@apifuse/provider-sdk 2.2.0-beta.7 → 2.2.0-beta.70

package/bin/apifuse-submit-check.ts

@@ -4,28 +4,53 @@ import { type ChildProcess, spawn } from "node:child_process";
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { writeFile } from "node:fs/promises";
 import { createServer } from "node:net";
-import { basename, dirname, join, relative, resolve } from "node:path";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
 
 import * as acorn from "acorn";
+import type TS from "typescript";
 import { z } from "zod";
 
 import packageJson from "../package.json";
 import {
-	formatPromptAssetIssues,
-	verifyPromptAssets,
-} from "../src/cli/prompt-assets.js";
-import type { ProviderDefinition } from "../src/index.js";
+	LOCAL_CONNECTION_SECRETS_ENV,
+	providerRequiresConnection,
+	resolveLocalConnection,
+} from "../src/cli/local-connection.js";
+import { formatPromptAssetIssues, verifyPromptAssets } from "../src/cli/prompt-assets.js";
 import {
 	loadProviderLocaleCatalogs,
 	type ProviderLocale,
 	validateProviderLocaleCatalogs,
 } from "../src/i18n/index.js";
-import { APIFUSE_DESCRIPTION_KEY_META_KEY } from "../src/schema.js";
-import { safeParseSchemaSync } from "../src/schema.js";
+import type { ProviderDefinition } from "../src/index.js";
+import { APIFUSE_DESCRIPTION_KEY_META_KEY, safeParseSchemaSync } from "../src/schema.js";
+import {
+	findStreamCaptureGroup,
+	hasStreamEvidenceMarker,
+	parseStreamEvidenceRecord,
+} from "../src/stream-evidence.js";
+import { getTypeScript } from "../src/typescript-module.js";
 import { type CheckResult, PROMPT_ASSETS_CHECK_MESSAGE, runChecks } from "./apifuse-check.js";
+import { hasSubstantiveDelimitedTextStructure } from "./submit-check-delimited-text.js";
 import { hasSubstantiveXmlStructure } from "./submit-check-xml.js";
 
+const ts: typeof import("typescript") = loadTypeScript();
+
+// Shares the lint rules' loader so a workspace whose `typescript` is the 7.x
+// native shell (no compiler API) falls back to `@typescript/typescript6`
+// instead of failing inside the first parse.
+function loadTypeScript(): typeof import("typescript") {
+	try {
+		return getTypeScript();
+	} catch (error) {
+		console.error(
+			`apifuse submit-check requires the TypeScript compiler API; install it in the workspace running the CLI (bun add -d typescript). ${error instanceof Error ? error.message : String(error)}`,
+		);
+		process.exit(1);
+	}
+}
+
 const TIERS = ["bronze", "silver", "gold", "diamond"] as const;
 const TIER_VALUES: ReadonlySet<string> = new Set(TIERS);
 type BountyTier = (typeof TIERS)[number];
@@ -105,16 +130,38 @@ export type SmokeResult = {
 	healthOk: boolean;
 	bootError?: string;
 	operations: SmokeOperationOutcome[];
+	/**
+	 * Whether the provider's declared auth mode needs a gateway-injected
+	 * credential, and whether this run had one. Recorded so a provider that
+	 * could not be exercised at all says so, instead of scoring as "ran, but
+	 * saw no live success" — the two are not the same evidence.
+	 */
+	credential?: {
+		required: boolean;
+		supplied: boolean;
+		mode: string;
+		/**
+		 * Why the local credential could not be resolved — a malformed
+		 * `APIFUSE__LOCAL_CONNECTION__SECRETS`, a non-string value, a bad
+		 * `--credential`. Distinct from "not configured": a misconfiguration
+		 * reported as an absence sends the author looking for a key they already
+		 * set.
+		 */
+		error?: string;
+	};
 };
 
 type SourceFinding = {
 	file: string;
 	line: number;
+	detail?: string;
 };
 
 const SDK_NATIVE_CATEGORY = "sdk-native";
 const VENDOR_SHIM_PROVIDER_ID_PREFIX = "apifuse-provider-";
 const MAX_SOURCE_FINDING_EVIDENCE = 5;
+const MAX_LOAD_ERROR_EVIDENCE = 5;
+const MAX_LOAD_ERROR_MESSAGE_LENGTH = 500;
 
 const CATEGORY_MAX_POINTS = {
 	definition: 15,
@@ -133,7 +180,9 @@ const HELP_TEXT = `Usage: apifuse submit-check [path] [--tier bronze|silver|gold
 Alias: apifuse bounty-check [path]
 Default: apifuse submit-check .
 
-Smoke: --smoke boots the provider dev server, checks /health, and POSTs every operation fixture. APIFUSE__PROVIDER__* env vars enable live upstream calls; without them, structured provider errors can still verify runtime routing. --smoke-note is deprecated and ignored for scoring.`;
+Smoke: --smoke boots the provider dev server, checks /health, and POSTs every operation fixture. APIFUSE__PROVIDER__* env vars enable live upstream calls; without them, structured provider errors can still verify runtime routing. --smoke-note is deprecated and ignored for scoring.
+
+A provider whose auth.mode is not "none" reads a credential the gateway injects at invocation time; smoke attaches the same connection from ${LOCAL_CONNECTION_SECRETS_ENV}='{"<key>":"<value>"}', keyed as the provider reads them through ctx.credential.get(...). Without it no operation reaches the upstream, and the smoke check says so rather than scoring it as a missing live success.`;
 
 export async function main() {
 	try {
@@ -269,7 +318,20 @@ export async function buildSubmitCheckReport(
 ): Promise<SubmitCheckReport> {
 	const checks: SubmitCheck[] = [];
 	const baseChecks = await safeRunChecks(providerRoot);
-	const provider = await safeLoadProvider(providerRoot);
+	const loadResult = await safeLoadProvider(providerRoot);
+	const provider = loadResult.ok ? loadResult.provider : undefined;
+	let indexParseError: string | undefined;
+	if (!provider) {
+		const indexPath = resolve(providerRoot, "index.ts");
+		if (existsSync(indexPath)) {
+			const relPath = toRelativeProviderPath(providerRoot, indexPath);
+			try {
+				maskCommentsAndStrings(readFileSync(indexPath, "utf8"), relPath);
+			} catch (error) {
+				indexParseError = error instanceof Error ? error.message : String(error);
+			}
+		}
+	}
 
 	// Prompt-asset freshness is reported by its own dedicated zero-point
 	// blocker below; filter the base-check duplicate so it is not double
@@ -280,17 +342,20 @@ export async function buildSubmitCheckReport(
 		),
 	);
 	checks.push(scorePromptAssetFreshness(providerRoot));
-	checks.push(scoreProviderIdSlug(providerRoot, provider));
-	checks.push(scoreNoVendorShim(providerRoot));
-	checks.push(scoreNoVendorImport(providerRoot));
-	checks.push(scoreDescribeKey(providerRoot));
-	checks.push(scoreNoRawFetch(providerRoot));
-	checks.push(scoreNoRedundantRuntimeGuards(providerRoot));
-	checks.push(scoreManagedBrowserRuntime(providerRoot));
-	checks.push(scoreAsAssertionCount(providerRoot));
-	checks.push(scoreUnsafeInputPassthrough(providerRoot));
-	checks.push(scoreUnjustifiedLooseSchema(providerRoot));
-	checks.push(scoreFlatOperationComposition(providerRoot));
+	if (!indexParseError) {
+		checks.push(scoreProviderIdSlug(providerRoot, provider));
+		checks.push(scoreNoVendorShim(providerRoot));
+		checks.push(scoreNoVendorImport(providerRoot));
+		checks.push(scoreDescribeKey(providerRoot));
+		checks.push(scoreNoRawFetch(providerRoot));
+		checks.push(scoreNoDynamicCode(providerRoot));
+		checks.push(scoreNoRedundantRuntimeGuards(providerRoot));
+		checks.push(scoreManagedBrowserRuntime(providerRoot));
+		checks.push(scoreAsAssertionCount(providerRoot));
+		checks.push(scoreUnsafeInputPassthrough(providerRoot));
+		checks.push(scoreUnjustifiedLooseSchema(providerRoot));
+		checks.push(scoreFlatOperationComposition(providerRoot));
+	}
 
 	if (provider) {
 		const smokeResult = args.smoke ? await runSubmitCheckSmoke(providerRoot, provider) : undefined;
@@ -309,15 +374,38 @@ export async function buildSubmitCheckReport(
 		checks.push(scoreRepositoryDx(providerRoot));
 		checks.push(scoreSecrets(providerRoot, provider));
 	} else {
+		const loadEvidence = indexParseError
+			? undefined
+			: loadResult.ok
+				? undefined
+				: formatLoadErrorEvidence(loadResult.error, providerRoot);
+		const loadRemediation = indexParseError
+			? "Fix the syntax error reported by the provider-load-parse blocker before apifuse check can load the provider."
+			: !loadResult.ok
+				? "Fix the import/initialization failure shown in evidence so apifuse check can load the provider."
+				: "Fix index.ts so it default-exports defineProvider(...).";
 		checks.push(
 			blocker(
 				"provider-load",
 				"definition",
 				"Provider could not be loaded.",
-				"Fix index.ts so it default-exports defineProvider(...).",
+				loadRemediation,
 				CATEGORY_MAX_POINTS.definition,
+				loadEvidence,
 			),
 		);
+		if (indexParseError) {
+			checks.push(
+				blocker(
+					"provider-load-parse",
+					"definition",
+					"Provider index.ts could not be parsed safely.",
+					"Fix the syntax error in index.ts before submitting.",
+					0,
+					[indexParseError],
+				),
+			);
+		}
 	}
 
 	const total = clamp(Math.round(checks.reduce((sum, check) => sum + check.points, 0)), 0, 100);
@@ -445,7 +533,7 @@ function scoreDescribeKey(providerRoot: string): SubmitCheck {
 }
 
 function scoreNoRawFetch(providerRoot: string): SubmitCheck {
-	const findings = findSourceLineMatches(providerRoot, /(?<![.\w])fetch\s*\(/);
+	const findings = findGlobalSinkCalls(providerRoot, FETCH_SINKS);
 	if (findings.length > 0) {
 		const evidence = formatSourceFindings(findings);
 		return blocker(
@@ -461,12 +549,441 @@ function scoreNoRawFetch(providerRoot: string): SubmitCheck {
 	return pass("no-raw-fetch", SDK_NATIVE_CATEGORY, "Provider source avoids raw fetch().", 0);
 }
 
