shapi-cli 0.1.0 → 0.3.0

package/dist/index.js

@@ -3,7 +3,7 @@ import { Command as Command2, CommanderError as CommanderError2, Option } from "
 
 // packages/cli/src/fix.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync4, mkdirSync as mkdirSync5, mkdtempSync as mkdtempSync3, readdirSync as readdirSync3, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, mkdtempSync as mkdtempSync3, readdirSync as readdirSync3, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
 import os3 from "os";
 import path12 from "path";
 
@@ -51,10 +51,34 @@ var providers_default = [
       "subscriptions.update": "POST /v1/subscriptions/{id}",
       "invoices.create": "POST /v1/invoices",
       "checkout.sessions.create": "POST /v1/checkout/sessions",
+      "checkout.sessions.retrieve": "GET /v1/checkout/sessions/{session}",
       "refunds.create": "POST /v1/refunds"
     },
     docsUrl: "https://docs.stripe.com/api",
-    changelogUrl: "https://docs.stripe.com/changelog"
+    changelogUrl: "https://docs.stripe.com/changelog",
+    python: {
+      packages: [
+        { pypi: "stripe", module: "stripe" }
+      ],
+      methods: {
+        "checkout.Session.create": "POST /v1/checkout/sessions",
+        "checkout.Session.retrieve": "GET /v1/checkout/sessions/{session}",
+        "PaymentIntent.create": "POST /v1/payment_intents",
+        "PaymentIntent.retrieve": "GET /v1/payment_intents/{intent}",
+        "PaymentIntent.confirm": "POST /v1/payment_intents/{intent}/confirm",
+        "SetupIntent.create": "POST /v1/setup_intents",
+        "Customer.create": "POST /v1/customers",
+        "Customer.list": "GET /v1/customers",
+        "Subscription.create": "POST /v1/subscriptions",
+        "Balance.retrieve": "GET /v1/balance",
+        "checkout.sessions.create": "POST /v1/checkout/sessions",
+        "checkout.sessions.retrieve": "GET /v1/checkout/sessions/{session}",
+        "payment_intents.create": "POST /v1/payment_intents",
+        "payment_intents.retrieve": "GET /v1/payment_intents/{intent}",
+        "customers.create": "POST /v1/customers",
+        "customers.list": "GET /v1/customers"
+      }
+    }
   },
   {
     id: "twilio",
@@ -66,12 +90,23 @@ var providers_default = [
       "calls.create": "POST /2010-04-01/Accounts/{AccountSid}/Calls.json"
     },
     docsUrl: "https://www.twilio.com/docs/usage/api",
-    changelogUrl: "https://www.twilio.com/en-us/changelog"
+    changelogUrl: "https://www.twilio.com/en-us/changelog",
+    python: {
+      packages: [
+        { pypi: "twilio", module: "twilio" }
+      ],
+      methods: {
+        "messages.create": "POST /2010-04-01/Accounts/{AccountSid}/Messages.json",
+        "messages.list": "GET /2010-04-01/Accounts/{AccountSid}/Messages.json",
+        "calls.create": "POST /2010-04-01/Accounts/{AccountSid}/Calls.json",
+        "conferences.list": "GET /2010-04-01/Accounts/{AccountSid}/Conferences.json"
+      }
+    }
   },
   {
     id: "shopify",
     name: "Shopify",
-    hosts: ["*.myshopify.com"],
+    hosts: ["*.myshopify.com", "discover.shopifyapps.com"],
     sdkPackages: ["@shopify/shopify-api", "@shopify/admin-api-client", "shopify-api-node"],
     docsUrl: "https://shopify.dev/docs/api/admin",
     changelogUrl: "https://shopify.dev/changelog"
@@ -98,7 +133,18 @@ var providers_default = [
     hosts: ["api.hubapi.com", "api.hubspot.com"],
     sdkPackages: ["@hubspot/api-client"],
     docsUrl: "https://developers.hubspot.com/docs/api/overview",
-    changelogUrl: "https://developers.hubspot.com/changelog"
+    changelogUrl: "https://developers.hubspot.com/changelog",
+    python: {
+      packages: [
+        { pypi: "hubspot-api-client", module: "hubspot" }
+      ],
+      methods: {
+        "crm.contacts.basic_api.get_page": "GET /crm/v3/objects/contacts",
+        "crm.contacts.basic_api.create": "POST /crm/v3/objects/contacts",
+        "crm.deals.basic_api.get_page": "GET /crm/v3/objects/deals",
+        "crm.pipelines.pipelines_api.get_all": "GET /crm/v3/pipelines/{objectType}"
+      }
+    }
   },
   {
     id: "slack",
@@ -114,7 +160,12 @@ var providers_default = [
       "files.uploadV2": "POST /api/files.uploadV2"
     },
     docsUrl: "https://api.slack.com/methods",
-    changelogUrl: "https://api.slack.com/changelog"
+    changelogUrl: "https://api.slack.com/changelog",
+    python: {
+      packages: [
+        { pypi: "slack-sdk", module: "slack_sdk" }
+      ]
+    }
   },
   {
     id: "openai",
@@ -132,7 +183,27 @@ var providers_default = [
       "files.create": "POST /v1/files"
     },
     docsUrl: "https://platform.openai.com/docs/api-reference",
-    changelogUrl: "https://platform.openai.com/docs/changelog"
+    changelogUrl: "https://platform.openai.com/docs/changelog",
+    python: {
+      packages: [
+        { pypi: "openai", module: "openai" }
+      ],
+      methods: {
+        "chat.completions.create": "POST /v1/chat/completions",
+        "responses.create": "POST /v1/responses",
+        "models.list": "GET /v1/models",
+        "embeddings.create": "POST /v1/embeddings",
+        "audio.translations.create": "POST /v1/audio/translations",
+        "audio.transcriptions.create": "POST /v1/audio/transcriptions",
+        "images.generate": "POST /v1/images/generations",
+        "beta.assistants.create": "POST /v1/assistants",
+        "beta.assistants.list": "GET /v1/assistants",
+        "beta.threads.create": "POST /v1/threads",
+        "beta.threads.runs.create": "POST /v1/threads/{thread_id}/runs",
+        "evals.create": "POST /v1/evals",
+        "evals.list": "GET /v1/evals"
+      }
+    }
   },
   {
     id: "anthropic",
@@ -146,7 +217,19 @@ var providers_default = [
       "models.list": "GET /v1/models"
     },
     docsUrl: "https://docs.claude.com/en/api",
-    changelogUrl: "https://docs.claude.com/en/release-notes/api"
+    changelogUrl: "https://docs.claude.com/en/release-notes/api",
+    python: {
+      packages: [
+        { pypi: "anthropic", module: "anthropic" }
+      ],
+      methods: {
+        "messages.create": "POST /v1/messages",
+        "messages.stream": "POST /v1/messages",
+        "messages.count_tokens": "POST /v1/messages/count_tokens",
+        "messages.batches.create": "POST /v1/messages/batches",
+        "models.list": "GET /v1/models"
+      }
+    }
   },
   {
     id: "salesforce",
@@ -357,7 +440,12 @@ var ProviderSchema = z.object({
   /** SDK method chain (after the client, without a leading "rest.") to the HTTP endpoint it calls. */
   sdkMethods: z.record(z.string(), EndpointRefSchema).optional(),
   docsUrl: z.url(),
-  changelogUrl: z.url().optional()
+  changelogUrl: z.url().optional(),
+  /** The provider's Python SDK: PyPI package and import module, and SDK method chain → HTTP endpoint. */
+  python: z.object({
+    packages: z.array(z.object({ pypi: z.string().min(1), module: z.string().min(1) })),
+    methods: z.record(z.string(), EndpointRefSchema).optional()
+  }).optional()
 });
 var ProviderRegistrySchema = z.array(ProviderSchema).refine((ps) => new Set(ps.map((p) => p.id)).size === ps.length, "provider ids must be unique");
 var cached;
@@ -365,6 +453,9 @@ function loadProviders() {
   cached ??= ProviderRegistrySchema.parse(providers_default);
   return cached;
 }
+function getProvider(id) {
+  return loadProviders().find((p) => p.id === id);
+}
 function providerForHost(host) {
   const h = host.toLowerCase().replace(/:\d+$/, "");
   let best;
@@ -378,9 +469,25 @@ function providerForHost(host) {
   }
   return best?.provider;
 }
+var PATH_SIGNATURES = [
+  { provider: "shopify", path: /^\/admin\/api\/\d{4}-\d{2}(\/|$)/ },
+  { provider: "hubspot", path: /^\/crm-pipelines\/v\d+(\/|$)/ }
+];
+function providerForPath(path13) {
+  const hit = PATH_SIGNATURES.find((s) => s.path.test(path13));
+  return hit ? getProvider(hit.provider) : void 0;
+}
 function providerForPackage(name) {
   return loadProviders().find((p) => p.sdkPackages.includes(name));
 }
+function providerForPythonModule(module) {
+  const top = module.split(".")[0];
+  return loadProviders().find((p) => p.python?.packages.some((pkg) => pkg.module === top));
+}
+function providerForPythonPackage(name) {
+  const norm = (s) => s.toLowerCase().replace(/[-_.]+/g, "-");
+  return loadProviders().find((p) => p.python?.packages.some((pkg) => norm(pkg.pypi) === norm(name)));
+}
 function sdkEndpoint(provider, chain) {
   const methods = provider.sdkMethods ?? {};
   const key = chain.replace(/^rest\./, "");
@@ -516,11 +623,26 @@ var TriggerSchema = z3.object({
   enums: z3.array(z3.object({ field: z3.string() })).optional(),
   /** Affected when the request sets this header (optionally to one of these values). */
   headers: z3.array(z3.object({ name: z3.string(), values: z3.array(z3.string()).optional() })).optional(),
-  /** Affected when the request sets this query parameter (optionally to a number below `below`). */
-  query: z3.array(z3.object({ name: z3.string(), below: z3.number().optional() })).optional(),
+  /**
+   * Affected when the request sets this query parameter: optionally to a number below `below`, or to
+   * one of `values` (a comma-separated value such as `metric=a,b` matches when any item does).
+   */
+  query: z3.array(z3.object({ name: z3.string(), below: z3.number().optional(), values: z3.array(z3.string()).optional() })).optional(),
   /** Every call to the endpoint is affected (sunsets, auth and scope changes). */
   any: z3.boolean().optional()
 }).refine((t) => Object.values(t).some((v) => v !== void 0 && v !== false), "trigger needs at least one condition");
+var FixSchema = z3.object({
+  /** Replace this part of the request path, for example "/v21.0/" with "/v26.0/". */
+  path: z3.object({ from: z3.string().min(1), to: z3.string().min(1) }).optional(),
+  /** Send this query parameter with this value, for example minorversion=75. */
+  query: z3.object({ name: z3.string().min(1), value: z3.string() }).optional(),
+  /** Send this request header with this value, for example Stripe-Version. */
+  header: z3.object({ name: z3.string().min(1), value: z3.string() }).optional(),
+  /** Response fields that were renamed: the code reads the new name, falling back to the old one. */
+  fields: z3.array(z3.object({ from: z3.string().min(1), to: z3.string().min(1) })).optional(),
+  /** Enum values that were renamed: comparisons with an old value also accept the new one. */
+  enums: z3.array(z3.object({ field: z3.string().min(1), values: z3.array(z3.object({ from: z3.string(), to: z3.string() })).min(1) })).optional()
+}).refine((f) => Object.values(f).some((v) => v !== void 0), "fix needs at least one change");
 var AdvisorySchema = z3.object({
   id: z3.string().regex(/^[a-z0-9-]+$/),
   provider: z3.string(),
@@ -538,6 +660,8 @@ var AdvisorySchema = z3.object({
   severity: z3.enum(SEVERITIES),
   migrationNote: z3.string().min(1),
   recipeId: z3.string().optional(),
+  /** What `recipeId: "apply-fix"` changes. */
+  fix: FixSchema.optional(),
   sources: z3.array(z3.url()).min(1),
   /** "verified": checked against a primary or two independent sources. "unverified": secondary reports only. */
   status: z3.enum(["verified", "unverified"]),
@@ -573,10 +697,16 @@ function matchAdvisories(lock, advisories, options = {}) {
   const horizon = options.horizonDays ?? 90;
   const affected = [];
   const exposed = [];
+  const possible = [];
   const hitsPerAdvisory = /* @__PURE__ */ new Map();
   for (const advisory of advisories) {
     for (const callSite of lock.callSites) {
-      if (!endpointMatches(callSite, advisory)) continue;
+      if (!endpointMatches(callSite, advisory)) {
+        if (endpointMayMatch(callSite, advisory) && triggerReasons(callSite, advisory.trigger).length > 0) {
+          possible.push({ advisory, callSite, reasons: [`builds the path at runtime (${describe(callSite)}); affected if it reaches ${advisory.endpoint.path}`] });
+        }
+        continue;
+      }
       hitsPerAdvisory.set(advisory.id, (hitsPerAdvisory.get(advisory.id) ?? 0) + 1);
       const reasons = triggerReasons(callSite, advisory.trigger);
       if (reasons.length > 0) affected.push({ advisory, callSite, reasons });
@@ -590,7 +720,7 @@ function matchAdvisories(lock, advisories, options = {}) {
     daysUntil: Math.round((Date.parse(advisory.effectiveDate) - today) / DAY_MS),
     callSites: hitsPerAdvisory.get(advisory.id) ?? 0
   })).filter((u) => present.has(u.advisory.provider) && u.daysUntil >= 0 && u.daysUntil <= horizon).sort((a, b) => a.daysUntil - b.daysUntil || cmp2(a.advisory.id, b.advisory.id));
-  return { affected: affected.sort(byFinding), exposed: exposed.sort(byFinding), upcoming };
+  return { affected: affected.sort(byFinding), exposed: exposed.sort(byFinding), possible: possible.sort(byFinding), upcoming };
 }
 function endpointMatches(site, advisory) {
   const pattern = advisory.endpoint;
@@ -599,6 +729,30 @@ function endpointMatches(site, advisory) {
   if (pattern.hosts && !(site.host && pattern.hosts.includes(site.host))) return false;
   return pathMatches(site.endpoint, pattern);
 }
+function endpointMayMatch(site, advisory) {
+  const pattern = advisory.endpoint;
+  if (site.provider !== advisory.provider || site.endpoint === null) return false;
+  if (pattern.method !== "*" && site.method !== null && site.method !== pattern.method) return false;
+  if (pattern.hosts && site.host && !pattern.hosts.includes(site.host)) return false;
+  if (!/\{[^}]*\}/.test(site.endpoint)) return false;
+  const known = segments(site.endpoint);
+  const runtimeAt = known.findIndex(isRuntime);
+  const literals = segments(pattern.path).filter((p) => !/[*{]/.test(p));
+  if (!literals.some((l) => known.slice(0, runtimeAt < 0 ? known.length : runtimeAt).includes(l))) return false;
+  return segmentsMayMatch(known, segments(pattern.path));
+}
+var segments = (p) => p.split("/").filter(Boolean);
+var isRuntime = (seg) => /^\{[^}]*\}$/.test(seg);
+function segmentsMayMatch(site, pattern) {
+  if (pattern.length === 0) return site.length === 0;
+  const [p, ...prest] = pattern;
+  if (p === "**") return segmentsMayMatch(site, prest) || site.length > 0 && segmentsMayMatch(site.slice(1), pattern);
+  if (site.length === 0) return false;
+  const [s, ...srest] = site;
+  if (isRuntime(s)) return srest.length === 0 || segmentsMayMatch(srest, prest);
+  if (!pathMatches(`/${s}`, { path: `/${p}` })) return false;
+  return segmentsMayMatch(srest, prest);
+}
 function pathMatches(endpoint, pattern) {
   const sample = endpoint.replace(/\{[^}]*\}/g, "\0");
   let re = "";
@@ -646,8 +800,12 @@ function triggerReasons(site, trigger) {
   for (const q of trigger.query ?? []) {
     const p = s.query.find((x) => x.name === q.name);
     if (!p) continue;
-    if (q.below === void 0) reasons.push(`sends ${p.name}=${p.value ?? "(dynamic)"}`);
-    else if (p.value !== null && Number(p.value) < q.below) reasons.push(`sends ${p.name}=${p.value} (below ${q.below})`);
+    if (q.below !== void 0) {
+      if (p.value !== null && Number(p.value) < q.below) reasons.push(`sends ${p.name}=${p.value} (below ${q.below})`);
+    } else if (q.values) {
+      const hit = p.value === null ? [] : p.value.split(",").map((v) => v.trim()).filter((v) => q.values.includes(v));
+      if (hit.length) reasons.push(`sends ${p.name}=${hit.join(",")}`);
+    } else reasons.push(`sends ${p.name}=${p.value ?? "(dynamic)"}`);
   }
   if (trigger.any) reasons.push(`calls ${describe(site)}`);
   return reasons;
@@ -737,7 +895,11 @@ function collectConsts(ctx) {
   for (const decl of ctx.sf.getDescendantsOfKind(SyntaxKind.VariableDeclaration)) {
     const list = decl.getVariableStatement()?.getDeclarationKind();
     const init = decl.getInitializer();
-    if (list === "const" && init && Node.isIdentifier(decl.getNameNode())) ctx.consts.set(decl.getName(), init);
+    if (list === "const" && init && Node.isIdentifier(decl.getNameNode())) {
+      ctx.consts.set(decl.getName(), init);
+      ctx.declared ??= /* @__PURE__ */ new Map();
+      ctx.declared.set(decl.getName(), [...ctx.declared.get(decl.getName()) ?? [], init]);
+    }
   }
 }
 function collectClients(ctx) {
@@ -843,7 +1005,8 @@ function fetchStyle(ctx, call, lib, urlArg, optsArg, verb, baseURL) {
     if (opts) method = methodFrom(ctx, propertyValue(opts, "method")) ?? (propertyValue(opts, "method") ? null : "GET");
     else method = null;
   }
-  return httpSite(ctx, call, lib, joinUrl(baseURL, evalString(ctx, urlArg)), method, opts ? optsArg : void 0);
+  const params = opts && (lib === "got" || lib === "ky") ? resolveObject(ctx, propertyValue(opts, "searchParams")) : void 0;
+  return httpSite(ctx, call, lib, joinUrl(baseURL, evalString(ctx, urlArg)), method, opts ? optsArg : void 0, params);
 }
 function axiosStyle(ctx, call, verb, baseURL) {
   const args = call.getArguments();
@@ -869,7 +1032,7 @@ function httpSite(ctx, call, lib, url, method, options, params) {
   const surface = emptySurface();
   surface.headers = headersOf(ctx, options);
   surface.query = [...query, ...objectEntries(ctx, params)];
-  const provider = host ? providerForHost(host)?.id ?? null : null;
+  const provider = providerOf(host, path13);
   return {
     call,
     options,
@@ -1051,9 +1214,16 @@ function evalString(ctx, node, depth = 0) {
     }
   }
   if (Node.isIdentifier(expr)) {
-    const init = ctx.consts.get(expr.getText());
+    const init = nearestConst(ctx, expr) ?? ctx.consts.get(expr.getText());
     return init && init !== node ? evalString(ctx, init, depth + 1) : void 0;
   }
+  if (Node.isCallExpression(expr)) {
+    const callee = expr.getExpression();
+    const args = expr.getArguments();
+    if (Node.isPropertyAccessExpression(callee) && callee.getName() === "toString" && args.length === 0) return evalString(ctx, callee.getExpression(), depth + 1);
+    if (Node.isIdentifier(callee) && callee.getText() === "String" && args.length === 1) return evalString(ctx, args[0], depth + 1);
+  }
+  if (Node.isPropertyAccessExpression(expr) && expr.getName() === "href") return evalString(ctx, expr.getExpression(), depth + 1);
   if (Node.isNewExpression(expr) && expr.getExpression().getText() === "URL") {
     const [p, base] = expr.getArguments();
     const pathPart = evalString(ctx, p, depth + 1);
@@ -1062,6 +1232,18 @@ function evalString(ctx, node, depth = 0) {
   }
   return void 0;
 }
+function nearestConst(ctx, id) {
+  const inits = ctx.declared?.get(id.getText());
+  if (!inits || inits.length < 2) return void 0;
+  let best;
+  for (const init of inits) {
+    const scope = init.getFirstAncestor((a) => Node.isBlock(a) || Node.isSourceFile(a));
+    if (!scope || id.getPos() < scope.getPos() || id.getEnd() > scope.getEnd()) continue;
+    const size = scope.getEnd() - scope.getPos();
+    if (!best || size < best.size) best = { init, size };
+  }
+  return best?.init;
+}
 function placeholder(node) {
   const expr = unwrap(node);
   if (Node.isIdentifier(expr)) return `{${expr.getText()}}`;
@@ -1069,6 +1251,53 @@ function placeholder(node) {
   if (Node.isCallExpression(expr) && expr.getArguments().length === 1) return placeholder(expr.getArguments()[0]);
   return "{}";
 }
+function providerOf(host, path13) {
+  if (host) return providerForHost(host)?.id ?? null;
+  return path13 ? providerForPath(path13)?.id ?? null : null;
+}
+function urlParts(value2) {
+  const v = value2.trim().replace(/\{\{\s*([^{}]*?)\s*\}\}/g, "{$1}");
+  if (/^(?:https?:)?\/\//i.test(v)) return parseUrl(v);
+  const asPath = "/" + v.replace(/^\{[^}]*\}(?=\/)/, "").replace(/^\/+/, "");
+  if (providerForPath(asPath.split(/[?#]/)[0])) return parseUrl(asPath);
+  return void 0;
+}
+function looseUrlSites(sf, file, found) {
+  const ctx = { sf, imports: /* @__PURE__ */ new Map(), consts: /* @__PURE__ */ new Map(), http: /* @__PURE__ */ new Map(), sdk: /* @__PURE__ */ new Map() };
+  collectConsts(ctx);
+  const covered = new Set(found.map((f) => `${f.site.provider} ${f.site.endpoint}`));
+  const inFoundCall = (node) => found.some((f) => node.getPos() >= f.call.getPos() && node.getEnd() <= f.call.getEnd());
+  const candidates = [];
+  for (const node of sf.getDescendants()) {
+    if (!Node.isStringLiteral(node) && !Node.isNoSubstitutionTemplateLiteral(node) && !Node.isTemplateExpression(node) && !isConcat(node)) continue;
+    const parent = node.getParent();
+    if (parent && (Node.isTemplateSpan(parent) || isConcat(parent) || Node.isImportDeclaration(parent) || Node.isExportDeclaration(parent))) continue;
+    if (parent && Node.isPropertyAssignment(parent) && parent.getNameNode() === node) continue;
+    if (inFoundCall(node)) continue;
+    const value2 = evalString(ctx, node);
+    const parts = value2 === void 0 ? void 0 : urlParts(value2);
+    if (!parts?.path || parts.path === "/") continue;
+    const provider = providerOf(parts.host, parts.path);
+    if (provider) candidates.push({ node, host: parts.host, path: parts.path, query: parts.query, provider });
+  }
+  const sites = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const c of candidates) {
+    const key = `${c.provider} ${c.path}`;
+    if (covered.has(key) || seen.has(key)) continue;
+    if (candidates.some((o) => o.provider === c.provider && o.path !== c.path && o.path.startsWith(`${c.path}/`))) continue;
+    if (found.some((f) => f.site.provider === c.provider && f.site.endpoint?.startsWith(`${c.path}/`))) continue;
+    seen.add(key);
+    const { line, column } = sf.getLineAndColumnAtPos(c.node.getStart());
+    const surface = emptySurface();
+    surface.query = c.query;
+    sites.push({ file, line, column, provider: c.provider, kind: "http", client: "url", method: null, host: c.host, endpoint: c.path, resolved: true, surface });
+  }
+  return sites;
+}
+function isConcat(node) {
+  return Node.isBinaryExpression(node) && node.getOperatorToken().getKind() === SyntaxKind.PlusToken;
+}
 function joinUrl(base, url) {
   if (url === void 0) return void 0;
   if (!base || /^[a-z]+:\/\//i.test(url)) return url;
@@ -1136,6 +1365,7 @@ var NOT_FIELDS = /* @__PURE__ */ new Set([
   "valueOf",
   "toJSON"
 ]);
+var ITEM_CALLBACKS = { map: 0, flatMap: 0, filter: 0, forEach: 0, find: 0, findIndex: 0, some: 0, every: 0, reduce: 1 };
 var MAX_DEPTH = 4;
 var Collector = class {
   fields = /* @__PURE__ */ new Set();
@@ -1250,7 +1480,7 @@ function use(ref, loc, env, c, depth) {
 function interpret(env, loc, access, top, c, depth, compare) {
   const full = [...loc.path, ...access];
   if (loc.space === "body" || env === "body") {
-    body(full, top, c, compare);
+    body(full, top, c, compare, env, depth);
     return;
   }
   const [first, ...rest] = full;
@@ -1276,20 +1506,37 @@ function interpret(env, loc, access, top, c, depth, compare) {
     } else if (h && h !== "get") c.responseHeaders.add(h.toLowerCase());
     return;
   }
-  if (env === "axios" && first === "data") return body(rest, top, c, compare);
-  if (env === "got" && first === "body") return body(rest, top, c, compare);
+  if (env === "axios" && first === "data") return body(rest, top, c, compare, env, depth);
+  if (env === "got" && first === "body") return body(rest, top, c, compare, env, depth);
   const bodyCall = (env === "fetch" || env === "got") && rest.length === 0 && (first === "json" || first === "text") || env === "undici" && first === "body" && rest.length === 1 && (rest[0] === "json" || rest[0] === "text");
   if (bodyCall && isCall()) {
     bindFrom(top.getParent(), { space: "body", path: [] }, env, c, depth + 1);
   }
 }
-function body(path13, top, c, compare) {
+function body(path13, top, c, compare, env, depth) {
   const cut = path13.findIndex((p) => NOT_FIELDS.has(p));
   const fieldPath = cut >= 0 ? path13.slice(0, cut) : path13;
   if (fieldPath.length === 0) return;
   const field = fieldPath.join(".").replace(/\.\[\]/g, "[]");
   c.fields.add(field);
   if (compare && cut < 0) for (const s of comparedLiterals(top).strs) c.addEnum(field, s);
+  if (depth >= MAX_DEPTH) return;
+  const items = { space: "body", path: [...fieldPath, "[]"] };
+  const method = cut >= 0 && cut === path13.length - 1 ? path13[cut] : void 0;
+  const call = top.getParent();
+  if (method && method in ITEM_CALLBACKS && Node2.isCallExpression(call) && call.getExpression() === top) {
+    const cb = call.getArguments()[0];
+    const param = cb && (Node2.isArrowFunction(cb) || Node2.isFunctionExpression(cb)) ? cb.getParameters()[ITEM_CALLBACKS[method]] : void 0;
+    if (param) bindName(param.getNameNode(), items, param, env, c, depth + 1);
+    if (method === "find") bindFrom(call, items, env, c, depth + 1);
+    return;
+  }
+  const loop = top.getParent();
+  if (cut < 0 && Node2.isForOfStatement(loop) && loop.getExpression() === top) {
+    const list = loop.getInitializer();
+    const decl = Node2.isVariableDeclarationList(list) ? list.getDeclarations()[0] : void 0;
+    if (decl) bindName(decl.getNameNode(), items, decl, env, c, depth + 1);
+  }
 }
 function comparedLiterals(node) {
   const nums = [];
@@ -1323,10 +1570,14 @@ function comparedLiterals(node) {
 import { readdirSync as readdirSync2, readFileSync as readFileSync2 } from "fs";
 import path3 from "path";
 var SOURCE_FILE = /\.(c|m)?[jt]sx?$/;
-var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", "build", "out", "coverage", "vendor", "bower_components"]);
+var PYTHON_FILE = /\.py$/;
+var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", "dist", "build", "out", "coverage", "vendor", "bower_components", "venv", "__pycache__", "site-packages"]);
+var PYTHON_MANIFEST = /^(requirements[\w.-]*\.txt|pyproject\.toml)$/;
 function listRepoFiles(root) {
   const sources = [];
   const manifests = [];
+  const python = [];
+  const pythonManifests = [];
   const walk2 = (dir) => {
     for (const entry of readdirSync2(dir, { withFileTypes: true })) {
       if (entry.name.startsWith(".")) continue;
@@ -1336,11 +1587,13 @@ function listRepoFiles(root) {
