shapi-cli 0.0.0-stage → 0.2.0

package/dist/index.js

@@ -0,0 +1,4206 @@
+// packages/cli/src/index.ts
+import { Command as Command2, CommanderError as CommanderError2, Option } from "commander";
+
+// packages/cli/src/fix.ts
+import { execFileSync as execFileSync3 } from "child_process";
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, mkdtempSync as mkdtempSync3, readdirSync as readdirSync3, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import os3 from "os";
+import path12 from "path";
+
+// packages/core/src/providers.ts
+import { z } from "zod";
+
+// packages/core/providers.json
+var providers_default = [
+  {
+    id: "github",
+    name: "GitHub",
+    hosts: ["api.github.com", "uploads.github.com"],
+    sdkPackages: ["@octokit/rest", "@octokit/core", "octokit", "@octokit/action", "@actions/github"],
+    sdkMethods: {
+      "actions.createWorkflowDispatch": "POST /repos/{owner}/{repo}/actions/workflows/{workflow_id}/dispatches",
+      "actions.listWorkflowRuns": "GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs",
+      "actions.getWorkflowRun": "GET /repos/{owner}/{repo}/actions/runs/{run_id}",
+      "repos.get": "GET /repos/{owner}/{repo}",
+      "repos.getContent": "GET /repos/{owner}/{repo}/contents/{path}",
+      "repos.createDispatchEvent": "POST /repos/{owner}/{repo}/dispatches",
+      "pulls.create": "POST /repos/{owner}/{repo}/pulls",
+      "pulls.get": "GET /repos/{owner}/{repo}/pulls/{pull_number}",
+      "pulls.merge": "PUT /repos/{owner}/{repo}/pulls/{pull_number}/merge",
+      "issues.create": "POST /repos/{owner}/{repo}/issues",
+      "issues.createComment": "POST /repos/{owner}/{repo}/issues/{issue_number}/comments",
+      "checks.create": "POST /repos/{owner}/{repo}/check-runs"
+    },
+    docsUrl: "https://docs.github.com/en/rest",
+    changelogUrl: "https://github.blog/changelog/"
+  },
+  {
+    id: "stripe",
+    name: "Stripe",
+    hosts: ["api.stripe.com", "files.stripe.com"],
+    sdkPackages: ["stripe"],
+    sdkMethods: {
+      "customers.create": "POST /v1/customers",
+      "customers.retrieve": "GET /v1/customers/{id}",
+      "customers.update": "POST /v1/customers/{id}",
+      "customers.list": "GET /v1/customers",
+      "paymentIntents.create": "POST /v1/payment_intents",
+      "paymentIntents.retrieve": "GET /v1/payment_intents/{id}",
+      "paymentIntents.confirm": "POST /v1/payment_intents/{id}/confirm",
+      "subscriptions.create": "POST /v1/subscriptions",
+      "subscriptions.update": "POST /v1/subscriptions/{id}",
+      "invoices.create": "POST /v1/invoices",
+      "checkout.sessions.create": "POST /v1/checkout/sessions",
+      "checkout.sessions.retrieve": "GET /v1/checkout/sessions/{session}",
+      "refunds.create": "POST /v1/refunds"
+    },
+    docsUrl: "https://docs.stripe.com/api",
+    changelogUrl: "https://docs.stripe.com/changelog",
+    python: {
+      packages: [
+        { pypi: "stripe", module: "stripe" }
+      ],
+      methods: {
+        "checkout.Session.create": "POST /v1/checkout/sessions",
+        "checkout.Session.retrieve": "GET /v1/checkout/sessions/{session}",
+        "PaymentIntent.create": "POST /v1/payment_intents",
+        "PaymentIntent.retrieve": "GET /v1/payment_intents/{intent}",
+        "PaymentIntent.confirm": "POST /v1/payment_intents/{intent}/confirm",
+        "SetupIntent.create": "POST /v1/setup_intents",
+        "Customer.create": "POST /v1/customers",
+        "Customer.list": "GET /v1/customers",
+        "Subscription.create": "POST /v1/subscriptions",
+        "Balance.retrieve": "GET /v1/balance",
+        "checkout.sessions.create": "POST /v1/checkout/sessions",
+        "checkout.sessions.retrieve": "GET /v1/checkout/sessions/{session}",
+        "payment_intents.create": "POST /v1/payment_intents",
+        "payment_intents.retrieve": "GET /v1/payment_intents/{intent}",
+        "customers.create": "POST /v1/customers",
+        "customers.list": "GET /v1/customers"
+      }
+    }
+  },
+  {
+    id: "twilio",
+    name: "Twilio",
+    hosts: ["api.twilio.com", "*.twilio.com"],
+    sdkPackages: ["twilio"],
+    sdkMethods: {
+      "messages.create": "POST /2010-04-01/Accounts/{AccountSid}/Messages.json",
+      "calls.create": "POST /2010-04-01/Accounts/{AccountSid}/Calls.json"
+    },
+    docsUrl: "https://www.twilio.com/docs/usage/api",
+    changelogUrl: "https://www.twilio.com/en-us/changelog",
+    python: {
+      packages: [
+        { pypi: "twilio", module: "twilio" }
+      ],
+      methods: {
+        "messages.create": "POST /2010-04-01/Accounts/{AccountSid}/Messages.json",
+        "messages.list": "GET /2010-04-01/Accounts/{AccountSid}/Messages.json",
+        "calls.create": "POST /2010-04-01/Accounts/{AccountSid}/Calls.json",
+        "conferences.list": "GET /2010-04-01/Accounts/{AccountSid}/Conferences.json"
+      }
+    }
+  },
+  {
+    id: "shopify",
+    name: "Shopify",
+    hosts: ["*.myshopify.com", "discover.shopifyapps.com"],
+    sdkPackages: ["@shopify/shopify-api", "@shopify/admin-api-client", "shopify-api-node"],
+    docsUrl: "https://shopify.dev/docs/api/admin",
+    changelogUrl: "https://shopify.dev/changelog"
+  },
+  {
+    id: "quickbooks",
+    name: "QuickBooks Online",
+    hosts: ["quickbooks.api.intuit.com", "sandbox-quickbooks.api.intuit.com", "oauth.platform.intuit.com"],
+    sdkPackages: ["node-quickbooks", "intuit-oauth"],
+    docsUrl: "https://developer.intuit.com/app/developer/qbo/docs/api/accounting/all-entities/account",
+    changelogUrl: "https://blogs.intuit.com/category/intuit-developer/"
+  },
+  {
+    id: "xero",
+    name: "Xero",
+    hosts: ["api.xero.com", "identity.xero.com", "login.xero.com"],
+    sdkPackages: ["xero-node"],
+    docsUrl: "https://developer.xero.com/documentation/api/accounting/overview",
+    changelogUrl: "https://developer.xero.com/changelog"
+  },
+  {
+    id: "hubspot",
+    name: "HubSpot",
+    hosts: ["api.hubapi.com", "api.hubspot.com"],
+    sdkPackages: ["@hubspot/api-client"],
+    docsUrl: "https://developers.hubspot.com/docs/api/overview",
+    changelogUrl: "https://developers.hubspot.com/changelog",
+    python: {
+      packages: [
+        { pypi: "hubspot-api-client", module: "hubspot" }
+      ],
+      methods: {
+        "crm.contacts.basic_api.get_page": "GET /crm/v3/objects/contacts",
+        "crm.contacts.basic_api.create": "POST /crm/v3/objects/contacts",
+        "crm.deals.basic_api.get_page": "GET /crm/v3/objects/deals",
+        "crm.pipelines.pipelines_api.get_all": "GET /crm/v3/pipelines/{objectType}"
+      }
+    }
+  },
+  {
+    id: "slack",
+    name: "Slack",
+    hosts: ["slack.com", "hooks.slack.com"],
+    sdkPackages: ["@slack/web-api", "@slack/bolt", "@slack/webhook"],
+    sdkMethods: {
+      "chat.postMessage": "POST /api/chat.postMessage",
+      "chat.update": "POST /api/chat.update",
+      "conversations.list": "POST /api/conversations.list",
+      "conversations.history": "POST /api/conversations.history",
+      "users.info": "POST /api/users.info",
+      "files.uploadV2": "POST /api/files.uploadV2"
+    },
+    docsUrl: "https://api.slack.com/methods",
+    changelogUrl: "https://api.slack.com/changelog",
+    python: {
+      packages: [
+        { pypi: "slack-sdk", module: "slack_sdk" }
+      ]
+    }
+  },
+  {
+    id: "openai",
+    name: "OpenAI",
+    hosts: ["api.openai.com"],
+    sdkPackages: ["openai"],
+    sdkMethods: {
+      "chat.completions.create": "POST /v1/chat/completions",
+      "responses.create": "POST /v1/responses",
+      "embeddings.create": "POST /v1/embeddings",
+      "images.generate": "POST /v1/images/generations",
+      "beta.assistants.create": "POST /v1/assistants",
+      "beta.threads.create": "POST /v1/threads",
+      "beta.threads.runs.create": "POST /v1/threads/{thread_id}/runs",
+      "files.create": "POST /v1/files"
+    },
+    docsUrl: "https://platform.openai.com/docs/api-reference",
+    changelogUrl: "https://platform.openai.com/docs/changelog",
+    python: {
+      packages: [
+        { pypi: "openai", module: "openai" }
+      ],
+      methods: {
+        "chat.completions.create": "POST /v1/chat/completions",
+        "responses.create": "POST /v1/responses",
+        "models.list": "GET /v1/models",
+        "embeddings.create": "POST /v1/embeddings",
+        "audio.translations.create": "POST /v1/audio/translations",
+        "audio.transcriptions.create": "POST /v1/audio/transcriptions",
+        "images.generate": "POST /v1/images/generations",
+        "beta.assistants.create": "POST /v1/assistants",
+        "beta.assistants.list": "GET /v1/assistants",
+        "beta.threads.create": "POST /v1/threads",
+        "beta.threads.runs.create": "POST /v1/threads/{thread_id}/runs",
+        "evals.create": "POST /v1/evals",
+        "evals.list": "GET /v1/evals"
+      }
+    }
+  },
+  {
+    id: "anthropic",
+    name: "Anthropic",
+    hosts: ["api.anthropic.com"],
+    sdkPackages: ["@anthropic-ai/sdk"],
+    sdkMethods: {
+      "messages.create": "POST /v1/messages",
+      "messages.stream": "POST /v1/messages",
+      "messages.countTokens": "POST /v1/messages/count_tokens",
+      "models.list": "GET /v1/models"
+    },
+    docsUrl: "https://docs.claude.com/en/api",
+    changelogUrl: "https://docs.claude.com/en/release-notes/api",
+    python: {
+      packages: [
+        { pypi: "anthropic", module: "anthropic" }
+      ],
+      methods: {
+        "messages.create": "POST /v1/messages",
+        "messages.stream": "POST /v1/messages",
+        "messages.count_tokens": "POST /v1/messages/count_tokens",
+        "messages.batches.create": "POST /v1/messages/batches",
+        "models.list": "GET /v1/models"
+      }
+    }
+  },
+  {
+    id: "salesforce",
+    name: "Salesforce",
+    hosts: ["*.salesforce.com", "*.force.com"],
+    sdkPackages: ["jsforce", "@jsforce/jsforce-node"],
+    docsUrl: "https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/",
+    changelogUrl: "https://help.salesforce.com/s/articleView?id=release-notes.salesforce_release_notes.htm"
+  },
+  {
+    id: "zendesk",
+    name: "Zendesk",
+    hosts: ["*.zendesk.com"],
+    sdkPackages: ["node-zendesk"],
+    docsUrl: "https://developer.zendesk.com/api-reference/",
+    changelogUrl: "https://developer.zendesk.com/api-reference/changelog/changelog/"
+  },
+  {
+    id: "intercom",
+    name: "Intercom",
+    hosts: ["api.intercom.io", "api.eu.intercom.io", "api.au.intercom.io"],
+    sdkPackages: ["intercom-client"],
+    docsUrl: "https://developers.intercom.com/docs/references/rest-api/api.intercom.io",
+    changelogUrl: "https://developers.intercom.com/docs/build-an-integration/learn-more/rest-apis/api-changelog"
+  },
+  {
+    id: "sendgrid",
+    name: "SendGrid",
+    hosts: ["api.sendgrid.com"],
+    sdkPackages: ["@sendgrid/mail", "@sendgrid/client"],
+    sdkMethods: {
+      send: "POST /v3/mail/send"
+    },
+    docsUrl: "https://www.twilio.com/docs/sendgrid/api-reference"
+  },
+  {
+    id: "mailchimp",
+    name: "Mailchimp",
+    hosts: ["*.api.mailchimp.com"],
+    sdkPackages: ["@mailchimp/mailchimp_marketing", "@mailchimp/mailchimp_transactional"],
+    docsUrl: "https://mailchimp.com/developer/marketing/api/"
+  },
+  {
+    id: "plaid",
+    name: "Plaid",
+    hosts: ["production.plaid.com", "sandbox.plaid.com", "development.plaid.com"],
+    sdkPackages: ["plaid"],
+    docsUrl: "https://plaid.com/docs/api/",
+    changelogUrl: "https://plaid.com/docs/changelog/"
+  },
+  {
+    id: "square",
+    name: "Square",
+    hosts: ["connect.squareup.com", "connect.squareupsandbox.com"],
+    sdkPackages: ["square"],
+    docsUrl: "https://developer.squareup.com/reference/square",
+    changelogUrl: "https://developer.squareup.com/docs/changelog/connect"
+  },
+  {
+    id: "paypal",
+    name: "PayPal",
+    hosts: ["api-m.paypal.com", "api-m.sandbox.paypal.com", "api.paypal.com", "api.sandbox.paypal.com"],
+    sdkPackages: ["@paypal/paypal-server-sdk", "@paypal/checkout-server-sdk"],
+    docsUrl: "https://developer.paypal.com/api/rest/"
+  },
+  {
+    id: "google-gemini",
+    name: "Google Gemini API",
+    hosts: ["generativelanguage.googleapis.com"],
+    sdkPackages: ["@google/genai", "@google/generative-ai"],
+    docsUrl: "https://ai.google.dev/api",
+    changelogUrl: "https://ai.google.dev/gemini-api/docs/changelog"
+  },
+  {
+    id: "google",
+    name: "Google APIs",
+    hosts: ["*.googleapis.com"],
+    sdkPackages: ["googleapis"],
+    docsUrl: "https://developers.google.com/apis-explorer"
+  },
+  {
+    id: "microsoft-graph",
+    name: "Microsoft Graph",
+    hosts: ["graph.microsoft.com"],
+    sdkPackages: ["@microsoft/microsoft-graph-client", "@microsoft/msgraph-sdk"],
+    docsUrl: "https://learn.microsoft.com/en-us/graph/api/overview",
+    changelogUrl: "https://developer.microsoft.com/en-us/graph/changelog"
+  },
+  {
+    id: "meta-graph",
+    name: "Meta Graph API",
+    hosts: ["graph.facebook.com", "graph.instagram.com"],
+    sdkPackages: ["facebook-nodejs-business-sdk"],
+    docsUrl: "https://developers.facebook.com/docs/graph-api",
+    changelogUrl: "https://developers.facebook.com/docs/graph-api/changelog"
+  },
+  {
+    id: "x",
+    name: "X (Twitter)",
+    hosts: ["api.x.com", "api.twitter.com", "upload.twitter.com"],
+    sdkPackages: ["twitter-api-v2"],
+    docsUrl: "https://docs.x.com/x-api",
+    changelogUrl: "https://docs.x.com/changelog"
+  },
+  {
+    id: "reddit",
+    name: "Reddit",
+    hosts: ["reddit.com", "www.reddit.com", "oauth.reddit.com", "old.reddit.com"],
+    sdkPackages: ["snoowrap"],
+    docsUrl: "https://www.reddit.com/dev/api/"
+  },
+  {
+    id: "linkedin",
+    name: "LinkedIn",
+    hosts: ["api.linkedin.com"],
+    sdkPackages: ["linkedin-api-client"],
+    docsUrl: "https://learn.microsoft.com/en-us/linkedin/",
+    changelogUrl: "https://learn.microsoft.com/en-us/linkedin/marketing/integrations/recent-changes"
+  },
+  {
+    id: "notion",
+    name: "Notion",
+    hosts: ["api.notion.com"],
+    sdkPackages: ["@notionhq/client"],
+    docsUrl: "https://developers.notion.com/reference",
+    changelogUrl: "https://developers.notion.com/page/changelog"
+  },
+  {
+    id: "airtable",
+    name: "Airtable",
+    hosts: ["api.airtable.com"],
+    sdkPackages: ["airtable"],
+    docsUrl: "https://airtable.com/developers/web/api/introduction"
+  },
+  {
+    id: "atlassian",
+    name: "Atlassian (Jira, Confluence)",
+    hosts: ["*.atlassian.net", "api.atlassian.com"],
+    sdkPackages: ["jira.js", "jira-client", "confluence.js"],
+    docsUrl: "https://developer.atlassian.com/cloud/jira/platform/rest/v3/",
+    changelogUrl: "https://developer.atlassian.com/changelog/"
+  },
+  {
+    id: "linear",
+    name: "Linear",
+    hosts: ["api.linear.app"],
+    sdkPackages: ["@linear/sdk"],
+    docsUrl: "https://linear.app/developers"
+  },
+  {
+    id: "discord",
+    name: "Discord",
+    hosts: ["discord.com", "discordapp.com"],
+    sdkPackages: ["discord.js", "@discordjs/rest"],
+    docsUrl: "https://discord.com/developers/docs/reference",
+    changelogUrl: "https://discord.com/developers/docs/change-log"
+  },
+  {
+    id: "zoom",
+    name: "Zoom",
+    hosts: ["api.zoom.us", "zoom.us"],
+    sdkPackages: [],
+    docsUrl: "https://developers.zoom.us/docs/api/",
+    changelogUrl: "https://developers.zoom.us/changelog/"
+  },
+  {
+    id: "dropbox",
+    name: "Dropbox",
+    hosts: ["api.dropboxapi.com", "content.dropboxapi.com"],
+    sdkPackages: ["dropbox"],
+    docsUrl: "https://www.dropbox.com/developers/documentation/http/documentation"
+  },
+  {
+    id: "pinterest",
+    name: "Pinterest",
+    hosts: ["api.pinterest.com"],
+    sdkPackages: [],
+    docsUrl: "https://developers.pinterest.com/docs/api/v5/",
+    changelogUrl: "https://developers.pinterest.com/docs/getting-started/changelog/"
+  },
+  {
+    id: "resend",
+    name: "Resend",
+    hosts: ["api.resend.com"],
+    sdkPackages: ["resend"],
+    docsUrl: "https://resend.com/docs/api-reference/introduction"
+  },
+  {
+    id: "cloudflare",
+    name: "Cloudflare",
+    hosts: ["api.cloudflare.com"],
+    sdkPackages: ["cloudflare"],
+    docsUrl: "https://developers.cloudflare.com/api/",
+    changelogUrl: "https://developers.cloudflare.com/changelog/"
+  }
+];
+
+// packages/core/src/providers.ts
+var HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
+var EndpointRefSchema = z.string().regex(/^(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS) \/\S*$/);
+var ProviderSchema = z.object({
+  id: z.string().regex(/^[a-z0-9-]+$/),
+  name: z.string().min(1),
+  /** Exact hostnames, or "*.example.com" for any subdomain of example.com. */
+  hosts: z.array(z.string().regex(/^(\*\.)?[a-z0-9.-]+$/)).min(1),
+  /** npm packages that are this provider's SDKs. */
+  sdkPackages: z.array(z.string().min(1)),
+  /** SDK method chain (after the client, without a leading "rest.") to the HTTP endpoint it calls. */
+  sdkMethods: z.record(z.string(), EndpointRefSchema).optional(),
+  docsUrl: z.url(),
+  changelogUrl: z.url().optional(),
+  /** The provider's Python SDK: PyPI package and import module, and SDK method chain → HTTP endpoint. */
+  python: z.object({
+    packages: z.array(z.object({ pypi: z.string().min(1), module: z.string().min(1) })),
+    methods: z.record(z.string(), EndpointRefSchema).optional()
+  }).optional()
+});
+var ProviderRegistrySchema = z.array(ProviderSchema).refine((ps) => new Set(ps.map((p) => p.id)).size === ps.length, "provider ids must be unique");
+var cached;
+function loadProviders() {
+  cached ??= ProviderRegistrySchema.parse(providers_default);
+  return cached;
+}
+function getProvider(id) {
+  return loadProviders().find((p) => p.id === id);
+}
+function providerForHost(host) {
+  const h = host.toLowerCase().replace(/:\d+$/, "");
+  let best;
+  for (const provider of loadProviders()) {
+    for (const pattern of provider.hosts) {
+      let score = -1;
+      if (pattern === h) score = 1e4;
+      else if (pattern.startsWith("*.") && h.endsWith(pattern.slice(1))) score = pattern.length;
+      if (score > (best?.score ?? -1)) best = { provider, score };
+    }
+  }
+  return best?.provider;
+}
+function providerForPackage(name) {
+  return loadProviders().find((p) => p.sdkPackages.includes(name));
+}
+function providerForPythonModule(module) {
+  const top = module.split(".")[0];
+  return loadProviders().find((p) => p.python?.packages.some((pkg) => pkg.module === top));
+}
+function providerForPythonPackage(name) {
+  const norm = (s) => s.toLowerCase().replace(/[-_.]+/g, "-");
+  return loadProviders().find((p) => p.python?.packages.some((pkg) => norm(pkg.pypi) === norm(name)));
+}
+function sdkEndpoint(provider, chain) {
+  const methods = provider.sdkMethods ?? {};
+  const key = chain.replace(/^rest\./, "");
+  const ref = methods[key];
+  if (!ref) return void 0;
+  const [method, path13] = ref.split(" ");
+  return { method, path: path13 };
+}
+
+// packages/core/src/lockfile.ts
+import { createHash } from "crypto";
+import { mkdirSync, writeFileSync } from "fs";
+import path from "path";
+import { z as z2 } from "zod";
+var NameValueSchema = z2.object({
+  name: z2.string(),
+  /** Statically known value, with unknown parts as {name}; null when unknown. */
+  value: z2.string().nullable()
+});
+var SurfaceSchema = z2.object({
+  /** Response body field paths read, dot-separated; array elements as "[]". */
+  fields: z2.array(z2.string()),
+  /** Status codes the code compares against. */
+  statusCodes: z2.array(z2.number().int()),
+  /** Branches on `response.ok`. */
+  checksOk: z2.boolean(),
+  /** String values response fields are compared against. */
+  enums: z2.array(z2.object({ field: z2.string(), values: z2.array(z2.string()) })),
+  /** Request headers set, names lowercased (API version pins live here). */
+  headers: z2.array(NameValueSchema),
+  /** Request query parameters. */
+  query: z2.array(NameValueSchema),
+  /** Response headers read, names lowercased. */
+  responseHeaders: z2.array(z2.string())
+});
+var CallSiteSchema = z2.object({
+  /** Repo-relative POSIX path. */
+  file: z2.string(),
+  line: z2.number().int().positive(),
+  column: z2.number().int().positive(),
+  provider: z2.string().nullable(),
+  kind: z2.enum(["http", "sdk"]),
+  /** HTTP library (fetch, axios, got, undici, ky, node-fetch) or SDK package name. */
+  client: z2.string(),
+  /** SDK method chain, for example "rest.actions.createWorkflowDispatch". */
+  operation: z2.string().optional(),
+  method: z2.enum(HTTP_METHODS).nullable(),
+  host: z2.string().nullable(),
+  /** Path with dynamic segments as {name} or {}, query string removed. */
+  endpoint: z2.string().nullable(),
+  /** True when provider, method and endpoint are all known. */
+  resolved: z2.boolean(),
+  surface: SurfaceSchema
+});
+var LockedCallSiteSchema = z2.object({ id: z2.string().regex(/^[0-9a-f]{12}$/) }).extend(CallSiteSchema.shape);
+var ApiLockSchema = z2.object({
+  lockfileVersion: z2.literal(1),
+  generator: z2.string(),
+  providers: z2.array(
+    z2.object({
+      id: z2.string(),
+      callSites: z2.number().int().nonnegative(),
+      /** SDK packages in package.json that point at this provider. */
+      declaredBy: z2.array(z2.string())
+    })
+  ),
+  callSites: z2.array(LockedCallSiteSchema)
+});
+var LOCKFILE_VERSION = 1;
+function callSiteId(site) {
+  return createHash("sha256").update(`${site.file}:${site.line}:${site.column}:${site.method ?? "?"}:${site.endpoint ?? "?"}`).digest("hex").slice(0, 12);
+}
+function createApiLock(input, generator) {
+  const callSites = [...input.callSites].sort((a, b) => cmp(a.file, b.file) || a.line - b.line || a.column - b.column).map((site) => ({ id: callSiteId(site), ...site }));
+  const providers = /* @__PURE__ */ new Map();
+  const entry = (id) => {
+    let e = providers.get(id);
+    if (!e) providers.set(id, e = { callSites: 0, declaredBy: /* @__PURE__ */ new Set() });
+    return e;
+  };
+  for (const site of callSites) if (site.provider) entry(site.provider).callSites++;
+  for (const d of input.declared) entry(d.provider).declaredBy.add(d.package);
+  return ApiLockSchema.parse({
+    lockfileVersion: LOCKFILE_VERSION,
+    generator,
+    providers: [...providers].sort(([a], [b]) => cmp(a, b)).map(([id, e]) => ({ id, callSites: e.callSites, declaredBy: [...e.declaredBy].sort() })),
+    callSites
+  });
+}
+function serializeApiLock(lock) {
+  return JSON.stringify(ApiLockSchema.parse(lock), null, 2) + "\n";
+}
+function writeApiLock(file, lock) {
+  mkdirSync(path.dirname(path.resolve(file)), { recursive: true });
+  writeFileSync(file, serializeApiLock(lock));
+}
+function cmp(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
+// packages/core/src/advisory.ts
+import { readdirSync, readFileSync } from "fs";
+import path2 from "path";
+import { z as z3 } from "zod";
+var CHANGE_CLASSES = [
+  "status-code",
+  "field-rename",
+  "enum-added",
+  "required-field",
+  "version-sunset",
+  "scope-change",
+  "auth"
+];
+var SEVERITIES = ["critical", "high", "medium", "low"];
+var IsoDate = z3.iso.date();
+var EndpointPatternSchema = z3.object({
+  method: z3.union([z3.enum(HTTP_METHODS), z3.literal("*")]),
+  path: z3.string().startsWith("/"),
+  /** Limit to these hosts (for providers whose hosts behave differently). */
+  hosts: z3.array(z3.string()).optional()
+});
+var TriggerSchema = z3.object({
+  /** Affected when the code compares the status against one of these (the old codes). */
+  statusCodes: z3.array(z3.number().int()).optional(),
+  /**
+   * The codes the provider answers with now. Code that already compares
+   * against all of them handles the change and is not affected.