+const DYNAMIC_CODE_SINKS: ReadonlySet<string> = new Set(["eval", "Function"]);
+const FETCH_SINKS: ReadonlySet<string> = new Set(["fetch"]);
+const DYNAMIC_CODE_GLOBAL_OBJECTS: ReadonlySet<string> = new Set([
+	"globalThis",
+	"window",
+	"self",
+	"global",
+]);
+
+function unwrapLocalExpression(expression: TS.Expression): TS.Expression {
+	let current = expression;
+	while (
+		ts.isParenthesizedExpression(current) ||
+		ts.isAsExpression(current) ||
+		ts.isSatisfiesExpression(current) ||
+		ts.isNonNullExpression(current)
+	) {
+		current = current.expression;
+	}
+	if (ts.isBinaryExpression(current) && current.operatorToken.kind === ts.SyntaxKind.CommaToken) {
+		return unwrapLocalExpression(current.right);
+	}
+	return current;
+}
+
+type LocalBinding = {
+	declaration: TS.Identifier;
+	initializer?: TS.Expression;
+	destructuredProperty?: string;
+	mutable: boolean;
+	reassigned: boolean;
+};
+
+type LocalBindings = {
+	scopes: Map<TS.Node, Map<string, LocalBinding[]>>;
+};
+
+function isLexicalScope(node: TS.Node): boolean {
+	return (
+		ts.isSourceFile(node) ||
+		ts.isFunctionLike(node) ||
+		ts.isBlock(node) ||
+		ts.isModuleBlock(node) ||
+		ts.isCaseBlock(node) ||
+		ts.isCatchClause(node) ||
+		ts.isForStatement(node) ||
+		ts.isForInStatement(node) ||
+		ts.isForOfStatement(node)
+	);
+}
+
+function enclosingScope(node: TS.Node, functionScoped: boolean): TS.Node {
+	let current: TS.Node | undefined = node.parent;
+	while (current !== undefined) {
+		if (
+			ts.isSourceFile(current) ||
+			(functionScoped ? ts.isFunctionLike(current) : isLexicalScope(current))
+		) {
+			return current;
+		}
+		current = current.parent;
+	}
+	return node.getSourceFile();
+}
+
+function collectLocalBindings(sourceFile: TS.SourceFile): LocalBindings {
+	const bindings: LocalBindings = { scopes: new Map() };
+	const addBinding = (
+		scope: TS.Node,
+		name: TS.Identifier,
+		binding: Omit<LocalBinding, "declaration" | "reassigned">,
+	): void => {
+		let scopeBindings = bindings.scopes.get(scope);
+		if (scopeBindings === undefined) {
+			scopeBindings = new Map();
+			bindings.scopes.set(scope, scopeBindings);
+		}
+		const existing = scopeBindings.get(name.text);
+		const localBinding: LocalBinding = { ...binding, declaration: name, reassigned: false };
+		if (existing === undefined) {
+			scopeBindings.set(name.text, [localBinding]);
+		} else {
+			existing.push(localBinding);
+		}
+	};
+	const addBindingName = (
+		bindingName: TS.BindingName,
+		scope: TS.Node,
+		binding: Omit<LocalBinding, "declaration" | "reassigned">,
+	): void => {
+		if (ts.isIdentifier(bindingName)) {
+			addBinding(scope, bindingName, binding);
+			return;
+		}
+		for (const element of bindingName.elements) {
+			if (ts.isOmittedExpression(element)) {
+				continue;
+			}
+			if (ts.isObjectBindingPattern(bindingName) && !element.dotDotDotToken) {
+				const property = element.propertyName ?? element.name;
+				const propertyName = propertyNameText(property);
+				if (propertyName !== undefined && ts.isIdentifier(element.name)) {
+					addBinding(scope, element.name, {
+						initializer: binding.initializer,
+						destructuredProperty: propertyName,
+						mutable: binding.mutable,
+					});
+					continue;
+				}
+			}
+			addBindingName(element.name, scope, { mutable: binding.mutable });
+		}
+	};
+	const visit = (node: TS.Node): void => {
+		if (ts.isVariableDeclaration(node)) {
+			const declarationList = ts.isVariableDeclarationList(node.parent) ? node.parent : undefined;
+			const isConstBinding =
+				declarationList !== undefined && (declarationList.flags & ts.NodeFlags.Const) !== 0;
+			const isBlockScoped =
+				declarationList !== undefined && (declarationList.flags & ts.NodeFlags.BlockScoped) !== 0;
+			addBindingName(node.name, enclosingScope(node, !isBlockScoped), {
+				initializer: node.initializer,
+				mutable: !isConstBinding,
+			});
+		} else if (ts.isFunctionDeclaration(node) && node.name !== undefined) {
+			addBinding(enclosingScope(node, false), node.name, { mutable: false });
+		} else if (ts.isFunctionExpression(node) && node.name !== undefined) {
+			addBinding(node, node.name, { mutable: false });
+		} else if (ts.isClassDeclaration(node) && node.name !== undefined) {
+			addBinding(enclosingScope(node, false), node.name, { mutable: false });
+		} else if (ts.isClassExpression(node) && node.name !== undefined) {
+			addBinding(node, node.name, { mutable: false });
+		} else if (ts.isParameter(node)) {
+			addBindingName(node.name, enclosingScope(node, true), { mutable: true });
+		} else if (ts.isImportClause(node) && node.name !== undefined) {
+			addBinding(sourceFile, node.name, { mutable: false });
+		} else if (ts.isNamespaceImport(node) || ts.isImportSpecifier(node)) {
+			addBinding(sourceFile, node.name, { mutable: false });
+		}
+		ts.forEachChild(node, visit);
+	};
+	visit(sourceFile);
+
+	const markReassigned = (identifier: TS.Identifier): void => {
+		for (const binding of lookupLocalBindings(identifier, bindings) ?? []) {
+			binding.reassigned = true;
+		}
+	};
+	const markAssignmentTarget = (node: TS.Node): void => {
+		const target = ts.isExpression(node) ? unwrapLocalExpression(node) : node;
+		if (ts.isIdentifier(target)) {
+			markReassigned(target);
+			return;
+		}
+		if (ts.isObjectLiteralExpression(target)) {
+			for (const element of target.properties) {
+				if (ts.isSpreadAssignment(element)) {
+					markAssignmentTarget(element.expression);
+				} else if (ts.isPropertyAssignment(element)) {
+					markAssignmentTarget(element.initializer);
+				} else if (ts.isShorthandPropertyAssignment(element)) {
+					markAssignmentTarget(element.name);
+				}
+			}
+		} else if (ts.isArrayLiteralExpression(target)) {
+			for (const element of target.elements) {
+				if (!ts.isOmittedExpression(element)) {
+					markAssignmentTarget(ts.isSpreadElement(element) ? element.expression : element);
+				}
+			}
+		}
+	};
+	const visitAssignments = (node: TS.Node): void => {
+		if (
+			ts.isBinaryExpression(node) &&
+			node.operatorToken.kind >= ts.SyntaxKind.FirstAssignment &&
+			node.operatorToken.kind <= ts.SyntaxKind.LastAssignment
+		) {
+			markAssignmentTarget(node.left);
+		} else if (
+			(ts.isPrefixUnaryExpression(node) || ts.isPostfixUnaryExpression(node)) &&
+			(node.operator === ts.SyntaxKind.PlusPlusToken ||
+				node.operator === ts.SyntaxKind.MinusMinusToken)
+		) {
+			markAssignmentTarget(node.operand);
+		} else if (
+			(ts.isForInStatement(node) || ts.isForOfStatement(node)) &&
+			!ts.isVariableDeclarationList(node.initializer)
+		) {
+			markAssignmentTarget(node.initializer);
+		}
+		ts.forEachChild(node, visitAssignments);
+	};
+	visitAssignments(sourceFile);
+	return bindings;
+}
+
+function lookupLocalBindings(
+	reference: TS.Identifier,
+	bindings: LocalBindings,
+): readonly LocalBinding[] | undefined {
+	let current: TS.Node | undefined = reference;
+	while (current !== undefined) {
+		const localBindings = bindings.scopes.get(current)?.get(reference.text);
+		if (localBindings !== undefined && localBindings.length > 0) {
+			return localBindings;
+		}
+		current = current.parent;
+	}
+	return undefined;
+}
+
+function propertyNameText(name: TS.PropertyName | TS.BindingName): string | undefined {
+	if (
+		ts.isIdentifier(name) ||
+		ts.isStringLiteral(name) ||
+		ts.isNumericLiteral(name) ||
+		ts.isNoSubstitutionTemplateLiteral(name)
+	) {
+		return name.text;
+	}
+	if (ts.isComputedPropertyName(name)) {
+		const expression = unwrapLocalExpression(name.expression);
+		if (ts.isStringLiteral(expression) || ts.isNoSubstitutionTemplateLiteral(expression)) {
+			return expression.text;
+		}
+	}
+	return undefined;
+}
+
+function isUnshadowedGlobalObject(reference: TS.Expression, bindings: LocalBindings): boolean {
+	const receiver = unwrapLocalExpression(reference);
+	return (
+		ts.isIdentifier(receiver) &&
+		DYNAMIC_CODE_GLOBAL_OBJECTS.has(receiver.text) &&
+		lookupLocalBindings(receiver, bindings) === undefined
+	);
+}
+
+function isGlobalMemberSink(
+	expression: TS.Expression,
+	sinkNames: ReadonlySet<string>,
+	bindings: LocalBindings,
+): boolean {
+	const callee = unwrapLocalExpression(expression);
+	let sinkName: string | undefined;
+	let receiver: TS.Expression | undefined;
+	if (ts.isPropertyAccessExpression(callee)) {
+		sinkName = callee.name.text;
+		receiver = callee.expression;
+	} else if (ts.isElementAccessExpression(callee)) {
+		const argument = callee.argumentExpression;
+		if (
+			argument !== undefined &&
+			(ts.isStringLiteral(argument) || ts.isNoSubstitutionTemplateLiteral(argument))
+		) {
+			sinkName = argument.text;
+			receiver = callee.expression;
+		}
+	}
+	if (sinkName === undefined || receiver === undefined || !sinkNames.has(sinkName)) {
+		return false;
+	}
+	return isUnshadowedGlobalObject(receiver, bindings);
+}
+
+function isGlobalSinkReference(
+	expression: TS.Expression,
+	sinkNames: ReadonlySet<string>,
+	bindings: LocalBindings,
+	resolving: ReadonlySet<LocalBinding>,
+): boolean {
+	const reference = unwrapLocalExpression(expression);
+	if (isGlobalMemberSink(reference, sinkNames, bindings)) {
+		return true;
+	}
+	if (!ts.isIdentifier(reference)) {
+		return false;
+	}
+	return isGlobalSinkIdentifier(reference, sinkNames, bindings, resolving);
+}
+
+function isGlobalSinkIdentifier(
+	reference: TS.Identifier,
+	sinkNames: ReadonlySet<string>,
+	bindings: LocalBindings,
+	resolving: ReadonlySet<LocalBinding>,
+): boolean {
+	const localBindings = lookupLocalBindings(reference, bindings);
+	if (localBindings === undefined || localBindings.length === 0) {
+		return sinkNames.has(reference.text);
+	}
+	return localBindings.every((binding) => {
+		if (resolving.has(binding) || binding.initializer === undefined) {
+			return false;
+		}
+		// A mutable alias is safe to resolve only when no assignment targeting
+		// this lexical binding exists in its scope (including nested closures).
+		// Reassigned let/var aliases remain unresolved to avoid false positives.
+		if (binding.mutable && binding.reassigned) {
+			return false;
+		}
+		const nextResolving = new Set(resolving);
+		nextResolving.add(binding);
+		if (binding.destructuredProperty !== undefined) {
+			return (
+				sinkNames.has(binding.destructuredProperty) &&
+				isUnshadowedGlobalObject(binding.initializer, bindings)
+			);
+		}
+		return isGlobalSinkReference(binding.initializer, sinkNames, bindings, nextResolving);
+	});
+}
+
+function isGlobalSinkCallee(
+	expression: TS.Expression,
+	sinkNames: ReadonlySet<string>,
+	bindings: LocalBindings,
+): boolean {
+	const callee = unwrapLocalExpression(expression);
+	if (isGlobalMemberSink(callee, sinkNames, bindings)) {
+		return true;
+	}
+	if (!ts.isIdentifier(callee)) {
+		return false;
+	}
+	return isGlobalSinkIdentifier(callee, sinkNames, bindings, new Set());
+}
+
+function resolveConstStringIdentifier(
+	reference: TS.Identifier,
+	bindings: LocalBindings,
+	resolving: ReadonlySet<LocalBinding> = new Set(),
+): string | undefined {
+	const localBindings = lookupLocalBindings(reference, bindings);
+	if (localBindings === undefined || localBindings.length === 0) {
+		return undefined;
+	}
+	let resolved: string | undefined;
+	for (const binding of localBindings) {
+		if (
+			resolving.has(binding) ||
+			binding.mutable ||
+			binding.initializer === undefined ||
+			binding.destructuredProperty !== undefined
+		) {
+			return undefined;
+		}
+		const nextResolving = new Set(resolving);
+		nextResolving.add(binding);
+		const initializer = unwrapLocalExpression(binding.initializer);
+		let value: string | undefined;
+		if (ts.isStringLiteral(initializer) || ts.isNoSubstitutionTemplateLiteral(initializer)) {
+			value = initializer.text;
+		} else if (ts.isIdentifier(initializer)) {
+			value = resolveConstStringIdentifier(initializer, bindings, nextResolving);
+		}
+		if (value === undefined || (resolved !== undefined && resolved !== value)) {
+			return undefined;
+		}
+		resolved = value;
+	}
+	return resolved;
+}
+
+function findGlobalSinkCalls(
+	providerRoot: string,
+	sinkNames: ReadonlySet<string>,
+	includeConstructors = false,
+): SourceFinding[] {
+	const findings: SourceFinding[] = [];
+	const seen = new Set<string>();
+	for (const filePath of listNonTestTypeScriptFiles(providerRoot)) {
+		const source = readFileSync(filePath, "utf8");
+		const relPath = toRelativeProviderPath(providerRoot, filePath);
+		const sourceFile = ts.createSourceFile(
+			relPath,
+			source,
+			ts.ScriptTarget.Latest,
+			true,
+			ts.ScriptKind.TS,
+		);
+		const bindings = collectLocalBindings(sourceFile);
+		const visit = (node: TS.Node): void => {
+			if (findings.length >= MAX_SOURCE_FINDING_EVIDENCE) {
+				return;
+			}
+			if (
+				(ts.isCallExpression(node) || (includeConstructors && ts.isNewExpression(node))) &&
+				isGlobalSinkCallee(node.expression, sinkNames, bindings)
+			) {
+				const line = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
+				const key = `${relPath}:${line}`;
+				if (!seen.has(key)) {
+					seen.add(key);
+					findings.push({ file: relPath, line });
+				}
+			}
+			ts.forEachChild(node, visit);
+		};
+		visit(sourceFile);
+		if (findings.length >= MAX_SOURCE_FINDING_EVIDENCE) {
+			break;
+		}
+	}
+	return findings;
+}
+
+function scoreNoDynamicCode(providerRoot: string): SubmitCheck {
+	const findings = findGlobalSinkCalls(providerRoot, DYNAMIC_CODE_SINKS, true);
+	if (findings.length > 0) {
+		return blocker(
+			"no-dynamic-code",
+			SDK_NATIVE_CATEGORY,
+			"Dynamic code evaluation is not permitted in provider source.",
+			"Remove eval() and Function constructor calls. Provider HTTP access must go through ctx.http.",
+			0,
+			formatSourceFindings(findings),
+		);
+	}
+
+	return pass(
+		"no-dynamic-code",
+		SDK_NATIVE_CATEGORY,
+		"Provider source avoids dynamic code evaluation.",
+		0,
+	);
+}
+
 const REDUNDANT_RUNTIME_GUARD_PATTERNS: readonly RegExp[] = [
-	/\bctx\.(?:stealth|http|cache|state|browser|trace|auth|stt|choice)\?\./,
+	/\bctx\.(?:stealth|http|cache|state|browser|trace|auth|stt|handle)\?\./,
 ];
 
 const SDK_CONTEXT_METHOD_ALIAS_PATTERN =
-	/\bconst\s+(\w+)\s*=\s*ctx\.(?:stealth|http|cache|state|browser|trace|auth|stt|choice)\.(?:\w+)/;
+	/\bconst\s+(\w+)\s*=\s*ctx\.(?:stealth|http|cache|state|browser|trace|auth|stt|handle)\.(?:\w+)/;
 
 function hasRedundantRuntimeGuard(line: string, remainingLines: readonly string[]): boolean {
 	if (REDUNDANT_RUNTIME_GUARD_PATTERNS.some((pattern) => pattern.test(line))) {
@@ -516,7 +1033,9 @@ function countAsAssertions(providerRoot: string): {
 
 	for (const filePath of listNonTestTypeScriptFiles(providerRoot)) {
 		const content = readFileSync(filePath, "utf8");
-		const lines = content.split(/\r?\n/);
+		const lines = maskCommentsAndStrings(content, toRelativeProviderPath(providerRoot, filePath), {
+			blankPropertyKeys: true,
+		}).split(/\r?\n/);
 		for (let index = 0; index < lines.length; index += 1) {
 			const line = lines[index];
 			if (
@@ -707,18 +1226,44 @@ function offsetToLine(source: string, offset: number): number {
 // between them, so `.passthrough ()` / `.passthrough\n()` are still detected.
 const PASSTHROUGH_CALL = /\.passthrough\s*\(\s*\)/;
 
+type ExpressionSlice = {
+	raw: string;
+	masked: string;
+};
+
+function trimExpressionSlice(expr: ExpressionSlice): ExpressionSlice {
+	const start = expr.raw.length - expr.raw.trimStart().length;
+	const end = expr.raw.trimEnd().length;
+	return {
+		raw: expr.raw.slice(start, end),
+		masked: expr.masked.slice(start, end),
+	};
+}
+
+function balancedExpressionSlice(
+	source: string,
+	valueStart: number,
+	fileName?: string,
+): ExpressionSlice {
+	const raw = balancedValueExpression(source, valueStart, fileName);
+	return trimExpressionSlice({
+		raw,
+		masked: maskCommentsAndStrings(source, fileName).slice(valueStart, valueStart + raw.length),
+	});
+}
+
 // Strips redundant wrapping parentheses from an expression so that a value like
 // `(makeOperations())` or `((x))` classifies the same as `makeOperations()`.
 // Only unwraps when the leading `(` matches the trailing `)` at depth 0 (i.e.
 // the whole expression is parenthesized), preserving call expressions such as
 // `makeOperations()` whose first `(` is not a wrapper.
-function unwrapParens(expr: string): string {
-	let value = expr.trim();
-	while (value.startsWith("(")) {
+function unwrapParens(expr: ExpressionSlice): ExpressionSlice {
+	let value = trimExpressionSlice(expr);
+	while (value.raw.startsWith("(")) {
 		let depth = 0;
 		let matchIndex = -1;
-		for (let i = 0; i < value.length; i += 1) {
-			const ch = value[i];
+		for (let i = 0; i < value.raw.length; i += 1) {
+			const ch = value.masked[i];
 			if (ch === "(") {
 				depth += 1;
 			} else if (ch === ")") {
@@ -731,8 +1276,11 @@ function unwrapParens(expr: string): string {
 		}
 		// Only a true wrapper spans the entire expression (closing paren is the
 		// last char). Otherwise the leading `(` belongs to a sub-expression.
-		if (matchIndex === value.length - 1) {
-			value = value.slice(1, -1).trim();
+		if (matchIndex === value.raw.length - 1) {
+			value = trimExpressionSlice({
+				raw: value.raw.slice(1, -1),
+				masked: value.masked.slice(1, -1),
+			});
 		} else {
 			break;
 		}
@@ -744,8 +1292,8 @@ function unwrapParens(expr: string): string {
 // across (){}[] and stopping at the first top-level `,`/`;` or unmatched
 // closing bracket. This lets a property value be read across newlines, so a
 // multi-line `input: z.object({...})\n.passthrough()` is captured whole.
-function balancedValueExpression(source: string, valueStart: number): string {
-	const masked = maskCommentsAndStrings(source);
+function balancedValueExpression(source: string, valueStart: number, fileName?: string): string {
+	const masked = maskCommentsAndStrings(source, fileName);
 	let depth = 0;
 	let index = valueStart;
 	for (; index < source.length; index += 1) {
@@ -769,14 +1317,14 @@ function balancedValueExpression(source: string, valueStart: number): string {
 // nested deeper than the outer object (inside handler bodies, nested objects,
 // or arrays) are ignored, so only a factory composition of the object itself
 // is detected. Input is expected to start at the outer `{`.
-function hasTopLevelFactorySpread(expr: string): boolean {
-	const open = expr.indexOf("{");
+function hasTopLevelFactorySpread(expr: ExpressionSlice): boolean {
+	const open = expr.masked.indexOf("{");
 	if (open === -1) {
 		return false;
 	}
 	let depth = 0;
-	for (let i = open; i < expr.length; i += 1) {
-		const ch = expr[i];
+	for (let i = open; i < expr.raw.length; i += 1) {
+		const ch = expr.masked[i];
 		if (ch === "{" || ch === "(" || ch === "[") {
 			depth += 1;
 		} else if (ch === "}" || ch === ")" || ch === "]") {
@@ -784,11 +1332,11 @@ function hasTopLevelFactorySpread(expr: string): boolean {
 			if (depth === 0) {
 				break;
 			}
-		} else if (ch === "." && depth === 1 && expr.startsWith("...", i)) {
+		} else if (ch === "." && depth === 1 && expr.masked.startsWith("...", i)) {
 			// A spread at the object's own level. Check whether the spread
 			// argument is a call expression (factory) rather than a plain
 			// identifier/member spread of an already-built object.
-			const rest = expr.slice(i + 3);
+			const rest = expr.raw.slice(i + 3);
 			if (/^\s*[A-Za-z_$][\w$.]*\s*\(/.test(rest)) {
 				return true;
 			}
@@ -803,15 +1351,15 @@ function hasTopLevelFactorySpread(expr: string): boolean {
 // hasTopLevelFactorySpread, so it is excluded here. These identifiers must be
 // resolved to their declarations: `const hidden = makeOperations()` spread as
 // `{ ...hidden }` is still a factory-composed map and must block.
-function topLevelSpreadIdentifiers(expr: string): string[] {
-	const open = expr.indexOf("{");
+function topLevelSpreadIdentifiers(expr: ExpressionSlice): string[] {
+	const open = expr.masked.indexOf("{");
 	if (open === -1) {
 		return [];
 	}
 	const names: string[] = [];
 	let depth = 0;
-	for (let i = open; i < expr.length; i += 1) {
-		const ch = expr[i];
+	for (let i = open; i < expr.raw.length; i += 1) {
+		const ch = expr.masked[i];
 		if (ch === "{" || ch === "(" || ch === "[") {
 			depth += 1;
 		} else if (ch === "}" || ch === ")" || ch === "]") {
@@ -819,8 +1367,8 @@ function topLevelSpreadIdentifiers(expr: string): string[] {
 			if (depth === 0) {
 				break;
 			}
-		} else if (ch === "." && depth === 1 && expr.startsWith("...", i)) {
-			const rest = expr.slice(i + 3);
+		} else if (ch === "." && depth === 1 && expr.masked.startsWith("...", i)) {
+			const rest = expr.raw.slice(i + 3);
 			// Bare identifier spread (no call parens) -> needs declaration
 			// resolution. `...obj.prop` member spreads are treated as already
 			// built and ignored (the leading identifier is captured).
@@ -853,8 +1401,8 @@ function topLevelSpreadIdentifiers(expr: string): string[] {
 // `makeOperations()` — stays classified as factory composition.
 const TRANSPARENT_RESHAPE_HEAD = /^Object\s*\.\s*fromEntries\s*\(/;
 const OBJECT_ENTRIES_HEAD = /^Object\s*\.\s*entries\s*\(/;
-function isTransparentObjectReshape(expr: string): boolean {
-	const head = TRANSPARENT_RESHAPE_HEAD.exec(expr);
+function isTransparentObjectReshape(expr: ExpressionSlice): boolean {
+	const head = TRANSPARENT_RESHAPE_HEAD.exec(expr.masked);
 	if (!head) {
 		return false;
 	}
@@ -862,7 +1410,7 @@ function isTransparentObjectReshape(expr: string): boolean {
 	// transparent only when that argument's root callee is `Object.entries(`
 	// (optionally chained: `Object.entries(obj).filter(...)`), so the source
 	// object is enumerable from source rather than produced by an opaque call.
-	const firstArg = expr.slice(head[0].length).trimStart();
+	const firstArg = expr.masked.slice(head[0].length).trimStart();
 	return OBJECT_ENTRIES_HEAD.test(firstArg);
 }
 
