+      usages.push(...res.usages.map((u) => ({ ...u, file: rel, pack: pack.id })));
+      if (res.output !== null && res.output !== source) {
+        source = res.output;
+        changed.set(rel, [...(changed.get(rel) || []), pack.id]);
+        if (write) fs.writeFileSync(abs, source);
+      }
+    }
+  });
+
+  const providers = {};
+  for (const u of usages) {
+    const p = (providers[u.provider] ||= { callSites: 0, ops: {}, files: new Set() });
+    p.callSites++;
+    p.ops[u.op] = (p.ops[u.op] || 0) + 1;
+    p.files.add(u.file);
+  }
+  const generatedAt = new Date().toISOString();
+  const inventory = {
+    ...buildInventory({ repo: path.basename(root), manifests, fileScans, packs }),
+    generatedAt,
+    // Campos anteriores a schemaVersion: lo que reportan los packs. Se mantienen por compatibilidad.
+    generated_at: generatedAt,
+    packages: Object.fromEntries(Object.entries(deps).filter(([name]) =>
+      packs.some((p) => (p.detect.packages || []).includes(name)))),
+    providers: Object.fromEntries(Object.entries(providers).map(([k, v]) => [k, { ...v, files: [...v.files] }])),
+    usages,
+  };
+  return { root, packs, context, inventory, findings, changed: [...changed.entries()].map(([file, packIds]) => ({ file, packs: packIds })) };
+}
+
+export const STATUS_ORDER = ['blocked', 'needs-input', 'needs-review', 'auto', 'detect-only'];

package/src/git.js

@@ -0,0 +1,85 @@
+import { execFileSync } from 'node:child_process';
+
+const git = (cwd, ...args) => execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+
+export function isRepo(cwd) {
+  try {
+    return git(cwd, 'rev-parse', '--is-inside-work-tree') === 'true';
+  } catch {
+    return false;
+  }
+}
+
+export function currentBranch(cwd) {
+  return git(cwd, 'rev-parse', '--abbrev-ref', 'HEAD');
+}
+
+export function isClean(cwd) {
+  return git(cwd, 'status', '--porcelain') === '';
+}
+
+export function checkoutNewBranch(cwd, name, base) {
+  try {
+    git(cwd, 'checkout', base);
+    git(cwd, 'branch', '-D', name);
+  } catch { /* la rama no existía */ }
+  git(cwd, 'checkout', '-b', name);
+}
+
+// Quién firma los commits de Parche. Nunca una dirección de un dominio que no controlamos: antes era
+// bot@parche.dev, y parche.dev lo tiene registrado otra persona. En orden:
+// 1. PARCHE_GIT_NAME y PARCHE_GIT_EMAIL, si están.
+// 2. La identidad de git de quien lo corre (en su compu, o la que configuró su workflow).
+// 3. En GitHub Actions sin identidad: el bot de Actions, el mismo que abre el PR con el GITHUB_TOKEN.
+// Si no hay ninguna, error: no se inventa un autor.
+export const ACTIONS_BOT = { name: 'github-actions[bot]', email: '41898282+github-actions[bot]@users.noreply.github.com' };
+
+export function commitIdentity(cwd, env = process.env) {
+  if (env.PARCHE_GIT_NAME && env.PARCHE_GIT_EMAIL) return { name: env.PARCHE_GIT_NAME, email: env.PARCHE_GIT_EMAIL };
+  const get = (key) => {
+    try {
+      return execFileSync('git', ['config', key], { cwd, env, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+    } catch { return ''; }
+  };
+  const name = get('user.name');
+  const email = get('user.email');
+  if (name && email) return { name, email };
+  if (env.GITHUB_ACTIONS === 'true') return ACTIONS_BOT;
+  throw new Error('No hay una identidad de git para firmar el commit: configurá `git config user.name` y `git config user.email`, o PARCHE_GIT_NAME y PARCHE_GIT_EMAIL.');
+}
+
+export function commitAll(cwd, message, env = process.env) {
+  const id = commitIdentity(cwd, env);
+  git(cwd, 'add', '-A');
+  git(cwd, '-c', `user.name=${id.name}`, '-c', `user.email=${id.email}`, 'commit', '-q', '-m', message);
+  return git(cwd, 'rev-parse', '--short', 'HEAD');
+}
+
+export function checkout(cwd, branch) {
+  git(cwd, 'checkout', '-q', branch);
+}
+
+export function remoteUrl(cwd, remote = 'origin') {
+  try {
+    return git(cwd, 'remote', 'get-url', remote);
+  } catch {
+    return null;
+  }
+}
+
+export const originUrl = (cwd) => remoteUrl(cwd, 'origin');
+
+export function push(cwd, branch, remote = 'origin') {
+  git(cwd, 'push', '-u', '--force', remote, branch);
+}
+
+// Descarta lo que Parche escribió en su rama (el árbol estaba limpio antes de empezar; .parche/ está excluido).
