shapi-cli 0.0.0-stage → 0.1.0

package/dist/index.js

@@ -0,0 +1,3026 @@
+// packages/cli/src/index.ts
+import { Command as Command2, CommanderError as CommanderError2, Option } from "commander";
+
+// packages/cli/src/fix.ts
+import { execFileSync as execFileSync3 } from "child_process";
+import { existsSync as existsSync4, mkdirSync as mkdirSync5, mkdtempSync as mkdtempSync3, readdirSync as readdirSync3, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import os3 from "os";
+import path12 from "path";
+
+// packages/core/src/providers.ts
+import { z } from "zod";
+
+// packages/core/providers.json
+var providers_default = [
+  {
+    id: "github",
+    name: "GitHub",
+    hosts: ["api.github.com", "uploads.github.com"],
+    sdkPackages: ["@octokit/rest", "@octokit/core", "octokit", "@octokit/action", "@actions/github"],
+    sdkMethods: {
+      "actions.createWorkflowDispatch": "POST /repos/{owner}/{repo}/actions/workflows/{workflow_id}/dispatches",
+      "actions.listWorkflowRuns": "GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs",
+      "actions.getWorkflowRun": "GET /repos/{owner}/{repo}/actions/runs/{run_id}",
+      "repos.get": "GET /repos/{owner}/{repo}",
+      "repos.getContent": "GET /repos/{owner}/{repo}/contents/{path}",
+      "repos.createDispatchEvent": "POST /repos/{owner}/{repo}/dispatches",
+      "pulls.create": "POST /repos/{owner}/{repo}/pulls",
+      "pulls.get": "GET /repos/{owner}/{repo}/pulls/{pull_number}",
+      "pulls.merge": "PUT /repos/{owner}/{repo}/pulls/{pull_number}/merge",
+      "issues.create": "POST /repos/{owner}/{repo}/issues",
+      "issues.createComment": "POST /repos/{owner}/{repo}/issues/{issue_number}/comments",
+      "checks.create": "POST /repos/{owner}/{repo}/check-runs"
+    },
+    docsUrl: "https://docs.github.com/en/rest",
+    changelogUrl: "https://github.blog/changelog/"
+  },
+  {
+    id: "stripe",
+    name: "Stripe",
+    hosts: ["api.stripe.com", "files.stripe.com"],
+    sdkPackages: ["stripe"],
+    sdkMethods: {
+      "customers.create": "POST /v1/customers",
+      "customers.retrieve": "GET /v1/customers/{id}",
+      "customers.update": "POST /v1/customers/{id}",
+      "customers.list": "GET /v1/customers",
+      "paymentIntents.create": "POST /v1/payment_intents",
+      "paymentIntents.retrieve": "GET /v1/payment_intents/{id}",
+      "paymentIntents.confirm": "POST /v1/payment_intents/{id}/confirm",
+      "subscriptions.create": "POST /v1/subscriptions",
+      "subscriptions.update": "POST /v1/subscriptions/{id}",
+      "invoices.create": "POST /v1/invoices",
+      "checkout.sessions.create": "POST /v1/checkout/sessions",
+      "refunds.create": "POST /v1/refunds"
+    },
+    docsUrl: "https://docs.stripe.com/api",
+    changelogUrl: "https://docs.stripe.com/changelog"
+  },
+  {
+    id: "twilio",
+    name: "Twilio",
+    hosts: ["api.twilio.com", "*.twilio.com"],
+    sdkPackages: ["twilio"],
+    sdkMethods: {
+      "messages.create": "POST /2010-04-01/Accounts/{AccountSid}/Messages.json",
+      "calls.create": "POST /2010-04-01/Accounts/{AccountSid}/Calls.json"
+    },
+    docsUrl: "https://www.twilio.com/docs/usage/api",
+    changelogUrl: "https://www.twilio.com/en-us/changelog"
+  },
+  {
+    id: "shopify",
+    name: "Shopify",
+    hosts: ["*.myshopify.com"],
+    sdkPackages: ["@shopify/shopify-api", "@shopify/admin-api-client", "shopify-api-node"],
+    docsUrl: "https://shopify.dev/docs/api/admin",
+    changelogUrl: "https://shopify.dev/changelog"
+  },
+  {
+    id: "quickbooks",
+    name: "QuickBooks Online",
+    hosts: ["quickbooks.api.intuit.com", "sandbox-quickbooks.api.intuit.com", "oauth.platform.intuit.com"],
+    sdkPackages: ["node-quickbooks", "intuit-oauth"],
+    docsUrl: "https://developer.intuit.com/app/developer/qbo/docs/api/accounting/all-entities/account",
+    changelogUrl: "https://blogs.intuit.com/category/intuit-developer/"
+  },
+  {
+    id: "xero",
+    name: "Xero",
+    hosts: ["api.xero.com", "identity.xero.com", "login.xero.com"],
+    sdkPackages: ["xero-node"],
+    docsUrl: "https://developer.xero.com/documentation/api/accounting/overview",
+    changelogUrl: "https://developer.xero.com/changelog"
+  },
+  {
+    id: "hubspot",
+    name: "HubSpot",
+    hosts: ["api.hubapi.com", "api.hubspot.com"],
+    sdkPackages: ["@hubspot/api-client"],
+    docsUrl: "https://developers.hubspot.com/docs/api/overview",
+    changelogUrl: "https://developers.hubspot.com/changelog"
+  },
+  {
+    id: "slack",
+    name: "Slack",
+    hosts: ["slack.com", "hooks.slack.com"],
+    sdkPackages: ["@slack/web-api", "@slack/bolt", "@slack/webhook"],
+    sdkMethods: {
+      "chat.postMessage": "POST /api/chat.postMessage",
+      "chat.update": "POST /api/chat.update",
+      "conversations.list": "POST /api/conversations.list",
+      "conversations.history": "POST /api/conversations.history",
+      "users.info": "POST /api/users.info",
+      "files.uploadV2": "POST /api/files.uploadV2"
+    },
+    docsUrl: "https://api.slack.com/methods",
+    changelogUrl: "https://api.slack.com/changelog"
+  },
+  {
+    id: "openai",
+    name: "OpenAI",
+    hosts: ["api.openai.com"],
+    sdkPackages: ["openai"],
+    sdkMethods: {
+      "chat.completions.create": "POST /v1/chat/completions",
+      "responses.create": "POST /v1/responses",
+      "embeddings.create": "POST /v1/embeddings",
+      "images.generate": "POST /v1/images/generations",
+      "beta.assistants.create": "POST /v1/assistants",
+      "beta.threads.create": "POST /v1/threads",
+      "beta.threads.runs.create": "POST /v1/threads/{thread_id}/runs",
+      "files.create": "POST /v1/files"
+    },
+    docsUrl: "https://platform.openai.com/docs/api-reference",
+    changelogUrl: "https://platform.openai.com/docs/changelog"
+  },
+  {
+    id: "anthropic",
+    name: "Anthropic",
+    hosts: ["api.anthropic.com"],
+    sdkPackages: ["@anthropic-ai/sdk"],
+    sdkMethods: {
+      "messages.create": "POST /v1/messages",
+      "messages.stream": "POST /v1/messages",
+      "messages.countTokens": "POST /v1/messages/count_tokens",
+      "models.list": "GET /v1/models"
+    },
+    docsUrl: "https://docs.claude.com/en/api",
+    changelogUrl: "https://docs.claude.com/en/release-notes/api"
+  },
+  {
+    id: "salesforce",
+    name: "Salesforce",
+    hosts: ["*.salesforce.com", "*.force.com"],
+    sdkPackages: ["jsforce", "@jsforce/jsforce-node"],
+    docsUrl: "https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/",
+    changelogUrl: "https://help.salesforce.com/s/articleView?id=release-notes.salesforce_release_notes.htm"
+  },
+  {
+    id: "zendesk",
+    name: "Zendesk",
+    hosts: ["*.zendesk.com"],
+    sdkPackages: ["node-zendesk"],
+    docsUrl: "https://developer.zendesk.com/api-reference/",
+    changelogUrl: "https://developer.zendesk.com/api-reference/changelog/changelog/"
+  },
+  {
+    id: "intercom",
+    name: "Intercom",
+    hosts: ["api.intercom.io", "api.eu.intercom.io", "api.au.intercom.io"],
+    sdkPackages: ["intercom-client"],
+    docsUrl: "https://developers.intercom.com/docs/references/rest-api/api.intercom.io",
+    changelogUrl: "https://developers.intercom.com/docs/build-an-integration/learn-more/rest-apis/api-changelog"
+  },
+  {
+    id: "sendgrid",
+    name: "SendGrid",
+    hosts: ["api.sendgrid.com"],
+    sdkPackages: ["@sendgrid/mail", "@sendgrid/client"],
+    sdkMethods: {
+      send: "POST /v3/mail/send"
+    },
+    docsUrl: "https://www.twilio.com/docs/sendgrid/api-reference"
+  },
+  {
+    id: "mailchimp",
+    name: "Mailchimp",
+    hosts: ["*.api.mailchimp.com"],
+    sdkPackages: ["@mailchimp/mailchimp_marketing", "@mailchimp/mailchimp_transactional"],
+    docsUrl: "https://mailchimp.com/developer/marketing/api/"
+  },
+  {
+    id: "plaid",
+    name: "Plaid",
+    hosts: ["production.plaid.com", "sandbox.plaid.com", "development.plaid.com"],
+    sdkPackages: ["plaid"],
+    docsUrl: "https://plaid.com/docs/api/",
+    changelogUrl: "https://plaid.com/docs/changelog/"
+  },
+  {
+    id: "square",
+    name: "Square",
+    hosts: ["connect.squareup.com", "connect.squareupsandbox.com"],
+    sdkPackages: ["square"],
+    docsUrl: "https://developer.squareup.com/reference/square",
+    changelogUrl: "https://developer.squareup.com/docs/changelog/connect"
+  },
+  {
+    id: "paypal",
+    name: "PayPal",
+    hosts: ["api-m.paypal.com", "api-m.sandbox.paypal.com", "api.paypal.com", "api.sandbox.paypal.com"],
+    sdkPackages: ["@paypal/paypal-server-sdk", "@paypal/checkout-server-sdk"],
+    docsUrl: "https://developer.paypal.com/api/rest/"
+  },
+  {
+    id: "google-gemini",
+    name: "Google Gemini API",
+    hosts: ["generativelanguage.googleapis.com"],
+    sdkPackages: ["@google/genai", "@google/generative-ai"],
+    docsUrl: "https://ai.google.dev/api",
+    changelogUrl: "https://ai.google.dev/gemini-api/docs/changelog"
+  },
+  {
+    id: "google",
+    name: "Google APIs",
+    hosts: ["*.googleapis.com"],
+    sdkPackages: ["googleapis"],
+    docsUrl: "https://developers.google.com/apis-explorer"
+  },
+  {
+    id: "microsoft-graph",
+    name: "Microsoft Graph",
+    hosts: ["graph.microsoft.com"],
+    sdkPackages: ["@microsoft/microsoft-graph-client", "@microsoft/msgraph-sdk"],
+    docsUrl: "https://learn.microsoft.com/en-us/graph/api/overview",
+    changelogUrl: "https://developer.microsoft.com/en-us/graph/changelog"
+  },
+  {
+    id: "meta-graph",
+    name: "Meta Graph API",
+    hosts: ["graph.facebook.com", "graph.instagram.com"],
+    sdkPackages: ["facebook-nodejs-business-sdk"],
+    docsUrl: "https://developers.facebook.com/docs/graph-api",
+    changelogUrl: "https://developers.facebook.com/docs/graph-api/changelog"
+  },
+  {
+    id: "x",
+    name: "X (Twitter)",
+    hosts: ["api.x.com", "api.twitter.com", "upload.twitter.com"],
+    sdkPackages: ["twitter-api-v2"],
+    docsUrl: "https://docs.x.com/x-api",
+    changelogUrl: "https://docs.x.com/changelog"
+  },
+  {
+    id: "reddit",
+    name: "Reddit",
+    hosts: ["reddit.com", "www.reddit.com", "oauth.reddit.com", "old.reddit.com"],
+    sdkPackages: ["snoowrap"],
+    docsUrl: "https://www.reddit.com/dev/api/"
+  },
+  {
+    id: "linkedin",
+    name: "LinkedIn",
+    hosts: ["api.linkedin.com"],
+    sdkPackages: ["linkedin-api-client"],
+    docsUrl: "https://learn.microsoft.com/en-us/linkedin/",
+    changelogUrl: "https://learn.microsoft.com/en-us/linkedin/marketing/integrations/recent-changes"
+  },
+  {
+    id: "notion",
+    name: "Notion",
+    hosts: ["api.notion.com"],
+    sdkPackages: ["@notionhq/client"],
+    docsUrl: "https://developers.notion.com/reference",
+    changelogUrl: "https://developers.notion.com/page/changelog"
+  },
+  {
+    id: "airtable",
+    name: "Airtable",
+    hosts: ["api.airtable.com"],
+    sdkPackages: ["airtable"],
+    docsUrl: "https://airtable.com/developers/web/api/introduction"
+  },
+  {
+    id: "atlassian",
+    name: "Atlassian (Jira, Confluence)",
+    hosts: ["*.atlassian.net", "api.atlassian.com"],
+    sdkPackages: ["jira.js", "jira-client", "confluence.js"],
+    docsUrl: "https://developer.atlassian.com/cloud/jira/platform/rest/v3/",
+    changelogUrl: "https://developer.atlassian.com/changelog/"
+  },
+  {
+    id: "linear",
+    name: "Linear",
+    hosts: ["api.linear.app"],
+    sdkPackages: ["@linear/sdk"],
+    docsUrl: "https://linear.app/developers"
+  },
+  {
+    id: "discord",
+    name: "Discord",
+    hosts: ["discord.com", "discordapp.com"],
+    sdkPackages: ["discord.js", "@discordjs/rest"],
+    docsUrl: "https://discord.com/developers/docs/reference",
+    changelogUrl: "https://discord.com/developers/docs/change-log"
+  },
+  {
+    id: "zoom",
+    name: "Zoom",
+    hosts: ["api.zoom.us", "zoom.us"],
+    sdkPackages: [],
+    docsUrl: "https://developers.zoom.us/docs/api/",
+    changelogUrl: "https://developers.zoom.us/changelog/"
+  },
+  {
+    id: "dropbox",
+    name: "Dropbox",
+    hosts: ["api.dropboxapi.com", "content.dropboxapi.com"],
+    sdkPackages: ["dropbox"],
+    docsUrl: "https://www.dropbox.com/developers/documentation/http/documentation"
+  },
+  {
+    id: "pinterest",
+    name: "Pinterest",
+    hosts: ["api.pinterest.com"],
+    sdkPackages: [],
+    docsUrl: "https://developers.pinterest.com/docs/api/v5/",
+    changelogUrl: "https://developers.pinterest.com/docs/getting-started/changelog/"
+  },
+  {
+    id: "resend",
+    name: "Resend",
+    hosts: ["api.resend.com"],
+    sdkPackages: ["resend"],
+    docsUrl: "https://resend.com/docs/api-reference/introduction"
+  },
+  {
+    id: "cloudflare",
+    name: "Cloudflare",
+    hosts: ["api.cloudflare.com"],
+    sdkPackages: ["cloudflare"],
+    docsUrl: "https://developers.cloudflare.com/api/",
+    changelogUrl: "https://developers.cloudflare.com/changelog/"
+  }
+];
+
+// packages/core/src/providers.ts
+var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
+var EndpointRefSchema = z.string().regex(/^(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS) \/\S*$/);
+var ProviderSchema = z.object({
+  id: z.string().regex(/^[a-z0-9-]+$/),
+  name: z.string().min(1),
+  /** Exact hostnames, or "*.example.com" for any subdomain of example.com. */
+  hosts: z.array(z.string().regex(/^(\*\.)?[a-z0-9.-]+$/)).min(1),
+  /** npm packages that are this provider's SDKs. */
+  sdkPackages: z.array(z.string().min(1)),
+  /** SDK method chain (after the client, without a leading "rest.") to the HTTP endpoint it calls. */
+  sdkMethods: z.record(z.string(), EndpointRefSchema).optional(),
+  docsUrl: z.url(),
+  changelogUrl: z.url().optional()
+});
+var ProviderRegistrySchema = z.array(ProviderSchema).refine((ps) => new Set(ps.map((p) => p.id)).size === ps.length, "provider ids must be unique");
+var cached;
+function loadProviders() {
+  cached ??= ProviderRegistrySchema.parse(providers_default);
+  return cached;
+}
+function providerForHost(host) {
+  const h = host.toLowerCase().replace(/:\d+$/, "");
+  let best;
+  for (const provider of loadProviders()) {
+    for (const pattern of provider.hosts) {
+      let score = -1;
+      if (pattern === h) score = 1e4;
+      else if (pattern.startsWith("*.") && h.endsWith(pattern.slice(1))) score = pattern.length;
+      if (score > (best?.score ?? -1)) best = { provider, score };
+    }
+  }
+  return best?.provider;
+}
+function providerForPackage(name) {
+  return loadProviders().find((p) => p.sdkPackages.includes(name));
+}
+function sdkEndpoint(provider, chain) {
+  const methods = provider.sdkMethods ?? {};
+  const key = chain.replace(/^rest\./, "");
+  const ref = methods[key];
+  if (!ref) return void 0;
+  const [method, path13] = ref.split(" ");
+  return { method, path: path13 };
+}
+
+// packages/core/src/lockfile.ts
+import { createHash } from "crypto";
+import { mkdirSync, writeFileSync } from "fs";
+import path from "path";
+import { z as z2 } from "zod";
+var NameValueSchema = z2.object({
+  name: z2.string(),
+  /** Statically known value, with unknown parts as {name}; null when unknown. */
+  value: z2.string().nullable()
+});
+var SurfaceSchema = z2.object({
+  /** Response body field paths read, dot-separated; array elements as "[]". */
+  fields: z2.array(z2.string()),
+  /** Status codes the code compares against. */
+  statusCodes: z2.array(z2.number().int()),
+  /** Branches on `response.ok`. */
+  checksOk: z2.boolean(),
+  /** String values response fields are compared against. */
+  enums: z2.array(z2.object({ field: z2.string(), values: z2.array(z2.string()) })),
+  /** Request headers set, names lowercased (API version pins live here). */
+  headers: z2.array(NameValueSchema),
+  /** Request query parameters. */
+  query: z2.array(NameValueSchema),
+  /** Response headers read, names lowercased. */
+  responseHeaders: z2.array(z2.string())
+});
+var CallSiteSchema = z2.object({
+  /** Repo-relative POSIX path. */
+  file: z2.string(),
+  line: z2.number().int().positive(),
+  column: z2.number().int().positive(),
+  provider: z2.string().nullable(),
+  kind: z2.enum(["http", "sdk"]),
+  /** HTTP library (fetch, axios, got, undici, ky, node-fetch) or SDK package name. */
+  client: z2.string(),
+  /** SDK method chain, for example "rest.actions.createWorkflowDispatch". */
+  operation: z2.string().optional(),
+  method: z2.enum(HTTP_METHODS).nullable(),
+  host: z2.string().nullable(),
+  /** Path with dynamic segments as {name} or {}, query string removed. */
+  endpoint: z2.string().nullable(),
+  /** True when provider, method and endpoint are all known. */
+  resolved: z2.boolean(),
+  surface: SurfaceSchema
+});
+var LockedCallSiteSchema = z2.object({ id: z2.string().regex(/^[0-9a-f]{12}$/) }).extend(CallSiteSchema.shape);
+var ApiLockSchema = z2.object({
+  lockfileVersion: z2.literal(1),
+  generator: z2.string(),
+  providers: z2.array(
+    z2.object({
+      id: z2.string(),
+      callSites: z2.number().int().nonnegative(),
+      /** SDK packages in package.json that point at this provider. */
+      declaredBy: z2.array(z2.string())
+    })
+  ),
+  callSites: z2.array(LockedCallSiteSchema)
+});
+var LOCKFILE_VERSION = 1;
+function callSiteId(site) {
+  return createHash("sha256").update(`${site.file}:${site.line}:${site.column}:${site.method ?? "?"}:${site.endpoint ?? "?"}`).digest("hex").slice(0, 12);
+}
+function createApiLock(input, generator) {
+  const callSites = [...input.callSites].sort((a, b) => cmp(a.file, b.file) || a.line - b.line || a.column - b.column).map((site) => ({ id: callSiteId(site), ...site }));
+  const providers = /* @__PURE__ */ new Map();
+  const entry = (id) => {
+    let e = providers.get(id);
+    if (!e) providers.set(id, e = { callSites: 0, declaredBy: /* @__PURE__ */ new Set() });
+    return e;
+  };
+  for (const site of callSites) if (site.provider) entry(site.provider).callSites++;
+  for (const d of input.declared) entry(d.provider).declaredBy.add(d.package);
+  return ApiLockSchema.parse({
+    lockfileVersion: LOCKFILE_VERSION,
+    generator,
+    providers: [...providers].sort(([a], [b]) => cmp(a, b)).map(([id, e]) => ({ id, callSites: e.callSites, declaredBy: [...e.declaredBy].sort() })),
+    callSites
+  });
+}
+function serializeApiLock(lock) {
+  return JSON.stringify(ApiLockSchema.parse(lock), null, 2) + "\n";
+}
+function writeApiLock(file, lock) {
+  mkdirSync(path.dirname(path.resolve(file)), { recursive: true });
+  writeFileSync(file, serializeApiLock(lock));
+}
+function cmp(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
+// packages/core/src/advisory.ts
+import { readdirSync, readFileSync } from "fs";
+import path2 from "path";
+import { z as z3 } from "zod";
+var CHANGE_CLASSES = [
+  "status-code",
+  "field-rename",
+  "enum-added",
+  "required-field",
+  "version-sunset",
+  "scope-change",
+  "auth"
+];
+var SEVERITIES = ["critical", "high", "medium", "low"];
+var IsoDate = z3.iso.date();
+var EndpointPatternSchema = z3.object({
+  method: z3.union([z3.enum(HTTP_METHODS), z3.literal("*")]),
+  path: z3.string().startsWith("/"),
+  /** Limit to these hosts (for providers whose hosts behave differently). */
+  hosts: z3.array(z3.string()).optional()
+});
+var TriggerSchema = z3.object({
+  /** Affected when the code compares the status against one of these (the old codes). */
+  statusCodes: z3.array(z3.number().int()).optional(),
+  /**
+   * The codes the provider answers with now. Code that already compares
+   * against all of them handles the change and is not affected.