@@ -996,7 +1544,7 @@ function scoreUnsafeInputPassthrough(providerRoot: string): SubmitCheck {
 				continue;
 			}
 			const valueStart = match.index + match[0].length;
-			const value = balancedValueExpression(source, valueStart);
+			const value = balancedValueExpression(source, valueStart, relPath);
 			if (PASSTHROUGH_CALL.test(value)) {
 				const site: ConstSite = {
 					file: relPath,
@@ -1025,8 +1573,8 @@ function scoreUnsafeInputPassthrough(providerRoot: string): SubmitCheck {
 	// that is itself a passthrough expression, or that references a passthrough
 	// const by name (resolved against the provider-wide map), is a violation.
 	for (const filePath of files) {
-		const source = fileSources.get(filePath) ?? readFileSync(filePath, "utf8");
 		const relPath = toRelativeProviderPath(providerRoot, filePath);
+		const source = fileSources.get(filePath) ?? readFileSync(filePath, "utf8");
 
 		const inputProp = /\binput\s*:\s*/g;
 		for (let match = inputProp.exec(source); match !== null; match = inputProp.exec(source)) {
@@ -1037,7 +1585,7 @@ function scoreUnsafeInputPassthrough(providerRoot: string): SubmitCheck {
 				continue;
 			}
 			const valueStart = match.index + match[0].length;
-			const value = balancedValueExpression(source, valueStart);
+			const value = balancedValueExpression(source, valueStart, relPath);
 			if (PASSTHROUGH_CALL.test(value)) {
 				push({ file: relPath, line: offsetToLine(source, valueStart) });
 				continue;
@@ -1148,13 +1696,19 @@ function spreadIdentifierResolvesToFactory(
 		if (!existsSync(filePath)) {
 			continue;
 		}
+		const relPath = toRelativeProviderPath(providerRoot, filePath);
 		const fileSource = filePath === indexPath ? indexSource : readFileSync(filePath, "utf8");
+		const maskedFileSource = maskCommentsAndStrings(fileSource, relPath, {
+			blankPropertyKeys: true,
+		});
 		const re = new RegExp(declRe.source, "g");
-		for (let m = re.exec(fileSource); m !== null; m = re.exec(fileSource)) {
+		for (let m = re.exec(maskedFileSource); m !== null; m = re.exec(maskedFileSource)) {
 			sawDeclaration = true;
-			const expr = unwrapParens(balancedValueExpression(fileSource, m.index + m[0].length).trim());
+			const expr = unwrapParens(
+				balancedExpressionSlice(fileSource, m.index + m[0].length, relPath),
+			);
 			const isFactory =
-				(/^[A-Za-z_$][\w$.]*\s*\(/.test(expr) || hasTopLevelFactorySpread(expr)) &&
+				(/^[A-Za-z_$][\w$.]*\s*\(/.test(expr.masked) || hasTopLevelFactorySpread(expr)) &&
 				!isTransparentObjectReshape(expr);
 			if (isFactory) {
 				return true;
@@ -1163,12 +1717,232 @@ function spreadIdentifierResolvesToFactory(
 	}
 	// No local declaration anywhere but imported into index.ts => constructed
 	// out of view; treat as factory (conservative, false-negative-safe).
-	if (!sawDeclaration && fileImportsBinding(indexSource, name)) {
+	if (
+		!sawDeclaration &&
+		fileImportsBinding(
+			maskCommentsAndStrings(indexSource, "index.ts", { blankPropertyKeys: true }),
+			name,
+		)
+	) {
 		return true;
 	}
 	return false;
 }
 
+function isDefineProviderCall(node: TS.CallExpression): boolean {
+	return ts.isIdentifier(node.expression) && node.expression.text === "defineProvider";
+}
+
+function resolveDefineProviderImplementationCall(
+	candidate: TS.CallExpression,
+): TS.CallExpression | undefined {
+	let root = candidate;
+	while (ts.isCallExpression(root.expression)) {
+		root = root.expression;
+	}
+	return isDefineProviderCall(root) ? candidate : undefined;
+}
+
+function findProviderImplementationCall(sourceFile: TS.SourceFile): TS.CallExpression | undefined {
+	const defaultExports = sourceFile.statements.filter(
+		(statement): statement is TS.ExportAssignment =>
+			ts.isExportAssignment(statement) && !statement.isExportEquals,
+	);
+
+	// Phase-separated providers export a builder invocation directly. Preserve
+	// the previous locator's preference for that call over every defineProvider
+	// declaration that may also appear in the file.
+	for (const assignment of defaultExports) {
+		const expression = unwrapImplementationExpression(assignment.expression);
+		if (!ts.isCallExpression(expression)) {
+			continue;
+		}
+		if (resolveDefineProviderImplementationCall(expression) !== undefined) {
+			continue;
+		}
+		if (ts.isIdentifier(expression.expression)) {
+			return expression;
+		}
+	}
+
+	// For `defineProvider(metadata)(implementation)`, select the outer call whose
+	// argument is the implementation. A plain `defineProvider(implementation)`
+	// selects the single call itself.
+	for (const assignment of defaultExports) {
+		const defaultExpression = unwrapImplementationExpression(assignment.expression);
+		if (!ts.isCallExpression(defaultExpression)) {
+			continue;
+		}
+		const implementationCall = resolveDefineProviderImplementationCall(defaultExpression);
+		if (implementationCall !== undefined) {
+			return implementationCall;
+		}
+	}
+
+	// Resolve `export default provider` to a top-level variable initialized by
+	// defineProvider, including its curried implementation call when present.
+	for (const assignment of defaultExports) {
+		if (!ts.isIdentifier(assignment.expression)) {
+			continue;
+		}
+		const exportedName = assignment.expression.text;
+		for (const statement of sourceFile.statements) {
+			if (!ts.isVariableStatement(statement)) {
+				continue;
+			}
+			for (const declaration of statement.declarationList.declarations) {
+				if (
+					!ts.isIdentifier(declaration.name) ||
+					declaration.name.text !== exportedName ||
+					declaration.initializer === undefined
+				) {
+					continue;
+				}
+				if (!ts.isCallExpression(declaration.initializer)) {
+					continue;
+				}
+				const implementationCall = resolveDefineProviderImplementationCall(declaration.initializer);
+				if (implementationCall !== undefined) {
+					return implementationCall;
+				}
+			}
+		}
+	}
+
+	// Structural fixtures without a recognizable default export retain the
+	// previous fallback to the first defineProvider call in source order.
+	let firstCall: TS.CallExpression | undefined;
+	const visit = (node: TS.Node): void => {
+		if (firstCall !== undefined) {
+			return;
+		}
+		if (ts.isCallExpression(node)) {
+			const implementationCall = resolveDefineProviderImplementationCall(node);
+			if (implementationCall !== undefined) {
+				firstCall = implementationCall;
+				return;
+			}
+		}
+		ts.forEachChild(node, visit);
+	};
+	visit(sourceFile);
+	return firstCall;
+}
+
+function unwrapImplementationExpression(expression: TS.Expression): TS.Expression {
+	let current = expression;
+	while (
+		ts.isSatisfiesExpression(current) ||
+		ts.isAsExpression(current) ||
+		ts.isParenthesizedExpression(current) ||
+		ts.isNonNullExpression(current)
+	) {
+		current = current.expression;
+	}
+	return current;
+}
+
+function isOperationsProperty(
+	property: TS.ObjectLiteralElementLike,
+): property is TS.PropertyAssignment | TS.ShorthandPropertyAssignment {
+	if (ts.isShorthandPropertyAssignment(property)) {
+		return property.name.text === "operations";
+	}
+	if (!ts.isPropertyAssignment(property)) {
+		return false;
+	}
+	return (
+		(ts.isIdentifier(property.name) || ts.isStringLiteral(property.name)) &&
+		property.name.text === "operations"
+	);
+}
+
+function isOperationsAccessorOrMethod(
+	property: TS.ObjectLiteralElementLike,
+): property is TS.GetAccessorDeclaration | TS.SetAccessorDeclaration | TS.MethodDeclaration {
+	if (
+		!ts.isGetAccessorDeclaration(property) &&
+		!ts.isSetAccessorDeclaration(property) &&
+		!ts.isMethodDeclaration(property)
+	) {
+		return false;
+	}
+	return (
+		(ts.isIdentifier(property.name) || ts.isStringLiteral(property.name)) &&
+		property.name.text === "operations"
+	);
+}
+
+function isSourceEnumerableStaticObjectLiteral(expression: TS.Expression): boolean {
+	const unwrapped = unwrapImplementationExpression(expression);
+	if (!ts.isObjectLiteralExpression(unwrapped)) {
+		return false;
+	}
+	return unwrapped.properties.every((property) => {
+		if (ts.isSpreadAssignment(property)) {
+			return isSourceEnumerableStaticObjectLiteral(property.expression);
+		}
+		if (property.name === undefined || ts.isComputedPropertyName(property.name)) {
+			return property.name === undefined;
+		}
+		return property.name.text !== "operations" || isOperationsProperty(property);
+	});
+}
+
+function findComputedImplementationProperty(
+	objectLiteral: TS.ObjectLiteralExpression,
+): TS.ObjectLiteralElementLike | undefined {
+	for (const property of objectLiteral.properties) {
+		if (property.name !== undefined && ts.isComputedPropertyName(property.name)) {
+			return property;
+		}
+		if (ts.isSpreadAssignment(property)) {
+			const spreadExpression = unwrapImplementationExpression(property.expression);
+			if (ts.isObjectLiteralExpression(spreadExpression)) {
+				const nested = findComputedImplementationProperty(spreadExpression);
+				if (nested !== undefined) {
+					return nested;
+				}
+			}
+		}
+	}
+	return undefined;
+}
+
+function findEffectiveOperationsProperty(
+	objectLiteral: TS.ObjectLiteralExpression,
+):
+	| TS.PropertyAssignment
+	| TS.ShorthandPropertyAssignment
+	| TS.GetAccessorDeclaration
+	| TS.SetAccessorDeclaration
+	| TS.MethodDeclaration
+	| undefined {
+	let effective:
+		| TS.PropertyAssignment
+		| TS.ShorthandPropertyAssignment
+		| TS.GetAccessorDeclaration
+		| TS.SetAccessorDeclaration
+		| TS.MethodDeclaration
+		| undefined;
+	for (const property of objectLiteral.properties) {
+		if (isOperationsProperty(property) || isOperationsAccessorOrMethod(property)) {
+			effective = property;
+			continue;
+		}
+		if (ts.isSpreadAssignment(property)) {
+			const spreadExpression = unwrapImplementationExpression(property.expression);
+			if (ts.isObjectLiteralExpression(spreadExpression)) {
+				const nested = findEffectiveOperationsProperty(spreadExpression);
+				if (nested !== undefined) {
+					effective = nested;
+				}
+			}
+		}
+	}
+	return effective;
+}
+
 function scoreFlatOperationComposition(providerRoot: string): SubmitCheck {
 	const indexPath = resolve(providerRoot, "index.ts");
 	const ruleId = "flat-operation-composition";
@@ -1182,10 +1956,23 @@ function scoreFlatOperationComposition(providerRoot: string): SubmitCheck {
 	}
 
 	const source = readFileSync(indexPath, "utf8");
-	// Use the same whitespace-tolerant detection as the resolver below, so a
-	// `defineProvider (` / `defineProvider\n(` formatting cannot pass the early
-	// exit before the real classification runs.
-	if (!/\bdefineProvider\s*\(/.test(source)) {
+	const indexRelPath = toRelativeProviderPath(providerRoot, indexPath);
+	// The report preflight already rejects unparseable index.ts sources before
+	// this rule runs, so this local AST parse only replaces property location.
+	const sourceFile = ts.createSourceFile(
+		indexRelPath,
+		source,
+		ts.ScriptTarget.Latest,
+		true,
+		ts.ScriptKind.TS,
+	);
+	const implementationCall = findProviderImplementationCall(sourceFile);
+	const rawImplementationArg = implementationCall?.arguments[0];
+	const implementationArg =
+		rawImplementationArg === undefined
+			? undefined
+			: unwrapImplementationExpression(rawImplementationArg);
+	if (implementationArg === undefined || !ts.isObjectLiteralExpression(implementationArg)) {
 		return pass(
 			ruleId,
 			SDK_NATIVE_CATEGORY,
@@ -1194,69 +1981,73 @@ function scoreFlatOperationComposition(providerRoot: string): SubmitCheck {
 		);
 	}
 
-	// Scope the scan to the argument of the EXPORTED `defineProvider(...)` call.
-	// A provider can contain helper/non-exported defineProvider calls before the
-	// real default export (e.g. test scaffolds), so resolve the default export
-	// rather than blindly taking the first regex match. Resolution order:
-	//   1. `export default defineProvider(` — inline default export
-	//   2. `export default <ident>` then `const <ident> = defineProvider(`
-	//   3. fallback: first `defineProvider(` in the file
-	let defineParenIndex = -1;
-	const inlineDefault = /\bexport\s+default\s+defineProvider\s*\(/.exec(source);
-	if (inlineDefault) {
-		defineParenIndex = inlineDefault.index + inlineDefault[0].length - 1; // points at `(`
-	} else {
-		const namedDefault = /\bexport\s+default\s+([A-Za-z_$][\w$]*)\s*;?/.exec(source);
-		const exportedName = namedDefault?.[1];
-		if (exportedName !== undefined) {
-			const namedDecl = new RegExp(
-				`(?:^|\\n)[ \t]*(?:export\\s+)?(?:const|let|var)\\s+${exportedName}\\s*(?::[^=\\n]+)?\\s*=\\s*defineProvider\\s*\\(`,
-			).exec(source);
-			if (namedDecl) {
-				defineParenIndex = namedDecl.index + namedDecl[0].length - 1;
-			}
-		}
-		if (defineParenIndex === -1) {
-			const firstCall = /\bdefineProvider\s*\(/.exec(source);
-			if (firstCall) {
-				defineParenIndex = firstCall.index + firstCall[0].length - 1;
-			}
-		}
+	// Resolve the top-level operations property from the AST, then feed its raw
+	// initializer offset into the existing expression classifier and alias
+	// resolver unchanged.
+	const opsProp = findEffectiveOperationsProperty(implementationArg);
+	let opsValue: ExpressionSlice | undefined;
+	let opsLine = 1;
+	if (opsProp !== undefined && ts.isPropertyAssignment(opsProp)) {
+		const valueStart = opsProp.initializer.getStart(sourceFile);
+		opsValue = unwrapParens(balancedExpressionSlice(source, valueStart, indexRelPath));
+		opsLine = offsetToLine(source, valueStart);
 	}
-	if (defineParenIndex === -1) {
-		return pass(
+
+	// Property shorthand: `buildProvider({ operations })` — resolve the
+	// local `operations` const initializer.
+	let aliasName: string | undefined;
+	if (opsProp !== undefined && ts.isShorthandPropertyAssignment(opsProp)) {
+		aliasName = "operations";
+	} else if (opsValue !== undefined && /^[A-Za-z_$][\w$]*$/.test(opsValue.masked)) {
+		// `operations: ops` — a bare identifier alias to resolve.
+		aliasName = opsValue.raw;
+	}
+
+	// A computed property might resolve to `operations`, but its composition is
+	// not source-enumerable here. Fail closed, like an unresolved imported alias.
+	const computed = findComputedImplementationProperty(implementationArg);
+	if (computed !== undefined) {
+		const computedLine = offsetToLine(source, computed.getStart(sourceFile));
+		return blocker(
 			ruleId,
 			SDK_NATIVE_CATEGORY,
-			"No defineProvider call to evaluate for operation composition.",
+			"The defineProvider operations property uses a computed property name that cannot be statically resolved.",
+			"Declare operations with the literal property name `operations` and a static object literal value so the provider-registry AST gate can enumerate it.",
 			0,
+			[`${indexRelPath}:${computedLine} (computed property name)`],
 		);
 	}
-	const argStart = defineParenIndex + 1;
-	const argText = balancedValueExpression(source, argStart);
 