+export function discardChanges(cwd) {
+  git(cwd, 'reset', '--hard', '-q');
+}
+
+export function deleteBranch(cwd, name) {
+  try {
+    git(cwd, 'branch', '-D', name);
+  } catch { /* ya no existía */ }
+}

package/src/github.js

@@ -0,0 +1,22 @@
+// Apertura del PR por la API REST de GitHub (sin dependencias).
+export function parseGithubRemote(url) {
+  if (!url) return null;
+  const m = url.match(/github\.com[:/]([^/]+)\/([^/.]+?)(\.git)?$/);
+  return m ? { owner: m[1], repo: m[2] } : null;
+}
+
+export async function openPullRequest({ token, owner, repo, head, base, title, body, draft }) {
+  const res = await fetch(`https://api.github.com/repos/${owner}/${repo}/pulls`, {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: 'application/vnd.github+json',
+      'X-GitHub-Api-Version': '2022-11-28',
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify({ title, head, base, body, draft }),
+  });
+  const data = await res.json();
+  if (!res.ok) throw new Error(`GitHub respondió ${res.status}: ${data.message || JSON.stringify(data)}`);
+  return data.html_url;
+}

package/src/inventory/index.js

@@ -0,0 +1,133 @@
+// Inventario de cualquier API (nivel 1 del producto): junta las dependencias declaradas, lo que
+// encontró js-scan en cada archivo y lo que reportaron los packs, y arma .parche/inventory.json.
+// El esquema está documentado en docs/inventario.md; si cambia de forma incompatible, sube SCHEMA_VERSION.
+import fs from 'node:fs';
+import path from 'node:path';
+import { classifyPackage, providerForHost } from './known.js';
+import { findFiles } from '../paths.js';
+
+export const SCHEMA_VERSION = 1;
+const KIND_ORDER = { sdk: 0, http: 1, 'ai-model': 2 };
+
+const readJson = (p) => {
+  try {
+    return JSON.parse(fs.readFileSync(p, 'utf8'));
+  } catch {
+    return null;
+  }
+};
+
+// requirements.txt: "paquete==1.2", "paquete>=1", "paquete[extra]"; sin comentarios, -r, -e ni URLs.
+export function parseRequirements(text) {
+  const out = {};
+  for (const raw of text.split(/\r?\n/)) {
+    const line = raw.replace(/#.*$/, '').trim();
+    if (!line || line.startsWith('-') || /^[a-z]+:\/\//i.test(line)) continue;
+    const m = line.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)(\[[^\]]*\])?\s*(.*)$/);
+    if (m) out[m[1].toLowerCase()] = m[3].trim() || '*';
+  }
+  return out;
+}
+
+const MANIFEST_NAMES = new Set(['package.json', 'composer.json', 'requirements.txt']);
+
+// Todos los manifiestos del repo, no solo los de la raíz: los monorepos (packages/backend/package.json,
+// ms-billing/package.json) declaran ahí sus SDKs. Primero la raíz, después por profundidad.
+export function findManifests(root) {
+  return findFiles(root, (name) => MANIFEST_NAMES.has(name));
+}
+
+// Dependencias declaradas por ecosistema (si un paquete aparece en varios manifiestos, gana el más cercano a la raíz).