+   */
+  newStatusCodes: z3.array(z3.number().int()).optional(),
+  /** Affected when the code reads one of these body fields (or a field beneath it). */
+  fields: z3.array(z3.string()).optional(),
+  /** Affected when the code compares this field against string values. */
+  enums: z3.array(z3.object({ field: z3.string() })).optional(),
+  /** Affected when the request sets this header (optionally to one of these values). */
+  headers: z3.array(z3.object({ name: z3.string(), values: z3.array(z3.string()).optional() })).optional(),
+  /** Affected when the request sets this query parameter (optionally to a number below `below`). */
+  query: z3.array(z3.object({ name: z3.string(), below: z3.number().optional() })).optional(),
+  /** Every call to the endpoint is affected (sunsets, auth and scope changes). */
+  any: z3.boolean().optional()
+}).refine((t) => Object.values(t).some((v) => v !== void 0 && v !== false), "trigger needs at least one condition");
+var AdvisorySchema = z3.object({
+  id: z3.string().regex(/^[a-z0-9-]+$/),
+  provider: z3.string(),
+  title: z3.string().min(1),
+  summary: z3.string().min(1),
+  endpoint: EndpointPatternSchema,
+  changeClass: z3.enum(CHANGE_CLASSES),
+  trigger: TriggerSchema,
+  /** When the changed behavior was first seen in the wild. */
+  firstObserved: IsoDate.nullable(),
+  /** The provider's own notice, if there was one. */
+  publishedNotice: z3.object({ date: IsoDate.nullable(), url: z3.url() }).nullable(),
+  /** When the change takes (or took) effect. */
+  effectiveDate: IsoDate,
+  severity: z3.enum(SEVERITIES),
+  migrationNote: z3.string().min(1),
+  recipeId: z3.string().optional(),
+  sources: z3.array(z3.url()).min(1),
+  /** "verified": checked against a primary or two independent sources. "unverified": secondary reports only. */
+  status: z3.enum(["verified", "unverified"]),
+  /** Observations behind a machine-drafted advisory: what SHAPI saw before and after the change. */
+  evidence: z3.object({
+    source: z3.string(),
+    before: z3.object({ observedAt: z3.iso.datetime(), status: z3.number().int(), shapeHash: z3.string() }),
+    after: z3.object({ observedAt: z3.iso.datetime(), status: z3.number().int(), shapeHash: z3.string() }),
+    changes: z3.array(z3.string())
+  }).optional()
+});
+function loadAdvisories(dir) {
+  const advisories = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const name of readdirSync(dir).filter((f) => f.endsWith(".json")).sort()) {
+    const file = path2.join(dir, name);
+    const parsed = AdvisorySchema.safeParse(JSON.parse(readFileSync(file, "utf8")));
+    if (!parsed.success) throw new Error(`invalid advisory ${name}: ${z3.prettifyError(parsed.error)}`);
+    const advisory = parsed.data;
+    if (`${advisory.id}.json` !== name) throw new Error(`advisory ${name} must be named ${advisory.id}.json`);
+    if (seen.has(advisory.id)) throw new Error(`duplicate advisory id ${advisory.id}`);
+    seen.add(advisory.id);
+    advisories.push(advisory);
+  }
+  return advisories.sort((a, b) => a.id < b.id ? -1 : 1);
+}
+var SEVERITY_RANK = { critical: 0, high: 1, medium: 2, low: 3 };
+
+// packages/core/src/matcher.ts
+var DAY_MS = 864e5;
+function matchAdvisories(lock, advisories, options = {}) {
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const horizon = options.horizonDays ?? 90;
+  const affected = [];
+  const exposed = [];
+  const hitsPerAdvisory = /* @__PURE__ */ new Map();
+  for (const advisory of advisories) {
+    for (const callSite of lock.callSites) {
+      if (!endpointMatches(callSite, advisory)) continue;
+      hitsPerAdvisory.set(advisory.id, (hitsPerAdvisory.get(advisory.id) ?? 0) + 1);
+      const reasons = triggerReasons(callSite, advisory.trigger);
+      if (reasons.length > 0) affected.push({ advisory, callSite, reasons });
+      else exposed.push({ advisory, callSite, reasons: [`calls ${describe(callSite)} but does not depend on the changed behavior`] });
+    }
+  }
+  const present = new Set(lock.providers.map((p) => p.id));
+  const today = Math.floor(now.getTime() / DAY_MS) * DAY_MS;
+  const upcoming = advisories.map((advisory) => ({
+    advisory,
+    daysUntil: Math.round((Date.parse(advisory.effectiveDate) - today) / DAY_MS),
+    callSites: hitsPerAdvisory.get(advisory.id) ?? 0
+  })).filter((u) => present.has(u.advisory.provider) && u.daysUntil >= 0 && u.daysUntil <= horizon).sort((a, b) => a.daysUntil - b.daysUntil || cmp2(a.advisory.id, b.advisory.id));
+  return { affected: affected.sort(byFinding), exposed: exposed.sort(byFinding), upcoming };
+}
+function endpointMatches(site, advisory) {
+  const pattern = advisory.endpoint;
+  if (site.provider !== advisory.provider || site.endpoint === null) return false;
+  if (pattern.method !== "*" && site.method !== pattern.method) return false;
+  if (pattern.hosts && !(site.host && pattern.hosts.includes(site.host))) return false;
+  return pathMatches(site.endpoint, pattern);
+}
+function pathMatches(endpoint, pattern) {
+  const sample = endpoint.replace(/\{[^}]*\}/g, "\0");
+  let re = "";
+  const src = pattern.path;
+  for (let i = 0; i < src.length; ) {
+    if (src.startsWith("/**", i)) {
+      re += "(?:/.*)?";
+      i += 3;
+    } else if (src.startsWith("**", i)) {
+      re += ".*";
+      i += 2;
+    } else if (src[i] === "*") {
+      re += "[^/]*";
+      i += 1;
+    } else if (src[i] === "{") {
+      const end = src.indexOf("}", i);
+      re += "[^/]+";
+      i = end < 0 ? src.length : end + 1;
+    } else {
+      re += src[i].replace(/[.+?^$()|[\]\\]/g, "\\$&");
+      i += 1;
+    }
+  }
+  return new RegExp(`^${re}/?$`).test(sample);
+}
+function triggerReasons(site, trigger) {
+  const s = site.surface;
+  const reasons = [];
+  const handlesNew = (trigger.newStatusCodes ?? []).length > 0 && trigger.newStatusCodes.every((c) => s.statusCodes.includes(c));
+  for (const code of trigger.statusCodes ?? []) {
+    if (s.statusCodes.includes(code) && !handlesNew) reasons.push(`compares the response status to ${code}`);
+  }
+  for (const field of trigger.fields ?? []) {
+    const read = s.fields.filter((f) => f === field || f.startsWith(`${field}.`) || f.startsWith(`${field}[]`));
+    if (read.length) reasons.push(`reads ${read.join(", ")}`);
+  }
+  for (const { field } of trigger.enums ?? []) {
+    const e = s.enums.find((x) => x.field === field);
+    if (e) reasons.push(`compares ${field} to ${e.values.map((v) => JSON.stringify(v)).join(", ")}`);
+  }
+  for (const h of trigger.headers ?? []) {
+    const set = s.headers.find((x) => x.name === h.name.toLowerCase());
+    if (set && (!h.values || set.value !== null && h.values.includes(set.value))) reasons.push(`sends ${set.name}: ${set.value ?? "(dynamic)"}`);
+  }
+  for (const q of trigger.query ?? []) {
+    const p = s.query.find((x) => x.name === q.name);
+    if (!p) continue;
+    if (q.below === void 0) reasons.push(`sends ${p.name}=${p.value ?? "(dynamic)"}`);
+    else if (p.value !== null && Number(p.value) < q.below) reasons.push(`sends ${p.name}=${p.value} (below ${q.below})`);
+  }
+  if (trigger.any) reasons.push(`calls ${describe(site)}`);
+  return reasons;
+}
+function describe(site) {
+  return `${site.method ?? "?"} ${site.endpoint ?? "?"}`;
+}
+function byFinding(a, b) {
+  return SEVERITY_RANK[a.advisory.severity] - SEVERITY_RANK[b.advisory.severity] || cmp2(a.callSite.file, b.callSite.file) || a.callSite.line - b.callSite.line || cmp2(a.advisory.id, b.advisory.id);
+}
+function cmp2(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
+// packages/extractor/src/index.ts
+import path4 from "path";
+import { readFileSync as readFileSync3 } from "fs";
+import { Project, ScriptKind } from "ts-morph";
+
+// packages/extractor/src/callsites.ts
+import { Node, SyntaxKind } from "ts-morph";
+function emptySurface() {
+  return { fields: [], statusCodes: [], checksOk: false, enums: [], headers: [], query: [], responseHeaders: [] };
+}
+var HTTP_MODULES = {
+  "node-fetch": "node-fetch",
+  "cross-fetch": "node-fetch",
+  "isomorphic-fetch": "node-fetch",
+  axios: "axios",
+  got: "got",
+  ky: "ky",
+  undici: "undici"
+};
+var VERBS = /* @__PURE__ */ new Set(["get", "post", "put", "patch", "delete", "head", "options"]);
+function extractFromFile(sf, file) {
+  const ctx = { sf, imports: /* @__PURE__ */ new Map(), consts: /* @__PURE__ */ new Map(), http: /* @__PURE__ */ new Map(), sdk: /* @__PURE__ */ new Map() };
+  collectImports(ctx);
+  collectConsts(ctx);
+  collectClients(ctx);
+  const found = [];
+  for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const hit = matchHttp(ctx, call) ?? matchSdk(ctx, call);
+    if (!hit) continue;
+    const { line, column } = sf.getLineAndColumnAtPos(call.getStart());
+    hit.site.file = file;
+    hit.site.line = line;
+    hit.site.column = column;
+    found.push(hit);
+  }
+  return found;
+}
+function collectImports(ctx) {
+  for (const decl of ctx.sf.getImportDeclarations()) {
+    const module = decl.getModuleSpecifierValue();
+    const def = decl.getDefaultImport();
+    if (def) ctx.imports.set(def.getText(), { module, imported: "default" });
+    const ns = decl.getNamespaceImport();
+    if (ns) ctx.imports.set(ns.getText(), { module, imported: "*" });
+    for (const named of decl.getNamedImports()) {
+      const local = named.getAliasNode()?.getText() ?? named.getName();
+      ctx.imports.set(local, { module, imported: named.getName() });
+    }
+  }
+  for (const decl of ctx.sf.getDescendantsOfKind(SyntaxKind.VariableDeclaration)) {
+    const module = requiredModule(decl.getInitializer());
+    if (!module) continue;
+    const name = decl.getNameNode();
+    if (Node.isIdentifier(name)) ctx.imports.set(name.getText(), { module, imported: "default" });
+    else if (Node.isObjectBindingPattern(name)) {
+      for (const el of name.getElements()) {
+        const imported = el.getPropertyNameNode()?.getText() ?? el.getName();
+        ctx.imports.set(el.getName(), { module, imported });
+      }
+    }
+  }
+}
+function requiredModule(node) {
+  if (!node || !Node.isCallExpression(node)) return void 0;
+  const callee = node.getExpression();
+  const arg = node.getArguments()[0];
+  if (Node.isIdentifier(callee) && callee.getText() === "require" && arg && Node.isStringLiteral(arg)) {
+    return arg.getLiteralValue();
+  }
+  return void 0;
+}
+function collectConsts(ctx) {
+  for (const decl of ctx.sf.getDescendantsOfKind(SyntaxKind.VariableDeclaration)) {
+    const list = decl.getVariableStatement()?.getDeclarationKind();
+    const init = decl.getInitializer();
+    if (list === "const" && init && Node.isIdentifier(decl.getNameNode())) ctx.consts.set(decl.getName(), init);
+  }
+}
+function collectClients(ctx) {
+  const bind = (key, init) => {
+    if (!init) return;
+    const expr = unwrap(init);
+    if (!Node.isNewExpression(expr) && !Node.isCallExpression(expr)) return;
+    const callee = expr.getExpression();
+    const args = expr.getArguments();
+    if (Node.isPropertyAccessExpression(callee)) {
+      const lib = httpLibOf(ctx, callee.getExpression());
+      if (lib && ["create", "extend"].includes(callee.getName())) {
+        const opts = args[0];
+        const base = Node.isObjectLiteralExpression(opts) ? evalString(ctx, propertyValue(opts, "baseURL")) ?? evalString(ctx, propertyValue(opts, "prefixUrl")) : void 0;
+        ctx.http.set(key, { lib, baseURL: base });
+        return;
+      }
+    }
+    const module = moduleOfCallee(ctx, callee);
+    const provider = module ? providerForPackage(module) : void 0;
+    if (module && provider) {
+      const options = [...args].reverse().find((a) => Node.isObjectLiteralExpression(a));
+      ctx.sdk.set(key, { provider, pkg: module, options });
+    }
+  };
+  for (const decl of ctx.sf.getDescendantsOfKind(SyntaxKind.VariableDeclaration)) {
+    if (Node.isIdentifier(decl.getNameNode())) bind(decl.getName(), decl.getInitializer());
+  }
+  for (const prop of ctx.sf.getDescendantsOfKind(SyntaxKind.PropertyDeclaration)) {
+    bind(`this.${prop.getName()}`, prop.getInitializer());
+  }
+  for (const bin of ctx.sf.getDescendantsOfKind(SyntaxKind.BinaryExpression)) {
+    if (bin.getOperatorToken().getKind() !== SyntaxKind.EqualsToken) continue;
+    const left = bin.getLeft();
+    if (Node.isPropertyAccessExpression(left) && left.getExpression().getKind() === SyntaxKind.ThisKeyword) {
+      bind(`this.${left.getName()}`, bin.getRight());
+    } else if (Node.isIdentifier(left)) {
+      bind(left.getText(), bin.getRight());
+    }
+  }
+}
+function moduleOfCallee(ctx, callee) {
+  const root = chainOf(callee)?.root;
+  if (root) return ctx.imports.get(root)?.module;
+  return requiredModule(callee);
+}
+function httpLibOf(ctx, node) {
+  if (!Node.isIdentifier(node)) return void 0;
+  const ref = ctx.imports.get(node.getText());
+  if (ref) {
+    const lib = HTTP_MODULES[ref.module];
+    if (lib === "undici") return ref.imported === "*" ? "undici" : void 0;
+    return lib && (ref.imported === "default" || ref.imported === "*") ? lib : void 0;
+  }
+  return void 0;
+}
+function matchHttp(ctx, call) {
+  const callee = call.getExpression();
+  const args = call.getArguments();
+  if (Node.isIdentifier(callee)) {
+    const name = callee.getText();
+    const ref = ctx.imports.get(name);
+    if (!ref && name === "fetch") return fetchStyle(ctx, call, "fetch", args[0], args[1]);
+    if (ref) {
+      const lib = HTTP_MODULES[ref.module];
+      if (lib === "node-fetch") return fetchStyle(ctx, call, lib, args[0], args[1]);
+      if (lib === "undici" && ref.imported === "fetch") return fetchStyle(ctx, call, lib, args[0], args[1]);
+      if (lib === "undici" && ref.imported === "request") return fetchStyle(ctx, call, lib, args[0], args[1]);
+      if (lib === "axios" && ref.imported === "default") return axiosStyle(ctx, call, void 0, void 0);
+      if ((lib === "got" || lib === "ky") && ref.imported === "default") return fetchStyle(ctx, call, lib, args[0], args[1]);
+    }
+    const inst = ctx.http.get(name);
+    if (inst?.lib === "axios") return axiosStyle(ctx, call, void 0, inst.baseURL);
+    if (inst) return fetchStyle(ctx, call, inst.lib, args[0], args[1], void 0, inst.baseURL);
+    return void 0;
+  }
+  if (Node.isPropertyAccessExpression(callee)) {
+    const target = callee.getExpression();
+    const member = callee.getName();
+    const lib = httpLibOf(ctx, target);
+    const inst = Node.isIdentifier(target) ? ctx.http.get(target.getText()) : void 0;
+    const effective = lib ?? inst?.lib;
+    if (!effective) return void 0;
+    const base = inst?.baseURL;
+    if (effective === "undici") {
+      return member === "fetch" || member === "request" ? fetchStyle(ctx, call, "undici", args[0], args[1]) : void 0;
+    }
+    if (effective === "axios") {
+      if (member === "request") return axiosStyle(ctx, call, void 0, base);
+      if (VERBS.has(member)) return axiosStyle(ctx, call, member.toUpperCase(), base);
+      return void 0;
+    }
+    if (VERBS.has(member)) {
+      return fetchStyle(ctx, call, effective, args[0], args[1], member.toUpperCase(), base);
+    }
+  }
+  return void 0;
+}
+function fetchStyle(ctx, call, lib, urlArg, optsArg, verb, baseURL) {
+  const opts = resolveObject(ctx, optsArg);
+  let method = verb ?? "GET";
+  if (!verb && optsArg) {
+    if (opts) method = methodFrom(ctx, propertyValue(opts, "method")) ?? (propertyValue(opts, "method") ? null : "GET");
+    else method = null;
+  }
+  return httpSite(ctx, call, lib, joinUrl(baseURL, evalString(ctx, urlArg)), method, opts ? optsArg : void 0);
+}