-	// Resolve the value passed as `operations:` inside the defineProvider call,
-	// following one alias hop. The value is classified as a static object
-	// literal (pass) or a factory/call expression (block). The regex index is
-	// offset back into the full source so line numbers stay accurate.
-	const opsProp = /\boperations\s*:\s*/.exec(argText);
-	let opsValue: string | undefined;
-	let opsLine = 1;
-	if (opsProp) {
-		const valueStart = argStart + opsProp.index + opsProp[0].length;
-		opsValue = unwrapParens(balancedValueExpression(source, valueStart).trim());
-		opsLine = offsetToLine(source, valueStart);
+	if (opsProp !== undefined && isOperationsAccessorOrMethod(opsProp)) {
+		const memberLine = offsetToLine(source, opsProp.getStart(sourceFile));
+		return blocker(
+			ruleId,
+			SDK_NATIVE_CATEGORY,
+			"The defineProvider operations member is an accessor/method whose value is not statically enumerable.",
+			"Declare operations as a property assignment with a static object literal value so the provider-registry AST gate can enumerate it.",
+			0,
+			[`${indexRelPath}:${memberLine} (operations accessor/method)`],
+		);
 	}
 
-	// Property shorthand: `defineProvider({ ..., operations })` — resolve the
-	// local `operations` const initializer.
-	let aliasName: string | undefined;
-	if (opsValue === undefined) {
-		if (/\boperations\s*[,}]/.test(argText)) {
-			aliasName = "operations";
-		}
-	} else if (/^[A-Za-z_$][\w$]*$/.test(opsValue)) {
-		// `operations: ops` — a bare identifier alias to resolve.
-		aliasName = opsValue;
+	// A spread can override a preceding literal `operations` property. Only an
+	// inline static object literal (including recursively inline static spreads)
+	// exposes all of its property names to this source-only gate. Identifiers,
+	// calls, and other expressions are opaque and therefore fail closed.
+	const opaqueSpread = implementationArg.properties.find(
+		(property): property is TS.SpreadAssignment =>
+			ts.isSpreadAssignment(property) &&
+			!isSourceEnumerableStaticObjectLiteral(property.expression),
+	);
+	if (opaqueSpread !== undefined) {
+		const spreadLine = offsetToLine(source, opaqueSpread.getStart(sourceFile));
+		return escapeHatchResult(providerRoot, ruleId, [{ file: indexRelPath, line: spreadLine }], {
+			blockerMessage:
+				"The defineProvider implementation uses a non-enumerable spread that could override operations.",
+			remediation:
+				"Declare operations directly with a static object literal. Implementation spreads must be inline static object literals so the provider-registry AST gate can enumerate every property name.",
+			passMessage: "defineProvider declares operations as a static object literal.",
+		});
 	}
 
 	// Determine the effective initializer expression to classify. The alias may
@@ -1290,7 +2081,7 @@ function scoreFlatOperationComposition(providerRoot: string): SubmitCheck {
 		// do not resolve the exact import target path; "any same-named factory
 		// blocks" is the conservative, false-negative-avoiding choice for a gate.)
 		type Candidate = {
-			expr: string;
+			expr: ExpressionSlice;
 			line: number;
 			file: string;
 			isFactory: boolean;
@@ -1300,15 +2091,18 @@ function scoreFlatOperationComposition(providerRoot: string): SubmitCheck {
 			if (!existsSync(filePath)) {
 				continue;
 			}
-			const fileSource = filePath === indexPath ? source : readFileSync(filePath, "utf8");
 			const relPath = toRelativeProviderPath(providerRoot, filePath);
+			const fileSource = filePath === indexPath ? source : readFileSync(filePath, "utf8");
+			const maskedFileSource = maskCommentsAndStrings(fileSource, relPath, {
+				blankPropertyKeys: true,
+			});
 
 			const declRe = new RegExp(aliasDecl.source, "g");
-			for (let m = declRe.exec(fileSource); m !== null; m = declRe.exec(fileSource)) {
+			for (let m = declRe.exec(maskedFileSource); m !== null; m = declRe.exec(maskedFileSource)) {
 				const valueStart = m.index + m[0].length;
-				const expr = unwrapParens(balancedValueExpression(fileSource, valueStart).trim());
+				const expr = unwrapParens(balancedExpressionSlice(fileSource, valueStart, relPath));
 				const isFactory =
-					(/^[A-Za-z_$][\w$.]*\s*\(/.test(expr) || hasTopLevelFactorySpread(expr)) &&
+					(/^[A-Za-z_$][\w$.]*\s*\(/.test(expr.masked) || hasTopLevelFactorySpread(expr)) &&
 					!isTransparentObjectReshape(expr);
 				candidates.push({
 					expr,
@@ -1318,9 +2112,14 @@ function scoreFlatOperationComposition(providerRoot: string): SubmitCheck {
 				});
 			}
 			const destructRe = new RegExp(destructured.source, "g");
-			for (let m = destructRe.exec(fileSource); m !== null; m = destructRe.exec(fileSource)) {
+			for (
+				let m = destructRe.exec(maskedFileSource);
+				m !== null;
+				m = destructRe.exec(maskedFileSource)
+			) {
+				const raw = `${m[1]}(`;
 				candidates.push({
-					expr: `${m[1]}(`,
+					expr: { raw, masked: raw },
 					line: offsetToLine(fileSource, m.index),
 					file: relPath,
 					isFactory: true,
@@ -1346,11 +2145,15 @@ function scoreFlatOperationComposition(providerRoot: string): SubmitCheck {
 		// the unresolved import as a factory-composed (non-static) shape rather
 		// than silently passing.
 		if (!resolved) {
+			const maskedIndexSource = maskCommentsAndStrings(source, indexRelPath, {
+				blankPropertyKeys: true,
+			});
 			const importMatch = new RegExp(`\\bimport\\b[^;]*\\b${aliasName}\\b[^;]*\\bfrom\\b`).exec(
-				source,
+				maskedIndexSource,
 			);
 			if (importMatch) {
-				effective = `${aliasName}(`;
+				const raw = `${aliasName}(`;
+				effective = { raw, masked: raw };
 				effectiveLine = offsetToLine(source, importMatch.index);
 				effectiveFile = "index.ts";
 			}
@@ -1374,14 +2177,16 @@ function scoreFlatOperationComposition(providerRoot: string): SubmitCheck {
 			spreadIdentifierResolvesToFactory(providerRoot, indexPath, source, name),
 		);
 	const isStaticLiteral =
-		effective?.startsWith("{") === true && !hasFactorySpread && !hasFactorySpreadIdentifier;
+		effective?.masked.startsWith("{") === true && !hasFactorySpread && !hasFactorySpreadIdentifier;
 	// A call expression `ident(...)` (factory) or a factory-spread literal is
 	// the rejected, non-static shape — UNLESS it is the stdlib
 	// `Object.fromEntries(Object.entries(<source-visible obj>)...)` reshape,
 	// whose op set is still enumerable from source (verified golden pattern).
 	const isFactoryCall =
 		effective !== undefined &&
-		(/^[A-Za-z_$][\w$.]*\s*\(/.test(effective) || hasFactorySpread || hasFactorySpreadIdentifier) &&
+		(/^[A-Za-z_$][\w$.]*\s*\(/.test(effective.masked) ||
+			hasFactorySpread ||
+			hasFactorySpreadIdentifier) &&
 		!isTransparentObjectReshape(effective);
 
 	if (isFactoryCall && !isStaticLiteral) {
@@ -1393,7 +2198,7 @@ function scoreFlatOperationComposition(providerRoot: string): SubmitCheck {
 			blockerMessage:
 				"defineProvider operations are composed by a factory call instead of a static object literal.",
 			remediation:
-				"Declare operations as a static literal: defineProvider({ operations: { 'op-id': defineOperation({...}) } }). The provider-registry AST gate requires static runtime/operations; factory composition fails the registry build. If composition is unavoidable, add `// @apifuse-allow flat-operation-composition: <reason>`.",
+				"Declare operations as a static literal in the provider builder call. The provider-registry AST gate requires static runtime/operations; factory composition fails the registry build. If composition is unavoidable, add `// @apifuse-allow flat-operation-composition: <reason>`.",
 			passMessage: "defineProvider declares operations as a static object literal.",
 		});
 	}
@@ -1407,7 +2212,7 @@ function scoreFlatOperationComposition(providerRoot: string): SubmitCheck {
 }
 
 function scoreCredentialUsage(providerRoot: string, provider: ProviderDefinition): SubmitCheck {
-	const credentialReferences = findSourceLineMatches(providerRoot, /ctx\.credential/);
+	const credentialReferences = findCredentialReferences(providerRoot);
 	const authMode = provider.auth?.mode ?? "none";
 	const credentialKeys = provider.credential?.keys ?? [];
 	const storesProviderCredential = authMode !== "none" || credentialKeys.length > 0;
@@ -1437,6 +2242,107 @@ function scoreCredentialUsage(providerRoot: string, provider: ProviderDefinition
 	);
 }
 
+function isDirectCredentialReference(expression: TS.Expression): boolean {
+	const reference = unwrapLocalExpression(expression);
+	let receiver: TS.Expression | undefined;
+	let memberName: string | undefined;
+	if (ts.isPropertyAccessExpression(reference)) {
+		receiver = reference.expression;
+		memberName = reference.name.text;
+	} else if (ts.isElementAccessExpression(reference)) {
+		receiver = reference.expression;
+		const argument = reference.argumentExpression;
+		if (
+			argument !== undefined &&
+			(ts.isStringLiteral(argument) || ts.isNoSubstitutionTemplateLiteral(argument))
+		) {
+			memberName = argument.text;
+		}
+	}
+	const unwrappedReceiver = receiver === undefined ? undefined : unwrapLocalExpression(receiver);
+	return (
+		memberName === "credential" &&
+		unwrappedReceiver !== undefined &&
+		ts.isIdentifier(unwrappedReceiver) &&
+		unwrappedReceiver.text === "ctx"
+	);
+}
+
+function isCredentialReference(
+	expression: TS.Expression,
+	bindings: LocalBindings,
+	resolving: ReadonlySet<LocalBinding> = new Set(),
+): boolean {
+	const reference = unwrapLocalExpression(expression);
+	if (isDirectCredentialReference(reference)) {
+		return true;
+	}
+	if (!ts.isIdentifier(reference)) {
+		return false;
+	}
+	const localBindings = lookupLocalBindings(reference, bindings);
+	if (localBindings === undefined || localBindings.length === 0) {
+		return false;
+	}
+	return localBindings.every((binding) => {
+		if (resolving.has(binding) || binding.mutable || binding.initializer === undefined) {
+			return false;
+		}
+		const nextResolving = new Set(resolving);
+		nextResolving.add(binding);
+		if (binding.destructuredProperty !== undefined) {
+			const source = unwrapLocalExpression(binding.initializer);
+			return (
+				binding.destructuredProperty === "credential" &&
+				ts.isIdentifier(source) &&
+				source.text === "ctx"
+			);
+		}
+		return isCredentialReference(binding.initializer, bindings, nextResolving);
+	});
+}
+
+function findCredentialReferences(providerRoot: string): SourceFinding[] {
+	const findings: SourceFinding[] = [];
+	const seen = new Set<string>();
+	for (const filePath of listNonTestTypeScriptFiles(providerRoot)) {
+		const source = readFileSync(filePath, "utf8");
+		const relPath = toRelativeProviderPath(providerRoot, filePath);
+		const sourceFile = ts.createSourceFile(
+			relPath,
+			source,
+			ts.ScriptTarget.Latest,
+			true,
+			ts.ScriptKind.TS,
+		);
+		const bindings = collectLocalBindings(sourceFile);
+		const visit = (node: TS.Node): void => {
+			if (findings.length >= MAX_SOURCE_FINDING_EVIDENCE) {
+				return;
+			}
+			if (
+				ts.isExpression(node) &&
+				(isDirectCredentialReference(node) ||
+					((ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) &&
+						isCredentialReference(node.expression, bindings)))
+			) {
+				const line = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile)).line + 1;
+				const key = `${relPath}:${line}`;
+				if (!seen.has(key)) {
+					seen.add(key);
+					findings.push({ file: relPath, line });
+				}
+			}
+			ts.forEachChild(node, visit);
+		};
+		visit(sourceFile);
+		if (findings.length >= MAX_SOURCE_FINDING_EVIDENCE) {
+			break;
+		}
+	}
+	return findings;
+}
+
 // ---------------------------------------------------------------------------
 // sdk-owned-secret-presence (warn): provider-local double validation of
 // declared env secrets.
@@ -1593,23 +2499,34 @@ function scoreSdkOwnedSecretPresence(
 function findSourceLineMatches(
 	providerRoot: string,
 	pattern: RegExp | ((line: string) => boolean),
+	useMaskedSource = false,
 ): SourceFinding[] {
-	return findSourceFindings(providerRoot, (line) => matchesLinePattern(line, pattern));
+	return findSourceFindings(
+		providerRoot,
+		(line) => matchesLinePattern(line, pattern),
+		useMaskedSource,
+	);
 }
 
 function findSourceFindings(
 	providerRoot: string,
 	matchesLine: (line: string, remainingLines: readonly string[]) => boolean,
+	useMaskedSource = false,
 ): SourceFinding[] {
 	const findings: SourceFinding[] = [];
 	for (const filePath of listNonTestTypeScriptFiles(providerRoot)) {
 		const content = readFileSync(filePath, "utf8");
-		const lines = content.split(/\r?\n/);
+		const relPath = toRelativeProviderPath(providerRoot, filePath);
+		const lines = (
+			useMaskedSource
+				? maskCommentsAndStrings(content, relPath, { blankPropertyKeys: true })
+				: content
+		).split(/\r?\n/);
 		for (let index = 0; index < lines.length; index += 1) {
 			const line = lines[index];
 			if (line !== undefined && matchesLine(line, lines.slice(index + 1))) {
 				findings.push({
-					file: toRelativeProviderPath(providerRoot, filePath),
+					file: relPath,
 					line: index + 1,
 				});
 				if (findings.length >= MAX_SOURCE_FINDING_EVIDENCE) {
@@ -1689,12 +2606,25 @@ function isScannableProviderSourceFile(relativePath: string): boolean {
 	);
 }
 
+const EXCLUDED_SOURCE_DIRECTORY_SEGMENTS = new Set([
+	".git",
+	".worktree",
+	"node_modules",
+	"dist",
+	"build",
+	"coverage",
+]);
+
 // `.agents`/`.apifuse` stay IN scope on purpose: managed content there is
 // markdown/JSON (never scannable), while a planted `.ts`/`.sh` under those
 // directories must not become a scan-exempt hiding place for secrets, raw
-// fetch, or vendor imports.
+// fetch, or vendor imports. Nested dependency/build output directories under
+// them use the same segment exclusions; `.worktree` is excluded because task
+// worktrees are duplicate repository checkouts, not provider source.
 function shouldScanSourceDirectory(relativePath: string): boolean {
-	return ![".git", "node_modules", "dist", "build", "coverage"].includes(relativePath);
+	return relativePath
+		.split("/")
+		.every((segment) => !EXCLUDED_SOURCE_DIRECTORY_SEGMENTS.has(segment));
 }
 
 function isExcludedTestSource(relativePath: string): boolean {
@@ -1712,7 +2642,10 @@ function toRelativeProviderPath(providerRoot: string, filePath: string): string
 }
 
 function formatSourceFindings(findings: readonly SourceFinding[]): string[] {
-	return findings.map((finding) => `${finding.file}:${finding.line}`);
+	return findings.map(
+		(finding) =>
+			`${finding.file}:${finding.line}${finding.detail === undefined ? "" : `: ${finding.detail}`}`,
+	);
 }
 
 function scorePromptAssetFreshness(providerRoot: string): SubmitCheck {
@@ -1808,7 +2741,7 @@ async function safeRunChecks(providerRoot: string): Promise<CheckResult[]> {
 			{
 				message: "Base provider checks can run",
 				passed: false,
-				details: [error instanceof Error ? error.message : String(error)],
+				details: [formatThrownValue(error)],
 			},
 		];
 	}
@@ -2033,13 +2966,17 @@ function collectProviderRequiredLocaleKeys(provider: ProviderDefinition): string
 
 	for (const operation of Object.values(provider.operations)) {
 		addLocaleKeys(keys, [
+			operation.titleKey,
 			operation.descriptionKey,
-			operation.docs?.titleKey,
-			operation.docs?.descriptionKey,
-			operation.docs?.summaryKey,
-			operation.docs?.markdownKey,
+			operation.summaryKey,
+			operation.markdownKey,
 			...(operation.whenToUseKeys ?? []),
 			...(operation.whenNotToUseKeys ?? []),
+			...(operation.normalizationNotesKeys ?? []),
+			...(operation.examples ?? []).flatMap((example) => [
+				example.scenarioKey,
+				example.rationaleKey,
+			]),
 			...collectSchemaDescriptionKeys(operation.input),
 			...collectSchemaDescriptionKeys(operation.output),
 		]);
@@ -2106,8 +3043,8 @@ function scoreOperationMetadata(provider: ProviderDefinition): SubmitCheck {
 			return true;
 		})
 		.map(([operationId]) => operationId);
-	const missingAnnotations = operations
-		.filter(([, operation]) => !operation.annotations)
+	const missingRiskClass = operations
+		.filter(([, operation]) => !operation.riskClass)
 		.map(([operationId]) => operationId);
 
 	if (weakDescriptions.length > 0) {
@@ -2119,30 +3056,30 @@ function scoreOperationMetadata(provider: ProviderDefinition): SubmitCheck {
 			points: 0,
 			maxPoints: CATEGORY_MAX_POINTS.operations,
 			message: "One or more operations have weak descriptions.",
-			remediation: `For ${weakDescriptions.join(", ")}, add an operation \`descriptionKey\` backed by \`locales/en.json\` and \`locales/ko.json\`, or add a 150+ character \`description\` explaining when to use it, when not to use it, outputs, and caveats.`,
+			remediation: `For ${weakDescriptions.join(", ")}, add an operation \`descriptionKey\` backed by \`locales/en.json\` and \`locales/ko.json\`.`,
 			evidence: weakDescriptions,
 		};
 	}
 