+export function readManifests(root) {
+  const deps = { npm: {}, composer: {}, pypi: {} };
+  const files = { npm: [], composer: [], pypi: [] };
+  const merge = (eco, entries, file) => {
+    files[eco].push(file);
+    for (const [name, version] of entries) if (!(name in deps[eco])) deps[eco][name] = version;
+  };
+  for (const rel of findManifests(root)) {
+    const abs = path.join(root, rel);
+    const name = path.posix.basename(rel);
+    if (name === 'package.json') {
+      const pkg = readJson(abs) || {};
+      merge('npm', Object.entries({ ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) }), rel);
+    } else if (name === 'composer.json') {
+      const c = readJson(abs) || {};
+      // fuera "php" y las extensiones "ext-*": no son paquetes
+      merge('composer', Object.entries({ ...(c.require || {}), ...(c['require-dev'] || {}) }).filter(([n]) => n.includes('/')), rel);
+    } else {
+      merge('pypi', Object.entries(parseRequirements(fs.readFileSync(abs, 'utf8'))), rel);
+    }
+  }
+  return { ...deps, files };
+}
+
+// fileScans: [{ file, scan }] con el resultado de scanJs; packs: los packs cargados.
+export function buildInventory({ repo, manifests, fileScans, packs }) {
+  const apis = new Map();
+  const add = (id, base) => {
+    if (!apis.has(id)) apis.set(id, { id, ...base, operations: new Map() });
+    return apis.get(id);
+  };
+  const addOp = (api, op, file, line) => {
+    const o = api.operations.get(op) || { op, count: 0, locations: [] };
+    o.count++;
+    o.locations.push({ file, line });
+    api.operations.set(op, o);
+  };
+  const packsFor = (pkg) => packs.filter((p) => (p.detect.packages || []).includes(pkg)).map((p) => p.id);
+
+  // Dependencias declaradas que son SDKs de una API (aunque todavía no se vean usadas).
+  for (const eco of ['npm', 'composer', 'pypi']) {
+    for (const [name, version] of Object.entries(manifests[eco] || {})) {
+      const c = classifyPackage(eco, name);
+      if (!c || c.kind !== 'sdk') continue;
+      add(`${eco}:${name}`, { kind: 'sdk', provider: c.provider, category: c.category, ecosystem: eco, package: name, version,
+        confidence: c.confidence, source: c.source, packs: packsFor(name) });
+    }
+  }
+
+  const unresolved = [];
+  for (const { file, scan } of fileScans) {
+    for (const u of scan.sdk) {
+      let api = apis.get(`npm:${u.pkg}`);
+      if (!api) {
+        const c = classifyPackage('npm', u.pkg);
+        if (!c || c.kind !== 'sdk') continue; // no es el cliente de una API (lodash, react...)
+        api = add(`npm:${u.pkg}`, { kind: 'sdk', provider: c.provider, category: c.category, ecosystem: 'npm', package: u.pkg,
+          version: null, confidence: c.confidence, source: c.source, packs: packsFor(u.pkg) });
+      }
+      addOp(api, u.op, file, u.line);
+    }
+    for (const h of scan.http) {
+      const known = providerForHost(h.host);
+      const api = add(`http:${h.host}`, { kind: 'http', provider: known?.provider || null, category: known?.category || null,
+        host: h.host, confidence: known ? 'alta' : 'media', source: known ? 'curated' : 'usage', packs: [] });
+      addOp(api, `${h.method} ${h.path}`, file, h.line);
+    }
+    for (const m of scan.models) {
+      const api = add(`ai:${m.provider}`, { kind: 'ai-model', provider: m.provider, category: 'ia', confidence: 'alta',
+        source: 'usage', packs: packs.some((p) => p.id === 'ai.model-retirements') ? ['ai.model-retirements'] : [] });
+      addOp(api, m.id, file, m.line);
+    }
+    for (const r of scan.unresolved) unresolved.push({ file, ...r });
+  }
+
+  const list = [...apis.values()].map((api) => {
+    const operations = [...api.operations.values()].sort((a, b) => b.count - a.count || a.op.localeCompare(b.op));
+    // Un SDK detectado por el nombre que además se ve usado deja de ser una corazonada.