+function axiosStyle(ctx, call, verb, baseURL) {
+  const args = call.getArguments();
+  const first = args[0];
+  const firstObj = resolveObject(ctx, first);
+  if (!verb && firstObj && !isStringish(first)) {
+    const url = evalString(ctx, propertyValue(firstObj, "url"));
+    const base = evalString(ctx, propertyValue(firstObj, "baseURL")) ?? baseURL;
+    const method2 = methodFrom(ctx, propertyValue(firstObj, "method")) ?? (propertyValue(firstObj, "method") ? null : "GET");
+    const params2 = resolveObject(ctx, propertyValue(firstObj, "params"));
+    return httpSite(ctx, call, "axios", joinUrl(base, url), method2, first, params2);
+  }
+  const hasBody = verb === "POST" || verb === "PUT" || verb === "PATCH";
+  const config = hasBody ? args[2] : args[1];
+  const cfg = resolveObject(ctx, config);
+  let method = verb ?? "GET";
+  if (!verb && cfg) method = methodFrom(ctx, propertyValue(cfg, "method")) ?? "GET";
+  const params = cfg ? resolveObject(ctx, propertyValue(cfg, "params")) : void 0;
+  return httpSite(ctx, call, "axios", joinUrl(baseURL, evalString(ctx, first)), method, config, params);
+}
+function httpSite(ctx, call, lib, url, method, options, params) {
+  const { host, path: path13, query } = parseUrl(url);
+  const surface = emptySurface();
+  surface.headers = headersOf(ctx, options);
+  surface.query = [...query, ...objectEntries(ctx, params)];
+  const provider = host ? providerForHost(host)?.id ?? null : null;
+  return {
+    call,
+    options,
+    site: {
+      file: "",
+      line: 0,
+      column: 0,
+      provider,
+      kind: "http",
+      client: lib,
+      method,
+      host,
+      endpoint: path13,
+      resolved: Boolean(provider && path13 && method),
+      surface
+    }
+  };
+}
+function matchSdk(ctx, call) {
+  const chain = chainOf(call.getExpression());
+  if (!chain || chain.names.length === 0) return void 0;
+  let client = ctx.sdk.get(chain.root);
+  if (!client) {
+    const ref = ctx.imports.get(chain.root);
+    const provider = ref ? providerForPackage(ref.module) : void 0;
+    if (!ref || !provider || ref.imported !== "default") return void 0;
+    client = { provider, pkg: ref.module };
+  }
+  const operation = chain.names.join(".");
+  const args = call.getArguments();
+  let method = null;
+  let endpoint = null;
+  let options = args[0];
+  const route = operation === "request" ? evalString(ctx, args[0]) : void 0;
+  if (route) {
+    const m = /^([A-Z]+)\s+(\S+)$/.exec(route.trim());
+    if (m && HTTP_METHODS.includes(m[1])) {
+      method = m[1];
+      endpoint = parseUrl(m[2]).path;
+    } else if (route.startsWith("/")) {
+      method = "GET";
+      endpoint = parseUrl(route).path;
+    }
+    options = args[1];
+  } else if (operation === "graphql") {
+    method = "POST";
+    endpoint = "/graphql";
+  } else {
+    const ep = sdkEndpoint(client.provider, operation);
+    if (ep) {
+      method = ep.method;
+      endpoint = ep.path;
+    }
+  }
+  const host = client.provider.hosts.find((h) => !h.startsWith("*.")) ?? null;
+  const surface = emptySurface();
+  surface.headers = [...headersOf(ctx, client.options, "defaultHeaders"), ...headersOf(ctx, options)];
+  const apiVersion = client.options ? propertyValue(client.options, "apiVersion") : void 0;
+  if (apiVersion) surface.headers.push({ name: `${client.provider.id}-version`, value: evalString(ctx, apiVersion) ?? null });
+  surface.headers.sort((a, b) => a.name.localeCompare(b.name));
+  return {
+    call,
+    options,
+    clientOptions: client.options,
+    site: {
+      file: "",
+      line: 0,
+      column: 0,
+      provider: client.provider.id,
+      kind: "sdk",
+      client: client.pkg,
+      operation,
+      method,
+      host,
+      endpoint,
+      resolved: Boolean(method && endpoint),
+      surface
+    }
+  };
+}
+function chainOf(node) {
+  const names = [];
+  let cur = node;
+  while (Node.isPropertyAccessExpression(cur)) {
+    names.unshift(cur.getName());
+    const inner = cur.getExpression();
+    if (inner.getKind() === SyntaxKind.ThisKeyword) {
+      const first = names.shift();
+      return { root: `this.${first}`, names };
+    }
+    cur = inner;
+  }
+  if (Node.isIdentifier(cur)) return { root: cur.getText(), names };
+  return void 0;
+}
+function unwrap(node) {
+  let cur = node;
+  for (; ; ) {
+    if (Node.isAwaitExpression(cur) || Node.isParenthesizedExpression(cur) || Node.isAsExpression(cur) || Node.isNonNullExpression(cur)) {
+      cur = cur.getExpression();
+    } else if (Node.isSatisfiesExpression(cur)) {
+      cur = cur.getExpression();
+    } else {
+      return cur;
+    }
+  }
+}
+function propertyValue(obj, name) {
+  if (!Node.isObjectLiteralExpression(obj)) return void 0;
+  for (const prop of obj.getProperties()) {
+    if (Node.isPropertyAssignment(prop) && propName(prop.getNameNode()) === name) return prop.getInitializer();
+    if (Node.isShorthandPropertyAssignment(prop) && prop.getName() === name) return prop.getNameNode();
+  }
+  return void 0;
+}
+function propName(node) {
+  if (Node.isStringLiteral(node) || Node.isNoSubstitutionTemplateLiteral(node)) return node.getLiteralValue();
+  return node.getText();
+}
+function headersOf(ctx, options, key = "headers") {
+  const obj = resolveObject(ctx, options);
+  return obj ? objectEntries(ctx, resolveObject(ctx, propertyValue(obj, key))).map((h) => ({ ...h, name: h.name.toLowerCase() })) : [];
+}
+function objectEntries(ctx, obj) {
+  if (!obj || !Node.isObjectLiteralExpression(obj)) return [];
+  const out = [];
+  for (const prop of obj.getProperties()) {
+    if (Node.isPropertyAssignment(prop)) {
+      out.push({ name: propName(prop.getNameNode()), value: evalString(ctx, prop.getInitializer()) ?? null });
+    } else if (Node.isShorthandPropertyAssignment(prop)) {
+      out.push({ name: prop.getName(), value: evalString(ctx, prop.getNameNode()) ?? null });
+    }
+  }
+  return out;
+}
+function resolveObject(ctx, node) {
+  if (!node) return void 0;
+  const expr = unwrap(node);
+  if (Node.isObjectLiteralExpression(expr)) return expr;
+  if (Node.isIdentifier(expr)) {
+    const init = ctx.consts.get(expr.getText());
+    if (init && Node.isObjectLiteralExpression(unwrap(init))) return unwrap(init);
+  }
+  return void 0;
+}
+function isStringish(node) {
+  if (!node) return false;
+  const expr = unwrap(node);
+  return Node.isStringLiteral(expr) || Node.isTemplateExpression(expr) || Node.isNoSubstitutionTemplateLiteral(expr);
+}
+function methodFrom(ctx, node) {
+  const value2 = evalString(ctx, node)?.toUpperCase();
+  return value2 && HTTP_METHODS.includes(value2) ? value2 : void 0;
+}
+function evalString(ctx, node, depth = 0) {
+  if (!node || depth > 8) return void 0;
+  const expr = unwrap(node);
+  if (Node.isStringLiteral(expr) || Node.isNoSubstitutionTemplateLiteral(expr)) return expr.getLiteralValue();
+  if (Node.isNumericLiteral(expr)) return expr.getLiteralText();
+  if (Node.isTemplateExpression(expr)) {
+    let out = expr.getHead().getLiteralText();
+    for (const span of expr.getTemplateSpans()) {
+      const inner = span.getExpression();
+      out += evalString(ctx, inner, depth + 1) ?? placeholder(inner);
+      out += span.getLiteral().getLiteralText();
+    }
+    return out;
+  }
+  if (Node.isBinaryExpression(expr)) {
+    const op = expr.getOperatorToken().getKind();
+    if (op === SyntaxKind.PlusToken) {
+      const l = evalString(ctx, expr.getLeft(), depth + 1);
+      const r = evalString(ctx, expr.getRight(), depth + 1);
+      if (l === void 0 && r === void 0) return void 0;
+      return (l ?? placeholder(expr.getLeft())) + (r ?? placeholder(expr.getRight()));
+    }
+    if (op === SyntaxKind.QuestionQuestionToken || op === SyntaxKind.BarBarToken) {
+      return evalString(ctx, expr.getLeft(), depth + 1) ?? evalString(ctx, expr.getRight(), depth + 1);
+    }
+  }
+  if (Node.isIdentifier(expr)) {
+    const init = ctx.consts.get(expr.getText());
+    return init && init !== node ? evalString(ctx, init, depth + 1) : void 0;
+  }
+  if (Node.isNewExpression(expr) && expr.getExpression().getText() === "URL") {
+    const [p, base] = expr.getArguments();
+    const pathPart = evalString(ctx, p, depth + 1);
+    const basePart = evalString(ctx, base, depth + 1);
+    return pathPart !== void 0 && basePart !== void 0 ? joinUrl(basePart, pathPart) : pathPart ?? void 0;
+  }
+  return void 0;
+}
+function placeholder(node) {
+  const expr = unwrap(node);
+  if (Node.isIdentifier(expr)) return `{${expr.getText()}}`;
+  if (Node.isPropertyAccessExpression(expr)) return `{${expr.getName()}}`;
+  if (Node.isCallExpression(expr) && expr.getArguments().length === 1) return placeholder(expr.getArguments()[0]);
+  return "{}";
+}
+function joinUrl(base, url) {
+  if (url === void 0) return void 0;
+  if (!base || /^[a-z]+:\/\//i.test(url)) return url;
+  return base.replace(/\/+$/, "") + "/" + url.replace(/^\/+/, "");
+}
+function parseUrl(url) {
+  if (url === void 0) return { host: null, path: null, query: [] };
+  let host = null;
+  let rest = url;
+  const m = /^(?:[a-z]+:)?\/\/([^/?#]+)(.*)$/i.exec(url);
+  if (m) {
+    host = m[1].includes("{") ? null : m[1].toLowerCase();
+    rest = m[2] || "/";
+  } else if (!url.startsWith("/")) {
+    const slash = url.indexOf("/");
+    rest = slash >= 0 ? url.slice(slash) : "/";
+    if (slash < 0) return { host: null, path: null, query: [] };
+  }
+  let path13 = rest.split(/[?#]/)[0].replace(/\/{2,}/g, "/");
+  if (path13.length > 1) path13 = path13.replace(/\/$/, "");
+  const search = /\?([^#]*)/.exec(rest)?.[1] ?? "";
+  const query = search.split("&").filter(Boolean).map((pair) => {
+    const [name, ...value2] = pair.split("=");
+    return { name, value: value2.length ? value2.join("=") : null };
+  });
+  return { host, path: path13 || "/", query };
+}
+
+// packages/extractor/src/surface.ts
+import { Node as Node2, SyntaxKind as SyntaxKind2 } from "ts-morph";
+var NOT_FIELDS = /* @__PURE__ */ new Set([
+  "length",
+  "map",
+  "filter",
+  "forEach",
+  "find",
+  "findIndex",
+  "some",
+  "every",
+  "includes",
+  "indexOf",
+  "reduce",
+  "slice",
+  "join",
+  "concat",
+  "flatMap",
+  "sort",
+  "keys",
+  "values",
+  "entries",
+  "at",
+  "push",
+  "toString",
+  "toLowerCase",
+  "toUpperCase",
+  "trim",
+  "split",
+  "startsWith",
+  "endsWith",
+  "replace",
+  "match",
+  "then",
+  "catch",
+  "finally",
+  "valueOf",
+  "toJSON"
+]);
+var MAX_DEPTH = 4;
+var Collector = class {
+  fields = /* @__PURE__ */ new Set();
+  statusCodes = /* @__PURE__ */ new Set();
+  checksOk = false;
+  enums = /* @__PURE__ */ new Map();
+  responseHeaders = /* @__PURE__ */ new Set();
+  addEnum(field, value2) {
+    const set = this.enums.get(field) ?? /* @__PURE__ */ new Set();
+    set.add(value2);
+    this.enums.set(field, set);
+  }
+};
+function addResponseSurface(found) {
+  const c = new Collector();
+  bindFrom(found.call, { space: "response", path: [] }, envelopeOf(found), c, 0);
+  const surface = found.site.surface;
+  surface.fields = [...c.fields].sort();
+  surface.statusCodes = [...c.statusCodes].sort((a, b) => a - b);
+  surface.checksOk = c.checksOk;
+  surface.enums = [...c.enums].map(([field, values]) => ({ field, values: [...values].sort() })).sort((a, b) => a.field.localeCompare(b.field));
+  surface.responseHeaders = [...c.responseHeaders].sort();
+}
+function envelopeOf({ site, call }) {
+  if (site.kind === "sdk") return site.provider === "github" ? "axios" : "body";
+  switch (site.client) {
+    case "axios":
+      return "axios";
+    case "got":
+      return "got";
+    case "undici":
+      return /request$/.test(call.getExpression().getText()) ? "undici" : "fetch";
+    default:
+      return "fetch";
+  }
+}
+function bindFrom(expr, loc, env, c, depth) {
+  if (depth > MAX_DEPTH) return;
+  let cur = expr;
+  for (; ; ) {
+    const p = cur.getParent();
+    if (p && (Node2.isAwaitExpression(p) || Node2.isParenthesizedExpression(p) || Node2.isAsExpression(p) || Node2.isNonNullExpression(p) || Node2.isSatisfiesExpression(p))) {
+      cur = p;
+    } else break;
+  }
+  const parent = cur.getParent();
+  if (!parent) return;
+  if (Node2.isPropertyAccessExpression(parent) && parent.getExpression() === cur && parent.getName() === "then") {
+    const thenCall = parent.getParent();
+    const cb = Node2.isCallExpression(thenCall) ? thenCall.getArguments()[0] : void 0;
+    if (cb && (Node2.isArrowFunction(cb) || Node2.isFunctionExpression(cb))) {
+      const param = cb.getParameters()[0];
+      if (param) bindName(param.getNameNode(), loc, param, env, c, depth);
+    }
+    return;
+  }
+  if (Node2.isVariableDeclaration(parent) && parent.getInitializer() === cur) {
+    bindName(parent.getNameNode(), loc, parent, env, c, depth);
+    return;
+  }
+  if (Node2.isBinaryExpression(parent) && parent.getRight() === cur && parent.getOperatorToken().getKind() === SyntaxKind2.EqualsToken) {
+    const left = parent.getLeft();
+    if (Node2.isIdentifier(left)) bindName(left, loc, parent, env, c, depth);
+    return;
+  }
+  use(cur, loc, env, c, depth);
+}
+function bindName(name, loc, decl, env, c, depth) {
+  if (Node2.isIdentifier(name)) {
+    for (const ref of referencesOf(name.getText(), decl)) use(ref, loc, env, c, depth);
+  } else if (Node2.isObjectBindingPattern(name)) {
+    for (const el of name.getElements()) {
+      const prop = el.getPropertyNameNode()?.getText() ?? el.getName();
+      bindName(el.getNameNode(), { ...loc, path: [...loc.path, prop] }, decl, env, c, depth);
+      interpret(env, { ...loc, path: [...loc.path, prop] }, [], el, c, depth, false);
+    }
+  }
+}
+function referencesOf(name, decl) {
+  const scope = decl.getFirstAncestor(
+    (n) => Node2.isBlock(n) || Node2.isSourceFile(n) || Node2.isArrowFunction(n) || Node2.isFunctionExpression(n) || Node2.isFunctionDeclaration(n) || Node2.isMethodDeclaration(n) || Node2.isCaseClause(n)
+  ) ?? decl.getSourceFile();
+  const after = decl.getEnd();
+  return scope.getDescendantsOfKind(SyntaxKind2.Identifier).filter((id) => {
+    if (id.getText() !== name || id.getStart() < after) return false;
+    const p = id.getParent();
+    if (Node2.isPropertyAccessExpression(p) && p.getNameNode() === id) return false;
+    if (Node2.isPropertyAssignment(p) && p.getNameNode() === id) return false;
+    if (Node2.isBindingElement(p) || Node2.isVariableDeclaration(p) || Node2.isParameterDeclaration(p)) return false;
+    return true;
+  });
+}
+function use(ref, loc, env, c, depth) {
+  const access = [];
+  let cur = ref;
+  for (; ; ) {
+    const p = cur.getParent();
+    if (Node2.isPropertyAccessExpression(p) && p.getExpression() === cur) {
+      access.push(p.getName());
+      cur = p;
+    } else if (Node2.isElementAccessExpression(p) && p.getExpression() === cur) {
+      const arg = p.getArgumentExpression();
+      if (arg && (Node2.isStringLiteral(arg) || Node2.isNoSubstitutionTemplateLiteral(arg))) access.push(arg.getLiteralValue());
+      else access.push("[]");
+      cur = p;
+    } else if (p && (Node2.isNonNullExpression(p) || Node2.isParenthesizedExpression(p))) {
+      cur = p;
+    } else break;
+  }
+  interpret(env, loc, access, cur, c, depth, true);
+}
+function interpret(env, loc, access, top, c, depth, compare) {
+  const full = [...loc.path, ...access];
+  if (loc.space === "body" || env === "body") {
+    body(full, top, c, compare);
+    return;
+  }
+  const [first, ...rest] = full;
+  if (first === void 0) return;
+  const isCall = () => {
+    const p = top.getParent();
+    return Node2.isCallExpression(p) && p.getExpression() === top;
