@bbradar/mcp 0.1.20 → 0.2.1

package/dist/server.js

@@ -1,11 +1,12 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
 import { BBRadarApiError } from "./bbradarClient.js";
+import { NumericCursorStore } from "./cursorStore.js";
 import { stableStringify, stripUndefined } from "./json.js";
 import { FixedWindowRateLimiter } from "./rateLimit.js";
-import { readArray, readBoolean, readNumber, readObject, readString, sanitizeJson, sanitizeChange, sanitizeProgram, sanitizeTarget, sanitizeTargetsForExport } from "./sanitize.js";
-const SERVER_VERSION = "0.1.19";
+import { readArray, readBoolean, readNumber, readObject, readString, sanitizeJson, sanitizeChange, sanitizeProgram, sanitizeRepositoryChange, sanitizeTarget, sanitizeTargetsForExport } from "./sanitize.js";
+const SERVER_VERSION = "0.2.1";
 const MAX_PROGRAMS_PER_SEARCH = 100;
 const MAX_TARGET_EXPORT = 500;
 const MAX_RECENT_CHANGES = 100;
@@ -29,10 +30,13 @@ const MAX_FILTER_DISCOVERY_PAGES = 5;
 const DEFAULT_FILTER_TARGET_SAMPLE_PROGRAMS = 10;
 const MAX_FILTER_TARGET_SAMPLE_PROGRAMS = 25;
 const MAX_LOCAL_EXPORT_RESOURCES = 25;
+const MAX_LOCAL_EXPORT_BYTES = 64 * 1024 * 1024;
+const LOCAL_EXPORT_TTL_MS = 10 * 60 * 1000;
 const EXPORT_PREVIEW_LIMIT = 25;
 const STALE_PROGRAM_ID_RESOLVE_PAGES = 1;
 const STALE_PROGRAM_ID_RESOLVE_BUDGET = 12;
 const PROGRAM_FALLBACK_CACHE_MAX_ENTRIES = 200;
+const MAX_IN_MEMORY_FEED_CURSORS = 500;
 const MAX_RESOLVE_SEARCH_QUERIES = 4;
 const FAST_RESOLVE_SEARCH_QUERIES = 2;
 const MAX_DIRECT_HANDLE_RESOLUTION_REQUESTS = 96;
@@ -45,6 +49,8 @@ const CORE_TOOL_NAMES = new Set([
     "get_program_eligible_targets_by_name",
     "get_program_targets",
     "get_recent_changes",
+    "get_repository_changes",
+    "find_repository_hunt_targets",
     "get_latest_added_targets",
     "get_opportunities",
     "find_programs",
@@ -54,6 +60,12 @@ const CORE_TOOL_NAMES = new Set([
     "get_mcp_status",
     "export_targets"
 ]);
+const TOOL_ENDPOINT_REQUIREMENTS = {
+    get_repository_changes: "repository_changes",
+    find_repository_hunt_targets: "repository_changes",
+    export_targets: "target_export",
+    get_opportunities: "opportunities"
+};
 const PROGRAM_ID_PLATFORM_GUESSES = [
     "HackerOne",
     "BugCrowd",
@@ -159,6 +171,7 @@ const TARGET_QUERY_STOP_WORDS = new Set([
 ]);
 const targetListModeSchema = z.enum(["identifiers", "compact", "full"]);
 const changeListModeSchema = z.enum(["compact", "full"]);
+const repositoryChangeListModeSchema = z.enum(["compact", "full"]);
 const programListModeSchema = z.enum(["compact", "full"]);
 const rewardThresholdModeSchema = z.enum(["max_at_least", "min_at_least"]);
 const vdpModeSchema = z.enum(["include", "exclude", "only_likely", "only_known_no_bounty"]);
@@ -227,6 +240,8 @@ const pageSchema = z.number().int().min(1).default(1);
 const programsPageSizeSchema = z.number().int().min(1).max(MAX_PROGRAMS_PER_SEARCH).default(20);
 const recentChangesPageSizeSchema = z.number().int().min(1).max(MAX_RECENT_CHANGES).default(50);
 const opportunityLevelSchema = z.enum(["elite", "hot", "strong", "potential"]);
+const targetOpportunityLabelSchema = z.enum(["Elite Target", "Strong Target", "Potential Target", "Normal"]);
+const competitionRiskSchema = z.enum(["Low", "Medium", "High", "Unknown"]);
 const programSortSchema = z
     .enum([
     "best_match",
@@ -278,6 +293,7 @@ function toolTimingOutputSchema() {
 function cacheOutputSchema() {
     return z.object({
         hit: z.boolean(),
+        stale_while_revalidate: z.boolean().optional(),
         coalesced_live_request: z.boolean().optional(),
         expires_at: z.string().optional()
     });
@@ -364,10 +380,12 @@ const programCandidatePresetInputSchema = {
     output_mode: programListModeSchema.default("compact"),
     upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(30)
 };
-function createProfiledToolRegistrar(server, profile) {
+function createProfiledToolRegistrar(server, profile, client) {
     return (name, toolConfig, callback) => {
         const registeredTool = server.registerTool(name, toolConfig, callback);
-        if (profile === "core" && !CORE_TOOL_NAMES.has(name)) {
+        const requiredEndpoint = TOOL_ENDPOINT_REQUIREMENTS[name];
+        if ((profile === "core" && !CORE_TOOL_NAMES.has(name)) ||
+            (requiredEndpoint !== undefined && !client.supportsEndpoint(requiredEndpoint))) {
             registeredTool.disable();
         }
         return registeredTool;
@@ -391,7 +409,9 @@ export function createBbradarServer(client, config) {
             "Partial program name + action: run_program_name_action. Partial program name only: resolve_program.",
             "Default to bounty-eligible in-scope data. Include out-of-scope, ineligible, VDP, disclosure-only, or no-bounty data only when the user explicitly asks.",
             "Recently updated programs across platforms: find_recently_updated_programs. Do not infer a platform such as Immunefi unless the user explicitly names it.",
+            "Self-Hosted programs use Self-Hosted:slug ids and are available through program search, exact detail, and target tools. Respect data_capabilities; do not infer missing opportunity, report-count, target-change, submission-cost, or repository signals.",
             "Freshness: find_recently_updated_programs, get_latest_added_targets, check_program_new_targets, check_watchlist_new_targets, find_recent_by_type, get_program_scope_delta.",
+            "Repository activity: get_repository_changes defaults to compact program-only events. Seed with after_id, then resume the in-memory per-filter cursor.",
             "Discovery: find_program_candidates, find_wildcard_programs, find_recently_added_wildcards, find_low_competition_high_reward, find_stack_matches, find_language_programs, find_target_type_programs, find_reward_programs, find_paid_programs, find_vdp_programs, find_web3_contests, find_low_noise_programs.",
             "Details: get_program_brief, get_program_scope_summary, get_program_target_breakdown, find_programs_by_target, compare_programs_compact.",
             "Prefer compact/identifier outputs and disclose sampled ranking scope when present."