+    const confidence = api.source === 'heuristic' && operations.length ? 'media' : api.confidence;
+    return { ...api, confidence, operations };
+  }).sort((a, b) => KIND_ORDER[a.kind] - KIND_ORDER[b.kind]
+    || (a.provider || a.package || a.host || '').localeCompare(b.provider || b.package || b.host || ''));
+
+  const { files: manifestFiles = {}, ...dependencies } = manifests;
+  return { schemaVersion: SCHEMA_VERSION, repo, apis: list, unresolved, dependencies, manifestFiles };
+}
+
+// Nombre corto para mostrar una API en el reporte y en la CLI.
+export function apiLabel(api) {
+  if (api.kind === 'sdk') return api.provider ? `${api.provider} · ${api.package}` : api.package;
+  if (api.kind === 'http') return api.provider ? `${api.provider} · ${api.host}` : api.host;
+  return `${api.provider} · modelos`;
+}

package/src/inventory/js-scan.js

@@ -0,0 +1,235 @@
+// Inventario de un archivo JS/TS: qué SDKs usa (y con qué operaciones), a qué hosts llama por HTTP
+// y qué modelos de IA nombra. Solo lee: usa @babel/parser directo (sin recast, no hay offsets que cuidar).
+//
+// Límite conocido: las variables se siguen por nombre en todo el archivo, sin scopes. Alcanza para el
+// inventario (aviso de nivel 1); un codemod que edita nunca debe apoyarse en esto.
+import { parse } from '@babel/parser';
+import { packageOf, isInternalHost } from './known.js';
+
+const HTTP_METHODS = ['get', 'post', 'put', 'patch', 'delete', 'head', 'options'];
+const FETCH_PACKAGES = new Set(['node-fetch', 'cross-fetch', 'isomorphic-fetch', 'undici']);
+const SKIP_KEYS = new Set(['loc', 'start', 'end', 'extra', 'range', 'comments', 'leadingComments', 'trailingComments', 'innerComments', 'tokens']);
+
+// IDs de modelos de IA. Prefijos inequívocos; la serie o1/o3/o4 de OpenAI solo cuenta si el archivo usa OpenAI.
+const MODEL_PATTERNS = [
+  [/^(gpt-(3\.5|4|4\.1|4o|4\.5|5)[\w.-]*|chatgpt-[\w.-]+|text-embedding-[\w-]+|dall-e-[23]|whisper-1|tts-1(-hd)?|gpt-image-[\w.-]+)$/, 'OpenAI'],
+  [/^o[1-9](-(mini|pro|preview|deep-research))?(-\d{4}-\d{2}-\d{2})?$/, 'OpenAI', { needs: 'openai' }],
+  [/^claude-[\w.-]+$/, 'Anthropic'],
+  [/^(gemini|gemma)-[\w.-]+$/, 'Google (Gemini)'],
+  [/^(mistral|mixtral|codestral|pixtral|ministral)-[\w.-]+$/, 'Mistral'],
+  [/^command-(r|a)[\w.-]*$/, 'Cohere'],
+];
+
+function parseJs(source, file) {
+  const lang = /\.tsx$/.test(file) ? ['typescript', 'jsx'] : /\.(ts|mts|cts)$/.test(file) ? ['typescript'] : ['jsx'];
+  const plugins = [...lang, 'decorators-legacy']; // NestJS, Angular, TypeORM
+  return parse(source, {
+    sourceType: 'unambiguous', plugins, errorRecovery: true,
+    allowAwaitOutsideFunction: true, allowReturnOutsideFunction: true, allowImportExportEverywhere: true,
+  });
+}
+
+function walk(node, visit, parent = null) {
+  if (!node || typeof node !== 'object') return;
+  if (Array.isArray(node)) { for (const n of node) walk(n, visit, parent); return; }
+  if (typeof node.type !== 'string') return;
+  visit(node, parent);
+  for (const [k, v] of Object.entries(node)) if (!SKIP_KEYS.has(k)) walk(v, visit, node);
+}
+
+const isRequire = (n) => n && n.type === 'CallExpression' && n.callee.type === 'Identifier' && n.callee.name === 'require'
+  && n.arguments[0] && n.arguments[0].type === 'StringLiteral';
+const propName = (n) => (n.type === 'Identifier' ? n.name : n.type === 'StringLiteral' ? n.value : null);
+
+// a.b.c(...) → { root: 'a', path: ['b', 'c'] }; null si la cadena no es estática.
