@bbradar/mcp 0.1.3 → 0.1.5

package/dist/server.js

@@ -29,17 +29,53 @@ const DEFAULT_FILTER_TARGET_SAMPLE_PROGRAMS = 10;
 const MAX_FILTER_TARGET_SAMPLE_PROGRAMS = 25;
 const MAX_LOCAL_EXPORT_RESOURCES = 25;
 const EXPORT_PREVIEW_LIMIT = 25;
+const STALE_PROGRAM_ID_RESOLVE_PAGES = 5;
+const STALE_PROGRAM_ID_RESOLVE_BUDGET = 5;
+const MAX_RESOLVE_SEARCH_QUERIES = 4;
 const SDK_VERSION = "1.29.0";
 const WEB3_TAGS = ["web3", "crypto", "blockchain", "smart-contract", "smart contract", "defi", "nft", "ethereum", "solana", "solidity"];
 const WEB3_CONTEST_SIGNALS = ["contest", "audit", "competitive", "code4rena", "sherlock", "cantina", "codehawks", "hats", "spearbit", "warden"];
 const VDP_SIGNALS = ["vdp", "disclosure", "responsible disclosure", "vulnerability disclosure", "no bounty", "non-bounty", "no reward"];
+const PROGRAM_RESOLUTION_STOP_WORDS = new Set([
+    "program",
+    "programs",
+    "target",
+    "targets",
+    "scope",
+    "scopes",
+    "new",
+    "latest",
+    "recent",
+    "recently",
+    "added",
+    "additions",
+    "for",
+    "from",
+    "the",
+    "a",
+    "an",
+    "of",
+    "on",
+    "in",
+    "with",
+    "to",
+    "get",
+    "find",
+    "show",
+    "list",
+    "check",
+    "does",
+    "has",
+    "have",
+    "any"
+]);
 const targetListModeSchema = z.enum(["identifiers", "compact", "full"]);
 const changeListModeSchema = z.enum(["compact", "full"]);
 const programListModeSchema = z.enum(["compact", "full"]);
 const rewardThresholdModeSchema = z.enum(["max_at_least", "min_at_least"]);
 const vdpModeSchema = z.enum(["include", "exclude", "only_likely", "only_known_no_bounty"]);
 const targetMatchModeSchema = z.enum(["contains", "exact", "suffix", "wildcard"]);
-const programNameActionSchema = z.enum(["new_targets", "scope_delta", "brief", "target_breakdown"]);
+const programNameActionSchema = z.enum(["new_targets", "targets", "scope_delta", "brief", "target_breakdown"]);
 const readOnlyAnnotations = {
     readOnlyHint: true,
     destructiveHint: false,
@@ -124,8 +160,11 @@ const apiEnvelopeOutputShape = {
     upstream_request_id: z.string().optional(),
     fetched_at: z.string().optional(),
     cache: cacheOutputSchema.optional(),
+    source_requests: z.array(jsonRecordSchema).optional(),
     mcp_rate_limit: rateLimitOutputSchema.optional(),
     mcp_timing: toolTimingOutputSchema.optional(),
+    warnings: z.array(z.string()).optional(),
+    program_id_resolution: jsonRecordSchema.optional(),
     error: errorOutputSchema.optional()
 };
 const programListOutputShape = {
@@ -187,7 +226,8 @@ export function createBbradarServer(client, config) {
         instructions: [
             "Use BBRadar only for passive bug bounty intelligence; never scan or contact targets.",
             "For BBRadar asks, use these tools first and avoid external skills unless methodology is explicitly requested.",
-            "Name + action: run_program_name_action. Name only: resolve_program.",
+            "Partial program name + action: run_program_name_action. Partial program name only: resolve_program.",
+            "Default to bounty-eligible in-scope data. Include out-of-scope, ineligible, VDP, disclosure-only, or no-bounty data only when the user explicitly asks.",
             "Freshness: get_latest_added_targets, check_program_new_targets, check_watchlist_new_targets, find_recent_by_type, get_program_scope_delta.",
             "Discovery: find_program_candidates, find_stack_matches, find_language_programs, find_target_type_programs, find_reward_programs, find_paid_programs, find_vdp_programs, find_web3_contests, find_low_noise_programs.",
             "Details: get_program_brief, get_program_scope_summary, get_program_target_breakdown, find_programs_by_target, compare_programs_compact.",
@@ -203,15 +243,20 @@ export function createBbradarServer(client, config) {
             platforms: stringListSchema,
             tags: stringListSchema,
             updated_since: isoDateTimeSchema.optional().describe("ISO datetime."),
+            vdp_mode: vdpModeSchema.default("exclude").describe("VDP/no-bounty filter mode."),
             page: pageSchema,
             page_size: programsPageSizeSchema
         },
         outputSchema: programListOutputShape,
         annotations: readOnlyAnnotations
     }, (args) => runTool("search_programs", config, rateLimiter, async () => {
-        const api = await client.listPrograms(toQuery(args));
+        const { vdp_mode, ...filters } = args;
+        const api = await client.listPrograms(toQuery(filters));
         const data = readObject(api.data);
-        const programs = readArray(data?.programs).map((program) => addProgramResourceLinks(sanitizeProgram(program, config.webBaseUrl)));
+        const programs = readArray(data?.programs)
+            .map((program) => toProgramCandidate(program, config.webBaseUrl))
+            .filter((candidate) => candidateMatchesVdpMode(candidate, vdp_mode))
+            .map((candidate) => candidate.program);
         return withApiMetadata(api, {
             programs,
             meta: sanitizeJson(data?.meta)
@@ -225,18 +270,29 @@ export function createBbradarServer(client, config) {
         },
         outputSchema: {
             ...apiEnvelopeOutputShape,
-            program: programOutputSchema.optional()
+            program: programOutputSchema.optional(),
+            meta: jsonRecordSchema.optional()
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program", config, rateLimiter, async () => {
-        const api = await client.getProgram(args.program_id);
-        return withApiMetadata(api, {
-            program: addProgramResourceLinks(sanitizeProgram(api.data, config.webBaseUrl))
-        });
+        return runProgramIdTool(client, config, args.program_id, async (programId) => {
+            const api = await client.getProgram(programId);
+            return withApiMetadata(api, {
+                program: addProgramResourceLinks(sanitizeProgram(api.data, config.webBaseUrl))
+            });
+        }, async (indexFallback) => ({
+            request_id: randomUUID(),
+            warnings: [`Returned program metadata from the BBRadar program index because the per-program detail endpoint returned 404 for ${indexFallback.resolvedProgramId}.`],
+            program: indexFallback.program,
+            meta: {
+                detail_source: "program_index",
+                detail_endpoint_unavailable: true
+            }
+        }));
     }));
     server.registerTool("resolve_program", {
         title: "Resolve Program",
-        description: "Resolve name/handle text to likely program_ids.",
+        description: "Resolve partial name/handle text to likely program_ids. Use this when the user gives a program name fragment like Nado.",
         inputSchema: {
             query: searchTextSchema,
             platforms: stringListSchema,
@@ -260,7 +316,7 @@ export function createBbradarServer(client, config) {
     }, (args) => runTool("resolve_program", config, rateLimiter, async () => resolveProgram(client, config, args)));
     server.registerTool("run_program_name_action", {
         title: "Run Program Name Action",
-        description: "Resolve a name, then run new_targets, scope_delta, brief, or target_breakdown.",
+        description: "Resolve a partial program name, then run targets, new_targets, scope_delta, brief, or target_breakdown.",
         inputSchema: {
             query: searchTextSchema,
             action: programNameActionSchema.default("new_targets"),
@@ -312,24 +368,7 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_program_targets", config, rateLimiter, async () => {
-        const api = await client.getProgramTargets(args.program_id);
-        const data = readObject(api.data);
-        const rawTargets = readArray(data?.targets);
-        const sanitizedTargets = rawTargets.map(sanitizeTarget).filter((target) => targetHasAllowedScope(target, args));
-        const targets = sanitizedTargets.slice(args.offset, args.offset + args.limit);
-        return withApiMetadata(api, {
-            program_id: args.program_id,
-            targets: formatTargetList(targets, args.output_mode),
-            meta: {
-                offset: args.offset,
-                limit: args.limit,
-                output_mode: args.output_mode,
-                total_active_targets: rawTargets.length,
-                total_after_filters: sanitizedTargets.length,
-                returned: targets.length,
-                has_more: args.offset + args.limit < sanitizedTargets.length