@@ -402,13 +422,26 @@ export function createBbradarServer(client, config) {
     }, {
         instructions: instructions.join("\n")
     });
-    const registerTool = createProfiledToolRegistrar(server, config.toolProfile);
+    const registerTool = createProfiledToolRegistrar(server, config.toolProfile, client);
     const rateLimiter = new FixedWindowRateLimiter();
     const exportStore = new Map();
+    const continuationStore = new Map();
+    const feedCursorStore = new NumericCursorStore(config.cursorStatePath, MAX_IN_MEMORY_FEED_CURSORS);
+    const maxProgramsPageSize = client.endpointNumber("programs", "max_page_size", MAX_PROGRAMS_PER_SEARCH);
+    const maxProgramTargetsPageSize = client.endpointNumber("program_targets", "max_page_size", MAX_TARGETS_PER_PROGRAM);
+    const maxTargetChangesPageSize = client.endpointNumber("target_changes", "max_page_size", MAX_RECENT_CHANGES);
+    const maxRepositoryChangesPageSize = client.endpointNumber("repository_changes", "max_page_size", MAX_RECENT_CHANGES);
+    const maxTargetExport = client.endpointNumber("target_export", "max_targets", MAX_TARGET_EXPORT);
+    const maxTargetExportProgramIds = client.endpointNumber("target_export", "max_program_ids", 50);
+    const programsPageSizeSchema = z.number().int().min(1).max(maxProgramsPageSize).default(Math.min(20, maxProgramsPageSize));
+    const recentChangesPageSizeSchema = z.number().int().min(1).max(maxTargetChangesPageSize).default(Math.min(50, maxTargetChangesPageSize));
+    const repositoryChangesPageSizeSchema = z.number().int().min(1).max(maxRepositoryChangesPageSize).default(Math.min(50, maxRepositoryChangesPageSize));
+    const acceptedTargetLimitSchema = z.number().int().min(1).max(maxProgramTargetsPageSize);
     registerTool("search_programs", {
         title: "Search BBRadar Programs",
-        description: `List active programs. page_size max ${MAX_PROGRAMS_PER_SEARCH}.`,
+        description: `Search or list active platform and Self-Hosted programs. page_size max ${MAX_PROGRAMS_PER_SEARCH}.`,
         inputSchema: {
+            search: searchTextSchema.optional().describe("Server-side program name, handle, platform, policy-host, or target search."),
             platforms: platformListSchema(),
             tags: tagListSchema(),
             updated_since: isoDateTimeSchema.optional().describe("ISO datetime."),
@@ -505,8 +538,8 @@ export function createBbradarServer(client, config) {
             language_tags: languageTagListSchema(),
             include_out_of_scope: z.boolean().default(false),
             include_ineligible: z.boolean().default(false),
-            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
-            max_targets: acceptedTargetLimitSchema.default(25),
+            page_size: recentChangesPageSizeSchema.default(Math.min(MAX_RECENT_CHANGES, maxTargetChangesPageSize)),
+            max_targets: acceptedTargetLimitSchema.default(Math.min(25, maxProgramTargetsPageSize)),
             group_limit: z.number().int().min(1).max(MAX_TARGETS_PER_PROGRAM).default(100),
             target_list_mode: targetListModeSchema.default("identifiers"),
             max_resolve_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
@@ -549,6 +582,7 @@ export function createBbradarServer(client, config) {
             resolved_program: jsonRecordSchema().optional(),
             program_id: z.string().optional(),
             targets: z.array(z.unknown()).optional(),
+            continuation: jsonRecordSchema().optional(),
             warnings: z.array(z.string()).optional(),
             upstream_budget: jsonRecordSchema().optional(),
             ranking_scope: jsonRecordSchema().optional(),
@@ -558,14 +592,19 @@ export function createBbradarServer(client, config) {
     }, (args) => runTool("get_program_eligible_targets_by_name", config, rateLimiter, async () => getProgramEligibleTargetsByName(client, config, args)));
     registerTool("get_program_targets", {
         title: "Get Program Targets",
-        description: `Get active targets for one program_id, handle, or human program name. This is a final source for eligible target lists; do not call summary/breakdown unless grouped counts are needed. For a program name query, get_program_eligible_targets_by_name is the simplest path. limit max ${MAX_TARGETS_PER_PROGRAM}.`,
+        description: `Get active targets for one program_id, handle, or human program name. This is a final source for eligible target lists; do not call summary/breakdown unless grouped counts are needed. For a program name query, get_program_eligible_targets_by_name is the simplest path. limit max ${maxProgramTargetsPageSize}.`,
         inputSchema: {
             program_id: programIdentifierSchema,
+            search: searchTextSchema.optional(),
+            target_type: filterValueSchema().optional(),
+            min_target_score: z.number().int().min(0).max(100).optional(),
+            target_opportunity_label: targetOpportunityLabelSchema.optional(),
+            competition_risk: competitionRiskSchema.optional(),
             include_out_of_scope: z.boolean().default(false),
             include_ineligible: z.boolean().default(false),
             strict_scope_filter: z.boolean().default(true),
             offset: z.number().int().min(0).default(0),
-            limit: z.number().int().min(1).max(MAX_TARGETS_PER_PROGRAM).default(100),
+            limit: z.number().int().min(1).max(maxProgramTargetsPageSize).default(Math.min(100, maxProgramTargetsPageSize)),
             output_mode: targetListModeSchema.default("compact")
         },
         outputSchema: {
@@ -576,13 +615,21 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_targets", config, rateLimiter, async () => {
-        return runProgramIdTool(client, config, args.program_id, async (programId) => getProgramTargetsPayload(client, args, programId), async (indexFallback) => getProgramTargetsExportFallbackPayload(client, args, indexFallback.resolvedProgramId));
+        const payload = await runProgramIdTool(client, config, args.program_id, async (programId) => getProgramTargetsPayload(client, args, programId), async (indexFallback) => getProgramTargetsExportFallbackPayload(client, args, indexFallback.resolvedProgramId));
+        return applyCollectionContinuation(payload, "targets", "program targets", continuationStore, config);
     }));
     registerTool("get_recent_changes", {
         title: "Get Recent Target Changes",
         description: `List recent target changes. page_size max ${MAX_RECENT_CHANGES}.`,
         inputSchema: {
             change_type: z.enum(["added", "updated", "removed"]).optional(),
+            after_id: z.number().int().min(0).optional().describe("Incremental cursor; returns changes after this id in ascending order."),
+            resume_cursor: z.boolean().default(false).describe("Resume the in-memory cursor for this exact normalized filter set. Seed it once with after_id."),
+            max_cursor_pages: z.number().int().min(1).max(10).default(2),
+            cursor_time_budget_ms: z.number().int().min(100).max(10_000).default(3_000),
+            min_target_score: z.number().int().min(0).max(100).optional(),
+            target_opportunity_label: targetOpportunityLabelSchema.optional(),
+            competition_risk: competitionRiskSchema.optional(),
             include_removed: z.boolean().default(false),
             include_ineligible: z.boolean().default(false),
             include_out_of_scope: z.boolean().default(false),
@@ -597,26 +644,148 @@ export function createBbradarServer(client, config) {
             ...apiEnvelopeOutputShape(),
             changes: z.array(jsonRecordSchema()).optional(),
             meta: jsonRecordSchema().optional(),
-            facets: jsonRecordSchema().optional()
+            facets: jsonRecordSchema().optional(),
+            cursor: jsonRecordSchema().optional(),
+            continuation: jsonRecordSchema().optional()
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_recent_changes", config, rateLimiter, async () => {
-        const { output_mode, ...filters } = args;
-        const api = await client.getRecentChanges(toQuery(filters));
-        const data = readObject(api.data);
+        const { output_mode, resume_cursor, max_cursor_pages, cursor_time_budget_ms, ...filters } = args;
+        const cursor = resolveFeedCursor(feedCursorStore, "target_changes", filters, resume_cursor);
+        const { min_target_score, target_opportunity_label, competition_risk, ...upstreamFilters } = filters;
+        const collected = await collectCursorFeedPages(feedCursorStore, cursor, max_cursor_pages, cursor_time_budget_ms, (afterId) => client.getRecentChanges(toQuery({
+            ...upstreamFilters,
+            minTargetScore: min_target_score,
+            targetOpportunityLabel: target_opportunity_label,
+            competitionRisk: competition_risk,
+            after_id: afterId,
+            page: afterId === undefined ? filters.page : 1
+        })));
+        const api = collected.lastApi;
+        const data = collected.lastData;
         const sanitizedMeta = readObject(sanitizeJson(data?.meta));
-        const changes = readArray(data?.results)
+        const changes = collected.results
             .map((change) => sanitizeChange(change, config.webBaseUrl))
             .map((change) => formatChange(change, output_mode));
-        return withApiMetadata(api, {
+        return applyCollectionContinuation(withApiMetadata(api, {
             changes,
             meta: stripUndefined({
                 ...(sanitizedMeta ?? {}),
-                output_mode
+                output_mode,
+                pages_fetched: collected.pagesFetched,
+                returned_across_pages: changes.length,
+                cursor_page_budget_exhausted: collected.pageBudgetExhausted,
+                cursor_time_budget_exhausted: collected.timeBudgetExhausted
             }),
-            facets: sanitizeJson(data?.facets)
-        });
+            facets: sanitizeJson(data?.facets),
+            cursor: collected.cursor,
+            source_requests: collected.sourceRequests.length > 1 ? collected.sourceRequests : undefined
+        }), "changes", "target changes", continuationStore, config);
+    }));
+    registerTool("get_repository_changes", {
+        title: "Get Repository Changes",
+        description: "Read-only repository push/change feed for direct inspection or polling. Defaults to lightweight program summaries; use after_id for efficient incremental polling. Use find_repository_hunt_targets instead when reward or target-quality ranking is also required.",
+        inputSchema: {
+            after_id: z.number().int().min(0).optional().describe("Incremental cursor; returns events after this id in ascending order."),
+            resume_cursor: z.boolean().default(false).describe("Resume the in-memory cursor for this exact normalized filter set. Seed it once with after_id."),