+function chainOf(node) {
+  const path = [];
+  let cur = node;
+  while (cur && (cur.type === 'MemberExpression' || cur.type === 'OptionalMemberExpression')) {
+    const name = cur.computed ? (cur.property.type === 'StringLiteral' ? cur.property.value : null) : propName(cur.property);
+    if (name === null) return null;
+    path.unshift(name);
+    cur = cur.object;
+  }
+  if (cur && cur.type === 'Identifier') return { root: cur.name, path };
+  // this.afip.ElectronicBilling.createVoucher → raíz "this.afip" (cliente guardado en la clase)
+  if (cur && cur.type === 'ThisExpression' && path.length) return { root: `this.${path[0]}`, path: path.slice(1) };
+  return null;
+}
+
+export function scanJs(source, file) {
+  const result = { sdk: [], http: [], unresolved: [], models: [], imports: new Set() };
+  let ast;
+  try {
+    ast = parseJs(source, file);
+  } catch {
+    return result;
+  }
+  const bindings = new Map(); // nombre → { pkg, kind: 'module'|'named'|'client'|'http', imported?, prefix?, base? }
+  const constants = new Map(); // nombre → string resuelto (para armar URLs)
+  const bind = (name, info) => { if (name) bindings.set(name, info); };
+
+  // Texto estático de una expresión: literales, plantillas y constantes del archivo; '{}' donde no se sabe.
+  const staticText = (expr) => {
+    if (!expr) return null;
+    if (expr.type === 'StringLiteral') return expr.value;
+    if (expr.type === 'TemplateLiteral') {
+      return expr.quasis.map((q, i) => q.value.cooked + (i < expr.expressions.length ? (staticText(expr.expressions[i]) ?? '{}') : '')).join('');
+    }
+    if (expr.type === 'Identifier' && constants.has(expr.name)) return constants.get(expr.name);
+    if (expr.type === 'BinaryExpression' && expr.operator === '+') {
+      const l = staticText(expr.left);
+      const r = staticText(expr.right);
+      return (l ?? '{}') + (r ?? '{}');
+    }
+    return null;
+  };
+  const objProp = (obj, name) => obj && obj.type === 'ObjectExpression'
+    && obj.properties.find((p) => (p.type === 'ObjectProperty' || p.type === 'Property') && !p.computed && propName(p.key) === name);
+  const objString = (obj, name) => { const p = objProp(obj, name); return p ? staticText(p.value) : null; };
+
+  // Instancias: new Stripe(key), twilio(sid, token), new Payment(client), axios.create({ baseURL }).
+  // → binding nuevo, o null si la expresión no crea un cliente de un SDK conocido en el archivo.
+  const instanceBinding = (expr) => {
+    let init = expr;
+    if (init && init.type === 'AwaitExpression') init = init.argument;
+    if (!init || (init.type !== 'NewExpression' && init.type !== 'CallExpression')) return null;
+    if (init.callee.type === 'Identifier' && bindings.has(init.callee.name)) {
+      const b = bindings.get(init.callee.name);
+      if (b.kind === 'named') return { pkg: b.pkg, kind: 'client', prefix: b.imported };
+      return { pkg: b.pkg, kind: 'client', prefix: b.prefix || '' };
+    }
+    const ch = init.callee.type === 'MemberExpression' ? chainOf(init.callee) : null;
+    if (ch && bindings.has(ch.root)) {
+      const b = bindings.get(ch.root);
+      const last = ch.path[ch.path.length - 1];
+      if ((b.pkg === 'axios' && last === 'create') || (b.pkg === 'got' && last === 'extend')) {
+        const cfg = init.arguments[0];
+        return { pkg: b.pkg, kind: 'http', base: objString(cfg, 'baseURL') ?? objString(cfg, 'prefixUrl') };
+      }
+      if (init.type === 'NewExpression') return { pkg: b.pkg, kind: 'client', prefix: [b.prefix, ...ch.path].filter(Boolean).join('.') };
+    }
+    return null;
+  };
+
+  // 1) Imports, require, constantes e instancias (en orden de aparición).