-            }
-        });
+        return runProgramIdTool(client, config, args.program_id, async (programId) => getProgramTargetsPayload(client, args, programId), async (indexFallback) => getProgramTargetsExportFallbackPayload(client, args, indexFallback.resolvedProgramId));
     }));
     server.registerTool("get_recent_changes", {
         title: "Get Recent Target Changes",
@@ -381,8 +420,8 @@ export function createBbradarServer(client, config) {
             include_full_target_list: z.boolean().default(true),
             full_target_list_mode: targetListModeSchema.default("identifiers"),
             full_target_limit: z.number().int().min(1).max(MAX_TARGETS_PER_PROGRAM).default(MAX_TARGETS_PER_PROGRAM),
-            full_list_include_out_of_scope: z.boolean().default(true),
-            full_list_include_ineligible: z.boolean().default(true)
+            full_list_include_out_of_scope: z.boolean().default(false),
+            full_list_include_ineligible: z.boolean().default(false)
         },
         outputSchema: {
             ...apiEnvelopeOutputShape,
@@ -403,8 +442,8 @@ export function createBbradarServer(client, config) {
             program_id: programIdSchema,
             target_list_mode: targetListModeSchema.default("identifiers"),
             group_limit: z.number().int().min(1).max(MAX_TARGETS_PER_PROGRAM).default(MAX_TARGETS_PER_PROGRAM),
-            include_out_of_scope: z.boolean().default(true),
-            include_ineligible: z.boolean().default(true)
+            include_out_of_scope: z.boolean().default(false),
+            include_ineligible: z.boolean().default(false)
         },
         outputSchema: {
             ...apiEnvelopeOutputShape,
@@ -414,7 +453,7 @@ export function createBbradarServer(client, config) {
             meta: jsonRecordSchema.optional()
         },
         annotations: readOnlyAnnotations
-    }, (args) => runTool("get_program_scope_summary", config, rateLimiter, async () => getProgramScopeSummary(client, config, args)));
+    }, (args) => runTool("get_program_scope_summary", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramScopeSummary(client, config, { ...args, program_id: programId }), (indexFallback) => getProgramScopeSummaryFromIndexFallback(client, indexFallback, { ...args, program_id: indexFallback.resolvedProgramId }))));
     server.registerTool("get_program_target_breakdown", {
         title: "Get Program Target Breakdown",
         description: "Target type, scope tag, language tag, and bucket counts for one program.",
@@ -422,8 +461,8 @@ export function createBbradarServer(client, config) {
             program_id: programIdSchema,
             target_list_mode: targetListModeSchema.default("identifiers"),
             group_limit: z.number().int().min(1).max(MAX_TARGETS_PER_PROGRAM).default(100),
-            include_out_of_scope: z.boolean().default(true),
-            include_ineligible: z.boolean().default(true)
+            include_out_of_scope: z.boolean().default(false),
+            include_ineligible: z.boolean().default(false)
         },
         outputSchema: {
             ...apiEnvelopeOutputShape,
@@ -433,7 +472,7 @@ export function createBbradarServer(client, config) {
             meta: jsonRecordSchema.optional()
         },
         annotations: readOnlyAnnotations
-    }, (args) => runTool("get_program_target_breakdown", config, rateLimiter, async () => getProgramTargetBreakdown(client, config, args)));
+    }, (args) => runTool("get_program_target_breakdown", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramTargetBreakdown(client, config, { ...args, program_id: programId }), (indexFallback) => getProgramTargetBreakdownFromIndexFallback(client, indexFallback, { ...args, program_id: indexFallback.resolvedProgramId }))));
     server.registerTool("get_program_scope_delta", {
         title: "Get Program Scope Delta",
         description: "Compact recent scope changes for one program.",
@@ -459,7 +498,7 @@ export function createBbradarServer(client, config) {
             meta: jsonRecordSchema.optional()
         },
         annotations: readOnlyAnnotations
-    }, (args) => runTool("get_program_scope_delta", config, rateLimiter, async () => getProgramScopeDelta(client, config, args)));
+    }, (args) => runTool("get_program_scope_delta", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramScopeDelta(client, config, { ...args, program_id: programId }))));
     server.registerTool("get_recent_target_activity", {
         title: "Get Recent Target Activity",
         description: "Recent target changes grouped by program.",
@@ -510,7 +549,7 @@ export function createBbradarServer(client, config) {
             meta: jsonRecordSchema.optional()
         },
         annotations: readOnlyAnnotations
-    }, (args) => runTool("check_program_new_targets", config, rateLimiter, async () => checkProgramNewTargets(client, config, args)));
+    }, (args) => runTool("check_program_new_targets", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => checkProgramNewTargets(client, config, { ...args, program_id: programId }), (indexFallback) => checkProgramNewTargetsFromIndexedProgram(client, config, { ...args, program_id: indexFallback.resolvedProgramId }, indexFallback.program))));
     server.registerTool("check_watchlist_new_targets", {
         title: "Check Watchlist New Targets",
         description: "New in-scope targets across many known program_ids.",
@@ -540,6 +579,7 @@ export function createBbradarServer(client, config) {
             platforms: stringListSchema,
             tags: stringListSchema,
             updated_since: isoDateTimeSchema.optional(),
+            vdp_mode: vdpModeSchema.default("exclude").describe("VDP/no-bounty filter mode."),
             page: pageSchema,
             page_size: programsPageSizeSchema
         },
@@ -549,10 +589,13 @@ export function createBbradarServer(client, config) {
         },
         annotations: readOnlyAnnotations
     }, (args) => runTool("get_opportunities", config, rateLimiter, async () => {
-        const { level, ...filters } = args;
+        const { level, vdp_mode, ...filters } = args;
         const api = await client.getOpportunities(level, toQuery(filters));
         const data = readObject(api.data);
-        const programs = readArray(data?.programs).map((program) => addProgramResourceLinks(sanitizeProgram(program, config.webBaseUrl)));
+        const programs = readArray(data?.programs)
+            .map((program) => toProgramCandidate(program, config.webBaseUrl))
+            .filter((candidate) => candidateMatchesVdpMode(candidate, vdp_mode))
+            .map((candidate) => candidate.program);
         return withApiMetadata(api, {
             level,
             programs,
@@ -583,7 +626,7 @@ export function createBbradarServer(client, config) {
             exclude_non_web: z.boolean().default(false),
             has_api_scope: z.boolean().default(false),
             contest_like: z.boolean().default(false).describe("Require contest/audit signals."),
-            vdp_mode: vdpModeSchema.default("include").describe("VDP/no-bounty filter mode."),
+            vdp_mode: vdpModeSchema.default("exclude").describe("VDP/no-bounty filter mode."),
             fresh_launch_days: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).optional(),
             min_wildcards: z.number().int().min(0).max(1000).default(0),
             min_eligible_targets: z.number().int().min(0).optional(),
@@ -791,7 +834,7 @@ export function createBbradarServer(client, config) {
             min_reward: z.number().int().min(0).optional(),
             reward_threshold_mode: rewardThresholdModeSchema.default("max_at_least"),
             require_bounty: z.boolean().default(false),
-            exclude_vdp: z.boolean().default(false),
+            exclude_vdp: z.boolean().default(true),
             max_public_report_count: z.number().int().min(0).optional(),
             require_known_report_count: z.boolean().default(false),
             include_unknown_report_count: z.boolean().default(true),
@@ -821,7 +864,7 @@ export function createBbradarServer(client, config) {
             require_bounty: z.boolean().default(false),
             fresh_only: z.boolean().default(false),
             min_added_7d: z.number().int().min(0).optional(),
-            exclude_vdp: z.boolean().default(false),
+            exclude_vdp: z.boolean().default(true),
             max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
             max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