+   */
+  newStatusCodes: z3.array(z3.number().int()).optional(),
+  /** Affected when the code reads one of these body fields (or a field beneath it). */
+  fields: z3.array(z3.string()).optional(),
+  /** Affected when the code compares this field against string values. */
+  enums: z3.array(z3.object({ field: z3.string() })).optional(),
+  /** Affected when the request sets this header (optionally to one of these values). */
+  headers: z3.array(z3.object({ name: z3.string(), values: z3.array(z3.string()).optional() })).optional(),
+  /**
+   * Affected when the request sets this query parameter: optionally to a number below `below`, or to
+   * one of `values` (a comma-separated value such as `metric=a,b` matches when any item does).
+   */
+  query: z3.array(z3.object({ name: z3.string(), below: z3.number().optional(), values: z3.array(z3.string()).optional() })).optional(),
+  /** Every call to the endpoint is affected (sunsets, auth and scope changes). */
+  any: z3.boolean().optional()
+}).refine((t) => Object.values(t).some((v) => v !== void 0 && v !== false), "trigger needs at least one condition");
+var FixSchema = z3.object({
+  /** Replace this part of the request path, for example "/v21.0/" with "/v26.0/". */
+  path: z3.object({ from: z3.string().min(1), to: z3.string().min(1) }).optional(),
+  /** Send this query parameter with this value, for example minorversion=75. */
+  query: z3.object({ name: z3.string().min(1), value: z3.string() }).optional(),
+  /** Send this request header with this value, for example Stripe-Version. */
+  header: z3.object({ name: z3.string().min(1), value: z3.string() }).optional(),
+  /** Response fields that were renamed: the code reads the new name, falling back to the old one. */
+  fields: z3.array(z3.object({ from: z3.string().min(1), to: z3.string().min(1) })).optional(),
+  /** Enum values that were renamed: comparisons with an old value also accept the new one. */
+  enums: z3.array(z3.object({ field: z3.string().min(1), values: z3.array(z3.object({ from: z3.string(), to: z3.string() })).min(1) })).optional()
+}).refine((f) => Object.values(f).some((v) => v !== void 0), "fix needs at least one change");
+var AdvisorySchema = z3.object({
+  id: z3.string().regex(/^[a-z0-9-]+$/),
+  provider: z3.string(),
+  title: z3.string().min(1),
+  summary: z3.string().min(1),
+  endpoint: EndpointPatternSchema,
+  changeClass: z3.enum(CHANGE_CLASSES),
+  trigger: TriggerSchema,
+  /** When the changed behavior was first seen in the wild. */
+  firstObserved: IsoDate.nullable(),
+  /** The provider's own notice, if there was one. */
+  publishedNotice: z3.object({ date: IsoDate.nullable(), url: z3.url() }).nullable(),
+  /** When the change takes (or took) effect. */
+  effectiveDate: IsoDate,
+  severity: z3.enum(SEVERITIES),
+  migrationNote: z3.string().min(1),
+  recipeId: z3.string().optional(),
+  /** What `recipeId: "apply-fix"` changes. */
+  fix: FixSchema.optional(),
+  sources: z3.array(z3.url()).min(1),
+  /** "verified": checked against a primary or two independent sources. "unverified": secondary reports only. */
+  status: z3.enum(["verified", "unverified"]),
+  /** Observations behind a machine-drafted advisory: what SHAPI saw before and after the change. */
+  evidence: z3.object({
+    source: z3.string(),
+    before: z3.object({ observedAt: z3.iso.datetime(), status: z3.number().int(), shapeHash: z3.string() }),
+    after: z3.object({ observedAt: z3.iso.datetime(), status: z3.number().int(), shapeHash: z3.string() }),
+    changes: z3.array(z3.string())
+  }).optional()
+});
+function loadAdvisories(dir) {
+  const advisories = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const name of readdirSync(dir).filter((f) => f.endsWith(".json")).sort()) {
+    const file = path2.join(dir, name);
+    const parsed = AdvisorySchema.safeParse(JSON.parse(readFileSync(file, "utf8")));
+    if (!parsed.success) throw new Error(`invalid advisory ${name}: ${z3.prettifyError(parsed.error)}`);
+    const advisory = parsed.data;
+    if (`${advisory.id}.json` !== name) throw new Error(`advisory ${name} must be named ${advisory.id}.json`);
+    if (seen.has(advisory.id)) throw new Error(`duplicate advisory id ${advisory.id}`);
+    seen.add(advisory.id);
+    advisories.push(advisory);
+  }
+  return advisories.sort((a, b) => a.id < b.id ? -1 : 1);
+}
+var SEVERITY_RANK = { critical: 0, high: 1, medium: 2, low: 3 };
+
+// packages/core/src/matcher.ts
+var DAY_MS = 864e5;
+function matchAdvisories(lock, advisories, options = {}) {
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const horizon = options.horizonDays ?? 90;
+  const affected = [];
+  const exposed = [];
+  const hitsPerAdvisory = /* @__PURE__ */ new Map();
+  for (const advisory of advisories) {
+    for (const callSite of lock.callSites) {
+      if (!endpointMatches(callSite, advisory)) continue;
+      hitsPerAdvisory.set(advisory.id, (hitsPerAdvisory.get(advisory.id) ?? 0) + 1);
+      const reasons = triggerReasons(callSite, advisory.trigger);
+      if (reasons.length > 0) affected.push({ advisory, callSite, reasons });
+      else exposed.push({ advisory, callSite, reasons: [`calls ${describe(callSite)} but does not depend on the changed behavior`] });
+    }
+  }
+  const present = new Set(lock.providers.map((p) => p.id));
+  const today = Math.floor(now.getTime() / DAY_MS) * DAY_MS;
+  const upcoming = advisories.map((advisory) => ({
+    advisory,
+    daysUntil: Math.round((Date.parse(advisory.effectiveDate) - today) / DAY_MS),
+    callSites: hitsPerAdvisory.get(advisory.id) ?? 0
+  })).filter((u) => present.has(u.advisory.provider) && u.daysUntil >= 0 && u.daysUntil <= horizon).sort((a, b) => a.daysUntil - b.daysUntil || cmp2(a.advisory.id, b.advisory.id));
+  return { affected: affected.sort(byFinding), exposed: exposed.sort(byFinding), upcoming };
+}
+function endpointMatches(site, advisory) {
+  const pattern = advisory.endpoint;
+  if (site.provider !== advisory.provider || site.endpoint === null) return false;
+  if (pattern.method !== "*" && site.method !== pattern.method) return false;
+  if (pattern.hosts && !(site.host && pattern.hosts.includes(site.host))) return false;
+  return pathMatches(site.endpoint, pattern);
+}
+function pathMatches(endpoint, pattern) {
+  const sample = endpoint.replace(/\{[^}]*\}/g, "\0");
+  let re = "";
+  const src = pattern.path;
+  for (let i = 0; i < src.length; ) {
+    if (src.startsWith("/**", i)) {
+      re += "(?:/.*)?";
+      i += 3;
+    } else if (src.startsWith("**", i)) {
+      re += ".*";
+      i += 2;
+    } else if (src[i] === "*") {
+      re += "[^/]*";
+      i += 1;
+    } else if (src[i] === "{") {
+      const end = src.indexOf("}", i);
+      re += "[^/]+";
+      i = end < 0 ? src.length : end + 1;
+    } else {
+      re += src[i].replace(/[.+?^$()|[\]\\]/g, "\\$&");
+      i += 1;
+    }
+  }
+  return new RegExp(`^${re}/?$`).test(sample);
+}
+function triggerReasons(site, trigger) {
+  const s = site.surface;
+  const reasons = [];
+  const handlesNew = (trigger.newStatusCodes ?? []).length > 0 && trigger.newStatusCodes.every((c) => s.statusCodes.includes(c));
+  for (const code of trigger.statusCodes ?? []) {
+    if (s.statusCodes.includes(code) && !handlesNew) reasons.push(`compares the response status to ${code}`);
+  }
+  for (const field of trigger.fields ?? []) {
+    const read = s.fields.filter((f) => f === field || f.startsWith(`${field}.`) || f.startsWith(`${field}[]`));
+    if (read.length) reasons.push(`reads ${read.join(", ")}`);
+  }
+  for (const { field } of trigger.enums ?? []) {
+    const e = s.enums.find((x) => x.field === field);
+    if (e) reasons.push(`compares ${field} to ${e.values.map((v) => JSON.stringify(v)).join(", ")}`);
+  }
+  for (const h of trigger.headers ?? []) {
+    const set = s.headers.find((x) => x.name === h.name.toLowerCase());
+    if (set && (!h.values || set.value !== null && h.values.includes(set.value))) reasons.push(`sends ${set.name}: ${set.value ?? "(dynamic)"}`);
+  }
+  for (const q of trigger.query ?? []) {
+    const p = s.query.find((x) => x.name === q.name);
+    if (!p) continue;
+    if (q.below !== void 0) {
+      if (p.value !== null && Number(p.value) < q.below) reasons.push(`sends ${p.name}=${p.value} (below ${q.below})`);
+    } else if (q.values) {
+      const hit = p.value === null ? [] : p.value.split(",").map((v) => v.trim()).filter((v) => q.values.includes(v));
+      if (hit.length) reasons.push(`sends ${p.name}=${hit.join(",")}`);
+    } else reasons.push(`sends ${p.name}=${p.value ?? "(dynamic)"}`);
+  }
+  if (trigger.any) reasons.push(`calls ${describe(site)}`);
+  return reasons;
+}
+function describe(site) {
+  return `${site.method ?? "?"} ${site.endpoint ?? "?"}`;
+}
+function byFinding(a, b) {
+  return SEVERITY_RANK[a.advisory.severity] - SEVERITY_RANK[b.advisory.severity] || cmp2(a.callSite.file, b.callSite.file) || a.callSite.line - b.callSite.line || cmp2(a.advisory.id, b.advisory.id);
+}
+function cmp2(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
+// packages/extractor/src/index.ts
+import path4 from "path";
+import { readFileSync as readFileSync3 } from "fs";
+import { Project, ScriptKind } from "ts-morph";
+
+// packages/extractor/src/callsites.ts
+import { Node, SyntaxKind } from "ts-morph";
+function emptySurface() {
+  return { fields: [], statusCodes: [], checksOk: false, enums: [], headers: [], query: [], responseHeaders: [] };
+}
+var HTTP_MODULES = {
+  "node-fetch": "node-fetch",
+  "cross-fetch": "node-fetch",
+  "isomorphic-fetch": "node-fetch",
+  axios: "axios",
+  got: "got",
+  ky: "ky",
+  undici: "undici"
+};
+var VERBS = /* @__PURE__ */ new Set(["get", "post", "put", "patch", "delete", "head", "options"]);
+function extractFromFile(sf, file) {
+  const ctx = { sf, imports: /* @__PURE__ */ new Map(), consts: /* @__PURE__ */ new Map(), http: /* @__PURE__ */ new Map(), sdk: /* @__PURE__ */ new Map() };
+  collectImports(ctx);
+  collectConsts(ctx);
+  collectClients(ctx);
+  const found = [];
+  for (const call of sf.getDescendantsOfKind(SyntaxKind.CallExpression)) {
+    const hit = matchHttp(ctx, call) ?? matchSdk(ctx, call);
+    if (!hit) continue;
+    const { line, column } = sf.getLineAndColumnAtPos(call.getStart());
+    hit.site.file = file;
+    hit.site.line = line;
+    hit.site.column = column;
+    found.push(hit);
+  }
+  return found;
+}
+function collectImports(ctx) {
+  for (const decl of ctx.sf.getImportDeclarations()) {
+    const module = decl.getModuleSpecifierValue();
+    const def = decl.getDefaultImport();
+    if (def) ctx.imports.set(def.getText(), { module, imported: "default" });
+    const ns = decl.getNamespaceImport();
+    if (ns) ctx.imports.set(ns.getText(), { module, imported: "*" });
+    for (const named of decl.getNamedImports()) {
+      const local = named.getAliasNode()?.getText() ?? named.getName();
+      ctx.imports.set(local, { module, imported: named.getName() });
+    }
+  }
+  for (const decl of ctx.sf.getDescendantsOfKind(SyntaxKind.VariableDeclaration)) {
+    const module = requiredModule(decl.getInitializer());
+    if (!module) continue;
+    const name = decl.getNameNode();
+    if (Node.isIdentifier(name)) ctx.imports.set(name.getText(), { module, imported: "default" });
+    else if (Node.isObjectBindingPattern(name)) {
+      for (const el of name.getElements()) {
+        const imported = el.getPropertyNameNode()?.getText() ?? el.getName();
+        ctx.imports.set(el.getName(), { module, imported });
+      }
+    }
+  }
+}
+function requiredModule(node) {
+  if (!node || !Node.isCallExpression(node)) return void 0;
+  const callee = node.getExpression();
+  const arg = node.getArguments()[0];
+  if (Node.isIdentifier(callee) && callee.getText() === "require" && arg && Node.isStringLiteral(arg)) {
+    return arg.getLiteralValue();
+  }
+  return void 0;
+}
+function collectConsts(ctx) {
+  for (const decl of ctx.sf.getDescendantsOfKind(SyntaxKind.VariableDeclaration)) {
+    const list = decl.getVariableStatement()?.getDeclarationKind();
+    const init = decl.getInitializer();
+    if (list === "const" && init && Node.isIdentifier(decl.getNameNode())) ctx.consts.set(decl.getName(), init);
+  }
+}
+function collectClients(ctx) {
+  const bind = (key, init) => {
+    if (!init) return;
+    const expr = unwrap(init);
+    if (!Node.isNewExpression(expr) && !Node.isCallExpression(expr)) return;
+    const callee = expr.getExpression();
+    const args = expr.getArguments();
+    if (Node.isPropertyAccessExpression(callee)) {
+      const lib = httpLibOf(ctx, callee.getExpression());
+      if (lib && ["create", "extend"].includes(callee.getName())) {
+        const opts = args[0];
+        const base = Node.isObjectLiteralExpression(opts) ? evalString(ctx, propertyValue(opts, "baseURL")) ?? evalString(ctx, propertyValue(opts, "prefixUrl")) : void 0;
+        ctx.http.set(key, { lib, baseURL: base });
+        return;
+      }
+    }
+    const module = moduleOfCallee(ctx, callee);
+    const provider = module ? providerForPackage(module) : void 0;
+    if (module && provider) {
+      const options = [...args].reverse().find((a) => Node.isObjectLiteralExpression(a));
+      ctx.sdk.set(key, { provider, pkg: module, options });
+    }
+  };
+  for (const decl of ctx.sf.getDescendantsOfKind(SyntaxKind.VariableDeclaration)) {
+    if (Node.isIdentifier(decl.getNameNode())) bind(decl.getName(), decl.getInitializer());
+  }
+  for (const prop of ctx.sf.getDescendantsOfKind(SyntaxKind.PropertyDeclaration)) {
+    bind(`this.${prop.getName()}`, prop.getInitializer());
+  }
+  for (const bin of ctx.sf.getDescendantsOfKind(SyntaxKind.BinaryExpression)) {
+    if (bin.getOperatorToken().getKind() !== SyntaxKind.EqualsToken) continue;
+    const left = bin.getLeft();
+    if (Node.isPropertyAccessExpression(left) && left.getExpression().getKind() === SyntaxKind.ThisKeyword) {
+      bind(`this.${left.getName()}`, bin.getRight());
+    } else if (Node.isIdentifier(left)) {
+      bind(left.getText(), bin.getRight());
+    }
+  }
+}
+function moduleOfCallee(ctx, callee) {
+  const root = chainOf(callee)?.root;
+  if (root) return ctx.imports.get(root)?.module;
+  return requiredModule(callee);
+}
+function httpLibOf(ctx, node) {
+  if (!Node.isIdentifier(node)) return void 0;
+  const ref = ctx.imports.get(node.getText());
+  if (ref) {
+    const lib = HTTP_MODULES[ref.module];
+    if (lib === "undici") return ref.imported === "*" ? "undici" : void 0;
+    return lib && (ref.imported === "default" || ref.imported === "*") ? lib : void 0;
+  }
+  return void 0;
+}
+function matchHttp(ctx, call) {
+  const callee = call.getExpression();
+  const args = call.getArguments();
+  if (Node.isIdentifier(callee)) {
+    const name = callee.getText();
+    const ref = ctx.imports.get(name);
+    if (!ref && name === "fetch") return fetchStyle(ctx, call, "fetch", args[0], args[1]);
+    if (ref) {
+      const lib = HTTP_MODULES[ref.module];
+      if (lib === "node-fetch") return fetchStyle(ctx, call, lib, args[0], args[1]);
+      if (lib === "undici" && ref.imported === "fetch") return fetchStyle(ctx, call, lib, args[0], args[1]);
+      if (lib === "undici" && ref.imported === "request") return fetchStyle(ctx, call, lib, args[0], args[1]);
+      if (lib === "axios" && ref.imported === "default") return axiosStyle(ctx, call, void 0, void 0);
+      if ((lib === "got" || lib === "ky") && ref.imported === "default") return fetchStyle(ctx, call, lib, args[0], args[1]);
+    }
+    const inst = ctx.http.get(name);
+    if (inst?.lib === "axios") return axiosStyle(ctx, call, void 0, inst.baseURL);
+    if (inst) return fetchStyle(ctx, call, inst.lib, args[0], args[1], void 0, inst.baseURL);
+    return void 0;
+  }
+  if (Node.isPropertyAccessExpression(callee)) {
+    const target = callee.getExpression();
+    const member = callee.getName();
+    const lib = httpLibOf(ctx, target);
+    const inst = Node.isIdentifier(target) ? ctx.http.get(target.getText()) : void 0;
+    const effective = lib ?? inst?.lib;
+    if (!effective) return void 0;
+    const base = inst?.baseURL;
+    if (effective === "undici") {
+      return member === "fetch" || member === "request" ? fetchStyle(ctx, call, "undici", args[0], args[1]) : void 0;
+    }
+    if (effective === "axios") {
+      if (member === "request") return axiosStyle(ctx, call, void 0, base);
+      if (VERBS.has(member)) return axiosStyle(ctx, call, member.toUpperCase(), base);
+      return void 0;
+    }
+    if (VERBS.has(member)) {
+      return fetchStyle(ctx, call, effective, args[0], args[1], member.toUpperCase(), base);
+    }
+  }
+  return void 0;
+}
+function fetchStyle(ctx, call, lib, urlArg, optsArg, verb, baseURL) {
+  const opts = resolveObject(ctx, optsArg);
+  let method = verb ?? "GET";
+  if (!verb && optsArg) {
+    if (opts) method = methodFrom(ctx, propertyValue(opts, "method")) ?? (propertyValue(opts, "method") ? null : "GET");
+    else method = null;
+  }
+  const params = opts && (lib === "got" || lib === "ky") ? resolveObject(ctx, propertyValue(opts, "searchParams")) : void 0;
+  return httpSite(ctx, call, lib, joinUrl(baseURL, evalString(ctx, urlArg)), method, opts ? optsArg : void 0, params);
+}
+function axiosStyle(ctx, call, verb, baseURL) {
+  const args = call.getArguments();
+  const first = args[0];
+  const firstObj = resolveObject(ctx, first);
+  if (!verb && firstObj && !isStringish(first)) {
+    const url = evalString(ctx, propertyValue(firstObj, "url"));
+    const base = evalString(ctx, propertyValue(firstObj, "baseURL")) ?? baseURL;
+    const method2 = methodFrom(ctx, propertyValue(firstObj, "method")) ?? (propertyValue(firstObj, "method") ? null : "GET");
+    const params2 = resolveObject(ctx, propertyValue(firstObj, "params"));
+    return httpSite(ctx, call, "axios", joinUrl(base, url), method2, first, params2);
+  }
+  const hasBody = verb === "POST" || verb === "PUT" || verb === "PATCH";
+  const config = hasBody ? args[2] : args[1];
+  const cfg = resolveObject(ctx, config);
+  let method = verb ?? "GET";
+  if (!verb && cfg) method = methodFrom(ctx, propertyValue(cfg, "method")) ?? "GET";
+  const params = cfg ? resolveObject(ctx, propertyValue(cfg, "params")) : void 0;
+  return httpSite(ctx, call, "axios", joinUrl(baseURL, evalString(ctx, first)), method, config, params);
+}
+function httpSite(ctx, call, lib, url, method, options, params) {
+  const { host, path: path13, query } = parseUrl(url);
+  const surface = emptySurface();
+  surface.headers = headersOf(ctx, options);
+  surface.query = [...query, ...objectEntries(ctx, params)];
+  const provider = host ? providerForHost(host)?.id ?? null : null;
+  return {
+    call,
+    options,
+    site: {
+      file: "",
+      line: 0,
+      column: 0,
+      provider,
+      kind: "http",
+      client: lib,
+      method,
+      host,
+      endpoint: path13,
+      resolved: Boolean(provider && path13 && method),
+      surface
+    }
+  };
+}
+function matchSdk(ctx, call) {
+  const chain = chainOf(call.getExpression());
+  if (!chain || chain.names.length === 0) return void 0;
+  let client = ctx.sdk.get(chain.root);
+  if (!client) {
+    const ref = ctx.imports.get(chain.root);
+    const provider = ref ? providerForPackage(ref.module) : void 0;
+    if (!ref || !provider || ref.imported !== "default") return void 0;
+    client = { provider, pkg: ref.module };
+  }
+  const operation = chain.names.join(".");
+  const args = call.getArguments();
+  let method = null;
+  let endpoint = null;
+  let options = args[0];
+  const route = operation === "request" ? evalString(ctx, args[0]) : void 0;
+  if (route) {
+    const m = /^([A-Z]+)\s+(\S+)$/.exec(route.trim());
+    if (m && HTTP_METHODS.includes(m[1])) {
+      method = m[1];
+      endpoint = parseUrl(m[2]).path;
+    } else if (route.startsWith("/")) {
+      method = "GET";
+      endpoint = parseUrl(route).path;
+    }
+    options = args[1];
+  } else if (operation === "graphql") {
+    method = "POST";
+    endpoint = "/graphql";
+  } else {
+    const ep = sdkEndpoint(client.provider, operation);
+    if (ep) {
+      method = ep.method;
+      endpoint = ep.path;
+    }
+  }
+  const host = client.provider.hosts.find((h) => !h.startsWith("*.")) ?? null;
+  const surface = emptySurface();
+  surface.headers = [...headersOf(ctx, client.options, "defaultHeaders"), ...headersOf(ctx, options)];
+  const apiVersion = client.options ? propertyValue(client.options, "apiVersion") : void 0;
+  if (apiVersion) surface.headers.push({ name: `${client.provider.id}-version`, value: evalString(ctx, apiVersion) ?? null });
+  surface.headers.sort((a, b) => a.name.localeCompare(b.name));
+  return {
+    call,
+    options,
+    clientOptions: client.options,
+    site: {
+      file: "",
+      line: 0,
+      column: 0,
+      provider: client.provider.id,
+      kind: "sdk",
+      client: client.pkg,
+      operation,
+      method,
+      host,
+      endpoint,
+      resolved: Boolean(method && endpoint),
+      surface
+    }
+  };
+}
+function chainOf(node) {
+  const names = [];
+  let cur = node;
+  while (Node.isPropertyAccessExpression(cur)) {
+    names.unshift(cur.getName());
+    const inner = cur.getExpression();
+    if (inner.getKind() === SyntaxKind.ThisKeyword) {
+      const first = names.shift();
+      return { root: `this.${first}`, names };
+    }
+    cur = inner;
+  }
+  if (Node.isIdentifier(cur)) return { root: cur.getText(), names };
+  return void 0;
+}
+function unwrap(node) {
+  let cur = node;
+  for (; ; ) {
+    if (Node.isAwaitExpression(cur) || Node.isParenthesizedExpression(cur) || Node.isAsExpression(cur) || Node.isNonNullExpression(cur)) {
+      cur = cur.getExpression();
+    } else if (Node.isSatisfiesExpression(cur)) {
+      cur = cur.getExpression();
+    } else {
+      return cur;
+    }
+  }
+}
+function propertyValue(obj, name) {
+  if (!Node.isObjectLiteralExpression(obj)) return void 0;
+  for (const prop of obj.getProperties()) {
+    if (Node.isPropertyAssignment(prop) && propName(prop.getNameNode()) === name) return prop.getInitializer();
+    if (Node.isShorthandPropertyAssignment(prop) && prop.getName() === name) return prop.getNameNode();
+  }
+  return void 0;
+}
+function propName(node) {
+  if (Node.isStringLiteral(node) || Node.isNoSubstitutionTemplateLiteral(node)) return node.getLiteralValue();
+  return node.getText();
+}
+function headersOf(ctx, options, key = "headers") {
+  const obj = resolveObject(ctx, options);
+  return obj ? objectEntries(ctx, resolveObject(ctx, propertyValue(obj, key))).map((h) => ({ ...h, name: h.name.toLowerCase() })) : [];
+}
+function objectEntries(ctx, obj) {
+  if (!obj || !Node.isObjectLiteralExpression(obj)) return [];
+  const out = [];
+  for (const prop of obj.getProperties()) {
+    if (Node.isPropertyAssignment(prop)) {
+      out.push({ name: propName(prop.getNameNode()), value: evalString(ctx, prop.getInitializer()) ?? null });
+    } else if (Node.isShorthandPropertyAssignment(prop)) {
+      out.push({ name: prop.getName(), value: evalString(ctx, prop.getNameNode()) ?? null });
+    }
+  }
+  return out;
+}
+function resolveObject(ctx, node) {
+  if (!node) return void 0;
+  const expr = unwrap(node);
+  if (Node.isObjectLiteralExpression(expr)) return expr;
+  if (Node.isIdentifier(expr)) {
+    const init = ctx.consts.get(expr.getText());
+    if (init && Node.isObjectLiteralExpression(unwrap(init))) return unwrap(init);
+  }
+  return void 0;
+}
+function isStringish(node) {
+  if (!node) return false;
+  const expr = unwrap(node);
+  return Node.isStringLiteral(expr) || Node.isTemplateExpression(expr) || Node.isNoSubstitutionTemplateLiteral(expr);
+}
+function methodFrom(ctx, node) {
+  const value2 = evalString(ctx, node)?.toUpperCase();
+  return value2 && HTTP_METHODS.includes(value2) ? value2 : void 0;
+}
+function evalString(ctx, node, depth = 0) {
+  if (!node || depth > 8) return void 0;
+  const expr = unwrap(node);
+  if (Node.isStringLiteral(expr) || Node.isNoSubstitutionTemplateLiteral(expr)) return expr.getLiteralValue();
+  if (Node.isNumericLiteral(expr)) return expr.getLiteralText();
+  if (Node.isTemplateExpression(expr)) {
+    let out = expr.getHead().getLiteralText();
+    for (const span of expr.getTemplateSpans()) {
+      const inner = span.getExpression();