+  walk(ast, (node) => {
+    // Cliente guardado en una clase: `private afip = new Afip(...)` o `this.afip = new Afip(...)` en el constructor.
+    if ((node.type === 'ClassProperty' || node.type === 'PropertyDefinition') && !node.computed && node.key.type === 'Identifier' && node.value) {
+      const b = instanceBinding(node.value);
+      if (b) bind(`this.${node.key.name}`, b);
+      return;
+    }
+    if (node.type === 'AssignmentExpression' && node.left.type === 'MemberExpression' && node.left.object.type === 'ThisExpression'
+      && !node.left.computed && node.left.property.type === 'Identifier') {
+      const b = instanceBinding(node.right);
+      if (b) bind(`this.${node.left.property.name}`, b);
+      return;
+    }
+    if (node.type === 'ImportDeclaration' && node.importKind !== 'type') {
+      const pkg = packageOf(node.source.value);
+      if (!pkg) return;
+      result.imports.add(pkg);
+      for (const s of node.specifiers) {
+        if (s.importKind === 'type') continue;
+        if (s.type === 'ImportSpecifier') bind(s.local.name, { pkg, kind: 'named', imported: propName(s.imported) });
+        else bind(s.local.name, { pkg, kind: 'module' });
+      }
+      return;
+    }
+    if (node.type !== 'VariableDeclarator' || !node.init) return;
+    let init = node.init;
+    if (init.type === 'AwaitExpression') init = init.argument;
+    const id = node.id;
+    // const BASE = 'https://...'
+    if (id.type === 'Identifier' && (init.type === 'StringLiteral' || init.type === 'TemplateLiteral' || init.type === 'BinaryExpression')) {
+      const t = staticText(init);
+      if (t !== null) constants.set(id.name, t);
+      return;
+    }
+    // require('x'), require('x').Y y require('x')(...)
+    if (isRequire(init) || (init.type === 'MemberExpression' && isRequire(init.object)) || (init.type === 'CallExpression' && isRequire(init.callee))) {
+      const req = isRequire(init) ? init : init.type === 'MemberExpression' ? init.object : init.callee;
+      const pkg = packageOf(req.arguments[0].value);
+      if (!pkg) return;
+      result.imports.add(pkg);
+      if (init.type === 'CallExpression' && init !== req) return bind(id.name, { pkg, kind: 'client', prefix: '' });
+      if (init.type === 'MemberExpression') return bind(id.name, { pkg, kind: 'named', imported: propName(init.property) });
+      if (id.type === 'Identifier') return bind(id.name, { pkg, kind: 'module' });
+      if (id.type === 'ObjectPattern') {
+        for (const p of id.properties) {
+          if (p.type === 'ObjectProperty' && p.value.type === 'Identifier') bind(p.value.name, { pkg, kind: 'named', imported: propName(p.key) });
+        }
+      }
+      return;
+    }
+    if (id.type !== 'Identifier') return;
+    const b = instanceBinding(init);
+    if (b) bind(id.name, b);
+  });
+
+  const usesOpenAI = result.imports.has('openai');
+
+  const recordHttp = (client, method, urlExpr, line, base = null) => {
+    let url = staticText(urlExpr);
+    if (url !== null && base && !/^https?:\/\//i.test(url)) url = base.replace(/\/+$/, '') + '/' + url.replace(/^\/+/, '');
+    if (url === null || url.startsWith('{}')) {
+      result.unresolved.push({ kind: 'http', client, line, reason: 'URL dinámica: no se puede saber a qué host va' });
+      return;
+    }
+    const m = url.match(/^https?:\/\/([^/?#{}]+)(\/[^?#]*)?/i);
+    if (!m) return; // ruta relativa: es el backend propio, no una API de terceros
+    // Sin el puerto, también cuando es dinámico: http://localhost:${PORT} → "localhost:" → "localhost".