             include_target_samples: z.boolean().default(false),
@@ -890,7 +933,7 @@ export function createBbradarServer(client, config) {
             web3: z.boolean().default(false),
             contest_like: z.boolean().default(false),
             require_bounty: z.boolean().default(false),
-            exclude_vdp: z.boolean().default(false),
+            exclude_vdp: z.boolean().default(true),
             max_public_report_count: z.number().int().min(0).optional(),
             min_eligible_targets: z.number().int().min(0).optional(),
             fresh_only: z.boolean().default(false),
@@ -969,8 +1012,8 @@ export function createBbradarServer(client, config) {
             use_api_search: z.boolean().default(true),
             max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(2),
             max_results: z.number().int().min(1).max(25).default(10),
-            include_out_of_scope: z.boolean().default(true),
-            include_ineligible: z.boolean().default(true),
+            include_out_of_scope: z.boolean().default(false),
+            include_ineligible: z.boolean().default(false),
             max_targets_per_program: z.number().int().min(1).max(50).default(10),
             target_list_mode: targetListModeSchema.default("identifiers"),
             upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(30)
@@ -1155,7 +1198,7 @@ export function createBbradarServer(client, config) {
             changes: z.array(jsonRecordSchema).optional()
         },
         annotations: readOnlyAnnotations
-    }, (args) => runTool("summarize_program_activity", config, rateLimiter, async () => summarizeProgramActivity(client, config, args.program_id, args.recent_changes_limit)));
+    }, (args) => runTool("summarize_program_activity", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => summarizeProgramActivity(client, config, programId, args.recent_changes_limit))));
     server.registerTool("get_program_brief", {
         title: "Get Program Brief",
         description: "Compact worth-hunting brief for one program.",
@@ -1178,7 +1221,7 @@ export function createBbradarServer(client, config) {
             meta: jsonRecordSchema.optional()
         },
         annotations: readOnlyAnnotations
-    }, (args) => runTool("get_program_brief", config, rateLimiter, async () => getProgramBrief(client, config, args)));
+    }, (args) => runTool("get_program_brief", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramBrief(client, config, { ...args, program_id: programId }))));
     server.registerTool("find_recently_added_wildcards", {
         title: "Find Recently Added Wildcards",
         description: "Recently added wildcard programs.",
@@ -1307,7 +1350,7 @@ export function createBbradarServer(client, config) {
             meta: jsonRecordSchema.optional()
         },
         annotations: readOnlyAnnotations
-    }, (args) => runTool("get_program_delta", config, rateLimiter, async () => getProgramDelta(client, config, args)));
+    }, (args) => runTool("get_program_delta", config, rateLimiter, async () => runProgramIdTool(client, config, args.program_id, (programId) => getProgramDelta(client, config, { ...args, program_id: programId }))));
     server.registerTool("export_targets", {
         title: "Export BBRadar Targets",
         description: `Read-only target export. limit max ${MAX_TARGET_EXPORT}.`,
@@ -1374,9 +1417,11 @@ function registerResources(server, client, config, exportStore) {
         mimeType: "application/json"
     }, async (uri) => {
         const programId = parseProgramIdFromResourceUri(uri);
-        const api = await client.getProgram(programId);
-        const payload = withApiMetadata(api, {
-            program: addProgramResourceLinks(sanitizeProgram(api.data, config.webBaseUrl))
+        const payload = await runProgramIdTool(client, config, programId, async (resolvedProgramId) => {
+            const api = await client.getProgram(resolvedProgramId);
+            return withApiMetadata(api, {
+                program: addProgramResourceLinks(sanitizeProgram(api.data, config.webBaseUrl))
+            });
         });
         return jsonResource(uri.toString(), payload);
     });
@@ -1386,15 +1431,17 @@ function registerResources(server, client, config, exportStore) {
         mimeType: "application/json"
     }, async (uri) => {
         const programId = parseProgramIdFromResourceUri(uri);
-        const api = await client.getProgramTargets(programId);
-        const data = readObject(api.data);
-        const targets = readArray(data?.targets).map(sanitizeTarget);
-        const payload = withApiMetadata(api, {
-            program_id: programId,
-            targets,
-            meta: {
-                total_active_targets: targets.length
-            }
+        const payload = await runProgramIdTool(client, config, programId, async (resolvedProgramId) => {
+            const api = await client.getProgramTargets(resolvedProgramId);
+            const data = readObject(api.data);
+            const targets = readArray(data?.targets).map(sanitizeTarget);
+            return withApiMetadata(api, {
+                program_id: resolvedProgramId,
+                targets,
+                meta: {
+                    total_active_targets: targets.length
+                }
+            });
         });
         return jsonResource(uri.toString(), payload);
     });
@@ -1433,6 +1480,228 @@ function registerResources(server, client, config, exportStore) {
         }));
     });
 }
+async function getProgramWithIdFallback(client, config, requestedProgramId) {
+    try {
+        return {
+            api: await client.getProgram(requestedProgramId),
+            programId: requestedProgramId,
+            sourceRequests: [],
+            warnings: []
+        };
+    }
+    catch (error) {
+        if (!isProgramNotFoundError(error)) {
+            throw error;
+        }
+        const fallback = await resolveStaleProgramId(client, config, requestedProgramId, error);
+        if (!fallback) {
+            throw error;
+        }
+        return {
+            api: await client.getProgram(fallback.resolvedProgramId),
+            programId: fallback.resolvedProgramId,
+            sourceRequests: fallback.sourceRequests,
+            warnings: fallback.warnings,
+            fallback
+        };
+    }
+}
+async function runProgramIdTool(client, config, requestedProgramId, callback, indexFallbackCallback) {
+    try {
+        return await callback(requestedProgramId);
+    }
+    catch (error) {
+        if (!isProgramNotFoundError(error)) {
+            throw error;
+        }
+        const fallback = await resolveStaleProgramId(client, config, requestedProgramId, error);
+        if (!fallback) {
+            if (!indexFallbackCallback) {
+                throw error;
+            }
+            const indexFallback = await resolveIndexedProgramId(client, config, requestedProgramId, error);
+            if (!indexFallback) {
+                throw error;
+            }
+            const payload = await indexFallbackCallback(indexFallback);
+            return withProgramIndexFallbackMetadata(payload, indexFallback);
+        }
+        const payload = await callback(fallback.resolvedProgramId);
+        return withProgramIdFallbackMetadata(payload, fallback);
+    }
+}
+async function resolveIndexedProgramId(client, config, requestedProgramId, staleError) {
+    const query = programSearchText(requestedProgramId);
+    if (query.length < 2) {
+        return undefined;
+    }
+    const resolution = await resolveProgram(client, config, {
+        query,
+        platforms: [],
+        tags: [],
+        opportunity_levels: [],
+        max_pages: STALE_PROGRAM_ID_RESOLVE_PAGES,
+        max_results: 5,
+        output_mode: "full",
+        upstream_request_budget: STALE_PROGRAM_ID_RESOLVE_BUDGET
+    });
+    const match = selectProgramIndexFallbackMatch(requestedProgramId, resolution);
+    if (!match) {
+        return undefined;
+    }
+    const sourceRequests = readArray(resolution.source_requests).filter((request) => readObject(request) !== undefined);
+    const warnings = readArray(resolution.warnings).filter((warning) => typeof warning === "string");
+    const staleApiError = staleError instanceof BBRadarApiError ? staleError : undefined;
+    const indexWarning = `program_id ${requestedProgramId} exists in the BBRadar program index, but the per-program detail endpoint returned 404.`;
+    return {
+        requestedProgramId,
+        resolvedProgramId: match.resolvedProgramId,