-	const points = missingAnnotations.length > 0 ? 11 : CATEGORY_MAX_POINTS.operations;
+	const points = missingRiskClass.length > 0 ? 11 : CATEGORY_MAX_POINTS.operations;
 	return {
 		id: "operation-metadata",
 		category: "operations",
-		level: missingAnnotations.length > 0 ? "warn" : "info",
-		status: missingAnnotations.length > 0 ? "warn" : "pass",
+		level: missingRiskClass.length > 0 ? "warn" : "info",
+		status: missingRiskClass.length > 0 ? "warn" : "pass",
 		points,
 		maxPoints: CATEGORY_MAX_POINTS.operations,
 		message:
-			missingAnnotations.length > 0
-				? "Operations are described, but some are missing safety annotations."
+			missingRiskClass.length > 0
+				? "Operations are described, but some are missing a safety classification."
 				: "Operation descriptions and metadata are review-ready.",
 		remediation:
-			missingAnnotations.length > 0
-				? `For ${missingAnnotations.join(", ")}, add \`annotations\` with the applicable safety fields, such as \`readOnly\`, \`destructive\`, \`idempotent\`, \`openWorld\`, \`rateLimit\`, or \`timeoutMs\`.`
+			missingRiskClass.length > 0
+				? `For ${missingRiskClass.join(", ")}, declare the operation's required \`riskClass\` as \`read\`, \`write\`, \`destructive\`, or \`external-send\`.`
 				: undefined,
 		evidence:
-			missingAnnotations.length > 0
-				? missingAnnotations.map((operationId) => `${operationId}: missing annotations`)
+			missingRiskClass.length > 0
+				? missingRiskClass.map((operationId) => `${operationId}: missing riskClass`)
 				: operations.map(([operationId]) => operationId),
 	};
 }
@@ -2174,11 +3111,16 @@ const GENERATED_LOCAL_ONLY_SCAFFOLD_REASON = /generated local-only scaffold/i;
 function scoreFixtureProvenance(providerRoot: string, provider: ProviderDefinition): SubmitCheck {
 	const rawPath = resolve(providerRoot, "__fixtures__", "raw.json");
 	let hasRecordedEvidence = false;
+	let fixtureValidationError: string | undefined;
 	if (existsSync(rawPath)) {
 		try {
-			hasRecordedEvidence = hasNonEmptyRecordedFixture(JSON.parse(readFileSync(rawPath, "utf8")));
-		} catch {
+			hasRecordedEvidence = recordedFixtureStats(
+				JSON.parse(readFileSync(rawPath, "utf8")),
+				0,
+			).hasNestedSubstance;
+		} catch (error) {
 			hasRecordedEvidence = false;
+			fixtureValidationError = error instanceof Error ? error.message : String(error);
 		}
 	}
 
@@ -2190,6 +3132,16 @@ function scoreFixtureProvenance(providerRoot: string, provider: ProviderDefiniti
 			0,
 		);
 	}
+	if (fixtureValidationError) {
+		return blocker(
+			"fixture-provenance",
+			"fixtures",
+			`Malformed recorded fixture evidence in __fixtures__/raw.json: ${fixtureValidationError}`,
+			"Re-run `bun run record` to replace the malformed stream evidence, or repair the named field using the stream evidence contract.",
+			0,
+			["__fixtures__/raw.json"],
+		);
+	}
 
 	if (allOperationsAreGeneratedLocalScaffold(provider)) {
 		return {
@@ -2217,14 +3169,32 @@ function scoreFixtureProvenance(providerRoot: string, provider: ProviderDefiniti
 	);
 }
 
-function hasNonEmptyRecordedFixture(value: unknown): boolean {
-	return recordedFixtureStats(value, 0).hasNestedSubstance;
+export function hasNonEmptyRecordedFixture(value: unknown): boolean {
+	try {
+		return recordedFixtureStats(value, 0).hasNestedSubstance;
+	} catch {
+		return false;
+	}
 }
 
 function recordedFixtureStats(
 	value: unknown,
 	depth: number,
 ): { hasNestedSubstance: boolean; leafValues: number } {
+	if (
+		value !== null &&
+		typeof value === "object" &&
+		!Array.isArray(value) &&
+		(value as Record<string, unknown>).__apifuse_capture__ === true
+	) {
+		const group = findStreamCaptureGroup(value);
+		if (!group) throw new Error("Stream capture envelope is invalid.");
+		return { hasNestedSubstance: true, leafValues: group.items.length };
+	}
+	if (hasStreamEvidenceMarker(value)) {
+		parseStreamEvidenceRecord(value);
+		return { hasNestedSubstance: true, leafValues: 1 };
+	}
 	if (value === null || value === undefined) {
 		return { hasNestedSubstance: false, leafValues: 0 };
 	}
@@ -2259,10 +3229,14 @@ function recordedFixtureStats(
 		if (value.length === 0) {
 			return { hasNestedSubstance: false, leafValues: 0 };
 		}
-		// A recorded operation value may be a raw XML success payload; treat a
-		// substantive, well-formed one as nested evidence while still counting the
-		// string as a leaf so existing JSON provenance heuristics are unchanged.
-		return { hasNestedSubstance: hasSubstantiveXmlStructure(value), leafValues: 1 };
+		// A recorded operation value may be a raw XML or delimited-text success
+		// payload. Treat a substantive one as nested evidence while still counting
+		// the string as a leaf so existing JSON provenance heuristics are unchanged.
+		return {
+			hasNestedSubstance:
+				hasSubstantiveXmlStructure(value) || hasSubstantiveDelimitedTextStructure(value),
+			leafValues: 1,
+		};
 	}
 	return { hasNestedSubstance: false, leafValues: 1 };
 }
@@ -2327,19 +3301,32 @@ function findVendorKeyLeakFindings(providerRoot: string): SourceFinding[] {
 	for (const filePath of listNonTestTypeScriptFiles(providerRoot)) {
 		const source = readFileSync(filePath, "utf8");
 		const relPath = toRelativeProviderPath(providerRoot, filePath);
+		maskCommentsAndStrings(source, relPath);
+		const sourceFile = ts.createSourceFile(
+			relPath,
+			source,
+			ts.ScriptTarget.Latest,
+			true,
+			ts.ScriptKind.TS,
+		);
+		const bindings = collectLocalBindings(sourceFile);
 		const upstreamRanges = findUpstreamMarkedConstRanges(source);
 		for (const zObject of findZObjectLiterals(source)) {
 			if (rangeContainsOffset(upstreamRanges, zObject.callStart)) {
 				continue;
 			}
-			if (!zObjectAppearsPublicOutput(source, zObject)) {
+			if (!zObjectAppearsPublicOutput(sourceFile, zObject, relPath)) {
 				continue;
 			}
-			for (const keyFinding of vendorKeyFindingsForObject(source, zObject)) {
+			for (const keyFinding of vendorKeyFindingsForObject(source, sourceFile, zObject, bindings)) {
 				const key = `${relPath}:${keyFinding.line}:${keyFinding.key}`;
 				if (!seen.has(key)) {
 					seen.add(key);
-					findings.push({ file: relPath, line: keyFinding.line });
+					findings.push({
+						file: relPath,
+						line: keyFinding.line,
+						detail: keyFinding.key,
+					});
 					if (findings.length >= MAX_SOURCE_FINDING_EVIDENCE) {
 						return findings;
 					}
@@ -2375,20 +3362,260 @@ function findZObjectLiterals(source: string): ZObjectLiteral[] {
 	return literals;
 }
 
-function zObjectAppearsPublicOutput(source: string, zObject: ZObjectLiteral): boolean {
-	const enclosingConst = findConstValueRangeContaining(source, zObject.callStart);
-	if (enclosingConst && /output|response|result/i.test(enclosingConst.name)) {
+function zObjectAppearsPublicOutput(
+	sourceFile: TS.SourceFile,
+	zObject: ZObjectLiteral,
+	relPath: string,
+): boolean {
+	let zObjectCall: TS.CallExpression | undefined;
+	const findCall = (node: TS.Node): void => {
+		if (
+			zObjectCall === undefined &&
+			ts.isCallExpression(node) &&
+			node.getStart(sourceFile) === zObject.callStart
+		) {
+			zObjectCall = node;
+			return;
+		}
+		ts.forEachChild(node, findCall);
+	};
+	findCall(sourceFile);
+	if (zObjectCall === undefined) {
+		return true;
+	}
+
+	let expression: TS.Expression = zObjectCall;
+	while (
+		ts.isParenthesizedExpression(expression.parent) ||
+		ts.isAsExpression(expression.parent) ||
+		ts.isSatisfiesExpression(expression.parent) ||
+		ts.isNonNullExpression(expression.parent)
+	) {
+		expression = expression.parent;
+	}
+	if (
+		ts.isPropertyAssignment(expression.parent) &&
+		isPublicOutputPropertyName(expression.parent.name)
+	) {
+		return true;
+	}
+
+	const declaration = findEnclosingVariableDeclaration(expression);
+	if (
+		declaration === undefined ||
+		!ts.isIdentifier(declaration.name) ||
+		declaration.initializer === undefined ||
+		!ts.isVariableDeclarationList(declaration.parent) ||
+		(declaration.parent.flags & ts.NodeFlags.Const) === 0
+	) {
+		return true;
+	}
+
+	const reachability = localSchemaBindingReachability(
+		sourceFile,
+		declaration.name.text,
+		declaration,
+		new Set(),
+	);
+	if (reachability === "public") {
+		return true;
+	}
+	if (reachability === "unknown") {
 		return true;
 	}
-	const before = source.slice(Math.max(0, zObject.callStart - 160), zObject.callStart);
-	return /(?:^|[\s,{])(?:output|response)\s*:\s*$/.test(before);
+	// Sibling modules are scanned independently and therefore remain
+	// fail-closed. An exported binding in index.ts is likewise consumable by
+	// another module, so local inertness does not prove it is private.
+	if (relPath !== "index.ts") {
+		return true;
+	}
+	return isExportedVariableBinding(sourceFile, declaration);
+}
+
+type SchemaReachability = "public" | "internal" | "unknown";
+
+const PARSE_LIKE_SCHEMA_METHODS: ReadonlySet<string> = new Set([
+	"parse",
+	"safeParse",
+	"parseAsync",
+	"safeParseAsync",
+]);
+
+function isExportedVariableBinding(
+	sourceFile: TS.SourceFile,
+	declaration: TS.VariableDeclaration,
+): boolean {
+	const declarationStatement = declaration.parent.parent;
+	if (
+		ts.isVariableStatement(declarationStatement) &&
+		declarationStatement.modifiers?.some(
+			(modifier) => modifier.kind === ts.SyntaxKind.ExportKeyword,
+		) === true
+	) {
+		return true;
+	}
+	if (!ts.isIdentifier(declaration.name)) {
+		return false;
+	}
+	const name = declaration.name.text;
+	let exported = false;
+	const visit = (node: TS.Node): void => {
+		if (exported) {
+			return;
+		}
+		if (ts.isExportSpecifier(node)) {
+			const localName = node.propertyName ?? node.name;
+			if (ts.isIdentifier(localName) && localName.text === name) {
+				exported = true;
+				return;
+			}
+		}
+		if (ts.isExportAssignment(node)) {
+			const expression = unwrapLocalExpression(node.expression);
+			if (ts.isIdentifier(expression) && expression.text === name) {
+				exported = true;
+				return;
+			}
+		}
+		ts.forEachChild(node, visit);
+	};
+	for (const statement of sourceFile.statements) {
+		visit(statement);
+		if (exported) {
+			break;
+		}
+	}
+	return exported;
+}
+
+function isPublicOutputPropertyName(name: TS.PropertyName): boolean {
+	const text = propertyNameText(name);
+	return text === "output" || text === "response";
+}
+
+function findEnclosingVariableDeclaration(node: TS.Node): TS.VariableDeclaration | undefined {
+	let current: TS.Node | undefined = node;
+	while (current !== undefined && !ts.isSourceFile(current)) {
+		if (ts.isVariableDeclaration(current)) {
+			return current;
+		}
+		current = current.parent;
+	}
+	return undefined;
+}
+
+function localSchemaBindingReachability(
+	sourceFile: TS.SourceFile,
+	name: string,
+	declaration: TS.VariableDeclaration,
+	resolving: ReadonlySet<string>,
+): SchemaReachability {
+	if (resolving.has(name)) {
+		return "unknown";
+	}
+	const nextResolving = new Set(resolving);
+	nextResolving.add(name);
+	let result: SchemaReachability = "internal";
+	const visit = (node: TS.Node): void => {
+		if (result === "public") {
+			return;
+		}
+		if (ts.isIdentifier(node) && node.text === name && node !== declaration.name) {
+			const parent = node.parent;
+			if (isParseLikeSchemaReceiver(node)) {
+				return;
+			}
+			if (ts.isExportSpecifier(parent)) {
+				const localName = parent.propertyName ?? parent.name;
+				if (localName === node) {
+					result = "public";
+				}
+				return;
+			}
+			if (
+				ts.isPropertyAssignment(parent) &&
+				parent.initializer === node &&
+				isPublicOutputPropertyName(parent.name)
+			) {
+				result = "public";
+				return;
+			}
+			if (ts.isShorthandPropertyAssignment(parent)) {
+				result = isPublicOutputPropertyName(parent.name) ? "public" : "unknown";
+				return;
+			}
+			if (
+				ts.isVariableDeclaration(parent) &&
+				parent.initializer === node &&
+				ts.isIdentifier(parent.name) &&
+				ts.isVariableDeclarationList(parent.parent) &&
+				(parent.parent.flags & ts.NodeFlags.Const) !== 0
+			) {
+				const aliasReachability = localSchemaBindingReachability(
+					sourceFile,
+					parent.name.text,
+					parent,
+					nextResolving,
+				);
+				if (aliasReachability === "public" || result === "internal") {
+					result = aliasReachability;
+				}
+				return;
+			}
+			if (ts.isVoidExpression(parent) || ts.isTypeOfExpression(parent)) {
+				return;
+			}
+			if (
+				(ts.isPropertyAccessExpression(parent) && parent.name === node) ||
+				(ts.isPropertyAssignment(parent) && parent.name === node) ||
+				ts.isBindingElement(parent) ||
+				ts.isImportSpecifier(parent)
+			) {
+				return;
+			}
+			result = "unknown";
+		}
+		ts.forEachChild(node, visit);
+	};
+	visit(sourceFile);
+	return result;
+}
+
+function isParseLikeSchemaReceiver(identifier: TS.Identifier): boolean {
+	const access = identifier.parent;
+	let methodName: string | undefined;
+	if (ts.isPropertyAccessExpression(access) && access.expression === identifier) {
+		methodName = access.name.text;
+	} else if (ts.isElementAccessExpression(access) && access.expression === identifier) {
+		const argument = access.argumentExpression;
+		if (
+			argument !== undefined &&
+			(ts.isStringLiteral(argument) || ts.isNoSubstitutionTemplateLiteral(argument))
+		) {
+			methodName = argument.text;
+		}
+	}
+	return (
+		methodName !== undefined &&
+		PARSE_LIKE_SCHEMA_METHODS.has(methodName) &&
+		ts.isCallExpression(access.parent) &&
+		access.parent.expression === access
+	);
 }
 
 function vendorKeyFindingsForObject(
 	source: string,
+	sourceFile: TS.SourceFile,
 	zObject: ZObjectLiteral,
+	bindings: LocalBindings,
 ): Array<{ key: string; line: number }> {
-	const keys = collectTopLevelObjectKeys(source, zObject.objectStart, zObject.objectEnd);
+	const keys = collectTopLevelObjectKeys(
+		source,
+		sourceFile,
+		zObject.objectStart,
+		zObject.objectEnd,
+		bindings,
+	);
 	const digitFamilies = new Map<string, Set<string>>();
 	for (const key of keys) {
 		const member = numberedFamilyMember(key.name);
@@ -2444,8 +3671,10 @@ function isAllowedPublicOutputKeyName(name: string): boolean {
 