+            max_cursor_pages: z.number().int().min(1).max(10).default(2),
+            cursor_time_budget_ms: z.number().int().min(100).max(10_000).default(3_000),
+            include_targets: z.boolean().default(false).describe("Include matched targets. False is faster and returns affected programs only."),
+            search: searchTextSchema.optional(),
+            platforms: platformListSchema(),
+            tags: tagListSchema(),
+            free_submission_only: z.boolean().default(false),
+            include_removed: z.boolean().default(false),
+            include_ineligible: z.boolean().default(false),
+            include_out_of_scope: z.boolean().default(false),
+            page: pageSchema,
+            page_size: repositoryChangesPageSizeSchema,
+            output_mode: repositoryChangeListModeSchema.default("compact")
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape(),
+            repository_changes: z.array(jsonRecordSchema()).optional(),
+            meta: jsonRecordSchema().optional(),
+            facets: jsonRecordSchema().optional(),
+            available_facets: jsonRecordSchema().optional(),
+            cursor: jsonRecordSchema().optional(),
+            continuation: jsonRecordSchema().optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("get_repository_changes", config, rateLimiter, async () => {
+        if (!client.supportsEndpoint("repository_changes")) {
+            throw new Error("The negotiated BBRadar API contract does not expose repository changes.");
+        }
+        const { output_mode, resume_cursor, max_cursor_pages, cursor_time_budget_ms, ...filters } = args;
+        const cursor = resolveFeedCursor(feedCursorStore, "repository_changes", filters, resume_cursor);
+        const collected = await collectCursorFeedPages(feedCursorStore, cursor, max_cursor_pages, cursor_time_budget_ms, (afterId) => client.getRepositoryChanges(toQuery({
+            ...filters,
+            after_id: afterId,
+            page: afterId === undefined ? filters.page : 1
+        })));
+        const api = collected.lastApi;
+        const data = collected.lastData;
+        return applyCollectionContinuation(withApiMetadata(api, {
+            repository_changes: collected.results.map((change) => sanitizeRepositoryChange(change, config.webBaseUrl)).map((change) => formatRepositoryChange(change, output_mode)),
+            meta: stripUndefined({
+                ...(readObject(sanitizeJson(data?.meta)) ?? {}),
+                output_mode,
+                pages_fetched: collected.pagesFetched,
+                returned_across_pages: collected.results.length,
+                cursor_page_budget_exhausted: collected.pageBudgetExhausted,
+                cursor_time_budget_exhausted: collected.timeBudgetExhausted
+            }),
+            facets: sanitizeJson(data?.facets),
+            available_facets: sanitizeJson(data?.available_facets),
+            cursor: collected.cursor,
+            source_requests: collected.sourceRequests.length > 1 ? collected.sourceRequests : undefined
+        }), "repository_changes", "repository changes", continuationStore, config);
     }));
+    registerTool("find_repository_hunt_targets", {
+        title: "Find Repository-Aware Hunt Targets",
+        description: "Fast one-call path for requests that combine recent repository activity with program rewards and target quality. Fetches program rankings and repository changes in parallel, joins them locally, and works with arbitrary platforms, Web2/Web3 modes, reward thresholds, target types, languages, and freshness criteria.",
+        inputSchema: {
+            platforms: platformListSchema(),
+            exclude_platforms: stringListSchema("Platforms to exclude from final matches."),
+            tags: tagListSchema(),
+            scope_tags: scopeTagListSchema(),
+            target_types: targetTypeListSchema(),
+            language_tags: languageTagListSchema(),
+            surface_mode: z.enum(["any", "web2", "web3"]).default("any"),
+            opportunity_levels: z.array(opportunityLevelSchema).max(4).default([]),
+            min_bounty_max: z.number().int().min(0).optional(),
+            require_bounty: z.boolean().default(true),
+            max_public_report_count: z.number().int().min(0).optional(),
+            include_unknown_report_count: z.boolean().default(true),
+            min_eligible_targets: z.number().int().min(0).default(1),
+            min_total_targets: z.number().int().min(0).optional(),
+            min_wildcards: z.number().int().min(0).max(1000).default(0),
+            min_added_7d: z.number().int().min(0).optional(),
+            changed_since: isoDateTimeSchema.optional(),
+            free_submission_only: z.boolean().default(false),
+            min_target_score: z.number().int().min(0).max(100).default(60),
+            target_opportunity_labels: z.array(targetOpportunityLabelSchema).max(4).default([]),
+            competition_risks: z.array(competitionRiskSchema).max(4).default([]),
+            max_program_pages: z.number().int().min(1).max(MAX_FIND_PROGRAM_PAGES).default(3),
+            max_program_candidates: z.number().int().min(1).max(MAX_FIND_PROGRAM_RESULTS).default(MAX_FIND_PROGRAM_RESULTS),
+            repository_page_size: z.number().int().min(1).max(maxRepositoryChangesPageSize).default(Math.min(100, maxRepositoryChangesPageSize)),
+            max_results: z.number().int().min(1).max(25).default(10),
+            max_targets_per_result: z.number().int().min(1).max(20).default(5),
+            ranking_mode: z.enum(["balanced", "highest_reward", "best_target", "newest"]).default("balanced"),
+            output_mode: repositoryChangeListModeSchema.default("compact"),
+            upstream_request_budget: z.number().int().min(2).max(MAX_FIND_UPSTREAM_REQUEST_BUDGET).default(10)
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape(),
+            matches: z.array(jsonRecordSchema()).optional(),
+            programs: z.array(jsonRecordSchema()).optional(),
+            filters: jsonRecordSchema().optional(),
+            upstream_budget: jsonRecordSchema().optional(),
+            ranking_scope: jsonRecordSchema().optional(),
+            meta: jsonRecordSchema().optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("find_repository_hunt_targets", config, rateLimiter, async () => findRepositoryHuntTargets(client, config, args)));
     registerTool("get_latest_added_targets", {
         title: "Get Latest Added Targets",
         description: "Latest added targets by type with optional platform, reward, and report-count filters. For fast wildcard discovery use target_type=wildcard and include_full_target_list=false.",
@@ -630,7 +799,7 @@ export function createBbradarServer(client, config) {
             include_unknown_report_count: z.boolean().default(true),
             include_out_of_scope: z.boolean().default(false).describe("Include out-of-scope."),
             include_ineligible: z.boolean().default(false).describe("Include ineligible."),
-            recent_changes_page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
+            recent_changes_page_size: recentChangesPageSizeSchema.default(Math.min(MAX_RECENT_CHANGES, maxTargetChangesPageSize)),
             max_results: z.number().int().min(1).max(MAX_RECENT_CHANGES).default(10),
             include_full_target_list: z.boolean().default(true).describe("Fetch the newest matching program's complete target list. Set false for the fastest cross-program discovery."),
             full_target_list_mode: targetListModeSchema.default("identifiers"),
@@ -701,8 +870,8 @@ export function createBbradarServer(client, config) {
             include_removed: z.boolean().default(true),
             include_out_of_scope: z.boolean().default(false),
             include_ineligible: z.boolean().default(false),
-            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
-            max_targets: acceptedTargetLimitSchema.default(50),
+            page_size: recentChangesPageSizeSchema.default(Math.min(MAX_RECENT_CHANGES, maxTargetChangesPageSize)),
+            max_targets: acceptedTargetLimitSchema.default(Math.min(50, maxProgramTargetsPageSize)),
             target_list_mode: targetListModeSchema.default("identifiers")
         },
         outputSchema: {
@@ -728,7 +897,7 @@ export function createBbradarServer(client, config) {
             platforms: platformListSchema(),
             tags: tagListSchema(),
             language_tags: languageTagListSchema(),
-            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
+            page_size: recentChangesPageSizeSchema.default(Math.min(MAX_RECENT_CHANGES, maxTargetChangesPageSize)),
             max_programs: z.number().int().min(1).max(50).default(10),
             sample_size: z.number().int().min(1).max(20).default(5),
             target_list_mode: targetListModeSchema.default("identifiers")
@@ -749,8 +918,8 @@ export function createBbradarServer(client, config) {
             since: isoDateTimeSchema.optional().describe("ISO datetime."),
             target_type: filterValueSchema().optional(),
             include_ineligible: z.boolean().default(false).describe("Include ineligible."),
-            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
-            max_targets: acceptedTargetLimitSchema.default(25),
+            page_size: recentChangesPageSizeSchema.default(Math.min(MAX_RECENT_CHANGES, maxTargetChangesPageSize)),
+            max_targets: acceptedTargetLimitSchema.default(Math.min(25, maxProgramTargetsPageSize)),
             target_list_mode: targetListModeSchema.default("identifiers")
         },
         outputSchema: {
@@ -774,7 +943,7 @@ export function createBbradarServer(client, config) {
             since: isoDateTimeSchema.optional(),
             target_type: filterValueSchema().optional(),
             include_ineligible: z.boolean().default(false),
-            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
+            page_size: recentChangesPageSizeSchema.default(Math.min(MAX_RECENT_CHANGES, maxTargetChangesPageSize)),
             max_targets_per_program: z.number().int().min(1).max(50).default(10),
             target_list_mode: targetListModeSchema.default("identifiers")
         },
@@ -820,14 +989,16 @@ export function createBbradarServer(client, config) {
     }));
     registerTool("find_programs", {
         title: "Find BBRadar Programs",
-        description: "Ranked program discovery with filters and compact output.",
+        description: "Ranked program discovery with positive and negative platform/surface filters and compact output. Strict-filter retries reuse cached upstream pages, so relax one local filter at a time when a narrow query returns no candidates.",
         inputSchema: {
             platforms: platformListSchema(),
+            exclude_platforms: stringListSchema("Platforms to exclude after retrieval. Use list_filters first when the user asks for a geographic/platform exclusion without naming exact platform values."),