+      out += evalString(ctx, inner, depth + 1) ?? placeholder(inner);
+      out += span.getLiteral().getLiteralText();
+    }
+    return out;
+  }
+  if (Node.isBinaryExpression(expr)) {
+    const op = expr.getOperatorToken().getKind();
+    if (op === SyntaxKind.PlusToken) {
+      const l = evalString(ctx, expr.getLeft(), depth + 1);
+      const r = evalString(ctx, expr.getRight(), depth + 1);
+      if (l === void 0 && r === void 0) return void 0;
+      return (l ?? placeholder(expr.getLeft())) + (r ?? placeholder(expr.getRight()));
+    }
+    if (op === SyntaxKind.QuestionQuestionToken || op === SyntaxKind.BarBarToken) {
+      return evalString(ctx, expr.getLeft(), depth + 1) ?? evalString(ctx, expr.getRight(), depth + 1);
+    }
+  }
+  if (Node.isIdentifier(expr)) {
+    const init = ctx.consts.get(expr.getText());
+    return init && init !== node ? evalString(ctx, init, depth + 1) : void 0;
+  }
+  if (Node.isNewExpression(expr) && expr.getExpression().getText() === "URL") {
+    const [p, base] = expr.getArguments();
+    const pathPart = evalString(ctx, p, depth + 1);
+    const basePart = evalString(ctx, base, depth + 1);
+    return pathPart !== void 0 && basePart !== void 0 ? joinUrl(basePart, pathPart) : pathPart ?? void 0;
+  }
+  return void 0;
+}
+function placeholder(node) {
+  const expr = unwrap(node);
+  if (Node.isIdentifier(expr)) return `{${expr.getText()}}`;
+  if (Node.isPropertyAccessExpression(expr)) return `{${expr.getName()}}`;
+  if (Node.isCallExpression(expr) && expr.getArguments().length === 1) return placeholder(expr.getArguments()[0]);
+  return "{}";
+}
+function joinUrl(base, url) {
+  if (url === void 0) return void 0;
+  if (!base || /^[a-z]+:\/\//i.test(url)) return url;
+  return base.replace(/\/+$/, "") + "/" + url.replace(/^\/+/, "");
+}
+function parseUrl(url) {
+  if (url === void 0) return { host: null, path: null, query: [] };
+  let host = null;
+  let rest = url;
+  const m = /^(?:[a-z]+:)?\/\/([^/?#]+)(.*)$/i.exec(url);
+  if (m) {
+    host = m[1].includes("{") ? null : m[1].toLowerCase();
+    rest = m[2] || "/";
+  } else if (!url.startsWith("/")) {
+    const slash = url.indexOf("/");
+    rest = slash >= 0 ? url.slice(slash) : "/";
+    if (slash < 0) return { host: null, path: null, query: [] };
+  }
+  let path13 = rest.split(/[?#]/)[0].replace(/\/{2,}/g, "/");
+  if (path13.length > 1) path13 = path13.replace(/\/$/, "");
+  const search = /\?([^#]*)/.exec(rest)?.[1] ?? "";
+  const query = search.split("&").filter(Boolean).map((pair) => {
+    const [name, ...value2] = pair.split("=");
+    return { name, value: value2.length ? value2.join("=") : null };
+  });
+  return { host, path: path13 || "/", query };
+}
+
+// packages/extractor/src/surface.ts
+import { Node as Node2, SyntaxKind as SyntaxKind2 } from "ts-morph";
+var NOT_FIELDS = /* @__PURE__ */ new Set([
+  "length",
+  "map",
+  "filter",
+  "forEach",
+  "find",
+  "findIndex",
+  "some",
+  "every",
+  "includes",
+  "indexOf",
+  "reduce",
+  "slice",
+  "join",
+  "concat",
+  "flatMap",
+  "sort",
+  "keys",
+  "values",
+  "entries",
+  "at",
+  "push",
+  "toString",
+  "toLowerCase",
+  "toUpperCase",
+  "trim",
+  "split",
+  "startsWith",
+  "endsWith",
+  "replace",
+  "match",
+  "then",
+  "catch",
+  "finally",
+  "valueOf",
+  "toJSON"
+]);
+var ITEM_CALLBACKS = { map: 0, flatMap: 0, filter: 0, forEach: 0, find: 0, findIndex: 0, some: 0, every: 0, reduce: 1 };
+var MAX_DEPTH = 4;
+var Collector = class {
+  fields = /* @__PURE__ */ new Set();
+  statusCodes = /* @__PURE__ */ new Set();
+  checksOk = false;
+  enums = /* @__PURE__ */ new Map();
+  responseHeaders = /* @__PURE__ */ new Set();
+  addEnum(field, value2) {
+    const set = this.enums.get(field) ?? /* @__PURE__ */ new Set();
+    set.add(value2);
+    this.enums.set(field, set);
+  }
+};
+function addResponseSurface(found) {
+  const c = new Collector();
+  bindFrom(found.call, { space: "response", path: [] }, envelopeOf(found), c, 0);
+  const surface = found.site.surface;
+  surface.fields = [...c.fields].sort();
+  surface.statusCodes = [...c.statusCodes].sort((a, b) => a - b);
+  surface.checksOk = c.checksOk;
+  surface.enums = [...c.enums].map(([field, values]) => ({ field, values: [...values].sort() })).sort((a, b) => a.field.localeCompare(b.field));
+  surface.responseHeaders = [...c.responseHeaders].sort();
+}
+function envelopeOf({ site, call }) {
+  if (site.kind === "sdk") return site.provider === "github" ? "axios" : "body";
+  switch (site.client) {
+    case "axios":
+      return "axios";
+    case "got":
+      return "got";
+    case "undici":
+      return /request$/.test(call.getExpression().getText()) ? "undici" : "fetch";
+    default:
+      return "fetch";
+  }
+}
+function bindFrom(expr, loc, env, c, depth) {
+  if (depth > MAX_DEPTH) return;
+  let cur = expr;
+  for (; ; ) {
+    const p = cur.getParent();
+    if (p && (Node2.isAwaitExpression(p) || Node2.isParenthesizedExpression(p) || Node2.isAsExpression(p) || Node2.isNonNullExpression(p) || Node2.isSatisfiesExpression(p))) {
+      cur = p;
+    } else break;
+  }
+  const parent = cur.getParent();
+  if (!parent) return;
+  if (Node2.isPropertyAccessExpression(parent) && parent.getExpression() === cur && parent.getName() === "then") {
+    const thenCall = parent.getParent();
+    const cb = Node2.isCallExpression(thenCall) ? thenCall.getArguments()[0] : void 0;
+    if (cb && (Node2.isArrowFunction(cb) || Node2.isFunctionExpression(cb))) {
+      const param = cb.getParameters()[0];
+      if (param) bindName(param.getNameNode(), loc, param, env, c, depth);
+    }
+    return;
+  }
+  if (Node2.isVariableDeclaration(parent) && parent.getInitializer() === cur) {
+    bindName(parent.getNameNode(), loc, parent, env, c, depth);
+    return;
+  }
+  if (Node2.isBinaryExpression(parent) && parent.getRight() === cur && parent.getOperatorToken().getKind() === SyntaxKind2.EqualsToken) {
+    const left = parent.getLeft();
+    if (Node2.isIdentifier(left)) bindName(left, loc, parent, env, c, depth);
+    return;
+  }
+  use(cur, loc, env, c, depth);
+}
+function bindName(name, loc, decl, env, c, depth) {
+  if (Node2.isIdentifier(name)) {
+    for (const ref of referencesOf(name.getText(), decl)) use(ref, loc, env, c, depth);
+  } else if (Node2.isObjectBindingPattern(name)) {
+    for (const el of name.getElements()) {
+      const prop = el.getPropertyNameNode()?.getText() ?? el.getName();
+      bindName(el.getNameNode(), { ...loc, path: [...loc.path, prop] }, decl, env, c, depth);
+      interpret(env, { ...loc, path: [...loc.path, prop] }, [], el, c, depth, false);
+    }
+  }
+}
+function referencesOf(name, decl) {
+  const scope = decl.getFirstAncestor(
+    (n) => Node2.isBlock(n) || Node2.isSourceFile(n) || Node2.isArrowFunction(n) || Node2.isFunctionExpression(n) || Node2.isFunctionDeclaration(n) || Node2.isMethodDeclaration(n) || Node2.isCaseClause(n)
+  ) ?? decl.getSourceFile();
+  const after = decl.getEnd();
+  return scope.getDescendantsOfKind(SyntaxKind2.Identifier).filter((id) => {
+    if (id.getText() !== name || id.getStart() < after) return false;
+    const p = id.getParent();
+    if (Node2.isPropertyAccessExpression(p) && p.getNameNode() === id) return false;
+    if (Node2.isPropertyAssignment(p) && p.getNameNode() === id) return false;
+    if (Node2.isBindingElement(p) || Node2.isVariableDeclaration(p) || Node2.isParameterDeclaration(p)) return false;
+    return true;
+  });
+}
+function use(ref, loc, env, c, depth) {
+  const access = [];
+  let cur = ref;
+  for (; ; ) {
+    const p = cur.getParent();
+    if (Node2.isPropertyAccessExpression(p) && p.getExpression() === cur) {
+      access.push(p.getName());
+      cur = p;
+    } else if (Node2.isElementAccessExpression(p) && p.getExpression() === cur) {
+      const arg = p.getArgumentExpression();
+      if (arg && (Node2.isStringLiteral(arg) || Node2.isNoSubstitutionTemplateLiteral(arg))) access.push(arg.getLiteralValue());
+      else access.push("[]");
+      cur = p;
+    } else if (p && (Node2.isNonNullExpression(p) || Node2.isParenthesizedExpression(p))) {
+      cur = p;
+    } else break;
+  }
+  interpret(env, loc, access, cur, c, depth, true);
+}
+function interpret(env, loc, access, top, c, depth, compare) {
+  const full = [...loc.path, ...access];
+  if (loc.space === "body" || env === "body") {
+    body(full, top, c, compare, env, depth);
+    return;
+  }
+  const [first, ...rest] = full;
+  if (first === void 0) return;
+  const isCall = () => {
+    const p = top.getParent();
+    return Node2.isCallExpression(p) && p.getExpression() === top;
+  };
+  const statusKey = env === "got" || env === "undici" ? "statusCode" : "status";
+  if (first === statusKey && rest.length === 0) {
+    if (compare) for (const n of comparedLiterals(top).nums) c.statusCodes.add(n);
+    return;
+  }
+  if (first === "ok" && rest.length === 0) {
+    c.checksOk = true;
+    return;
+  }
+  if (first === "headers") {
+    const [h] = rest;
+    if (h === "get" && isCall()) {
+      const arg = top.getParent().getArguments()[0];
+      if (arg && Node2.isStringLiteral(arg)) c.responseHeaders.add(arg.getLiteralValue().toLowerCase());
+    } else if (h && h !== "get") c.responseHeaders.add(h.toLowerCase());
+    return;
+  }
+  if (env === "axios" && first === "data") return body(rest, top, c, compare, env, depth);
+  if (env === "got" && first === "body") return body(rest, top, c, compare, env, depth);
+  const bodyCall = (env === "fetch" || env === "got") && rest.length === 0 && (first === "json" || first === "text") || env === "undici" && first === "body" && rest.length === 1 && (rest[0] === "json" || rest[0] === "text");
+  if (bodyCall && isCall()) {
+    bindFrom(top.getParent(), { space: "body", path: [] }, env, c, depth + 1);
+  }
+}
+function body(path13, top, c, compare, env, depth) {
+  const cut = path13.findIndex((p) => NOT_FIELDS.has(p));
+  const fieldPath = cut >= 0 ? path13.slice(0, cut) : path13;
+  if (fieldPath.length === 0) return;
+  const field = fieldPath.join(".").replace(/\.\[\]/g, "[]");
+  c.fields.add(field);
+  if (compare && cut < 0) for (const s of comparedLiterals(top).strs) c.addEnum(field, s);
+  if (depth >= MAX_DEPTH) return;
+  const items = { space: "body", path: [...fieldPath, "[]"] };
+  const method = cut >= 0 && cut === path13.length - 1 ? path13[cut] : void 0;
+  const call = top.getParent();
+  if (method && method in ITEM_CALLBACKS && Node2.isCallExpression(call) && call.getExpression() === top) {
+    const cb = call.getArguments()[0];
+    const param = cb && (Node2.isArrowFunction(cb) || Node2.isFunctionExpression(cb)) ? cb.getParameters()[ITEM_CALLBACKS[method]] : void 0;
+    if (param) bindName(param.getNameNode(), items, param, env, c, depth + 1);
+    if (method === "find") bindFrom(call, items, env, c, depth + 1);
+    return;
+  }
+  const loop = top.getParent();
+  if (cut < 0 && Node2.isForOfStatement(loop) && loop.getExpression() === top) {
+    const list = loop.getInitializer();
+    const decl = Node2.isVariableDeclarationList(list) ? list.getDeclarations()[0] : void 0;
+    if (decl) bindName(decl.getNameNode(), items, decl, env, c, depth + 1);
+  }
+}
+function comparedLiterals(node) {
+  const nums = [];
+  const strs = [];
+  const take = (n) => {
+    if (!n) return;
+    if (Node2.isNumericLiteral(n)) nums.push(Number(n.getLiteralValue()));
+    else if (Node2.isStringLiteral(n) || Node2.isNoSubstitutionTemplateLiteral(n)) strs.push(n.getLiteralValue());
+  };
+  let cur = node;
+  while (Node2.isParenthesizedExpression(cur.getParent())) cur = cur.getParent();
+  const p = cur.getParent();
+  if (Node2.isBinaryExpression(p)) {
+    const op = p.getOperatorToken().getKind();
+    if (op === SyntaxKind2.EqualsEqualsEqualsToken || op === SyntaxKind2.ExclamationEqualsEqualsToken || op === SyntaxKind2.EqualsEqualsToken || op === SyntaxKind2.ExclamationEqualsToken) {
+      take(p.getLeft() === cur ? p.getRight() : p.getLeft());
+    }
+  } else if (Node2.isSwitchStatement(p) && p.getExpression() === cur) {
+    for (const clause of p.getClauses()) if (Node2.isCaseClause(clause)) take(clause.getExpression());
+  } else if (Node2.isCallExpression(p) && p.getArguments()[0] === cur) {
+    const callee = p.getExpression();
+    if (Node2.isPropertyAccessExpression(callee) && callee.getName() === "includes") {
+      const arr = callee.getExpression();
+      if (Node2.isArrayLiteralExpression(arr)) arr.getElements().forEach(take);
+    }
+  }
+  return { nums, strs };
+}
+
+// packages/extractor/src/files.ts
+import { readdirSync as readdirSync2, readFileSync as readFileSync2 } from "fs";
+import path3 from "path";
+var SOURCE_FILE = /\.(c|m)?[jt]sx?$/;
+var PYTHON_FILE = /\.py$/;
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", "build", "out", "coverage", "vendor", "bower_components", "venv", "__pycache__", "site-packages"]);
+var PYTHON_MANIFEST = /^(requirements[\w.-]*\.txt|pyproject\.toml)$/;
+function listRepoFiles(root) {
+  const sources = [];
+  const manifests = [];
+  const python = [];
+  const pythonManifests = [];
+  const walk2 = (dir) => {
+    for (const entry of readdirSync2(dir, { withFileTypes: true })) {
+      if (entry.name.startsWith(".")) continue;
+      const full = path3.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRS.has(entry.name)) walk2(full);
+      } else if (entry.isFile()) {
+        if (entry.name === "package.json") manifests.push(full);
+        else if (SOURCE_FILE.test(entry.name) && !entry.name.endsWith(".d.ts")) sources.push(full);
+        else if (PYTHON_FILE.test(entry.name)) python.push(full);
+        else if (PYTHON_MANIFEST.test(entry.name)) pythonManifests.push(full);
+      }
+    }
+  };
+  walk2(root);
+  return { sources: sources.sort(), manifests: manifests.sort(), python: python.sort(), pythonManifests: pythonManifests.sort() };
+}
+function declaredProviders(root, manifests) {
+  const found = [];
+  for (const manifest of manifests) {
+    let pkg;
+    try {
+      pkg = JSON.parse(readFileSync2(manifest, "utf8"));
+    } catch {
+      continue;
+    }
+    const names = /* @__PURE__ */ new Set();
+    for (const field of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
+      const deps = pkg[field];
+      if (deps && typeof deps === "object") for (const name of Object.keys(deps)) names.add(name);
+    }
+    for (const name of [...names].sort()) {
+      const provider = providerForPackage(name);
+      if (provider) found.push({ provider: provider.id, package: name, manifest: toPosix(path3.relative(root, manifest)) });
+    }
+  }
+  return found;
+}
+function toPosix(p) {
+  return p.split(path3.sep).join("/");
+}
+function declaredPythonProviders(root, manifests) {
+  const found = [];
+  for (const manifest of manifests) {
+    let text;
+    try {
+      text = readFileSync2(manifest, "utf8");
+    } catch {
+      continue;
+    }
+    const names = /* @__PURE__ */ new Set();
+    if (manifest.endsWith(".txt")) {
+      for (const line of text.split(/\r?\n/)) {
+        const m = /^\s*([A-Za-z0-9][A-Za-z0-9._-]*)/.exec(line.replace(/#.*/, ""));
+        if (m && !line.trim().startsWith("-")) names.add(m[1]);
+      }
+    } else {
+      let inTable = false;
+      let inList = false;
+      for (const line of text.split(/\r?\n/)) {
+        const t = line.replace(/#.*/, "").trim();
+        if (/^\[/.test(t)) {
+          inTable = /dependencies\]$/.test(t);
+          inList = false;
+          continue;
+        }
+        if (/^(dependencies|optional-dependencies|dev-dependencies)\s*=\s*\[/.test(t) || /^[\w-]+\s*=\s*\[/.test(t)) inList = true;
+        if (inList) for (const m of t.matchAll(/["']([A-Za-z0-9][A-Za-z0-9._-]*)/g)) names.add(m[1]);
+        if (inList && t.includes("]")) inList = false;
+        const kv = inTable ? /^([A-Za-z0-9][A-Za-z0-9._-]*)\s*=/.exec(t) : null;
+        if (kv) names.add(kv[1]);
+      }
+    }
+    for (const name of [...names].sort()) {
+      const provider = providerForPythonPackage(name);
+      if (provider) found.push({ provider: provider.id, package: name, manifest: toPosix(path3.relative(root, manifest)) });
+    }
+  }
+  return found;
+}
+
+// packages/extractor/src/python.ts
+import { existsSync } from "fs";
+import { createRequire } from "module";
+import { fileURLToPath } from "url";
+import { Language, Parser } from "web-tree-sitter";
+var parser;
+async function loadPythonParser() {
+  if (parser) return;
+  await Parser.init();
+  const bundled = fileURLToPath(new URL("./tree-sitter-python.wasm", import.meta.url));
+  const wasm = existsSync(bundled) ? bundled : createRequire(import.meta.url).resolve("tree-sitter-python/tree-sitter-python.wasm");
+  const language = await Language.load(wasm);
+  const p = new Parser();
+  p.setLanguage(language);
+  parser = p;
+}
+function pythonParserLoaded() {
+  return parser !== void 0;
+}
+var HTTP_LIBS = /* @__PURE__ */ new Set(["requests", "httpx", "aiohttp"]);
+var VERBS2 = /* @__PURE__ */ new Set(["get", "post", "put", "patch", "delete", "head", "options"]);
+function extractPython(source, file) {
+  if (!parser) throw new Error("call loadPythonParser() before extracting Python");
+  const tree = parser.parse(source);
+  if (!tree) return [];
+  try {
+    const root = tree.rootNode;
+    const ctx = { names: /* @__PURE__ */ new Map(), consts: /* @__PURE__ */ new Map() };
+    collectImports2(root, ctx);
+    collectConsts2(root, ctx);
+    collectClients2(root, ctx);
+    const sites = [];
+    for (const call of root.descendantsOfType("call")) {
+      if (!call) continue;
+      const site = httpCall(ctx, call) ?? sdkCall(ctx, call);
+      if (!site) continue;
+      site.file = file;
+      site.line = call.startPosition.row + 1;
+      site.column = call.startPosition.column + 1;
+      addResponseSurface2(call, site);
+      sites.push(site);
+    }
+    return sites;
+  } finally {
+    tree.delete();
+  }
+}
+function collectImports2(root, ctx) {
+  for (const st of root.descendantsOfType(["import_statement", "import_from_statement"])) {
+    if (!st) continue;
+    if (st.type === "import_statement") {
+      for (const item of st.namedChildren) {
+        if (!item) continue;
+        const dotted = item.type === "aliased_import" ? item.childForFieldName("name") : item;
+        const alias = item.type === "aliased_import" ? item.childForFieldName("alias")?.text : dotted?.text.split(".")[0];
+        if (!dotted || !alias) continue;
+        bindModule(ctx, alias, dotted.text);
+      }
+    } else {
+      const module = st.childForFieldName("module_name")?.text;
+      if (!module) continue;
+      for (const item of st.childrenForFieldName("name")) {
+        if (!item) continue;
+        const name = item.type === "aliased_import" ? item.childForFieldName("name")?.text : item.text;
+        const alias = item.type === "aliased_import" ? item.childForFieldName("alias")?.text : item.text;
+        if (name && alias) bindModule(ctx, alias, `${module}.${name}`);
+      }
+    }
+  }
+}
+function bindModule(ctx, alias, dotted) {
+  const top = dotted.split(".")[0];
+  if (HTTP_LIBS.has(top)) {
+    ctx.names.set(alias, { kind: "http-module", lib: top });
+    return;
+  }
+  const provider = providerForPythonModule(top);
+  if (provider) ctx.names.set(alias, { kind: "sdk-module", provider, module: dotted });
+}
+function collectConsts2(root, ctx) {
+  for (const st of root.namedChildren) {
+    const assign = st?.type === "expression_statement" ? st.namedChildren[0] : void 0;
+    if (assign?.type !== "assignment") continue;
+    const left = assign.childForFieldName("left");
+    const right = assign.childForFieldName("right");
+    if (left?.type === "identifier" && right) ctx.consts.set(left.text, right);
+  }
+}
+function collectClients2(root, ctx) {
+  const visit = (target, value2) => {
+    const call = unwrap2(value2);
+    if (call.type !== "call") return;
+    const fn = call.childForFieldName("function");
+    const chain = fn ? chainOf2(fn) : void 0;
+    if (!chain) return;
+    const base = ctx.names.get(chain.root);
+    if (!base) return;
+    if (base.kind === "http-module" || base.kind === "http-client") {
+      const ctor = chain.names.at(-1);
+      if (!ctor || !/^(Session|Client|AsyncClient|ClientSession)$/.test(ctor)) return;
+      const args = call.childForFieldName("arguments");
+      const baseUrl = evalString2(ctx, keyword(args, "base_url"));
+      ctx.names.set(target, { kind: "http-client", lib: base.lib, ...baseUrl ? { baseUrl } : {}, headers: dictEntries(ctx, keyword(args, "headers")) });
+      return;
+    }
+    if (base.kind === "sdk-module" && !sdkEndpoint2(base.provider, [...modulePath(base), ...chain.names])) {
+      ctx.names.set(target, { kind: "sdk-client", provider: base.provider, module: base.module });
+    }
+  };
+  for (const assign of root.descendantsOfType("assignment")) {
+    const left = assign?.childForFieldName("left");
+    const right = assign?.childForFieldName("right");
+    if (left && right && (left.type === "identifier" || left.type === "attribute")) visit(left.text, right);
+  }
+  for (const item of root.descendantsOfType("as_pattern")) {
+    const value2 = item?.namedChildren[0];
+    const alias = item?.childForFieldName("alias")?.namedChildren[0] ?? item?.namedChildren.at(-1);
+    if (value2 && alias && alias.type === "identifier") visit(alias.text, value2);
+  }
+}
+function httpCall(ctx, call) {
+  const fn = call.childForFieldName("function");
+  const chain = fn ? chainOf2(fn) : void 0;
+  if (!chain || chain.names.length === 0) {
+    return void 0;
+  }
+  const binding = ctx.names.get(chain.root) ?? ctx.names.get(chain.prefix(chain.names.length - 1));
+  const member = chain.names.at(-1);
+  if (!binding || binding.kind !== "http-module" && binding.kind !== "http-client") return void 0;
+  if (binding.kind === "http-module" && chain.names.length !== 1) return void 0;
+  const args = call.childForFieldName("arguments");
+  const positional = (args?.namedChildren ?? []).filter((a) => a && a.type !== "keyword_argument");
+  let method;
+  let urlNode;
+  if (VERBS2.has(member)) {
+    method = member.toUpperCase();
+    urlNode = positional[0] ?? keyword(args, "url");
+  } else if (member === "request") {
+    const m = evalString2(ctx, positional[0] ?? keyword(args, "method"))?.toUpperCase();
+    method = m && HTTP_METHODS.includes(m) ? m : null;
+    urlNode = positional[1] ?? keyword(args, "url");
+  } else return void 0;
+  const base = binding.kind === "http-client" ? binding.baseUrl : void 0;
+  const { host, path: path13, query } = parseUrl(joinUrl2(base, evalString2(ctx, urlNode)));
+  const surface = emptySurface2();
+  surface.headers = [...binding.kind === "http-client" ? binding.headers : [], ...dictEntries(ctx, keyword(args, "headers"))].map((h) => ({ ...h, name: h.name.toLowerCase() }));
+  surface.query = [...query, ...dictEntries(ctx, keyword(args, "params"))];
+  const provider = host ? providerForHost(host)?.id ?? null : null;
+  return { file: "", line: 0, column: 0, provider, kind: "http", client: binding.lib, method, host, endpoint: path13, resolved: Boolean(provider && path13 && method), surface };
+}
+function sdkCall(ctx, call) {
+  const fn = call.childForFieldName("function");
+  const chain = fn ? chainOf2(fn) : void 0;
+  if (!chain || chain.names.length === 0) return void 0;
+  const binding = ctx.names.get(chain.root);
+  if (!binding || binding.kind !== "sdk-module" && binding.kind !== "sdk-client") return void 0;
+  const names = binding.kind === "sdk-module" ? [...modulePath(binding), ...chain.names] : chain.names;
+  const ep = sdkEndpoint2(binding.provider, names);
+  if (!ep && (binding.kind === "sdk-module" || names.length < 2)) return void 0;
+  const surface = emptySurface2();
+  const host = binding.provider.hosts.find((h) => !h.startsWith("*.")) ?? null;
+  return {
+    file: "",
+    line: 0,
+    column: 0,
+    provider: binding.provider.id,
+    kind: "sdk",
+    client: binding.module.split(".")[0],
+    operation: names.join("."),
+    method: ep?.method ?? null,
+    host,
+    endpoint: ep?.path ?? null,
+    resolved: Boolean(ep),
+    surface
+  };
+}
+function modulePath(b) {
+  return b.module.split(".").slice(1);
+}
+function sdkEndpoint2(provider, names) {
+  let op = names.join(".");
+  if (provider.id === "stripe") op = op.replace(/^v1\./, "");