+        query,
+        staleRequestId: staleApiError?.requestId,
+        staleUpstreamRequestId: staleApiError?.upstreamRequestId,
+        sourceRequests,
+        warnings: uniqueStrings([...warnings, indexWarning]),
+        resolution,
+        program: match.program
+    };
+}
+async function resolveStaleProgramId(client, config, requestedProgramId, staleError) {
+    const query = programSearchText(requestedProgramId);
+    if (query.length < 2) {
+        return undefined;
+    }
+    const resolution = await resolveProgram(client, config, {
+        query,
+        platforms: [],
+        tags: [],
+        opportunity_levels: [],
+        max_pages: STALE_PROGRAM_ID_RESOLVE_PAGES,
+        max_results: 5,
+        output_mode: "compact",
+        upstream_request_budget: STALE_PROGRAM_ID_RESOLVE_BUDGET
+    });
+    const match = selectProgramIdFallbackMatch(requestedProgramId, resolution);
+    if (!match) {
+        return undefined;
+    }
+    const sourceRequests = readArray(resolution.source_requests).filter((request) => readObject(request) !== undefined);
+    const warnings = readArray(resolution.warnings).filter((warning) => typeof warning === "string");
+    const staleApiError = staleError instanceof BBRadarApiError ? staleError : undefined;
+    const fallbackWarning = `program_id ${requestedProgramId} was stale; automatically retried with resolved program_id ${match.resolvedProgramId}.`;
+    return {
+        requestedProgramId,
+        resolvedProgramId: match.resolvedProgramId,
+        query,
+        staleRequestId: staleApiError?.requestId,
+        staleUpstreamRequestId: staleApiError?.upstreamRequestId,
+        sourceRequests,
+        warnings: uniqueStrings([...warnings, fallbackWarning]),
+        resolution
+    };
+}
+function selectProgramIdFallbackMatch(requestedProgramId, resolution) {
+    const requestedHandle = normalizeTag(programHandleText(requestedProgramId));
+    const requestedSearchText = normalizeTag(programSearchText(requestedProgramId));
+    const candidates = readArray(resolution.matches)
+        .map((entry) => readObject(entry))
+        .filter((entry) => entry !== undefined)
+        .map((entry) => {
+        const program = readObject(entry.program);
+        const resolvedProgramId = stringField(entry, "program_id") ?? stringField(program, "id");
+        const candidateHandle = normalizeTag(stringField(program, "handle") ?? "");
+        const candidateSearchText = resolvedProgramId ? normalizeTag(programSearchText(resolvedProgramId)) : "";
+        const score = readNumber(entry.score) ?? 0;
+        const exactHandleMatch = candidateHandle === requestedHandle ||
+            candidateHandle === requestedSearchText ||
+            candidateSearchText === requestedSearchText;
+        return {
+            resolvedProgramId,
+            score,
+            exactHandleMatch
+        };
+    })
+        .filter((entry) => entry.resolvedProgramId !== undefined && entry.resolvedProgramId !== requestedProgramId && entry.exactHandleMatch && entry.score >= 80)
+        .sort((left, right) => right.score - left.score || left.resolvedProgramId.localeCompare(right.resolvedProgramId));
+    if (candidates.length === 0) {
+        return undefined;
+    }
+    const [best, next] = candidates;
+    if (!best || (next && best.score === next.score)) {
+        return undefined;
+    }
+    return {
+        resolvedProgramId: best.resolvedProgramId
+    };
+}
+function selectProgramIndexFallbackMatch(requestedProgramId, resolution) {
+    const requestedId = normalizeTag(requestedProgramId);
+    const requestedHandle = normalizeTag(programHandleText(requestedProgramId));
+    const requestedPlatform = normalizeTag(programPlatformText(requestedProgramId));
+    const candidates = readArray(resolution.matches)
+        .map((entry) => readObject(entry))
+        .filter((entry) => entry !== undefined)
+        .map((entry) => {
+        const program = readObject(entry.program);
+        const resolvedProgramId = stringField(entry, "program_id") ?? stringField(program, "id");
+        const candidateHandle = normalizeTag(stringField(program, "handle") ?? (resolvedProgramId ? programHandleText(resolvedProgramId) : ""));
+        const candidatePlatform = normalizeTag(stringField(program, "platform") ?? (resolvedProgramId ? programPlatformText(resolvedProgramId) : ""));
+        const score = readNumber(entry.score) ?? 0;
+        const idMatch = resolvedProgramId !== undefined && normalizeTag(resolvedProgramId) === requestedId;
+        const platformHandleMatch = requestedPlatform.length > 0 &&
+            candidatePlatform === requestedPlatform &&
+            candidateHandle === requestedHandle;
+        return {
+            resolvedProgramId,
+            program,
+            score,
+            exactMatch: idMatch || platformHandleMatch
+        };
+    })
+        .filter((entry) => entry.resolvedProgramId !== undefined && entry.program !== undefined && entry.exactMatch && entry.score >= 80)
+        .sort((left, right) => right.score - left.score || left.resolvedProgramId.localeCompare(right.resolvedProgramId));
+    if (candidates.length === 0) {
+        return undefined;
+    }
+    const [best, next] = candidates;
+    if (!best || (next && best.score === next.score && normalizeTag(next.resolvedProgramId) !== normalizeTag(best.resolvedProgramId))) {
+        return undefined;
+    }
+    return {
+        resolvedProgramId: best.resolvedProgramId,
+        program: addProgramResourceLinks(best.program)
+    };
+}
+function withProgramIdFallbackMetadata(payload, fallback) {
+    const sourceRequests = readArray(payload.source_requests).filter((request) => readObject(request) !== undefined);
+    const warnings = readArray(payload.warnings).filter((warning) => typeof warning === "string");
+    const resolution = stripUndefined({
+        requested_program_id: fallback.requestedProgramId,
+        resolved_program_id: fallback.resolvedProgramId,
+        query: fallback.query,
+        reason: "stale_program_id",
+        stale_status: 404,
+        stale_request_id: fallback.staleRequestId,
+        stale_upstream_request_id: fallback.staleUpstreamRequestId,
+        resolution_request_id: stringField(fallback.resolution, "request_id")
+    });
+    return stripUndefined({
+        ...payload,
+        source_requests: [...fallback.sourceRequests, ...sourceRequests],
+        warnings: uniqueStrings([...fallback.warnings, ...warnings]),
+        program_id_resolution: resolution
+    });
+}
+function withProgramIndexFallbackMetadata(payload, fallback) {
+    const enriched = withProgramIdFallbackMetadata(payload, fallback);
+    const resolution = readObject(enriched.program_id_resolution);
+    return {
+        ...enriched,
+        program_id_resolution: stripUndefined({
+            ...(resolution ?? {}),
+            reason: "program_index_detail_404"
+        })
+    };
+}
 async function resolveProgram(client, config, input) {
     const warnings = [];
     const budget = {
@@ -1440,10 +1709,11 @@ async function resolveProgram(client, config, input) {
         remaining: input.upstream_request_budget
     };
     const maxPages = clampLimit("max_pages", input.max_pages, MAX_FIND_PROGRAM_PAGES, warnings);
-    const collected = await collectPrograms(client, {
+    const searchQueries = programResolutionSearchQueries(input.query);
+    const collected = await collectProgramsForResolution(client, {
+        searchQueries,
         platforms: input.platforms,
         tags: input.tags,
-        updated_since: undefined,
         opportunity_levels: input.opportunity_levels,
         max_pages: maxPages,
         budget,
@@ -1465,6 +1735,7 @@ async function resolveProgram(client, config, input) {
         warnings: warnings.length > 0 ? warnings : undefined,
         query: {
             text: input.query,
+            search_queries: searchQueries,
             platforms: input.platforms.length > 0 ? input.platforms : undefined,
             tags: input.tags.length > 0 ? input.tags : undefined
         },
@@ -1572,6 +1843,31 @@ async function runResolvedProgramAction(client, config, programId, input) {
             include_ineligible: input.include_ineligible
         });
     }
+    if (input.action === "targets") {
+        const api = await client.getProgramTargets(programId);
+        const data = readObject(api.data);
+        const rawTargets = readArray(data?.targets);
+        const sanitizedTargets = rawTargets
+            .map(sanitizeTarget)