             tags: tagListSchema(),
             scope_tags: scopeTagListSchema(),
             target_types: targetTypeListSchema(),
             language_tags: languageTagListSchema(),
             web3: z.boolean().default(false).describe("Require Web3 signals."),
+            exclude_web3: z.boolean().default(false).describe("Exclude programs with Web3, blockchain, smart-contract, crypto, DeFi, NFT, Solidity, Ethereum, or Solana signals. Use this for Web2-only discovery."),
             opportunity_levels: z.array(opportunityLevelSchema).max(4).default([]),
             updated_since: isoDateTimeSchema.optional(),
             min_bounty_min: z.number().int().min(0).optional(),
@@ -1211,7 +1382,7 @@ export function createBbradarServer(client, config) {
             platforms: platformListSchema(),
             tags: tagListSchema(),
             language_tags: languageTagListSchema(),
-            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
+            page_size: recentChangesPageSizeSchema.default(Math.min(MAX_RECENT_CHANGES, maxTargetChangesPageSize)),
             max_programs: z.number().int().min(1).max(50).default(10),
             sample_size: z.number().int().min(1).max(20).default(5),
             target_list_mode: targetListModeSchema.default("identifiers")
@@ -1387,7 +1558,7 @@ export function createBbradarServer(client, config) {
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_bbradar_guide", config, rateLimiter, async () => ({
         request_id: randomUUID(),
-        guide: bbradarGuide(args.topic, config.toolProfile)
+        guide: bbradarGuide(args.topic, config.toolProfile, client)
     })));
     registerTool("get_mcp_status", {
         title: "Get BBRadar MCP Status",
@@ -1417,6 +1588,13 @@ export function createBbradarServer(client, config) {
             compact_tool_text: config.compactToolText,
             tool_profile: config.toolProfile,
             request_timeout_ms: config.requestTimeoutMs,
+            feed_cursors: feedCursorStore.stats(),
+            continuations: {
+                entries: continuationStore.size,
+                max_entries: MAX_LOCAL_EXPORT_RESOURCES,
+                inline_limit: config.continuationInlineLimit ?? 50,
+                ttl_ms: config.continuationTtlMs ?? LOCAL_EXPORT_TTL_MS
+            },
             validate_on_startup: config.validateOnStartup,
             transport: "stdio",
             remote_streamable_http: "not_enabled_for_local_setup",
@@ -1626,7 +1804,7 @@ export function createBbradarServer(client, config) {
             include_removed: z.boolean().default(true),
             include_ineligible: z.boolean().default(false),
             include_out_of_scope: z.boolean().default(false),
-            page_size: recentChangesPageSizeSchema.default(50)
+            page_size: recentChangesPageSizeSchema.default(Math.min(50, maxTargetChangesPageSize))
         },
         outputSchema: {
             ...apiEnvelopeOutputShape(),
@@ -1638,16 +1816,16 @@ export function createBbradarServer(client, config) {
     }, (args) => runTool("get_program_delta", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramDelta(client, config, { ...args, program_id: programId }))));
     registerTool("export_targets", {
         title: "Export BBRadar Targets",
-        description: `Read-only target export. limit max ${MAX_TARGET_EXPORT}.`,
+        description: `Read-only target export. limit max ${maxTargetExport}.`,
         inputSchema: {
-            program_ids: z.array(programIdentifierSchema).max(50).default([]),
+            program_ids: z.array(programIdentifierSchema).max(maxTargetExportProgramIds).default([]),
             platforms: platformListSchema(),
             tags: tagListSchema(),
             opportunity_levels: z.array(z.enum(["elite", "hot", "strong", "potential"])).max(4).default([]),
             include_out_of_scope: z.boolean().default(false),
             include_ineligible: z.boolean().default(false),
             format: z.enum(["json", "csv"]).default("json"),
-            limit: z.number().int().min(1).max(MAX_TARGET_EXPORT).default(MAX_TARGET_EXPORT)
+            limit: z.number().int().min(1).max(maxTargetExport).default(maxTargetExport)
         },
         outputSchema: {
             ...apiEnvelopeOutputShape(),
@@ -1694,12 +1872,12 @@ export function createBbradarServer(client, config) {
         }
     }));
     registerPrompts(server, config.toolProfile);
-    registerResources(server, client, config, exportStore);
+    registerResources(server, client, config, exportStore, continuationStore);
     return server;
 }
-function bbradarGuide(topic, profile) {
+function bbradarGuide(topic, profile, client) {
     if (profile === "core") {
-        return coreBbradarGuide(topic);
+        return coreBbradarGuide(topic, client);
     }
     const primaryEntryPoints = [
         {
@@ -1708,6 +1886,12 @@ function bbradarGuide(topic, profile) {
             minimum_arguments: {},
             useful_arguments: ["platforms", "target_types", "language_tags", "min_bounty_max", "max_public_report_count", "fresh_launch_days", "has_api_scope"]
         },
+        {
+            tool: "find_repository_hunt_targets",
+            use_when: "The request combines repository activity with reward, target-quality, platform, technology, or freshness filters.",
+            minimum_arguments: {},
+            useful_arguments: ["platforms", "exclude_platforms", "surface_mode", "min_bounty_max", "min_target_score", "changed_since", "ranking_mode"]
+        },
         {
             tool: "run_program_name_action",
             use_when: "The user names one program and asks for a brief, targets, new targets, scope delta, or target breakdown.",
@@ -1732,6 +1916,11 @@ function bbradarGuide(topic, profile) {
             first_tool: "find_program_candidates",
             then: "Use get_program_brief on the best program_id if the user wants details."
         },
+        {
+            user_goal: "Web2 programs with broad scope, good rewards, recent target activity, and excluded platforms",
+            first_tool: "list_filters",
+            then: "Resolve the excluded platform names, then call find_programs with exclude_platforms, exclude_web3=true, exclude_non_web=true, reward/scope/freshness thresholds, and sort_by=most_new_targets. If strict local filters return zero, relax one threshold and retry; cached source pages make the retry cheap."
+        },
         {
             user_goal: "named program summary",
             first_tool: "run_program_name_action",
@@ -1752,6 +1941,18 @@ function bbradarGuide(topic, profile) {
             first_tool: "find_recently_updated_programs",
             then: "Use get_latest_added_targets for global added targets, or check_program_new_targets when the user names one program."
         },
+        {
+            user_goal: "repository changes or repository polling",
+            first_tool: "get_repository_changes",
+            arguments: { include_targets: false, max_cursor_pages: 2 },
+            then: "For incremental polling, seed once with after_id and later set resume_cursor=true with the same filters."
+        },
+        {
+            user_goal: "hunt targets combining repository activity with rewards, target quality, platforms, or Web2/Web3 constraints",
+            first_tool: "find_repository_hunt_targets",
+            arguments: { platforms: ["requested platforms"], surface_mode: "web3", min_bounty_max: 5000, min_target_score: 60 },
+            then: "Use this single composite call instead of manually chaining program discovery and repository tools. Omit or change any example filter the user did not request."
+        },
         {
             user_goal: "latest added wildcard targets with platform, reward, or report-count filters",
             first_tool: "get_latest_added_targets",
@@ -1797,10 +1998,12 @@ function bbradarGuide(topic, profile) {
     };
     const filters = {
         platforms: "Only set when the user explicitly names a platform. Do not infer Immunefi, HackerOne, etc.",
+        exclude_platforms: "Use exact observed values from list_filters for user-requested platform or geographic exclusions.",
         tags: "Broad combined tag filter across scope, language, and target-type signals.",
         scope_tags: "Scope category signals such as domain, api, mobile, smart-contract, wildcard.",
         target_types: "Target-kind signals such as domain, api, url, mobile, smart-contract.",
         language_tags: "Technology/language signals such as javascript, solidity, web3, php, python.",
+        exclude_web3: "Set true for Web2-only requests.",
         vdp_mode: "Default exclude. Include VDP/no-bounty data only when asked."
     };
     const examples = [
@@ -1851,24 +2054,20 @@ function bbradarGuide(topic, profile) {
             require_bounty: true
         },
         primary_entry_points: topic === "start" ? primaryEntryPoints : primaryEntryPoints.filter((entry) => entry.tool !== "get_bbradar_guide"),
-        decision_tree: decisionTree.filter((entry) => topic === "start" || guideEntryMatchesTopic(topic, entry)),
+        decision_tree: decisionTree.filter((entry) => toolAvailableForContract(client, String(entry.first_tool)) &&
+            (topic === "start" || guideEntryMatchesTopic(topic, entry))),
         filters,
         advanced_tools: advancedTools,
         examples
     };
 }
-function coreBbradarGuide(topic) {
+function coreBbradarGuide(topic, client) {
     const decisionTree = [
         {
             user_goal: "find programs to hunt",
             first_tool: "find_programs",
             arguments: { max_results: 10, output_mode: "compact" }
         },
-        {
-            user_goal: "named program summary or action",
-            first_tool: "run_program_name_action",
-            arguments: { query: "program name", action: "brief" }
-        },
         {
             user_goal: "named program targets",
             first_tool: "get_program_eligible_targets_by_name",
@@ -1884,6 +2083,17 @@ function coreBbradarGuide(topic) {
             first_tool: "get_recent_changes",
             then: "Use get_latest_added_targets when only newly added targets are needed."
         },
+        {
+            user_goal: "repository changes or repository polling",
+            first_tool: "get_repository_changes",
+            arguments: { include_targets: false, max_cursor_pages: 2 }
+        },
+        {
+            user_goal: "hunt targets combining repository activity with rewards, target quality, platforms, or Web2/Web3 constraints",
+            first_tool: "find_repository_hunt_targets",
+            arguments: { platforms: ["requested platforms"], surface_mode: "web3", min_bounty_max: 5000, min_target_score: 60 },
+            then: "Use this one call instead of manually chaining program and repository tools. Omit or change any example filter the user did not request."