       } else if (entry.isFile()) {
         if (entry.name === "package.json") manifests.push(full);
         else if (SOURCE_FILE.test(entry.name) && !entry.name.endsWith(".d.ts")) sources.push(full);
+        else if (PYTHON_FILE.test(entry.name)) python.push(full);
+        else if (PYTHON_MANIFEST.test(entry.name)) pythonManifests.push(full);
       }
     }
   };
   walk2(root);
-  return { sources: sources.sort(), manifests: manifests.sort() };
+  return { sources: sources.sort(), manifests: manifests.sort(), python: python.sort(), pythonManifests: pythonManifests.sort() };
 }
 function declaredProviders(root, manifests) {
   const found = [];
@@ -1366,6 +1619,578 @@ function declaredProviders(root, manifests) {
 function toPosix(p) {
   return p.split(path3.sep).join("/");
 }
+function declaredPythonProviders(root, manifests) {
+  const found = [];
+  for (const manifest of manifests) {
+    let text;
+    try {
+      text = readFileSync2(manifest, "utf8");
+    } catch {
+      continue;
+    }
+    const names = /* @__PURE__ */ new Set();
+    if (manifest.endsWith(".txt")) {
+      for (const line of text.split(/\r?\n/)) {
+        const m = /^\s*([A-Za-z0-9][A-Za-z0-9._-]*)/.exec(line.replace(/#.*/, ""));
+        if (m && !line.trim().startsWith("-")) names.add(m[1]);
+      }
+    } else {
+      let inTable = false;
+      let inList = false;
+      for (const line of text.split(/\r?\n/)) {
+        const t = line.replace(/#.*/, "").trim();
+        if (/^\[/.test(t)) {
+          inTable = /dependencies\]$/.test(t);
+          inList = false;
+          continue;
+        }
+        if (/^(dependencies|optional-dependencies|dev-dependencies)\s*=\s*\[/.test(t) || /^[\w-]+\s*=\s*\[/.test(t)) inList = true;
+        if (inList) for (const m of t.matchAll(/["']([A-Za-z0-9][A-Za-z0-9._-]*)/g)) names.add(m[1]);
+        if (inList && t.includes("]")) inList = false;
+        const kv = inTable ? /^([A-Za-z0-9][A-Za-z0-9._-]*)\s*=/.exec(t) : null;
+        if (kv) names.add(kv[1]);
+      }
+    }
+    for (const name of [...names].sort()) {
+      const provider = providerForPythonPackage(name);
+      if (provider) found.push({ provider: provider.id, package: name, manifest: toPosix(path3.relative(root, manifest)) });
+    }
+  }
+  return found;
+}
+
+// packages/extractor/src/python.ts
+import { existsSync } from "fs";
+import { createRequire } from "module";
+import { fileURLToPath } from "url";
+import { Language, Parser } from "web-tree-sitter";
+var parser;
+async function loadPythonParser() {
+  if (parser) return;
+  await Parser.init();
+  const bundled = fileURLToPath(new URL("./tree-sitter-python.wasm", import.meta.url));
+  const wasm = existsSync(bundled) ? bundled : createRequire(import.meta.url).resolve("tree-sitter-python/tree-sitter-python.wasm");
+  const language = await Language.load(wasm);
+  const p = new Parser();
+  p.setLanguage(language);
+  parser = p;
+}
+function pythonParserLoaded() {
+  return parser !== void 0;
+}
+var HTTP_LIBS = /* @__PURE__ */ new Set(["requests", "httpx", "aiohttp"]);
+var VERBS2 = /* @__PURE__ */ new Set(["get", "post", "put", "patch", "delete", "head", "options"]);
+function extractPython(source, file) {
+  if (!parser) throw new Error("call loadPythonParser() before extracting Python");
+  const tree = parser.parse(source);
+  if (!tree) return [];
+  try {
+    const root = tree.rootNode;
+    const ctx = { names: /* @__PURE__ */ new Map(), consts: /* @__PURE__ */ new Map() };
+    collectImports2(root, ctx);
+    collectConsts2(root, ctx);
+    collectClients2(root, ctx);
+    const sites = [];
+    const calls = [];
+    for (const call of root.descendantsOfType("call")) {
+      if (!call) continue;
+      const site = httpCall(ctx, call) ?? sdkCall(ctx, call);
+      if (!site) continue;
+      site.file = file;
+      site.line = call.startPosition.row + 1;
+      site.column = call.startPosition.column + 1;
+      addResponseSurface2(call, site);
+      sites.push(site);
+      calls.push(call);
+    }
+    return [...sites, ...looseUrls(ctx, root, file, sites, calls)];
+  } finally {
+    tree.delete();
+  }
+}
+function collectImports2(root, ctx) {
+  for (const st of root.descendantsOfType(["import_statement", "import_from_statement"])) {
+    if (!st) continue;
+    if (st.type === "import_statement") {
+      for (const item of st.namedChildren) {
+        if (!item) continue;
+        const dotted = item.type === "aliased_import" ? item.childForFieldName("name") : item;
+        const alias = item.type === "aliased_import" ? item.childForFieldName("alias")?.text : dotted?.text.split(".")[0];
+        if (!dotted || !alias) continue;
+        bindModule(ctx, alias, dotted.text);
+      }
+    } else {
+      const module = st.childForFieldName("module_name")?.text;
+      if (!module) continue;
+      for (const item of st.childrenForFieldName("name")) {
+        if (!item) continue;
+        const name = item.type === "aliased_import" ? item.childForFieldName("name")?.text : item.text;
+        const alias = item.type === "aliased_import" ? item.childForFieldName("alias")?.text : item.text;
+        if (name && alias) bindModule(ctx, alias, `${module}.${name}`);
+      }
+    }
+  }
+}
+function bindModule(ctx, alias, dotted) {
+  const top = dotted.split(".")[0];
+  if (HTTP_LIBS.has(top)) {
+    ctx.names.set(alias, { kind: "http-module", lib: top });
+    return;
+  }
+  const provider = providerForPythonModule(top);
+  if (provider) ctx.names.set(alias, { kind: "sdk-module", provider, module: dotted });
+}
+function collectConsts2(root, ctx) {
+  for (const st of root.namedChildren) {
+    const assign = st?.type === "expression_statement" ? st.namedChildren[0] : void 0;
+    if (assign?.type !== "assignment") continue;
+    const left = assign.childForFieldName("left");
+    const right = assign.childForFieldName("right");
+    if (left?.type === "identifier" && right) ctx.consts.set(left.text, right);
+  }
+}
+function collectClients2(root, ctx) {
+  const visit = (target, value2) => {
+    const call = unwrap2(value2);
+    if (call.type !== "call") return;
+    const fn = call.childForFieldName("function");
+    const chain = fn ? chainOf2(fn) : void 0;
+    if (!chain) return;
+    const base = ctx.names.get(chain.root);
+    if (!base) return;
+    if (base.kind === "http-module" || base.kind === "http-client") {
+      const ctor = chain.names.at(-1);
+      if (!ctor || !/^(Session|Client|AsyncClient|ClientSession)$/.test(ctor)) return;
+      const args = call.childForFieldName("arguments");
+      const baseUrl = evalString2(ctx, keyword(args, "base_url"));
+      ctx.names.set(target, { kind: "http-client", lib: base.lib, ...baseUrl ? { baseUrl } : {}, headers: dictEntries(ctx, keyword(args, "headers")) });
+      return;
+    }
+    if (base.kind === "sdk-module" && !sdkEndpoint2(base.provider, [...modulePath(base), ...chain.names])) {
+      ctx.names.set(target, { kind: "sdk-client", provider: base.provider, module: base.module });
+    }
+  };
+  for (const assign of root.descendantsOfType("assignment")) {
+    const left = assign?.childForFieldName("left");
+    const right = assign?.childForFieldName("right");
+    if (left && right && (left.type === "identifier" || left.type === "attribute")) visit(left.text, right);
+  }
+  for (const item of root.descendantsOfType("as_pattern")) {
+    const value2 = item?.namedChildren[0];
+    const alias = item?.childForFieldName("alias")?.namedChildren[0] ?? item?.namedChildren.at(-1);
+    if (value2 && alias && alias.type === "identifier") visit(alias.text, value2);
+  }
+}
+function httpCall(ctx, call) {
+  const fn = call.childForFieldName("function");
+  const chain = fn ? chainOf2(fn) : void 0;
+  if (!chain || chain.names.length === 0) {
+    return void 0;
+  }
+  const binding = ctx.names.get(chain.root) ?? ctx.names.get(chain.prefix(chain.names.length - 1));
+  const member = chain.names.at(-1);
+  if (!binding || binding.kind !== "http-module" && binding.kind !== "http-client") return void 0;
+  if (binding.kind === "http-module" && chain.names.length !== 1) return void 0;
+  const args = call.childForFieldName("arguments");
+  const positional = (args?.namedChildren ?? []).filter((a) => a && a.type !== "keyword_argument");
+  let method;
+  let urlNode;
+  if (VERBS2.has(member)) {
+    method = member.toUpperCase();
+    urlNode = positional[0] ?? keyword(args, "url");
+  } else if (member === "request") {
+    const m = evalString2(ctx, positional[0] ?? keyword(args, "method"))?.toUpperCase();
+    method = m && HTTP_METHODS.includes(m) ? m : null;
+    urlNode = positional[1] ?? keyword(args, "url");
+  } else return void 0;
+  const base = binding.kind === "http-client" ? binding.baseUrl : void 0;
+  const { host, path: path13, query } = parseUrl(joinUrl2(base, evalString2(ctx, urlNode)));
+  const surface = emptySurface2();
+  surface.headers = [...binding.kind === "http-client" ? binding.headers : [], ...dictEntries(ctx, keyword(args, "headers"))].map((h) => ({ ...h, name: h.name.toLowerCase() }));
+  surface.query = [...query, ...dictEntries(ctx, keyword(args, "params"))];
+  const provider = providerOf(host, path13);
+  return { file: "", line: 0, column: 0, provider, kind: "http", client: binding.lib, method, host, endpoint: path13, resolved: Boolean(provider && path13 && method), surface };
+}
+function sdkCall(ctx, call) {
+  const fn = call.childForFieldName("function");
+  const chain = fn ? chainOf2(fn) : void 0;
+  if (!chain || chain.names.length === 0) return void 0;
+  const binding = ctx.names.get(chain.root);
+  if (!binding || binding.kind !== "sdk-module" && binding.kind !== "sdk-client") return void 0;
+  const names = binding.kind === "sdk-module" ? [...modulePath(binding), ...chain.names] : chain.names;
+  const ep = sdkEndpoint2(binding.provider, names);
+  if (!ep && (binding.kind === "sdk-module" || names.length < 2)) return void 0;
+  const surface = emptySurface2();
+  const host = binding.provider.hosts.find((h) => !h.startsWith("*.")) ?? null;
+  return {
+    file: "",
+    line: 0,
+    column: 0,
+    provider: binding.provider.id,
+    kind: "sdk",
+    client: binding.module.split(".")[0],
+    operation: names.join("."),
+    method: ep?.method ?? null,
+    host,
+    endpoint: ep?.path ?? null,
+    resolved: Boolean(ep),
+    surface
+  };
+}
+function modulePath(b) {
+  return b.module.split(".").slice(1);
+}
+function sdkEndpoint2(provider, names) {
+  let op = names.join(".");
+  if (provider.id === "stripe") op = op.replace(/^v1\./, "");
+  if (provider.id === "slack") {
+    const last = names.at(-1);
+    if (names.length !== 1 || !last || !/^[a-z]+(_[a-zA-Z0-9]+)+$/.test(last)) return void 0;
+    if (last === "files_upload_v2") return { method: "POST", path: "/api/files.completeUploadExternal" };
+    return { method: "POST", path: `/api/${last.replace(/_/g, ".")}` };
+  }
+  const ref = getProvider(provider.id)?.python?.methods?.[op];
+  if (!ref) return void 0;
+  const [method, path13] = ref.split(" ");
+  return { method, path: path13 };
+}
+var NOT_FIELDS2 = /* @__PURE__ */ new Set([
+  "keys",
+  "values",
+  "items",
+  "append",
+  "extend",
+  "lower",
+  "upper",
+  "strip",
+  "split",
+  "startswith",
+  "endswith",
+  "replace",
+  "format",
+  "encode",
+  "decode",
+  "count",
+  "index",
+  "copy",
+  "pop",
+  "update",
+  "sort"
+]);
+var SAME_DATA = /* @__PURE__ */ new Set(["to_dict", "to_dict_recursive", "model_dump", "dict"]);
+var MAX_DEPTH2 = 4;
+var Collector2 = class {
+  fields = /* @__PURE__ */ new Set();
+  statusCodes = /* @__PURE__ */ new Set();
+  checksOk = false;
+  enums = /* @__PURE__ */ new Map();
+  responseHeaders = /* @__PURE__ */ new Set();
+};
+function addResponseSurface2(call, site) {
+  const c = new Collector2();
+  const envelope = site.kind === "sdk" ? "body" : "response";
+  bindFrom2(call, { space: envelope, path: [] }, site.client, c, 0);
+  const s = site.surface;
+  s.fields = [...c.fields].sort();
+  s.statusCodes = [...c.statusCodes].sort((a, b) => a - b);
+  s.checksOk = c.checksOk;
+  s.enums = [...c.enums].map(([field, values]) => ({ field, values: [...values].sort() })).sort((a, b) => a.field.localeCompare(b.field));
+  s.responseHeaders = [...c.responseHeaders].sort();
+}
+function bindFrom2(expr, loc, lib, c, depth) {
+  if (depth > MAX_DEPTH2) return;
+  let cur = expr;
+  while (cur.parent && (cur.parent.type === "await" || cur.parent.type === "parenthesized_expression")) cur = cur.parent;
+  const parent = cur.parent;
+  if (!parent) return;
+  if (parent.type === "assignment" && parent.childForFieldName("right")?.id === cur.id) {
+    const left = parent.childForFieldName("left");
+    if (left?.type === "identifier") bindName2(left.text, parent, loc, lib, c, depth);
+    return;
+  }
+  if (parent.type === "as_pattern" && parent.namedChildren[0]?.id === cur.id) {
+    const alias = parent.childForFieldName("alias")?.namedChildren[0] ?? parent.namedChildren.at(-1);
+    if (alias?.type === "identifier") bindName2(alias.text, parent, loc, lib, c, depth);
+    return;
+  }
+  use2(cur, loc, lib, c, depth);
+}
+function bindName2(name, decl, loc, lib, c, depth) {
+  for (const ref of referencesOf2(name, decl)) use2(ref, loc, lib, c, depth);
+}
+function referencesOf2(name, decl) {
+  let scope = decl.parent;
+  while (scope && scope.type !== "function_definition" && scope.type !== "lambda" && scope.type !== "module") scope = scope.parent;
+  if (!scope) return [];
+  return scope.descendantsOfType("identifier").filter((id) => {
+    if (!id || id.text !== name || id.startIndex < decl.endIndex) return false;
+    const p = id.parent;
+    if (p?.type === "attribute" && p.childForFieldName("attribute")?.id === id.id) return false;
+    if (p?.type === "keyword_argument" && p.childForFieldName("name")?.id === id.id) return false;
+    if (p?.type === "assignment" && p.childForFieldName("left")?.id === id.id) return false;
+    return true;
+  });
+}
+function use2(ref, loc, lib, c, depth) {
+  const access = [];
+  let cur = ref;
+  for (; ; ) {
+    const p = cur.parent;
+    if (!p) break;
+    if (p.type === "attribute" && p.childForFieldName("object")?.id === cur.id) {
+      const name = p.childForFieldName("attribute")?.text ?? "";
+      const call = p.parent?.type === "call" && p.parent.childForFieldName("function")?.id === p.id ? p.parent : void 0;
+      if (call && name === "get" && (loc.space === "body" || access.length > 0)) {
+        const key = stringValue(call.childForFieldName("arguments")?.namedChildren[0] ?? void 0);
+        if (key === void 0) break;
+        access.push(key);
+        cur = call;
+        continue;
+      }
+      if (call && SAME_DATA.has(name) && loc.space === "body") {
+        cur = call;
+        continue;
+      }
+      access.push(name);
+      cur = p;
+    } else if (p.type === "subscript" && p.childForFieldName("value")?.id === cur.id) {
+      const key = stringValue(p.childForFieldName("subscript") ?? void 0);
+      access.push(key ?? "[]");
+      cur = p;
+    } else if (p.type === "parenthesized_expression" || p.type === "await") {
+      cur = p;
+    } else break;
+  }
+  interpret2(loc, access, cur, lib, c, depth);
+}
+function interpret2(loc, access, top, lib, c, depth) {
+  const full = [...loc.path, ...access];
+  if (loc.space === "body") return body2(full, top, lib, c, depth);
+  const [first, ...rest] = full;
+  if (first === void 0) return;
+  const isCall = top.parent?.type === "call" && top.parent.childForFieldName("function")?.id === top.id;
+  const statusKey = lib === "aiohttp" ? "status" : "status_code";
+  if (first === statusKey && rest.length === 0) {
+    for (const n of comparedLiterals2(top).nums) c.statusCodes.add(n);
+    return;
+  }
+  if (first === "ok" && rest.length === 0 || first === "raise_for_status" && isCall) {
+    c.checksOk = true;
+    return;
+  }
+  if (first === "headers") {
+    if (rest[0]) c.responseHeaders.add(rest[0].toLowerCase());
+    return;
+  }
+  if (first === "json" && rest.length === 0 && isCall) bindFrom2(top.parent, { space: "body", path: [] }, lib, c, depth + 1);
+}
+function body2(path13, top, lib, c, depth) {
+  const cut = path13.findIndex((p) => NOT_FIELDS2.has(p));
+  const fieldPath = cut >= 0 ? path13.slice(0, cut) : path13;
+  if (fieldPath.length === 0) {
+    if (path13.length === 0 && depth < MAX_DEPTH2) iterate(top, { space: "body", path: [] }, lib, c, depth);
+    return;
+  }
+  const field = fieldPath.join(".").replace(/\.\[\]/g, "[]");
+  c.fields.add(field);
+  if (cut < 0) {
+    for (const s of comparedLiterals2(top).strs) {
+      const set = c.enums.get(field) ?? /* @__PURE__ */ new Set();
+      set.add(s);
+      c.enums.set(field, set);
+    }
+    if (depth < MAX_DEPTH2) {
+      const parent = top.parent;
+      if (parent?.type === "assignment" && parent.childForFieldName("right")?.id === top.id) {
+        const left = parent.childForFieldName("left");
+        if (left?.type === "identifier") bindName2(left.text, parent, { space: "body", path: fieldPath }, lib, c, depth + 1);
+      }
+      iterate(top, { space: "body", path: fieldPath }, lib, c, depth);
+    }
+  }
+}
+function iterate(top, loc, lib, c, depth) {
+  const p = top.parent;
+  const items = { space: "body", path: [...loc.path, "[]"] };
+  if (p?.type === "for_statement" && p.childForFieldName("right")?.id === top.id) {
+    const left = p.childForFieldName("left");
+    if (left?.type === "identifier") bindName2(left.text, left, items, lib, c, depth + 1);
+  } else if (p?.type === "for_in_clause" && p.childForFieldName("right")?.id === top.id) {
+    const left = p.childForFieldName("left");
+    const comp = p.parent;
+    if (left?.type === "identifier" && comp) {
+      for (const id of comp.descendantsOfType("identifier")) {
+        if (id && id.text === left.text && id.id !== left.id) use2(id, items, lib, c, depth + 1);
+      }
+    }
+  }
+}
+function comparedLiterals2(node) {
+  const nums = [];
+  const strs = [];
+  let cur = node;
+  while (cur.parent?.type === "parenthesized_expression") cur = cur.parent;
+  const p = cur.parent;
+  if (p?.type !== "comparison_operator") return { nums, strs };
+  const take = (n) => {
+    if (!n) return;
+    if (n.type === "integer") nums.push(Number(n.text));
+    else if (n.type === "string") {
+      const v = stringValue(n);
+      if (v !== void 0) strs.push(v);
+    } else if (n.type === "tuple" || n.type === "list" || n.type === "set") n.namedChildren.forEach(take);
+  };
+  for (const operand of p.namedChildren) if (operand && operand.id !== cur.id) take(operand);
+  return { nums, strs };
+}
+function chainOf2(node) {
+  const names = [];
+  let cur = node;
+  while (cur.type === "attribute") {
+    names.unshift(cur.childForFieldName("attribute").text);
+    cur = cur.childForFieldName("object");
+  }
+  if (cur.type !== "identifier") return void 0;
+  const root = cur.text;
+  return { root, names, prefix: (n) => [root, ...names.slice(0, n)].join(".") };
+}
+function unwrap2(n) {
+  let cur = n;
+  while (cur.type === "await" || cur.type === "parenthesized_expression") cur = cur.namedChildren[0] ?? cur;
+  return cur;
+}
+function keyword(args, name) {
+  for (const a of args?.namedChildren ?? []) {
+    if (a?.type === "keyword_argument" && a.childForFieldName("name")?.text === name) return a.childForFieldName("value") ?? void 0;
+  }
+  return void 0;
+}
+function stringValue(n) {
+  if (!n || n.type !== "string") return void 0;
+  if (n.namedChildren.some((c) => c?.type === "interpolation")) return void 0;
+  return n.namedChildren.filter((c) => c?.type === "string_content" || c?.type === "escape_sequence").map((c) => c.text).join("");
+}
+function evalString2(ctx, node, depth = 0) {
+  if (!node || depth > 8) return void 0;
+  const n = unwrap2(node);
+  if (n.type === "string") {
+    let out = "";
+    for (const part of n.namedChildren) {
+      if (!part) continue;
+      if (part.type === "string_content" || part.type === "escape_sequence") out += part.text;
+      else if (part.type === "interpolation") {
+        const inner = part.childForFieldName("expression") ?? part.namedChildren[0];
+        out += (inner && evalString2(ctx, inner, depth + 1)) ?? placeholder2(inner ?? void 0);
+      }
+    }
+    return out;
+  }
+  if (n.type === "concatenated_string") return n.namedChildren.map((s) => evalString2(ctx, s ?? void 0, depth + 1) ?? "").join("");
+  if (n.type === "binary_operator" && n.childForFieldName("operator")?.text === "+") {
+    const l = evalString2(ctx, n.childForFieldName("left") ?? void 0, depth + 1);
+    const r = evalString2(ctx, n.childForFieldName("right") ?? void 0, depth + 1);
+    if (l === void 0 && r === void 0) return void 0;
+    return (l ?? placeholder2(n.childForFieldName("left") ?? void 0)) + (r ?? placeholder2(n.childForFieldName("right") ?? void 0));
+  }
+  if (n.type === "identifier") {
+    const init = localAssignment(n) ?? ctx.consts.get(n.text);
+    return init && init.id !== node.id ? evalString2(ctx, init, depth + 1) : void 0;
+  }
+  if (n.type === "call") {
+    const fn = n.childForFieldName("function")?.text;
+    const args = (n.childForFieldName("arguments")?.namedChildren ?? []).filter(Boolean);
+    if ((fn === "os.getenv" || fn === "getenv" || fn === "os.environ.get") && args[1]) return evalString2(ctx, args[1], depth + 1);
+  }
+  return void 0;
+}
+function localAssignment(use3) {
+  let scope = use3.parent;
+  while (scope && scope.type !== "function_definition" && scope.type !== "module") scope = scope.parent;
+  if (!scope || scope.type === "module") return void 0;
+  let last;
+  for (const assign of scope.descendantsOfType("assignment")) {
+    if (!assign || assign.endIndex > use3.startIndex) continue;
+    const left = assign.childForFieldName("left");
+    if (left?.type !== "identifier" || left.text !== use3.text) continue;
+    let owner = assign.parent;
+    while (owner && owner.type !== "function_definition") owner = owner.parent;
+    if (owner?.id !== scope.id) continue;
+    last = assign.childForFieldName("right") ?? void 0;
+  }
+  return last;
+}
+function looseUrls(ctx, root, file, sites, calls) {
+  const covered = new Set(sites.map((s) => `${s.provider} ${s.endpoint}`));
+  const inCall = (n) => calls.some((c) => n.startIndex >= c.startIndex && n.endIndex <= c.endIndex);
+  const candidates = [];
+  for (const node of root.descendantsOfType(["string", "concatenated_string", "binary_operator"])) {
+    if (!node) continue;
+    if (node.type === "binary_operator" && node.childForFieldName("operator")?.text !== "+") continue;
+    const p = node.parent;
+    if (p && (p.type === "concatenated_string" || p.type === "interpolation" || p.type === "expression_statement" || p.type === "binary_operator" && p.childForFieldName("operator")?.text === "+")) continue;
+    if (inCall(node)) continue;
+    const value2 = evalString2(ctx, node);
+    const parts = value2 === void 0 ? void 0 : urlParts(value2);
+    if (!parts?.path || parts.path === "/") continue;
+    const provider = providerOf(parts.host, parts.path);
+    if (provider) candidates.push({ node, host: parts.host, path: parts.path, query: parts.query, provider });
+  }
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const c of candidates) {
+    const key = `${c.provider} ${c.path}`;
+    if (covered.has(key) || seen.has(key)) continue;
+    if (candidates.some((o) => o.provider === c.provider && o.path !== c.path && o.path.startsWith(`${c.path}/`))) continue;
+    if (sites.some((s) => s.provider === c.provider && s.endpoint?.startsWith(`${c.path}/`))) continue;
+    seen.add(key);
+    const surface = emptySurface2();
+    surface.query = c.query;
+    out.push({ file, line: c.node.startPosition.row + 1, column: c.node.startPosition.column + 1, provider: c.provider, kind: "http", client: "url", method: null, host: c.host, endpoint: c.path, resolved: true, surface });
+  }
+  return out;
+}
+function placeholder2(n) {
+  if (!n) return "{}";
+  const e = unwrap2(n);
+  if (e.type === "identifier") return `{${e.text}}`;
+  if (e.type === "attribute") return `{${e.childForFieldName("attribute")?.text ?? ""}}`;
+  const args = e.type === "call" ? (e.childForFieldName("arguments")?.namedChildren ?? []).filter(Boolean) : [];
+  if (args.length === 1) return placeholder2(args[0]);
+  return "{}";
+}
+function dictEntries(ctx, node, depth = 0) {
+  if (!node || depth > 3) return [];
+  const n = unwrap2(node);
+  if (n.type === "identifier") {
+    const init = ctx.consts.get(n.text);
+    return init ? dictEntries(ctx, init, depth + 1) : [];
+  }
+  if (n.type === "call" && n.childForFieldName("function")?.text === "dict") {
+    return (n.childForFieldName("arguments")?.namedChildren ?? []).filter((a) => a?.type === "keyword_argument").map((a) => ({ name: a.childForFieldName("name").text, value: literal(ctx, a.childForFieldName("value") ?? void 0) }));
+  }
+  if (n.type !== "dictionary") return [];
+  const out = [];
+  for (const pair of n.namedChildren) {
+    if (pair?.type !== "pair") continue;
+    const key = stringValue(pair.childForFieldName("key") ?? void 0);
+    if (key !== void 0) out.push({ name: key, value: literal(ctx, pair.childForFieldName("value") ?? void 0) });
+  }
+  return out;
+}
+function literal(ctx, n) {
+  if (!n) return null;
+  if (n.type === "integer" || n.type === "float") return n.text;
+  if (n.type === "true" || n.type === "false") return n.text.toLowerCase();
+  return evalString2(ctx, n) ?? null;
+}
+function joinUrl2(base, url) {
+  if (url === void 0) return base;
+  if (!base || /^[a-z]+:\/\//i.test(url)) return url;
+  return base.replace(/\/+$/, "") + "/" + url.replace(/^\/+/, "");
+}
+function emptySurface2() {
+  return { fields: [], statusCodes: [], checksOk: false, enums: [], headers: [], query: [], responseHeaders: [] };
+}
 