+  };
+  const statusKey = env === "got" || env === "undici" ? "statusCode" : "status";
+  if (first === statusKey && rest.length === 0) {
+    if (compare) for (const n of comparedLiterals(top).nums) c.statusCodes.add(n);
+    return;
+  }
+  if (first === "ok" && rest.length === 0) {
+    c.checksOk = true;
+    return;
+  }
+  if (first === "headers") {
+    const [h] = rest;
+    if (h === "get" && isCall()) {
+      const arg = top.getParent().getArguments()[0];
+      if (arg && Node2.isStringLiteral(arg)) c.responseHeaders.add(arg.getLiteralValue().toLowerCase());
+    } else if (h && h !== "get") c.responseHeaders.add(h.toLowerCase());
+    return;
+  }
+  if (env === "axios" && first === "data") return body(rest, top, c, compare);
+  if (env === "got" && first === "body") return body(rest, top, c, compare);
+  const bodyCall = (env === "fetch" || env === "got") && rest.length === 0 && (first === "json" || first === "text") || env === "undici" && first === "body" && rest.length === 1 && (rest[0] === "json" || rest[0] === "text");
+  if (bodyCall && isCall()) {
+    bindFrom(top.getParent(), { space: "body", path: [] }, env, c, depth + 1);
+  }
+}
+function body(path13, top, c, compare) {
+  const cut = path13.findIndex((p) => NOT_FIELDS.has(p));
+  const fieldPath = cut >= 0 ? path13.slice(0, cut) : path13;
+  if (fieldPath.length === 0) return;
+  const field = fieldPath.join(".").replace(/\.\[\]/g, "[]");
+  c.fields.add(field);
+  if (compare && cut < 0) for (const s of comparedLiterals(top).strs) c.addEnum(field, s);
+}
+function comparedLiterals(node) {
+  const nums = [];
+  const strs = [];
+  const take = (n) => {
+    if (!n) return;
+    if (Node2.isNumericLiteral(n)) nums.push(Number(n.getLiteralValue()));
+    else if (Node2.isStringLiteral(n) || Node2.isNoSubstitutionTemplateLiteral(n)) strs.push(n.getLiteralValue());
+  };
+  let cur = node;
+  while (Node2.isParenthesizedExpression(cur.getParent())) cur = cur.getParent();
+  const p = cur.getParent();
+  if (Node2.isBinaryExpression(p)) {
+    const op = p.getOperatorToken().getKind();
+    if (op === SyntaxKind2.EqualsEqualsEqualsToken || op === SyntaxKind2.ExclamationEqualsEqualsToken || op === SyntaxKind2.EqualsEqualsToken || op === SyntaxKind2.ExclamationEqualsToken) {
+      take(p.getLeft() === cur ? p.getRight() : p.getLeft());
+    }
+  } else if (Node2.isSwitchStatement(p) && p.getExpression() === cur) {
+    for (const clause of p.getClauses()) if (Node2.isCaseClause(clause)) take(clause.getExpression());
+  } else if (Node2.isCallExpression(p) && p.getArguments()[0] === cur) {
+    const callee = p.getExpression();
+    if (Node2.isPropertyAccessExpression(callee) && callee.getName() === "includes") {
+      const arr = callee.getExpression();
+      if (Node2.isArrayLiteralExpression(arr)) arr.getElements().forEach(take);
+    }
+  }
+  return { nums, strs };
+}
+
+// packages/extractor/src/files.ts
+import { readdirSync as readdirSync2, readFileSync as readFileSync2 } from "fs";
+import path3 from "path";
+var SOURCE_FILE = /\.(c|m)?[jt]sx?$/;
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", "build", "out", "coverage", "vendor", "bower_components"]);
+function listRepoFiles(root) {
+  const sources = [];
+  const manifests = [];
+  const walk2 = (dir) => {
+    for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+      if (entry.name.startsWith(".")) continue;
+      const full = path3.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRS.has(entry.name)) walk2(full);
+      } else if (entry.isFile()) {
+        if (entry.name === "package.json") manifests.push(full);
+        else if (SOURCE_FILE.test(entry.name) && !entry.name.endsWith(".d.ts")) sources.push(full);
+      }
+    }
+  };
+  walk2(root);
+  return { sources: sources.sort(), manifests: manifests.sort() };
+}
+function declaredProviders(root, manifests) {
+  const found = [];
+  for (const manifest of manifests) {
+    let pkg;
+    try {
+      pkg = JSON.parse(readFileSync2(manifest, "utf8"));
+    } catch {
+      continue;
+    }
+    const names = /* @__PURE__ */ new Set();
+    for (const field of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
+      const deps = pkg[field];
+      if (deps && typeof deps === "object") for (const name of Object.keys(deps)) names.add(name);
+    }
+    for (const name of [...names].sort()) {
+      const provider = providerForPackage(name);
+      if (provider) found.push({ provider: provider.id, package: name, manifest: toPosix(path3.relative(root, manifest)) });
+    }
+  }
+  return found;
+}
+function toPosix(p) {
+  return p.split(path3.sep).join("/");
+}
+
+// packages/extractor/src/index.ts
+var SCRIPT_KINDS = {
+  ".ts": ScriptKind.TS,
+  ".mts": ScriptKind.TS,
+  ".cts": ScriptKind.TS,
+  ".tsx": ScriptKind.TSX,
+  ".js": ScriptKind.JS,
+  ".mjs": ScriptKind.JS,
+  ".cjs": ScriptKind.JS,
+  ".jsx": ScriptKind.JSX
+};
+function extractCallSites(rootDir) {
+  const root = path4.resolve(rootDir);
+  const { sources, manifests } = listRepoFiles(root);
+  const project = new Project({
+    useInMemoryFileSystem: true,
+    skipFileDependencyResolution: true,
+    compilerOptions: { allowJs: true }
+  });
+  const found = [];
+  for (const abs of sources) {
+    const rel = toPosix(path4.relative(root, abs));
+    const sf = project.createSourceFile(`/${rel}`, readFileSync3(abs, "utf8"), {
+      overwrite: true,
+      scriptKind: SCRIPT_KINDS[path4.extname(abs)] ?? ScriptKind.TS
+    });
+    for (const f of extractFromFile(sf, rel)) {
+      addResponseSurface(f);
+      found.push(f);
+    }
+  }
+  found.sort((a, b) => a.site.file.localeCompare(b.site.file) || a.site.line - b.site.line || a.site.column - b.site.column);
+  return {
+    root,
+    filesScanned: sources.length,
+    callSites: found.map((f) => f.site),
+    declared: declaredProviders(root, manifests),
+    found
+  };
+}
+
+// packages/shapes/src/shape.ts
+import { createHash as createHash2, createHmac } from "crypto";
+import { z as z4 } from "zod";
+var JSON_TYPES = ["array", "boolean", "integer", "null", "number", "object", "string"];
+var VALUE_CLASSES = [
+  "datetime",
+  "date",
+  "uuid",
+  "url",
+  "email",
+  "id",
+  "token",
+  "text",
+  "positive",
+  "negative",
+  "zero",
+  "true",
+  "false"
+];
+var MAX_ENUM_VALUES = 50;
+var FieldShapeSchema = z4.object({
+  /** Field path, dot-separated, array items as "[]". Omitted when the shape is redacted. */
+  path: z4.string().optional(),
+  /** HMAC of the path with the provider salt; stable across observations. */
+  pathHash: z4.string(),
+  types: z4.array(z4.enum(JSON_TYPES)),
+  classes: z4.array(z4.enum(VALUE_CLASSES)),
+  /** How many times the field appeared (more than once inside arrays). */
+  occurrences: z4.number().int().nonnegative(),
+  /** Share of occurrences that were null. */
+  nullRate: z4.number().min(0).max(1),
+  /** Array lengths seen, for array fields. */
+  arrayLength: z4.object({ min: z4.number().int(), max: z4.number().int() }).optional(),
+  /** HMACs of distinct token values (enum candidates), never the values themselves. */
+  valueHashes: z4.array(z4.string()).optional()
+});
+var ResponseShapeSchema = z4.object({
+  status: z4.number().int(),
+  /** Allowlisted headers whose values describe the contract, not the payload. */
+  headers: z4.record(z4.string(), z4.string()),
+  /** Names of the other non-volatile headers present. */
+  headerNames: z4.array(z4.string()),
+  body: z4.object({
+    kind: z4.enum(["empty", "json", "text"]),
+    rootType: z4.enum(JSON_TYPES).optional(),
+    fields: z4.array(FieldShapeSchema)
+  })
+});
+var VALUE_HEADERS = /* @__PURE__ */ new Set([
+  "content-type",
+  "deprecation",
+  "sunset",
+  "link-deprecation",
+  "x-github-api-version-selected",
+  "stripe-version",
+  "x-api-version",
+  "api-version",
+  "openai-version",
+  "anthropic-version",
+  "intuit-minor-version"
+]);
+var VOLATILE_HEADERS = /* @__PURE__ */ new Set([
+  "date",
+  "age",
+  "etag",
+  "last-modified",
+  "expires",
+  "set-cookie",
+  "cf-ray",
+  "server-timing",
+  "x-request-id",
+  "request-id",
+  "x-github-request-id",
+  "x-runtime",
+  "x-served-by",
+  "x-cache",
+  "x-cache-hits",
+  "x-timer",
+  "content-length",
+  "connection",
+  "keep-alive",
+  "via",
+  "report-to",
+  "nel",
+  "idempotency-key",
+  "original-request",
+  // transport and caching: vary with chunking, compression and proxies, not with the API contract
+  "transfer-encoding",
+  "accept-ranges",
+  "content-encoding",
+  "vary",
+  "alt-svc",
+  "cache-control",
+  // token metadata: present only on authenticated calls, value changes per token
+  "github-authentication-token-expiration"
+]);
+function providerSalt(provider, secret) {
+  return createHmac("sha256", secret).update(provider).digest("hex");
+}
+function hmac(salt, value2) {
+  return createHmac("sha256", salt).update(value2).digest("hex").slice(0, 16);
+}
+function inferShape(res, opts) {
+  const headers = {};
+  const headerNames = [];
+  const entries = res.headers instanceof Headers ? [...res.headers.entries()] : Object.entries(res.headers);
+  for (const [rawName, value2] of entries) {
+    const name = rawName.toLowerCase();
+    if (VALUE_HEADERS.has(name)) headers[name] = name === "content-type" ? value2.split(";")[0].trim() : value2;
+    else if (!VOLATILE_HEADERS.has(name) && !name.startsWith("x-ratelimit") && !name.startsWith("ratelimit")) headerNames.push(name);
+  }
+  const text = res.body ?? "";
+  let body2;
+  if (text.trim() === "") {
+    body2 = { kind: "empty", fields: [] };
+  } else {
+    let parsed;
+    let isJson = true;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      isJson = false;
+    }
+    if (isJson) {
+      const acc = /* @__PURE__ */ new Map();
+      walk(parsed, "", acc);
+      body2 = { kind: "json", rootType: typeOf(parsed), fields: finish(acc, opts.salt) };
+    } else {
+      body2 = { kind: "text", fields: [] };
+    }
+  }
+  return {
+    status: res.status,
+    headers: Object.fromEntries(Object.entries(headers).sort(([a], [b]) => cmp3(a, b))),
+    headerNames: [...new Set(headerNames)].sort(),
+    body: body2
+  };
+}
+function walk(value2, path13, acc) {
+  if (path13 !== "") record(value2, path13, acc);
+  if (Array.isArray(value2)) {
+    for (const item of value2) walk(item, `${path13}[]`, acc);
+  } else if (value2 !== null && typeof value2 === "object") {
+    for (const [key, child] of Object.entries(value2)) walk(child, path13 === "" ? key : `${path13}.${key}`, acc);
+  }
+}
+function record(value2, path13, acc) {
+  let a = acc.get(path13);
+  if (!a) acc.set(path13, a = { types: /* @__PURE__ */ new Set(), classes: /* @__PURE__ */ new Set(), occurrences: 0, nulls: 0, tokens: /* @__PURE__ */ new Set(), textValues: 0 });
+  a.occurrences++;
+  const type = typeOf(value2);
+  a.types.add(type);
+  if (type === "null") a.nulls++;
+  if (Array.isArray(value2)) {
+    a.lengths = a.lengths ? { min: Math.min(a.lengths.min, value2.length), max: Math.max(a.lengths.max, value2.length) } : { min: value2.length, max: value2.length };
+  }
+  const cls = classify(value2);
+  if (cls) a.classes.add(cls);
+  if (cls === "token" && typeof value2 === "string") a.tokens.add(value2);
+}
+function finish(acc, salt) {
+  return [...acc.entries()].sort(([a], [b]) => cmp3(a, b)).map(([path13, a]) => {
+    const field = {
+      path: path13,
+      pathHash: hmac(salt, path13),
+      types: [...a.types].sort(),
+      classes: [...a.classes].sort(),
+      occurrences: a.occurrences,
+      nullRate: round(a.nulls / a.occurrences)
+    };
+    if (a.lengths) field.arrayLength = a.lengths;
+    if (a.tokens.size > 0 && a.tokens.size <= MAX_ENUM_VALUES) {
+      field.valueHashes = [...a.tokens].map((v) => hmac(salt, `${path13}=${v}`)).sort();
+    }
+    return field;
+  });
+}
+function typeOf(value2) {
+  if (value2 === null) return "null";
+  if (Array.isArray(value2)) return "array";
+  if (typeof value2 === "number") return Number.isInteger(value2) ? "integer" : "number";
+  if (typeof value2 === "boolean") return "boolean";
+  if (typeof value2 === "string") return "string";
+  return "object";
+}
+function classify(value2) {
+  if (typeof value2 === "boolean") return value2 ? "true" : "false";
+  if (typeof value2 === "number") return value2 > 0 ? "positive" : value2 < 0 ? "negative" : "zero";
+  if (typeof value2 !== "string") return void 0;
+  if (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:?\d{2})?$/.test(value2)) return "datetime";
+  if (/^\d{4}-\d{2}-\d{2}$/.test(value2)) return "date";
+  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value2)) return "uuid";
+  if (/^https?:\/\//i.test(value2)) return "url";
+  if (/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(value2)) return "email";
+  if (/^[a-z]{2,8}_(?=[A-Za-z0-9]*\d)[A-Za-z0-9]{8,}$/.test(value2) || /^\d{5,}$/.test(value2) || /^[0-9a-f]{20,}$/i.test(value2)) return "id";
+  if (/^[A-Za-z][A-Za-z0-9_.-]{0,39}$/.test(value2)) return "token";
+  return "text";
+}
+function shapeHash(shape) {
+  const structural = {
+    status: shape.status,
+    headers: shape.headers,
+    headerNames: shape.headerNames,
+    body: {
+      kind: shape.body.kind,
+      rootType: shape.body.rootType ?? null,
+      fields: shape.body.fields.map((f) => [f.pathHash, f.types, f.classes, f.nullRate > 0, f.valueHashes ?? null])
+    }
+  };
+  return createHash2("sha256").update(JSON.stringify(structural)).digest("hex");
+}
+function round(n) {
+  return Math.round(n * 1e3) / 1e3;
+}
+function cmp3(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
+// packages/shapes/src/store.ts
+import { mkdirSync as mkdirSync2 } from "fs";
+import path5 from "path";
+import Database from "better-sqlite3";
+var SCHEMA_VERSION = 1;
+var ShapeStore = class _ShapeStore {
+  constructor(db) {
+    this.db = db;
+  }
+  db;
+  /** Open (and create or migrate) a store. Use ":memory:" for tests. */
+  static open(file) {
+    if (file !== ":memory:") mkdirSync2(path5.dirname(path5.resolve(file)), { recursive: true });
+    const db = new Database(file);
+    if (file !== ":memory:") db.pragma("journal_mode = WAL");
+    const version = db.pragma("user_version", { simple: true });
+    if (version < SCHEMA_VERSION) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS observations (
+          id INTEGER PRIMARY KEY,
+          provider TEXT NOT NULL,
+          method TEXT NOT NULL,
+          endpoint TEXT NOT NULL,
+          observed_at TEXT NOT NULL,
+          source TEXT NOT NULL,
+          shape_hash TEXT NOT NULL,
+          shape_json TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS observations_endpoint
+          ON observations (provider, method, endpoint, observed_at);
+      `);
+      db.pragma(`user_version = ${SCHEMA_VERSION}`);
+    }
+    return new _ShapeStore(db);
+  }
+  record(obs) {
+    const shape = ResponseShapeSchema.parse(obs.shape);
+    const hash = shapeHash(shape);
+    const info = this.db.prepare(
+      `INSERT INTO observations (provider, method, endpoint, observed_at, source, shape_hash, shape_json)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`
+    ).run(obs.provider, obs.method, obs.endpoint, obs.observedAt, obs.source, hash, JSON.stringify(shape));
+    return { ...obs, shape, id: Number(info.lastInsertRowid), shapeHash: hash };
+  }
+  /**
+   * Observations of one endpoint, newest first. Pass `source` to stay within one
+   * vantage point: the same endpoint answers differently with and without a token,
+   * so observations from different sources must not be compared.