 function collectTopLevelObjectKeys(
 	source: string,
+	sourceFile: TS.SourceFile,
 	objectStart: number,
 	objectEnd: number,
+	bindings: LocalBindings,
 ): Array<{ name: string; offset: number }> {
 	const keys: Array<{ name: string; offset: number }> = [];
 	const masked = maskCommentsAndStrings(source);
@@ -2467,17 +3696,16 @@ function collectTopLevelObjectKeys(
 			index = endQuote + 1;
 		} else if (masked[index] === "[") {
 			const computedEnd = findMatchingBracket(masked, index);
-			const literalStart = findNextNonWhitespace(masked, index + 1);
-			if (computedEnd === -1 || literalStart === -1) {
+			if (computedEnd === -1) {
 				break;
 			}
-			const computedQuote = source[literalStart];
-			if (computedQuote === '"' || computedQuote === "'") {
-				const literalEnd = findStringEnd(source, literalStart);
-				const afterLiteral =
-					literalEnd === -1 ? -1 : skipWhitespaceAndComments(masked, literalEnd + 1, computedEnd);
-				if (literalEnd !== -1 && afterLiteral === computedEnd) {
-					key = source.slice(literalStart + 1, literalEnd);
+			const expression = computedPropertyExpressionAtOffset(sourceFile, index);
+			if (expression !== undefined) {
+				const unwrapped = unwrapLocalExpression(expression);
+				if (ts.isStringLiteral(unwrapped) || ts.isNoSubstitutionTemplateLiteral(unwrapped)) {
+					key = unwrapped.text;
+				} else if (ts.isIdentifier(unwrapped)) {
+					key = resolveConstStringIdentifier(unwrapped, bindings);
 				}
 			}
 			index = computedEnd + 1;
@@ -2500,8 +3728,27 @@ function collectTopLevelObjectKeys(
 		if (masked[index] === ",") {
 			index += 1;
 		}
-	}
-	return keys;
+	}
+	return keys;
+}
+
+function computedPropertyExpressionAtOffset(
+	sourceFile: TS.SourceFile,
+	offset: number,
+): TS.Expression | undefined {
+	let expression: TS.Expression | undefined;
+	const visit = (node: TS.Node): void => {
+		if (expression !== undefined || offset < node.getFullStart() || offset >= node.getEnd()) {
+			return;
+		}
+		if (ts.isComputedPropertyName(node) && node.getStart(sourceFile) === offset) {
+			expression = node.expression;
+			return;
+		}
+		ts.forEachChild(node, visit);
+	};
+	visit(sourceFile);
+	return expression;
 }
 
 function findVendorTimestampLeakFindings(providerRoot: string): SourceFinding[] {
@@ -2511,6 +3758,15 @@ function findVendorTimestampLeakFindings(providerRoot: string): SourceFinding[]
 	for (const filePath of listNonTestTypeScriptFiles(providerRoot)) {
 		const source = readFileSync(filePath, "utf8");
 		const relPath = toRelativeProviderPath(providerRoot, filePath);
+		maskCommentsAndStrings(source, relPath);
+		const sourceFile = ts.createSourceFile(
+			relPath,
+			source,
+			ts.ScriptTarget.Latest,
+			true,
+			ts.ScriptKind.TS,
+		);
+		const bindings = collectLocalBindings(sourceFile);
 		const zObjectRanges = findZObjectLiterals(source).map((zObject) => ({
 			start: zObject.callStart,
 			end: zObject.objectEnd,
@@ -2523,7 +3779,7 @@ function findVendorTimestampLeakFindings(providerRoot: string): SourceFinding[]
 		].filter((range) => rangeContainedInRanges(fixtureRanges, range));
 
 		for (const range of fixtureResponseRanges) {
-			for (const literal of findStringLiteralsInRange(source, range)) {
+			for (const literal of findStringLiteralsInRange(source, range, relPath)) {
 				if (
 					rangeContainsOffset(zObjectRanges, literal.offset) ||
 					rangeContainsOffset(upstreamRanges, literal.offset) ||
@@ -2544,12 +3800,86 @@ function findVendorTimestampLeakFindings(providerRoot: string): SourceFinding[]
 					}
 				}
 			}
+
+			const visitAliases = (node: TS.Node): void => {
+				if (findings.length >= MAX_SOURCE_FINDING_EVIDENCE) {
+					return;
+				}
+				const offset = node.getStart(sourceFile);
+				if (
+					ts.isIdentifier(node) &&
+					isIdentifierValueUse(node) &&
+					offset >= range.start &&
+					offset <= range.end &&
+					!rangeContainsOffset(zObjectRanges, offset) &&
+					!rangeContainsOffset(upstreamRanges, offset)
+				) {
+					const value = resolveConstStringIdentifier(node, bindings);
+					if (
+						value !== undefined &&
+						isVendorTimestampCandidate(value, propertyNameForValueExpression(node))
+					) {
+						const line = offsetToLine(source, offset);
+						const key = `${relPath}:${line}:${value}`;
+						if (!seen.has(key)) {
+							seen.add(key);
+							findings.push({ file: relPath, line });
+						}
+					}
+				}
+				ts.forEachChild(node, visitAliases);
+			};
+			visitAliases(sourceFile);
+			if (findings.length >= MAX_SOURCE_FINDING_EVIDENCE) {
+				return findings;
+			}
 		}
 	}
 
 	return findings;
 }
 
+function isIdentifierValueUse(identifier: TS.Identifier): boolean {
+	const parent = identifier.parent;
+	return !(
+		(ts.isPropertyAssignment(parent) && parent.name === identifier) ||
+		(ts.isPropertyAccessExpression(parent) && parent.name === identifier) ||
+		ts.isBindingElement(parent) ||
+		ts.isVariableDeclaration(parent) ||
+		ts.isParameter(parent) ||
+		ts.isImportClause(parent) ||
+		ts.isImportSpecifier(parent) ||
+		ts.isNamespaceImport(parent) ||
+		ts.isFunctionDeclaration(parent) ||
+		ts.isFunctionExpression(parent) ||
+		ts.isClassDeclaration(parent) ||
+		ts.isClassExpression(parent) ||
+		ts.isPropertyDeclaration(parent) ||
+		ts.isPropertySignature(parent) ||
+		ts.isMethodDeclaration(parent) ||
+		ts.isMethodSignature(parent)
+	);
+}
+
+function propertyNameForValueExpression(expression: TS.Expression): string | undefined {
+	let current: TS.Expression = expression;
+	while (
+		ts.isParenthesizedExpression(current.parent) ||
+		ts.isAsExpression(current.parent) ||
+		ts.isSatisfiesExpression(current.parent) ||
+		ts.isNonNullExpression(current.parent)
+	) {
+		current = current.parent;
+	}
+	if (ts.isPropertyAssignment(current.parent) && current.parent.initializer === current) {
+		return propertyNameText(current.parent.name);
+	}
+	if (ts.isShorthandPropertyAssignment(current.parent)) {
+		return current.parent.name.text;
+	}
+	return undefined;
+}
+
 function findPropertyObjectRanges(source: string, propertyName: string): ObjectRange[] {
 	const ranges: ObjectRange[] = [];
 	const masked = maskCommentsAndStrings(source);
@@ -2593,23 +3923,16 @@ function findNamedConstValueRanges(source: string): NamedObjectRange[] {
 	return ranges;
 }
 
-function findConstValueRangeContaining(
-	source: string,
-	offset: number,
-): NamedObjectRange | undefined {
-	return findNamedConstValueRanges(source).find(
-		(range) => offset >= range.start && offset <= range.end,
-	);
-}
-
 function findStringLiteralsInRange(
 	source: string,
 	range: ObjectRange,
+	fileName: string,
 ): Array<{ value: string; offset: number }> {
 	const literals: Array<{ value: string; offset: number }> = [];
+	const masked = maskCommentsAndStrings(source, fileName);
 	let index = range.start;
 	while (index <= range.end) {
-		const quote = source[index];
+		const quote = masked[index];
 		if (quote !== '"' && quote !== "'" && quote !== "`") {
 			index += 1;
 			continue;
@@ -2719,57 +4042,233 @@ function findStringEnd(source: string, start: number): number {
 	return -1;
 }
 
-function maskCommentsAndStrings(source: string): string {
+// Masking now parses with TypeScript, which is orders of magnitude more
+// expensive than the character walk it replaced, and six scanners call this
+// helper once per candidate match — the same file is masked thousands of
+// times in one run (measured: 1,872 calls for a 3.4k-line provider). Without
+// memoization that run regresses from ~8s to minutes and can exceed the CI
+// validation timeout. Successful results are cached by exact source text and
+// property-key mode; the cache stays small because a run only ever reads a
+// handful of files.
+// Parse failures are NOT cached: they throw and abort the check (fail-closed).
+const MASK_CACHE_LIMIT = 64;
+const maskCache = new Map<string, string>();
+
+// Neutralize { } ( ) [ ], backtick, quotes, slash, backslash, comma, and semicolon
+// because scanners treat these as depth, string/regex delimiters, or top-level stops.
+const PRESERVED_PROPERTY_KEY_STRUCTURAL_CHARS = new Set([
+	"{",
+	"}",
+	"(",
+	")",
+	"[",
+	"]",
+	"`",
+	'"',
+	"'",
+	"/",
+	"\\",
+	",",
+	";",
+]);
+
+type MaskCommentsAndStringsOptions = {
+	blankPropertyKeys?: boolean;
+};
+
+// Which literal bodies are blanked alongside comment bodies. "all" blanks
+// every string/template/regex body; "values" does the same but keeps quoted
+// property-key text (only its structural characters are blanked); "none"
+// leaves every literal and all code byte-identical, so only comments go.
+type LiteralMaskMode = "all" | "values" | "none";
+
+export function maskCommentsAndStrings(
+	source: string,
+	fileName = "provider.ts",
+	options: MaskCommentsAndStringsOptions = {},
+): string {
+	return maskSource(source, fileName, options.blankPropertyKeys === true ? "all" : "values");
+}
+
+// Blanks comment bodies only, from the same TypeScript-lexer comment ranges
+// maskCommentsAndStrings uses: a `//` inside a string, template, or regex is
+// not a comment, and a block comment spanning lines is blanked whole. Line
+// terminators survive, so line N of the result is line N of the source.
+// Throws like maskCommentsAndStrings when the source cannot be parsed.
+export function maskComments(source: string, fileName = "provider.ts"): string {
+	return maskSource(source, fileName, "none");
+}
+
+function maskSource(source: string, fileName: string, literals: LiteralMaskMode): string {
+	const { scriptKind } = maskScriptKind(fileName);
+	const cacheKey = `${literals}\0${scriptKind}\0${source}`;
+	const cached = maskCache.get(cacheKey);
+	if (cached !== undefined) {
+		return cached;
+	}
+	const masked = computeMaskedSource(source, fileName, literals);
+	if (maskCache.size >= MASK_CACHE_LIMIT) {
+		const oldest = maskCache.keys().next();
+		if (!oldest.done) {
+			maskCache.delete(oldest.value);
+		}
+	}
+	maskCache.set(cacheKey, masked);
+	return masked;
+}
+
+// The script kind a source is lexed as, from its file name, and the synthetic
+// implementation file name transpileModule parses it under. Declaration files
+// trigger an internal TypeScript Debug Failure when passed to transpileModule,
+// so `.d.ts` (like every other non-JS/JSX/TSX name) parses as `provider.ts`.
+function maskScriptKind(fileName: string): {
+	scriptKind: TS.ScriptKind;
+	syntheticFileName: string;
+} {
+	if (fileName.endsWith(".tsx")) {
+		return { scriptKind: ts.ScriptKind.TSX, syntheticFileName: "provider.tsx" };
+	}
+	if (fileName.endsWith(".jsx")) {
+		return { scriptKind: ts.ScriptKind.JSX, syntheticFileName: "provider.jsx" };
+	}
+	if (/\.[cm]?js$/.test(fileName)) {
+		return { scriptKind: ts.ScriptKind.JS, syntheticFileName: "provider.js" };
+	}
+	return { scriptKind: ts.ScriptKind.TS, syntheticFileName: "provider.ts" };
+}
+
+function computeMaskedSource(source: string, fileName: string, literals: LiteralMaskMode): string {
+	const blankPropertyKeys = literals === "all";
+	const { scriptKind, syntheticFileName } = maskScriptKind(fileName);
+	const transpiled = ts.transpileModule(source, {
+		// Parsing is all we need here: parse under the synthetic implementation
+		// filename while retaining the real filename for source mapping and
+		// sanitized diagnostics below.
+		fileName: syntheticFileName,
+		reportDiagnostics: true,
+		compilerOptions: { target: ts.ScriptTarget.Latest },
+	});
+	const sourceFile = ts.createSourceFile(
+		fileName,
+		source,
+		ts.ScriptTarget.Latest,
+		true,
+		scriptKind,
+	);
+	const parseDiagnostic = transpiled.diagnostics?.[0];
+	if (parseDiagnostic) {
+		const position = parseDiagnostic.start ?? 0;
+		const { line, character } = sourceFile.getLineAndCharacterOfPosition(position);
+		throw new Error(
+			`Cannot safely scan TypeScript source ${sanitizeDiagnosticFileName(fileName)} at ${line + 1}:${character + 1}: ${ts.flattenDiagnosticMessageText(parseDiagnostic.messageText, "\n")}`,
+		);
+	}
+
 	const chars = source.split("");
-	for (let index = 0; index < source.length; index += 1) {
-		if (source.startsWith("//", index)) {
-			const bodyStart = index + 2;
-			const newline = source.indexOf("\n", bodyStart);
-			const end = newline === -1 ? source.length : newline;
-			for (let bodyIndex = bodyStart; bodyIndex < end; bodyIndex += 1) {
-				chars[bodyIndex] = " ";
-			}
-			index = end;
-			continue;
-		}
-		if (source.startsWith("/*", index)) {
-			const bodyStart = index + 2;
-			const close = source.indexOf("*/", bodyStart);
-			const end = close === -1 ? source.length : close;
-			for (let bodyIndex = bodyStart; bodyIndex < end; bodyIndex += 1) {
-				if (chars[bodyIndex] !== "\n") {
-					chars[bodyIndex] = " ";
-				}
+	const maskRange = (start: number, end: number): void => {
+		for (let index = start; index < end; index += 1) {
+			// Preserve the backslash of a string line continuation (\ followed
+			// by LF, CRLF, or lone CR) and every line terminator, so masked
+			// string bodies remain syntactically valid and the mask output can
+			// be re-parsed (mask(mask(x)) === mask(x)).
+			if (source[index] === "\\" && (source[index + 1] === "\n" || source[index + 1] === "\r")) {
+				continue;
 			}
-			index = close === -1 ? source.length : close + 1;
-			continue;
-		}
-		const quote = source[index];
-		if (quote !== '"' && quote !== "'" && quote !== "`") {
-			continue;
-		}
-		const end = findStringEnd(source, index);
-		if (end === -1) {
-			break;
+			if (chars[index] !== "\n" && chars[index] !== "\r") chars[index] = " ";
 		}
-		// Preserve quoted property keys ("response": ...) so range/key scanners
-		// can still match them; only string VALUES are blanked.
-		let probe = end + 1;
-		while (probe < source.length && /\s/.test(source[probe] ?? "")) {
-			probe += 1;
+	};
+	const commentRanges = new Map<string, TS.CommentRange>();
+	const addCommentRanges = (ranges: readonly TS.CommentRange[] | undefined): void => {
+		for (const range of ranges ?? []) {
+			commentRanges.set(`${range.pos}:${range.end}`, range);
 		}
-		if (source[probe] !== ":") {
-			for (let bodyIndex = index + 1; bodyIndex < end; bodyIndex += 1) {
-				if (chars[bodyIndex] !== "\n") {
-					chars[bodyIndex] = " ";
+	};
+
+	const maskLiteralBody = (node: TS.Node): void => {
+		const start = node.getStart(sourceFile);
+		if (ts.isStringLiteral(node)) {
+			// Preserve quoted property keys ("response": ...) by default so range/key
+			// scanners can still match them. Line scanners opt into blanking key bodies
+			// as well, preventing key text from looking like executable source.
+			const isQuotedPropertyKey = ts.isPropertyAssignment(node.parent) && node.parent.name === node;
+			if (blankPropertyKeys || !isQuotedPropertyKey) {
+				maskRange(start + 1, node.end - 1);
+			} else {
+				for (let index = start + 1; index < node.end - 1; index += 1) {
+					if (
+						source[index] === "\\" &&
+						(source[index + 1] === "\n" || source[index + 1] === "\r")
+					) {
+						continue;
+					}
+					if (PRESERVED_PROPERTY_KEY_STRUCTURAL_CHARS.has(source[index] ?? "")) {
+						chars[index] = " ";
+					}
 				}
 			}
+		} else if (ts.isRegularExpressionLiteral(node)) {
+			let closeDelimiter = node.end - 1;
+			while (closeDelimiter > start && /[A-Za-z]/.test(source[closeDelimiter] ?? "")) {
+				closeDelimiter -= 1;
+			}
+			maskRange(start + 1, closeDelimiter);
+		} else if (ts.isNoSubstitutionTemplateLiteral(node)) {
+			maskRange(start + 1, node.end - 1);
+		} else if (node.kind === ts.SyntaxKind.TemplateHead) {
+			maskRange(start + 1, node.end - 2);
+		} else if (node.kind === ts.SyntaxKind.TemplateMiddle) {
+			maskRange(start + 1, node.end - 2);
+		} else if (node.kind === ts.SyntaxKind.TemplateTail) {
+			maskRange(start + 1, node.end - 1);
 		}
-		index = end;
+	};
+
+	const visit = (node: TS.Node): void => {
+		addCommentRanges(ts.getLeadingCommentRanges(source, node.getFullStart()));
+		addCommentRanges(ts.getTrailingCommentRanges(source, node.getEnd()));
+		if (literals !== "none") maskLiteralBody(node);
+		for (const child of node.getChildren(sourceFile)) visit(child);
+	};
+
+	visit(sourceFile);
+	for (const comment of commentRanges.values()) {
+		const markerLength = 2;
+		const bodyEnd =
+			comment.kind === ts.SyntaxKind.MultiLineCommentTrivia
+				? comment.end - markerLength
+				: comment.end;
+		maskRange(comment.pos + markerLength, bodyEnd);
 	}
 	return chars.join("");
 }
 