+    const host = m[1].toLowerCase().replace(/:.*$/, '');
+    if (isInternalHost(host)) return;
+    result.http.push({ client, method: (method || 'GET').toUpperCase(), host, path: (m[2] || '/').replace(/\{\}[^/]*/g, '{}'), line });
+  };
+
+  // 2) Llamadas.
+  walk(ast, (node) => {
+    if (node.type === 'StringLiteral' || (node.type === 'TemplateLiteral' && node.expressions.length === 0)) {
+      const value = node.type === 'StringLiteral' ? node.value : node.quasis[0].value.cooked;
+      for (const [re, provider, opts] of MODEL_PATTERNS) {
+        if (re.test(value) && (!opts || (opts.needs === 'openai' && usesOpenAI))) {
+          result.models.push({ id: value, provider, line: node.loc.start.line });
+          break;
+        }
+      }
+      return;
+    }
+    if (node.type !== 'CallExpression' && node.type !== 'OptionalCallExpression') return;
+    const line = node.loc.start.line;
+    const callee = node.callee;
+    const [a0, a1] = node.arguments;
+
+    // fetch global, o importado de node-fetch / undici / cross-fetch
+    if (callee.type === 'Identifier') {
+      const b = bindings.get(callee.name);
+      if ((!b && callee.name === 'fetch') || (b && FETCH_PACKAGES.has(b.pkg) && (b.kind === 'module' || b.imported === 'fetch'))) {
+        return recordHttp(b ? b.pkg : 'fetch', objString(a1, 'method'), a0, line);
+      }
+      if (b && b.pkg === 'undici' && b.imported === 'request') return recordHttp('undici', objString(a1, 'method'), a0, line);
+      if (b && (b.pkg === 'axios' || b.pkg === 'got') && (b.kind === 'module' || b.kind === 'http')) {
+        if (a0 && a0.type === 'ObjectExpression') return recordHttp(b.pkg, objString(a0, 'method'), objProp(a0, 'url')?.value, line, objString(a0, 'baseURL') ?? b.base);
+        return recordHttp(b.pkg, objString(a1, 'method'), a0, line, b.base);
+      }
+      if (b && b.kind === 'named') result.sdk.push({ pkg: b.pkg, op: b.imported, line });
+      return;
+    }
+    const ch = chainOf(callee);
+    if (!ch || !bindings.has(ch.root)) return;
+    const b = bindings.get(ch.root);
+    const method = ch.path[ch.path.length - 1];
+    if (['axios', 'got', 'ky', 'superagent'].includes(b.pkg) || b.kind === 'http') {
+      if (ch.path.length === 1 && HTTP_METHODS.includes(method)) return recordHttp(b.pkg, method, a0, line, b.base);
+      if (ch.path.length === 1 && method === 'request' && a0 && a0.type === 'ObjectExpression') {
+        return recordHttp(b.pkg, objString(a0, 'method'), objProp(a0, 'url')?.value, line, objString(a0, 'baseURL') ?? b.base);
+      }
+      return;
+    }
+    if (FETCH_PACKAGES.has(b.pkg)) return;
+    const op = [b.kind === 'named' ? b.imported : b.prefix, ...ch.path].filter(Boolean).join('.');
+    if (op) result.sdk.push({ pkg: b.pkg, op, line });
+  });
+  return result;
+}

package/src/inventory/known.js

@@ -0,0 +1,60 @@
+// Qué es cada dependencia y cada host: SDK de una API, cliente HTTP o ninguna de las dos.
+// La fuente de verdad es data/known-sdks.json (datos, no código: se amplía sin tocar esto).