 // packages/extractor/src/index.ts
 var SCRIPT_KINDS = {
@@ -1380,31 +2205,50 @@ var SCRIPT_KINDS = {
 };
 function extractCallSites(rootDir) {
   const root = path4.resolve(rootDir);
-  const { sources, manifests } = listRepoFiles(root);
+  const { sources, manifests, python, pythonManifests } = listRepoFiles(root);
   const project = new Project({
     useInMemoryFileSystem: true,
     skipFileDependencyResolution: true,
     compilerOptions: { allowJs: true }
   });
   const found = [];
+  const loose = [];
   for (const abs of sources) {
     const rel = toPosix(path4.relative(root, abs));
     const sf = project.createSourceFile(`/${rel}`, readFileSync3(abs, "utf8"), {
       overwrite: true,
       scriptKind: SCRIPT_KINDS[path4.extname(abs)] ?? ScriptKind.TS
     });
-    for (const f of extractFromFile(sf, rel)) {
+    const inFile = extractFromFile(sf, rel);
+    for (const f of inFile) {
       addResponseSurface(f);
       found.push(f);
     }
+    loose.push(...looseUrlSites(sf, rel, inFile));
   }
   found.sort((a, b) => a.site.file.localeCompare(b.site.file) || a.site.line - b.site.line || a.site.column - b.site.column);
+  const skipped = [];
+  const pythonSites = [];
+  for (const abs of python) {
+    const rel = toPosix(path4.relative(root, abs));
+    if (!pythonParserLoaded()) {
+      skipped.push({ file: rel, reason: "the Python parser was not loaded" });
+      continue;
+    }
+    try {
+      pythonSites.push(...extractPython(readFileSync3(abs, "utf8"), rel));
+    } catch (err) {
+      skipped.push({ file: rel, reason: err instanceof Error ? err.message : String(err) });
+    }
+  }
+  const callSites = [...found.map((f) => f.site), ...loose, ...pythonSites].sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line || a.column - b.column);
   return {
     root,
-    filesScanned: sources.length,
-    callSites: found.map((f) => f.site),
-    declared: declaredProviders(root, manifests),
-    found
+    filesScanned: sources.length + python.length - skipped.length,
+    callSites,
+    declared: [...declaredProviders(root, manifests), ...declaredPythonProviders(root, pythonManifests)],
+    found,
+    skipped
   };
 }
 