+  if (provider.id === "slack") {
+    const last = names.at(-1);
+    if (names.length !== 1 || !last || !/^[a-z]+(_[a-zA-Z0-9]+)+$/.test(last)) return void 0;
+    if (last === "files_upload_v2") return { method: "POST", path: "/api/files.completeUploadExternal" };
+    return { method: "POST", path: `/api/${last.replace(/_/g, ".")}` };
+  }
+  const ref = getProvider(provider.id)?.python?.methods?.[op];
+  if (!ref) return void 0;
+  const [method, path13] = ref.split(" ");
+  return { method, path: path13 };
+}
+var NOT_FIELDS2 = /* @__PURE__ */ new Set([
+  "keys",
+  "values",
+  "items",
+  "append",
+  "extend",
+  "lower",
+  "upper",
+  "strip",
+  "split",
+  "startswith",
+  "endswith",
+  "replace",
+  "format",
+  "encode",
+  "decode",
+  "count",
+  "index",
+  "copy",
+  "pop",
+  "update",
+  "sort"
+]);
+var SAME_DATA = /* @__PURE__ */ new Set(["to_dict", "to_dict_recursive", "model_dump", "dict"]);
+var MAX_DEPTH2 = 4;
+var Collector2 = class {
+  fields = /* @__PURE__ */ new Set();
+  statusCodes = /* @__PURE__ */ new Set();
+  checksOk = false;
+  enums = /* @__PURE__ */ new Map();
+  responseHeaders = /* @__PURE__ */ new Set();
+};
+function addResponseSurface2(call, site) {
+  const c = new Collector2();
+  const envelope = site.kind === "sdk" ? "body" : "response";
+  bindFrom2(call, { space: envelope, path: [] }, site.client, c, 0);
+  const s = site.surface;
+  s.fields = [...c.fields].sort();
+  s.statusCodes = [...c.statusCodes].sort((a, b) => a - b);
+  s.checksOk = c.checksOk;
+  s.enums = [...c.enums].map(([field, values]) => ({ field, values: [...values].sort() })).sort((a, b) => a.field.localeCompare(b.field));
+  s.responseHeaders = [...c.responseHeaders].sort();
+}
+function bindFrom2(expr, loc, lib, c, depth) {
+  if (depth > MAX_DEPTH2) return;
+  let cur = expr;
+  while (cur.parent && (cur.parent.type === "await" || cur.parent.type === "parenthesized_expression")) cur = cur.parent;
+  const parent = cur.parent;
+  if (!parent) return;
+  if (parent.type === "assignment" && parent.childForFieldName("right")?.id === cur.id) {
+    const left = parent.childForFieldName("left");
+    if (left?.type === "identifier") bindName2(left.text, parent, loc, lib, c, depth);
+    return;
+  }
+  if (parent.type === "as_pattern" && parent.namedChildren[0]?.id === cur.id) {
+    const alias = parent.childForFieldName("alias")?.namedChildren[0] ?? parent.namedChildren.at(-1);
+    if (alias?.type === "identifier") bindName2(alias.text, parent, loc, lib, c, depth);
+    return;
+  }
+  use2(cur, loc, lib, c, depth);
+}
+function bindName2(name, decl, loc, lib, c, depth) {
+  for (const ref of referencesOf2(name, decl)) use2(ref, loc, lib, c, depth);
+}
+function referencesOf2(name, decl) {
+  let scope = decl.parent;
+  while (scope && scope.type !== "function_definition" && scope.type !== "lambda" && scope.type !== "module") scope = scope.parent;
+  if (!scope) return [];
+  return scope.descendantsOfType("identifier").filter((id) => {
+    if (!id || id.text !== name || id.startIndex < decl.endIndex) return false;
+    const p = id.parent;
+    if (p?.type === "attribute" && p.childForFieldName("attribute")?.id === id.id) return false;
+    if (p?.type === "keyword_argument" && p.childForFieldName("name")?.id === id.id) return false;
+    if (p?.type === "assignment" && p.childForFieldName("left")?.id === id.id) return false;
+    return true;
+  });
+}
+function use2(ref, loc, lib, c, depth) {
+  const access = [];
+  let cur = ref;
+  for (; ; ) {
+    const p = cur.parent;
+    if (!p) break;
+    if (p.type === "attribute" && p.childForFieldName("object")?.id === cur.id) {
+      const name = p.childForFieldName("attribute")?.text ?? "";
+      const call = p.parent?.type === "call" && p.parent.childForFieldName("function")?.id === p.id ? p.parent : void 0;
+      if (call && name === "get" && (loc.space === "body" || access.length > 0)) {
+        const key = stringValue(call.childForFieldName("arguments")?.namedChildren[0] ?? void 0);
+        if (key === void 0) break;
+        access.push(key);
+        cur = call;
+        continue;
+      }
+      if (call && SAME_DATA.has(name) && loc.space === "body") {
+        cur = call;
+        continue;
+      }
+      access.push(name);
+      cur = p;
+    } else if (p.type === "subscript" && p.childForFieldName("value")?.id === cur.id) {
+      const key = stringValue(p.childForFieldName("subscript") ?? void 0);
+      access.push(key ?? "[]");
+      cur = p;
+    } else if (p.type === "parenthesized_expression" || p.type === "await") {
+      cur = p;
+    } else break;
+  }
+  interpret2(loc, access, cur, lib, c, depth);
+}
+function interpret2(loc, access, top, lib, c, depth) {
+  const full = [...loc.path, ...access];
+  if (loc.space === "body") return body2(full, top, lib, c, depth);
+  const [first, ...rest] = full;
+  if (first === void 0) return;
+  const isCall = top.parent?.type === "call" && top.parent.childForFieldName("function")?.id === top.id;
+  const statusKey = lib === "aiohttp" ? "status" : "status_code";
+  if (first === statusKey && rest.length === 0) {
+    for (const n of comparedLiterals2(top).nums) c.statusCodes.add(n);
+    return;
+  }
+  if (first === "ok" && rest.length === 0 || first === "raise_for_status" && isCall) {
+    c.checksOk = true;
+    return;
+  }
+  if (first === "headers") {
+    if (rest[0]) c.responseHeaders.add(rest[0].toLowerCase());
+    return;
+  }
+  if (first === "json" && rest.length === 0 && isCall) bindFrom2(top.parent, { space: "body", path: [] }, lib, c, depth + 1);
+}
+function body2(path13, top, lib, c, depth) {
+  const cut = path13.findIndex((p) => NOT_FIELDS2.has(p));
+  const fieldPath = cut >= 0 ? path13.slice(0, cut) : path13;
+  if (fieldPath.length === 0) {
+    if (path13.length === 0 && depth < MAX_DEPTH2) iterate(top, { space: "body", path: [] }, lib, c, depth);
+    return;
+  }
+  const field = fieldPath.join(".").replace(/\.\[\]/g, "[]");
+  c.fields.add(field);
+  if (cut < 0) {
+    for (const s of comparedLiterals2(top).strs) {
+      const set = c.enums.get(field) ?? /* @__PURE__ */ new Set();
+      set.add(s);
+      c.enums.set(field, set);
+    }
+    if (depth < MAX_DEPTH2) {
+      const parent = top.parent;
+      if (parent?.type === "assignment" && parent.childForFieldName("right")?.id === top.id) {
+        const left = parent.childForFieldName("left");
+        if (left?.type === "identifier") bindName2(left.text, parent, { space: "body", path: fieldPath }, lib, c, depth + 1);
+      }
+      iterate(top, { space: "body", path: fieldPath }, lib, c, depth);
+    }
+  }
+}
+function iterate(top, loc, lib, c, depth) {
+  const p = top.parent;
+  const items = { space: "body", path: [...loc.path, "[]"] };
+  if (p?.type === "for_statement" && p.childForFieldName("right")?.id === top.id) {
+    const left = p.childForFieldName("left");
+    if (left?.type === "identifier") bindName2(left.text, left, items, lib, c, depth + 1);
+  } else if (p?.type === "for_in_clause" && p.childForFieldName("right")?.id === top.id) {
+    const left = p.childForFieldName("left");
+    const comp = p.parent;
+    if (left?.type === "identifier" && comp) {
+      for (const id of comp.descendantsOfType("identifier")) {
+        if (id && id.text === left.text && id.id !== left.id) use2(id, items, lib, c, depth + 1);
+      }
+    }
+  }
+}
+function comparedLiterals2(node) {
+  const nums = [];
+  const strs = [];
+  let cur = node;
+  while (cur.parent?.type === "parenthesized_expression") cur = cur.parent;
+  const p = cur.parent;
+  if (p?.type !== "comparison_operator") return { nums, strs };
+  const take = (n) => {
+    if (!n) return;
+    if (n.type === "integer") nums.push(Number(n.text));
+    else if (n.type === "string") {
+      const v = stringValue(n);
+      if (v !== void 0) strs.push(v);
+    } else if (n.type === "tuple" || n.type === "list" || n.type === "set") n.namedChildren.forEach(take);
+  };
+  for (const operand of p.namedChildren) if (operand && operand.id !== cur.id) take(operand);
+  return { nums, strs };
+}
+function chainOf2(node) {
+  const names = [];
+  let cur = node;
+  while (cur.type === "attribute") {
+    names.unshift(cur.childForFieldName("attribute").text);
+    cur = cur.childForFieldName("object");
+  }
+  if (cur.type !== "identifier") return void 0;
+  const root = cur.text;
+  return { root, names, prefix: (n) => [root, ...names.slice(0, n)].join(".") };
+}
+function unwrap2(n) {
+  let cur = n;
+  while (cur.type === "await" || cur.type === "parenthesized_expression") cur = cur.namedChildren[0] ?? cur;
+  return cur;
+}
+function keyword(args, name) {
+  for (const a of args?.namedChildren ?? []) {
+    if (a?.type === "keyword_argument" && a.childForFieldName("name")?.text === name) return a.childForFieldName("value") ?? void 0;
+  }
+  return void 0;
+}
+function stringValue(n) {
+  if (!n || n.type !== "string") return void 0;
+  if (n.namedChildren.some((c) => c?.type === "interpolation")) return void 0;
+  return n.namedChildren.filter((c) => c?.type === "string_content" || c?.type === "escape_sequence").map((c) => c.text).join("");
+}
+function evalString2(ctx, node, depth = 0) {
+  if (!node || depth > 8) return void 0;
+  const n = unwrap2(node);
+  if (n.type === "string") {
+    let out = "";
+    for (const part of n.namedChildren) {
+      if (!part) continue;
+      if (part.type === "string_content" || part.type === "escape_sequence") out += part.text;
+      else if (part.type === "interpolation") {
+        const inner = part.childForFieldName("expression") ?? part.namedChildren[0];
+        out += (inner && evalString2(ctx, inner, depth + 1)) ?? placeholder2(inner ?? void 0);
+      }
+    }
+    return out;
+  }
+  if (n.type === "concatenated_string") return n.namedChildren.map((s) => evalString2(ctx, s ?? void 0, depth + 1) ?? "").join("");
+  if (n.type === "binary_operator" && n.childForFieldName("operator")?.text === "+") {
+    const l = evalString2(ctx, n.childForFieldName("left") ?? void 0, depth + 1);
+    const r = evalString2(ctx, n.childForFieldName("right") ?? void 0, depth + 1);
+    if (l === void 0 && r === void 0) return void 0;
+    return (l ?? placeholder2(n.childForFieldName("left") ?? void 0)) + (r ?? placeholder2(n.childForFieldName("right") ?? void 0));
+  }
+  if (n.type === "identifier") {
+    const init = ctx.consts.get(n.text);
+    return init && init.id !== node.id ? evalString2(ctx, init, depth + 1) : void 0;
+  }
+  if (n.type === "call") {
+    const fn = n.childForFieldName("function")?.text;
+    const args = (n.childForFieldName("arguments")?.namedChildren ?? []).filter(Boolean);
+    if ((fn === "os.getenv" || fn === "getenv" || fn === "os.environ.get") && args[1]) return evalString2(ctx, args[1], depth + 1);
+  }
+  return void 0;
+}
+function placeholder2(n) {
+  if (!n) return "{}";
+  const e = unwrap2(n);
+  if (e.type === "identifier") return `{${e.text}}`;
+  if (e.type === "attribute") return `{${e.childForFieldName("attribute")?.text ?? ""}}`;
+  const args = e.type === "call" ? (e.childForFieldName("arguments")?.namedChildren ?? []).filter(Boolean) : [];
+  if (args.length === 1) return placeholder2(args[0]);
+  return "{}";
+}
+function dictEntries(ctx, node, depth = 0) {
+  if (!node || depth > 3) return [];
+  const n = unwrap2(node);
+  if (n.type === "identifier") {
+    const init = ctx.consts.get(n.text);
+    return init ? dictEntries(ctx, init, depth + 1) : [];
+  }
+  if (n.type === "call" && n.childForFieldName("function")?.text === "dict") {
+    return (n.childForFieldName("arguments")?.namedChildren ?? []).filter((a) => a?.type === "keyword_argument").map((a) => ({ name: a.childForFieldName("name").text, value: literal(ctx, a.childForFieldName("value") ?? void 0) }));
+  }
+  if (n.type !== "dictionary") return [];
+  const out = [];
+  for (const pair of n.namedChildren) {
+    if (pair?.type !== "pair") continue;
+    const key = stringValue(pair.childForFieldName("key") ?? void 0);
+    if (key !== void 0) out.push({ name: key, value: literal(ctx, pair.childForFieldName("value") ?? void 0) });
+  }
+  return out;
+}
+function literal(ctx, n) {
+  if (!n) return null;
+  if (n.type === "integer" || n.type === "float") return n.text;
+  if (n.type === "true" || n.type === "false") return n.text.toLowerCase();
+  return evalString2(ctx, n) ?? null;
+}
+function joinUrl2(base, url) {
+  if (url === void 0) return base;
+  if (!base || /^[a-z]+:\/\//i.test(url)) return url;
+  return base.replace(/\/+$/, "") + "/" + url.replace(/^\/+/, "");
+}
+function emptySurface2() {
+  return { fields: [], statusCodes: [], checksOk: false, enums: [], headers: [], query: [], responseHeaders: [] };
+}
+
+// packages/extractor/src/index.ts
+var SCRIPT_KINDS = {
+  ".ts": ScriptKind.TS,
+  ".mts": ScriptKind.TS,
+  ".cts": ScriptKind.TS,
+  ".tsx": ScriptKind.TSX,
+  ".js": ScriptKind.JS,
+  ".mjs": ScriptKind.JS,
+  ".cjs": ScriptKind.JS,
+  ".jsx": ScriptKind.JSX
+};
+function extractCallSites(rootDir) {
+  const root = path4.resolve(rootDir);
+  const { sources, manifests, python, pythonManifests } = listRepoFiles(root);
+  const project = new Project({
+    useInMemoryFileSystem: true,
+    skipFileDependencyResolution: true,
+    compilerOptions: { allowJs: true }
+  });
+  const found = [];
+  for (const abs of sources) {
+    const rel = toPosix(path4.relative(root, abs));
+    const sf = project.createSourceFile(`/${rel}`, readFileSync3(abs, "utf8"), {
+      overwrite: true,
+      scriptKind: SCRIPT_KINDS[path4.extname(abs)] ?? ScriptKind.TS
+    });
+    for (const f of extractFromFile(sf, rel)) {
+      addResponseSurface(f);
+      found.push(f);
+    }
+  }
+  found.sort((a, b) => a.site.file.localeCompare(b.site.file) || a.site.line - b.site.line || a.site.column - b.site.column);
+  const skipped = [];
+  const pythonSites = [];
+  for (const abs of python) {
+    const rel = toPosix(path4.relative(root, abs));
+    if (!pythonParserLoaded()) {
+      skipped.push({ file: rel, reason: "the Python parser was not loaded" });
+      continue;
+    }
+    try {
+      pythonSites.push(...extractPython(readFileSync3(abs, "utf8"), rel));
+    } catch (err) {
+      skipped.push({ file: rel, reason: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  const callSites = [...found.map((f) => f.site), ...pythonSites].sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line || a.column - b.column);
+  return {
+    root,
+    filesScanned: sources.length + python.length - skipped.length,
+    callSites,
+    declared: [...declaredProviders(root, manifests), ...declaredPythonProviders(root, pythonManifests)],
+    found,
+    skipped
+  };
+}
+
+// packages/shapes/src/shape.ts
+import { createHash as createHash2, createHmac } from "crypto";
+import { z as z4 } from "zod";
+var JSON_TYPES = ["array", "boolean", "integer", "null", "number", "object", "string"];
+var VALUE_CLASSES = [
+  "datetime",
+  "date",
+  "uuid",
+  "url",
+  "email",
+  "id",
+  "token",
+  "text",
+  "positive",
+  "negative",
+  "zero",
+  "true",
+  "false"
+];
+var MAX_ENUM_VALUES = 50;
+var FieldShapeSchema = z4.object({
+  /** Field path, dot-separated, array items as "[]". Omitted when the shape is redacted. */
+  path: z4.string().optional(),
+  /** HMAC of the path with the provider salt; stable across observations. */
+  pathHash: z4.string(),
+  types: z4.array(z4.enum(JSON_TYPES)),
+  classes: z4.array(z4.enum(VALUE_CLASSES)),
+  /** How many times the field appeared (more than once inside arrays). */
+  occurrences: z4.number().int().nonnegative(),
+  /** Share of occurrences that were null. */
+  nullRate: z4.number().min(0).max(1),
+  /** Array lengths seen, for array fields. */
+  arrayLength: z4.object({ min: z4.number().int(), max: z4.number().int() }).optional(),
+  /** HMACs of distinct token values (enum candidates), never the values themselves. */
+  valueHashes: z4.array(z4.string()).optional()
+});
+var ResponseShapeSchema = z4.object({
+  status: z4.number().int(),
+  /** Allowlisted headers whose values describe the contract, not the payload. */
+  headers: z4.record(z4.string(), z4.string()),
+  /** Names of the other non-volatile headers present. */
+  headerNames: z4.array(z4.string()),
+  body: z4.object({
+    kind: z4.enum(["empty", "json", "text"]),
+    rootType: z4.enum(JSON_TYPES).optional(),
+    fields: z4.array(FieldShapeSchema)
+  })
+});
+var VALUE_HEADERS = /* @__PURE__ */ new Set([
+  "content-type",
+  "deprecation",
+  "sunset",
+  "link-deprecation",
+  "x-github-api-version-selected",
+  "stripe-version",
+  "x-api-version",
+  "api-version",
+  "openai-version",
+  "anthropic-version",
+  "intuit-minor-version"
+]);
+var VOLATILE_HEADERS = /* @__PURE__ */ new Set([
+  "date",
+  "age",
+  "etag",
+  "last-modified",
+  "expires",
+  "set-cookie",
+  "cf-ray",
+  "server-timing",
+  "x-request-id",
+  "request-id",
+  "x-github-request-id",
+  "x-runtime",
+  "x-served-by",
+  "x-cache",
+  "x-cache-hits",
+  "x-timer",
+  "content-length",
+  "connection",
+  "keep-alive",
+  "via",
+  "report-to",
+  "nel",
+  "idempotency-key",
+  "original-request",
+  // transport and caching: vary with chunking, compression and proxies, not with the API contract
+  "transfer-encoding",
+  "accept-ranges",
+  "content-encoding",
+  "vary",
+  "alt-svc",
+  "cache-control",
+  // token metadata: present only on authenticated calls, value changes per token
+  "github-authentication-token-expiration"
+]);
+function providerSalt(provider, secret) {
+  return createHmac("sha256", secret).update(provider).digest("hex");
+}
+function hmac(salt, value2) {
+  return createHmac("sha256", salt).update(value2).digest("hex").slice(0, 16);
+}
+function inferShape(res, opts) {
+  const headers = {};
+  const headerNames = [];
+  const entries = res.headers instanceof Headers ? [...res.headers.entries()] : Object.entries(res.headers);
+  for (const [rawName, value2] of entries) {
+    const name = rawName.toLowerCase();
+    if (VALUE_HEADERS.has(name)) headers[name] = name === "content-type" ? value2.split(";")[0].trim() : value2;
+    else if (!VOLATILE_HEADERS.has(name) && !name.startsWith("x-ratelimit") && !name.startsWith("ratelimit")) headerNames.push(name);
+  }
+  const text = res.body ?? "";
+  let body3;
+  if (text.trim() === "") {
+    body3 = { kind: "empty", fields: [] };
+  } else {
+    let parsed;
+    let isJson = true;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      isJson = false;
+    }
+    if (isJson) {
+      const acc = /* @__PURE__ */ new Map();
+      walk(parsed, "", acc);
+      body3 = { kind: "json", rootType: typeOf(parsed), fields: finish(acc, opts.salt) };
+    } else {
+      body3 = { kind: "text", fields: [] };
+    }
+  }
+  return {
+    status: res.status,
+    headers: Object.fromEntries(Object.entries(headers).sort(([a], [b]) => cmp3(a, b))),
+    headerNames: [...new Set(headerNames)].sort(),
+    body: body3
+  };
+}
+function walk(value2, path13, acc) {
+  if (path13 !== "") record(value2, path13, acc);
+  if (Array.isArray(value2)) {
+    for (const item of value2) walk(item, `${path13}[]`, acc);
+  } else if (value2 !== null && typeof value2 === "object") {
+    for (const [key, child] of Object.entries(value2)) walk(child, path13 === "" ? key : `${path13}.${key}`, acc);
+  }
+}
+function record(value2, path13, acc) {
+  let a = acc.get(path13);
+  if (!a) acc.set(path13, a = { types: /* @__PURE__ */ new Set(), classes: /* @__PURE__ */ new Set(), occurrences: 0, nulls: 0, tokens: /* @__PURE__ */ new Set(), textValues: 0 });
+  a.occurrences++;
+  const type = typeOf(value2);
+  a.types.add(type);
+  if (type === "null") a.nulls++;
+  if (Array.isArray(value2)) {
+    a.lengths = a.lengths ? { min: Math.min(a.lengths.min, value2.length), max: Math.max(a.lengths.max, value2.length) } : { min: value2.length, max: value2.length };
+  }
+  const cls = classify(value2);
+  if (cls) a.classes.add(cls);
+  if (cls === "token" && typeof value2 === "string") a.tokens.add(value2);
+}
+function finish(acc, salt) {
+  return [...acc.entries()].sort(([a], [b]) => cmp3(a, b)).map(([path13, a]) => {
+    const field = {
+      path: path13,
+      pathHash: hmac(salt, path13),
+      types: [...a.types].sort(),
+      classes: [...a.classes].sort(),
+      occurrences: a.occurrences,
+      nullRate: round(a.nulls / a.occurrences)
+    };
+    if (a.lengths) field.arrayLength = a.lengths;
+    if (a.tokens.size > 0 && a.tokens.size <= MAX_ENUM_VALUES) {
+      field.valueHashes = [...a.tokens].map((v) => hmac(salt, `${path13}=${v}`)).sort();
+    }
+    return field;
+  });
+}
+function typeOf(value2) {
+  if (value2 === null) return "null";
+  if (Array.isArray(value2)) return "array";
+  if (typeof value2 === "number") return Number.isInteger(value2) ? "integer" : "number";
+  if (typeof value2 === "boolean") return "boolean";
+  if (typeof value2 === "string") return "string";
+  return "object";
+}
+function classify(value2) {
+  if (typeof value2 === "boolean") return value2 ? "true" : "false";
+  if (typeof value2 === "number") return value2 > 0 ? "positive" : value2 < 0 ? "negative" : "zero";
+  if (typeof value2 !== "string") return void 0;
+  if (/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:?\d{2})?$/.test(value2)) return "datetime";
+  if (/^\d{4}-\d{2}-\d{2}$/.test(value2)) return "date";
+  if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value2)) return "uuid";
+  if (/^https?:\/\//i.test(value2)) return "url";
+  if (/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(value2)) return "email";
+  if (/^[a-z]{2,8}_(?=[A-Za-z0-9]*\d)[A-Za-z0-9]{8,}$/.test(value2) || /^\d{5,}$/.test(value2) || /^[0-9a-f]{20,}$/i.test(value2)) return "id";
+  if (/^[A-Za-z][A-Za-z0-9_.-]{0,39}$/.test(value2)) return "token";
+  return "text";
+}
+function shapeHash(shape) {
+  const structural = {
+    status: shape.status,
+    headers: shape.headers,
+    headerNames: shape.headerNames,
+    body: {
+      kind: shape.body.kind,
+      rootType: shape.body.rootType ?? null,
+      fields: shape.body.fields.map((f) => [f.pathHash, f.types, f.classes, f.nullRate > 0, f.valueHashes ?? null])
+    }
+  };
+  return createHash2("sha256").update(JSON.stringify(structural)).digest("hex");
+}
+function round(n) {
+  return Math.round(n * 1e3) / 1e3;
+}
+function cmp3(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
+// packages/shapes/src/store.ts
+import { mkdirSync as mkdirSync2 } from "fs";
+import path5 from "path";
+import Database from "better-sqlite3";
+var SCHEMA_VERSION = 1;
+var ShapeStore = class _ShapeStore {
+  constructor(db) {
+    this.db = db;
+  }
+  db;
+  /** Open (and create or migrate) a store. Use ":memory:" for tests. */
+  static open(file) {
+    if (file !== ":memory:") mkdirSync2(path5.dirname(path5.resolve(file)), { recursive: true });
+    const db = new Database(file);
+    if (file !== ":memory:") db.pragma("journal_mode = WAL");
+    const version = db.pragma("user_version", { simple: true });
+    if (version < SCHEMA_VERSION) {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS observations (
+          id INTEGER PRIMARY KEY,
+          provider TEXT NOT NULL,
+          method TEXT NOT NULL,
+          endpoint TEXT NOT NULL,
+          observed_at TEXT NOT NULL,
+          source TEXT NOT NULL,
+          shape_hash TEXT NOT NULL,
+          shape_json TEXT NOT NULL
+        );
+        CREATE INDEX IF NOT EXISTS observations_endpoint
+          ON observations (provider, method, endpoint, observed_at);
+      `);
+      db.pragma(`user_version = ${SCHEMA_VERSION}`);
+    }
+    return new _ShapeStore(db);
+  }
+  record(obs) {
+    const shape = ResponseShapeSchema.parse(obs.shape);
+    const hash = shapeHash(shape);
+    const info = this.db.prepare(
+      `INSERT INTO observations (provider, method, endpoint, observed_at, source, shape_hash, shape_json)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`
+    ).run(obs.provider, obs.method, obs.endpoint, obs.observedAt, obs.source, hash, JSON.stringify(shape));
+    return { ...obs, shape, id: Number(info.lastInsertRowid), shapeHash: hash };
+  }
+  /**
+   * Observations of one endpoint, newest first. Pass `source` to stay within one
+   * vantage point: the same endpoint answers differently with and without a token,
+   * so observations from different sources must not be compared.