+   */
+  history(provider, method, endpoint, opts = {}) {
+    const rows = this.db.prepare(
+      `SELECT * FROM observations WHERE provider = ? AND method = ? AND endpoint = ? AND (? IS NULL OR source = ?)
+         ORDER BY observed_at DESC, id DESC LIMIT ?`
+    ).all(provider, method, endpoint, opts.source ?? null, opts.source ?? null, opts.limit ?? 100);
+    return rows.map(fromRow);
+  }
+  latest(provider, method, endpoint, source) {
+    return this.history(provider, method, endpoint, { limit: 1, source })[0];
+  }
+  /** The most recent observation whose shape differs from the latest one: the "before" side of the last change. */
+  previousDistinct(provider, method, endpoint, source) {
+    const latest = this.latest(provider, method, endpoint, source);
+    if (!latest) return void 0;
+    const row = this.db.prepare(
+      `SELECT * FROM observations WHERE provider = ? AND method = ? AND endpoint = ? AND (? IS NULL OR source = ?)
+           AND shape_hash != ?
+         ORDER BY observed_at DESC, id DESC LIMIT 1`
+    ).get(provider, method, endpoint, source ?? null, source ?? null, latest.shapeHash);
+    return row ? fromRow(row) : void 0;
+  }
+  /** One row per endpoint and source. */
+  endpoints() {
+    return this.db.prepare(
+      `SELECT provider, method, endpoint, source, COUNT(*) AS observations, COUNT(DISTINCT shape_hash) AS distinctShapes,
+                MAX(observed_at) AS lastObservedAt
+         FROM observations GROUP BY provider, method, endpoint, source ORDER BY provider, endpoint, method, source`
+    ).all();
+  }
+  close() {
+    this.db.close();
+  }
+};
+function fromRow(row) {
+  return {
+    id: row.id,
+    provider: row.provider,
+    method: row.method,
+    endpoint: row.endpoint,
+    observedAt: row.observed_at,
+    source: row.source,
+    shapeHash: row.shape_hash,
+    shape: ResponseShapeSchema.parse(JSON.parse(row.shape_json))
+  };
+}
+
+// packages/shapes/src/diff.ts
+var IMPACT_ORDER = { breaking: 0, "non-breaking": 1, informational: 2 };
+var CONTRACT_HEADERS = /* @__PURE__ */ new Set(["content-type"]);
+var SUNSET_HEADERS = /* @__PURE__ */ new Set(["deprecation", "sunset", "link-deprecation"]);
+function diffShapes(before, after) {
+  const changes = [];
+  const ok = (s) => s >= 200 && s < 300;
+  if (before.status !== after.status) changes.push(statusChange(before.status, after.status));
+  if (before.body.kind !== after.body.kind) {
+    const lost = before.body.kind === "json" && after.body.kind !== "json";
+    changes.push({
+      kind: "body-kind",
+      impact: lost && ok(after.status) ? "breaking" : "informational",
+      ...lost && ok(after.status) ? { changeClass: "field-rename" } : {},
+      from: before.body.kind,
+      to: after.body.kind,
+      detail: `body ${before.body.kind} \u2192 ${after.body.kind}`
+    });
+  }
+  if (ok(before.status) === ok(after.status) && before.body.kind === "json" && after.body.kind === "json") {
+    changes.push(...fieldChanges(before.body.fields, after.body.fields));
+  }
+  changes.push(...headerChanges(before, after));
+  changes.sort((a, b) => IMPACT_ORDER[a.impact] - IMPACT_ORDER[b.impact] || (a.path ?? "").localeCompare(b.path ?? ""));
+  return { changes, breaking: changes.some((c) => c.impact === "breaking") };
+}
+function statusChange(from, to) {
+  const ok = (s) => s >= 200 && s < 300;
+  const base = { kind: "status-code", from, to, detail: `status ${from} \u2192 ${to}` };
+  if (ok(from) && ok(to)) return { ...base, impact: "breaking", changeClass: "status-code" };
+  if (ok(from) && (to === 401 || to === 403)) return { ...base, impact: "breaking", changeClass: "auth" };
+  if (ok(from) && (to === 404 || to === 410)) return { ...base, impact: "breaking", changeClass: "version-sunset" };
+  return { ...base, impact: "informational" };
+}
+function label(f) {
+  return f.path ?? `#${f.pathHash}`;
+}
+function fieldChanges(before, after) {
+  const out = [];
+  const prev = new Map(before.map((f) => [f.pathHash, f]));
+  const next = new Map(after.map((f) => [f.pathHash, f]));
+  const removedPaths = [];
+  const addedPaths = [];
+  const under = (path13, roots) => path13 !== void 0 && roots.some((r) => path13.startsWith(`${r}.`) || path13.startsWith(`${r}[]`));
+  for (const f of before) {
+    if (next.has(f.pathHash)) continue;
+    if (under(f.path, removedPaths)) continue;
+    if (f.path) removedPaths.push(f.path);
+    out.push({
+      kind: "field-removed",
+      impact: "breaking",
+      changeClass: "field-rename",
+      path: f.path,
+      pathHash: f.pathHash,
+      from: f.types,
+      detail: `field ${label(f)} removed`
+    });
+  }
+  for (const f of after) {
+    const old = prev.get(f.pathHash);
+    if (!old) {
+      if (under(f.path, addedPaths)) continue;
+      if (f.path) addedPaths.push(f.path);
+      out.push({
+        kind: "field-added",
+        impact: "non-breaking",
+        path: f.path,
+        pathHash: f.pathHash,
+        to: f.types,
+        detail: `field ${label(f)} added (${f.types.join(" | ")})`
+      });
+      continue;
+    }
+    const where = { path: f.path ?? old.path, pathHash: f.pathHash };
+    const name = f.path ?? old.path ?? `#${f.pathHash}`;
+    const newTypes = f.types.filter((t) => !old.types.includes(t));
+    const goneTypes = old.types.filter((t) => !f.types.includes(t));
+    const nonNullNew = newTypes.filter((t) => t !== "null");
+    if (nonNullNew.length > 0) {
+      out.push({
+        kind: "type-changed",
+        impact: "breaking",
+        changeClass: "field-rename",
+        ...where,
+        from: old.types,
+        to: f.types,
+        detail: `field ${name} type ${old.types.join(" | ")} \u2192 ${f.types.join(" | ")}`
+      });
+    } else if (newTypes.includes("null")) {
+      out.push({
+        kind: "became-nullable",
+        impact: "breaking",
+        changeClass: "required-field",
+        ...where,
+        from: old.types,
+        to: f.types,
+        detail: `field ${name} can now be null`
+      });
+    } else if (goneTypes.includes("null") && goneTypes.length === 1) {
+      out.push({ kind: "no-longer-nullable", impact: "informational", ...where, detail: `field ${name} no longer seen as null` });
+    }
+    const added = (f.valueHashes ?? []).filter((h) => !(old.valueHashes ?? []).includes(h));
+    if (enumLike(old) && added.length > 0) {
+      out.push({
+        kind: "enum-value-added",
+        impact: "breaking",
+        changeClass: "enum-added",
+        ...where,
+        to: added,
+        detail: `field ${name} has ${added.length} value${added.length === 1 ? "" : "s"} not seen before`
+      });
+    }
+    const newClasses = f.classes.filter((c) => !old.classes.includes(c));
+    if (nonNullNew.length === 0 && newClasses.length > 0 && old.classes.length > 0 && !newClasses.every((c) => ["positive", "negative", "zero", "true", "false"].includes(c))) {
+      out.push({
+        kind: "class-changed",
+        impact: "informational",
+        ...where,
+        from: old.classes,
+        to: f.classes,
+        detail: `field ${name} values look like ${f.classes.join(", ")} (were ${old.classes.join(", ")})`
+      });
+    }
+  }
+  return out;
+}
+function enumLike(f) {
+  const distinct = f.valueHashes?.length ?? 0;
+  return distinct > 0 && f.occurrences >= 2 * distinct;
+}
+function headerChanges(before, after) {
+  const out = [];
+  const names = /* @__PURE__ */ new Set([...Object.keys(before.headers), ...Object.keys(after.headers)]);
+  for (const name of [...names].sort()) {
+    const from = before.headers[name];
+    const to = after.headers[name];
+    if (from === to) continue;
+    if (SUNSET_HEADERS.has(name) && from === void 0) {
+      out.push({ kind: "header-added", impact: "informational", changeClass: "version-sunset", path: name, to, detail: `response now carries ${name}: ${to}` });
+    } else if (from === void 0 || to === void 0) {
+      out.push({
+        kind: from === void 0 ? "header-added" : "header-removed",
+        impact: "informational",
+        path: name,
+        ...from !== void 0 ? { from } : {},
+        ...to !== void 0 ? { to } : {},
+        detail: from === void 0 ? `header ${name}: ${to} added` : `header ${name} removed`
+      });
+    } else {
+      const contract = CONTRACT_HEADERS.has(name) && before.status === after.status;
+      out.push({
+        kind: "header-changed",
+        impact: contract ? "breaking" : "informational",
+        ...contract ? { changeClass: "field-rename" } : {},
+        path: name,
+        from,
+        to,
+        detail: `header ${name}: ${from} \u2192 ${to}`
+      });
+    }
+  }
+  const prevNames = new Set(before.headerNames);
+  const nextNames = new Set(after.headerNames);
+  for (const name of after.headerNames) {
+    if (!prevNames.has(name)) out.push({ kind: "header-added", impact: "informational", path: name, detail: `header ${name} added` });
+  }
+  for (const name of before.headerNames) {
+    if (!nextNames.has(name)) out.push({ kind: "header-removed", impact: "informational", path: name, detail: `header ${name} removed` });
+  }
+  return out;
+}
+
+// packages/canary/src/index.ts
+import { Command, CommanderError } from "commander";
+
+// packages/canary/src/draft.ts
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync2 } from "fs";
+import path6 from "path";
+
+// packages/canary/src/replay.ts
+import { readFileSync as readFileSync4 } from "fs";
+import { z as z5 } from "zod";
+var RecordingSchema = z5.object({
+  provider: z5.string(),
+  method: z5.enum(HTTP_METHODS),
+  endpoint: z5.string().startsWith("/"),
+  note: z5.string().optional(),
+  sources: z5.array(z5.url()).default([]),
+  observations: z5.array(
+    z5.object({
+      observedAt: z5.iso.datetime(),
+      status: z5.number().int(),
+      headers: z5.record(z5.string(), z5.string()).default({}),
+      body: z5.string().default("")
+    })
+  ).min(2)
+});
+function loadRecording(file) {
+  return RecordingSchema.parse(JSON.parse(readFileSync4(file, "utf8")));
+}
+function replay(recording, store, secret) {
+  const salt = providerSalt(recording.provider, secret);
+  const { provider, method, endpoint } = recording;
+  const observations = recording.observations.map(
+    (o) => store.record({
+      provider,
+      method,
+      endpoint,
+      observedAt: o.observedAt,
+      source: "replay",
+      shape: inferShape({ status: o.status, headers: o.headers, body: o.body }, { salt })
+    })
+  );
+  const after = store.latest(provider, method, endpoint, "replay");
+  const before = store.previousDistinct(provider, method, endpoint, "replay");
+  return { recording, observations, after, before, ...before ? { diff: diffShapes(before.shape, after.shape) } : {} };
+}
+
+// packages/repair/src/recipes/status-code-accept-set.ts
+import { Node as Node3, SyntaxKind as SyntaxKind3 } from "ts-morph";
+var STATUS_PROPS = /* @__PURE__ */ new Set(["status", "statusCode"]);
+var statusCodeAcceptSet = {
+  id: "status-code-accept-set",
+  changeClass: "status-code",
+  description: "Accept the new status codes alongside the old ones wherever the response status is compared",
+  edits({ sourceFile, call, advisory }) {
+    const oldCodes = advisory.trigger.statusCodes ?? [];
+    const accept = [.../* @__PURE__ */ new Set([...oldCodes, ...advisory.trigger.newStatusCodes ?? []])].sort((a, b) => a - b);
+    if (oldCodes.length === 0 || accept.length === oldCodes.length) return [];
+    const list = `[${accept.join(", ")}]`;
+    const edits = [];
+    const where = (n) => `${sourceFile.getFilePath().slice(1)}:${n.getStartLineNumber()}`;
+    for (const status of statusExpressions(call)) {
+      let cur = status;
+      while (Node3.isParenthesizedExpression(cur.getParent())) cur = cur.getParent();
+      const parent = cur.getParent();
+      if (Node3.isBinaryExpression(parent)) {
+        const op = parent.getOperatorToken().getKind();
+        const other = parent.getLeft() === cur ? parent.getRight() : parent.getLeft();
+        if (!Node3.isNumericLiteral(other) || !oldCodes.includes(Number(other.getLiteralValue()))) continue;
+        const negated = op === SyntaxKind3.ExclamationEqualsEqualsToken || op === SyntaxKind3.ExclamationEqualsToken;
+        const equal = op === SyntaxKind3.EqualsEqualsEqualsToken || op === SyntaxKind3.EqualsEqualsToken;
+        if (!negated && !equal) continue;
+        const text = `${negated ? "!" : ""}${list}.includes(${status.getText()})`;
+        edits.push({ start: parent.getStart(), end: parent.getEnd(), text, note: `${where(parent)} \`${parent.getText()}\` \u2192 \`${text}\`` });
+      } else if (Node3.isSwitchStatement(parent) && parent.getExpression() === cur) {
+        const cases = parent.getClauses().filter(Node3.isCaseClause);
+        const present = new Set(cases.map((c) => c.getExpression()).filter(Node3.isNumericLiteral).map((l) => Number(l.getLiteralValue())));
+        const anchor = cases.find((c) => {
+          const e = c.getExpression();
+          return Node3.isNumericLiteral(e) && oldCodes.includes(Number(e.getLiteralValue()));
+        });
+        const missing = accept.filter((c) => !present.has(c));
+        if (!anchor || missing.length === 0) continue;
+        const indent = " ".repeat(sourceFile.getLineAndColumnAtPos(anchor.getStart()).column - 1);
+        const text = missing.map((c) => `case ${c}:
+${indent}`).join("");
+        edits.push({ start: anchor.getStart(), end: anchor.getStart(), text, note: `${where(anchor)} add ${missing.map((c) => `case ${c}`).join(", ")}` });
+      } else if (Node3.isCallExpression(parent) && parent.getArguments()[0] === cur) {
+        const callee = parent.getExpression();
+        const arr = Node3.isPropertyAccessExpression(callee) && callee.getName() === "includes" ? callee.getExpression() : void 0;
+        if (!arr || !Node3.isArrayLiteralExpression(arr)) continue;
+        const values = arr.getElements().filter(Node3.isNumericLiteral).map((l) => Number(l.getLiteralValue()));
+        if (!values.some((v) => oldCodes.includes(v))) continue;
+        const merged = [.../* @__PURE__ */ new Set([...values, ...accept])].sort((a, b) => a - b);
+        if (merged.length === values.length) continue;
+        const text = `[${merged.join(", ")}]`;
+        edits.push({ start: arr.getStart(), end: arr.getEnd(), text, note: `${where(arr)} \`${arr.getText()}\` \u2192 \`${text}\`` });
+      }
+    }
+    return edits;
+  }
+};
+function statusExpressions(call) {
+  const out = [];
+  let cur = call;
+  for (; ; ) {
+    const p = cur.getParent();
+    if (p && (Node3.isAwaitExpression(p) || Node3.isParenthesizedExpression(p) || Node3.isAsExpression(p) || Node3.isNonNullExpression(p))) cur = p;
+    else break;
+  }
+  const parent = cur.getParent();
+  const sf = call.getSourceFile();
+  if (Node3.isPropertyAccessExpression(parent) && parent.getExpression() === cur && STATUS_PROPS.has(parent.getName())) out.push(parent);
+  if (Node3.isPropertyAccessExpression(parent) && parent.getName() === "then") {
+    const cb = Node3.isCallExpression(parent.getParent()) ? parent.getParent().getArguments()[0] : void 0;
+    const param = cb && (Node3.isArrowFunction(cb) || Node3.isFunctionExpression(cb)) ? cb.getParameters()[0] : void 0;
+    if (param) out.push(...fromBinding(param.getNameNode(), param, sf));
+  }
+  if (Node3.isVariableDeclaration(parent) && parent.getInitializer() === cur) out.push(...fromBinding(parent.getNameNode(), parent, sf));
+  return out;
+}
+function fromBinding(name, decl, sf) {
+  const out = [];
+  if (Node3.isIdentifier(name)) {
+    for (const ref of references(name.getText(), decl, sf)) {
+      const p = ref.getParent();
+      if (Node3.isPropertyAccessExpression(p) && p.getExpression() === ref && STATUS_PROPS.has(p.getName())) out.push(p);
+    }
+  } else if (Node3.isObjectBindingPattern(name)) {
+    for (const el of name.getElements()) {
+      const prop = el.getPropertyNameNode()?.getText() ?? el.getName();
+      if (STATUS_PROPS.has(prop) && Node3.isIdentifier(el.getNameNode())) out.push(...references(el.getName(), decl, sf));
+    }
+  }
+  return out;
+}
+function references(name, decl, sf) {
+  const scope = decl.getFirstAncestor(
+    (n) => Node3.isBlock(n) || Node3.isArrowFunction(n) || Node3.isFunctionExpression(n) || Node3.isFunctionDeclaration(n) || Node3.isMethodDeclaration(n) || Node3.isCaseClause(n)
+  ) ?? sf;
+  return scope.getDescendantsOfKind(SyntaxKind3.Identifier).filter((id) => {
+    if (id.getText() !== name || id.getStart() < decl.getEnd()) return false;
+    const p = id.getParent();
+    if (Node3.isPropertyAccessExpression(p) && p.getNameNode() === id) return false;
+    if (Node3.isPropertyAssignment(p) && p.getNameNode() === id) return false;
+    return !(Node3.isBindingElement(p) || Node3.isVariableDeclaration(p) || Node3.isParameterDeclaration(p));
+  });
+}
+
+// packages/repair/src/recipe.ts
+import { Project as Project2, ScriptKind as ScriptKind2, SyntaxKind as SyntaxKind4 } from "ts-morph";
+function findCall(sf, site) {
+  return sf.getDescendantsOfKind(SyntaxKind4.CallExpression).filter((c) => {
+    const pos = sf.getLineAndColumnAtPos(c.getStart());
+    return pos.line === site.line && pos.column === site.column;