@@ -1520,9 +2364,9 @@ function inferShape(res, opts) {
     else if (!VOLATILE_HEADERS.has(name) && !name.startsWith("x-ratelimit") && !name.startsWith("ratelimit")) headerNames.push(name);
   }
   const text = res.body ?? "";
-  let body2;
+  let body3;
   if (text.trim() === "") {
-    body2 = { kind: "empty", fields: [] };
+    body3 = { kind: "empty", fields: [] };
   } else {
     let parsed;
     let isJson = true;
@@ -1534,16 +2378,16 @@ function inferShape(res, opts) {
     if (isJson) {
       const acc = /* @__PURE__ */ new Map();
       walk(parsed, "", acc);
-      body2 = { kind: "json", rootType: typeOf(parsed), fields: finish(acc, opts.salt) };
+      body3 = { kind: "json", rootType: typeOf(parsed), fields: finish(acc, opts.salt) };
     } else {
-      body2 = { kind: "text", fields: [] };
+      body3 = { kind: "text", fields: [] };
     }
   }
   return {
     status: res.status,
     headers: Object.fromEntries(Object.entries(headers).sort(([a], [b]) => cmp3(a, b))),
     headerNames: [...new Set(headerNames)].sort(),
-    body: body2
+    body: body3
   };
 }
 function walk(value2, path13, acc) {
@@ -1939,8 +2783,181 @@ function replay(recording, store, secret) {
   return { recording, observations, after, before, ...before ? { diff: diffShapes(before.shape, after.shape) } : {} };
 }
 