+   */
+  history(provider, method, endpoint, opts = {}) {
+    const rows = this.db.prepare(
+      `SELECT * FROM observations WHERE provider = ? AND method = ? AND endpoint = ? AND (? IS NULL OR source = ?)
+         ORDER BY observed_at DESC, id DESC LIMIT ?`
+    ).all(provider, method, endpoint, opts.source ?? null, opts.source ?? null, opts.limit ?? 100);
+    return rows.map(fromRow);
+  }
+  latest(provider, method, endpoint, source) {
+    return this.history(provider, method, endpoint, { limit: 1, source })[0];
+  }
+  /** The most recent observation whose shape differs from the latest one: the "before" side of the last change. */
+  previousDistinct(provider, method, endpoint, source) {
+    const latest = this.latest(provider, method, endpoint, source);
+    if (!latest) return void 0;
+    const row = this.db.prepare(
+      `SELECT * FROM observations WHERE provider = ? AND method = ? AND endpoint = ? AND (? IS NULL OR source = ?)
+           AND shape_hash != ?
+         ORDER BY observed_at DESC, id DESC LIMIT 1`
+    ).get(provider, method, endpoint, source ?? null, source ?? null, latest.shapeHash);
+    return row ? fromRow(row) : void 0;
+  }
+  /** One row per endpoint and source. */
+  endpoints() {
+    return this.db.prepare(
+      `SELECT provider, method, endpoint, source, COUNT(*) AS observations, COUNT(DISTINCT shape_hash) AS distinctShapes,
+                MAX(observed_at) AS lastObservedAt
+         FROM observations GROUP BY provider, method, endpoint, source ORDER BY provider, endpoint, method, source`
+    ).all();
+  }
+  close() {
+    this.db.close();
+  }
+};
+function fromRow(row) {
+  return {
+    id: row.id,
+    provider: row.provider,
+    method: row.method,
+    endpoint: row.endpoint,
+    observedAt: row.observed_at,
+    source: row.source,
+    shapeHash: row.shape_hash,
+    shape: ResponseShapeSchema.parse(JSON.parse(row.shape_json))
+  };
+}
+
+// packages/shapes/src/diff.ts
+var IMPACT_ORDER = { breaking: 0, "non-breaking": 1, informational: 2 };
+var CONTRACT_HEADERS = /* @__PURE__ */ new Set(["content-type"]);
+var SUNSET_HEADERS = /* @__PURE__ */ new Set(["deprecation", "sunset", "link-deprecation"]);
+function diffShapes(before, after) {
+  const changes = [];
+  const ok = (s) => s >= 200 && s < 300;
+  if (before.status !== after.status) changes.push(statusChange(before.status, after.status));
+  if (before.body.kind !== after.body.kind) {
+    const lost = before.body.kind === "json" && after.body.kind !== "json";
+    changes.push({
+      kind: "body-kind",
+      impact: lost && ok(after.status) ? "breaking" : "informational",
+      ...lost && ok(after.status) ? { changeClass: "field-rename" } : {},
+      from: before.body.kind,
+      to: after.body.kind,
+      detail: `body ${before.body.kind} \u2192 ${after.body.kind}`
+    });
+  }
+  if (ok(before.status) === ok(after.status) && before.body.kind === "json" && after.body.kind === "json") {
+    changes.push(...fieldChanges(before.body.fields, after.body.fields));
+  }
+  changes.push(...headerChanges(before, after));
+  changes.sort((a, b) => IMPACT_ORDER[a.impact] - IMPACT_ORDER[b.impact] || (a.path ?? "").localeCompare(b.path ?? ""));
+  return { changes, breaking: changes.some((c) => c.impact === "breaking") };
+}
+function statusChange(from, to) {
+  const ok = (s) => s >= 200 && s < 300;
+  const base = { kind: "status-code", from, to, detail: `status ${from} \u2192 ${to}` };
+  if (ok(from) && ok(to)) return { ...base, impact: "breaking", changeClass: "status-code" };
+  if (ok(from) && (to === 401 || to === 403)) return { ...base, impact: "breaking", changeClass: "auth" };
+  if (ok(from) && (to === 404 || to === 410)) return { ...base, impact: "breaking", changeClass: "version-sunset" };
+  return { ...base, impact: "informational" };
+}
+function label(f) {
+  return f.path ?? `#${f.pathHash}`;
+}
+function fieldChanges(before, after) {
+  const out = [];
+  const prev = new Map(before.map((f) => [f.pathHash, f]));
+  const next = new Map(after.map((f) => [f.pathHash, f]));
+  const removedPaths = [];
+  const addedPaths = [];
+  const under = (path13, roots) => path13 !== void 0 && roots.some((r) => path13.startsWith(`${r}.`) || path13.startsWith(`${r}[]`));
+  for (const f of before) {
+    if (next.has(f.pathHash)) continue;
+    if (under(f.path, removedPaths)) continue;
+    if (f.path) removedPaths.push(f.path);
+    out.push({
+      kind: "field-removed",
+      impact: "breaking",
+      changeClass: "field-rename",
+      path: f.path,
+      pathHash: f.pathHash,
+      from: f.types,
+      detail: `field ${label(f)} removed`
+    });
+  }
+  for (const f of after) {
+    const old = prev.get(f.pathHash);
+    if (!old) {
+      if (under(f.path, addedPaths)) continue;
+      if (f.path) addedPaths.push(f.path);
+      out.push({
+        kind: "field-added",
+        impact: "non-breaking",
+        path: f.path,
+        pathHash: f.pathHash,
+        to: f.types,
+        detail: `field ${label(f)} added (${f.types.join(" | ")})`
+      });
+      continue;
+    }
+    const where = { path: f.path ?? old.path, pathHash: f.pathHash };
+    const name = f.path ?? old.path ?? `#${f.pathHash}`;
+    const newTypes = f.types.filter((t) => !old.types.includes(t));
+    const goneTypes = old.types.filter((t) => !f.types.includes(t));
+    const nonNullNew = newTypes.filter((t) => t !== "null");
+    if (nonNullNew.length > 0) {
+      out.push({
+        kind: "type-changed",
+        impact: "breaking",
+        changeClass: "field-rename",
+        ...where,
+        from: old.types,
+        to: f.types,
+        detail: `field ${name} type ${old.types.join(" | ")} \u2192 ${f.types.join(" | ")}`
+      });
+    } else if (newTypes.includes("null")) {
+      out.push({
+        kind: "became-nullable",
+        impact: "breaking",
+        changeClass: "required-field",
+        ...where,
+        from: old.types,
+        to: f.types,
+        detail: `field ${name} can now be null`
+      });
+    } else if (goneTypes.includes("null") && goneTypes.length === 1) {
+      out.push({ kind: "no-longer-nullable", impact: "informational", ...where, detail: `field ${name} no longer seen as null` });
+    }
+    const added = (f.valueHashes ?? []).filter((h) => !(old.valueHashes ?? []).includes(h));
+    if (enumLike(old) && added.length > 0) {
+      out.push({
+        kind: "enum-value-added",
+        impact: "breaking",
+        changeClass: "enum-added",
+        ...where,
+        to: added,
+        detail: `field ${name} has ${added.length} value${added.length === 1 ? "" : "s"} not seen before`
+      });
+    }
+    const newClasses = f.classes.filter((c) => !old.classes.includes(c));
+    if (nonNullNew.length === 0 && newClasses.length > 0 && old.classes.length > 0 && !newClasses.every((c) => ["positive", "negative", "zero", "true", "false"].includes(c))) {
+      out.push({
+        kind: "class-changed",
+        impact: "informational",
+        ...where,
+        from: old.classes,
+        to: f.classes,
+        detail: `field ${name} values look like ${f.classes.join(", ")} (were ${old.classes.join(", ")})`
+      });
+    }
+  }
+  return out;
+}
+function enumLike(f) {
+  const distinct = f.valueHashes?.length ?? 0;
+  return distinct > 0 && f.occurrences >= 2 * distinct;
+}
+function headerChanges(before, after) {
+  const out = [];
+  const names = /* @__PURE__ */ new Set([...Object.keys(before.headers), ...Object.keys(after.headers)]);
+  for (const name of [...names].sort()) {
+    const from = before.headers[name];
+    const to = after.headers[name];
+    if (from === to) continue;
+    if (SUNSET_HEADERS.has(name) && from === void 0) {
+      out.push({ kind: "header-added", impact: "informational", changeClass: "version-sunset", path: name, to, detail: `response now carries ${name}: ${to}` });
+    } else if (from === void 0 || to === void 0) {
+      out.push({
+        kind: from === void 0 ? "header-added" : "header-removed",
+        impact: "informational",
+        path: name,
+        ...from !== void 0 ? { from } : {},
+        ...to !== void 0 ? { to } : {},
+        detail: from === void 0 ? `header ${name}: ${to} added` : `header ${name} removed`
+      });
+    } else {
+      const contract = CONTRACT_HEADERS.has(name) && before.status === after.status;
+      out.push({
+        kind: "header-changed",
+        impact: contract ? "breaking" : "informational",
+        ...contract ? { changeClass: "field-rename" } : {},
+        path: name,
+        from,
+        to,
+        detail: `header ${name}: ${from} \u2192 ${to}`
+      });
+    }
+  }
+  const prevNames = new Set(before.headerNames);
+  const nextNames = new Set(after.headerNames);
+  for (const name of after.headerNames) {
+    if (!prevNames.has(name)) out.push({ kind: "header-added", impact: "informational", path: name, detail: `header ${name} added` });
+  }
+  for (const name of before.headerNames) {
+    if (!nextNames.has(name)) out.push({ kind: "header-removed", impact: "informational", path: name, detail: `header ${name} removed` });
+  }
+  return out;
+}
+
+// packages/canary/src/index.ts
+import { Command, CommanderError } from "commander";
+
+// packages/canary/src/draft.ts
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync2 } from "fs";
+import path6 from "path";
+
+// packages/canary/src/replay.ts
+import { readFileSync as readFileSync4 } from "fs";
+import { z as z5 } from "zod";
+var RecordingSchema = z5.object({
+  provider: z5.string(),
+  method: z5.enum(HTTP_METHODS),
+  endpoint: z5.string().startsWith("/"),
+  note: z5.string().optional(),
+  sources: z5.array(z5.url()).default([]),
+  observations: z5.array(
+    z5.object({
+      observedAt: z5.iso.datetime(),
+      status: z5.number().int(),
+      headers: z5.record(z5.string(), z5.string()).default({}),
+      body: z5.string().default("")
+    })
+  ).min(2)
+});
+function loadRecording(file) {
+  return RecordingSchema.parse(JSON.parse(readFileSync4(file, "utf8")));
+}
+function replay(recording, store, secret) {
+  const salt = providerSalt(recording.provider, secret);
+  const { provider, method, endpoint } = recording;
+  const observations = recording.observations.map(
+    (o) => store.record({
+      provider,
+      method,
+      endpoint,
+      observedAt: o.observedAt,
+      source: "replay",
+      shape: inferShape({ status: o.status, headers: o.headers, body: o.body }, { salt })
+    })
+  );
+  const after = store.latest(provider, method, endpoint, "replay");
+  const before = store.previousDistinct(provider, method, endpoint, "replay");
+  return { recording, observations, after, before, ...before ? { diff: diffShapes(before.shape, after.shape) } : {} };
+}
+
+// packages/repair/src/recipes/apply-fix.ts
+import { Node as Node3, SyntaxKind as SyntaxKind3 } from "ts-morph";
+var applyFix = {
+  id: "apply-fix",
+  changeClass: "version-sunset",
+  description: "Apply the advisory's fix: the new path, query value or header, and the renamed fields and enum values",
+  edits({ sourceFile, call, advisory }) {
+    const fix2 = advisory.fix;
+    if (!fix2) return [];
+    const where = (n) => `${sourceFile.getFilePath().slice(1)}:${n.getStartLineNumber()}`;
+    const edits = [...requestEdits(call, sourceFile, fix2, where), ...headerEdits(call, fix2, where)];
+    const scope = enclosingFunction(call) ?? sourceFile;
+    edits.push(...fieldEdits(scope, fix2, where, edits), ...enumEdits(scope, fix2, where));
+    return edits;
+  }
+};
+var TEXT_KINDS = [SyntaxKind3.StringLiteral, SyntaxKind3.NoSubstitutionTemplateLiteral, SyntaxKind3.TemplateHead, SyntaxKind3.TemplateMiddle, SyntaxKind3.TemplateTail];
+function requestEdits(call, sf, fix2, where) {
+  if (!fix2.path && !fix2.query) return [];
+  const edits = [];
+  for (const node of urlTextNodes(call, sf)) {
+    const before = node.getText();
+    let after = before;
+    if (fix2.path) {
+      after = after.split(fix2.path.from).join(fix2.path.to);
+      const from = fix2.path.from.replace(/\/$/, "");
+      const to = fix2.path.to.replace(/\/$/, "");
+      if (from !== fix2.path.from) after = after.replace(new RegExp(`${escapeRe(from)}(?=["'\`]|\\$\\{)`, "g"), to);
+    }
+    if (fix2.query) {
+      const re = new RegExp(`([?&])${escapeRe(fix2.query.name)}=([^&#\`'"$]+)`, "g");
+      after = after.replace(re, (_m, sep) => `${sep}${fix2.query.name}=${fix2.query.value}`);
+    }
+    if (after !== before) edits.push({ start: node.getStart(), end: node.getEnd(), text: after, note: `${where(node)} \`${before}\` \u2192 \`${after}\`` });
+  }
+  if (fix2.query) {
+    for (const prop of [...objectProperties(call, "params"), ...objectProperties(call, "searchParams")]) {
+      if (propName2(prop) !== fix2.query.name || !Node3.isPropertyAssignment(prop)) continue;
+      const init = prop.getInitializer();
+      if (!init || !(Node3.isNumericLiteral(init) || Node3.isStringLiteral(init))) continue;
+      const text = /^\d+(\.\d+)?$/.test(fix2.query.value) && Node3.isNumericLiteral(init) ? fix2.query.value : JSON.stringify(fix2.query.value);
+      if (init.getText() !== text) edits.push({ start: init.getStart(), end: init.getEnd(), text, note: `${where(init)} ${fix2.query.name}: \`${init.getText()}\` \u2192 \`${text}\`` });
+    }
+  }
+  return edits;
+}
+function headerEdits(call, fix2, where) {
+  if (!fix2.header) return [];
+  const edits = [];
+  const text = JSON.stringify(fix2.header.value);
+  for (const prop of objectProperties(call, "headers")) {
+    if (propName2(prop)?.toLowerCase() !== fix2.header.name.toLowerCase() || !Node3.isPropertyAssignment(prop)) continue;
+    const init = prop.getInitializer();
+    if (!init || !(Node3.isStringLiteral(init) || Node3.isNoSubstitutionTemplateLiteral(init)) || init.getLiteralText() === fix2.header.value) continue;
+    edits.push({ start: init.getStart(), end: init.getEnd(), text, note: `${where(init)} ${fix2.header.name}: \`${init.getText()}\` \u2192 \`${text}\`` });
+  }
+  return edits;
+}
+function fieldEdits(scope, fix2, where, taken) {
+  const edits = [];
+  for (const { from, to } of fix2.fields ?? []) {
+    const oldName = leaf(from);
+    const newName = leaf(to);
+    if (oldName === newName) continue;
+    for (const access of scope.getDescendantsOfKind(SyntaxKind3.PropertyAccessExpression)) {
+      if (access.getName() !== oldName || isWrite(access) || overlaps(access, [...taken, ...edits])) continue;
+      const target = access.getExpression().getText();
+      const dot = access.hasQuestionDotToken() ? "?." : ".";
+      const text = `(${target}${dot}${newName} ?? ${target}${dot}${oldName})`;
+      edits.push({ start: access.getStart(), end: access.getEnd(), text, note: `${where(access)} \`${access.getText()}\` \u2192 \`${text}\`` });
+    }
+  }
+  return edits;
+}
+function enumEdits(scope, fix2, where) {
+  const edits = [];
+  for (const { field, values } of fix2.enums ?? []) {
+    const name = leaf(field);
+    const renamed = new Map(values.map((v) => [v.from, v.to]));
+    const isField = (n) => Node3.isPropertyAccessExpression(n) && n.getName() === name || Node3.isIdentifier(n) && n.getText() === name;
+    for (const bin of scope.getDescendantsOfKind(SyntaxKind3.BinaryExpression)) {
+      const op = bin.getOperatorToken().getKind();
+      const negated = op === SyntaxKind3.ExclamationEqualsEqualsToken || op === SyntaxKind3.ExclamationEqualsToken;
+      if (!negated && op !== SyntaxKind3.EqualsEqualsEqualsToken && op !== SyntaxKind3.EqualsEqualsToken) continue;
+      const [lit, other] = Node3.isStringLiteral(bin.getRight()) ? [bin.getRight(), bin.getLeft()] : [bin.getLeft(), bin.getRight()];
+      if (!Node3.isStringLiteral(lit) || !isField(other)) continue;
+      const to = renamed.get(lit.getLiteralText());
+      if (to === void 0) continue;
+      const text = `${negated ? "!" : ""}${JSON.stringify([lit.getLiteralText(), to])}.includes(${other.getText()})`;
+      edits.push({ start: bin.getStart(), end: bin.getEnd(), text, note: `${where(bin)} \`${bin.getText()}\` \u2192 \`${text}\`` });
+    }
+    for (const sw of scope.getDescendantsOfKind(SyntaxKind3.SwitchStatement)) {
+      if (!isField(sw.getExpression())) continue;
+      const cases = sw.getClauses().filter(Node3.isCaseClause);
+      const present = new Set(cases.map((c) => c.getExpression()).filter(Node3.isStringLiteral).map((l) => l.getLiteralText()));
+      for (const c of cases) {
+        const e = c.getExpression();
+        const to = Node3.isStringLiteral(e) ? renamed.get(e.getLiteralText()) : void 0;
+        if (to === void 0 || present.has(to)) continue;
+        present.add(to);
+        const indent = " ".repeat(c.getSourceFile().getLineAndColumnAtPos(c.getStart()).column - 1);
+        edits.push({ start: c.getStart(), end: c.getStart(), text: `case ${JSON.stringify(to)}:
+${indent}`, note: `${where(c)} add case ${JSON.stringify(to)}` });
+      }
+    }
+    for (const inc of scope.getDescendantsOfKind(SyntaxKind3.CallExpression)) {
+      const callee = inc.getExpression();
+      if (!Node3.isPropertyAccessExpression(callee) || callee.getName() !== "includes" || !isField(inc.getArguments()[0] ?? inc)) continue;
+      const arr = callee.getExpression();
+      if (!Node3.isArrayLiteralExpression(arr)) continue;
+      const items = arr.getElements().filter(Node3.isStringLiteral).map((l) => l.getLiteralText());
+      const add = items.map((v) => renamed.get(v)).filter((v) => v !== void 0 && !items.includes(v));
+      if (!add.length) continue;
+      const text = JSON.stringify([...items, ...new Set(add)]);
+      edits.push({ start: arr.getStart(), end: arr.getEnd(), text, note: `${where(arr)} \`${arr.getText()}\` \u2192 \`${text}\`` });
+    }
+  }
+  return edits;
+}
+function urlTextNodes(call, sf) {
+  const out = /* @__PURE__ */ new Set();
+  const seen = /* @__PURE__ */ new Set();
+  const visit = (n, depth) => {
+    if (!n || depth > 4 || seen.has(n)) return;
+    seen.add(n);
+    if (TEXT_KINDS.includes(n.getKind())) out.add(n);
+    if (Node3.isIdentifier(n)) {
+      const decl = sf.getVariableDeclaration(n.getText());
+      if (decl?.getVariableStatement()?.getDeclarationKind() === "const") visit(decl.getInitializer(), depth + 1);
+      return;
+    }
+    n.forEachChild((c) => visit(c, depth));
+  };
+  const [first] = call.getArguments();
+  if (first && Node3.isObjectLiteralExpression(first)) {
+    const url = first.getProperty("url");
+    if (url && Node3.isPropertyAssignment(url)) visit(url.getInitializer(), 0);
+  } else visit(first, 0);
+  for (const prop of sf.getDescendantsOfKind(SyntaxKind3.PropertyAssignment)) if (propName2(prop) === "baseURL") visit(prop.getInitializer(), 0);
+  return [...out];
+}
+function objectProperties(call, name) {
+  const out = [];
+  for (const arg of call.getArguments()) {
+    if (!Node3.isObjectLiteralExpression(arg)) continue;
+    const prop = arg.getProperties().find((p) => propName2(p) === name);
+    const value2 = prop && Node3.isPropertyAssignment(prop) ? prop.getInitializer() : void 0;
+    if (value2 && Node3.isObjectLiteralExpression(value2)) out.push(...value2.getProperties());
+  }
+  return out;
+}
+function propName2(p) {
+  if (!(Node3.isPropertyAssignment(p) || Node3.isShorthandPropertyAssignment(p))) return void 0;
+  const n = p.getNameNode();
+  return Node3.isStringLiteral(n) || Node3.isNoSubstitutionTemplateLiteral(n) ? n.getLiteralText() : n.getText();
+}
+function enclosingFunction(call) {
+  return call.getFirstAncestor((n) => Node3.isFunctionDeclaration(n) || Node3.isArrowFunction(n) || Node3.isFunctionExpression(n) || Node3.isMethodDeclaration(n));
+}
+function isWrite(access) {
+  const p = access.getParent();
+  return Node3.isBinaryExpression(p) && p.getLeft() === access && p.getOperatorToken().getKind() === SyntaxKind3.EqualsToken;
+}
+function overlaps(n, edits) {
+  return edits.some((e) => n.getStart() < e.end && e.start < n.getEnd());
+}
+function leaf(path13) {
+  return path13.split(".").pop().replace(/\[\]/g, "");
+}
+function escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// packages/repair/src/recipes/status-code-accept-set.ts
+import { Node as Node4, SyntaxKind as SyntaxKind4 } from "ts-morph";
+var STATUS_PROPS = /* @__PURE__ */ new Set(["status", "statusCode"]);
+var statusCodeAcceptSet = {
+  id: "status-code-accept-set",
+  changeClass: "status-code",
+  description: "Accept the new status codes alongside the old ones wherever the response status is compared",
+  edits({ sourceFile, call, advisory }) {