+        },
         {
             user_goal: "export targets",
             first_tool: "export_targets",
@@ -1909,15 +2119,21 @@ function coreBbradarGuide(topic) {
         },
         primary_entry_points: [
             "find_programs",
+            "find_repository_hunt_targets",
             "run_program_name_action",
             "get_program_eligible_targets_by_name",
             "find_programs_by_target",
             "get_bbradar_guide"
         ],
-        decision_tree: decisionTree.filter((entry) => topic === "start" || guideEntryMatchesTopic(topic, entry)),
-        available_tools: [...CORE_TOOL_NAMES]
+        decision_tree: decisionTree.filter((entry) => toolAvailableForContract(client, String(entry.first_tool)) &&
+            (topic === "start" || guideEntryMatchesTopic(topic, entry))),
+        available_tools: [...CORE_TOOL_NAMES].filter((name) => toolAvailableForContract(client, name))
     };
 }
+function toolAvailableForContract(client, toolName) {
+    const endpoint = TOOL_ENDPOINT_REQUIREMENTS[toolName];
+    return endpoint === undefined || client.supportsEndpoint(endpoint);
+}
 function guideEntryMatchesTopic(topic, entry) {
     const goal = typeof entry.user_goal === "string" ? entry.user_goal : "";
     const firstTool = typeof entry.first_tool === "string" ? entry.first_tool : "";
@@ -1944,15 +2160,52 @@ function guideEntryMatchesTopic(topic, entry) {
     }
     return true;
 }
-function registerResources(server, client, config, exportStore) {
+function registerResources(server, client, config, exportStore, continuationStore) {
+    server.registerResource("continuation", new ResourceTemplate("bbradar://continuations{?continuation_id,offset,limit}", { list: undefined }), {
+        title: "BBRadar Result Continuation",
+        description: "Bounded, short-lived in-memory continuation page for a large tool result.",
+        mimeType: "application/json"
+    }, async (uri) => {
+        const continuationId = uri.searchParams.get("continuation_id") ?? "";
+        pruneExpiredContinuations(continuationStore);
+        const stored = continuationStore.get(continuationId);
+        if (!stored) {
+            return jsonResource(uri.toString(), {
+                request_id: randomUUID(),
+                error: { message: "Continuation not found or expired from local memory." }
+            });
+        }
+        const offset = boundedResourceInteger(uri.searchParams.get("offset"), 0, 0, stored.items.length);
+        const limit = boundedResourceInteger(uri.searchParams.get("limit"), config.continuationInlineLimit ?? 50, 1, 100);
+        const items = stored.items.slice(offset, offset + limit);
+        const nextOffset = offset + items.length;
+        const hasMore = nextOffset < stored.items.length;
+        return jsonResource(uri.toString(), {
+            request_id: randomUUID(),
+            continuation_id: continuationId,
+            label: stored.label,
+            items,
+            meta: {
+                offset,
+                limit,
+                returned: items.length,
+                total: stored.items.length,
+                has_more: hasMore,
+                next_resource_uri: hasMore
+                    ? continuationResourceUri(continuationId, nextOffset, limit)
+                    : undefined
+            }
+        });
+    });
     server.registerResource("target-export", new ResourceTemplate("bbradar://exports{?export_id}", { list: undefined }), {
         title: "BBRadar Target Export",
-        description: "In-memory local target export payload by export_id query parameter.",
+        description: "Bounded, short-lived in-memory target export payload by export_id query parameter.",
         mimeType: "application/json"
     }, async (uri) => {
         const exportId = uri.searchParams.get("export_id") ?? "";
-        const payload = exportStore.get(exportId);
-        if (!payload) {
+        pruneExpiredExports(exportStore);
+        const storedExport = exportStore.get(exportId);
+        if (!storedExport) {
             return jsonResource(uri.toString(), {
                 request_id: randomUUID(),
                 error: {
@@ -1963,7 +2216,7 @@ function registerResources(server, client, config, exportStore) {
         return jsonResource(uri.toString(), {
             request_id: randomUUID(),
             export_id: exportId,
-            export: payload
+            export: storedExport.payload
         });
     });
     server.registerResource("program", new ResourceTemplate("bbradar://program{?program_id}", { list: undefined }), {
@@ -3498,6 +3751,10 @@ function programsByTargetResult(input, warnings, sourceRequests, matches, budget
     });
 }
 async function searchProgramsByTargetApi(client, config, input, budget, warnings, sourceRequests) {
+    if (!client.supportsEndpoint("target_search")) {
+        warnings.push("The negotiated API contract does not expose direct target search; using sampled program target lists.");
+        return undefined;
+    }
     const searchQueries = targetApiSearchQueries(input.target_query);
     const grouped = new Map();
     let rawMatchesScanned = 0;
@@ -3519,7 +3776,7 @@ async function searchProgramsByTargetApi(client, config, input, budget, warnings
                 include_out_of_scope: input.include_out_of_scope,
                 include_ineligible: input.include_ineligible,
                 page: 1,
-                page_size: Math.max(input.max_results * input.max_targets_per_program, input.max_results)
+                page_size: Math.min(client.endpointNumber("target_search", "max_page_size", MAX_TARGETS_PER_PROGRAM), Math.max(input.max_results * input.max_targets_per_program, input.max_results))
             });
             refundBudgetIfNoUpstreamRequest(budget, api);
         }
@@ -4096,8 +4353,18 @@ function latestAddedProgramMatches(change, input, platformFilters) {
     return true;
 }
 async function getProgramTargetsPayload(client, input, programId) {
-    const api = await client.getProgramTargets(programId);
+    const api = await client.getProgramTargets(programId, {
+        search: input.search,
+        target_type: input.target_type,
+        eligibility: input.include_ineligible ? "all" : "eligible",
+        minTargetScore: input.min_target_score,
+        targetOpportunityLabel: input.target_opportunity_label,
+        competitionRisk: input.competition_risk,
+        page: 1,
+        page_size: client.endpointNumber("program_targets", "max_page_size", MAX_TARGETS_PER_PROGRAM)
+    });
     const data = readObject(api.data);
+    const upstreamMeta = readObject(data?.meta);
     const rawTargets = readArray(data?.targets);
     const sanitizedTargets = rawTargets.map(sanitizeTarget).filter((target) => targetHasAllowedScope(target, input));
     const targets = sanitizedTargets.slice(input.offset, input.offset + input.limit);
@@ -4108,10 +4375,13 @@ async function getProgramTargetsPayload(client, input, programId) {
             offset: input.offset,
             limit: input.limit,
             output_mode: input.output_mode,
-            total_active_targets: rawTargets.length,
+            total_active_targets: readNumber(upstreamMeta?.total) ?? rawTargets.length,
             total_after_filters: sanitizedTargets.length,
             returned: targets.length,
-            has_more: input.offset + input.limit < sanitizedTargets.length,
+            has_more: input.offset + input.limit < sanitizedTargets.length || readBoolean(upstreamMeta?.has_more) === true,
+            upstream_has_more: readBoolean(upstreamMeta?.has_more),
+            possibly_incomplete: readBoolean(upstreamMeta?.has_more) === true,
+            data_capabilities: readObject(upstreamMeta?.data_capabilities),
             target_source: "program_targets"
         }
     });
@@ -5196,6 +5466,79 @@ function programTargetsResourceUri(programId) {
 function exportResourceUri(exportId) {
     return `bbradar://exports?export_id=${encodeURIComponent(exportId)}`;
 }
+function continuationResourceUri(continuationId, offset, limit) {
+    return `bbradar://continuations?continuation_id=${encodeURIComponent(continuationId)}&offset=${offset}&limit=${limit}`;
+}
+function applyCollectionContinuation(payload, field, label, store, config) {
+    const items = Array.isArray(payload[field]) ? payload[field] : undefined;
+    const inlineLimit = Math.min(100, Math.max(1, config.continuationInlineLimit ?? 50));
+    if (!items || items.length <= inlineLimit) {
+        return payload;
+    }
+    const continuationId = randomUUID();
+    const expiresAt = Date.now() + (config.continuationTtlMs ?? LOCAL_EXPORT_TTL_MS);
+    const stored = rememberContinuation(store, continuationId, label, items, expiresAt);
+    if (!stored) {
+        return {
+            ...payload,
+            [field]: items.slice(0, inlineLimit),
+            warnings: uniqueStrings([
+                ...readArray(payload.warnings).filter((entry) => typeof entry === "string"),
+                "The complete result exceeded the local continuation-store byte limit; only the inline prefix is available."
+            ])
+        };
+    }
+    return {
+        ...payload,
+        [field]: items.slice(0, inlineLimit),
+        continuation: {
+            continuation_id: continuationId,
+            resource_uri: continuationResourceUri(continuationId, inlineLimit, inlineLimit),
+            collection: field,
+            total: items.length,
+            inline_returned: inlineLimit,
+            remaining: items.length - inlineLimit,
+            expires_at: new Date(expiresAt).toISOString()
+        }
+    };
+}
+function rememberContinuation(store, id, label, items, expiresAt) {
+    const byteLength = Buffer.byteLength(JSON.stringify(items), "utf8");
+    pruneExpiredContinuations(store);
+    if (byteLength > MAX_LOCAL_EXPORT_BYTES) {
+        return false;
+    }
+    while (store.size >= MAX_LOCAL_EXPORT_RESOURCES ||
+        retainedContinuationBytes(store) + byteLength > MAX_LOCAL_EXPORT_BYTES) {
+        const oldest = store.keys().next().value;
+        if (oldest === undefined) {
+            break;
+        }
+        store.delete(oldest);
+    }
+    store.set(id, { items, label, byteLength, expiresAt });
+    return true;
+}
+function pruneExpiredContinuations(store, now = Date.now()) {
+    for (const [id, value] of store) {
+        if (value.expiresAt <= now) {
+            store.delete(id);
+        }
+    }
+}
+function retainedContinuationBytes(store) {
+    let total = 0;