+  }).sort((a, b) => a.getWidth() - b.getWidth())[0];
+}
+function applyEdits(text, edits) {
+  let out = text;
+  for (const e of [...edits].sort((a, b) => b.start - a.start)) out = out.slice(0, e.start) + e.text + out.slice(e.end);
+  return out;
+}
+function runRecipe(recipes, advisory, callSite, text) {
+  const recipe = advisory.recipeId ? recipes[advisory.recipeId] : void 0;
+  if (!recipe) return { status: "no-recipe", reason: advisory.recipeId ? `unknown recipe ${advisory.recipeId}` : "advisory names no recipe" };
+  const project = new Project2({ useInMemoryFileSystem: true, skipFileDependencyResolution: true, compilerOptions: { allowJs: true } });
+  const kind = /\.(c|m)?jsx?$/.test(callSite.file) ? ScriptKind2.JS : callSite.file.endsWith("x") ? ScriptKind2.TSX : ScriptKind2.TS;
+  const sourceFile = project.createSourceFile(`/${callSite.file}`, text, { scriptKind: kind });
+  const call = findCall(sourceFile, callSite);
+  if (!call) return { status: "call-not-found", recipe: recipe.id, reason: `no call at ${callSite.file}:${callSite.line}:${callSite.column}` };
+  const edits = recipe.edits({ sourceFile, call, callSite, advisory });
+  if (edits.length === 0) return { status: "no-change", recipe: recipe.id, reason: "recipe found nothing to change" };
+  return {
+    status: "applied",
+    recipe: recipe.id,
+    change: { file: callSite.file, before: text, after: applyEdits(text, edits), notes: edits.map((e) => e.note) }
+  };
+}
+
+// packages/repair/src/contract.ts
+import path7 from "path";
+import { Node as Node4, Project as Project3, ScriptKind as ScriptKind3, SyntaxKind as SyntaxKind5 } from "ts-morph";
+
+// packages/repair/src/synth.ts
+function synthesizeBody(shape) {
+  if (shape.body.kind !== "json") return null;
+  const root = { children: /* @__PURE__ */ new Map() };
+  for (const field of shape.body.fields) {
+    if (field.path === void 0) throw new Error("cannot synthesize from a redacted shape (field paths removed)");
+    let node = root;
+    for (const token of tokens(field.path)) {
+      if (token === "[]") node = node.item ??= { children: /* @__PURE__ */ new Map() };
+      else {
+        let child = node.children.get(token);
+        if (!child) node.children.set(token, child = { children: /* @__PURE__ */ new Map() });
+        node = child;
+      }
+    }
+    node.field = field;
+  }
+  return value(root, shape.body.rootType === "array" ? "array" : "object");
+}
+function tokens(path13) {
+  const out = [];
+  for (const part of path13.split(".")) {
+    const m = /^([^[]*)((?:\[\])*)$/.exec(part);
+    if (m[1]) out.push(m[1]);
+    for (let i = 0; i < m[2].length / 2; i++) out.push("[]");
+  }
+  return out;
+}
+function value(node, forced) {
+  const types = node.field?.types.filter((t) => t !== "null") ?? [];
+  const kind = forced ?? (node.item || types.includes("array") ? "array" : node.children.size > 0 || types.includes("object") ? "object" : types[0]);
+  if (kind === "array") return node.item ? [value(node.item)] : [];
+  if (kind === "object") return Object.fromEntries([...node.children].map(([k, child]) => [k, value(child)]));
+  const classes = node.field?.classes ?? [];
+  switch (kind) {
+    case "integer":
+      return classes.includes("negative") ? -1 : classes.includes("zero") && !classes.includes("positive") ? 0 : 1;
+    case "number":
+      return classes.includes("negative") ? -1.5 : 1.5;
+    case "boolean":
+      return !classes.includes("false") || classes.includes("true");
+    case "string":
+      return sampleString(classes);
+    default:
+      return null;
+  }
+}
+function sampleString(classes) {
+  if (classes.includes("datetime")) return "2026-01-01T00:00:00Z";
+  if (classes.includes("date")) return "2026-01-01";
+  if (classes.includes("uuid")) return "00000000-0000-4000-8000-000000000000";
+  if (classes.includes("url")) return "https://example.com/shapi";
+  if (classes.includes("email")) return "shapi@example.com";
+  if (classes.includes("id")) return "id_shapi00000001";
+  if (classes.includes("token")) return "shapi_value";
+  return "shapi text";
+}
+
+// packages/repair/src/contract.ts
+var CONTRACT_DIR = "test/shapi";
+function generateContractTest(input) {
+  const { callSite, advisory, before, after } = input;
+  if (callSite.kind !== "http" || callSite.client !== "fetch") {
+    return { status: "unsupported", reason: `contract tests support global fetch call sites; this one uses ${callSite.client}` };
+  }
+  const project = new Project3({ useInMemoryFileSystem: true, skipFileDependencyResolution: true, compilerOptions: { allowJs: true } });
+  const sf = project.createSourceFile(`/${callSite.file}`, input.sourceText, {
+    scriptKind: /\.(c|m)?jsx?$/.test(callSite.file) ? ScriptKind3.JS : ScriptKind3.TS
+  });
+  const call = findCall(sf, callSite);
+  if (!call) return { status: "unsupported", reason: `no call at ${callSite.file}:${callSite.line}:${callSite.column}` };
+  const fn = exportedFunction(call);
+  if (!fn) return { status: "unsupported", reason: "the call site is not inside an exported function" };
+  let responses;
+  try {
+    responses = [response(`before (${before.status})`, before), response(`after (${after.status})`, after)].join(",\n");
+  } catch (err) {
+    return { status: "unsupported", reason: err instanceof Error ? err.message : String(err) };
+  }
+  const file = `${CONTRACT_DIR}/${advisory.id}.test.ts`;
+  const importPath = toImport(path7.posix.relative(path7.posix.dirname(file), callSite.file));
+  const args = fn.params.map((p) => argument(p, sf)).join(", ");
+  const content = `// Generated by SHAPI for advisory ${advisory.id}: ${advisory.title}
+// Call site: ${callSite.file}:${callSite.line} (${callSite.method} ${callSite.endpoint})
+// Calls ${fn.name}() with fetch returning the response the code was written for and the one
+// ${advisory.provider} sends now. It fails while the code accepts only the old response.
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { ${fn.name} } from "${importPath}";
+
+const responses = [
+${responses},
+];
+
+describe("SHAPI contract: ${advisory.id}", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  for (const r of responses) {
+    it(\`${fn.name} handles the \${r.name} response\`, async () => {
+      const fetchMock = vi.fn(async () => new Response(r.body === null ? null : JSON.stringify(r.body), { status: r.status, headers: r.headers }));
+      vi.stubGlobal("fetch", fetchMock);
+      await ${fn.name}(${args});
+      expect(fetchMock).toHaveBeenCalled();
+    });
+  }
+});
+`;
+  return { status: "generated", file, content, functionName: fn.name };
+}
+function response(name, shape) {
+  const body2 = synthesizeBody(shape);
+  const headers = shape.headers["content-type"] ? { "content-type": shape.headers["content-type"] } : {};
+  return `  { name: ${JSON.stringify(name)}, status: ${shape.status}, headers: ${JSON.stringify(headers)}, body: ${JSON.stringify(body2)} }`;
+}
+function exportedFunction(call) {
+  for (const anc of call.getAncestors()) {
+    if (Node4.isFunctionDeclaration(anc) && anc.isExported() && anc.getName()) return { name: anc.getName(), params: anc.getParameters() };
+    if (Node4.isArrowFunction(anc) || Node4.isFunctionExpression(anc)) {
+      const decl = anc.getParent();
+      if (Node4.isVariableDeclaration(decl) && decl.getVariableStatement()?.isExported()) return { name: decl.getName(), params: anc.getParameters() };
+    }
+  }
+  return void 0;
+}
+function argument(p, sf) {
+  const type = p.getTypeNode();
+  return type ? valueFor(type, p.getName(), sf, 0) : JSON.stringify(`shapi-${p.getName()}`);
+}
+function valueFor(type, name, sf, depth) {
+  if (depth > 4) return "undefined as never";
+  switch (type.getKind()) {
+    case SyntaxKind5.StringKeyword:
+      return JSON.stringify(`shapi-${name}`);
+    case SyntaxKind5.NumberKeyword:
+      return "1";
+    case SyntaxKind5.BooleanKeyword:
+      return "true";
+  }
+  if (Node4.isTypeLiteral(type)) return objectFrom(type.getProperties(), sf, depth);
+  if (Node4.isTypeReference(type)) {
+    const ref = type.getTypeName().getText();
+    const iface = sf.getInterface(ref);
+    if (iface) return objectFrom(iface.getProperties(), sf, depth);
+    const alias = sf.getTypeAlias(ref)?.getTypeNode();
+    if (alias) return valueFor(alias, name, sf, depth + 1);
+  }
+  if (Node4.isArrayTypeNode(type)) return "[]";
+  return "undefined as never";
+}
+function objectFrom(props, sf, depth) {
+  const entries = props.filter((p) => !p.hasQuestionToken()).map((p) => {
+    const t = p.getTypeNode();
+    return `${JSON.stringify(p.getName())}: ${t ? valueFor(t, p.getName(), sf, depth + 1) : "undefined as never"}`;
+  });
+  return `{ ${entries.join(", ")} }`;
+}
+function toImport(rel) {
+  const noExt = rel.replace(/\.(c|m)?[jt]sx?$/, "");
+  return noExt.startsWith(".") ? noExt : `./${noExt}`;
+}
+
+// packages/repair/src/agent.ts
+import path10 from "path";
+
+// packages/repair/src/runner.ts
+import { spawnSync } from "child_process";
+import { existsSync } from "fs";
+import { createRequire } from "module";
+import path8 from "path";
+function vitestCli(dir) {
+  const local = path8.join(dir, "node_modules", "vitest", "vitest.mjs");
+  if (existsSync(local)) return local;
+  const require2 = createRequire(import.meta.url);
+  return path8.join(path8.dirname(require2.resolve("vitest/package.json")), "vitest.mjs");
+}
+function runTestFile(dir, file, timeoutMs = 12e4) {
+  const res = spawnSync(process.execPath, [vitestCli(dir), "run", file, "--root", dir, "--reporter", "verbose", "--no-color"], {
+    cwd: dir,
+    encoding: "utf8",
+    timeout: timeoutMs,
+    env: { ...process.env, FORCE_COLOR: "0", CI: "1" }
+  });
+  const output = `${res.stdout ?? ""}${res.stderr ?? ""}${res.error ? `
+${res.error.message}` : ""}`;
+  const exitCode = res.status ?? 1;
+  return { passed: exitCode === 0, exitCode, output };
+}
+function testsRan(output) {
+  return /^\s*Tests\s+.*\d+ (?:failed|passed)/m.test(output);
+}
+function runFailure(output) {
+  const lines = output.split("\n").map((l) => l.trim()).filter(Boolean);
+  return lines.find((l) => /\b\w*Error: |\berror: /i.test(l)) ?? lines.find((l) => /Cannot find|not found|Error/.test(l)) ?? lines[0] ?? "no output";
+}
+
+// packages/repair/src/workspace.ts
+import { cpSync, existsSync as existsSync2, mkdirSync as mkdirSync4, mkdtempSync, readFileSync as readFileSync5, symlinkSync, writeFileSync as writeFileSync3 } from "fs";
+import os from "os";
+import path9 from "path";
+var COPY_SKIP = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "coverage", ".shapi"]);
+function localWorkspace(repoDir) {
+  const dir = mkdtempSync(path9.join(os.tmpdir(), "shapi-repair-"));
+  cpSync(repoDir, dir, {
+    recursive: true,
+    filter: (src) => !COPY_SKIP.has(path9.basename(src)) || path9.resolve(src) === path9.resolve(repoDir)
+  });
+  const modules = path9.join(repoDir, "node_modules");
+  if (existsSync2(modules)) symlinkSync(modules, path9.join(dir, "node_modules"), "junction");
+  return {
+    location: dir,
+    async read(file) {
+      const abs = path9.join(dir, file);
+      return existsSync2(abs) ? readFileSync5(abs, "utf8") : void 0;
+    },
+    async write(file, content) {
+      const abs = path9.join(dir, file);
+      mkdirSync4(path9.dirname(abs), { recursive: true });
+      writeFileSync3(abs, content);
+    },
+    async runTest(file) {
+      return runTestFile(dir, file);
+    }
+  };
+}
+
+// packages/repair/src/agent.ts
+var PROTECTED = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "coverage", ".shapi"]);
+async function repairCallSite(input) {
+  const { advisory, callSite } = input;
+  if (!input.workspace && !input.repoDir) throw new Error("repairCallSite needs a workspace or a repoDir");
+  const ws = input.workspace ?? localWorkspace(input.repoDir);
+  const original = await ws.read(callSite.file);
+  if (original === void 0) return { status: "unsupported", sandbox: ws.location, changes: [], attempts: [], reason: `${callSite.file} is not in the repository` };
+  const test = generateContractTest({ callSite, advisory, before: input.before, after: input.after, sourceText: original });
+  if (test.status !== "generated") return { status: "unsupported", changes: [], attempts: [], reason: test.reason };
+  await ws.write(test.file, test.content);
+  const testChange = { file: test.file, before: "", after: test.content, notes: ["generated contract test"] };
+  const baseline = await ws.runTest(test.file);
+  if (!baseline.passed && !testsRan(baseline.output)) {
+    return {
+      status: "unsupported",
+      sandbox: ws.location,
+      changes: [],
+      test: { file: test.file, content: test.content },
+      baseline,
+      attempts: [],
+      reason: `the contract test could not run: ${runFailure(baseline.output)}`
+    };
+  }
+  if (baseline.passed) {
+    return {
+      status: "already-handled",
+      sandbox: ws.location,
+      changes: [],
+      test: { file: test.file, content: test.content },
+      baseline,
+      attempts: [],
+      reason: "the contract test already passes against the new response"
+    };
+  }
+  const attempts = [];
+  const recipe = runRecipe(input.recipes, advisory, callSite, original);
+  if (recipe.status === "applied") {
+    await ws.write(callSite.file, recipe.change.after);
+    const run3 = await ws.runTest(test.file);
+    attempts.push({ method: "recipe", outcome: run3.passed ? "passed" : "failed", detail: recipe.recipe, run: run3 });
+    if (run3.passed) {
+      return { status: "fixed", method: "recipe", sandbox: ws.location, changes: [recipe.change, testChange], test: { file: test.file, content: test.content }, baseline, attempts };
+    }
+    await ws.write(callSite.file, original);
+  } else {
+    attempts.push({ method: "recipe", outcome: "skipped", detail: recipe.reason });
+  }
+  if (!input.llm) {
+    attempts.push({ method: "llm", outcome: "skipped", detail: "no LLM fixer configured" });
+    return rejected(ws, test, baseline, attempts);
+  }
+  const proposal = await input.llm.fix({
+    advisory,
+    callSite,
+    file: { path: callSite.file, content: original },
+    test: { path: test.file, content: test.content },
+    failingOutput: baseline.output
+  });
+  if (proposal.status !== "proposed") {
+    attempts.push({ method: "llm", outcome: "skipped", detail: proposal.reason });
+    return rejected(ws, test, baseline, attempts);
+  }
+  const changes = [];
+  for (const f of proposal.files) {
+    const rel = path10.posix.normalize(f.path.replaceAll("\\", "/"));
+    if (rel.startsWith("..") || path10.posix.isAbsolute(rel) || rel === test.file || rel.split("/").some((s) => PROTECTED.has(s))) {
+      attempts.push({ method: "llm", outcome: "failed", detail: `refused to write ${f.path}: outside the repo, the test, or a protected folder` });
+      await restore(ws, changes);
+      return rejected(ws, test, baseline, attempts);
+    }
+    const before = await ws.read(rel) ?? "";
+    await ws.write(rel, f.content);
+    changes.push({ file: rel, before, after: f.content, notes: [proposal.explanation] });
+  }
+  const run2 = await ws.runTest(test.file);
+  attempts.push({ method: "llm", outcome: run2.passed ? "passed" : "failed", detail: `${proposal.model}: ${proposal.explanation}`, run: run2 });
+  if (run2.passed) {
+    return { status: "fixed", method: "llm", sandbox: ws.location, changes: [...changes, testChange], test: { file: test.file, content: test.content }, baseline, attempts };
+  }
+  await restore(ws, changes);
+  return rejected(ws, test, baseline, attempts);
+}
+function rejected(ws, test, baseline, attempts) {
+  return {
+    status: "rejected",
+    sandbox: ws.location,
+    changes: [],
+    test: { file: test.file, content: test.content },
+    baseline,
+    attempts,
+    reason: "no change made the contract test pass"
+  };
+}
+async function restore(ws, changes) {
+  for (const c of changes) await ws.write(c.file, c.before);
+}
+
+// packages/repair/src/llm.ts
+import Anthropic from "@anthropic-ai/sdk";
+import { z as z6 } from "zod";
+var DEFAULT_REPAIR_MODEL = "claude-fable-5-1";
+var ProposalSchema = z6.object({
+  files: z6.array(z6.object({ path: z6.string().min(1), content: z6.string() })).min(1),
+  explanation: z6.string()
+});
+var SUBMIT_FIX = {
+  name: "submit_fix",
+  description: "Submit the corrected files. Each entry is a repo-relative path and the file's complete new content (not a diff). Include only files you changed. Never include the contract test.",
+  strict: true,
+  input_schema: {
+    type: "object",
+    properties: {
+      files: {
+        type: "array",
+        items: {
+          type: "object",
+          properties: { path: { type: "string" }, content: { type: "string" } },
+          required: ["path", "content"],
+          additionalProperties: false
+        }
+      },
+      explanation: { type: "string", description: "One or two sentences on what changed and why, for the pull request." }
+    },
+    required: ["files", "explanation"],
+    additionalProperties: false
+  }
+};
+var SYSTEM = `You repair third-party API integrations after the provider changed its behavior.