+    const oldCodes = advisory.trigger.statusCodes ?? [];
+    const accept = [.../* @__PURE__ */ new Set([...oldCodes, ...advisory.trigger.newStatusCodes ?? []])].sort((a, b) => a - b);
+    if (oldCodes.length === 0 || accept.length === oldCodes.length) return [];
+    const list = `[${accept.join(", ")}]`;
+    const edits = [];
+    const where = (n) => `${sourceFile.getFilePath().slice(1)}:${n.getStartLineNumber()}`;
+    for (const status of statusExpressions(call)) {
+      let cur = status;
+      while (Node4.isParenthesizedExpression(cur.getParent())) cur = cur.getParent();
+      const parent = cur.getParent();
+      if (Node4.isBinaryExpression(parent)) {
+        const op = parent.getOperatorToken().getKind();
+        const other = parent.getLeft() === cur ? parent.getRight() : parent.getLeft();
+        if (!Node4.isNumericLiteral(other) || !oldCodes.includes(Number(other.getLiteralValue()))) continue;
+        const negated = op === SyntaxKind4.ExclamationEqualsEqualsToken || op === SyntaxKind4.ExclamationEqualsToken;
+        const equal = op === SyntaxKind4.EqualsEqualsEqualsToken || op === SyntaxKind4.EqualsEqualsToken;
+        if (!negated && !equal) continue;
+        const text = `${negated ? "!" : ""}${list}.includes(${status.getText()})`;
+        edits.push({ start: parent.getStart(), end: parent.getEnd(), text, note: `${where(parent)} \`${parent.getText()}\` \u2192 \`${text}\`` });
+      } else if (Node4.isSwitchStatement(parent) && parent.getExpression() === cur) {
+        const cases = parent.getClauses().filter(Node4.isCaseClause);
+        const present = new Set(cases.map((c) => c.getExpression()).filter(Node4.isNumericLiteral).map((l) => Number(l.getLiteralValue())));
+        const anchor = cases.find((c) => {
+          const e = c.getExpression();
+          return Node4.isNumericLiteral(e) && oldCodes.includes(Number(e.getLiteralValue()));
+        });
+        const missing = accept.filter((c) => !present.has(c));
+        if (!anchor || missing.length === 0) continue;
+        const indent = " ".repeat(sourceFile.getLineAndColumnAtPos(anchor.getStart()).column - 1);
+        const text = missing.map((c) => `case ${c}:
+${indent}`).join("");
+        edits.push({ start: anchor.getStart(), end: anchor.getStart(), text, note: `${where(anchor)} add ${missing.map((c) => `case ${c}`).join(", ")}` });
+      } else if (Node4.isCallExpression(parent) && parent.getArguments()[0] === cur) {
+        const callee = parent.getExpression();
+        const arr = Node4.isPropertyAccessExpression(callee) && callee.getName() === "includes" ? callee.getExpression() : void 0;
+        if (!arr || !Node4.isArrayLiteralExpression(arr)) continue;
+        const values = arr.getElements().filter(Node4.isNumericLiteral).map((l) => Number(l.getLiteralValue()));
+        if (!values.some((v) => oldCodes.includes(v))) continue;
+        const merged = [.../* @__PURE__ */ new Set([...values, ...accept])].sort((a, b) => a - b);
+        if (merged.length === values.length) continue;
+        const text = `[${merged.join(", ")}]`;
+        edits.push({ start: arr.getStart(), end: arr.getEnd(), text, note: `${where(arr)} \`${arr.getText()}\` \u2192 \`${text}\`` });
+      }
+    }
+    return edits;
+  }
+};
+function statusExpressions(call) {
+  const out = [];
+  let cur = call;
+  for (; ; ) {
+    const p = cur.getParent();
+    if (p && (Node4.isAwaitExpression(p) || Node4.isParenthesizedExpression(p) || Node4.isAsExpression(p) || Node4.isNonNullExpression(p))) cur = p;
+    else break;
+  }
+  const parent = cur.getParent();
+  const sf = call.getSourceFile();
+  if (Node4.isPropertyAccessExpression(parent) && parent.getExpression() === cur && STATUS_PROPS.has(parent.getName())) out.push(parent);
+  if (Node4.isPropertyAccessExpression(parent) && parent.getName() === "then") {
+    const cb = Node4.isCallExpression(parent.getParent()) ? parent.getParent().getArguments()[0] : void 0;
+    const param = cb && (Node4.isArrowFunction(cb) || Node4.isFunctionExpression(cb)) ? cb.getParameters()[0] : void 0;
+    if (param) out.push(...fromBinding(param.getNameNode(), param, sf));
+  }
+  if (Node4.isVariableDeclaration(parent) && parent.getInitializer() === cur) out.push(...fromBinding(parent.getNameNode(), parent, sf));
+  return out;
+}
+function fromBinding(name, decl, sf) {
+  const out = [];
+  if (Node4.isIdentifier(name)) {
+    for (const ref of references(name.getText(), decl, sf)) {
+      const p = ref.getParent();
+      if (Node4.isPropertyAccessExpression(p) && p.getExpression() === ref && STATUS_PROPS.has(p.getName())) out.push(p);
+    }
+  } else if (Node4.isObjectBindingPattern(name)) {
+    for (const el of name.getElements()) {
+      const prop = el.getPropertyNameNode()?.getText() ?? el.getName();
+      if (STATUS_PROPS.has(prop) && Node4.isIdentifier(el.getNameNode())) out.push(...references(el.getName(), decl, sf));
+    }
+  }
+  return out;
+}
+function references(name, decl, sf) {
+  const scope = decl.getFirstAncestor(
+    (n) => Node4.isBlock(n) || Node4.isArrowFunction(n) || Node4.isFunctionExpression(n) || Node4.isFunctionDeclaration(n) || Node4.isMethodDeclaration(n) || Node4.isCaseClause(n)
+  ) ?? sf;
+  return scope.getDescendantsOfKind(SyntaxKind4.Identifier).filter((id) => {
+    if (id.getText() !== name || id.getStart() < decl.getEnd()) return false;
+    const p = id.getParent();
+    if (Node4.isPropertyAccessExpression(p) && p.getNameNode() === id) return false;
+    if (Node4.isPropertyAssignment(p) && p.getNameNode() === id) return false;
+    return !(Node4.isBindingElement(p) || Node4.isVariableDeclaration(p) || Node4.isParameterDeclaration(p));
+  });
+}
+
+// packages/repair/src/recipe.ts
+import { Project as Project2, ScriptKind as ScriptKind2, SyntaxKind as SyntaxKind5 } from "ts-morph";
+function findCall(sf, site) {
+  return sf.getDescendantsOfKind(SyntaxKind5.CallExpression).filter((c) => {
+    const pos = sf.getLineAndColumnAtPos(c.getStart());
+    return pos.line === site.line && pos.column === site.column;
+  }).sort((a, b) => a.getWidth() - b.getWidth())[0];
+}
+function applyEdits(text, edits) {
+  let out = text;
+  for (const e of [...edits].sort((a, b) => b.start - a.start)) out = out.slice(0, e.start) + e.text + out.slice(e.end);
+  return out;
+}
+function runRecipe(recipes, advisory, callSite, text) {
+  const recipe = advisory.recipeId ? recipes[advisory.recipeId] : void 0;
+  if (!recipe) return { status: "no-recipe", reason: advisory.recipeId ? `unknown recipe ${advisory.recipeId}` : "advisory names no recipe" };
+  const project = new Project2({ useInMemoryFileSystem: true, skipFileDependencyResolution: true, compilerOptions: { allowJs: true } });
+  const kind = /\.(c|m)?jsx?$/.test(callSite.file) ? ScriptKind2.JS : callSite.file.endsWith("x") ? ScriptKind2.TSX : ScriptKind2.TS;
+  const sourceFile = project.createSourceFile(`/${callSite.file}`, text, { scriptKind: kind });
+  const call = findCall(sourceFile, callSite);
+  if (!call) return { status: "call-not-found", recipe: recipe.id, reason: `no call at ${callSite.file}:${callSite.line}:${callSite.column}` };
+  const edits = recipe.edits({ sourceFile, call, callSite, advisory });
+  if (edits.length === 0) return { status: "no-change", recipe: recipe.id, reason: "recipe found nothing to change" };
+  return {
+    status: "applied",
+    recipe: recipe.id,
+    change: { file: callSite.file, before: text, after: applyEdits(text, edits), notes: edits.map((e) => e.note) }
+  };
+}
+
+// packages/repair/src/contract.ts
+import path7 from "path";
+import { Node as Node5, Project as Project3, ScriptKind as ScriptKind3, SyntaxKind as SyntaxKind6 } from "ts-morph";
+
+// packages/repair/src/synth.ts
+function synthesizeBody(shape) {
+  if (shape.body.kind !== "json") return null;
+  const root = { children: /* @__PURE__ */ new Map() };
+  for (const field of shape.body.fields) {
+    if (field.path === void 0) throw new Error("cannot synthesize from a redacted shape (field paths removed)");
+    let node = root;
+    for (const token of tokens(field.path)) {
+      if (token === "[]") node = node.item ??= { children: /* @__PURE__ */ new Map() };
+      else {
+        let child = node.children.get(token);
+        if (!child) node.children.set(token, child = { children: /* @__PURE__ */ new Map() });
+        node = child;
+      }
+    }
+    node.field = field;
+  }
+  return value(root, shape.body.rootType === "array" ? "array" : "object");
+}
+function tokens(path13) {
+  const out = [];
+  for (const part of path13.split(".")) {
+    const m = /^([^[]*)((?:\[\])*)$/.exec(part);
+    if (m[1]) out.push(m[1]);
+    for (let i = 0; i < m[2].length / 2; i++) out.push("[]");
+  }
+  return out;
+}
+function value(node, forced) {
+  const types = node.field?.types.filter((t) => t !== "null") ?? [];
+  const kind = forced ?? (node.item || types.includes("array") ? "array" : node.children.size > 0 || types.includes("object") ? "object" : types[0]);
+  if (kind === "array") return node.item ? [value(node.item)] : [];
+  if (kind === "object") return Object.fromEntries([...node.children].map(([k, child]) => [k, value(child)]));
+  const classes = node.field?.classes ?? [];
+  switch (kind) {
+    case "integer":
+      return classes.includes("negative") ? -1 : classes.includes("zero") && !classes.includes("positive") ? 0 : 1;
+    case "number":
+      return classes.includes("negative") ? -1.5 : 1.5;
+    case "boolean":
+      return !classes.includes("false") || classes.includes("true");
+    case "string":
+      return sampleString(classes);
+    default:
+      return null;
+  }
+}
+function sampleString(classes) {
+  if (classes.includes("datetime")) return "2026-01-01T00:00:00Z";
+  if (classes.includes("date")) return "2026-01-01";
+  if (classes.includes("uuid")) return "00000000-0000-4000-8000-000000000000";
+  if (classes.includes("url")) return "https://example.com/shapi";
+  if (classes.includes("email")) return "shapi@example.com";
+  if (classes.includes("id")) return "id_shapi00000001";
+  if (classes.includes("token")) return "shapi_value";
+  return "shapi text";
+}
+function bodyFromPaths(paths, values = {}) {
+  const all = [.../* @__PURE__ */ new Set([...paths, ...Object.keys(values)])];
+  const isLeaf = (p) => !all.some((o) => o !== p && (o.startsWith(`${p}.`) || o.startsWith(`${p}[]`)));
+  const shape = {
+    status: 200,
+    headers: {},
+    headerNames: [],
+    body: {
+      kind: "json",
+      rootType: all.some((p) => p.startsWith("[]")) ? "array" : "object",
+      fields: all.map((path13) => ({ path: path13, pathHash: path13, types: isLeaf(path13) ? ["string"] : [], classes: [], occurrences: 1, nullRate: 0 }))
+    }
+  };
+  const body3 = synthesizeBody(shape);
+  for (const [path13, value2] of Object.entries(values)) setPath(body3, tokens(path13), value2);
+  return body3;
+}
+function setPath(target, path13, value2) {
+  let cur = target;
+  for (let i = 0; i < path13.length; i++) {
+    const t = path13[i];
+    const last = i === path13.length - 1;
+    if (t === "[]") {
+      const arr = cur;
+      if (last) arr[0] = value2;
+      else cur = arr[0];
+    } else {
+      const obj = cur;
+      if (last) obj[t] = value2;
+      else cur = obj[t];
+    }
+    if (cur === void 0 || cur === null) return;
+  }
+}
+
+// packages/repair/src/contract.ts
+var CONTRACT_DIR = "test/shapi";
+var RETIRED_STATUS = 410;
+function generateContractTest(input) {
+  const { callSite, advisory, before, after } = input;
+  const fix2 = advisory.fix;
+  const project = new Project3({ useInMemoryFileSystem: true, skipFileDependencyResolution: true, compilerOptions: { allowJs: true } });
+  const sf = project.createSourceFile(`/${callSite.file}`, input.sourceText, {
+    scriptKind: /\.(c|m)?jsx?$/.test(callSite.file) ? ScriptKind3.JS : ScriptKind3.TS
+  });
+  const call = findCall(sf, callSite);
+  if (!call) return { status: "unsupported", reason: `no call at ${callSite.file}:${callSite.line}:${callSite.column}` };
+  const transport = transportFor(callSite, sf);
+  if ("reason" in transport) return { status: "unsupported", reason: transport.reason };
+  const fn = exportedFunction(call);
+  if (!fn) return { status: "unsupported", reason: "the call site is not inside an exported function" };
+  const file = input.file ?? `${CONTRACT_DIR}/${advisory.id}.test.ts`;
+  const importPath = toImport(path7.posix.relative(path7.posix.dirname(file), callSite.file));
+  const parts = {
+    header: `// Generated by SHAPI for advisory ${advisory.id}: ${advisory.title}
+// Call site: ${callSite.file}:${callSite.line} (${callSite.method} ${callSite.endpoint}, via ${callSite.client})`,
+    fn: fn.name,
+    importPath,
+    args: fn.params.map((p) => argument(p, sf)).join(", "),
+    advisory,
+    transport
+  };
+  if (fix2 && (fix2.path || fix2.query || fix2.header)) {
+    if (callSite.kind === "sdk") return { status: "unsupported", reason: `the fix changes the request, which ${callSite.client} builds itself` };
+    return { status: "generated", file, content: requestTest({ ...parts, fix: fix2, body: renamePair(callSite, fix2).after }), functionName: fn.name };
+  }
+  if (fix2 && (fix2.fields || fix2.enums)) {
+    return { status: "generated", file, content: sameResultTest({ ...parts, ...renamePair(callSite, fix2) }), functionName: fn.name };
+  }
+  if (!before || !after) return { status: "unsupported", reason: "no before/after responses for this endpoint, and the advisory has no fix to build a test from" };
+  try {
+    return { status: "generated", file, content: recordedTest({ ...parts, before, after }), functionName: fn.name };
+  } catch (err) {
+    return { status: "unsupported", reason: err instanceof Error ? err.message : String(err) };
+  }
+}
+function transportFor(site, sf) {
+  if (site.kind === "http") {
+    if (site.client === "fetch" || site.client === "ky") return { mock: "", stubFetch: true, name: "fetch" };
+    if (site.client === "node-fetch") {
+      return { mock: `vi.mock("node-fetch", () => ({ default: (input: RequestInfo | URL, init?: RequestInit) => globalThis.fetch(input, init) }));
+`, stubFetch: true, name: "node-fetch" };
+    }
+    if (site.client === "axios") return { mock: AXIOS_FAKE, stubFetch: false, name: "axios" };
+    if (site.client === "got") return { mock: GOT_FAKE, stubFetch: false, name: "got" };
+    return { reason: `contract tests support fetch, node-fetch, ky, axios, got and SDK call sites; this one uses ${site.client}` };
+  }
+  const decl = sf.getImportDeclarations().find((d) => d.getModuleSpecifierValue() === site.client);
+  if (!decl) return { reason: `${site.file} does not import ${site.client} with an import statement` };
+  const names = decl.getNamedImports().map((n) => n.getName());
+  const exports = [`default: client`, ...names.map((n) => `${JSON.stringify(n)}: client`)].join(", ");
+  const url = `https://${site.host ?? "sdk.invalid"}${site.endpoint ?? "/"}`;
+  const envelope = site.provider === "github" ? `{ status: res.status, data: res.body, headers: res.headers }` : `res.body`;
+  return {
+    mock: `vi.mock(${JSON.stringify(site.client)}, () => {
+  const call = async () => {
+    const res = shapi.respond({ method: ${JSON.stringify(site.method ?? "GET")}, url: ${JSON.stringify(url)}, headers: {} });
+    if (res.status >= 400) throw Object.assign(new Error(\`${site.client} request failed with \${res.status}\`), { status: res.status, statusCode: res.status, response: { status: res.status, data: res.body } });
+    return ${envelope};
+  };
+  const client: any = new Proxy(function () {}, {
+    get: (_t, prop) => (prop === "then" || typeof prop === "symbol" ? undefined : client),
+    apply: () => call(),
+    construct: () => client,
+  });
+  return { ${exports} };
+});
+`,
+    stubFetch: false,
+    name: `a fake ${site.client} client`
+  };
+}
+function preamble(p) {
+  return `import { afterEach, describe, expect, it, vi } from "vitest";
+
+type ShapiRequest = { method: string; url: string; headers: Record<string, string> };
+type ShapiResponse = { status: number; body: unknown; headers: Record<string, string> };
+const shapi = vi.hoisted(() => ({
+  respond: (_req: { method: string; url: string; headers: Record<string, string> }): { status: number; body: unknown; headers: Record<string, string> } => ({ status: 200, body: null, headers: {} }),
+  lower: (h: unknown): Record<string, string> =>
+    Object.fromEntries(Object.entries((h ?? {}) as Record<string, unknown>).filter(([, v]) => v !== undefined).map(([k, v]) => [k.toLowerCase(), String(v)])),
+}));
+${p.transport.mock}
+import { ${p.fn} } from "${p.importPath}";
+${p.transport.stubFetch ? `
+const shapiFetch = vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+  const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+  const headers = Object.fromEntries(new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined)).entries());
+  const res = shapi.respond({ method: (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase(), url, headers });
+  return new Response(res.body === null ? null : JSON.stringify(res.body), { status: res.status, headers: res.headers });
+});
+` : ""}
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+async function run(respond: (req: ShapiRequest) => ShapiResponse): Promise<unknown> {
+  shapi.respond = respond;${p.transport.stubFetch ? `
+  vi.stubGlobal("fetch", shapiFetch);` : ""}
+  return ${p.fn}(${p.args});
+}
+`;
+}
+var JSON_HEADERS = `{ "content-type": "application/json" }`;
+function requestTest(p) {
+  const checks = [];
+  if (p.fix.path) checks.push(`url.href.includes(${JSON.stringify(p.fix.path.from)})`);
+  if (p.fix.query) {
+    const name = JSON.stringify(p.fix.query.name);
+    const below = p.advisory.trigger.query?.find((q) => q.name === p.fix.query.name)?.below;
+    checks.push(
+      below === void 0 ? `(url.searchParams.has(${name}) && url.searchParams.get(${name}) !== ${JSON.stringify(p.fix.query.value)})` : `(url.searchParams.has(${name}) && Number(url.searchParams.get(${name})) < ${below})`
+    );
+  }
+  if (p.fix.header) {
+    const name = JSON.stringify(p.fix.header.name.toLowerCase());
+    checks.push(`(${name} in req.headers && req.headers[${name}] !== ${JSON.stringify(p.fix.header.value)})`);
+  }
+  return `${p.header}
+// The provider no longer accepts the old request: ${p.transport.name} is replaced by a stub that answers it
+// with ${RETIRED_STATUS}, and answers anything else with a body holding the fields the code reads. The test
+// fails until ${p.fn}() sends the new request (${describeFix(p.fix)}) and still works.
+${preamble(p)}
+const body = ${JSON.stringify(p.body)};
+
+function retired(req: ShapiRequest): boolean {
+  const url = new URL(req.url, "https://shapi.invalid");
+  return ${checks.join(" || ")};
+}
+
+describe("SHAPI contract: ${p.advisory.id}", () => {
+  it("${p.fn} sends the new request and handles the response", async () => {
+    const sent: boolean[] = [];
+    await run((req) => {
+      const old = retired(req);
+      sent.push(old);
+      return old ? { status: ${RETIRED_STATUS}, body: { error: "retired request (SHAPI contract test)" }, headers: ${JSON_HEADERS} } : { status: 200, body, headers: ${JSON_HEADERS} };
+    });
+    expect(sent.length).toBeGreaterThan(0);
+    expect(sent).not.toContain(true);
+  });
+});
+`;
+}
+function sameResultTest(p) {
+  return `${p.header}
+// The provider renamed fields or enum values. This test calls ${p.fn}() once with the old response and
+// once with the new one (${p.transport.name} replaced by a stub), and expects the same result: it fails
+// while the code only reads the old names.
+${preamble(p)}
+const responses = [
+  { name: "old", body: ${JSON.stringify(p.before)} },
+  { name: "new", body: ${JSON.stringify(p.after)} },
+];
+
+describe("SHAPI contract: ${p.advisory.id}", () => {
+  it("${p.fn} returns the same result for the old and the new response", async () => {
+    const results: unknown[] = [];
+    for (const r of responses) results.push(await run(() => ({ status: 200, body: r.body, headers: ${JSON_HEADERS} })));
+    expect(results[1]).toEqual(results[0]);
+  });
+});
+`;
+}
+function recordedTest(p) {
+  const responses = [response(`before (${p.before.status})`, p.before), response(`after (${p.after.status})`, p.after)].join(",\n");
+  return `${p.header}
+// Calls ${p.fn}() with ${p.transport.name} returning the response the code was written for and the one
+// ${p.advisory.provider} sends now. It fails while the code accepts only the old response.