+// Escapes every non-printable or formatting character before a submitter-
+// controlled filename is interpolated into a diagnostic that the CLI prints.
+// Category-based on purpose: enumerated code-point lists kept missing members
+// of the same class (C1 controls, U+061C, U+2028/U+2029 were each found
+// individually in review), so this escapes the whole Unicode categories —
+// Cc (controls), Cf (formatting, includes all Bidi_Control), Zl/Zp
+// (line/paragraph separators). Ordinary letters, digits, spaces, and CJK
+// filenames pass through unchanged.
+const DIAGNOSTIC_UNSAFE_CHARACTER = /\p{Cc}|\p{Cf}|\p{Zl}|\p{Zp}/u;
+
+function sanitizeDiagnosticFileName(fileName: string): string {
+	let sanitized = "";
+	for (const character of fileName) {
+		const codePoint = character.codePointAt(0);
+		if (codePoint === undefined) continue;
+		if (DIAGNOSTIC_UNSAFE_CHARACTER.test(character)) {
+			sanitized +=
+				codePoint <= 0xff
+					? `\\x${codePoint.toString(16).padStart(2, "0")}`
+					: `\\u{${codePoint.toString(16)}}`;
+		} else {
+			sanitized += character;
+		}
+	}
+	return sanitized;
+}
+
 function skipWhitespaceAndComments(source: string, start: number, end: number): number {
 	let index = start;
 	while (index < end) {
@@ -2865,6 +4364,7 @@ function scoreHealthCoverage(provider: ProviderDefinition): SubmitCheck {
 	const operations = Object.entries(provider.operations);
 	const missing: string[] = [];
 	const vacuous: string[] = [];
+	const evidenceFreeScenario: string[] = [];
 	const placeholder: string[] = [];
 	const unsupported: string[] = [];
 	const generatedStarter: string[] = [];
@@ -2876,8 +4376,13 @@ function scoreHealthCoverage(provider: ProviderDefinition): SubmitCheck {
 			missing.push(operationId);
 			continue;
 		}
-		if (hasCheck && !hasUnsupported && hasOnlyVacuousHealthCases(operation.healthCheck)) {
-			vacuous.push(operationId);
+		if (hasCheck && !hasUnsupported) {
+			const vacuousClass = vacuousHealthCaseClass(operation.healthCheck);
+			if (vacuousClass === "empty-assertions") {
+				vacuous.push(operationId);
+			} else if (vacuousClass === "evidence-free-scenario") {
+				evidenceFreeScenario.push(operationId);
+			}
 		}
 		if (hasUnsupported) {
 			const reason = operation.healthCheckUnsupported?.reason ?? "";
@@ -2904,14 +4409,36 @@ function scoreHealthCoverage(provider: ProviderDefinition): SubmitCheck {
 		);
 	}
 
-	if (vacuous.length > 0) {
+	if (vacuous.length > 0 || evidenceFreeScenario.length > 0) {
+		const remediationParts: string[] = [];
+		if (vacuous.length > 0) {
+			remediationParts.push(
+				`healthCheck.assertions for ${vacuous.join(", ")} is empty — assert on status and response shape (e.g. throw or return {status:'degraded'} when the upstream contract breaks), or declare healthCheckUnsupported with a specific reason if the operation genuinely cannot be probed.`,
+			);
+		}
+		if (evidenceFreeScenario.length > 0) {
+			remediationParts.push(
+				`healthCheck scenario for ${evidenceFreeScenario.join(", ")} asserts nothing beyond transport — add an assert step whose expression reads the probe response (a field under data, an extracted value, or a quantifier over response rows), not just status_2xx or a bare response-envelope check.`,
+			);
+		}
+		const message =
+			evidenceFreeScenario.length === 0
+				? "One or more operations have healthCheck cases with empty assertions."
+				: vacuous.length === 0
+					? "One or more operations have healthCheck scenarios without response evidence."
+					: "One or more operations have healthCheck cases with empty assertions or evidence-free scenarios.";
 		return blocker(
 			"health-coverage",
 			"health",
-			"One or more operations have healthCheck cases with empty assertions.",
-			`healthCheck.assertions for ${vacuous.join(", ")} is empty — assert on status and response shape (e.g. throw or return {status:'degraded'} when the upstream contract breaks), or declare healthCheckUnsupported with a specific reason if the operation genuinely cannot be probed.`,
+			message,
+			remediationParts.join(" "),
 			CATEGORY_MAX_POINTS.health,
-			vacuous.map((operationId) => `${operationId}: empty healthCheck.assertions`),
+			[
+				...vacuous.map((operationId) => `${operationId}: empty healthCheck.assertions`),
+				...evidenceFreeScenario.map(
+					(operationId) => `${operationId}: healthCheck scenario asserts nothing beyond transport`,
+				),
+			],
 		);
 	}
 
@@ -2966,14 +4493,216 @@ function scoreHealthCoverage(provider: ProviderDefinition): SubmitCheck {
 	);
 }
 
-function hasOnlyVacuousHealthCases(
+type VacuousHealthCaseClass = "empty-assertions" | "evidence-free-scenario";
+
+/**
+ * Classify an operation whose every health case is vacuous. Returns undefined
+ * when at least one case carries real coverage: an imperative case with a
+ * non-vacuous assertions function, or a declarative case whose scenario reads
+ * the probe response. When all cases are vacuous, the class picks the blocker
+ * wording — "empty-assertions" whenever any vacuous case is imperative (the
+ * pre-scenario behavior, kept byte-identical), "evidence-free-scenario" when
+ * the suite is scenario-only.
+ */
+function vacuousHealthCaseClass(
 	healthCheck: ProviderDefinition["operations"][string]["healthCheck"],
-): boolean {
+): VacuousHealthCaseClass | undefined {
 	const cases = healthCheck?.cases;
 	if (!Array.isArray(cases) || cases.length === 0) {
+		return "empty-assertions";
+	}
+	let sawImperativeCase = false;
+	for (const healthCase of cases) {
+		if (healthCase?.scenario !== undefined) {
+			if (scenarioCarriesResponseEvidence(healthCase.scenario)) {
+				return undefined;
+			}
+			continue;
+		}
+		sawImperativeCase = true;
+		if (!isVacuousAssertionFunction(healthCase?.assertions)) {
+			return undefined;
+		}
+	}
+	return sawImperativeCase ? "empty-assertions" : "evidence-free-scenario";
+}
+
+/**
+ * A declarative case (`scenario`) carries real coverage when at least one
+ * `assert` step reads the probe response beyond the transport envelope. The
+ * SDK's own definitions drive this judgement:
+ *
+ * - The assert step is the scenario's only verdict-bearing construct
+ *   (`AssertResult.passed`). A guard can only attribute
+ *   degraded/expected_absence and stop the run (an escape hatch, not a health
+ *   verdict), and an operation step does not intrinsically fail on a non-2xx
+ *   response — that is what the explicit `status_2xx` predicate exists for. So
+ *   a scenario without a semantic assert step proves nothing beyond the
+ *   operation merely executing, which is the same emptiness the imperative
+ *   vacuity check flags.
+ * - Leaves that cannot observe upstream content carry no evidence: predicates
+ *   whose operands read nothing produced by a step (pure literals,
+ *   attempt/credential metadata, and the `status_code`/`request_id`/`kind`
+ *   envelope fields of a step result — this is what makes the legacy transport
+ *   pin `status_2xx` on `["status_code"]` non-evidence), predicates comparing
+ *   a reference against an identical copy of itself (`equals(x, x)` holds for
+ *   any response), and positive-polarity presence/type pins (`exists`,
+ *   `type_is`, `not(not_exists(...))`, zero-bound `array_length_gte`) on the
+ *   bare `data` root — the declarative spellings of the legacy transport-only
+ *   assertion (`status === 200` + `typeof data === "object"`), satisfied by
+ *   any well-formed response body. Polarity matters: `not(exists(data))`
+ *   ("this probe must return no body") is falsified by ordinary responses, so
+ *   the carve-out only applies where the pin appears un-negated.
+ * - Everything else counts: paths under `data`, extract-step results,
+ *   `duration_ms` (parity with imperative `ctx.durationMs` reads),
+ *   `status_2xx` applied to a body path (envelope-style upstreams answer HTTP
+ *   200 and carry the real code in the body), and quantifiers, which iterate
+ *   response rows by construction.
+ *
+ * Fail-open contract (same as isVacuousAssertionFunction): the provider module
+ * already validated this scenario against HealthScenarioSchema in its own SDK
+ * at import time, so any shape this walk does not recognize (unknown step
+ * kind, expression kind, operator, or reference namespace) indicates a newer
+ * grammar, not an empty probe — treat it as evidence rather than flag it.
+ * The inverse direction is accepted and documented: a determined author can
+ * still fabricate a read that never fails (a decorative deep path inside a
+ * disjunction, a degenerate bound). That effort is comparable to writing the
+ * real one-line assertion — the same accepted limitation as the imperative
+ * check's decorative-ctx-read — and the live `--smoke` probe remains the
+ * runtime defense.
+ */
+export function scenarioCarriesResponseEvidence(scenario: unknown): boolean {
+	if (!isRecord(scenario) || !Array.isArray(scenario.steps)) {
+		return true;
+	}
+	let sawUnknownStepKind = false;
+	for (const step of scenario.steps) {
+		if (!isRecord(step)) {
+			sawUnknownStepKind = true;
+			continue;
+		}
+		if (step.kind === "assert") {
+			if (expressionReadsResponse(step.expression)) {
+				return true;
+			}
+			continue;
+		}
+		if (step.kind !== "operation" && step.kind !== "extract" && step.kind !== "guard") {
+			sawUnknownStepKind = true;
+		}
+	}
+	return sawUnknownStepKind;
+}
+
+/**
+ * Predicate operators of the current scenario grammar. An operator outside
+ * this set indicates a newer grammar and fails open (counts as evidence),
+ * because a future operator may source the response through fields this walk
+ * does not know about.
+ */
+const KNOWN_SCENARIO_PREDICATE_OPERATORS: ReadonlySet<string> = new Set([
+	"exists",
+	"not_exists",
+	"non_empty",
+	"is_true",
+	"equals",
+	"not_equals",
+	"contains",
+	"matches",
+	"number_gt",
+	"number_gte",
+	"number_lt",
+	"number_lte",
+	"array_length_eq",
+	"array_length_gte",
+	"array_length_lte",
+	"status_2xx",
+	"type_is",
+]);
+
+function expressionReadsResponse(expression: unknown, negationDepth = 0): boolean {
+	if (!isRecord(expression)) {
+		return true;
+	}
+	if (expression.kind === "all" || expression.kind === "any") {
+		return Array.isArray(expression.clauses)
+			? expression.clauses.some((clause) => expressionReadsResponse(clause, negationDepth))
+			: true;
+	}
+	if (expression.kind === "not") {
+		return expressionReadsResponse(expression.clause, negationDepth + 1);
+	}
+	if (expression.kind === "quantifier") {
+		return true;
+	}
+	if (expression.kind !== "predicate" || typeof expression.operator !== "string") {
+		return true;
+	}
+	const operator = expression.operator;
+	if (!KNOWN_SCENARIO_PREDICATE_OPERATORS.has(operator)) {
+		return true;
+	}
+	const actualReads = operandReadsStepOutput(expression.actual);
+	const expectedReads = operandReadsStepOutput(expression.expected);
+	if (!actualReads && !expectedReads) {
+		return false;
+	}
+	// A predicate comparing a reference against an identical copy of itself
+	// (equals(x, x) and friends) holds or fails identically for every response,
+	// so the reads discriminate nothing.
+	if (
+		actualReads &&
+		expectedReads &&
+		JSON.stringify(expression.actual) === JSON.stringify(expression.expected)
+	) {
+		return false;
+	}
+	// Presence/type pins on the whole `data` root are satisfied by any
+	// well-formed JSON body — but only in positive polarity. Under an odd
+	// number of `not` wrappers the same pin means "this probe must return no
+	// body / a different shape", which ordinary responses falsify, so it is a
+	// real (if unusual) constraint and stays evidence.
+	const positivePolarity = negationDepth % 2 === 0;
+	const bareEnvelopePin = positivePolarity
+		? operator === "exists" ||
+			operator === "type_is" ||
+			(operator === "array_length_gte" && expression.expected === 0)
+		: operator === "not_exists";
+	if (bareEnvelopePin && !expectedReads && isBareResponseEnvelope(expression.actual)) {
+		return false;
+	}
+	return true;
+}
+
+function operandReadsStepOutput(operand: unknown): boolean {
+	if (!isRecord(operand) || !isRecord(operand.ref)) {
+		return false;
+	}
+	const reference = operand.ref;
+	if (reference.namespace === "attempt" || reference.namespace === "credentials") {
+		return false;
+	}
+	if (reference.namespace !== "steps") {
+		return true;
+	}
+	if (!Array.isArray(reference.path) || reference.path.length === 0) {
 		return true;
 	}
-	return cases.every((healthCase) => isVacuousAssertionFunction(healthCase?.assertions));
+	const head = reference.path[0];
+	return head !== "status_code" && head !== "request_id" && head !== "kind";
+}
+
+function isBareResponseEnvelope(operand: unknown): boolean {
+	if (!isRecord(operand) || !isRecord(operand.ref)) {
+		return false;
+	}
+	const reference = operand.ref;
+	return (
+		reference.namespace === "steps" &&
+		Array.isArray(reference.path) &&
+		reference.path.length === 1 &&
+		reference.path[0] === "data"
+	);
 }
 
 function isVacuousAssertionFunction(assertions: unknown): boolean {
@@ -3341,7 +5070,7 @@ function isAstNode(value: unknown): value is acorn.AnyNode {
 	);
 }
 
-function scoreSmoke(
+export function scoreSmoke(
 	smokeResult: SmokeResult | undefined,
 	smokeNote: string | undefined,
 ): SubmitCheck {
@@ -3363,8 +5092,22 @@ function scoreSmoke(
 		};
 	}
 
+	const credential = smokeResult.credential;
+	// An invalid configuration is reported even for a provider that needs no
+	// credential: the operator set something, and silence would read as accepted.
+	const credentialEvidence =
+		credential?.required === true || credential?.error !== undefined
+			? [
+					credential.supplied
+						? `credential: supplied for auth.mode "${credential.mode}"`
+						: credential.error
+							? `credential: CONFIGURED BUT INVALID — ${credential.error}`
+							: `credential: NOT supplied; auth.mode "${credential.mode}" needs one the gateway injects at invocation time, so every credentialed operation failed before reaching the upstream`,
+				]
+			: [];
 	const evidence = [
 		`/health: ${smokeResult.healthOk ? "ok" : "failed"}`,
+		...credentialEvidence,
 		...smokeResult.operations.map(
 			(outcome) =>
 				`${outcome.operationId}: ${outcome.status}${outcome.httpStatus ? ` HTTP ${outcome.httpStatus}` : ""} - ${outcome.message}`,
@@ -3388,6 +5131,31 @@ function scoreSmoke(
 		};
 	}
 
+	// Checked BEFORE the success branch. A provider that needs a
+	// gateway-injected credential and did not get one never exercised its
+	// credentialed path, so a schema-valid success from some other operation --
+	// an unauthenticated one, or a fixture-shaped response -- must not buy full
+	// smoke points. Saying "verified" would credit the run with evidence it does
+	// not have.
+	if (credential?.required === true && !credential.supplied) {
+		return {
+			id: "local-smoke",
+			category: "smoke",
+			level: "warn",
+			status: "warn",
+			points: 7,
+			maxPoints: CATEGORY_MAX_POINTS.smoke,
+			message: credential.error
+				? `Runtime path was verified, but the configured local credential could not be used, so the provider's credentialed operations never reached the upstream.`
+				: `Runtime path was verified, but auth.mode "${credential.mode}" needs a credential this run did not have, so the provider's credentialed operations never reached the upstream.`,
+			remediation: credential.error
+				? `Fix the local credential configuration and rerun \`bun run submit-check -- --smoke\`: ${credential.error}`
+				: `Supply the credential the gateway injects and rerun \`bun run submit-check -- --smoke\`: ${LOCAL_CONNECTION_SECRETS_ENV}='{"<key>":"<value>"}', where the keys are the ones the provider passes to ctx.credential.get(...). For platform-managed providers that value is the platform-owned key an operator holds; it is not in the checkout.`,
+			evidence,
+			details: smokeResult,
+		};
+	}
+
 	const successes = smokeResult.operations.filter((outcome) => outcome.status === "success");
 	if (successes.length > 0) {
 		return {
@@ -3458,6 +5226,12 @@ export async function runSubmitCheckSmoke(
 				operations: [],
 			};
 		}
+		// The gateway attaches a resolved credential to every invocation of a
+		// provider whose auth.mode is not "none". Smoke POSTed an envelope with
+		// no `connection` at all, so every platform-managed provider answered
+		// MISSING_SECRET and scored as "runtime verified, no live success" —
+		// a capability gap wearing the costume of an ordinary upstream miss.
+		const connection = resolveLocalConnection(loadedProvider);
 		const operations: SmokeOperationOutcome[] = [];
 		for (const [operationId, operation] of Object.entries(loadedProvider.operations)) {
 			operations.push(
@@ -3465,10 +5239,21 @@ export async function runSubmitCheckSmoke(
 					requestId: `req_submit_check_smoke_${operationId}`,
 					input: operation.fixtures?.request ?? {},
 					headers: {},
+					...(connection.ok && connection.connection ? { connection: connection.connection } : {}),
 				}),
 			);
 		}
-		return { measured: true, healthOk: true, operations };
+		return {
+			measured: true,
+			healthOk: true,
+			operations,
+			credential: {
+				required: providerRequiresConnection(loadedProvider),
+				supplied: connection.ok && connection.connection !== undefined,
+				mode: loadedProvider.auth?.mode ?? "none",
+				...(connection.ok ? {} : { error: connection.reason }),
+			},
+		};
 	} finally {
 		await stopSmokeServer(server);
 	}
@@ -3655,25 +5440,6 @@ function scoreAuthSafety(provider: ProviderDefinition): SubmitCheck {
 		};
 	}
 