+    for (const value of store.values()) {
+        total += value.byteLength;
+    }
+    return total;
+}
+function boundedResourceInteger(raw, fallback, minimum, maximum) {
+    const parsed = raw === null ? fallback : Number.parseInt(raw, 10);
+    return Number.isFinite(parsed)
+        ? Math.min(maximum, Math.max(minimum, parsed))
+        : fallback;
+}
 function jsonResource(uri, payload) {
     return {
         contents: [
@@ -5208,41 +5551,86 @@ function jsonResource(uri, payload) {
     };
 }
 function rememberExport(exportStore, exportId, payload) {
+    const now = Date.now();
+    const byteLength = Buffer.byteLength(JSON.stringify(payload), "utf8");
+    pruneExpiredExports(exportStore, now);
     if (exportStore.has(exportId)) {
         exportStore.delete(exportId);
     }
-    while (exportStore.size >= MAX_LOCAL_EXPORT_RESOURCES) {
+    while (exportStore.size >= MAX_LOCAL_EXPORT_RESOURCES ||
+        retainedExportBytes(exportStore) + byteLength > MAX_LOCAL_EXPORT_BYTES) {
         const oldestKey = exportStore.keys().next().value;
         if (oldestKey === undefined) {
             break;
         }
         exportStore.delete(oldestKey);
     }
-    exportStore.set(exportId, payload);
+    exportStore.set(exportId, {
+        payload,
+        byteLength,
+        expiresAt: now + LOCAL_EXPORT_TTL_MS
+    });
+}
+function pruneExpiredExports(exportStore, now = Date.now()) {
+    for (const [exportId, storedExport] of exportStore) {
+        if (storedExport.expiresAt <= now) {
+            exportStore.delete(exportId);
+        }
+    }
+}
+function retainedExportBytes(exportStore) {
+    let total = 0;
+    for (const storedExport of exportStore.values()) {
+        total += storedExport.byteLength;
+    }
+    return total;
 }
 function previewExportPayload(payload) {
+    if (typeof payload === "string") {
+        return previewExportText(payload);
+    }
     if (Array.isArray(payload)) {
         return payload.slice(0, EXPORT_PREVIEW_LIMIT);
     }
-    if (readObject(payload) && Array.isArray(payload.targets)) {
+    const object = readObject(payload);
+    if (object && typeof object.content === "string") {
         return {
-            ...payload,
-            targets: payload.targets.slice(0, EXPORT_PREVIEW_LIMIT)
+            ...object,
+            content: previewExportText(object.content)
+        };
+    }
+    if (object && Array.isArray(object.targets)) {
+        return {
+            ...object,
+            targets: object.targets.slice(0, EXPORT_PREVIEW_LIMIT)
         };
     }
     return payload;
 }
 function previewExportCount(payload) {
+    if (typeof payload === "string") {
+        return Math.min(Math.max(0, payload.split(/\r?\n/).length - 1), EXPORT_PREVIEW_LIMIT);
+    }
     if (Array.isArray(payload)) {
         return Math.min(payload.length, EXPORT_PREVIEW_LIMIT);
     }
     const object = readObject(payload);
+    if (typeof object?.content === "string") {
+        return Math.min(Math.max(0, object.content.split(/\r?\n/).length - 1), EXPORT_PREVIEW_LIMIT);
+    }
     const targets = object?.targets;
     if (Array.isArray(targets)) {
         return Math.min(targets.length, EXPORT_PREVIEW_LIMIT);
     }
     return payload === undefined || payload === null ? 0 : 1;
 }
+function previewExportText(payload) {
+    const lines = payload.split(/\r?\n/);
+    const preview = lines.slice(0, EXPORT_PREVIEW_LIMIT + 1).join("\n");
+    return lines.length > EXPORT_PREVIEW_LIMIT + 1
+        ? `${preview}\n[preview truncated; read the export resource for the complete payload]`
+        : preview;
+}
 function collectResourceLinks(payload) {
     const links = new Map();
     for (const program of extractProgramsFromPayload(payload)) {
@@ -5284,6 +5672,19 @@ function collectResourceLinks(payload) {
             mimeType: "application/json"
         });
     }
+    const continuation = readObject(payload.continuation);
+    const continuationUri = stringField(continuation, "resource_uri");
+    const continuationId = stringField(continuation, "continuation_id");
+    if (continuationUri && continuationId) {
+        links.set(continuationUri, {
+            type: "resource_link",
+            uri: continuationUri,
+            name: `${continuationId} continuation`,
+            title: "Result continuation",
+            description: "Read the next bounded page of this local in-memory result.",
+            mimeType: "application/json"
+        });
+    }
     return [...links.values()];
 }
 function extractProgramsFromPayload(payload) {
@@ -5333,9 +5734,18 @@ function compactProgram(program) {
         handle: stringField(program, "handle"),
         name: stringField(program, "name"),
         platform: stringField(program, "platform"),
+        catalog: stringField(program, "catalog"),
+        program_type: stringField(program, "program_type"),
         platform_url: stringField(program, "platform_url"),
         bbradar_url: stringField(program, "bbradar_url"),
+        policy_url: stringField(program, "policy_url"),
+        reporting_url: stringField(program, "reporting_url"),
+        reward_status: stringField(program, "reward_status"),
+        data_capabilities: readObject(program.data_capabilities),
         opportunity_tag: readObject(program.opportunity_tag),
+        competition_risk: stringField(program, "competition_risk"),
+        competition_risk_reason: stringField(program, "competition_risk_reason"),
+        submission_cost: readObject(program.submission_cost),
         reward_range: readObject(program.reward_range),
         public_report_count: readNumber(program.public_report_count),
         public_report_count_label: stringField(program, "public_report_count_label"),
@@ -5385,6 +5795,30 @@ function formatChange(change, mode) {
         target: target ? compactTarget(target) : undefined
     });
 }
+function formatRepositoryChange(change, mode) {
+    if (mode === "full") {
+        return change;
+    }
+    const repository = readObject(change.repository);
+    return stripUndefined({
+        id: change.id,
+        event_type: stringField(change, "event_type"),
+        ref_name: stringField(change, "ref_name"),
+        observed_at: stringField(change, "observed_at"),
+        repository: repository
+            ? stripUndefined({
+                provider: stringField(repository, "provider"),
+                full_name: stringField(repository, "full_name"),
+                url: stringField(repository, "url")
+            })
+            : undefined,
+        changes_url: stringField(change, "changes_url"),
+        programs: readArray(change.programs).map((program) => formatProgram(readObject(program) ?? {}, "compact")),
+        targets: Array.isArray(change.targets)
+            ? change.targets.map((target) => compactTarget(readObject(target) ?? {}))
+            : undefined
+    });
+}
 function buildTargetScopeSummary(targets, mode, groupLimit, includeOutOfScope, includeIneligible) {
     const bountyTargets = targets.filter((target) => target.in_scope === true && target.eligible_for_bounty === true);
     const groups = {
@@ -5636,6 +6070,14 @@ function candidateLooksContestLike(candidate) {
     return tagIncludesAnyNormalized(candidate.normalizedSearchSignals, WEB3_CONTEST_SIGNALS);
 }
 function candidateHasKnownNoBounty(candidate) {
+    const programType = normalizeTag(stringField(candidate.program, "program_type") ?? "");
+    const rewardStatus = normalizeTag(stringField(candidate.program, "reward_status") ?? "");
+    if (programType === "vdp" || rewardStatus === "no_reward" || rewardStatus === "no reward") {
+        return true;
+    }
+    if (programType === "paid" || rewardStatus === "paid") {
+        return false;
+    }
     if (candidate.bountyMin === undefined && candidate.bountyMax === undefined) {
         return false;
     }
@@ -5824,6 +6266,16 @@ function normalizeFindProgramsInput(input) {
     const warnings = [];
     const normalized = { ...input };
     normalized.vdp_mode ??= "exclude";
+    normalized.exclude_platforms = uniqueStrings(normalized.exclude_platforms ?? []);
+    if (normalized.web3 && normalized.exclude_web3) {
+        normalized.web3 = false;
+        warnings.push("exclude_web3=true took precedence over the contradictory web3=true filter.");
+    }
+    const includedPlatforms = new Set(normalized.platforms.map(normalizeTag));
+    const overlappingPlatforms = normalized.exclude_platforms.filter((platform) => includedPlatforms.has(normalizeTag(platform)));
+    if (overlappingPlatforms.length > 0) {
+        warnings.push(`Excluded platform filters take precedence over included values: ${overlappingPlatforms.join(", ")}.`);
+    }
     normalized.max_pages = clampLimit("max_pages", normalized.max_pages, MAX_FIND_PROGRAM_PAGES, warnings);
     normalized.max_results = clampLimit("max_results", normalized.max_results, MAX_FIND_PROGRAM_RESULTS, warnings);
     normalized.target_sample_programs = clampLimit("target_sample_programs", normalized.target_sample_programs, MAX_FIND_TARGET_SAMPLE_PROGRAMS, warnings);
@@ -5842,6 +6294,285 @@ function clampLimit(name, value, max, warnings) {
     warnings.push(`${name} was clamped from ${value} to ${max}.`);
     return max;
 }
+async function findRepositoryHuntTargets(client, config, input) {
+    const warnings = [];
+    const repositoryRequestReserve = input.upstream_request_budget >= 3 ? 2 : 1;
+    const programRequestBudget = Math.max(1, input.upstream_request_budget - repositoryRequestReserve);
+    const programInput = {
+        platforms: input.platforms,
+        exclude_platforms: input.exclude_platforms,
+        tags: input.tags,
+        scope_tags: input.scope_tags,
+        target_types: input.target_types,
+        language_tags: input.language_tags,
+        web3: input.surface_mode === "web3",
+        exclude_web3: input.surface_mode === "web2",
+        opportunity_levels: input.opportunity_levels,
+        updated_since: undefined,
+        min_bounty_min: undefined,
+        min_bounty_max: input.min_bounty_max,
+        max_bounty_max: undefined,
+        require_bounty: input.require_bounty,
+        max_public_report_count: input.max_public_report_count,
+        require_known_report_count: false,
+        include_unknown_report_count: input.include_unknown_report_count,
+        exclude_ctf: true,
+        exclude_mobile_only: false,
+        exclude_non_web: input.surface_mode === "web2",
+        has_api_scope: false,
+        contest_like: false,
+        vdp_mode: "exclude",
+        fresh_launch_days: undefined,