+${preamble(p)}
+const responses = [
+${responses},
+];
+
+describe("SHAPI contract: ${p.advisory.id}", () => {
+  for (const r of responses) {
+    it(\`${p.fn} handles the \${r.name} response\`, async () => {
+      const seen: ShapiRequest[] = [];
+      await run((req) => (seen.push(req), { status: r.status, body: r.body, headers: r.headers }));
+      expect(seen.length).toBeGreaterThan(0);
+    });
+  }
+});
+`;
+}
+function renamePair(site, fix2) {
+  const paths = site.surface.fields;
+  const rename = (p) => {
+    for (const { from, to } of fix2.fields ?? []) {
+      if (!/[.[]/.test(from)) {
+        const segs = p.split(".");
+        const i = segs.findIndex((seg) => seg.replace(/\[\]/g, "") === from);
+        if (i >= 0) return [...segs.slice(0, i), segs[i].replace(from, to), ...segs.slice(i + 1)].join(".");
+      } else if (p === from || p.startsWith(`${from}.`) || p.startsWith(`${from}[]`)) return to + p.slice(from.length);
+    }
+    return p;
+  };
+  const oldValues = {};
+  const newValues = {};
+  for (const { field, values } of fix2.enums ?? []) {
+    const compared = site.surface.enums.find((e) => e.field === field)?.values ?? [];
+    const pick = values.find((v) => compared.includes(v.from)) ?? values[0];
+    oldValues[field] = pick.from;
+    newValues[rename(field)] = pick.to;
+  }
+  return { before: bodyFromPaths(paths, oldValues), after: bodyFromPaths(paths.map(rename), newValues) };
+}
+function describeFix(fix2) {
+  const parts = [];
+  if (fix2.path) parts.push(`${fix2.path.to} instead of ${fix2.path.from}`);
+  if (fix2.query) parts.push(`${fix2.query.name}=${fix2.query.value}`);
+  if (fix2.header) parts.push(`${fix2.header.name}: ${fix2.header.value}`);
+  return parts.join(", ");
+}
+var AXIOS_FAKE = `vi.mock("axios", () => {
+  class AxiosError extends Error {
+    isAxiosError = true;
+    constructor(message: string, readonly response?: unknown, readonly status?: number) {
+      super(message);
+    }
+  }
+  const build = (defaults: any = {}): any => {
+    const send = async (config: any) => {
+      const c = { ...defaults, ...config, headers: { ...defaults.headers, ...config.headers }, params: { ...defaults.params, ...config.params } };
+      let url = String(c.url ?? "");
+      if (c.baseURL && !/^[a-z]+:\\/\\//i.test(url)) url = String(c.baseURL).replace(/\\/+$/, "") + "/" + url.replace(/^\\/+/, "");
+      const qs = new URLSearchParams(Object.entries(c.params).filter(([, v]) => v !== undefined && v !== null).map(([k, v]) => [k, String(v)])).toString();
+      if (qs) url += (url.includes("?") ? "&" : "?") + qs;
+      const res = shapi.respond({ method: String(c.method ?? "get").toUpperCase(), url, headers: shapi.lower(c.headers) });
+      const response = { status: res.status, statusText: "", headers: res.headers, data: res.body, config: c };
+      if (res.status < 200 || res.status >= 300) throw new AxiosError(\`Request failed with status code \${res.status}\`, response, res.status);
+      return response;
+    };
+    const instance: any = (a: any, b?: any) => send(typeof a === "string" ? { ...b, url: a } : a);
+    instance.request = (c: any) => send(c);
+    for (const m of ["get", "delete", "head", "options"]) instance[m] = (url: string, c: any = {}) => send({ ...c, url, method: m });
+    for (const m of ["post", "put", "patch"]) instance[m] = (url: string, data: unknown, c: any = {}) => send({ ...c, url, data, method: m });
+    instance.create = (d: any = {}) => build({ ...defaults, ...d, headers: { ...defaults.headers, ...d.headers } });
+    instance.defaults = defaults;
+    instance.interceptors = { request: { use: () => 0, eject: () => {} }, response: { use: () => 0, eject: () => {} } };
+    instance.isAxiosError = (e: any) => Boolean(e?.isAxiosError);
+    return instance;
+  };
+  const axios = build();
+  return { default: axios, create: axios.create, isAxiosError: axios.isAxiosError, AxiosError };
+});
+`;
+var GOT_FAKE = `vi.mock("got", () => {
+  class HTTPError extends Error {
+    constructor(readonly response: any) {
+      super(\`Response code \${response.statusCode}\`);
+    }
+  }
+  const build = (defaults: any = {}): any => {
+    const call = (input: any, options: any = {}) => {
+      const fromObject = typeof input === "object" && !(input instanceof URL);
+      const o = { ...defaults, ...(fromObject ? input : options), headers: { ...defaults.headers, ...(fromObject ? input.headers : options.headers) } };
+      let url = fromObject ? String(o.url ?? "") : String(input);
+      if (o.prefixUrl) url = String(o.prefixUrl).replace(/\\/+$/, "") + "/" + url.replace(/^\\/+/, "");
+      const sp = o.searchParams;
+      const qs = sp ? new URLSearchParams(typeof sp === "string" || sp instanceof URLSearchParams ? sp : Object.entries(sp).map(([k, v]) => [k, String(v)])).toString() : "";
+      if (qs) url += (url.includes("?") ? "&" : "?") + qs;
+      const res = shapi.respond({ method: String(o.method ?? "GET").toUpperCase(), url, headers: shapi.lower(o.headers) });
+      const text = res.body === null ? "" : JSON.stringify(res.body);
+      const response = { statusCode: res.status, headers: res.headers, body: o.responseType === "json" ? res.body : text, url };
+      const failed = (o.throwHttpErrors ?? true) && res.status >= 400;
+      const settle = <T,>(value: T): Promise<T> => (failed ? Promise.reject(new HTTPError(response)) : Promise.resolve(value));
+      const promise: any = settle(response);
+      promise.catch(() => {});
+      promise.json = () => settle(res.body);
+      promise.text = () => settle(text);
+      promise.buffer = () => settle(Buffer.from(text));
+      return promise;
+    };
+    const got: any = (input: any, options?: any) => call(input, options);
+    for (const m of ["get", "post", "put", "patch", "delete", "head"]) got[m] = (input: any, options: any = {}) => call(input, { ...options, method: m.toUpperCase() });
+    got.extend = (...opts: any[]) => build(Object.assign({}, defaults, ...opts));
+    return got;
+  };
+  return { default: build(), HTTPError };
+});
+`;
+function response(name, shape) {
+  const body3 = synthesizeBody(shape);
+  const headers = shape.headers["content-type"] ? { "content-type": shape.headers["content-type"] } : {};
+  return `  { name: ${JSON.stringify(name)}, status: ${shape.status}, headers: ${JSON.stringify(headers)}, body: ${JSON.stringify(body3)} }`;
+}
+function exportedFunction(call) {
+  for (const anc of call.getAncestors()) {
+    if (Node5.isFunctionDeclaration(anc) && anc.isExported() && anc.getName()) return { name: anc.getName(), params: anc.getParameters() };
+    if (Node5.isArrowFunction(anc) || Node5.isFunctionExpression(anc)) {
+      const decl = anc.getParent();
+      if (Node5.isVariableDeclaration(decl) && decl.getVariableStatement()?.isExported()) return { name: decl.getName(), params: anc.getParameters() };
+    }
+  }
+  return void 0;
+}
+function argument(p, sf) {
+  const type = p.getTypeNode();
+  return type ? valueFor(type, p.getName(), sf, 0) : JSON.stringify(`shapi-${p.getName()}`);
+}
+function valueFor(type, name, sf, depth) {
+  if (depth > 4) return "undefined as never";
+  switch (type.getKind()) {
+    case SyntaxKind6.StringKeyword:
+      return JSON.stringify(`shapi-${name}`);
+    case SyntaxKind6.NumberKeyword:
+      return "1";
+    case SyntaxKind6.BooleanKeyword:
+      return "true";
+  }
+  if (Node5.isTypeLiteral(type)) return objectFrom(type.getProperties(), sf, depth);
+  if (Node5.isTypeReference(type)) {
+    const ref = type.getTypeName().getText();
+    const iface = sf.getInterface(ref);
+    if (iface) return objectFrom(iface.getProperties(), sf, depth);
+    const alias = sf.getTypeAlias(ref)?.getTypeNode();
+    if (alias) return valueFor(alias, name, sf, depth + 1);
+  }
+  if (Node5.isArrayTypeNode(type)) return "[]";
+  return "undefined as never";
+}
+function objectFrom(props, sf, depth) {
+  const entries = props.filter((p) => !p.hasQuestionToken()).map((p) => {
+    const t = p.getTypeNode();
+    return `${JSON.stringify(p.getName())}: ${t ? valueFor(t, p.getName(), sf, depth + 1) : "undefined as never"}`;
+  });
+  return `{ ${entries.join(", ")} }`;
+}
+function toImport(rel) {
+  const noExt = rel.replace(/\.(c|m)?[jt]sx?$/, "");
+  return noExt.startsWith(".") ? noExt : `./${noExt}`;
+}
+
+// packages/repair/src/agent.ts
+import path10 from "path";
+
+// packages/repair/src/runner.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync2 } from "fs";
+import { createRequire as createRequire2 } from "module";
+import path8 from "path";
+function vitestCli(dir) {
+  const local = path8.join(dir, "node_modules", "vitest", "vitest.mjs");
+  if (existsSync2(local)) return local;
+  const require2 = createRequire2(import.meta.url);
+  return path8.join(path8.dirname(require2.resolve("vitest/package.json")), "vitest.mjs");
+}
+function runTestFile(dir, file, timeoutMs = 12e4) {
+  const res = spawnSync(process.execPath, [vitestCli(dir), "run", file, "--root", dir, "--reporter", "verbose", "--no-color"], {
+    cwd: dir,
+    encoding: "utf8",
+    timeout: timeoutMs,
+    env: { ...process.env, FORCE_COLOR: "0", CI: "1" }
+  });
+  const output = `${res.stdout ?? ""}${res.stderr ?? ""}${res.error ? `
+${res.error.message}` : ""}`;
+  const exitCode = res.status ?? 1;
+  return { passed: exitCode === 0, exitCode, output };
+}
+function testsRan(output) {
+  return /^\s*Tests\s+.*\d+ (?:failed|passed)/m.test(output);
+}
+function runFailure(output) {
+  const lines = output.split("\n").map((l) => l.trim()).filter(Boolean);
+  return lines.find((l) => /\b\w*Error: |\berror: /i.test(l)) ?? lines.find((l) => /Cannot find|not found|Error/.test(l)) ?? lines[0] ?? "no output";
+}
+
+// packages/repair/src/workspace.ts
+import { cpSync, existsSync as existsSync3, mkdirSync as mkdirSync4, mkdtempSync, readFileSync as readFileSync5, symlinkSync, writeFileSync as writeFileSync3 } from "fs";
+import os from "os";
+import path9 from "path";
+var COPY_SKIP = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "coverage", ".shapi"]);
+function localWorkspace(repoDir) {
+  const dir = mkdtempSync(path9.join(os.tmpdir(), "shapi-repair-"));
+  cpSync(repoDir, dir, {
+    recursive: true,
+    filter: (src) => !COPY_SKIP.has(path9.basename(src)) || path9.resolve(src) === path9.resolve(repoDir)
+  });
+  const modules = path9.join(repoDir, "node_modules");
+  if (existsSync3(modules)) symlinkSync(modules, path9.join(dir, "node_modules"), "junction");
+  return {
+    location: dir,
+    async read(file) {
+      const abs = path9.join(dir, file);
+      return existsSync3(abs) ? readFileSync5(abs, "utf8") : void 0;
+    },
+    async write(file, content) {
+      const abs = path9.join(dir, file);
+      mkdirSync4(path9.dirname(abs), { recursive: true });
+      writeFileSync3(abs, content);
+    },
+    async runTest(file) {
+      return runTestFile(dir, file);
+    }
+  };
+}
+
+// packages/repair/src/agent.ts
+var PROTECTED = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "coverage", ".shapi"]);
+async function repairCallSite(input) {
+  const { advisory, callSite } = input;
+  if (!input.workspace && !input.repoDir) throw new Error("repairCallSite needs a workspace or a repoDir");
+  if (!/\.(c|m)?[jt]sx?$/.test(callSite.file)) {
+    return { status: "unsupported", changes: [], attempts: [], reason: `fixes support TypeScript and JavaScript; ${callSite.file} is scanned only` };
+  }
+  const ws = input.workspace ?? localWorkspace(input.repoDir);
+  const original = await ws.read(callSite.file);
+  if (original === void 0) return { status: "unsupported", sandbox: ws.location, changes: [], attempts: [], reason: `${callSite.file} is not in the repository` };
+  const test = generateContractTest({ callSite, advisory, before: input.before, after: input.after, sourceText: original, file: input.testFile });
+  if (test.status !== "generated") return { status: "unsupported", changes: [], attempts: [], reason: test.reason };
+  await ws.write(test.file, test.content);
+  const testChange = { file: test.file, before: "", after: test.content, notes: ["generated contract test"] };
+  const baseline = await ws.runTest(test.file);
+  if (!baseline.passed && !testsRan(baseline.output)) {
+    return {
+      status: "unsupported",
+      sandbox: ws.location,
+      changes: [],
+      test: { file: test.file, content: test.content },
+      baseline,
+      attempts: [],
+      reason: `the contract test could not run: ${runFailure(baseline.output)}`
+    };
+  }
+  if (baseline.passed) {
+    return {
+      status: "already-handled",
+      sandbox: ws.location,
+      changes: [],
+      test: { file: test.file, content: test.content },
+      baseline,
+      attempts: [],
+      reason: "the contract test already passes against the new response"
+    };
+  }
+  const attempts = [];
+  const recipe = runRecipe(input.recipes, advisory, callSite, original);
+  if (recipe.status === "applied") {
+    await ws.write(callSite.file, recipe.change.after);
+    const run3 = await ws.runTest(test.file);
+    attempts.push({ method: "recipe", outcome: run3.passed ? "passed" : "failed", detail: recipe.recipe, run: run3 });
+    if (run3.passed) {
+      return { status: "fixed", method: "recipe", sandbox: ws.location, changes: [recipe.change, testChange], test: { file: test.file, content: test.content }, baseline, attempts };
+    }
+    await ws.write(callSite.file, original);
+  } else {
+    attempts.push({ method: "recipe", outcome: "skipped", detail: recipe.reason });
+  }
+  if (!input.llm) {
+    attempts.push({ method: "llm", outcome: "skipped", detail: "no LLM fixer configured" });
+    return rejected(ws, test, baseline, attempts);
+  }
+  const proposal = await input.llm.fix({
+    advisory,
+    callSite,
+    file: { path: callSite.file, content: original },
+    test: { path: test.file, content: test.content },
+    failingOutput: baseline.output
+  });
+  if (proposal.status !== "proposed") {
+    attempts.push({ method: "llm", outcome: "skipped", detail: proposal.reason });
+    return rejected(ws, test, baseline, attempts);
+  }
+  const changes = [];
+  for (const f of proposal.files) {
+    const rel = path10.posix.normalize(f.path.replaceAll("\\", "/"));
+    if (rel.startsWith("..") || path10.posix.isAbsolute(rel) || rel === test.file || rel.split("/").some((s) => PROTECTED.has(s))) {
+      attempts.push({ method: "llm", outcome: "failed", detail: `refused to write ${f.path}: outside the repo, the test, or a protected folder` });
+      await restore(ws, changes);
+      return rejected(ws, test, baseline, attempts);
+    }
+    const before = await ws.read(rel) ?? "";
+    await ws.write(rel, f.content);
+    changes.push({ file: rel, before, after: f.content, notes: [proposal.explanation] });
+  }
+  const run2 = await ws.runTest(test.file);
+  attempts.push({ method: "llm", outcome: run2.passed ? "passed" : "failed", detail: `${proposal.model}: ${proposal.explanation}`, run: run2 });
+  if (run2.passed) {
+    return { status: "fixed", method: "llm", sandbox: ws.location, changes: [...changes, testChange], test: { file: test.file, content: test.content }, baseline, attempts };
+  }
+  await restore(ws, changes);
+  return rejected(ws, test, baseline, attempts);
+}
+function rejected(ws, test, baseline, attempts) {
+  return {
+    status: "rejected",
+    sandbox: ws.location,
+    changes: [],
+    test: { file: test.file, content: test.content },
+    baseline,
+    attempts,
+    reason: "no change made the contract test pass"
+  };
+}
+async function restore(ws, changes) {
+  for (const c of changes) await ws.write(c.file, c.before);
+}
+async function repairAdvisory(input) {
+  if (!input.workspace && !input.repoDir) throw new Error("repairAdvisory needs a workspace or a repoDir");
+  const ws = input.workspace ?? localWorkspace(input.repoDir);
+  const seen = /* @__PURE__ */ new Set();
+  const order = input.callSites.filter((s) => {
+    const key = `${s.file}:${s.line}:${s.column}`;
+    return !seen.has(key) && Boolean(seen.add(key));
+  }).sort((a, b) => a.file.localeCompare(b.file) || b.line - a.line || b.column - a.column);
+  const originals = /* @__PURE__ */ new Map();
+  const sites = [];
+  for (const [i, callSite] of order.entries()) {
+    if (!originals.has(callSite.file)) originals.set(callSite.file, await ws.read(callSite.file) ?? "");
+    const testFile = `test/shapi/${input.advisory.id}${i === 0 ? "" : `.${i + 1}`}.test.ts`;
+    const result = await repairCallSite({ ...input, workspace: ws, callSite, testFile });
+    for (const c of result.changes) if (c.before && !originals.has(c.file)) originals.set(c.file, c.before);
+    sites.push({ callSite, result });
+  }
+  const fixed = sites.filter((s) => s.result.status === "fixed");
+  const needed = sites.filter((s) => s.result.status !== "already-handled");
+  const tests = new Set(fixed.map((s) => s.result.test?.file));
+  const sourceFiles = [...new Set(fixed.flatMap((s) => s.result.changes.filter((c) => !tests.has(c.file)).map((c) => c.file)))].sort();
+  const changes = [];
+  for (const file of sourceFiles) {
+    const notes = fixed.flatMap((s) => s.result.changes.filter((c) => c.file === file).flatMap((c) => c.notes));
+    changes.push({ file, before: originals.get(file) ?? "", after: await ws.read(file) ?? "", notes });
+  }
+  for (const s of fixed) if (s.result.test) changes.push({ file: s.result.test.file, before: "", after: s.result.test.content, notes: ["generated contract test"] });
+  const methods = new Set(fixed.map((s) => s.result.method));
+  return {
+    status: fixed.length === 0 ? "none" : fixed.length === needed.length ? "fixed" : "partial",
+    sites,
+    changes,
+    ...fixed.length ? { method: methods.has("llm") ? "llm" : "recipe" } : {},
+    sandbox: ws.location
+  };
+}
+
+// packages/repair/src/llm.ts
+import Anthropic from "@anthropic-ai/sdk";
+import { z as z6 } from "zod";
+var DEFAULT_REPAIR_MODEL = "claude-fable-5-1";
+var ProposalSchema = z6.object({
+  files: z6.array(z6.object({ path: z6.string().min(1), content: z6.string() })).min(1),
+  explanation: z6.string()
+});
+var SUBMIT_FIX = {
+  name: "submit_fix",
+  description: "Submit the corrected files. Each entry is a repo-relative path and the file's complete new content (not a diff). Include only files you changed. Never include the contract test.",
+  strict: true,
+  input_schema: {
+    type: "object",
+    properties: {
+      files: {
+        type: "array",
+        items: {
+          type: "object",
+          properties: { path: { type: "string" }, content: { type: "string" } },
+          required: ["path", "content"],
+          additionalProperties: false
+        }
+      },
+      explanation: { type: "string", description: "One or two sentences on what changed and why, for the pull request." }
+    },
+    required: ["files", "explanation"],
+    additionalProperties: false
+  }
+};
+var SYSTEM = `You repair third-party API integrations after the provider changed its behavior.
+You get a breaking-change advisory, the call site that depends on the old behavior, the file around it, and a contract test that calls the code with the old response and with the new one. The test currently fails on the new response.
+Make the smallest change that lets the code handle both responses. Keep its behavior for the old response, keep the file's style, and do not touch unrelated code. Do not edit the test.
+When done, call submit_fix with the complete content of each file you changed. If no safe change exists, explain why in text and do not call the tool.`;
+function claudeFixer(opts = {}) {
+  const client = opts.client ?? new Anthropic();
+  const model = opts.model ?? process.env.SHAPI_REPAIR_MODEL ?? DEFAULT_REPAIR_MODEL;
+  return {
+    async fix(req) {
+      let response2;
+      try {
+        response2 = await client.beta.messages.create({
+          model,
+          max_tokens: 16e3,
+          // Thinking is always on for this model; effort sets its depth.
+          output_config: { effort: "high" },
+          // On a safety-classifier decline, retry server-side on Anthropic's recommended fallback model.
+          betas: ["server-side-fallback-2026-07-01"],
+          fallbacks: "default",
+          system: SYSTEM,
+          tools: [SUBMIT_FIX],
+          tool_choice: { type: "auto" },
+          messages: [{ role: "user", content: prompt(req) }]
+        });
+      } catch (err) {
+        if (err instanceof Anthropic.AuthenticationError) return { status: "declined", reason: "Claude API authentication failed (set ANTHROPIC_API_KEY)" };
+        if (err instanceof Anthropic.RateLimitError) return { status: "declined", reason: "Claude API rate limit reached; retry later" };
+        if (err instanceof Anthropic.APIError) return { status: "declined", reason: `Claude API error ${err.status ?? ""}: ${err.message}`.trim() };
+        throw err;
+      }
+      if (response2.stop_reason === "refusal") {
+        return { status: "declined", reason: `model declined (${response2.stop_details?.category ?? "no category"})` };
+      }
+      if (response2.stop_reason === "max_tokens") return { status: "declined", reason: "response hit max_tokens before finishing" };
+      const call = response2.content.find((b) => b.type === "tool_use" && b.name === "submit_fix");
+      if (!call) {
+        const text = response2.content.filter((b) => b.type === "text").map((b) => b.text).join("\n");
+        return { status: "declined", reason: text.trim() || "model did not submit a fix" };
+      }
+      const parsed = ProposalSchema.safeParse(call.input);
+      if (!parsed.success) return { status: "declined", reason: `fix did not match the submit_fix schema: ${z6.prettifyError(parsed.error)}` };
+      return { status: "proposed", ...parsed.data, model: response2.model };
+    }
+  };
+}
+function prompt(req) {
+  const { advisory, callSite } = req;
+  return `<advisory>
+${JSON.stringify(
+    {
+      id: advisory.id,
+      provider: advisory.provider,
+      title: advisory.title,
+      summary: advisory.summary,
+      endpoint: advisory.endpoint,
+      changeClass: advisory.changeClass,
+      trigger: advisory.trigger,
+      migrationNote: advisory.migrationNote
+    },
+    null,
+    2
+  )}
+</advisory>
+
+<call_site>${callSite.file}:${callSite.line}:${callSite.column} ${callSite.method ?? "?"} ${callSite.endpoint ?? "?"}</call_site>
+
+<file path="${req.file.path}">
+${req.file.content}
+</file>
+
+<contract_test path="${req.test.path}">
+${req.test.content}
+</contract_test>
+
+<failing_test_output>
+${req.failingOutput.slice(-6e3)}
+</failing_test_output>`;
+}
+
+// packages/repair/src/index.ts
+var RECIPES = {
+  [statusCodeAcceptSet.id]: statusCodeAcceptSet,
+  [applyFix.id]: applyFix
+};
+
+// packages/github-app/src/pr.ts
+import { execFileSync } from "child_process";
+import { readFileSync as readFileSync6 } from "fs";
+import { createAppAuth } from "@octokit/auth-app";
+import { Octokit } from "@octokit/rest";
+
+// packages/github-app/src/policy.ts
+var STOP_LABEL = "shapi:stop";
+
+// packages/github-app/src/pr.ts
+function octokitFor(auth, opts = {}) {
+  const request = opts.fetch ? { fetch: opts.fetch } : void 0;
+  if ("token" in auth) return new Octokit({ auth: auth.token, userAgent: "shapi", request });
+  return new Octokit({
+    authStrategy: createAppAuth,
+    auth: { appId: auth.appId, privateKey: auth.privateKey, installationId: auth.installationId },
+    userAgent: "shapi",
+    request
+  });
+}
+function authFromEnv(env = process.env) {
+  const key = env.SHAPI_GITHUB_APP_PRIVATE_KEY ?? (env.SHAPI_GITHUB_APP_PRIVATE_KEY_PATH ? readFileSync6(env.SHAPI_GITHUB_APP_PRIVATE_KEY_PATH, "utf8") : void 0);
+  if (env.SHAPI_GITHUB_APP_ID && env.SHAPI_GITHUB_APP_INSTALLATION_ID && key) {
+    return { appId: env.SHAPI_GITHUB_APP_ID, privateKey: key, installationId: Number(env.SHAPI_GITHUB_APP_INSTALLATION_ID) };
+  }
+  const token = env.GITHUB_TOKEN ?? env.GH_TOKEN;
+  if (token) return { token };
+  try {
+    const fromGh = execFileSync("gh", ["auth", "token"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return fromGh ? { token: fromGh } : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var FIX_TRAILER = "SHAPI-Branch";
+async function upsertFixPr(octokit, pr) {
+  const { owner, repo } = splitRepo(pr.repo);
+  const message = `${pr.commitMessage.trimEnd()}
+
+${FIX_TRAILER}: ${pr.branch}`;
+  const { data: prs } = await octokit.rest.pulls.list({ owner, repo, head: `${owner}:${pr.branch}`, state: "all", sort: "created", direction: "desc", per_page: 10 });
+  const openPr = prs.find((p) => p.state === "open");
+  const latest = prs[0];
+  const closedByMaintainer = !openPr && latest && !latest.merged_at;
+  if (closedByMaintainer && !pr.retryClosed) {
+    return { action: "skipped", reason: "closed without merging", branch: pr.branch, url: latest.html_url, number: latest.number, state: "closed" };
+  }
+  const head = await branchHead(octokit, owner, repo, pr.branch);
+  const ours = head ? (await octokit.rest.git.getCommit({ owner, repo, commit_sha: head })).data.message.includes(`${FIX_TRAILER}: ${pr.branch}`) : true;
+  if (openPr) {
+    const found = { branch: pr.branch, url: openPr.html_url, number: openPr.number, state: "open" };
+    if (openPr.labels.some((l) => l.name === STOP_LABEL)) return { action: "skipped", reason: `labeled ${STOP_LABEL}`, ...found };
+    if (!ours) return { action: "skipped", reason: "someone else pushed to the branch", ...found };
+    const conflicted = (await octokit.rest.pulls.get({ owner, repo, pull_number: openPr.number })).data.mergeable === false;
+    if (head && !conflicted && await filesMatch(octokit, owner, repo, head, pr.files)) {
+      if (openPr.title !== pr.title || (openPr.body ?? "") !== pr.body) {
+        await octokit.rest.pulls.update({ owner, repo, pull_number: openPr.number, title: pr.title, body: pr.body });
+      }
+      return { action: "unchanged", url: openPr.html_url, number: openPr.number, branch: pr.branch, commit: head };
+    }
+    const commit2 = await commitOnBase(octokit, owner, repo, openPr.base.ref, pr.files, message);
+    await octokit.rest.git.updateRef({ owner, repo, ref: `heads/${pr.branch}`, sha: commit2, force: true });
+    await octokit.rest.pulls.update({ owner, repo, pull_number: openPr.number, title: pr.title, body: pr.body });
+    return { action: "updated", url: openPr.html_url, number: openPr.number, branch: pr.branch, commit: commit2 };
+  }
+  if (head && !ours && !latest?.merged_at && !closedByMaintainer) return { action: "skipped", reason: "a branch with this name exists and is not SHAPI's", branch: pr.branch };
+  const base = pr.base ?? (await octokit.rest.repos.get({ owner, repo })).data.default_branch;
+  const commit = await commitOnBase(octokit, owner, repo, base, pr.files, message);
+  if (head) await octokit.rest.git.updateRef({ owner, repo, ref: `heads/${pr.branch}`, sha: commit, force: true });
+  else await octokit.rest.git.createRef({ owner, repo, ref: `refs/heads/${pr.branch}`, sha: commit });
+  const opened = await octokit.rest.pulls.create({ owner, repo, head: pr.branch, base, title: pr.title, body: pr.body });
+  if (pr.labels?.length) await octokit.rest.issues.addLabels({ owner, repo, issue_number: opened.data.number, labels: pr.labels });
+  return { action: "created", url: opened.data.html_url, number: opened.data.number, branch: pr.branch, commit };
+}
+function splitRepo(full) {
+  const [owner, repo] = full.split("/");
+  if (!owner || !repo) throw new Error(`repo must be owner/name, got ${full}`);
+  return { owner, repo };
+}
+async function branchHead(octokit, owner, repo, branch) {
+  const { data } = await octokit.rest.git.listMatchingRefs({ owner, repo, ref: `heads/${branch}` });
+  return data.find((r) => r.ref === `refs/heads/${branch}`)?.object.sha;
+}
+async function commitOnBase(octokit, owner, repo, base, files, message) {
+  const baseSha = (await octokit.rest.git.getRef({ owner, repo, ref: `heads/${base}` })).data.object.sha;
+  const baseTree = (await octokit.rest.git.getCommit({ owner, repo, commit_sha: baseSha })).data.tree.sha;
+  const existing = new Set(
+    (await octokit.rest.git.getTree({ owner, repo, tree_sha: baseTree, recursive: "true" })).data.tree.map((e) => e.path)
+  );
+  const contents = await Promise.all(
+    files.map(async (f) => ({
+      ...f,
+      content: existing.has(f.path) ? await matchLineEndings(octokit, owner, repo, base, f.path, f.content) : f.content.replace(/\r\n/g, "\n")
+    }))
+  );
+  const tree = await octokit.rest.git.createTree({
+    owner,
+    repo,
+    base_tree: baseTree,
+    tree: contents.map((f) => ({ path: f.path, mode: "100644", type: "blob", content: f.content }))
+  });
+  const commit = await octokit.rest.git.createCommit({ owner, repo, message, tree: tree.data.sha, parents: [baseSha] });
+  return commit.data.sha;
+}
+async function readFile(octokit, owner, repo, ref, filePath) {
+  try {
+    const res = await octokit.rest.repos.getContent({ owner, repo, path: filePath, ref });
+    return !Array.isArray(res.data) && res.data.type === "file" && "content" in res.data ? Buffer.from(res.data.content, "base64").toString("utf8") : void 0;
+  } catch (err) {
+    if (err.status === 404) return void 0;
+    throw err;
+  }
+}
+async function filesMatch(octokit, owner, repo, ref, files) {
+  const lf = (s) => s.replace(/\r\n/g, "\n");
+  for (const f of files) {
+    const current = await readFile(octokit, owner, repo, ref, f.path);
+    if (current === void 0 || lf(current) !== lf(f.content)) return false;
+  }
+  return true;
+}
+async function matchLineEndings(octokit, owner, repo, ref, filePath, content) {
+  const current = await readFile(octokit, owner, repo, ref, filePath) ?? "";
+  const lf = content.replace(/\r\n/g, "\n");
+  return current.includes("\r\n") ? lf.replace(/\n/g, "\r\n") : lf;
+}
+function repoFromUrl(url) {
+  const m = /github\.com[/:]([^/]+)\/([^/]+?)(?:\.git)?\/?$/.exec(url.trim());
+  return m ? `${m[1]}/${m[2]}` : void 0;
+}
+
+// packages/github-app/src/body.ts
+function prTitle(advisory) {
+  return `SHAPI: ${advisory.title}`;
+}
+function prBranch(advisory) {
+  return `shapi/${advisory.id}`;
+}
+function renderPrBody({ advisory, repair, shapeSource }) {
+  const fixed = repair.sites.filter((s) => s.result.status === "fixed");
+  const tests = new Set(fixed.map((s) => s.result.test?.file));
+  const notes = repair.changes.filter((c) => !tests.has(c.file)).flatMap((c) => (c.notes.length ? c.notes : [`\`${c.file}\``]).map((n) => `- ${n}`));
+  const method = repair.method === "llm" ? "Claude, verified by the contract tests" : `deterministic recipe \`${advisory.recipeId}\``;
+  const evidence = advisory.evidence;
+  const where = (s) => `\`${s.callSite.file}:${s.callSite.line}\` (${s.callSite.method} ${s.callSite.endpoint})`;
+  const siteLine = (s) => s.result.status === "fixed" ? `- [x] ${where(s)}: fixed, test \`${s.result.test?.file}\`` : s.result.status === "already-handled" ? `- [x] ${where(s)}: already handles the change` : `- [ ] ${where(s)}: not fixed here (${s.result.reason ?? s.result.status}); needs a manual change`;
+  const lines = [
+    `**${advisory.provider}** changed \`${advisory.endpoint.method} ${advisory.endpoint.path}\`: ${advisory.title}.`,
+    "",
+    advisory.summary,
+    "",
+    `### Affected call sites (${fixed.length} of ${repair.sites.length} fixed here)`,
+    ...repair.sites.map(siteLine),
+    "",
+    `### Change (${method})`,
+    ...notes,
+    "",
+    `### Contract test${fixed.length === 1 ? "" : "s"}`,
+    "Each test calls the code with the response it was written for and the one the provider sends now. Each failed before this change and passes after it.",
+    "",
+    "| Test | Before this change | After this change |",
+    "|---|---|---|",
+    ...fixed.map((s) => `| \`${s.result.test?.file}\` | ${summary(s.result.baseline)} | ${summary(s.result.attempts.find((a) => a.outcome === "passed")?.run)} |`),
+    "",
+    "### Evidence",
+    "| | |",
+    "|---|---|",
+    `| Advisory | \`${advisory.id}\` (${advisory.status}) |`,
+    `| Severity | ${advisory.severity} |`,
+    `| Change class | ${advisory.changeClass} |`,
+    `| First observed | ${advisory.firstObserved ?? "unknown"} |`,
+    `| Provider notice | ${advisory.publishedNotice ? `[${advisory.publishedNotice.date ?? "link"}](${advisory.publishedNotice.url})` : "none (undocumented change)"} |`,
+    `| Shapes from | ${shapeSource} |`,
+    ...evidence ? [`| Observed | ${evidence.before.status} at ${evidence.before.observedAt} \u2192 ${evidence.after.status} at ${evidence.after.observedAt} (${evidence.source}) |`] : [],
+    `| Blast radius | ${repair.sites.length} affected call site${repair.sites.length === 1 ? "" : "s"} in this repo |`,
+    `| Sources | ${advisory.sources.map((s, i) => `[${i + 1}](${s})`).join(" ")} |`,
+    "",
+    `Migration note: ${advisory.migrationNote}`,
+    "",
+    "---",
+    "Opened by [SHAPI](https://github.com/SriVarshini09/YC). A change is kept only when its contract test failed before it and passes after it."