-// packages/repair/src/recipes/status-code-accept-set.ts
+// packages/repair/src/recipes/apply-fix.ts
 import { Node as Node3, SyntaxKind as SyntaxKind3 } from "ts-morph";
+var applyFix = {
+  id: "apply-fix",
+  changeClass: "version-sunset",
+  description: "Apply the advisory's fix: the new path, query value or header, and the renamed fields and enum values",
+  edits({ sourceFile, call, advisory }) {
+    const fix2 = advisory.fix;
+    if (!fix2) return [];
+    const where = (n) => `${sourceFile.getFilePath().slice(1)}:${n.getStartLineNumber()}`;
+    const edits = [...requestEdits(call, sourceFile, fix2, where), ...headerEdits(call, fix2, where)];
+    const scope = enclosingFunction(call) ?? sourceFile;
+    edits.push(...fieldEdits(scope, fix2, where, edits), ...enumEdits(scope, fix2, where));
+    return edits;
+  }
+};
+var TEXT_KINDS = [SyntaxKind3.StringLiteral, SyntaxKind3.NoSubstitutionTemplateLiteral, SyntaxKind3.TemplateHead, SyntaxKind3.TemplateMiddle, SyntaxKind3.TemplateTail];
+function requestEdits(call, sf, fix2, where) {
+  if (!fix2.path && !fix2.query) return [];
+  const edits = [];
+  for (const node of urlTextNodes(call, sf)) {
+    const before = node.getText();
+    let after = before;
+    if (fix2.path) {
+      after = after.split(fix2.path.from).join(fix2.path.to);
+      const from = fix2.path.from.replace(/\/$/, "");
+      const to = fix2.path.to.replace(/\/$/, "");
+      if (from !== fix2.path.from) after = after.replace(new RegExp(`${escapeRe(from)}(?=["'\`]|\\$\\{)`, "g"), to);
+    }
+    if (fix2.query) {
+      const re = new RegExp(`([?&])${escapeRe(fix2.query.name)}=([^&#\`'"$]+)`, "g");
+      after = after.replace(re, (_m, sep) => `${sep}${fix2.query.name}=${fix2.query.value}`);
+    }
+    if (after !== before) edits.push({ start: node.getStart(), end: node.getEnd(), text: after, note: `${where(node)} \`${before}\` \u2192 \`${after}\`` });
+  }
+  if (fix2.query) {
+    for (const prop of [...objectProperties(call, "params"), ...objectProperties(call, "searchParams")]) {
+      if (propName2(prop) !== fix2.query.name || !Node3.isPropertyAssignment(prop)) continue;
+      const init = prop.getInitializer();
+      if (!init || !(Node3.isNumericLiteral(init) || Node3.isStringLiteral(init))) continue;
+      const text = /^\d+(\.\d+)?$/.test(fix2.query.value) && Node3.isNumericLiteral(init) ? fix2.query.value : JSON.stringify(fix2.query.value);
+      if (init.getText() !== text) edits.push({ start: init.getStart(), end: init.getEnd(), text, note: `${where(init)} ${fix2.query.name}: \`${init.getText()}\` \u2192 \`${text}\`` });
+    }
+  }
+  return edits;
+}
+function headerEdits(call, fix2, where) {
+  if (!fix2.header) return [];
+  const edits = [];
+  const text = JSON.stringify(fix2.header.value);
+  for (const prop of objectProperties(call, "headers")) {
+    if (propName2(prop)?.toLowerCase() !== fix2.header.name.toLowerCase() || !Node3.isPropertyAssignment(prop)) continue;
+    const init = prop.getInitializer();
+    if (!init || !(Node3.isStringLiteral(init) || Node3.isNoSubstitutionTemplateLiteral(init)) || init.getLiteralText() === fix2.header.value) continue;
+    edits.push({ start: init.getStart(), end: init.getEnd(), text, note: `${where(init)} ${fix2.header.name}: \`${init.getText()}\` \u2192 \`${text}\`` });
+  }
+  return edits;
+}
+function fieldEdits(scope, fix2, where, taken) {
+  const edits = [];
+  for (const { from, to } of fix2.fields ?? []) {
+    const oldName = leaf(from);
+    const newName = leaf(to);
+    if (oldName === newName) continue;
+    for (const access of scope.getDescendantsOfKind(SyntaxKind3.PropertyAccessExpression)) {
+      if (access.getName() !== oldName || isWrite(access) || overlaps(access, [...taken, ...edits])) continue;
+      const target = access.getExpression().getText();
+      const dot = access.hasQuestionDotToken() ? "?." : ".";
+      const text = `(${target}${dot}${newName} ?? ${target}${dot}${oldName})`;
+      edits.push({ start: access.getStart(), end: access.getEnd(), text, note: `${where(access)} \`${access.getText()}\` \u2192 \`${text}\`` });
+    }
+  }
+  return edits;
+}
+function enumEdits(scope, fix2, where) {
+  const edits = [];
+  for (const { field, values } of fix2.enums ?? []) {
+    const name = leaf(field);
+    const renamed = new Map(values.map((v) => [v.from, v.to]));
+    const isField = (n) => Node3.isPropertyAccessExpression(n) && n.getName() === name || Node3.isIdentifier(n) && n.getText() === name;
+    for (const bin of scope.getDescendantsOfKind(SyntaxKind3.BinaryExpression)) {
+      const op = bin.getOperatorToken().getKind();
+      const negated = op === SyntaxKind3.ExclamationEqualsEqualsToken || op === SyntaxKind3.ExclamationEqualsToken;
+      if (!negated && op !== SyntaxKind3.EqualsEqualsEqualsToken && op !== SyntaxKind3.EqualsEqualsToken) continue;
+      const [lit, other] = Node3.isStringLiteral(bin.getRight()) ? [bin.getRight(), bin.getLeft()] : [bin.getLeft(), bin.getRight()];
+      if (!Node3.isStringLiteral(lit) || !isField(other)) continue;
+      const to = renamed.get(lit.getLiteralText());
+      if (to === void 0) continue;
+      const text = `${negated ? "!" : ""}${JSON.stringify([lit.getLiteralText(), to])}.includes(${other.getText()})`;
+      edits.push({ start: bin.getStart(), end: bin.getEnd(), text, note: `${where(bin)} \`${bin.getText()}\` \u2192 \`${text}\`` });
+    }
+    for (const sw of scope.getDescendantsOfKind(SyntaxKind3.SwitchStatement)) {
+      if (!isField(sw.getExpression())) continue;
+      const cases = sw.getClauses().filter(Node3.isCaseClause);
+      const present = new Set(cases.map((c) => c.getExpression()).filter(Node3.isStringLiteral).map((l) => l.getLiteralText()));
+      for (const c of cases) {
+        const e = c.getExpression();
+        const to = Node3.isStringLiteral(e) ? renamed.get(e.getLiteralText()) : void 0;
+        if (to === void 0 || present.has(to)) continue;
+        present.add(to);
+        const indent = " ".repeat(c.getSourceFile().getLineAndColumnAtPos(c.getStart()).column - 1);
+        edits.push({ start: c.getStart(), end: c.getStart(), text: `case ${JSON.stringify(to)}:
+${indent}`, note: `${where(c)} add case ${JSON.stringify(to)}` });
+      }
+    }
+    for (const inc of scope.getDescendantsOfKind(SyntaxKind3.CallExpression)) {
+      const callee = inc.getExpression();
+      if (!Node3.isPropertyAccessExpression(callee) || callee.getName() !== "includes" || !isField(inc.getArguments()[0] ?? inc)) continue;
+      const arr = callee.getExpression();
+      if (!Node3.isArrayLiteralExpression(arr)) continue;
+      const items = arr.getElements().filter(Node3.isStringLiteral).map((l) => l.getLiteralText());
+      const add = items.map((v) => renamed.get(v)).filter((v) => v !== void 0 && !items.includes(v));
+      if (!add.length) continue;
+      const text = JSON.stringify([...items, ...new Set(add)]);
+      edits.push({ start: arr.getStart(), end: arr.getEnd(), text, note: `${where(arr)} \`${arr.getText()}\` \u2192 \`${text}\`` });
+    }
+  }
+  return edits;
+}
+function urlTextNodes(call, sf) {
+  const out = /* @__PURE__ */ new Set();
+  const seen = /* @__PURE__ */ new Set();
+  const visit = (n, depth) => {
+    if (!n || depth > 4 || seen.has(n)) return;
+    seen.add(n);
+    if (TEXT_KINDS.includes(n.getKind())) out.add(n);
+    if (Node3.isIdentifier(n)) {
+      const decl = sf.getVariableDeclaration(n.getText());
+      if (decl?.getVariableStatement()?.getDeclarationKind() === "const") visit(decl.getInitializer(), depth + 1);
+      return;
+    }
+    n.forEachChild((c) => visit(c, depth));
+  };
+  const [first] = call.getArguments();
+  if (first && Node3.isObjectLiteralExpression(first)) {
+    const url = first.getProperty("url");
+    if (url && Node3.isPropertyAssignment(url)) visit(url.getInitializer(), 0);
+  } else visit(first, 0);
+  for (const prop of sf.getDescendantsOfKind(SyntaxKind3.PropertyAssignment)) if (propName2(prop) === "baseURL") visit(prop.getInitializer(), 0);
+  return [...out];
+}
+function objectProperties(call, name) {
+  const out = [];
+  for (const arg of call.getArguments()) {
+    if (!Node3.isObjectLiteralExpression(arg)) continue;
+    const prop = arg.getProperties().find((p) => propName2(p) === name);
+    const value2 = prop && Node3.isPropertyAssignment(prop) ? prop.getInitializer() : void 0;
+    if (value2 && Node3.isObjectLiteralExpression(value2)) out.push(...value2.getProperties());
+  }
+  return out;
+}
+function propName2(p) {
+  if (!(Node3.isPropertyAssignment(p) || Node3.isShorthandPropertyAssignment(p))) return void 0;
+  const n = p.getNameNode();
+  return Node3.isStringLiteral(n) || Node3.isNoSubstitutionTemplateLiteral(n) ? n.getLiteralText() : n.getText();
+}
+function enclosingFunction(call) {
+  return call.getFirstAncestor((n) => Node3.isFunctionDeclaration(n) || Node3.isArrowFunction(n) || Node3.isFunctionExpression(n) || Node3.isMethodDeclaration(n));
+}
+function isWrite(access) {
+  const p = access.getParent();
+  return Node3.isBinaryExpression(p) && p.getLeft() === access && p.getOperatorToken().getKind() === SyntaxKind3.EqualsToken;
+}
+function overlaps(n, edits) {
+  return edits.some((e) => n.getStart() < e.end && e.start < n.getEnd());
+}
+function leaf(path13) {
+  return path13.split(".").pop().replace(/\[\]/g, "");
+}
+function escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// packages/repair/src/recipes/status-code-accept-set.ts
+import { Node as Node4, SyntaxKind as SyntaxKind4 } from "ts-morph";
 var STATUS_PROPS = /* @__PURE__ */ new Set(["status", "statusCode"]);
 var statusCodeAcceptSet = {
   id: "status-code-accept-set",
@@ -1955,23 +2972,23 @@ var statusCodeAcceptSet = {
     const where = (n) => `${sourceFile.getFilePath().slice(1)}:${n.getStartLineNumber()}`;
     for (const status of statusExpressions(call)) {
       let cur = status;
-      while (Node3.isParenthesizedExpression(cur.getParent())) cur = cur.getParent();
+      while (Node4.isParenthesizedExpression(cur.getParent())) cur = cur.getParent();
       const parent = cur.getParent();
-      if (Node3.isBinaryExpression(parent)) {
+      if (Node4.isBinaryExpression(parent)) {
         const op = parent.getOperatorToken().getKind();
         const other = parent.getLeft() === cur ? parent.getRight() : parent.getLeft();
-        if (!Node3.isNumericLiteral(other) || !oldCodes.includes(Number(other.getLiteralValue()))) continue;
-        const negated = op === SyntaxKind3.ExclamationEqualsEqualsToken || op === SyntaxKind3.ExclamationEqualsToken;
-        const equal = op === SyntaxKind3.EqualsEqualsEqualsToken || op === SyntaxKind3.EqualsEqualsToken;
+        if (!Node4.isNumericLiteral(other) || !oldCodes.includes(Number(other.getLiteralValue()))) continue;
+        const negated = op === SyntaxKind4.ExclamationEqualsEqualsToken || op === SyntaxKind4.ExclamationEqualsToken;
+        const equal = op === SyntaxKind4.EqualsEqualsEqualsToken || op === SyntaxKind4.EqualsEqualsToken;
         if (!negated && !equal) continue;
         const text = `${negated ? "!" : ""}${list}.includes(${status.getText()})`;
         edits.push({ start: parent.getStart(), end: parent.getEnd(), text, note: `${where(parent)} \`${parent.getText()}\` \u2192 \`${text}\`` });
-      } else if (Node3.isSwitchStatement(parent) && parent.getExpression() === cur) {
-        const cases = parent.getClauses().filter(Node3.isCaseClause);
-        const present = new Set(cases.map((c) => c.getExpression()).filter(Node3.isNumericLiteral).map((l) => Number(l.getLiteralValue())));
+      } else if (Node4.isSwitchStatement(parent) && parent.getExpression() === cur) {
+        const cases = parent.getClauses().filter(Node4.isCaseClause);
+        const present = new Set(cases.map((c) => c.getExpression()).filter(Node4.isNumericLiteral).map((l) => Number(l.getLiteralValue())));
         const anchor = cases.find((c) => {
           const e = c.getExpression();
-          return Node3.isNumericLiteral(e) && oldCodes.includes(Number(e.getLiteralValue()));
+          return Node4.isNumericLiteral(e) && oldCodes.includes(Number(e.getLiteralValue()));
         });
         const missing = accept.filter((c) => !present.has(c));
         if (!anchor || missing.length === 0) continue;
@@ -1979,11 +2996,11 @@ var statusCodeAcceptSet = {
         const text = missing.map((c) => `case ${c}:
 ${indent}`).join("");
         edits.push({ start: anchor.getStart(), end: anchor.getStart(), text, note: `${where(anchor)} add ${missing.map((c) => `case ${c}`).join(", ")}` });
-      } else if (Node3.isCallExpression(parent) && parent.getArguments()[0] === cur) {
+      } else if (Node4.isCallExpression(parent) && parent.getArguments()[0] === cur) {
         const callee = parent.getExpression();
-        const arr = Node3.isPropertyAccessExpression(callee) && callee.getName() === "includes" ? callee.getExpression() : void 0;
-        if (!arr || !Node3.isArrayLiteralExpression(arr)) continue;
-        const values = arr.getElements().filter(Node3.isNumericLiteral).map((l) => Number(l.getLiteralValue()));
+        const arr = Node4.isPropertyAccessExpression(callee) && callee.getName() === "includes" ? callee.getExpression() : void 0;
+        if (!arr || !Node4.isArrayLiteralExpression(arr)) continue;
+        const values = arr.getElements().filter(Node4.isNumericLiteral).map((l) => Number(l.getLiteralValue()));
         if (!values.some((v) => oldCodes.includes(v))) continue;
         const merged = [.../* @__PURE__ */ new Set([...values, ...accept])].sort((a, b) => a - b);
         if (merged.length === values.length) continue;
@@ -1999,52 +3016,52 @@ function statusExpressions(call) {
   let cur = call;
   for (; ; ) {
     const p = cur.getParent();
-    if (p && (Node3.isAwaitExpression(p) || Node3.isParenthesizedExpression(p) || Node3.isAsExpression(p) || Node3.isNonNullExpression(p))) cur = p;
+    if (p && (Node4.isAwaitExpression(p) || Node4.isParenthesizedExpression(p) || Node4.isAsExpression(p) || Node4.isNonNullExpression(p))) cur = p;
     else break;
   }
   const parent = cur.getParent();
   const sf = call.getSourceFile();
-  if (Node3.isPropertyAccessExpression(parent) && parent.getExpression() === cur && STATUS_PROPS.has(parent.getName())) out.push(parent);
-  if (Node3.isPropertyAccessExpression(parent) && parent.getName() === "then") {
-    const cb = Node3.isCallExpression(parent.getParent()) ? parent.getParent().getArguments()[0] : void 0;
-    const param = cb && (Node3.isArrowFunction(cb) || Node3.isFunctionExpression(cb)) ? cb.getParameters()[0] : void 0;
+  if (Node4.isPropertyAccessExpression(parent) && parent.getExpression() === cur && STATUS_PROPS.has(parent.getName())) out.push(parent);
+  if (Node4.isPropertyAccessExpression(parent) && parent.getName() === "then") {
+    const cb = Node4.isCallExpression(parent.getParent()) ? parent.getParent().getArguments()[0] : void 0;
+    const param = cb && (Node4.isArrowFunction(cb) || Node4.isFunctionExpression(cb)) ? cb.getParameters()[0] : void 0;
     if (param) out.push(...fromBinding(param.getNameNode(), param, sf));
   }
-  if (Node3.isVariableDeclaration(parent) && parent.getInitializer() === cur) out.push(...fromBinding(parent.getNameNode(), parent, sf));
+  if (Node4.isVariableDeclaration(parent) && parent.getInitializer() === cur) out.push(...fromBinding(parent.getNameNode(), parent, sf));
   return out;
 }
 function fromBinding(name, decl, sf) {
   const out = [];
-  if (Node3.isIdentifier(name)) {
+  if (Node4.isIdentifier(name)) {
     for (const ref of references(name.getText(), decl, sf)) {
       const p = ref.getParent();
-      if (Node3.isPropertyAccessExpression(p) && p.getExpression() === ref && STATUS_PROPS.has(p.getName())) out.push(p);
+      if (Node4.isPropertyAccessExpression(p) && p.getExpression() === ref && STATUS_PROPS.has(p.getName())) out.push(p);
     }
-  } else if (Node3.isObjectBindingPattern(name)) {
+  } else if (Node4.isObjectBindingPattern(name)) {
     for (const el of name.getElements()) {
       const prop = el.getPropertyNameNode()?.getText() ?? el.getName();
-      if (STATUS_PROPS.has(prop) && Node3.isIdentifier(el.getNameNode())) out.push(...references(el.getName(), decl, sf));
+      if (STATUS_PROPS.has(prop) && Node4.isIdentifier(el.getNameNode())) out.push(...references(el.getName(), decl, sf));
     }
   }
   return out;
 }
 function references(name, decl, sf) {
   const scope = decl.getFirstAncestor(
-    (n) => Node3.isBlock(n) || Node3.isArrowFunction(n) || Node3.isFunctionExpression(n) || Node3.isFunctionDeclaration(n) || Node3.isMethodDeclaration(n) || Node3.isCaseClause(n)
+    (n) => Node4.isBlock(n) || Node4.isArrowFunction(n) || Node4.isFunctionExpression(n) || Node4.isFunctionDeclaration(n) || Node4.isMethodDeclaration(n) || Node4.isCaseClause(n)
   ) ?? sf;
-  return scope.getDescendantsOfKind(SyntaxKind3.Identifier).filter((id) => {
+  return scope.getDescendantsOfKind(SyntaxKind4.Identifier).filter((id) => {
     if (id.getText() !== name || id.getStart() < decl.getEnd()) return false;
     const p = id.getParent();
-    if (Node3.isPropertyAccessExpression(p) && p.getNameNode() === id) return false;
-    if (Node3.isPropertyAssignment(p) && p.getNameNode() === id) return false;
-    return !(Node3.isBindingElement(p) || Node3.isVariableDeclaration(p) || Node3.isParameterDeclaration(p));
+    if (Node4.isPropertyAccessExpression(p) && p.getNameNode() === id) return false;
+    if (Node4.isPropertyAssignment(p) && p.getNameNode() === id) return false;
+    return !(Node4.isBindingElement(p) || Node4.isVariableDeclaration(p) || Node4.isParameterDeclaration(p));
   });
 }
 
 // packages/repair/src/recipe.ts
-import { Project as Project2, ScriptKind as ScriptKind2, SyntaxKind as SyntaxKind4 } from "ts-morph";
+import { Project as Project2, ScriptKind as ScriptKind2, SyntaxKind as SyntaxKind5 } from "ts-morph";
 function findCall(sf, site) {
-  return sf.getDescendantsOfKind(SyntaxKind4.CallExpression).filter((c) => {
+  return sf.getDescendantsOfKind(SyntaxKind5.CallExpression).filter((c) => {
     const pos = sf.getLineAndColumnAtPos(c.getStart());
     return pos.line === site.line && pos.column === site.column;
   }).sort((a, b) => a.getWidth() - b.getWidth())[0];
@@ -2073,7 +3090,7 @@ function runRecipe(recipes, advisory, callSite, text) {
 