+        min_wildcards: input.min_wildcards,
+        min_eligible_targets: input.min_eligible_targets,
+        min_total_targets: input.min_total_targets,
+        min_added_24h: undefined,
+        min_added_7d: input.min_added_7d,
+        max_pages: input.max_program_pages,
+        max_results: input.max_program_candidates,
+        sort_by: "highest_reward",
+        include_target_samples: false,
+        target_sample_programs: 0,
+        target_sample_size: 1,
+        only_in_scope_targets: true,
+        only_bounty_eligible_targets: true,
+        target_samples_only_wildcards: false,
+        output_mode: "compact",
+        upstream_request_budget: programRequestBudget
+    };
+    const [programPayload, repository] = await Promise.all([
+        findPrograms(client, config, programInput),
+        fetchRepositoryHuntPage(client, input, warnings, repositoryRequestReserve)
+    ]);
+    const candidatePrograms = readArray(programPayload.programs)
+        .map(readObject)
+        .filter((program) => program !== undefined);
+    const candidatesById = new Map(candidatePrograms
+        .map((program) => [stringField(program, "id"), program])
+        .filter((entry) => entry[0] !== undefined));
+    const changedSinceTime = input.changed_since ? Date.parse(input.changed_since) : undefined;
+    const rankedMatches = [];
+    let qualifyingTargetCount = 0;
+    for (const rawChange of readArray(readObject(repository.api.data)?.results)) {
+        const change = sanitizeRepositoryChange(rawChange, config.webBaseUrl);
+        const observedAtText = stringField(change, "observed_at");
+        const observedAt = observedAtText ? Date.parse(observedAtText) : 0;
+        if (changedSinceTime !== undefined && (!Number.isFinite(observedAt) || observedAt < changedSinceTime)) {
+            continue;
+        }
+        const programs = readArray(change.programs)
+            .map((program) => stringField(readObject(program), "id"))
+            .filter((id) => id !== undefined)
+            .map((id) => candidatesById.get(id))
+            .filter((program) => program !== undefined);
+        if (programs.length === 0) {
+            continue;
+        }
+        const targets = readArray(change.targets)
+            .map(readObject)
+            .filter((target) => target !== undefined)
+            .filter((target) => repositoryHuntTargetMatches(target, input))
+            .sort((left, right) => (readNumber(right.target_opportunity_score) ?? 0) - (readNumber(left.target_opportunity_score) ?? 0));
+        if (targets.length === 0) {
+            continue;
+        }
+        qualifyingTargetCount += targets.length;
+        const maxReward = Math.max(0, ...programs.map(programMaximumReward));
+        const maxTargetScore = Math.max(0, ...targets.map((target) => readNumber(target.target_opportunity_score) ?? 0));
+        const balancedScore = repositoryHuntBalancedScore(maxReward, maxTargetScore, observedAt);
+        const formattedChange = formatRepositoryChange(change, input.output_mode);
+        const { programs: _eventPrograms, targets: _eventTargets, ...repositoryChange } = formattedChange;
+        rankedMatches.push({
+            balancedScore,
+            maxReward,
+            maxTargetScore,
+            observedAt,
+            payload: stripUndefined({
+                repository_change: repositoryChange,
+                programs,
+                targets: targets.slice(0, input.max_targets_per_result).map((target) => input.output_mode === "full" ? target : compactTarget(target)),
+                target_count: targets.length,
+                max_target_score: maxTargetScore,
+                max_program_reward: maxReward,
+                match_score: balancedScore,
+                why_ranked_here: repositoryHuntReasons(maxReward, maxTargetScore, observedAt)
+            })
+        });
+    }
+    rankedMatches.sort((left, right) => compareRepositoryHuntMatches(left, right, input.ranking_mode));
+    const matches = rankedMatches.slice(0, input.max_results).map((match, index) => ({
+        rank: index + 1,
+        ...match.payload
+    }));
+    const matchedPrograms = uniqueProgramsFromRepositoryMatches(matches);
+    const programWarnings = readArray(programPayload.warnings).filter((warning) => typeof warning === "string");
+    if (candidatePrograms.length === 0) {
+        warnings.push("No programs matched the reward and program-level filters. Relax one program filter and retry.");
+    }
+    else if (matches.length === 0) {
+        warnings.push("Programs matched, but no recent repository event also contained a target that passed the target-quality filters. Relax one target or freshness filter and retry.");
+    }
+    const programBudget = readObject(programPayload.upstream_budget);
+    const usedRequests = (readNumber(programBudget?.used) ?? 0) + repository.attempts;
+    return stripUndefined({
+        request_id: randomUUID(),
+        fetched_at: new Date().toISOString(),
+        source_requests: [
+            ...readArray(programPayload.source_requests),
+            {
+                source: "repository_changes",
+                request_id: repository.api.requestId,
+                upstream_request_id: repository.api.upstreamRequestId,
+                page: 1,
+                page_size: repository.pageSize,
+                ...apiSourceMetadata(repository.api)
+            }
+        ],
+        warnings: uniqueStrings([...programWarnings, ...warnings]),
+        filters: stripUndefined({
+            platforms: input.platforms.length > 0 ? input.platforms : undefined,
+            exclude_platforms: input.exclude_platforms.length > 0 ? input.exclude_platforms : undefined,
+            tags: input.tags.length > 0 ? input.tags : undefined,
+            scope_tags: input.scope_tags.length > 0 ? input.scope_tags : undefined,
+            target_types: input.target_types.length > 0 ? input.target_types : undefined,
+            language_tags: input.language_tags.length > 0 ? input.language_tags : undefined,
+            surface_mode: input.surface_mode,
+            opportunity_levels: input.opportunity_levels.length > 0 ? input.opportunity_levels : undefined,
+            min_bounty_max: input.min_bounty_max,
+            require_bounty: input.require_bounty,
+            max_public_report_count: input.max_public_report_count,
+            min_eligible_targets: input.min_eligible_targets,
+            min_total_targets: input.min_total_targets,
+            min_wildcards: input.min_wildcards,
+            min_added_7d: input.min_added_7d,
+            changed_since: input.changed_since,
+            free_submission_only: input.free_submission_only,
+            min_target_score: input.min_target_score,
+            target_opportunity_labels: input.target_opportunity_labels.length > 0 ? input.target_opportunity_labels : undefined,
+            competition_risks: input.competition_risks.length > 0 ? input.competition_risks : undefined,
+            ranking_mode: input.ranking_mode,
+            output_mode: input.output_mode
+        }),
+        upstream_budget: {
+            initial: input.upstream_request_budget,
+            used: usedRequests,
+            remaining: Math.max(0, input.upstream_request_budget - usedRequests)
+        },
+        ranking_scope: readObject(programPayload.ranking_scope),
+        programs: matchedPrograms,
+        matches,
+        meta: {
+            returned: matches.length,
+            matched_programs: matchedPrograms.length,
+            program_candidates: candidatePrograms.length,
+            repository_events_scanned: readArray(readObject(repository.api.data)?.results).length,
+            qualifying_targets_before_result_limit: qualifyingTargetCount,
+            repository_page_size_used: repository.pageSize,
+            repository_request_attempts: repository.attempts,
+            parallel_source_fetch: true
+        }
+    });
+}
+async function fetchRepositoryHuntPage(client, input, warnings, maxAttempts) {
+    let pageSize = input.repository_page_size;
+    for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+        try {
+            const api = await client.getRepositoryChanges(toQuery({
+                include_targets: true,
+                platforms: input.platforms.length > 0 ? input.platforms : undefined,
+                tags: input.tags.length > 0 ? input.tags : undefined,
+                free_submission_only: input.free_submission_only,
+                include_removed: false,
+                include_ineligible: false,
+                include_out_of_scope: false,
+                page: 1,
+                page_size: pageSize
+            }));
+            return { api, pageSize, attempts: attempt };
+        }
+        catch (error) {
+            if (!(error instanceof BBRadarApiError) || error.status !== 413 || attempt >= maxAttempts || pageSize <= 10) {
+                throw error;
+            }
+            const reducedPageSize = Math.max(10, Math.floor(pageSize / 2));
+            warnings.push(`Repository page_size was reduced from ${pageSize} to ${reducedPageSize} after a 413 association-limit response.`);
+            pageSize = reducedPageSize;
+        }
+    }
+    throw new Error("No repository-change response was collected.");
+}
+function repositoryHuntTargetMatches(target, input) {
+    if (readBoolean(target.in_scope) !== true || readBoolean(target.eligible_for_bounty) !== true) {
+        return false;
+    }
+    const score = readNumber(target.target_opportunity_score);
+    if (score === undefined || score < input.min_target_score) {
+        return false;
+    }
+    if (input.target_opportunity_labels.length > 0 &&
+        !input.target_opportunity_labels.includes(stringField(target, "target_opportunity_label"))) {
+        return false;
+    }
+    if (input.competition_risks.length > 0 &&
+        !input.competition_risks.includes(stringField(target, "competition_risk"))) {
+        return false;
+    }
+    if (input.target_types.length > 0 && !input.target_types.some((targetType) => targetMatchesRequestedType(target, targetType))) {
+        return false;
+    }
+    if (input.scope_tags.length > 0 && !targetMatchesAnyTags(target, input.scope_tags, "scope_tags")) {
+        return false;
+    }
+    if (input.language_tags.length > 0 && !targetMatchesAnyTags(target, input.language_tags, "language_tags")) {
+        return false;
+    }
+    return true;
+}
+function targetMatchesAnyTags(target, requested, field) {