+You get a breaking-change advisory, the call site that depends on the old behavior, the file around it, and a contract test that calls the code with the old response and with the new one. The test currently fails on the new response.
+Make the smallest change that lets the code handle both responses. Keep its behavior for the old response, keep the file's style, and do not touch unrelated code. Do not edit the test.
+When done, call submit_fix with the complete content of each file you changed. If no safe change exists, explain why in text and do not call the tool.`;
+function claudeFixer(opts = {}) {
+  const client = opts.client ?? new Anthropic();
+  const model = opts.model ?? process.env.SHAPI_REPAIR_MODEL ?? DEFAULT_REPAIR_MODEL;
+  return {
+    async fix(req) {
+      let response2;
+      try {
+        response2 = await client.beta.messages.create({
+          model,
+          max_tokens: 16e3,
+          // Thinking is always on for this model; effort sets its depth.
+          output_config: { effort: "high" },
+          // On a safety-classifier decline, retry server-side on Anthropic's recommended fallback model.
+          betas: ["server-side-fallback-2026-07-01"],
+          fallbacks: "default",
+          system: SYSTEM,
+          tools: [SUBMIT_FIX],
+          tool_choice: { type: "auto" },
+          messages: [{ role: "user", content: prompt(req) }]
+        });
+      } catch (err) {
+        if (err instanceof Anthropic.AuthenticationError) return { status: "declined", reason: "Claude API authentication failed (set ANTHROPIC_API_KEY)" };
+        if (err instanceof Anthropic.RateLimitError) return { status: "declined", reason: "Claude API rate limit reached; retry later" };
+        if (err instanceof Anthropic.APIError) return { status: "declined", reason: `Claude API error ${err.status ?? ""}: ${err.message}`.trim() };
+        throw err;
+      }
+      if (response2.stop_reason === "refusal") {
+        return { status: "declined", reason: `model declined (${response2.stop_details?.category ?? "no category"})` };
+      }
+      if (response2.stop_reason === "max_tokens") return { status: "declined", reason: "response hit max_tokens before finishing" };
+      const call = response2.content.find((b) => b.type === "tool_use" && b.name === "submit_fix");
+      if (!call) {
+        const text = response2.content.filter((b) => b.type === "text").map((b) => b.text).join("\n");
+        return { status: "declined", reason: text.trim() || "model did not submit a fix" };
+      }
+      const parsed = ProposalSchema.safeParse(call.input);
+      if (!parsed.success) return { status: "declined", reason: `fix did not match the submit_fix schema: ${z6.prettifyError(parsed.error)}` };
+      return { status: "proposed", ...parsed.data, model: response2.model };
+    }
+  };
+}
+function prompt(req) {
+  const { advisory, callSite } = req;
+  return `<advisory>
+${JSON.stringify(
+    {
+      id: advisory.id,
+      provider: advisory.provider,
+      title: advisory.title,
+      summary: advisory.summary,
+      endpoint: advisory.endpoint,
+      changeClass: advisory.changeClass,
+      trigger: advisory.trigger,
+      migrationNote: advisory.migrationNote
+    },
+    null,
+    2
+  )}
+</advisory>
+
+<call_site>${callSite.file}:${callSite.line}:${callSite.column} ${callSite.method ?? "?"} ${callSite.endpoint ?? "?"}</call_site>
+
+<file path="${req.file.path}">
+${req.file.content}
+</file>
+
+<contract_test path="${req.test.path}">
+${req.test.content}
+</contract_test>
+
+<failing_test_output>
+${req.failingOutput.slice(-6e3)}
+</failing_test_output>`;
+}
+
+// packages/repair/src/index.ts
+var RECIPES = {
+  [statusCodeAcceptSet.id]: statusCodeAcceptSet
+};
+
+// packages/github-app/src/pr.ts
+import { execFileSync } from "child_process";
+import { readFileSync as readFileSync6 } from "fs";
+import { createAppAuth } from "@octokit/auth-app";
+import { Octokit } from "@octokit/rest";
+
+// packages/github-app/src/policy.ts
+var STOP_LABEL = "shapi:stop";
+
+// packages/github-app/src/pr.ts
+function octokitFor(auth, opts = {}) {
+  const request = opts.fetch ? { fetch: opts.fetch } : void 0;
+  if ("token" in auth) return new Octokit({ auth: auth.token, userAgent: "shapi", request });
+  return new Octokit({
+    authStrategy: createAppAuth,
+    auth: { appId: auth.appId, privateKey: auth.privateKey, installationId: auth.installationId },
+    userAgent: "shapi",
+    request
+  });
+}
+function authFromEnv(env = process.env) {
+  const key = env.SHAPI_GITHUB_APP_PRIVATE_KEY ?? (env.SHAPI_GITHUB_APP_PRIVATE_KEY_PATH ? readFileSync6(env.SHAPI_GITHUB_APP_PRIVATE_KEY_PATH, "utf8") : void 0);
+  if (env.SHAPI_GITHUB_APP_ID && env.SHAPI_GITHUB_APP_INSTALLATION_ID && key) {
+    return { appId: env.SHAPI_GITHUB_APP_ID, privateKey: key, installationId: Number(env.SHAPI_GITHUB_APP_INSTALLATION_ID) };
+  }
+  const token = env.GITHUB_TOKEN ?? env.GH_TOKEN;
+  if (token) return { token };
+  try {
+    const fromGh = execFileSync("gh", ["auth", "token"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return fromGh ? { token: fromGh } : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var FIX_TRAILER = "SHAPI-Branch";
+async function upsertFixPr(octokit, pr) {
+  const { owner, repo } = splitRepo(pr.repo);
+  const message = `${pr.commitMessage.trimEnd()}
+
+${FIX_TRAILER}: ${pr.branch}`;
+  const { data: prs } = await octokit.rest.pulls.list({ owner, repo, head: `${owner}:${pr.branch}`, state: "all", sort: "created", direction: "desc", per_page: 10 });
+  const openPr = prs.find((p) => p.state === "open");
+  const latest = prs[0];
+  const closedByMaintainer = !openPr && latest && !latest.merged_at;
+  if (closedByMaintainer && !pr.retryClosed) {
+    return { action: "skipped", reason: "closed without merging", branch: pr.branch, url: latest.html_url, number: latest.number, state: "closed" };
+  }
+  const head = await branchHead(octokit, owner, repo, pr.branch);
+  const ours = head ? (await octokit.rest.git.getCommit({ owner, repo, commit_sha: head })).data.message.includes(`${FIX_TRAILER}: ${pr.branch}`) : true;
+  if (openPr) {
+    const found = { branch: pr.branch, url: openPr.html_url, number: openPr.number, state: "open" };
+    if (openPr.labels.some((l) => l.name === STOP_LABEL)) return { action: "skipped", reason: `labeled ${STOP_LABEL}`, ...found };
+    if (!ours) return { action: "skipped", reason: "someone else pushed to the branch", ...found };
+    const conflicted = (await octokit.rest.pulls.get({ owner, repo, pull_number: openPr.number })).data.mergeable === false;
+    if (head && !conflicted && await filesMatch(octokit, owner, repo, head, pr.files)) {
+      if (openPr.title !== pr.title || (openPr.body ?? "") !== pr.body) {
+        await octokit.rest.pulls.update({ owner, repo, pull_number: openPr.number, title: pr.title, body: pr.body });
+      }
+      return { action: "unchanged", url: openPr.html_url, number: openPr.number, branch: pr.branch, commit: head };
+    }
+    const commit2 = await commitOnBase(octokit, owner, repo, openPr.base.ref, pr.files, message);
+    await octokit.rest.git.updateRef({ owner, repo, ref: `heads/${pr.branch}`, sha: commit2, force: true });
+    await octokit.rest.pulls.update({ owner, repo, pull_number: openPr.number, title: pr.title, body: pr.body });
+    return { action: "updated", url: openPr.html_url, number: openPr.number, branch: pr.branch, commit: commit2 };
+  }
+  if (head && !ours && !latest?.merged_at && !closedByMaintainer) return { action: "skipped", reason: "a branch with this name exists and is not SHAPI's", branch: pr.branch };
+  const base = pr.base ?? (await octokit.rest.repos.get({ owner, repo })).data.default_branch;
+  const commit = await commitOnBase(octokit, owner, repo, base, pr.files, message);
+  if (head) await octokit.rest.git.updateRef({ owner, repo, ref: `heads/${pr.branch}`, sha: commit, force: true });
+  else await octokit.rest.git.createRef({ owner, repo, ref: `refs/heads/${pr.branch}`, sha: commit });
+  const opened = await octokit.rest.pulls.create({ owner, repo, head: pr.branch, base, title: pr.title, body: pr.body });
+  if (pr.labels?.length) await octokit.rest.issues.addLabels({ owner, repo, issue_number: opened.data.number, labels: pr.labels });
+  return { action: "created", url: opened.data.html_url, number: opened.data.number, branch: pr.branch, commit };
+}
+function splitRepo(full) {
+  const [owner, repo] = full.split("/");
+  if (!owner || !repo) throw new Error(`repo must be owner/name, got ${full}`);
+  return { owner, repo };
+}
+async function branchHead(octokit, owner, repo, branch) {
+  const { data } = await octokit.rest.git.listMatchingRefs({ owner, repo, ref: `heads/${branch}` });
+  return data.find((r) => r.ref === `refs/heads/${branch}`)?.object.sha;
+}
+async function commitOnBase(octokit, owner, repo, base, files, message) {
+  const baseSha = (await octokit.rest.git.getRef({ owner, repo, ref: `heads/${base}` })).data.object.sha;
+  const baseTree = (await octokit.rest.git.getCommit({ owner, repo, commit_sha: baseSha })).data.tree.sha;
+  const existing = new Set(
+    (await octokit.rest.git.getTree({ owner, repo, tree_sha: baseTree, recursive: "true" })).data.tree.map((e) => e.path)
+  );
+  const contents = await Promise.all(
+    files.map(async (f) => ({
+      ...f,
+      content: existing.has(f.path) ? await matchLineEndings(octokit, owner, repo, base, f.path, f.content) : f.content.replace(/\r\n/g, "\n")
+    }))
+  );
+  const tree = await octokit.rest.git.createTree({
+    owner,
+    repo,
+    base_tree: baseTree,
+    tree: contents.map((f) => ({ path: f.path, mode: "100644", type: "blob", content: f.content }))
+  });
+  const commit = await octokit.rest.git.createCommit({ owner, repo, message, tree: tree.data.sha, parents: [baseSha] });
+  return commit.data.sha;
+}
+async function readFile(octokit, owner, repo, ref, filePath) {
+  try {
+    const res = await octokit.rest.repos.getContent({ owner, repo, path: filePath, ref });
+    return !Array.isArray(res.data) && res.data.type === "file" && "content" in res.data ? Buffer.from(res.data.content, "base64").toString("utf8") : void 0;
+  } catch (err) {
+    if (err.status === 404) return void 0;
+    throw err;
+  }
+}
+async function filesMatch(octokit, owner, repo, ref, files) {
+  const lf = (s) => s.replace(/\r\n/g, "\n");
+  for (const f of files) {
+    const current = await readFile(octokit, owner, repo, ref, f.path);
+    if (current === void 0 || lf(current) !== lf(f.content)) return false;
+  }
+  return true;
+}
+async function matchLineEndings(octokit, owner, repo, ref, filePath, content) {
+  const current = await readFile(octokit, owner, repo, ref, filePath) ?? "";
+  const lf = content.replace(/\r\n/g, "\n");
+  return current.includes("\r\n") ? lf.replace(/\n/g, "\r\n") : lf;
+}
+function repoFromUrl(url) {
+  const m = /github\.com[/:]([^/]+)\/([^/]+?)(?:\.git)?\/?$/.exec(url.trim());
+  return m ? `${m[1]}/${m[2]}` : void 0;
+}
+
+// packages/github-app/src/body.ts
+function prTitle(advisory) {
+  return `SHAPI: ${advisory.title}`;
+}
+function prBranch(advisory) {
+  return `shapi/${advisory.id}`;
+}
+function renderPrBody({ advisory, callSite, result, affectedInRepo, shapeSource }) {
+  const source = result.changes.filter((c) => c.file !== result.test?.file);
+  const notes = source.flatMap((c) => c.notes.map((n) => `- ${n}`));
+  const method = result.method === "recipe" ? `deterministic recipe \`${advisory.recipeId}\`` : "Claude, verified by the contract test";
+  const evidence = advisory.evidence;
+  const lines = [
+    `**${advisory.provider}** changed \`${advisory.endpoint.method} ${advisory.endpoint.path}\`: ${advisory.title}.`,
+    "",
+    advisory.summary,
+    "",
+    "### Affected call site",
+    `\`${callSite.file}:${callSite.line}\` (${callSite.method} ${callSite.endpoint})`,
+    "",
+    `### Change (${method})`,
+    ...notes.length ? notes : source.map((c) => `- \`${c.file}\``),
+    "",
+    "### Contract test",
+    `Added \`${result.test?.file}\`. It calls the code with the response it was written for and the response ${advisory.provider} sends now.`,
+    "",
+    "| Run | Result |",
+    "|---|---|",
+    `| Before this change | ${summary(result.baseline)} |`,
+    `| After this change | ${summary(result.attempts.find((a) => a.outcome === "passed")?.run)} |`,
+    "",
+    "### Evidence",
+    "| | |",
+    "|---|---|",
+    `| Advisory | \`${advisory.id}\` (${advisory.status}) |`,
+    `| Severity | ${advisory.severity} |`,
+    `| Change class | ${advisory.changeClass} |`,
+    `| First observed | ${advisory.firstObserved ?? "unknown"} |`,
+    `| Provider notice | ${advisory.publishedNotice ? `[${advisory.publishedNotice.date ?? "link"}](${advisory.publishedNotice.url})` : "none (undocumented change)"} |`,
+    `| Shapes from | ${shapeSource} |`,
+    ...evidence ? [`| Observed | ${evidence.before.status} at ${evidence.before.observedAt} \u2192 ${evidence.after.status} at ${evidence.after.observedAt} (${evidence.source}) |`] : [],
+    `| Blast radius | ${affectedInRepo} affected call site${affectedInRepo === 1 ? "" : "s"} in this repo |`,
+    `| Sources | ${advisory.sources.map((s, i) => `[${i + 1}](${s})`).join(" ")} |`,
+    "",
+    `Migration note: ${advisory.migrationNote}`,
+    "",
+    "---",
+    "Opened by [SHAPI](https://github.com/SriVarshini09/YC). The change was kept only because the contract test failed before it and passes after it."