+  ];
+  return lines.join("\n") + "\n";
+}
+function summary(run2) {
+  if (!run2) return "not run";
+  const m = /Tests\s+([^\n]+?)\s*\(\d+\)/.exec(run2.output);
+  return `${run2.passed ? "pass" : "fail"}${m ? ` (${m[1].trim()})` : ""}`;
+}
+
+// packages/github-app/src/app.ts
+import { createHmac as createHmac2, timingSafeEqual } from "crypto";
+import { createAppAuth as createAppAuth2 } from "@octokit/auth-app";
+
+// packages/github-app/src/client.ts
+import { retry } from "@octokit/plugin-retry";
+import { throttling } from "@octokit/plugin-throttling";
+import { Octokit as Octokit2 } from "@octokit/rest";
+var ResilientOctokit = Octokit2.plugin(throttling, retry);
+
+// packages/github-app/src/snapshot.ts
+import { Parser as Parser2 } from "tar";
+
+// packages/cli/src/scan.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { mkdtempSync as mkdtempSync2, rmSync } from "fs";
+import os2 from "os";
+import path11 from "path";
+
+// packages/cli/src/paths.ts
+import { existsSync as existsSync4 } from "fs";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function bundledDir(published, monorepo) {
+  const candidates = [new URL(`../${published}`, import.meta.url), new URL(`../../../${monorepo}`, import.meta.url)].map((u) => fileURLToPath2(u));
+  return candidates.find((p) => existsSync4(p)) ?? candidates[candidates.length - 1];
+}
+
+// packages/cli/src/scan.ts
+var VERSION = "0.2.0";
+var DEFAULT_ADVISORIES = bundledDir("advisories", "advisories");
+async function preparePython() {
+  await loadPythonParser().catch(() => void 0);
+}
+function scan(target, opts) {
+  const started = performance.now();
+  const failOn = parseFailOn(opts.failOn ?? "critical");
+  const now = opts.now ? new Date(opts.now) : /* @__PURE__ */ new Date();
+  if (Number.isNaN(now.getTime())) throw new Error(`--now: not a date: ${opts.now}`);
+  let dir = path11.resolve(target ?? ".");
+  let label2 = target ?? ".";
+  let cleanup;
+  if (opts.repo) {
+    if (opts.repo.startsWith("-")) throw new Error(`--repo: not a repository URL: ${opts.repo}`);
+    cleanup = mkdtempSync2(path11.join(os2.tmpdir(), "shapi-scan-"));
+    execFileSync2("git", ["-c", "core.autocrlf=false", "clone", "--depth", "1", "--quiet", "--", opts.repo, cleanup], { stdio: ["ignore", "ignore", "pipe"] });
+    dir = cleanup;
+    label2 = opts.repo;
+  }
+  try {
+    const extracted = extractCallSites(dir);
+    const lock = createApiLock(extracted, `shapi ${VERSION}`);
+    if (opts.out) writeApiLock(opts.out, lock);
+    const advisories = loadAdvisories(opts.advisories ?? DEFAULT_ADVISORIES);
+    const match = matchAdvisories(lock, advisories, { now });
+    const failing = failOn === "none" ? [] : match.affected.filter((f) => SEVERITY_RANK[f.advisory.severity] <= SEVERITY_RANK[failOn]);
+    return {
+      label: label2,
+      filesScanned: extracted.filesScanned,
+      skipped: extracted.skipped,
+      lock,
+      match,
+      elapsedMs: Math.round(performance.now() - started),
+      exitCode: failing.length > 0 ? 1 : 0
+    };
+  } finally {
+    if (cleanup) rmSync(cleanup, { recursive: true, force: true });
+  }
+}
+function parseFailOn(value2) {
+  if (value2 === "none" || SEVERITIES.includes(value2)) return value2;
+  throw new Error(`--fail-on: expected one of ${[...SEVERITIES, "none"].join(", ")}, got ${value2}`);
+}
+function toJsonReport(o) {
+  const finding = (f) => ({
+    advisory: f.advisory.id,
+    severity: f.advisory.severity,
+    title: f.advisory.title,
+    callSite: f.callSite.id,
+    file: f.callSite.file,
+    line: f.callSite.line,
+    method: f.callSite.method,
+    endpoint: f.callSite.endpoint,
+    reasons: f.reasons,
+    migrationNote: f.advisory.migrationNote
+  });
+  return {
+    target: o.label,
+    filesScanned: o.filesScanned,
+    affected: o.match.affected.map(finding),
+    exposed: o.match.exposed.map(finding),
+    upcoming: o.match.upcoming.map((u) => ({
+      advisory: u.advisory.id,
+      provider: u.advisory.provider,
+      title: u.advisory.title,
+      effectiveDate: u.advisory.effectiveDate,
+      daysUntil: u.daysUntil,
+      callSites: u.callSites
+    })),
+    lock: o.lock
+  };
+}
+
+// packages/cli/src/fix.ts
+var DEFAULT_RECORDINGS = bundledDir("recordings", "fixtures/recordings");
+async function fix(target, opts, deps) {
+  let dir = path12.resolve(target ?? ".");
+  let cleanup;
+  let remote = opts.repo ? repoFromUrl(opts.repo) : void 0;
+  if (opts.repo) {
+    if (opts.repo.startsWith("-")) throw new Error(`--repo: not a repository URL: ${opts.repo}`);
+    cleanup = mkdtempSync3(path12.join(os3.tmpdir(), "shapi-fix-"));
+    execFileSync3("git", ["-c", "core.autocrlf=false", "clone", "--depth", "1", "--quiet", "--", opts.repo, cleanup], { stdio: ["ignore", "ignore", "pipe"] });
+    dir = cleanup;
+  } else if (opts.pr) {
+    remote = originRepo(dir);
+  }
+  if (opts.pr && !remote) throw new Error("--pr needs a GitHub repository: pass --repo <github url> or run inside a clone whose origin is on GitHub");
+  try {
+    const advisories = loadAdvisories(opts.advisories ?? DEFAULT_ADVISORIES).filter((a) => !opts.advisory || a.id === opts.advisory);
+    const lock = createApiLock(extractCallSites(dir), "shapi fix");
+    const now = opts.now ? new Date(opts.now) : /* @__PURE__ */ new Date();
+    const { affected } = matchAdvisories(lock, advisories, { now });
+    if (affected.length === 0) deps.log("No affected call sites: nothing to fix.");
+    const llm = opts.llm ? claudeFixer() : void 0;
+    const outcomes = [];
+    const byAdvisory = /* @__PURE__ */ new Map();
+    for (const f of affected) byAdvisory.set(f.advisory.id, [...byAdvisory.get(f.advisory.id) ?? [], f]);
+    for (const findings of byAdvisory.values()) {
+      const advisory = findings[0].advisory;
+      const shapes = advisory.fix ? { source: FIX_SOURCE } : findShapes(advisory, opts);
+      if (!shapes) {
+        const skipped = "no before/after shapes for this endpoint (record them with the canary, or add a recording)";
+        for (const finding of findings) {
+          deps.log(`SKIP  ${finding.callSite.file}:${finding.callSite.line}  ${advisory.id}: ${skipped}`);
+          outcomes.push({ finding, skipped });
+        }
+        continue;
+      }
+      const repair = await repairAdvisory({ workspace: localWorkspace(dir), advisory, callSites: findings.map((f) => f.callSite), before: shapes.before, after: shapes.after, recipes: RECIPES, llm });
+      const mine = [];
+      for (const { callSite, result } of repair.sites) {
+        const finding = findings.find((f) => f.callSite.file === callSite.file && f.callSite.line === callSite.line && f.callSite.column === callSite.column);
+        mine.push({ finding, shapeSource: shapes.source, result });
+        deps.log(`${result.status.toUpperCase().padEnd(15)} ${callSite.file}:${callSite.line}  ${advisory.id}${result.method ? `  via ${result.method}` : ""}${result.reason ? `: ${result.reason}` : ""}`);
+        for (const a of result.attempts) deps.log(`    ${a.method}: ${a.outcome} (${a.detail})`);
+      }
+      outcomes.push(...mine);
+      if (!repair.changes.length) continue;
+      for (const c of repair.changes) deps.log(`    ${c.before ? "M" : "A"} ${c.file}`);
+      const files = repair.changes.map((c) => ({ path: c.file, content: c.after }));
+      if (opts.write) {
+        for (const f of files) {
+          mkdirSync5(path12.dirname(path12.join(dir, f.path)), { recursive: true });
+          writeFileSync4(path12.join(dir, f.path), f.content);
+        }
+        deps.log(`    wrote ${files.length} files into ${dir}`);
+      }
+      if (opts.pr && remote) {
+        const fixed = repair.sites.filter((s) => s.result.status === "fixed");
+        const meta = {
+          title: prTitle(advisory),
+          branch: prBranch(advisory),
+          commitMessage: `fix: ${advisory.title}
+
+Advisory ${advisory.id}, ${fixed.length} of ${repair.sites.length} call sites. Contract tests ${fixed.map((s) => s.result.test?.file).join(", ")} fail before this change and pass after.`,
+          body: renderPrBody({ advisory, repair, shapeSource: shapes.source })
+        };
+        const pr = await (deps.deliver ?? deliverToGitHub)(remote, files, meta);
+        for (const o of mine) if (o.result?.status === "fixed") o.pr = pr;
+        deps.log(`    pull request: ${pr.url}`);
+      }
+    }
+    return outcomes;
+  } finally {
+    if (cleanup) rmSync2(cleanup, { recursive: true, force: true });
+  }
+}
+async function deliverToGitHub(repo, files, meta) {
+  const auth = authFromEnv();
+  if (!auth) throw new Error("no GitHub credentials: set GITHUB_TOKEN, log in with `gh auth login`, or configure the SHAPI GitHub App variables");
+  const outcome = await upsertFixPr(octokitFor(auth), { repo, files, ...meta, labels: ["shapi"] });
+  if (outcome.action === "skipped") throw new Error(`not delivered: ${outcome.reason}${outcome.url ? ` (${outcome.url})` : ""}`);
+  return { url: outcome.url, number: outcome.number, branch: outcome.branch, commit: outcome.commit };
+}
+var FIX_SOURCE = "built from the advisory's fix and the fields the code reads";
+function findShapes(advisory, opts) {
+  if (opts.db && existsSync5(opts.db)) {
+    const store = ShapeStore.open(opts.db);
+    try {
+      for (const e of store.endpoints()) {
+        if (e.provider !== advisory.provider || !pathMatches(e.endpoint, advisory.endpoint)) continue;
+        if (advisory.endpoint.method !== "*" && e.method !== advisory.endpoint.method) continue;
+        const after = store.latest(e.provider, e.method, e.endpoint, e.source);
+        const before = store.previousDistinct(e.provider, e.method, e.endpoint, e.source);
+        if (before && after) return { before: before.shape, after: after.shape, source: `${e.source} (${opts.db})` };
+      }
+    } finally {
+      store.close();
+    }
+  }
+  const dir = opts.recordings ?? DEFAULT_RECORDINGS;
+  if (!existsSync5(dir)) return void 0;
+  for (const name of readdirSync3(dir).filter((f) => f.endsWith(".json")).sort()) {
+    const recording = loadRecording(path12.join(dir, name));
+    if (recording.provider !== advisory.provider || !pathMatches(recording.endpoint, advisory.endpoint)) continue;
+    if (advisory.endpoint.method !== "*" && recording.method !== advisory.endpoint.method) continue;
+    const store = ShapeStore.open(":memory:");
+    const replayed = replay(recording, store, process.env.SHAPI_SHAPE_SECRET ?? "shapi-dev-secret");
+    store.close();
+    if (replayed.before) return { before: replayed.before.shape, after: replayed.after.shape, source: `recording ${name}` };
+  }
+  return void 0;
+}
+function originRepo(dir) {
+  try {
+    return repoFromUrl(execFileSync3("git", ["remote", "get-url", "origin"], { cwd: dir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }));
+  } catch {
+    return void 0;
+  }
+}
+
+// packages/cli/src/report.ts
+import { styleText } from "util";
+function renderText(o, color) {
+  const paint = (style, s) => color ? styleText(style, s) : s;
+  const out = [];
+  const { lock, match } = o;
+  const providers = lock.providers;
+  const unresolved = lock.callSites.filter((c) => !c.resolved).length;
+  out.push(`${paint("bold", "SHAPI scan")}  ${o.label}`);
+  out.push(
+    paint(
+      "dim",
+      [plural(o.filesScanned, "file"), plural(lock.callSites.length, "call site"), plural(providers.length, "provider"), `${o.elapsedMs} ms`].join(" \xB7 ")
+    )
+  );
+  if (o.skipped.length) out.push(paint("dim", `${plural(o.skipped.length, "file")} not scanned: ${[...new Set(o.skipped.map((s) => s.reason))].join("; ")}`));
+  out.push("");
+  out.push(paint("bold", "Providers"));
+  if (providers.length === 0) out.push("  none found");
+  const idWidth = Math.max(0, ...providers.map((p) => p.id.length));
+  for (const p of providers) {
+    const sites = plural(p.callSites, "call site");
+    out.push(`  ${p.id.padEnd(idWidth)}  ${sites.padEnd(13)}  ${paint("dim", p.declaredBy.join(", "))}`.trimEnd());
+  }
+  out.push("");
+  out.push(paint("bold", `Affected call sites (${match.affected.length})`));
+  if (match.affected.length === 0) out.push("  none");
+  for (const f of match.affected) out.push(...renderFinding(f, paint));
+  out.push("");
+  if (match.exposed.length > 0) {
+    out.push(paint("bold", `Exposed, not affected (${match.exposed.length})`));
+    for (const f of match.exposed) {
+      out.push(`  ${f.callSite.file}:${f.callSite.line}  ${f.advisory.id}  ${paint("dim", f.reasons.join("; "))}`);
+    }
+    out.push("");
+  }
+  out.push(paint("bold", "Deadlines in the next 90 days"));
+  if (match.upcoming.length === 0) out.push("  none for the providers in this repo");
+  for (const u of match.upcoming) {
+    const where = u.callSites > 0 ? plural(u.callSites, "call site") : "declared dependency";
+    out.push(`  ${u.advisory.effectiveDate} (${u.daysUntil} days)  ${u.advisory.provider}  ${u.advisory.title}  ${paint("dim", where)}`);
+  }
+  if (unresolved > 0) {
+    out.push("");
+    out.push(paint("dim", `${plural(unresolved, "call site")} could not be fully resolved (see --json or --out api.lock).`));
+  }
+  return out.join("\n") + "\n";
+}
+var SEVERITY_STYLE = { critical: "red", high: "yellow", medium: "cyan", low: "gray" };
+function renderFinding(f, paint) {
+  const sev = f.advisory.severity.toUpperCase().padEnd(8);
+  const site = f.callSite;
+  const call = `${site.method ?? "?"} ${site.endpoint ?? "?"}`;
+  const indent = " ".repeat(12);
+  const lines = [
+    `  ${paint(SEVERITY_STYLE[f.advisory.severity] ?? "white", sev)}  ${paint("bold", `${site.file}:${site.line}`)}  ${call}`,
+    `${indent}${f.advisory.title}  ${paint("dim", `[${f.advisory.id}]`)}`,
+    `${indent}why: ${f.reasons.join("; ")}`,
+    `${indent}fix: ${f.advisory.migrationNote}`
+  ];
+  if (f.advisory.status === "unverified") lines.push(`${indent}${paint("dim", "note: unverified advisory (secondary reports only)")}`);
+  return lines;
+}
+function plural(n, noun) {
+  return `${n} ${noun}${n === 1 ? "" : "s"}`;
+}
+
+// packages/cli/src/index.ts
+var processIo = {
+  stdout: (s) => process.stdout.write(s),
+  stderr: (s) => process.stderr.write(s),
+  isTTY: process.stdout.isTTY
+};
+async function run(argv, io = processIo, fixDeps = {}) {
+  let exitCode = 0;
+  await preparePython();
+  const program = new Command2().name("shapi").description("Map the third-party APIs a codebase depends on and flag the breaking changes that hit it.").version(VERSION).exitOverride().configureOutput({ writeOut: io.stdout, writeErr: io.stderr });
+  program.command("scan").description("Scan a repository and report affected call sites").argument("[path]", "directory to scan", ".").option("--json", "print a JSON report (includes the api.lock)").option("--out <file>", "write the api.lock to this file").option("--repo <url>", "clone a git repository (shallow) into a temp dir and scan it").option("--advisories <dir>", "advisory directory (default: the bundled advisories/)").option("--fail-on <severity>", "exit 1 when an affected call site is at least this severe (critical|high|medium|low|none)", "critical").option("--no-color", "disable color").addOption(new Option("--now <date>", "evaluate deadlines as of this date").hideHelp()).action((target, opts) => {
+    const outcome = scan(opts.repo ? void 0 : target, opts);
+    if (opts.json) io.stdout(JSON.stringify(toJsonReport(outcome), null, 2) + "\n");
+    else io.stdout(renderText(outcome, opts.color !== false && Boolean(io.isTTY)));
+    exitCode = outcome.exitCode;
+  });
+  program.command("fix").description("Repair affected call sites test-first: generate a contract test, apply the recipe (or Claude), keep the change only if the test passes").argument("[path]", "repository to fix", ".").option("--repo <url>", "clone a GitHub repository (shallow) and fix it; with --pr the PR goes to that repository").option("--advisory <id>", "only this advisory").option("--advisories <dir>", "advisory directory (default: the bundled advisories/)").option("--db <file>", "shape store with canary observations (checked before recordings)", ".shapi/shapes.db").option("--recordings <dir>", "recorded response sequences (default: the bundled fixtures/recordings/)").option("--llm", "ask Claude when no recipe fixes the call site (needs ANTHROPIC_API_KEY)").option("--write", "write the fix and the contract test into the local repository").option("--pr", "open a pull request with the fix and the contract test").addOption(new Option("--now <date>", "evaluate deadlines as of this date").hideHelp()).action(async (target, opts) => {
+    const outcomes = await fix(opts.repo ? void 0 : target, opts, { log: (l) => io.stdout(`${l}
+`), ...fixDeps });
+    exitCode = outcomes.every((o) => o.result?.status === "fixed" || o.result?.status === "already-handled") ? 0 : 1;
+  });
+  try {
+    await program.parseAsync(argv);
+    return exitCode;
+  } catch (err) {
+    if (err instanceof CommanderError2) return err.exitCode;
+    io.stderr(`shapi: ${err instanceof Error ? err.message : String(err)}
+`);
+    return 2;
+  }
+}
+async function main(argv) {
+  return run(argv);
+}
+export {
+  DEFAULT_ADVISORIES,
+  DEFAULT_RECORDINGS,
+  VERSION,
+  fix,
+  main,
+  preparePython,
+  renderText,
+  run,
+  scan,
+  toJsonReport
+};