+    const actual = new Set(readStringArrayField(target, field).map(normalizeTag));
+    return requested.map(normalizeTag).some((value) => actual.has(value));
+}
+function programMaximumReward(program) {
+    return readNumber(readObject(program.reward_range)?.max) ?? 0;
+}
+function repositoryHuntBalancedScore(maxReward, maxTargetScore, observedAt) {
+    const rewardScore = Math.min(100, Math.log10(Math.max(1, maxReward)) / 7 * 100);
+    const ageDays = observedAt > 0 ? Math.max(0, Date.now() - observedAt) / (24 * 60 * 60 * 1000) : 30;
+    const freshnessScore = Math.max(0, 100 - Math.min(30, ageDays) / 30 * 100);
+    return Math.round((maxTargetScore * 0.45 + rewardScore * 0.35 + freshnessScore * 0.2) * 100) / 100;
+}
+function repositoryHuntReasons(maxReward, maxTargetScore, observedAt) {
+    const reasons = [`target score up to ${maxTargetScore}`, `maximum reward ${maxReward}`];
+    if (observedAt > 0) {
+        reasons.push(`repository activity observed ${new Date(observedAt).toISOString()}`);
+    }
+    return reasons;
+}
+function compareRepositoryHuntMatches(left, right, mode) {
+    if (mode === "highest_reward") {
+        return right.maxReward - left.maxReward || right.maxTargetScore - left.maxTargetScore || right.observedAt - left.observedAt;
+    }
+    if (mode === "best_target") {
+        return right.maxTargetScore - left.maxTargetScore || right.maxReward - left.maxReward || right.observedAt - left.observedAt;
+    }
+    if (mode === "newest") {
+        return right.observedAt - left.observedAt || right.maxTargetScore - left.maxTargetScore || right.maxReward - left.maxReward;
+    }
+    return right.balancedScore - left.balancedScore || right.observedAt - left.observedAt;
+}
+function uniqueProgramsFromRepositoryMatches(matches) {
+    const programs = new Map();
+    for (const match of matches) {
+        for (const value of readArray(match.programs)) {
+            const program = readObject(value);
+            const id = stringField(program, "id");
+            if (program && id && !programs.has(id)) {
+                programs.set(id, program);
+            }
+        }
+    }
+    return [...programs.values()];
+}
 async function findPrograms(client, config, input) {
     const normalized = normalizeFindProgramsInput(input);
     const warnings = normalized.warnings;
@@ -5890,8 +6621,10 @@ async function findPrograms(client, config, input) {
         warnings: warnings.length > 0 ? warnings : undefined,
         filters: stripUndefined({
             platforms: input.platforms.length > 0 ? input.platforms : undefined,
+            exclude_platforms: input.exclude_platforms && input.exclude_platforms.length > 0 ? input.exclude_platforms : undefined,
             tags: upstreamTags.length > 0 ? upstreamTags : undefined,
             web3: input.web3 ? true : undefined,
+            exclude_web3: input.exclude_web3 ? true : undefined,
             opportunity_levels: input.opportunity_levels.length > 0 ? input.opportunity_levels : undefined,
             updated_since: input.updated_since,
             min_bounty_min: input.min_bounty_min,
@@ -6423,12 +7156,19 @@ function programCandidateMatches(candidate, filters) {
     if (filters.platforms.length > 0 && !filters.platforms.map(normalizeTag).includes(normalizeTag(stringField(candidate.program, "platform") ?? ""))) {
         return false;
     }
+    if ((filters.exclude_platforms?.length ?? 0) > 0 &&
+        filters.exclude_platforms?.map(normalizeTag).includes(normalizeTag(stringField(candidate.program, "platform") ?? ""))) {
+        return false;
+    }
     if (filters.tags.length > 0 && !candidateMatchesAnyTag(candidate, filters.tags)) {
         return false;
     }
     if (filters.web3 && !candidateHasWeb3Surface(candidate)) {
         return false;
     }
+    if (filters.exclude_web3 && candidateHasWeb3Surface(candidate)) {
+        return false;
+    }
     if (filters.scope_tags.length > 0 && !candidateMatchesAnyTag(candidate, filters.scope_tags)) {
         return false;
     }
@@ -6441,7 +7181,9 @@ function programCandidateMatches(candidate, filters) {
     if (candidate.wildcardCount < filters.min_wildcards) {
         return false;
     }
-    if (filters.require_bounty && (candidate.bountyMax ?? candidate.bountyMin ?? 0) <= 0) {
+    const explicitlyPaid = normalizeTag(stringField(candidate.program, "program_type") ?? "") === "paid" ||
+        normalizeTag(stringField(candidate.program, "reward_status") ?? "") === "paid";
+    if (filters.require_bounty && !explicitlyPaid && (candidate.bountyMax ?? candidate.bountyMin ?? 0) <= 0) {
         return false;
     }
     if (filters.min_bounty_min !== undefined && (candidate.bountyMin ?? 0) < filters.min_bounty_min) {
@@ -6812,6 +7554,111 @@ The plan must:
 - Prioritize targets by bounty eligibility, freshness, wildcard status, target type, and severity labels.
 - Include a short checklist of BBRadar follow-up tool calls and decision points.`));
 }
+function resolveFeedCursor(store, endpoint, filters, resume) {
+    const normalizedFilters = stableStringify(normalizeFeedCursorFilters(filters));
+    const key = `${endpoint}:${createHash("sha256").update(normalizedFilters).digest("hex")}`;
+    const explicitAfterId = readNumber(filters.after_id);
+    if (explicitAfterId !== undefined) {
+        return { endpoint, key, afterId: explicitAfterId, resumed: false };
+    }
+    if (!resume) {
+        return { endpoint, key, afterId: undefined, resumed: false };
+    }
+    const stored = store.get(key);
+    if (stored === undefined) {
+        throw new Error(`No in-memory ${endpoint} cursor exists for this filter set. Provide after_id once to seed it.`);
+    }
+    return { endpoint, key, afterId: stored, resumed: true };
+}
+function advanceFeedCursor(store, cursor, rawMeta) {
+    if (cursor.afterId === undefined) {
+        return undefined;
+    }
+    const meta = readObject(rawMeta);
+    const nextAfterId = readNumber(meta?.next_after_id) ?? cursor.afterId;
+    store.set(cursor.key, nextAfterId);
+    return {
+        endpoint: cursor.endpoint,
+        mode: cursor.resumed ? "resumed" : "seeded",
+        used_after_id: cursor.afterId,
+        next_after_id: nextAfterId,
+        has_more: readBoolean(meta?.has_more) ?? false,
+        stored_in_memory: true
+    };
+}
+async function collectCursorFeedPages(store, initialCursor, maxPages, timeBudgetMs, fetchPage) {
+    const startedAt = Date.now();
+    const results = [];
+    const sourceRequests = [];
+    let currentCursor = initialCursor;
+    let lastApi;
+    let lastData;
+    let cursorPayload;
+    let pagesFetched = 0;
+    let hasMore = false;
+    let pageBudgetExhausted = false;
+    let timeBudgetExhausted = false;
+    do {
+        const api = await fetchPage(currentCursor.afterId);
+        const data = readObject(api.data);
+        const pageResults = readArray(data?.results);
+        lastApi = api;
+        lastData = data;
+        results.push(...pageResults);
+        pagesFetched += 1;
+        sourceRequests.push({
+            source: currentCursor.endpoint,
+            page: pagesFetched,
+            request_id: api.requestId,
+            upstream_request_id: api.upstreamRequestId,
+            ...apiSourceMetadata(api)
+        });
+        cursorPayload = advanceFeedCursor(store, currentCursor, data?.meta);
+        hasMore = readBoolean(readObject(data?.meta)?.has_more) === true;
+        if (currentCursor.afterId === undefined || !hasMore) {
+            break;
+        }
+        if (pagesFetched >= maxPages) {
+            pageBudgetExhausted = true;
+            break;
+        }
+        if (Date.now() - startedAt >= timeBudgetMs) {
+            timeBudgetExhausted = true;
+            break;
+        }
+        currentCursor = {
+            ...currentCursor,
+            afterId: readNumber(cursorPayload?.next_after_id) ?? currentCursor.afterId,
+            resumed: true
+        };
+    } while (true);
+    if (!lastApi) {
+        throw new Error(`No ${initialCursor.endpoint} response was collected.`);
+    }
+    return {
+        lastApi,
+        lastData,
+        results,
+        cursor: cursorPayload,
+        pagesFetched,
+        pageBudgetExhausted,
+        timeBudgetExhausted,
+        sourceRequests
+    };
+}
+function normalizeFeedCursorFilters(filters) {
+    return Object.fromEntries(Object.entries(filters)
+        .filter(([key, value]) => key !== "after_id" && key !== "page" && value !== undefined)
+        .map(([key, value]) => [key, normalizeFeedCursorFilterValue(value)]));
+}
+function normalizeFeedCursorFilterValue(value) {
+    if (Array.isArray(value)) {
+        return value
+            .map((entry) => normalizeFeedCursorFilterValue(entry))
+            .sort((left, right) => String(left).localeCompare(String(right)));
+    }
+    return typeof value === "string" ? value.trim().toLowerCase() : value;
+}
 async function runTool(toolName, config, rateLimiter, callback) {
     const startedAt = Date.now();
     const decision = rateLimiter.consume(toolName, rateLimitForTool(toolName, config));
@@ -6870,7 +7717,8 @@ function compactToolText(payload, isError) {
         [
             readArray(payload.programs).length,
             readArray(payload.targets).length,
-            readArray(payload.changes).length
+            readArray(payload.changes).length,
+            readArray(payload.repository_changes).length
         ].find((count) => count > 0);
     return JSON.stringify(stripUndefined({
         request_id: payload.request_id,
@@ -6901,6 +7749,7 @@ function withApiMetadata(api, payload) {
         upstream_request_id: api.upstreamRequestId,
         cache: stripUndefined({
             hit: api.cached,
+            stale_while_revalidate: api.stale,
             coalesced_live_request: api.coalesced,
             expires_at: api.cacheExpiresAt
         }),
@@ -7053,7 +7902,11 @@ function compactTarget(target) {
         target_type: stringField(target, "target_type"),
         in_scope: readBoolean(target.in_scope),
         eligible_for_bounty: readBoolean(target.eligible_for_bounty),
-        wildcard: readBoolean(target.wildcard)
+        wildcard: readBoolean(target.wildcard),
+        target_opportunity_score: readNumber(target.target_opportunity_score),
+        target_opportunity_label: stringField(target, "target_opportunity_label"),
+        competition_risk: stringField(target, "competition_risk"),
+        why_this_target: stringField(target, "why_this_target")
     });
 }
 function targetIdentifier(target) {