 // packages/repair/src/contract.ts
 import path7 from "path";
-import { Node as Node4, Project as Project3, ScriptKind as ScriptKind3, SyntaxKind as SyntaxKind5 } from "ts-morph";
+import { Node as Node5, Project as Project3, ScriptKind as ScriptKind3, SyntaxKind as SyntaxKind6 } from "ts-morph";
 
 // packages/repair/src/synth.ts
 function synthesizeBody(shape) {
@@ -2132,70 +3149,339 @@ function sampleString(classes) {
   if (classes.includes("token")) return "shapi_value";
   return "shapi text";
 }
+function bodyFromPaths(paths, values = {}) {
+  const all = [.../* @__PURE__ */ new Set([...paths, ...Object.keys(values)])];
+  const isLeaf = (p) => !all.some((o) => o !== p && (o.startsWith(`${p}.`) || o.startsWith(`${p}[]`)));
+  const shape = {
+    status: 200,
+    headers: {},
+    headerNames: [],
+    body: {
+      kind: "json",
+      rootType: all.some((p) => p.startsWith("[]")) ? "array" : "object",
+      fields: all.map((path13) => ({ path: path13, pathHash: path13, types: isLeaf(path13) ? ["string"] : [], classes: [], occurrences: 1, nullRate: 0 }))
+    }
+  };
+  const body3 = synthesizeBody(shape);
+  for (const [path13, value2] of Object.entries(values)) setPath(body3, tokens(path13), value2);
+  return body3;
+}
+function setPath(target, path13, value2) {
+  let cur = target;
+  for (let i = 0; i < path13.length; i++) {
+    const t = path13[i];
+    const last = i === path13.length - 1;
+    if (t === "[]") {
+      const arr = cur;
+      if (last) arr[0] = value2;
+      else cur = arr[0];
+    } else {
+      const obj = cur;
+      if (last) obj[t] = value2;
+      else cur = obj[t];
+    }
+    if (cur === void 0 || cur === null) return;
+  }
+}
 
 // packages/repair/src/contract.ts
 var CONTRACT_DIR = "test/shapi";
+var RETIRED_STATUS = 410;
 function generateContractTest(input) {
   const { callSite, advisory, before, after } = input;
-  if (callSite.kind !== "http" || callSite.client !== "fetch") {
-    return { status: "unsupported", reason: `contract tests support global fetch call sites; this one uses ${callSite.client}` };
-  }
+  const fix2 = advisory.fix;
   const project = new Project3({ useInMemoryFileSystem: true, skipFileDependencyResolution: true, compilerOptions: { allowJs: true } });
   const sf = project.createSourceFile(`/${callSite.file}`, input.sourceText, {
     scriptKind: /\.(c|m)?jsx?$/.test(callSite.file) ? ScriptKind3.JS : ScriptKind3.TS
   });
   const call = findCall(sf, callSite);
   if (!call) return { status: "unsupported", reason: `no call at ${callSite.file}:${callSite.line}:${callSite.column}` };
+  const transport = transportFor(callSite, sf);
+  if ("reason" in transport) return { status: "unsupported", reason: transport.reason };
   const fn = exportedFunction(call);
   if (!fn) return { status: "unsupported", reason: "the call site is not inside an exported function" };
-  let responses;
+  const file = input.file ?? `${CONTRACT_DIR}/${advisory.id}.test.ts`;
+  const importPath = toImport(path7.posix.relative(path7.posix.dirname(file), callSite.file));
+  const parts = {
+    header: `// Generated by SHAPI for advisory ${advisory.id}: ${advisory.title}
+// Call site: ${callSite.file}:${callSite.line} (${callSite.method} ${callSite.endpoint}, via ${callSite.client})`,
+    fn: fn.name,
+    importPath,
+    args: fn.params.map((p) => argument(p, sf)).join(", "),
+    advisory,
+    transport
+  };
+  if (fix2 && (fix2.path || fix2.query || fix2.header)) {
+    if (callSite.kind === "sdk") return { status: "unsupported", reason: `the fix changes the request, which ${callSite.client} builds itself` };
+    return { status: "generated", file, content: requestTest({ ...parts, fix: fix2, body: renamePair(callSite, fix2).after }), functionName: fn.name };
+  }
+  if (fix2 && (fix2.fields || fix2.enums)) {
+    return { status: "generated", file, content: sameResultTest({ ...parts, ...renamePair(callSite, fix2) }), functionName: fn.name };
+  }
+  if (!before || !after) return { status: "unsupported", reason: "no before/after responses for this endpoint, and the advisory has no fix to build a test from" };
   try {
-    responses = [response(`before (${before.status})`, before), response(`after (${after.status})`, after)].join(",\n");
+    return { status: "generated", file, content: recordedTest({ ...parts, before, after }), functionName: fn.name };
   } catch (err) {
     return { status: "unsupported", reason: err instanceof Error ? err.message : String(err) };
   }
-  const file = `${CONTRACT_DIR}/${advisory.id}.test.ts`;
-  const importPath = toImport(path7.posix.relative(path7.posix.dirname(file), callSite.file));
-  const args = fn.params.map((p) => argument(p, sf)).join(", ");
-  const content = `// Generated by SHAPI for advisory ${advisory.id}: ${advisory.title}
-// Call site: ${callSite.file}:${callSite.line} (${callSite.method} ${callSite.endpoint})
-// Calls ${fn.name}() with fetch returning the response the code was written for and the one
-// ${advisory.provider} sends now. It fails while the code accepts only the old response.
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { ${fn.name} } from "${importPath}";
+}
+function transportFor(site, sf) {
+  if (site.kind === "http") {
+    if (site.client === "fetch" || site.client === "ky") return { mock: "", stubFetch: true, name: "fetch" };
+    if (site.client === "node-fetch") {
+      return { mock: `vi.mock("node-fetch", () => ({ default: (input: RequestInfo | URL, init?: RequestInit) => globalThis.fetch(input, init) }));
+`, stubFetch: true, name: "node-fetch" };
+    }
+    if (site.client === "axios") return { mock: AXIOS_FAKE, stubFetch: false, name: "axios" };
+    if (site.client === "got") return { mock: GOT_FAKE, stubFetch: false, name: "got" };
+    return { reason: `contract tests support fetch, node-fetch, ky, axios, got and SDK call sites; this one uses ${site.client}` };
+  }
+  const decl = sf.getImportDeclarations().find((d) => d.getModuleSpecifierValue() === site.client);
+  if (!decl) return { reason: `${site.file} does not import ${site.client} with an import statement` };
+  const names = decl.getNamedImports().map((n) => n.getName());
+  const exports = [`default: client`, ...names.map((n) => `${JSON.stringify(n)}: client`)].join(", ");
+  const url = `https://${site.host ?? "sdk.invalid"}${site.endpoint ?? "/"}`;
+  const envelope = site.provider === "github" ? `{ status: res.status, data: res.body, headers: res.headers }` : `res.body`;
+  return {
+    mock: `vi.mock(${JSON.stringify(site.client)}, () => {
+  const call = async () => {
+    const res = shapi.respond({ method: ${JSON.stringify(site.method ?? "GET")}, url: ${JSON.stringify(url)}, headers: {} });
+    if (res.status >= 400) throw Object.assign(new Error(\`${site.client} request failed with \${res.status}\`), { status: res.status, statusCode: res.status, response: { status: res.status, data: res.body } });
+    return ${envelope};
+  };
+  const client: any = new Proxy(function () {}, {
+    get: (_t, prop) => (prop === "then" || typeof prop === "symbol" ? undefined : client),
+    apply: () => call(),
+    construct: () => client,
+  });
+  return { ${exports} };
+});
+`,
+    stubFetch: false,
+    name: `a fake ${site.client} client`
+  };
+}
+function preamble(p) {
+  return `import { afterEach, describe, expect, it, vi } from "vitest";
+
+type ShapiRequest = { method: string; url: string; headers: Record<string, string> };
+type ShapiResponse = { status: number; body: unknown; headers: Record<string, string> };
+const shapi = vi.hoisted(() => ({
+  respond: (_req: { method: string; url: string; headers: Record<string, string> }): { status: number; body: unknown; headers: Record<string, string> } => ({ status: 200, body: null, headers: {} }),
+  lower: (h: unknown): Record<string, string> =>
+    Object.fromEntries(Object.entries((h ?? {}) as Record<string, unknown>).filter(([, v]) => v !== undefined).map(([k, v]) => [k.toLowerCase(), String(v)])),
+}));
+${p.transport.mock}
+import { ${p.fn} } from "${p.importPath}";
+${p.transport.stubFetch ? `
+const shapiFetch = vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+  const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+  const headers = Object.fromEntries(new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined)).entries());
+  const res = shapi.respond({ method: (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase(), url, headers });
+  return new Response(res.body === null ? null : JSON.stringify(res.body), { status: res.status, headers: res.headers });
+});
+` : ""}
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
 
+async function run(respond: (req: ShapiRequest) => ShapiResponse): Promise<unknown> {
+  shapi.respond = respond;${p.transport.stubFetch ? `
+  vi.stubGlobal("fetch", shapiFetch);` : ""}
+  return ${p.fn}(${p.args});
+}
+`;
+}
+var JSON_HEADERS = `{ "content-type": "application/json" }`;
+function requestTest(p) {
+  const checks = [];
+  if (p.fix.path) checks.push(`url.href.includes(${JSON.stringify(p.fix.path.from)})`);
+  if (p.fix.query) {
+    const name = JSON.stringify(p.fix.query.name);
+    const below = p.advisory.trigger.query?.find((q) => q.name === p.fix.query.name)?.below;
+    checks.push(
+      below === void 0 ? `(url.searchParams.has(${name}) && url.searchParams.get(${name}) !== ${JSON.stringify(p.fix.query.value)})` : `(url.searchParams.has(${name}) && Number(url.searchParams.get(${name})) < ${below})`
+    );
+  }
+  if (p.fix.header) {
+    const name = JSON.stringify(p.fix.header.name.toLowerCase());
+    checks.push(`(${name} in req.headers && req.headers[${name}] !== ${JSON.stringify(p.fix.header.value)})`);
+  }
+  return `${p.header}
+// The provider no longer accepts the old request: ${p.transport.name} is replaced by a stub that answers it
+// with ${RETIRED_STATUS}, and answers anything else with a body holding the fields the code reads. The test
+// fails until ${p.fn}() sends the new request (${describeFix(p.fix)}) and still works.
+${preamble(p)}
+const body = ${JSON.stringify(p.body)};
+
+function retired(req: ShapiRequest): boolean {
+  const url = new URL(req.url, "https://shapi.invalid");
+  return ${checks.join(" || ")};
+}
+
+describe("SHAPI contract: ${p.advisory.id}", () => {
+  it("${p.fn} sends the new request and handles the response", async () => {
+    const sent: boolean[] = [];
+    await run((req) => {
+      const old = retired(req);
+      sent.push(old);
+      return old ? { status: ${RETIRED_STATUS}, body: { error: "retired request (SHAPI contract test)" }, headers: ${JSON_HEADERS} } : { status: 200, body, headers: ${JSON_HEADERS} };
+    });
+    expect(sent.length).toBeGreaterThan(0);
+    expect(sent).not.toContain(true);
+  });
+});
+`;
+}
+function sameResultTest(p) {
+  return `${p.header}
+// The provider renamed fields or enum values. This test calls ${p.fn}() once with the old response and
+// once with the new one (${p.transport.name} replaced by a stub), and expects the same result: it fails
+// while the code only reads the old names.
+${preamble(p)}
 const responses = [
-${responses},
+  { name: "old", body: ${JSON.stringify(p.before)} },
+  { name: "new", body: ${JSON.stringify(p.after)} },
 ];
 
-describe("SHAPI contract: ${advisory.id}", () => {
-  afterEach(() => {
-    vi.unstubAllGlobals();
+describe("SHAPI contract: ${p.advisory.id}", () => {
+  it("${p.fn} returns the same result for the old and the new response", async () => {
+    const results: unknown[] = [];
+    for (const r of responses) results.push(await run(() => ({ status: 200, body: r.body, headers: ${JSON_HEADERS} })));
+    expect(results[1]).toEqual(results[0]);
   });
+});
+`;
+}
+function recordedTest(p) {
+  const responses = [response(`before (${p.before.status})`, p.before), response(`after (${p.after.status})`, p.after)].join(",\n");
+  return `${p.header}
+// Calls ${p.fn}() with ${p.transport.name} returning the response the code was written for and the one
+// ${p.advisory.provider} sends now. It fails while the code accepts only the old response.
+${preamble(p)}
+const responses = [
+${responses},
+];
 