+            .filter((target) => targetHasAllowedScope(target, {
+            include_out_of_scope: input.include_out_of_scope,
+            include_ineligible: input.include_ineligible,
+            strict_scope_filter: true
+        }));
+        const targets = sanitizedTargets.slice(0, input.max_targets);
+        return withApiMetadata(api, {
+            program_id: programId,
+            targets: formatTargetList(targets, input.target_list_mode),
+            meta: {
+                limit: input.max_targets,
+                output_mode: input.target_list_mode,
+                total_active_targets: rawTargets.length,
+                total_after_filters: sanitizedTargets.length,
+                returned: targets.length,
+                has_more: sanitizedTargets.length > targets.length
+            }
+        });
+    }
     return checkProgramNewTargets(client, config, {
         program_id: programId,
         since: input.since,
@@ -1937,7 +2233,7 @@ function findLowNoisePrograms(client, config, input) {
         exclude_mobile_only: false,
         exclude_non_web: false,
         has_api_scope: false,
-        vdp_mode: input.require_bounty ? "exclude" : "include",
+        vdp_mode: "exclude",
         fresh_launch_days: undefined,
         min_wildcards: 0,
         min_eligible_targets: input.min_eligible_targets,
@@ -2268,17 +2564,22 @@ async function comparePrograms(client, config, input) {
     const candidates = [];
     const sourceRequests = [];
     const errors = [];
+    const warnings = [];
     await mapWithConcurrency(input.program_ids, TARGET_SAMPLE_CONCURRENCY, async (programId) => {
         try {
-            const api = await client.getProgram(programId);
-            candidates.push(toProgramCandidate(api.data, config.webBaseUrl));
-            sourceRequests.push({
+            const lookup = await getProgramWithIdFallback(client, config, programId);
+            const api = lookup.api;
+            const requestSource = stripUndefined({
                 source: "program",
-                program_id: programId,
+                program_id: lookup.programId,
+                requested_program_id: lookup.programId === programId ? undefined : programId,
                 request_id: api.requestId,
                 upstream_request_id: api.upstreamRequestId,
                 ...apiSourceMetadata(api)
             });
+            candidates.push(toProgramCandidate(api.data, config.webBaseUrl));
+            sourceRequests.push(...lookup.sourceRequests, requestSource);
+            warnings.push(...lookup.warnings);
         }
         catch (error) {
             errors.push(programFetchError(programId, error));
@@ -2333,6 +2634,7 @@ async function comparePrograms(client, config, input) {
         partial_success: errors.length > 0,
         program_ids_requested: input.program_ids,
         failed_program_ids: errors.map((error) => error.program_id).filter((id) => typeof id === "string"),
+        warnings: warnings.length > 0 ? uniqueStrings(warnings) : undefined,
         errors: errors.length > 0 ? errors : undefined,
         source_requests: sourceRequests,
         compared_programs: candidates.map((candidate, index) => candidateOutput(candidate, index, targetSamples, input.output_mode ?? "compact")),
@@ -2467,11 +2769,132 @@ async function getLatestAddedTargets(client, config, input) {
         })
     });
 }
+async function getProgramTargetsPayload(client, input, programId) {
+    const api = await client.getProgramTargets(programId);
+    const data = readObject(api.data);
+    const rawTargets = readArray(data?.targets);
+    const sanitizedTargets = rawTargets.map(sanitizeTarget).filter((target) => targetHasAllowedScope(target, input));
+    const targets = sanitizedTargets.slice(input.offset, input.offset + input.limit);
+    return withApiMetadata(api, {
+        program_id: programId,
+        targets: formatTargetList(targets, input.output_mode),
+        meta: {
+            offset: input.offset,
+            limit: input.limit,
+            output_mode: input.output_mode,
+            total_active_targets: rawTargets.length,
+            total_after_filters: sanitizedTargets.length,
+            returned: targets.length,
+            has_more: input.offset + input.limit < sanitizedTargets.length,
+            target_source: "program_targets"
+        }
+    });
+}
+async function getProgramTargetsExportFallbackPayload(client, input, programId) {
+    const exportLookup = await fetchProgramTargetsFromExportFallback(client, programId);
+    const sanitizedTargets = exportLookup.rawTargets.filter((target) => targetHasAllowedScope(target, input));
+    const targets = sanitizedTargets.slice(input.offset, input.offset + input.limit);
+    return stripUndefined({
+        request_id: exportLookup.requestId,
+        upstream_request_id: exportLookup.upstreamRequestId,
+        fetched_at: exportLookup.fetchedAt,
+        cache: exportLookup.cache,
+        source_requests: exportLookup.sourceRequests,
+        warnings: exportLookup.warnings.length > 0 ? uniqueStrings(exportLookup.warnings) : undefined,
+        program_id: programId,
+        targets: formatTargetList(targets, input.output_mode),
+        meta: stripUndefined({
+            offset: input.offset,
+            limit: input.limit,
+            output_mode: input.output_mode,
+            total_active_targets: exportLookup.rawTargets.length,
+            total_after_filters: sanitizedTargets.length,
+            returned: targets.length,
+            has_more: input.offset + input.limit < sanitizedTargets.length,
+            target_source: exportLookup.source,
+            target_list_unavailable: exportLookup.unavailable,
+            fallback_error: exportLookup.error
+        })
+    });
+}
+async function fetchProgramTargetsFromExportFallback(client, programId) {
+    try {
+        const api = await client.exportTargets({
+            program_ids: [programId],
+            include_out_of_scope: true,
+            include_ineligible: true,
+            format: "json",
+            limit: MAX_TARGET_EXPORT
+        });
+        const rawTargets = readExportTargetRows(api.data).map((row) => sanitizeTarget(readObject(row)?.target ?? row));
+        return {
+            requestId: api.requestId,
+            upstreamRequestId: api.upstreamRequestId,
+            fetchedAt: api.fetchedAt,
+            cache: readObject(stripUndefined({
+                hit: api.cached,
+                coalesced_live_request: api.coalesced,
+                expires_at: api.cacheExpiresAt
+            })),
+            source: "target_export",
+            rawTargets,
+            sourceRequests: [
+                {
+                    source: "target_export",
+                    program_id: programId,
+                    request_id: api.requestId,
+                    upstream_request_id: api.upstreamRequestId,
+                    ...apiSourceMetadata(api)
+                }
+            ],
+            warnings: [`Used target export fallback because the per-program targets endpoint returned 404 for ${programId}.`],
+            unavailable: false
+        };
+    }
+    catch (error) {
+        return {
+            requestId: randomUUID(),
+            source: "unavailable",
+            rawTargets: [],
+            sourceRequests: [
+                {
+                    source: "target_export",
+                    program_id: programId,
+                    failed: true,
+                    error: programFetchError(programId, error)
+                }
+            ],
+            warnings: [
+                `The BBRadar program index contains ${programId}, but both the per-program targets endpoint and target export fallback were unavailable. Exact targets cannot be returned from the current API response.`
+            ],
+            unavailable: true,
+            error: programFetchError(programId, error)
+        };
+    }
+}
+function readExportTargetRows(data) {
+    if (Array.isArray(data)) {
+        return data;
+    }
+    const object = readObject(data);
+    if (!object) {
+        return [];
+    }
+    return [object.targets, object.results, object.data]
+        .map(readArray)
+        .find((rows) => rows.length > 0) ?? [];
+}
 async function getProgramScopeSummary(client, config, input) {
     const [programApi, targetsApi] = await Promise.all([client.getProgram(input.program_id), client.getProgramTargets(input.program_id)]);
     const targetsData = readObject(targetsApi.data);