-	if (authMode === "none") {
-		const securedOperations = Object.entries(provider.operations).filter(
-			([, operation]) => operation.annotations?.openWorld === false,
-		);
-		if (securedOperations.length > 0) {
-			return {
-				id: "auth-safety",
-				category: "auth",
-				level: "warn",
-				status: "warn",
-				points: 7,
-				maxPoints: CATEGORY_MAX_POINTS.auth,
-				message: "Provider is no-auth but at least one operation is not marked openWorld.",
-				remediation: `Either set \`auth.mode\` to the upstream auth model, or mark these public no-auth operations with \`annotations.openWorld: true\`: ${securedOperations.map(([operationId]) => operationId).join(", ")}.`,
-				evidence: securedOperations.map(([operationId]) => operationId),
-			};
-		}
-	}
-
 	return pass(
 		"auth-safety",
 		"auth",
@@ -3875,18 +5641,18 @@ function findEntropySecretFindings(providerRoot: string, providerId: string): Se
 		if (isEntropySecretExcludedPath(relativePath)) continue;
 		const content = readFileSync(filePath, "utf8");
 		const lines = content.split(/\r?\n/);
-		for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
-			const line = lines[lineIndex] ?? "";
-			for (const candidate of extractStringLiteralCandidates(line)) {
-				const finding = classifyEntropyCandidate({
-					value: candidate,
-					line,
-					file: relativePath,
-					lineNumber: lineIndex + 1,
-					providerId,
-				});
-				if (finding) findings.push(finding);
-			}
+		for (const candidate of extractStringLiteralCandidates(content, relativePath)) {
+			// Context is the whole source line, comment tail included: a
+			// comment that names the value is evidence about it, even though
+			// comment text itself is never a candidate.
+			const finding = classifyEntropyCandidate({
+				value: candidate.value,
+				line: lines[candidate.lineIndex] ?? "",
+				file: relativePath,
+				lineNumber: candidate.lineIndex + 1,
+				providerId,
+			});
+			if (finding) findings.push(finding);
 		}
 	}
 	return findings;
@@ -3902,7 +5668,62 @@ function isEntropySecretExcludedPath(relativePath: string): boolean {
 	);
 }
 
-export function extractStringLiteralCandidates(line: string): string[] {
+export type StringLiteralCandidate = {
+	value: string;
+	// 0-based index of the source line the literal sits on.
+	lineIndex: number;
+};
+
+// Every string-literal candidate (a quoted body of at least
+// ENTROPY_CANDIDATE_MIN_LENGTH characters) in one provider source file.
+// Candidates come from code only. Comments are prose, not values, so each
+// file's own comment syntax is removed before a quote is read:
+// - JS/TS sources: comment trivia is blanked with the TypeScript lexer
+//   (maskComments, the comment ranges the other source lints skip), so `//`
+//   inside a string or regex is not a comment and a `/* … */` block spanning
+//   lines is skipped whole. A backtick in code opens a template literal — a
+//   string value — so it stays a quote form.
+// - Shell sources (.sh/.bash, Dockerfile, entrypoint): `#` starts a comment
+//   when it begins a word outside quotes, and a backtick is command
+//   substitution (code), not a string delimiter.
+// Identifiers are therefore never candidates by construction: a bare name is
+// not a string literal, and a backticked name in a comment is comment text.
+// A JS/TS source the lexer cannot parse keeps the unmasked scan (every quote
+// pair is a candidate): when comments cannot be located the scan may
+// over-report, never under-report.
+export function extractStringLiteralCandidates(
+	content: string,
+	relativePath: string,
+): StringLiteralCandidate[] {
+	const shell = !isJavaScriptFamilySource(relativePath);
+	const codeLines = (shell ? content : maskCommentsForSecretScan(content, relativePath)).split(
+		/\r?\n/,
+	);
+	const candidates: StringLiteralCandidate[] = [];
+	for (let lineIndex = 0; lineIndex < codeLines.length; lineIndex += 1) {
+		const line = codeLines[lineIndex] ?? "";
+		const values = shell ? extractShellLineStrings(line) : extractQuotedLineStrings(line);
+		for (const value of values) candidates.push({ value, lineIndex });
+	}
+	return candidates;
+}
+
+function isJavaScriptFamilySource(relativePath: string): boolean {
+	return /\.(?:ts|tsx|js|jsx|mjs|cjs)$/.test(relativePath);
+}
+
+function maskCommentsForSecretScan(content: string, relativePath: string): string {
+	try {
+		return maskComments(content, relativePath);
+	} catch {
+		// Unparseable: scan the source unmasked rather than skip it.
+		return content;
+	}
+}
+
+// Quoted bodies on one comment-free JS/TS line (`"`, `'`, and template
+// backticks), with backslash escapes.
+function extractQuotedLineStrings(line: string): string[] {
 	const candidates: string[] = [];
 	for (let index = 0; index < line.length; index += 1) {
 		const quote = line[index];
@@ -3929,6 +5750,51 @@ export function extractStringLiteralCandidates(line: string): string[] {
 	return candidates;
 }
 
+// Characters after which a `#` begins a new shell word (blanks and the
+// metacharacters `;&|()<>`).
+const SHELL_WORD_BOUNDARY = /[\s;&|()<>]/;
+
+// Quoted bodies on one shell line. Single quotes take no escapes; double
+// quotes and unquoted text honor backslash escapes. A `#` that begins a word
+// outside quotes ends the line's code (the rest is a comment). A word begins
+// at the line start or after an UNESCAPED boundary character, so `${#var}`,
+// `$#`, `"a"#b`, and `word\ #` (escaped blank) keep `#` inside the word.
+// Backticks are command substitution, so their text is lexed as code. A
+// quote left open on the line is read as a literal character, as the
+// line-based scan always has.
+function extractShellLineStrings(line: string): string[] {
+	const candidates: string[] = [];
+	let index = 0;
+	let atWordStart = true;
+	while (index < line.length) {
+		const char = line[index];
+		if (char === "\\") {
+			index += 2;
+			atWordStart = false;
+			continue;
+		}
+		if (char === "#" && atWordStart) break;
+		if (char === '"' || char === "'") {
+			const contentStart = index + 1;
+			let cursor = contentStart;
+			while (cursor < line.length && line[cursor] !== char) {
+				cursor += char === '"' && line[cursor] === "\\" ? 2 : 1;
+			}
+			if (cursor < line.length) {
+				if (cursor - contentStart >= ENTROPY_CANDIDATE_MIN_LENGTH) {
+					candidates.push(line.slice(contentStart, cursor));
+				}
+				index = cursor + 1;
+				atWordStart = false;
+				continue;
+			}
+		}
+		atWordStart = SHELL_WORD_BOUNDARY.test(char ?? "");
+		index += 1;
+	}
+	return candidates;
+}
+
 function classifyEntropyCandidate(input: {
 	value: string;
 	line: string;
@@ -4023,9 +5889,7 @@ type LineStringLiteral = {
 // Stable identity for the container a literal sits in ("top" when the
 // literal is not inside any bracket on the line).
 function literalContainerKey(literal: LineStringLiteral): string {
-	return literal.container
-		? `${literal.container.bracket}${literal.container.index}`
-		: "top";
+	return literal.container ? `${literal.container.bracket}${literal.container.index}` : "top";
 }
 
 // Single-pass line tokenizer: extracts every string literal with its span and
@@ -4035,7 +5899,7 @@ function literalContainerKey(literal: LineStringLiteral): string {
 // other literal is a VALUE: ternary arms (preceded by "?" or ":"), array
 // elements, call arguments, and assignment right-hand sides, even when a
 // ternary's ":" happens to follow them. Uses the same quote/escape walking as
-// extractStringLiteralCandidates.
+// extractQuotedLineStrings.
 function tokenizeLineStringLiterals(line: string): LineStringLiteral[] {
 	const literals: LineStringLiteral[] = [];
 	const bracketStack: Array<{ bracket: "[" | "(" | "{"; index: number }> = [];
@@ -4166,8 +6030,9 @@ function shannonEntropy(value: string): number {
 
 function guessSecretName(line: string): string {
 	const match =
-		/\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)/.exec(line) ??
-		/["']?([A-Za-z_$][\w$-]*)["']?\s*:/.exec(line);
+		/\b[A-Za-z_$][\w$]*(?:\s*\.\s*([A-Za-z_$][\w$]*))+\s*=/.exec(line) ??
+		/["']?([A-Za-z_$][\w$-]*)["']?\s*:\s*["'`]/.exec(line) ??
+		/\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)/.exec(line);
 	const raw = match?.[1] ?? "SECRET";
 	return raw
 		.replace(/([a-z0-9])([A-Z])/g, "$1_$2")
@@ -4182,6 +6047,35 @@ const SECRETISH_IDENTIFIER_PATTERN = /key|token|secret|password|credential|auth/
 // the three stay coherent.
 const ENTROPY_CANDIDATE_MIN_LENGTH = 20;
 
+// A secret-ish name is only supporting evidence. Shorter values must also look
+// credential-like, and known config tokens/numeric values are never candidates.
+const SECRET_NAMED_ENV_VALUE_MIN_LENGTH = 4;
+const SECRET_NAMED_ENV_UNSTRUCTURED_MIN_LENGTH = 8;
+const NON_SECRET_ENV_VALUE_TOKENS = new Set([
+	"true",
+	"false",
+	"yes",
+	"no",
+	"on",
+	"off",
+	"none",
+	"null",
+	"nil",
+	"auto",
+	"default",
+	"local",
+	"debug",
+	"info",
+	"warn",
+	"error",
+	"always",
+	"never",
+	"enabled",
+	"disabled",
+	"0",
+	"1",
+]);
+
 const SECRET_PATTERNS: Array<[string, RegExp]> = [
 	["JWT-like token", /eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{10,}/],
 	["GitHub token", /gh[pousr]_[A-Za-z0-9_]{30,}/],
@@ -4193,12 +6087,150 @@ const SECRET_PATTERNS: Array<[string, RegExp]> = [
 	],
 ];
 
-async function safeLoadProvider(providerRoot: string): Promise<ProviderDefinition | undefined> {
+type SafeLoadProviderResult =
+	| { ok: true; provider: ProviderDefinition | undefined }
+	| { ok: false; error: unknown };
+
+async function safeLoadProvider(providerRoot: string): Promise<SafeLoadProviderResult> {
+	try {
+		return { ok: true, provider: await loadProvider(providerRoot) };
+	} catch (error) {
+		return { ok: false, error };
+	}
+}
+
+const UNRENDERABLE_LOAD_ERROR = "<thrown value could not be rendered>";
+
+function formatLoadErrorEvidence(error: unknown, providerRoot: string): string[] {
+	const evidence: string[] = [];
+	const seen = new Set<object>();
+	let current: unknown = error;
+	let frame = 0;
+	while (frame < MAX_LOAD_ERROR_EVIDENCE) {
+		if (typeof current === "object" || typeof current === "function") {
+			if (current !== null && seen.has(current)) {
+				break;
+			}
+			if (current !== null) seen.add(current);
+		}
+		evidence.push(
+			`${frame === 0 ? "Load error" : "Cause"}: ${sanitizeLoadErrorText(
+				formatThrownValue(current),
+				providerRoot,
+			)}`,
+		);
+		frame += 1;
+		const cause = readThrownValueCause(current);
+		if (!cause.found || cause.value === undefined || cause.value === null) {
+			break;
+		}
+		current = cause.value;
+	}
+	return evidence;
+}
+
+function formatThrownValue(value: unknown): string {
 	try {
-		return await loadProvider(providerRoot);
+		if (value instanceof Error) {
+			return String(value.message);
+		}
+		if (
+			value !== null &&
+			(typeof value === "object" || typeof value === "function") &&
+			"message" in value
+		) {
+			return String((value as { message?: unknown }).message);
+		}
+		return `<non-Error value thrown: ${String(value)}>`;
 	} catch {
-		return undefined;
+		return UNRENDERABLE_LOAD_ERROR;
+	}
+}
+
+function readThrownValueCause(value: unknown): { found: boolean; value?: unknown } {
+	try {
+		if (
+			value === null ||
+			(typeof value !== "object" && typeof value !== "function") ||
+			!("cause" in value)
+		) {
+			return { found: false };
+		}
+		return { found: true, value: (value as { cause?: unknown }).cause };
+	} catch {
+		return { found: false };
+	}
+}
+
+function isPlausibleSecretNamedEnvValue(value: string): boolean {
+	const normalized = value.trim();
+	if (normalized.length < SECRET_NAMED_ENV_VALUE_MIN_LENGTH) return false;
+	if (NON_SECRET_ENV_VALUE_TOKENS.has(normalized.toLowerCase())) return false;
+	if (/^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i.test(normalized)) return false;
+	if (normalized.length >= SECRET_NAMED_ENV_UNSTRUCTURED_MIN_LENGTH) return true;
+
+	const hasLetter = /[A-Za-z]/.test(normalized);
+	const hasDigitOrSymbol = /[^A-Za-z\s]/.test(normalized);
+	return hasLetter && hasDigitOrSymbol;
+}
+
+function replaceEnvValue(
+	input: string,
+	value: string,
+	requireIdentifierBoundaries: boolean,
+): string {
+	if (!requireIdentifierBoundaries) return input.replaceAll(value, "[REDACTED]");
+	const escaped = value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	return input.replace(
+		new RegExp(`(?<![A-Za-z0-9_])${escaped}(?![A-Za-z0-9_])`, "g"),
+		"[REDACTED]",
+	);
+}
+
+function sanitizeLoadErrorText(value: string, providerRoot: string): string {
+	let output = value.replace(
+		/(^|[^A-Za-z0-9_.])((?:\/[^\s"'`]+)+)/g,
+		(_match, prefix: string, rawPath: string) => {
+			const pathCandidate = rawPath.replace(/[),.;:!?]+$/u, "");
+			const relativePath = relative(providerRoot, resolve(pathCandidate));
+			const insideProvider =
+				relativePath === "" || (relativePath !== ".." && !relativePath.startsWith(`..${sep}`));
+			return `${prefix}${insideProvider ? relativePath || "." : "[REDACTED_PATH]"}`;
+		},
+	);
+	output = output.replace(/[A-Za-z]:[\\/][^\s"'`]+/g, "[REDACTED_PATH]");
+	output = output.replace(
+		/((?:password|token|secret|api[_-]?key|credential|authorization)\s*[:=]\s*)(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|`(?:\\.|[^`\\])*`|["'`]?[^\s,;"'`]+)/gi,
+		"$1[REDACTED]",
+	);
+	const envValues: Array<{ value: string; requireIdentifierBoundaries: boolean }> = [];
+	for (const [name, item] of Object.entries(process.env)) {
+		if (typeof item !== "string") continue;
+		const secretNamed = SECRETISH_IDENTIFIER_PATTERN.test(name);
+		let shouldRedact = secretNamed;
+		if (secretNamed) {
+			shouldRedact = isPlausibleSecretNamedEnvValue(item);
+		} else if (item.length >= ENTROPY_CANDIDATE_MIN_LENGTH && shouldConsiderEntropyValue(item)) {
+			const charset = classifyEntropyCharset(item);
+			const threshold = charset === "hex" ? 3.0 : 4.5;
+			shouldRedact = charset !== undefined && shannonEntropy(item) >= threshold;
+		}
+		if (shouldRedact) {
+			envValues.push({
+				value: item,
+				requireIdentifierBoundaries:
+					secretNamed && item.trim().length < ENTROPY_CANDIDATE_MIN_LENGTH,
+			});
+		}
+	}
+	envValues.sort((a, b) => b.value.length - a.value.length);
+	for (const envValue of envValues) {
+		output = replaceEnvValue(output, envValue.value, envValue.requireIdentifierBoundaries);
 	}
+	output = redact(output).replace(/\s+/g, " ");
+	return output.length > MAX_LOAD_ERROR_MESSAGE_LENGTH
+		? `${output.slice(0, MAX_LOAD_ERROR_MESSAGE_LENGTH - 1)}…`
+		: output;
 }
 
 async function loadProvider(providerRoot: string): Promise<ProviderDefinition | undefined> {