+describe("SHAPI contract: ${p.advisory.id}", () => {
   for (const r of responses) {
-    it(\`${fn.name} handles the \${r.name} response\`, async () => {
-      const fetchMock = vi.fn(async () => new Response(r.body === null ? null : JSON.stringify(r.body), { status: r.status, headers: r.headers }));
-      vi.stubGlobal("fetch", fetchMock);
-      await ${fn.name}(${args});
-      expect(fetchMock).toHaveBeenCalled();
+    it(\`${p.fn} handles the \${r.name} response\`, async () => {
+      const seen: ShapiRequest[] = [];
+      await run((req) => (seen.push(req), { status: r.status, body: r.body, headers: r.headers }));
+      expect(seen.length).toBeGreaterThan(0);
     });
   }
 });
 `;
-  return { status: "generated", file, content, functionName: fn.name };
 }
+function renamePair(site, fix2) {
+  const paths = site.surface.fields;
+  const rename = (p) => {
+    for (const { from, to } of fix2.fields ?? []) {
+      if (!/[.[]/.test(from)) {
+        const segs = p.split(".");
+        const i = segs.findIndex((seg) => seg.replace(/\[\]/g, "") === from);
+        if (i >= 0) return [...segs.slice(0, i), segs[i].replace(from, to), ...segs.slice(i + 1)].join(".");
+      } else if (p === from || p.startsWith(`${from}.`) || p.startsWith(`${from}[]`)) return to + p.slice(from.length);
+    }
+    return p;
+  };
+  const oldValues = {};
+  const newValues = {};
+  for (const { field, values } of fix2.enums ?? []) {
+    const compared = site.surface.enums.find((e) => e.field === field)?.values ?? [];
+    const pick = values.find((v) => compared.includes(v.from)) ?? values[0];
+    oldValues[field] = pick.from;
+    newValues[rename(field)] = pick.to;
+  }
+  return { before: bodyFromPaths(paths, oldValues), after: bodyFromPaths(paths.map(rename), newValues) };
+}
+function describeFix(fix2) {
+  const parts = [];
+  if (fix2.path) parts.push(`${fix2.path.to} instead of ${fix2.path.from}`);
+  if (fix2.query) parts.push(`${fix2.query.name}=${fix2.query.value}`);
+  if (fix2.header) parts.push(`${fix2.header.name}: ${fix2.header.value}`);
+  return parts.join(", ");
+}
+var AXIOS_FAKE = `vi.mock("axios", () => {
+  class AxiosError extends Error {
+    isAxiosError = true;
+    constructor(message: string, readonly response?: unknown, readonly status?: number) {
+      super(message);
+    }
+  }
+  const build = (defaults: any = {}): any => {
+    const send = async (config: any) => {
+      const c = { ...defaults, ...config, headers: { ...defaults.headers, ...config.headers }, params: { ...defaults.params, ...config.params } };
+      let url = String(c.url ?? "");
+      if (c.baseURL && !/^[a-z]+:\\/\\//i.test(url)) url = String(c.baseURL).replace(/\\/+$/, "") + "/" + url.replace(/^\\/+/, "");
+      const qs = new URLSearchParams(Object.entries(c.params).filter(([, v]) => v !== undefined && v !== null).map(([k, v]) => [k, String(v)])).toString();
+      if (qs) url += (url.includes("?") ? "&" : "?") + qs;
+      const res = shapi.respond({ method: String(c.method ?? "get").toUpperCase(), url, headers: shapi.lower(c.headers) });
+      const response = { status: res.status, statusText: "", headers: res.headers, data: res.body, config: c };
+      if (res.status < 200 || res.status >= 300) throw new AxiosError(\`Request failed with status code \${res.status}\`, response, res.status);
+      return response;
+    };
+    const instance: any = (a: any, b?: any) => send(typeof a === "string" ? { ...b, url: a } : a);
+    instance.request = (c: any) => send(c);
+    for (const m of ["get", "delete", "head", "options"]) instance[m] = (url: string, c: any = {}) => send({ ...c, url, method: m });
+    for (const m of ["post", "put", "patch"]) instance[m] = (url: string, data: unknown, c: any = {}) => send({ ...c, url, data, method: m });
+    instance.create = (d: any = {}) => build({ ...defaults, ...d, headers: { ...defaults.headers, ...d.headers } });
+    instance.defaults = defaults;
+    instance.interceptors = { request: { use: () => 0, eject: () => {} }, response: { use: () => 0, eject: () => {} } };
+    instance.isAxiosError = (e: any) => Boolean(e?.isAxiosError);
+    return instance;
+  };
+  const axios = build();
+  return { default: axios, create: axios.create, isAxiosError: axios.isAxiosError, AxiosError };
+});
+`;
+var GOT_FAKE = `vi.mock("got", () => {
+  class HTTPError extends Error {
+    constructor(readonly response: any) {
+      super(\`Response code \${response.statusCode}\`);
+    }
+  }
+  const build = (defaults: any = {}): any => {
+    const call = (input: any, options: any = {}) => {
+      const fromObject = typeof input === "object" && !(input instanceof URL);
+      const o = { ...defaults, ...(fromObject ? input : options), headers: { ...defaults.headers, ...(fromObject ? input.headers : options.headers) } };
+      let url = fromObject ? String(o.url ?? "") : String(input);
+      if (o.prefixUrl) url = String(o.prefixUrl).replace(/\\/+$/, "") + "/" + url.replace(/^\\/+/, "");
+      const sp = o.searchParams;
+      const qs = sp ? new URLSearchParams(typeof sp === "string" || sp instanceof URLSearchParams ? sp : Object.entries(sp).map(([k, v]) => [k, String(v)])).toString() : "";
+      if (qs) url += (url.includes("?") ? "&" : "?") + qs;
+      const res = shapi.respond({ method: String(o.method ?? "GET").toUpperCase(), url, headers: shapi.lower(o.headers) });
+      const text = res.body === null ? "" : JSON.stringify(res.body);
+      const response = { statusCode: res.status, headers: res.headers, body: o.responseType === "json" ? res.body : text, url };
+      const failed = (o.throwHttpErrors ?? true) && res.status >= 400;
+      const settle = <T,>(value: T): Promise<T> => (failed ? Promise.reject(new HTTPError(response)) : Promise.resolve(value));
+      const promise: any = settle(response);
+      promise.catch(() => {});
+      promise.json = () => settle(res.body);
+      promise.text = () => settle(text);
+      promise.buffer = () => settle(Buffer.from(text));
+      return promise;
+    };
+    const got: any = (input: any, options?: any) => call(input, options);
+    for (const m of ["get", "post", "put", "patch", "delete", "head"]) got[m] = (input: any, options: any = {}) => call(input, { ...options, method: m.toUpperCase() });
+    got.extend = (...opts: any[]) => build(Object.assign({}, defaults, ...opts));
+    return got;
+  };
+  return { default: build(), HTTPError };
+});
+`;
 function response(name, shape) {
-  const body2 = synthesizeBody(shape);
+  const body3 = synthesizeBody(shape);
   const headers = shape.headers["content-type"] ? { "content-type": shape.headers["content-type"] } : {};
-  return `  { name: ${JSON.stringify(name)}, status: ${shape.status}, headers: ${JSON.stringify(headers)}, body: ${JSON.stringify(body2)} }`;
+  return `  { name: ${JSON.stringify(name)}, status: ${shape.status}, headers: ${JSON.stringify(headers)}, body: ${JSON.stringify(body3)} }`;
 }
 function exportedFunction(call) {
   for (const anc of call.getAncestors()) {
-    if (Node4.isFunctionDeclaration(anc) && anc.isExported() && anc.getName()) return { name: anc.getName(), params: anc.getParameters() };
-    if (Node4.isArrowFunction(anc) || Node4.isFunctionExpression(anc)) {
+    if (Node5.isFunctionDeclaration(anc) && anc.isExported() && anc.getName()) return { name: anc.getName(), params: anc.getParameters() };
+    if (Node5.isArrowFunction(anc) || Node5.isFunctionExpression(anc)) {
       const decl = anc.getParent();
-      if (Node4.isVariableDeclaration(decl) && decl.getVariableStatement()?.isExported()) return { name: decl.getName(), params: anc.getParameters() };
+      if (Node5.isVariableDeclaration(decl) && decl.getVariableStatement()?.isExported()) return { name: decl.getName(), params: anc.getParameters() };
     }
   }
   return void 0;
@@ -2207,22 +3493,22 @@ function argument(p, sf) {
 function valueFor(type, name, sf, depth) {
   if (depth > 4) return "undefined as never";
   switch (type.getKind()) {
-    case SyntaxKind5.StringKeyword:
+    case SyntaxKind6.StringKeyword:
       return JSON.stringify(`shapi-${name}`);
-    case SyntaxKind5.NumberKeyword:
+    case SyntaxKind6.NumberKeyword:
       return "1";
-    case SyntaxKind5.BooleanKeyword:
+    case SyntaxKind6.BooleanKeyword:
       return "true";
   }
-  if (Node4.isTypeLiteral(type)) return objectFrom(type.getProperties(), sf, depth);
-  if (Node4.isTypeReference(type)) {
+  if (Node5.isTypeLiteral(type)) return objectFrom(type.getProperties(), sf, depth);
+  if (Node5.isTypeReference(type)) {
     const ref = type.getTypeName().getText();
     const iface = sf.getInterface(ref);
     if (iface) return objectFrom(iface.getProperties(), sf, depth);
     const alias = sf.getTypeAlias(ref)?.getTypeNode();
     if (alias) return valueFor(alias, name, sf, depth + 1);
   }
-  if (Node4.isArrayTypeNode(type)) return "[]";
+  if (Node5.isArrayTypeNode(type)) return "[]";
   return "undefined as never";
 }
 function objectFrom(props, sf, depth) {
@@ -2242,13 +3528,13 @@ import path10 from "path";
 
 // packages/repair/src/runner.ts
 import { spawnSync } from "child_process";
-import { existsSync } from "fs";
-import { createRequire } from "module";
+import { existsSync as existsSync2 } from "fs";
+import { createRequire as createRequire2 } from "module";
 import path8 from "path";
 function vitestCli(dir) {
   const local = path8.join(dir, "node_modules", "vitest", "vitest.mjs");
-  if (existsSync(local)) return local;
-  const require2 = createRequire(import.meta.url);
+  if (existsSync2(local)) return local;
+  const require2 = createRequire2(import.meta.url);
   return path8.join(path8.dirname(require2.resolve("vitest/package.json")), "vitest.mjs");
 }
 function runTestFile(dir, file, timeoutMs = 12e4) {
@@ -2272,7 +3558,7 @@ function runFailure(output) {
 }
 
 // packages/repair/src/workspace.ts
-import { cpSync, existsSync as existsSync2, mkdirSync as mkdirSync4, mkdtempSync, readFileSync as readFileSync5, symlinkSync, writeFileSync as writeFileSync3 } from "fs";
+import { cpSync, existsSync as existsSync3, mkdirSync as mkdirSync4, mkdtempSync, readFileSync as readFileSync5, symlinkSync, writeFileSync as writeFileSync3 } from "fs";
 import os from "os";
 import path9 from "path";
 var COPY_SKIP = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "coverage", ".shapi"]);
@@ -2283,12 +3569,12 @@ function localWorkspace(repoDir) {
     filter: (src) => !COPY_SKIP.has(path9.basename(src)) || path9.resolve(src) === path9.resolve(repoDir)
   });
   const modules = path9.join(repoDir, "node_modules");
-  if (existsSync2(modules)) symlinkSync(modules, path9.join(dir, "node_modules"), "junction");
+  if (existsSync3(modules)) symlinkSync(modules, path9.join(dir, "node_modules"), "junction");
   return {
     location: dir,
     async read(file) {
       const abs = path9.join(dir, file);
-      return existsSync2(abs) ? readFileSync5(abs, "utf8") : void 0;
+      return existsSync3(abs) ? readFileSync5(abs, "utf8") : void 0;
     },
     async write(file, content) {
       const abs = path9.join(dir, file);
@@ -2306,10 +3592,13 @@ var PROTECTED = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "covera
 async function repairCallSite(input) {
   const { advisory, callSite } = input;
   if (!input.workspace && !input.repoDir) throw new Error("repairCallSite needs a workspace or a repoDir");
+  if (!/\.(c|m)?[jt]sx?$/.test(callSite.file)) {
+    return { status: "unsupported", changes: [], attempts: [], reason: `fixes support TypeScript and JavaScript; ${callSite.file} is scanned only` };
+  }
   const ws = input.workspace ?? localWorkspace(input.repoDir);
   const original = await ws.read(callSite.file);
   if (original === void 0) return { status: "unsupported", sandbox: ws.location, changes: [], attempts: [], reason: `${callSite.file} is not in the repository` };
-  const test = generateContractTest({ callSite, advisory, before: input.before, after: input.after, sourceText: original });
+  const test = generateContractTest({ callSite, advisory, before: input.before, after: input.after, sourceText: original, file: input.testFile });
   if (test.status !== "generated") return { status: "unsupported", changes: [], attempts: [], reason: test.reason };
   await ws.write(test.file, test.content);
   const testChange = { file: test.file, before: "", after: test.content, notes: ["generated contract test"] };
@@ -2398,6 +3687,42 @@ function rejected(ws, test, baseline, attempts) {
 async function restore(ws, changes) {
   for (const c of changes) await ws.write(c.file, c.before);
 }
+async function repairAdvisory(input) {
+  if (!input.workspace && !input.repoDir) throw new Error("repairAdvisory needs a workspace or a repoDir");
+  const ws = input.workspace ?? localWorkspace(input.repoDir);
+  const seen = /* @__PURE__ */ new Set();
+  const order = input.callSites.filter((s) => {
+    const key = `${s.file}:${s.line}:${s.column}`;
+    return !seen.has(key) && Boolean(seen.add(key));
+  }).sort((a, b) => a.file.localeCompare(b.file) || b.line - a.line || b.column - a.column);
+  const originals = /* @__PURE__ */ new Map();
+  const sites = [];
+  for (const [i, callSite] of order.entries()) {
+    if (!originals.has(callSite.file)) originals.set(callSite.file, await ws.read(callSite.file) ?? "");
+    const testFile = `test/shapi/${input.advisory.id}${i === 0 ? "" : `.${i + 1}`}.test.ts`;
+    const result = await repairCallSite({ ...input, workspace: ws, callSite, testFile });
+    for (const c of result.changes) if (c.before && !originals.has(c.file)) originals.set(c.file, c.before);
+    sites.push({ callSite, result });
+  }
+  const fixed = sites.filter((s) => s.result.status === "fixed");
+  const needed = sites.filter((s) => s.result.status !== "already-handled");
+  const tests = new Set(fixed.map((s) => s.result.test?.file));
+  const sourceFiles = [...new Set(fixed.flatMap((s) => s.result.changes.filter((c) => !tests.has(c.file)).map((c) => c.file)))].sort();
+  const changes = [];
+  for (const file of sourceFiles) {
+    const notes = fixed.flatMap((s) => s.result.changes.filter((c) => c.file === file).flatMap((c) => c.notes));
+    changes.push({ file, before: originals.get(file) ?? "", after: await ws.read(file) ?? "", notes });
+  }
+  for (const s of fixed) if (s.result.test) changes.push({ file: s.result.test.file, before: "", after: s.result.test.content, notes: ["generated contract test"] });
+  const methods = new Set(fixed.map((s) => s.result.method));
+  return {
+    status: fixed.length === 0 ? "none" : fixed.length === needed.length ? "fixed" : "partial",
+    sites,
+    changes,
+    ...fixed.length ? { method: methods.has("llm") ? "llm" : "recipe" } : {},
+    sandbox: ws.location
+  };
+}
 
 // packages/repair/src/llm.ts
 import Anthropic from "@anthropic-ai/sdk";
@@ -2510,7 +3835,8 @@ ${req.failingOutput.slice(-6e3)}
 
 // packages/repair/src/index.ts
 var RECIPES = {
-  [statusCodeAcceptSet.id]: statusCodeAcceptSet
+  [statusCodeAcceptSet.id]: statusCodeAcceptSet,
+  [applyFix.id]: applyFix
 };
 
 // packages/github-app/src/pr.ts
@@ -2651,29 +3977,31 @@ function prTitle(advisory) {
 function prBranch(advisory) {
   return `shapi/${advisory.id}`;
 }
-function renderPrBody({ advisory, callSite, result, affectedInRepo, shapeSource }) {
-  const source = result.changes.filter((c) => c.file !== result.test?.file);
-  const notes = source.flatMap((c) => c.notes.map((n) => `- ${n}`));
-  const method = result.method === "recipe" ? `deterministic recipe \`${advisory.recipeId}\`` : "Claude, verified by the contract test";
+function renderPrBody({ advisory, repair, shapeSource }) {
+  const fixed = repair.sites.filter((s) => s.result.status === "fixed");
+  const tests = new Set(fixed.map((s) => s.result.test?.file));
+  const notes = repair.changes.filter((c) => !tests.has(c.file)).flatMap((c) => (c.notes.length ? c.notes : [`\`${c.file}\``]).map((n) => `- ${n}`));
+  const method = repair.method === "llm" ? "Claude, verified by the contract tests" : `deterministic recipe \`${advisory.recipeId}\``;
   const evidence = advisory.evidence;
+  const where = (s) => `\`${s.callSite.file}:${s.callSite.line}\` (${s.callSite.method} ${s.callSite.endpoint})`;
+  const siteLine = (s) => s.result.status === "fixed" ? `- [x] ${where(s)}: fixed, test \`${s.result.test?.file}\`` : s.result.status === "already-handled" ? `- [x] ${where(s)}: already handles the change` : `- [ ] ${where(s)}: not fixed here (${s.result.reason ?? s.result.status}); needs a manual change`;
   const lines = [
     `**${advisory.provider}** changed \`${advisory.endpoint.method} ${advisory.endpoint.path}\`: ${advisory.title}.`,
     "",
     advisory.summary,
     "",
-    "### Affected call site",
-    `\`${callSite.file}:${callSite.line}\` (${callSite.method} ${callSite.endpoint})`,
+    `### Affected call sites (${fixed.length} of ${repair.sites.length} fixed here)`,
+    ...repair.sites.map(siteLine),
     "",
     `### Change (${method})`,
-    ...notes.length ? notes : source.map((c) => `- \`${c.file}\``),
+    ...notes,
     "",
-    "### Contract test",
-    `Added \`${result.test?.file}\`. It calls the code with the response it was written for and the response ${advisory.provider} sends now.`,
+    `### Contract test${fixed.length === 1 ? "" : "s"}`,
+    "Each test calls the code with the response it was written for and the one the provider sends now. Each failed before this change and passes after it.",
     "",
-    "| Run | Result |",
-    "|---|---|",
-    `| Before this change | ${summary(result.baseline)} |`,
-    `| After this change | ${summary(result.attempts.find((a) => a.outcome === "passed")?.run)} |`,
+    "| Test | Before this change | After this change |",
+    "|---|---|---|",
+    ...fixed.map((s) => `| \`${s.result.test?.file}\` | ${summary(s.result.baseline)} | ${summary(s.result.attempts.find((a) => a.outcome === "passed")?.run)} |`),
     "",
     "### Evidence",
     "| | |",
@@ -2685,13 +4013,13 @@ function renderPrBody({ advisory, callSite, result, affectedInRepo, shapeSource
     `| Provider notice | ${advisory.publishedNotice ? `[${advisory.publishedNotice.date ?? "link"}](${advisory.publishedNotice.url})` : "none (undocumented change)"} |`,
     `| Shapes from | ${shapeSource} |`,
     ...evidence ? [`| Observed | ${evidence.before.status} at ${evidence.before.observedAt} \u2192 ${evidence.after.status} at ${evidence.after.observedAt} (${evidence.source}) |`] : [],
-    `| Blast radius | ${affectedInRepo} affected call site${affectedInRepo === 1 ? "" : "s"} in this repo |`,
+    `| Blast radius | ${repair.sites.length} affected call site${repair.sites.length === 1 ? "" : "s"} in this repo |`,
     `| Sources | ${advisory.sources.map((s, i) => `[${i + 1}](${s})`).join(" ")} |`,
     "",
     `Migration note: ${advisory.migrationNote}`,
     "",
     "---",
-    "Opened by [SHAPI](https://github.com/SriVarshini09/YC). The change was kept only because the contract test failed before it and passes after it."
+    "Opened by [SHAPI](https://shapi.dev). A change is kept only when its contract test failed before it and passes after it."
   ];
   return lines.join("\n") + "\n";
 }
@@ -2712,7 +4040,7 @@ import { Octokit as Octokit2 } from "@octokit/rest";
 var ResilientOctokit = Octokit2.plugin(throttling, retry);
 