+  ];
+  return lines.join("\n") + "\n";
+}
+function summary(run2) {
+  if (!run2) return "not run";
+  const m = /Tests\s+([^\n]+?)\s*\(\d+\)/.exec(run2.output);
+  return `${run2.passed ? "pass" : "fail"}${m ? ` (${m[1].trim()})` : ""}`;
+}
+
+// packages/github-app/src/app.ts
+import { createHmac as createHmac2, timingSafeEqual } from "crypto";
+import { createAppAuth as createAppAuth2 } from "@octokit/auth-app";
+
+// packages/github-app/src/client.ts
+import { retry } from "@octokit/plugin-retry";
+import { throttling } from "@octokit/plugin-throttling";
+import { Octokit as Octokit2 } from "@octokit/rest";
+var ResilientOctokit = Octokit2.plugin(throttling, retry);
+
+// packages/github-app/src/snapshot.ts
+import { Parser } from "tar";
+
+// packages/cli/src/scan.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { mkdtempSync as mkdtempSync2, rmSync } from "fs";
+import os2 from "os";
+import path11 from "path";
+
+// packages/cli/src/paths.ts
+import { existsSync as existsSync3 } from "fs";
+import { fileURLToPath } from "url";
+function bundledDir(published, monorepo) {
+  const candidates = [new URL(`../${published}`, import.meta.url), new URL(`../../../${monorepo}`, import.meta.url)].map((u) => fileURLToPath(u));
+  return candidates.find((p) => existsSync3(p)) ?? candidates[candidates.length - 1];
+}
+
+// packages/cli/src/scan.ts
+var VERSION = "0.1.0";
+var DEFAULT_ADVISORIES = bundledDir("advisories", "advisories");
+function scan(target, opts) {
+  const started = performance.now();
+  const failOn = parseFailOn(opts.failOn ?? "critical");
+  const now = opts.now ? new Date(opts.now) : /* @__PURE__ */ new Date();
+  if (Number.isNaN(now.getTime())) throw new Error(`--now: not a date: ${opts.now}`);
+  let dir = path11.resolve(target ?? ".");
+  let label2 = target ?? ".";
+  let cleanup;
+  if (opts.repo) {
+    if (opts.repo.startsWith("-")) throw new Error(`--repo: not a repository URL: ${opts.repo}`);
+    cleanup = mkdtempSync2(path11.join(os2.tmpdir(), "shapi-scan-"));
+    execFileSync2("git", ["-c", "core.autocrlf=false", "clone", "--depth", "1", "--quiet", "--", opts.repo, cleanup], { stdio: ["ignore", "ignore", "pipe"] });
+    dir = cleanup;
+    label2 = opts.repo;
+  }
+  try {
+    const extracted = extractCallSites(dir);
+    const lock = createApiLock(extracted, `shapi ${VERSION}`);
+    if (opts.out) writeApiLock(opts.out, lock);
+    const advisories = loadAdvisories(opts.advisories ?? DEFAULT_ADVISORIES);
+    const match = matchAdvisories(lock, advisories, { now });
+    const failing = failOn === "none" ? [] : match.affected.filter((f) => SEVERITY_RANK[f.advisory.severity] <= SEVERITY_RANK[failOn]);
+    return {
+      label: label2,
+      filesScanned: extracted.filesScanned,
+      lock,
+      match,
+      elapsedMs: Math.round(performance.now() - started),
+      exitCode: failing.length > 0 ? 1 : 0
+    };
+  } finally {
+    if (cleanup) rmSync(cleanup, { recursive: true, force: true });
+  }
+}
+function parseFailOn(value2) {
+  if (value2 === "none" || SEVERITIES.includes(value2)) return value2;
+  throw new Error(`--fail-on: expected one of ${[...SEVERITIES, "none"].join(", ")}, got ${value2}`);
+}
+function toJsonReport(o) {
+  const finding = (f) => ({
+    advisory: f.advisory.id,
+    severity: f.advisory.severity,
+    title: f.advisory.title,
+    callSite: f.callSite.id,
+    file: f.callSite.file,
+    line: f.callSite.line,
+    method: f.callSite.method,
+    endpoint: f.callSite.endpoint,
+    reasons: f.reasons,
+    migrationNote: f.advisory.migrationNote
+  });
+  return {
+    target: o.label,
+    filesScanned: o.filesScanned,
+    affected: o.match.affected.map(finding),
+    exposed: o.match.exposed.map(finding),
+    upcoming: o.match.upcoming.map((u) => ({
+      advisory: u.advisory.id,
+      provider: u.advisory.provider,
+      title: u.advisory.title,
+      effectiveDate: u.advisory.effectiveDate,
+      daysUntil: u.daysUntil,
+      callSites: u.callSites
+    })),
+    lock: o.lock
+  };
+}
+
+// packages/cli/src/fix.ts
+var DEFAULT_RECORDINGS = bundledDir("recordings", "fixtures/recordings");
+async function fix(target, opts, deps) {
+  let dir = path12.resolve(target ?? ".");
+  let cleanup;
+  let remote = opts.repo ? repoFromUrl(opts.repo) : void 0;
+  if (opts.repo) {
+    if (opts.repo.startsWith("-")) throw new Error(`--repo: not a repository URL: ${opts.repo}`);
+    cleanup = mkdtempSync3(path12.join(os3.tmpdir(), "shapi-fix-"));
+    execFileSync3("git", ["-c", "core.autocrlf=false", "clone", "--depth", "1", "--quiet", "--", opts.repo, cleanup], { stdio: ["ignore", "ignore", "pipe"] });
+    dir = cleanup;
+  } else if (opts.pr) {
+    remote = originRepo(dir);
+  }
+  if (opts.pr && !remote) throw new Error("--pr needs a GitHub repository: pass --repo <github url> or run inside a clone whose origin is on GitHub");
+  try {
+    const advisories = loadAdvisories(opts.advisories ?? DEFAULT_ADVISORIES).filter((a) => !opts.advisory || a.id === opts.advisory);
+    const lock = createApiLock(extractCallSites(dir), "shapi fix");
+    const now = opts.now ? new Date(opts.now) : /* @__PURE__ */ new Date();
+    const { affected } = matchAdvisories(lock, advisories, { now });
+    if (affected.length === 0) deps.log("No affected call sites: nothing to fix.");
+    const llm = opts.llm ? claudeFixer() : void 0;
+    const outcomes = [];
+    for (const finding of affected) {
+      const { advisory, callSite } = finding;
+      const where = `${callSite.file}:${callSite.line}`;
+      const shapes = findShapes(advisory, opts);
+      if (!shapes) {
+        const skipped = "no before/after shapes for this endpoint (record them with the canary, or add a recording)";
+        deps.log(`SKIP  ${where}  ${advisory.id}: ${skipped}`);
+        outcomes.push({ finding, skipped });
+        continue;
+      }
+      const result = await repairCallSite({ repoDir: dir, advisory, callSite, before: shapes.before, after: shapes.after, recipes: RECIPES, llm });
+      const outcome = { finding, shapeSource: shapes.source, result };
+      outcomes.push(outcome);
+      deps.log(`${result.status.toUpperCase().padEnd(15)} ${where}  ${advisory.id}${result.method ? `  via ${result.method}` : ""}${result.reason ? `: ${result.reason}` : ""}`);
+      for (const a of result.attempts) deps.log(`    ${a.method}: ${a.outcome} (${a.detail})`);
+      if (result.status !== "fixed") continue;
+      for (const c of result.changes) deps.log(`    ${c.before ? "M" : "A"} ${c.file}`);
+      const files = result.changes.map((c) => ({ path: c.file, content: c.after }));
+      if (opts.write) {
+        for (const f of files) {
+          mkdirSync5(path12.dirname(path12.join(dir, f.path)), { recursive: true });
+          writeFileSync4(path12.join(dir, f.path), f.content);
+        }
+        deps.log(`    wrote ${files.length} files into ${dir}`);
+      }
+      if (opts.pr && remote) {
+        const meta = {
+          title: prTitle(advisory),
+          branch: prBranch(advisory),
+          commitMessage: `fix: ${advisory.title}
+
+Advisory ${advisory.id}. Contract test ${result.test?.file} fails before this change and passes after.`,
+          body: renderPrBody({
+            advisory,
+            callSite,
+            result,
+            affectedInRepo: affected.filter((f) => f.advisory.id === advisory.id).length,
+            shapeSource: shapes.source
+          })
+        };
+        outcome.pr = await (deps.deliver ?? deliverToGitHub)(remote, files, meta);
+        deps.log(`    pull request: ${outcome.pr.url}`);
+      }
+    }
+    return outcomes;
+  } finally {
+    if (cleanup) rmSync2(cleanup, { recursive: true, force: true });
+  }
+}
+async function deliverToGitHub(repo, files, meta) {
+  const auth = authFromEnv();
+  if (!auth) throw new Error("no GitHub credentials: set GITHUB_TOKEN, log in with `gh auth login`, or configure the SHAPI GitHub App variables");
+  const outcome = await upsertFixPr(octokitFor(auth), { repo, files, ...meta, labels: ["shapi"] });
+  if (outcome.action === "skipped") throw new Error(`not delivered: ${outcome.reason}${outcome.url ? ` (${outcome.url})` : ""}`);
+  return { url: outcome.url, number: outcome.number, branch: outcome.branch, commit: outcome.commit };
+}
+function findShapes(advisory, opts) {
+  if (opts.db && existsSync4(opts.db)) {
+    const store = ShapeStore.open(opts.db);
+    try {
+      for (const e of store.endpoints()) {
+        if (e.provider !== advisory.provider || !pathMatches(e.endpoint, advisory.endpoint)) continue;
+        if (advisory.endpoint.method !== "*" && e.method !== advisory.endpoint.method) continue;
+        const after = store.latest(e.provider, e.method, e.endpoint, e.source);
+        const before = store.previousDistinct(e.provider, e.method, e.endpoint, e.source);
+        if (before && after) return { before: before.shape, after: after.shape, source: `${e.source} (${opts.db})` };
+      }
+    } finally {
+      store.close();
+    }
+  }
+  const dir = opts.recordings ?? DEFAULT_RECORDINGS;
+  if (!existsSync4(dir)) return void 0;
+  for (const name of readdirSync3(dir).filter((f) => f.endsWith(".json")).sort()) {
+    const recording = loadRecording(path12.join(dir, name));
+    if (recording.provider !== advisory.provider || !pathMatches(recording.endpoint, advisory.endpoint)) continue;
+    if (advisory.endpoint.method !== "*" && recording.method !== advisory.endpoint.method) continue;
+    const store = ShapeStore.open(":memory:");
+    const replayed = replay(recording, store, process.env.SHAPI_SHAPE_SECRET ?? "shapi-dev-secret");
+    store.close();
+    if (replayed.before) return { before: replayed.before.shape, after: replayed.after.shape, source: `recording ${name}` };
+  }
+  return void 0;
+}
+function originRepo(dir) {
+  try {
+    return repoFromUrl(execFileSync3("git", ["remote", "get-url", "origin"], { cwd: dir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }));
+  } catch {
+    return void 0;
+  }
+}
+
+// packages/cli/src/report.ts
+import { styleText } from "util";
+function renderText(o, color) {
+  const paint = (style, s) => color ? styleText(style, s) : s;
+  const out = [];
+  const { lock, match } = o;
+  const providers = lock.providers;
+  const unresolved = lock.callSites.filter((c) => !c.resolved).length;
+  out.push(`${paint("bold", "SHAPI scan")}  ${o.label}`);
+  out.push(
+    paint(
+      "dim",
+      [plural(o.filesScanned, "file"), plural(lock.callSites.length, "call site"), plural(providers.length, "provider"), `${o.elapsedMs} ms`].join(" \xB7 ")
+    )
+  );
+  out.push("");
+  out.push(paint("bold", "Providers"));
+  if (providers.length === 0) out.push("  none found");
+  const idWidth = Math.max(0, ...providers.map((p) => p.id.length));
+  for (const p of providers) {
+    const sites = plural(p.callSites, "call site");
+    out.push(`  ${p.id.padEnd(idWidth)}  ${sites.padEnd(13)}  ${paint("dim", p.declaredBy.join(", "))}`.trimEnd());
+  }
+  out.push("");
+  out.push(paint("bold", `Affected call sites (${match.affected.length})`));
+  if (match.affected.length === 0) out.push("  none");
+  for (const f of match.affected) out.push(...renderFinding(f, paint));
+  out.push("");
+  if (match.exposed.length > 0) {
+    out.push(paint("bold", `Exposed, not affected (${match.exposed.length})`));
+    for (const f of match.exposed) {
+      out.push(`  ${f.callSite.file}:${f.callSite.line}  ${f.advisory.id}  ${paint("dim", f.reasons.join("; "))}`);
+    }
+    out.push("");
+  }
+  out.push(paint("bold", "Deadlines in the next 90 days"));
+  if (match.upcoming.length === 0) out.push("  none for the providers in this repo");
+  for (const u of match.upcoming) {
+    const where = u.callSites > 0 ? plural(u.callSites, "call site") : "declared dependency";
+    out.push(`  ${u.advisory.effectiveDate} (${u.daysUntil} days)  ${u.advisory.provider}  ${u.advisory.title}  ${paint("dim", where)}`);
+  }
+  if (unresolved > 0) {
+    out.push("");
+    out.push(paint("dim", `${plural(unresolved, "call site")} could not be fully resolved (see --json or --out api.lock).`));
+  }
+  return out.join("\n") + "\n";
+}
+var SEVERITY_STYLE = { critical: "red", high: "yellow", medium: "cyan", low: "gray" };
+function renderFinding(f, paint) {
+  const sev = f.advisory.severity.toUpperCase().padEnd(8);
+  const site = f.callSite;
+  const call = `${site.method ?? "?"} ${site.endpoint ?? "?"}`;
+  const indent = " ".repeat(12);
+  const lines = [
+    `  ${paint(SEVERITY_STYLE[f.advisory.severity] ?? "white", sev)}  ${paint("bold", `${site.file}:${site.line}`)}  ${call}`,
+    `${indent}${f.advisory.title}  ${paint("dim", `[${f.advisory.id}]`)}`,
+    `${indent}why: ${f.reasons.join("; ")}`,
+    `${indent}fix: ${f.advisory.migrationNote}`
+  ];
+  if (f.advisory.status === "unverified") lines.push(`${indent}${paint("dim", "note: unverified advisory (secondary reports only)")}`);
+  return lines;
+}
+function plural(n, noun) {
+  return `${n} ${noun}${n === 1 ? "" : "s"}`;
+}
+
+// packages/cli/src/index.ts
+var processIo = {
+  stdout: (s) => process.stdout.write(s),
+  stderr: (s) => process.stderr.write(s),
+  isTTY: process.stdout.isTTY
+};
+async function run(argv, io = processIo, fixDeps = {}) {
+  let exitCode = 0;
+  const program = new Command2().name("shapi").description("Map the third-party APIs a codebase depends on and flag the breaking changes that hit it.").version(VERSION).exitOverride().configureOutput({ writeOut: io.stdout, writeErr: io.stderr });
+  program.command("scan").description("Scan a repository and report affected call sites").argument("[path]", "directory to scan", ".").option("--json", "print a JSON report (includes the api.lock)").option("--out <file>", "write the api.lock to this file").option("--repo <url>", "clone a git repository (shallow) into a temp dir and scan it").option("--advisories <dir>", "advisory directory (default: the bundled advisories/)").option("--fail-on <severity>", "exit 1 when an affected call site is at least this severe (critical|high|medium|low|none)", "critical").option("--no-color", "disable color").addOption(new Option("--now <date>", "evaluate deadlines as of this date").hideHelp()).action((target, opts) => {
+    const outcome = scan(opts.repo ? void 0 : target, opts);
+    if (opts.json) io.stdout(JSON.stringify(toJsonReport(outcome), null, 2) + "\n");
+    else io.stdout(renderText(outcome, opts.color !== false && Boolean(io.isTTY)));
+    exitCode = outcome.exitCode;
+  });
+  program.command("fix").description("Repair affected call sites test-first: generate a contract test, apply the recipe (or Claude), keep the change only if the test passes").argument("[path]", "repository to fix", ".").option("--repo <url>", "clone a GitHub repository (shallow) and fix it; with --pr the PR goes to that repository").option("--advisory <id>", "only this advisory").option("--advisories <dir>", "advisory directory (default: the bundled advisories/)").option("--db <file>", "shape store with canary observations (checked before recordings)", ".shapi/shapes.db").option("--recordings <dir>", "recorded response sequences (default: the bundled fixtures/recordings/)").option("--llm", "ask Claude when no recipe fixes the call site (needs ANTHROPIC_API_KEY)").option("--write", "write the fix and the contract test into the local repository").option("--pr", "open a pull request with the fix and the contract test").addOption(new Option("--now <date>", "evaluate deadlines as of this date").hideHelp()).action(async (target, opts) => {
+    const outcomes = await fix(opts.repo ? void 0 : target, opts, { log: (l) => io.stdout(`${l}
+`), ...fixDeps });
+    exitCode = outcomes.every((o) => o.result?.status === "fixed" || o.result?.status === "already-handled") ? 0 : 1;
+  });
+  try {
+    await program.parseAsync(argv);
+    return exitCode;
+  } catch (err) {
+    if (err instanceof CommanderError2) return err.exitCode;
+    io.stderr(`shapi: ${err instanceof Error ? err.message : String(err)}
+`);
+    return 2;
+  }
+}
+async function main(argv) {
+  return run(argv);
+}
+export {
+  DEFAULT_ADVISORIES,
+  DEFAULT_RECORDINGS,
+  VERSION,
+  fix,
+  main,
+  renderText,
+  run,
+  scan,
+  toJsonReport
+};