     const rawTargets = readArray(targetsData?.targets);
-    const targets = rawTargets.map(sanitizeTarget);
+    const targets = rawTargets
+        .map(sanitizeTarget)
+        .filter((target) => targetHasAllowedScope(target, {
+        include_out_of_scope: input.include_out_of_scope,
+        include_ineligible: input.include_ineligible,
+        strict_scope_filter: false
+    }));
     return {
         request_id: randomUUID(),
         source_requests: [
@@ -2492,11 +2915,39 @@ async function getProgramScopeSummary(client, config, input) {
         scope: buildTargetScopeSummary(targets, input.target_list_mode, input.group_limit, input.include_out_of_scope, input.include_ineligible),
         meta: {
             total_active_targets: rawTargets.length,
+            total_after_filters: targets.length,
             target_list_mode: input.target_list_mode,
             group_limit: input.group_limit
         }
     };
 }
+async function getProgramScopeSummaryFromIndexFallback(client, indexFallback, input) {
+    const exportLookup = await fetchProgramTargetsFromExportFallback(client, input.program_id);
+    const targets = exportLookup.rawTargets.filter((target) => targetHasAllowedScope(target, {
+        include_out_of_scope: input.include_out_of_scope,
+        include_ineligible: input.include_ineligible,
+        strict_scope_filter: false
+    }));
+    return stripUndefined({
+        request_id: exportLookup.requestId,
+        upstream_request_id: exportLookup.upstreamRequestId,
+        fetched_at: exportLookup.fetchedAt,
+        cache: exportLookup.cache,
+        source_requests: exportLookup.sourceRequests,
+        warnings: exportLookup.warnings.length > 0 ? uniqueStrings(exportLookup.warnings) : undefined,
+        program: formatProgram(indexFallback.program, "compact"),
+        scope: buildTargetScopeSummary(targets, input.target_list_mode, input.group_limit, input.include_out_of_scope, input.include_ineligible),
+        meta: stripUndefined({
+            total_active_targets: exportLookup.rawTargets.length,
+            total_after_filters: targets.length,
+            target_list_mode: input.target_list_mode,
+            group_limit: input.group_limit,
+            target_source: exportLookup.source,
+            target_list_unavailable: exportLookup.unavailable,
+            fallback_error: exportLookup.error
+        })
+    });
+}
 async function getProgramTargetBreakdown(client, config, input) {
     const [programApi, targetsApi] = await Promise.all([client.getProgram(input.program_id), client.getProgramTargets(input.program_id)]);
     const targetsData = readObject(targetsApi.data);
@@ -2543,6 +2994,42 @@ async function getProgramTargetBreakdown(client, config, input) {
         }
     };
 }
+async function getProgramTargetBreakdownFromIndexFallback(client, indexFallback, input) {
+    const exportLookup = await fetchProgramTargetsFromExportFallback(client, input.program_id);
+    const targets = exportLookup.rawTargets.filter((target) => targetHasAllowedScope(target, {
+        include_out_of_scope: input.include_out_of_scope,
+        include_ineligible: input.include_ineligible,
+        strict_scope_filter: false
+    }));
+    const scope = buildTargetScopeSummary(targets, input.target_list_mode, input.group_limit, input.include_out_of_scope, input.include_ineligible);
+    return stripUndefined({
+        request_id: exportLookup.requestId,
+        upstream_request_id: exportLookup.upstreamRequestId,
+        fetched_at: exportLookup.fetchedAt,
+        cache: exportLookup.cache,
+        source_requests: exportLookup.sourceRequests,
+        warnings: exportLookup.warnings.length > 0 ? uniqueStrings(exportLookup.warnings) : undefined,
+        program: formatProgram(indexFallback.program, "compact"),
+        breakdown: {
+            target_counts: readObject(scope.target_counts),
+            by_target_type: countTargetValues(targets, (target) => stringField(target, "target_type")),
+            by_scope_tag: countTargetValues(targets, (target) => readStringArrayField(target, "scope_tags")),
+            by_language_tag: countTargetValues(targets, (target) => readStringArrayField(target, "language_tags")),
+            group_counts: readObject(scope.group_counts),
+            group_has_more: readObject(scope.group_has_more),
+            groups: readObject(scope.groups)
+        },
+        meta: stripUndefined({
+            total_active_targets: exportLookup.rawTargets.length,
+            total_after_filters: targets.length,
+            target_list_mode: input.target_list_mode,
+            group_limit: input.group_limit,
+            target_source: exportLookup.source,
+            target_list_unavailable: exportLookup.unavailable,
+            fallback_error: exportLookup.error
+        })
+    });
+}
 async function getProgramScopeDelta(client, config, input) {
     const programApi = await client.getProgram(input.program_id);
     const program = addProgramResourceLinks(sanitizeProgram(programApi.data, config.webBaseUrl));
@@ -2673,13 +3160,15 @@ async function getRecentTargetActivity(client, config, input) {
     };
 }
 async function checkProgramNewTargets(client, config, input) {
-    const handle = programSearchText(input.program_id);
+    const programLookup = await getProgramWithIdFallback(client, config, input.program_id);
+    const programId = programLookup.programId;
+    const handle = programSearchText(programId);
     const api = await client.getRecentChanges({
         change_type: "added",
         include_removed: false,
         include_ineligible: input.include_ineligible,
         include_out_of_scope: false,
-        search: handle.length >= 2 ? handle : input.program_id,
+        search: handle.length >= 2 ? handle : programId,
         tags: input.target_type ? [input.target_type] : [],
         page: 1,
         page_size: input.page_size
@@ -2693,7 +3182,88 @@ async function checkProgramNewTargets(client, config, input) {
         const target = readObject(change.target);
         const changedAt = timestampField(change, "changed_at");
         return (stringField(change, "change_type") === "added" &&
-            stringField(readObject(change.program), "id") === input.program_id &&
+            stringField(readObject(change.program), "id") === programId &&
+            target !== undefined &&
+            (sinceTimestamp === undefined || changedAt >= sinceTimestamp) &&
+            (!input.target_type || targetMatchesRequestedType(target, input.target_type)) &&
+            targetHasAllowedScope(target, {
+                include_out_of_scope: false,
+                include_ineligible: input.include_ineligible,
+                strict_scope_filter: true
+            }));
+    })
+        .sort((left, right) => timestampField(right, "changed_at") - timestampField(left, "changed_at"));
+    const limitedChanges = matchingChanges.slice(0, input.max_targets);
+    const targets = limitedChanges
+        .map((change) => readObject(change.target))
+        .filter((target) => target !== undefined);
+    const latest = matchingChanges[0];
+    const sourceRequests = [
+        {
+            source: "program",
+            program_id: programId,
+            requested_program_id: programId === input.program_id ? undefined : input.program_id,
+            request_id: programLookup.api.requestId,
+            upstream_request_id: programLookup.api.upstreamRequestId,
+            ...apiSourceMetadata(programLookup.api)
+        },
+        {
+            source: "recent_changes",
+            request_id: api.requestId,
+            upstream_request_id: api.upstreamRequestId,
+            ...apiSourceMetadata(api)
+        }
+    ];
+    const payload = stripUndefined({
+        request_id: randomUUID(),
+        source_requests: sourceRequests,
+        warnings: !programLookup.fallback && programLookup.warnings.length > 0 ? uniqueStrings(programLookup.warnings) : undefined,
+        program_id: programId,
+        program: latest
+            ? formatProgram(addProgramResourceLinks(readObject(latest.program) ?? {}), "compact")
+            : formatProgram(addProgramResourceLinks(sanitizeProgram(programLookup.api.data, config.webBaseUrl)), "compact"),
+        has_new_targets: matchingChanges.length > 0,
+        new_target_count: matchingChanges.length,
+        latest_added_at: latest ? stringField(latest, "changed_at") : undefined,
+        new_targets: formatTargetList(targets, input.target_list_mode),
+        meta: stripUndefined({
+            recent_changes_scanned: changes.length,