 // packages/github-app/src/snapshot.ts
-import { Parser } from "tar";
+import { Parser as Parser2 } from "tar";
 
 // packages/cli/src/scan.ts
 import { execFileSync as execFileSync2 } from "child_process";
@@ -2721,16 +4049,19 @@ import os2 from "os";
 import path11 from "path";
 
 // packages/cli/src/paths.ts
-import { existsSync as existsSync3 } from "fs";
-import { fileURLToPath } from "url";
+import { existsSync as existsSync4 } from "fs";
+import { fileURLToPath as fileURLToPath2 } from "url";
 function bundledDir(published, monorepo) {
-  const candidates = [new URL(`../${published}`, import.meta.url), new URL(`../../../${monorepo}`, import.meta.url)].map((u) => fileURLToPath(u));
-  return candidates.find((p) => existsSync3(p)) ?? candidates[candidates.length - 1];
+  const candidates = [new URL(`../${published}`, import.meta.url), new URL(`../../../${monorepo}`, import.meta.url)].map((u) => fileURLToPath2(u));
+  return candidates.find((p) => existsSync4(p)) ?? candidates[candidates.length - 1];
 }
 
 // packages/cli/src/scan.ts
-var VERSION = "0.1.0";
+var VERSION = "0.3.0";
 var DEFAULT_ADVISORIES = bundledDir("advisories", "advisories");
+async function preparePython() {
+  await loadPythonParser().catch(() => void 0);
+}
 function scan(target, opts) {
   const started = performance.now();
   const failOn = parseFailOn(opts.failOn ?? "critical");
@@ -2753,9 +4084,12 @@ function scan(target, opts) {
     const advisories = loadAdvisories(opts.advisories ?? DEFAULT_ADVISORIES);
     const match = matchAdvisories(lock, advisories, { now });
     const failing = failOn === "none" ? [] : match.affected.filter((f) => SEVERITY_RANK[f.advisory.severity] <= SEVERITY_RANK[failOn]);
+    const where = opts.repo ? `--repo ${opts.repo}` : label2;
     return {
       label: label2,
+      fixTarget: /\s/.test(where) ? JSON.stringify(where) : where,
       filesScanned: extracted.filesScanned,
+      skipped: extracted.skipped,
       lock,
       match,
       elapsedMs: Math.round(performance.now() - started),
@@ -2787,6 +4121,7 @@ function toJsonReport(o) {
     filesScanned: o.filesScanned,
     affected: o.match.affected.map(finding),
     exposed: o.match.exposed.map(finding),
+    possible: o.match.possible.map(finding),
     upcoming: o.match.upcoming.map((u) => ({
       advisory: u.advisory.id,
       provider: u.advisory.provider,
@@ -2822,24 +4157,31 @@ async function fix(target, opts, deps) {
     if (affected.length === 0) deps.log("No affected call sites: nothing to fix.");
     const llm = opts.llm ? claudeFixer() : void 0;
     const outcomes = [];
-    for (const finding of affected) {
-      const { advisory, callSite } = finding;
-      const where = `${callSite.file}:${callSite.line}`;
-      const shapes = findShapes(advisory, opts);
+    const byAdvisory = /* @__PURE__ */ new Map();
+    for (const f of affected) byAdvisory.set(f.advisory.id, [...byAdvisory.get(f.advisory.id) ?? [], f]);
+    for (const findings of byAdvisory.values()) {
+      const advisory = findings[0].advisory;
+      const shapes = advisory.fix ? { source: FIX_SOURCE } : findShapes(advisory, opts);
       if (!shapes) {
         const skipped = "no before/after shapes for this endpoint (record them with the canary, or add a recording)";
-        deps.log(`SKIP  ${where}  ${advisory.id}: ${skipped}`);
-        outcomes.push({ finding, skipped });
+        for (const finding of findings) {
+          deps.log(`SKIP  ${finding.callSite.file}:${finding.callSite.line}  ${advisory.id}: ${skipped}`);
+          outcomes.push({ finding, skipped });
+        }
         continue;
       }
-      const result = await repairCallSite({ repoDir: dir, advisory, callSite, before: shapes.before, after: shapes.after, recipes: RECIPES, llm });
-      const outcome = { finding, shapeSource: shapes.source, result };
-      outcomes.push(outcome);
-      deps.log(`${result.status.toUpperCase().padEnd(15)} ${where}  ${advisory.id}${result.method ? `  via ${result.method}` : ""}${result.reason ? `: ${result.reason}` : ""}`);
-      for (const a of result.attempts) deps.log(`    ${a.method}: ${a.outcome} (${a.detail})`);
-      if (result.status !== "fixed") continue;
-      for (const c of result.changes) deps.log(`    ${c.before ? "M" : "A"} ${c.file}`);
-      const files = result.changes.map((c) => ({ path: c.file, content: c.after }));
+      const repair = await repairAdvisory({ workspace: localWorkspace(dir), advisory, callSites: findings.map((f) => f.callSite), before: shapes.before, after: shapes.after, recipes: RECIPES, llm });
+      const mine = [];
+      for (const { callSite, result } of repair.sites) {
+        const finding = findings.find((f) => f.callSite.file === callSite.file && f.callSite.line === callSite.line && f.callSite.column === callSite.column);
+        mine.push({ finding, shapeSource: shapes.source, result });
+        deps.log(`${result.status.toUpperCase().padEnd(15)} ${callSite.file}:${callSite.line}  ${advisory.id}${result.method ? `  via ${result.method}` : ""}${result.reason ? `: ${result.reason}` : ""}`);
+        for (const a of result.attempts) deps.log(`    ${a.method}: ${a.outcome} (${a.detail})`);
+      }
+      outcomes.push(...mine);
+      if (!repair.changes.length) continue;
+      for (const c of repair.changes) deps.log(`    ${c.before ? "M" : "A"} ${c.file}`);
+      const files = repair.changes.map((c) => ({ path: c.file, content: c.after }));
       if (opts.write) {
         for (const f of files) {
           mkdirSync5(path12.dirname(path12.join(dir, f.path)), { recursive: true });
@@ -2848,22 +4190,18 @@ async function fix(target, opts, deps) {
         deps.log(`    wrote ${files.length} files into ${dir}`);
       }
       if (opts.pr && remote) {
+        const fixed = repair.sites.filter((s) => s.result.status === "fixed");
         const meta = {
           title: prTitle(advisory),
           branch: prBranch(advisory),
           commitMessage: `fix: ${advisory.title}
 
-Advisory ${advisory.id}. Contract test ${result.test?.file} fails before this change and passes after.`,
-          body: renderPrBody({
-            advisory,
-            callSite,
-            result,
-            affectedInRepo: affected.filter((f) => f.advisory.id === advisory.id).length,
-            shapeSource: shapes.source
-          })
+Advisory ${advisory.id}, ${fixed.length} of ${repair.sites.length} call sites. Contract tests ${fixed.map((s) => s.result.test?.file).join(", ")} fail before this change and pass after.`,
+          body: renderPrBody({ advisory, repair, shapeSource: shapes.source })
         };
-        outcome.pr = await (deps.deliver ?? deliverToGitHub)(remote, files, meta);
-        deps.log(`    pull request: ${outcome.pr.url}`);
+        const pr = await (deps.deliver ?? deliverToGitHub)(remote, files, meta);
+        for (const o of mine) if (o.result?.status === "fixed") o.pr = pr;
+        deps.log(`    pull request: ${pr.url}`);
       }
     }
     return outcomes;
@@ -2878,8 +4216,9 @@ async function deliverToGitHub(repo, files, meta) {
   if (outcome.action === "skipped") throw new Error(`not delivered: ${outcome.reason}${outcome.url ? ` (${outcome.url})` : ""}`);
   return { url: outcome.url, number: outcome.number, branch: outcome.branch, commit: outcome.commit };
 }
+var FIX_SOURCE = "built from the advisory's fix and the fields the code reads";
 function findShapes(advisory, opts) {
-  if (opts.db && existsSync4(opts.db)) {
+  if (opts.db && existsSync5(opts.db)) {
     const store = ShapeStore.open(opts.db);
     try {
       for (const e of store.endpoints()) {
@@ -2894,7 +4233,7 @@ function findShapes(advisory, opts) {
     }
   }
   const dir = opts.recordings ?? DEFAULT_RECORDINGS;
-  if (!existsSync4(dir)) return void 0;
+  if (!existsSync5(dir)) return void 0;
   for (const name of readdirSync3(dir).filter((f) => f.endsWith(".json")).sort()) {
     const recording = loadRecording(path12.join(dir, name));
     if (recording.provider !== advisory.provider || !pathMatches(recording.endpoint, advisory.endpoint)) continue;
@@ -2916,19 +4255,26 @@ function originRepo(dir) {
 
 // packages/cli/src/report.ts
 import { styleText } from "util";
+var APP_URL = "https://app.shapi.dev";
+function title(color) {
+  const paint = (style, s) => color ? styleText(style, s) : s;
+  return `${paint("bold", "SHAPI")}  ${paint("dim", "third-party API changes, caught and fixed")}`;
+}
 function renderText(o, color) {
   const paint = (style, s) => color ? styleText(style, s) : s;
   const out = [];
   const { lock, match } = o;
   const providers = lock.providers;
   const unresolved = lock.callSites.filter((c) => !c.resolved).length;
-  out.push(`${paint("bold", "SHAPI scan")}  ${o.label}`);
+  out.push(title(color));
+  out.push(`${paint("bold", "scan")}  ${o.label}`);
   out.push(
     paint(
       "dim",
       [plural(o.filesScanned, "file"), plural(lock.callSites.length, "call site"), plural(providers.length, "provider"), `${o.elapsedMs} ms`].join(" \xB7 ")
     )
   );
+  if (o.skipped.length) out.push(paint("dim", `${plural(o.skipped.length, "file")} not scanned: ${[...new Set(o.skipped.map((s) => s.reason))].join("; ")}`));
   out.push("");
   out.push(paint("bold", "Providers"));
   if (providers.length === 0) out.push("  none found");
@@ -2942,6 +4288,11 @@ function renderText(o, color) {
   if (match.affected.length === 0) out.push("  none");
   for (const f of match.affected) out.push(...renderFinding(f, paint));
   out.push("");
+  if (match.possible.length > 0) {
+    out.push(paint("bold", `Possibly affected, check these (${match.possible.length})`));
+    for (const f of match.possible) out.push(...renderFinding(f, paint));
+    out.push("");
+  }
   if (match.exposed.length > 0) {
     out.push(paint("bold", `Exposed, not affected (${match.exposed.length})`));
     for (const f of match.exposed) {
@@ -2959,6 +4310,10 @@ function renderText(o, color) {
     out.push("");
     out.push(paint("dim", `${plural(unresolved, "call site")} could not be fully resolved (see --json or --out api.lock).`));
   }
+  out.push("");
+  out.push(paint("bold", "Next"));
+  if (match.affected.length > 0) out.push(`  npx shapi-cli fix ${o.fixTarget}  ${paint("dim", "fix the affected call sites test-first (nothing changes until you add --write or --pr)")}`);
+  out.push(`  ${APP_URL}  ${paint("dim", "install the GitHub App: every push scanned, verified fix PRs, and a dashboard")}`);
   return out.join("\n") + "\n";
 }
 var SEVERITY_STYLE = { critical: "red", high: "yellow", medium: "cyan", low: "gray" };
@@ -2988,7 +4343,12 @@ var processIo = {
 };
 async function run(argv, io = processIo, fixDeps = {}) {
   let exitCode = 0;
-  const program = new Command2().name("shapi").description("Map the third-party APIs a codebase depends on and flag the breaking changes that hit it.").version(VERSION).exitOverride().configureOutput({ writeOut: io.stdout, writeErr: io.stderr });
+  await preparePython();
+  const program = new Command2().name("shapi").description("Map the third-party APIs a codebase depends on and flag the breaking changes that hit it.").version(VERSION).addHelpText("beforeAll", `${title(Boolean(io.isTTY))}
+`).addHelpText("afterAll", `
+Run it without installing: npx shapi-cli scan .
+Fix PRs and a dashboard on every push: install the GitHub App at ${APP_URL}
+`).exitOverride().configureOutput({ writeOut: io.stdout, writeErr: io.stderr });
   program.command("scan").description("Scan a repository and report affected call sites").argument("[path]", "directory to scan", ".").option("--json", "print a JSON report (includes the api.lock)").option("--out <file>", "write the api.lock to this file").option("--repo <url>", "clone a git repository (shallow) into a temp dir and scan it").option("--advisories <dir>", "advisory directory (default: the bundled advisories/)").option("--fail-on <severity>", "exit 1 when an affected call site is at least this severe (critical|high|medium|low|none)", "critical").option("--no-color", "disable color").addOption(new Option("--now <date>", "evaluate deadlines as of this date").hideHelp()).action((target, opts) => {
     const outcome = scan(opts.repo ? void 0 : target, opts);
     if (opts.json) io.stdout(JSON.stringify(toJsonReport(outcome), null, 2) + "\n");
@@ -2996,8 +4356,13 @@ async function run(argv, io = processIo, fixDeps = {}) {
     exitCode = outcome.exitCode;
   });
   program.command("fix").description("Repair affected call sites test-first: generate a contract test, apply the recipe (or Claude), keep the change only if the test passes").argument("[path]", "repository to fix", ".").option("--repo <url>", "clone a GitHub repository (shallow) and fix it; with --pr the PR goes to that repository").option("--advisory <id>", "only this advisory").option("--advisories <dir>", "advisory directory (default: the bundled advisories/)").option("--db <file>", "shape store with canary observations (checked before recordings)", ".shapi/shapes.db").option("--recordings <dir>", "recorded response sequences (default: the bundled fixtures/recordings/)").option("--llm", "ask Claude when no recipe fixes the call site (needs ANTHROPIC_API_KEY)").option("--write", "write the fix and the contract test into the local repository").option("--pr", "open a pull request with the fix and the contract test").addOption(new Option("--now <date>", "evaluate deadlines as of this date").hideHelp()).action(async (target, opts) => {
+    io.stdout(`${title(Boolean(io.isTTY))}
+`);
     const outcomes = await fix(opts.repo ? void 0 : target, opts, { log: (l) => io.stdout(`${l}
 `), ...fixDeps });
+    if (outcomes.some((o) => o.result?.status === "fixed") && !opts.write && !opts.pr) io.stdout("\nNothing was changed. Add --write to keep these fixes, or --pr to open pull requests.\n");
+    io.stdout(`Fix PRs and a dashboard on every push: install the GitHub App at ${APP_URL}
+`);
     exitCode = outcomes.every((o) => o.result?.status === "fixed" || o.result?.status === "already-handled") ? 0 : 1;
   });
   try {
@@ -3019,6 +4384,7 @@ export {
   VERSION,
   fix,
   main,
+  preparePython,
   renderText,
   run,
   scan,