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+export const KNOWN = JSON.parse(fs.readFileSync(path.join(HERE, '..', '..', 'data', 'known-sdks.json'), 'utf8'));
+
+// Palabras que, en el nombre de un paquete, sugieren que es el cliente de una API.
+const NAME_HINT = /(^|[-_./@])(api|sdk|client)([-_./]|$)/i;
+
+// Clasifica un paquete de un ecosistema (npm, composer, pypi).
+// → { kind: 'sdk', provider, category, confidence, source } | { kind: 'http-client' } | null
+export function classifyPackage(ecosystem, name) {
+  const curated = KNOWN[ecosystem]?.[name];
+  if (curated) return { kind: 'sdk', ...curated, confidence: 'alta', source: 'curated' };
+  // Antes que los prefijos de familias: @aws-sdk/types es de la familia de AWS pero son solo tipos.
+  if (KNOWN.notApis.prefixes.some((p) => isFamily(name, p))) return null;
+  if (ecosystem === 'npm') {
+    for (const [prefix, info] of Object.entries(KNOWN.npmPrefixes)) {
+      if (name.startsWith(prefix)) return { kind: 'sdk', ...info, confidence: 'alta', source: 'curated' };
+    }
+  }
+  if ((KNOWN.httpClients[ecosystem] || []).includes(name)) return { kind: 'http-client' };
+  // Heurística: el nombre dice api/sdk/client. Confianza baja hasta que se vea usado (el inventario la sube).
+  if (NAME_HINT.test(name)) return { kind: 'sdk', provider: null, category: null, confidence: 'baja', source: 'heuristic' };
+  return null;
+}
+
+// ¿`name` es de la familia `p`? "@types/" y "babel-" son prefijos; "pg" es "pg" o "pg-*", pero no "pgsql"
+// (con nombres cortos como "ws", un prefijo suelto se llevaría puesto un "wsfe-sdk").
+function isFamily(name, p) {
+  if (p.endsWith('/') || p.endsWith('-')) return name.startsWith(p);
+  return name === p || name.startsWith(`${p}-`);
+}
+
+// Paquete de un import: 'openai/resources' → 'openai'; '@aws-sdk/client-s3/dist' → '@aws-sdk/client-s3'.
+export function packageOf(spec) {
+  if (!spec || spec.startsWith('.') || spec.startsWith('/') || spec.startsWith('node:')) return null;
+  const parts = spec.split('/');
+  return spec.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0];
+}
+
+// Proveedor de un host, por sufijo: 'sheets.googleapis.com' → Google APIs.
+export function providerForHost(host) {
+  if (!host) return null;
+  const h = host.toLowerCase();
+  for (const [known, info] of Object.entries(KNOWN.hosts)) {
+    if (h === known || h.endsWith(`.${known}`)) return info;
+  }
+  return null;
+}
+
+// Hosts que no son APIs de terceros: la propia máquina o la red local.
+export function isInternalHost(host) {
+  const h = (host || '').toLowerCase();
+  return !h || h === 'localhost' || h.endsWith('.localhost') || h.endsWith('.local') || h.endsWith('.internal')
+    || /^127\./.test(h) || h === '0.0.0.0' || h === '[::1]' || /^10\./.test(h) || /^192\.168\./.test(h);
+}

package/src/ledger.js

@@ -0,0 +1,16 @@
+// Registro append-only de eventos. En el producto real esto se sube (anonimizado) y es lo que
+// hace que la base de packs mejore: qué fixes se mergean, cuáles se editan y cuáles se rechazan.
+import fs from 'node:fs';
+import path from 'node:path';
+
+export function record(root, event) {
+  const dir = path.join(root, '.parche');
+  fs.mkdirSync(dir, { recursive: true });
+  fs.appendFileSync(path.join(dir, 'ledger.jsonl'), JSON.stringify({ at: new Date().toISOString(), ...event }) + '\n');
+}
+
+export function read(root) {
+  const f = path.join(root, '.parche', 'ledger.jsonl');
+  if (!fs.existsSync(f)) return [];
+  return fs.readFileSync(f, 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+}