+            returned: targets.length,
+            has_more: matchingChanges.length > targets.length,
+            since: input.since,
+            target_type: input.target_type,
+            in_scope_only: true,
+            include_ineligible: input.include_ineligible,
+            target_list_mode: input.target_list_mode,
+            upstream_total_pages: readNumber(upstreamMeta?.total_pages),
+            scan_may_be_incomplete: (readNumber(upstreamMeta?.total_pages) ?? 1) > 1
+        })
+    });
+    return programLookup.fallback ? withProgramIdFallbackMetadata(payload, programLookup.fallback) : payload;
+}
+async function checkProgramNewTargetsFromIndexedProgram(client, config, input, indexedProgram) {
+    const programId = input.program_id;
+    const handle = programSearchText(programId);
+    const api = await client.getRecentChanges({
+        change_type: "added",
+        include_removed: false,
+        include_ineligible: input.include_ineligible,
+        include_out_of_scope: false,
+        search: handle.length >= 2 ? handle : programId,
+        tags: input.target_type ? [input.target_type] : [],
+        page: 1,
+        page_size: input.page_size
+    });
+    const data = readObject(api.data);
+    const upstreamMeta = readObject(sanitizeJson(data?.meta));
+    const sinceTimestamp = input.since ? Date.parse(input.since) : undefined;
+    const changes = readArray(data?.results).map((change) => sanitizeChange(change, config.webBaseUrl));
+    const matchingChanges = changes
+        .filter((change) => {
+        const target = readObject(change.target);
+        const changedAt = timestampField(change, "changed_at");
+        return (stringField(change, "change_type") === "added" &&
+            stringField(readObject(change.program), "id") === programId &&
             target !== undefined &&
             (sinceTimestamp === undefined || changedAt >= sinceTimestamp) &&
             (!input.target_type || targetMatchesRequestedType(target, input.target_type)) &&
@@ -2719,8 +3289,10 @@ async function checkProgramNewTargets(client, config, input) {
                 ...apiSourceMetadata(api)
             }
         ],
-        program_id: input.program_id,
-        program: latest ? formatProgram(addProgramResourceLinks(readObject(latest.program) ?? {}), "compact") : undefined,
+        program_id: programId,
+        program: latest
+            ? formatProgram(addProgramResourceLinks(readObject(latest.program) ?? {}), "compact")
+            : formatProgram(indexedProgram, "compact"),
         has_new_targets: matchingChanges.length > 0,
         new_target_count: matchingChanges.length,
         latest_added_at: latest ? stringField(latest, "changed_at") : undefined,
@@ -2734,6 +3306,7 @@ async function checkProgramNewTargets(client, config, input) {
             in_scope_only: true,
             include_ineligible: input.include_ineligible,
             target_list_mode: input.target_list_mode,
+            program_detail_source: "program_index",
             upstream_total_pages: readNumber(upstreamMeta?.total_pages),
             scan_may_be_incomplete: (readNumber(upstreamMeta?.total_pages) ?? 1) > 1
         })
@@ -3409,8 +3982,9 @@ function candidateLooksLikeVdp(candidate) {
     return candidateHasKnownNoBounty(candidate) || tagIncludesAnyNormalized(candidate.normalizedSearchSignals, VDP_SIGNALS);
 }
 function programResolutionMatch(candidate, query) {
-    const normalizedQuery = normalizeTag(query);
-    const queryTokens = tokenSet(normalizedQuery);
+    const queryVariants = programResolutionQueryVariants(query);
+    const primaryQuery = queryVariants[0] ?? normalizeTag(query);
+    const queryTokens = meaningfulProgramQueryTokens(query);
     const fields = [
         { name: "id", value: stringField(candidate.program, "id") },
         { name: "handle", value: stringField(candidate.program, "handle") },
@@ -3428,16 +4002,23 @@ function programResolutionMatch(candidate, query) {
         }
         const normalizedValue = normalizeTag(field.value);
         const fieldTokens = tokenSet(normalizedValue);
-        if (normalizedValue === normalizedQuery) {
-            score = Math.max(score, field.name === "id" || field.name === "handle" ? 100 : 95);
-            matchedFields.add(field.name);
-            reasons.add(`${field.name} exact match`);
-            continue;
-        }
-        if (normalizedValue.includes(normalizedQuery)) {
-            score = Math.max(score, field.name === "name" || field.name === "handle" ? 80 : 65);
-            matchedFields.add(field.name);
-            reasons.add(`${field.name} contains query`);
+        for (const queryVariant of queryVariants) {
+            if (normalizedValue === queryVariant) {
+                score = Math.max(score, field.name === "id" || field.name === "handle" ? 100 : 95);
+                matchedFields.add(field.name);
+                reasons.add(queryVariant === primaryQuery ? `${field.name} exact match` : `${field.name} exact meaningful-query match`);
+                continue;
+            }
+            if (normalizedValue.includes(queryVariant)) {
+                const containsScore = field.name === "name" || field.name === "handle"
+                    ? queryVariant.includes("-") || queryVariant.includes(" ")
+                        ? 90
+                        : 85
+                    : 70;
+                matchedFields.add(field.name);
+                score = Math.max(score, containsScore);
+                reasons.add(queryVariant === primaryQuery ? `${field.name} contains query` : `${field.name} contains meaningful query`);
+            }
         }
         const tokenOverlap = [...queryTokens].filter((token) => fieldTokens.has(token)).length;
         if (tokenOverlap > 0) {
@@ -3447,10 +4028,12 @@ function programResolutionMatch(candidate, query) {
             reasons.add(`${field.name} token match`);
         }
     }
-    if (candidate.normalizedSearchSignals.some((signal) => signal.includes(normalizedQuery))) {
-        score = Math.max(score, 55);
-        matchedFields.add("search_signals");
-        reasons.add("program search signals contain query");
+    for (const queryVariant of queryVariants) {
+        if (candidate.normalizedSearchSignals.some((signal) => signal.includes(queryVariant))) {
+            score = Math.max(score, queryVariant === primaryQuery ? 55 : 65);
+            matchedFields.add("search_signals");
+            reasons.add(queryVariant === primaryQuery ? "program search signals contain query" : "program search signals contain meaningful query");
+        }
     }
     return {
         score,
@@ -3458,6 +4041,25 @@ function programResolutionMatch(candidate, query) {
         reasons: [...reasons]
     };
 }
+function programResolutionSearchQueries(query) {
+    return programResolutionQueryVariants(query).slice(0, MAX_RESOLVE_SEARCH_QUERIES);
+}
+function programResolutionQueryVariants(query) {
+    const normalized = normalizeTag(query);
+    const meaningfulTokens = [...meaningfulProgramQueryTokens(query)];
+    const meaningfulPhrase = meaningfulTokens.join(" ");
+    const values = [
+        normalized,
+        meaningfulPhrase,
+        meaningfulTokens.join("-"),
+        ...meaningfulTokens
+    ];
+    return uniqueStrings(values.filter((value) => value.length >= 2));
+}
+function meaningfulProgramQueryTokens(query) {
+    const tokens = [...tokenSet(normalizeTag(query))].filter((token) => !PROGRAM_RESOLUTION_STOP_WORDS.has(token));
+    return new Set(tokens.length > 0 ? tokens : [...tokenSet(normalizeTag(query))]);
+}
 function normalizedCandidateValues(program, normalizedScopeTags) {
     return [
         stringField(program, "id"),
@@ -3504,9 +4106,18 @@ function programSearchText(programId) {
     const lastPathSegment = handle.split("/").filter(Boolean).at(-1) ?? handle;
     return lastPathSegment.length >= 2 ? lastPathSegment : handle;
 }
+function programHandleText(programId) {
+    const colonIndex = programId.indexOf(":");
+    return colonIndex >= 0 ? programId.slice(colonIndex + 1) : programId;
+}
+function programPlatformText(programId) {
+    const colonIndex = programId.indexOf(":");
+    return colonIndex >= 0 ? programId.slice(0, colonIndex) : "";
+}
 function normalizeFindProgramsInput(input) {
     const warnings = [];
     const normalized = { ...input };
+    normalized.vdp_mode ??= "exclude";
     normalized.max_pages = clampLimit("max_pages", normalized.max_pages, MAX_FIND_PROGRAM_PAGES, warnings);
     normalized.max_results = clampLimit("max_results", normalized.max_results, MAX_FIND_PROGRAM_RESULTS, warnings);
     normalized.target_sample_programs = clampLimit("target_sample_programs", normalized.target_sample_programs, MAX_FIND_TARGET_SAMPLE_PROGRAMS, warnings);
@@ -3637,6 +4248,55 @@ async function collectPrograms(client, options) {
         totalPagesBySource
     };
 }
+async function collectProgramsForResolution(client, options) {
+    const collections = [];
+    const queries = options.searchQueries.length > 0 ? options.searchQueries : [undefined];
+    for (const search of queries) {
+        if (options.budget.remaining <= 0) {
+            addUniqueWarning(options.warnings, "Upstream request budget was exhausted before all program name search variants could be checked.");
+            break;
+        }
+        collections.push(await collectPrograms(client, {
+            search,
+            platforms: options.platforms,
+            tags: options.tags,
+            updated_since: undefined,
+            opportunity_levels: options.opportunity_levels,
+            max_pages: options.max_pages,
+            budget: options.budget,
+            warnings: options.warnings
+        }));
+    }
+    if (collections.length === 0) {
+        return {
+            programs: [],
+            sourceRequests: [],
+            requestsScanned: 0,
+            programsScanned: 0,
+            totalPagesBySource: {}
+        };
+    }
+    return mergeProgramCollections(collections);
+}
+function mergeProgramCollections(collections) {
+    const programs = new Map();
+    const totalPagesBySource = {};
+    for (const collection of collections) {
+        for (const program of collection.programs) {
+            programs.set(programKey(program, programs.size), program);
+        }
+        for (const [sourceName, totalPages] of Object.entries(collection.totalPagesBySource)) {
+            totalPagesBySource[sourceName] = totalPages;
+        }
+    }
+    return {
+        programs: [...programs.values()],
+        sourceRequests: collections.flatMap((collection) => collection.sourceRequests),
+        requestsScanned: collections.reduce((total, collection) => total + collection.requestsScanned, 0),
+        programsScanned: programs.size,
+        totalPagesBySource
+    };
+}
 async function collectProgramSources(client, sources, options) {
     const pages = [];
     await mapWithConcurrency(sources.map((source, sourceIndex) => ({ source, sourceIndex })), PROGRAM_COLLECTION_CONCURRENCY, async ({ source, sourceIndex }) => {
@@ -3681,6 +4341,7 @@ async function fetchProgramPage(client, source, sourceIndex, page, options) {
     const runWithSlot = options.runWithProgramPageSlot ?? runImmediately;
     return runWithSlot(async () => {
         const query = toQuery({
+            search: options.search,
             platforms: options.platforms,
             tags: options.tags,
             updated_since: options.updated_since,
@@ -3696,14 +4357,16 @@ async function fetchProgramPage(client, source, sourceIndex, page, options) {
         const data = readObject(api.data);
         const meta = readObject(data?.meta);
         const sourceName = source.kind === "opportunity" ? `opportunities:${source.level}` : "programs";
+        const labeledSourceName = options.search ? `${sourceName}:search:${normalizeTag(options.search)}` : sourceName;
         return {
-            sourceName,
+            sourceName: labeledSourceName,
             sourceIndex,
             page,
             programs: readArray(data?.programs),
             totalPages: readNumber(meta?.total_pages),
             sourceRequest: stripUndefined({
-                source: sourceName,
+                source: labeledSourceName,
+                search: options.search,
                 request_id: api.requestId,
                 upstream_request_id: api.upstreamRequestId,
                 ...apiSourceMetadata(api),
@@ -3826,13 +4489,7 @@ function programCandidateMatches(candidate, filters) {
     if (filters.contest_like === true && !candidateLooksContestLike(candidate)) {
         return false;
     }
-    if (filters.vdp_mode === "exclude" && candidateLooksLikeVdp(candidate)) {
-        return false;
-    }
-    if (filters.vdp_mode === "only_likely" && !candidateLooksLikeVdp(candidate)) {
-        return false;
-    }
-    if (filters.vdp_mode === "only_known_no_bounty" && !candidateHasKnownNoBounty(candidate)) {
+    if (!candidateMatchesVdpMode(candidate, filters.vdp_mode ?? "exclude")) {
         return false;
     }
     if (filters.fresh_launch_days !== undefined) {
@@ -3893,6 +4550,18 @@ function compareProgramCandidates(left, right, sortBy) {
         right.firstSeenTime - left.firstSeenTime ||
         right.lastUpdatedTime - left.lastUpdatedTime);
 }
+function candidateMatchesVdpMode(candidate, vdpMode) {
+    if (vdpMode === "exclude") {
+        return !candidateLooksLikeVdp(candidate);
+    }
+    if (vdpMode === "only_likely") {
+        return candidateLooksLikeVdp(candidate);
+    }
+    if (vdpMode === "only_known_no_bounty") {
+        return candidateHasKnownNoBounty(candidate);
+    }
+    return true;
+}
 async function collectTargetSamples(client, candidates, input, budget) {
     const samples = {};
     const sampleCandidates = candidates.slice(0, input.target_sample_programs);
@@ -3984,6 +4653,9 @@ function addUniqueWarning(warnings, warning) {
         warnings.push(warning);
     }
 }
+function isProgramNotFoundError(error) {
+    return error instanceof BBRadarApiError && error.status === 404;
+}
 function runImmediately(callback) {
     return callback();
 }
@@ -4092,7 +4764,7 @@ function registerPrompts(server) {
 
 Find the best BBRadar program candidates.
 - Start with find_program_candidates unless the user needs custom filters; pass opportunity_levels from this JSON array unless the user asked for a broader search: ${promptJson([args.opportunity_level ?? "elite"])}.
-- Use find_language_programs for language asks, find_target_type_programs for API/mobile/source-code/domain asks, find_reward_programs or find_paid_programs for reward asks, find_vdp_programs for VDP/no-bounty asks, find_web3_contests for Web3 contest/audit asks, find_web3_programs for general Web3 requests, and find_wildcard_programs for wildcard-specific requests.
+- Use find_language_programs for language asks, find_target_type_programs for API/mobile/source-code/domain asks, find_reward_programs or find_paid_programs for reward asks, find_vdp_programs only for explicit VDP/no-bounty asks, find_web3_contests for Web3 contest/audit asks, find_web3_programs for general Web3 requests, and find_wildcard_programs for wildcard-specific requests.
 - Apply platform filters from this JSON string if provided: ${promptJson(args.platforms ?? "")}.
 - Apply tag filters from this JSON string if provided: ${promptJson(args.tags ?? "")}.
 - Keep the shortlist to this JSON value: ${promptJson(args.max_programs ?? "10")}.
@@ -4102,16 +4774,16 @@ Find the best BBRadar program candidates.
 - Stay passive-only; do not recommend scanning, probing, exploit attempts, or direct contact with targets.`));
     server.registerPrompt("summarize_program_scope", {
         title: "Summarize Program Scope",
-        description: "Summarize in-scope and out-of-scope BBRadar target data for one program.",
+        description: "Summarize BBRadar target data for one program.",
         argsSchema: {
             program_id: programIdSchema
         }
-    }, (args) => promptResult(`Use get_program for the program_id in this JSON string: ${promptJson(args.program_id)}. Then use get_program_targets with include_out_of_scope=true, include_ineligible=true, and limit=${MAX_TARGETS_PER_PROGRAM}.
+    }, (args) => promptResult(`Use get_program for the program_id in this JSON string: ${promptJson(args.program_id)}. Then use get_program_targets with include_out_of_scope=false, include_ineligible=false, and limit=${MAX_TARGETS_PER_PROGRAM}. Only request out-of-scope or ineligible targets if the user explicitly asks for them.
 
 Summarize the program scope:
 - Program name, platform, reward range, public report count, first seen date, last updated date, and BBRadar URL.
 - In-scope bounty-eligible target categories.
-- Out-of-scope or ineligible target categories.
+- Out-of-scope or ineligible target categories only if explicitly requested.
 - Wildcards, high-severity target labels, and notable language or scope tags.
 - Recent target update signals if present.
 - Do not contact, scan, probe, or validate any listed target.`));