@bbradar/mcp 0.1.3

package/dist/server.js

@@ -0,0 +1,4418 @@
+import { randomUUID } from "node:crypto";
+import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
+import { BBRadarApiError } from "./bbradarClient.js";
+import { stripUndefined } from "./json.js";
+import { FixedWindowRateLimiter } from "./rateLimit.js";
+import { readArray, readBoolean, readNumber, readObject, readString, sanitizeJson, sanitizeChange, sanitizeProgram, sanitizeTarget, sanitizeTargetsForExport } from "./sanitize.js";
+const SERVER_VERSION = "0.1.0";
+const MAX_PROGRAMS_PER_SEARCH = 100;
+const MAX_TARGET_EXPORT = 500;
+const MAX_RECENT_CHANGES = 100;
+const MAX_TARGETS_PER_PROGRAM = 500;
+const MAX_WILDCARD_SEARCH_PAGES = 10;
+const MAX_WILDCARD_RESULTS = 25;
+const MAX_WILDCARD_TARGET_SAMPLE_PROGRAMS = 5;
+const MAX_WILDCARD_TARGET_SAMPLES = 10;
+const MAX_FIND_PROGRAM_PAGES = 10;
+const MAX_FIND_PROGRAM_RESULTS = 50;
+const MAX_FIND_TARGET_SAMPLE_PROGRAMS = 10;
+const MAX_FIND_TARGET_SAMPLES = 20;
+const MAX_FIND_UPSTREAM_REQUEST_BUDGET = 50;
+const DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET = 20;
+const MAX_ACCEPTED_NUMERIC_LIMIT = 1_000;
+const PROGRAM_COLLECTION_CONCURRENCY = 4;
+const TARGET_SAMPLE_CONCURRENCY = 3;
+const DEFAULT_FILTER_DISCOVERY_PAGES = 2;
+const MAX_FILTER_DISCOVERY_PAGES = 5;
+const DEFAULT_FILTER_TARGET_SAMPLE_PROGRAMS = 10;
+const MAX_FILTER_TARGET_SAMPLE_PROGRAMS = 25;
+const MAX_LOCAL_EXPORT_RESOURCES = 25;
+const EXPORT_PREVIEW_LIMIT = 25;
+const SDK_VERSION = "1.29.0";
+const WEB3_TAGS = ["web3", "crypto", "blockchain", "smart-contract", "smart contract", "defi", "nft", "ethereum", "solana", "solidity"];
+const WEB3_CONTEST_SIGNALS = ["contest", "audit", "competitive", "code4rena", "sherlock", "cantina", "codehawks", "hats", "spearbit", "warden"];
+const VDP_SIGNALS = ["vdp", "disclosure", "responsible disclosure", "vulnerability disclosure", "no bounty", "non-bounty", "no reward"];
+const targetListModeSchema = z.enum(["identifiers", "compact", "full"]);
+const changeListModeSchema = z.enum(["compact", "full"]);
+const programListModeSchema = z.enum(["compact", "full"]);
+const rewardThresholdModeSchema = z.enum(["max_at_least", "min_at_least"]);
+const vdpModeSchema = z.enum(["include", "exclude", "only_likely", "only_known_no_bounty"]);
+const targetMatchModeSchema = z.enum(["contains", "exact", "suffix", "wildcard"]);
+const programNameActionSchema = z.enum(["new_targets", "scope_delta", "brief", "target_breakdown"]);
+const readOnlyAnnotations = {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: true
+};
+const TOOL_METRICS = new Map();
+const filterValueSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(128)
+    .refine((value) => !/[,\u0000-\u001F\u007F]/.test(value), {
+    message: "Filter values cannot contain commas or control characters."
+});
+const stringListSchema = z
+    .array(filterValueSchema)
+    .max(50)
+    .default([])
+    .describe("Filter values.");
+const searchTextSchema = z
+    .string()
+    .trim()
+    .min(2)
+    .max(128)
+    .refine((value) => !/[\u0000-\u001F\u007F]/.test(value), {
+    message: "Search text cannot contain control characters."
+});
+const isoDateTimeSchema = z.string().datetime({ offset: true });
+const pageSchema = z.number().int().min(1).default(1);
+const programsPageSizeSchema = z.number().int().min(1).max(MAX_PROGRAMS_PER_SEARCH).default(20);
+const recentChangesPageSizeSchema = z.number().int().min(1).max(MAX_RECENT_CHANGES).default(50);
+const opportunityLevelSchema = z.enum(["elite", "hot", "strong", "potential"]);
+const programSortSchema = z
+    .enum([
+    "best_match",
+    "lowest_reports",
+    "highest_reward",
+    "most_wildcards",
+    "most_eligible_targets",
+    "freshest",
+    "recently_updated",
+    "highest_opportunity_score",
+    "most_new_targets",
+    "best_hunt_value"
+])
+    .default("best_match");
+const programIdSchema = z
+    .string()
+    .trim()
+    .min(3)
+    .max(256)
+    .regex(/^[A-Za-z0-9_-]+:[^?#]+$/, "Use platform:handle, for example HackerOne:example-handle.")
+    .refine((value) => !/[\u0000-\u001F\u007F]/.test(value), {
+    message: "program_id cannot contain control characters."
+})
+    .describe("platform:handle id.");
+const jsonRecordSchema = z.record(z.unknown());
+const rateLimitOutputSchema = z.object({
+    remaining: z.number().int().min(0),
+    reset_at: z.string()
+});
+const toolTimingOutputSchema = z.object({
+    tool_name: z.string(),
+    duration_ms: z.number().int().min(0)
+});
+const cacheOutputSchema = z.object({
+    hit: z.boolean(),
+    coalesced_live_request: z.boolean().optional(),
+    expires_at: z.string().optional()
+});
+const errorOutputSchema = z.object({
+    message: z.string(),
+    status: z.number().int().optional(),
+    detail: z.unknown().optional(),
+    errors: z.unknown().optional()
+});
+const programOutputSchema = jsonRecordSchema;
+const targetOutputSchema = jsonRecordSchema;
+const apiEnvelopeOutputShape = {
+    request_id: z.string(),
+    upstream_request_id: z.string().optional(),
+    fetched_at: z.string().optional(),
+    cache: cacheOutputSchema.optional(),
+    mcp_rate_limit: rateLimitOutputSchema.optional(),
+    mcp_timing: toolTimingOutputSchema.optional(),
+    error: errorOutputSchema.optional()
+};
+const programListOutputShape = {
+    ...apiEnvelopeOutputShape,
+    programs: z.array(programOutputSchema).optional(),
+    meta: jsonRecordSchema.optional()
+};
+const findProgramsOutputShape = {
+    ...programListOutputShape,
+    source_requests: z.array(jsonRecordSchema).optional(),
+    filters: jsonRecordSchema.optional(),
+    warnings: z.array(z.string()).optional(),
+    errors: z.array(jsonRecordSchema).optional(),
+    upstream_budget: jsonRecordSchema.optional(),
+    ranking_scope: jsonRecordSchema.optional()
+};
+const decisionOutputShape = {
+    ...findProgramsOutputShape,
+    partial_success: z.boolean().optional(),
+    program_ids_requested: z.array(z.string()).optional(),
+    failed_program_ids: z.array(z.string()).optional(),
+    compared_programs: z.array(programOutputSchema).optional(),
+    activity: jsonRecordSchema.optional(),
+    changes: z.array(jsonRecordSchema).optional()
+};
+const programCandidatePresetInputSchema = {
+    platforms: stringListSchema,
+    tags: stringListSchema,
+    scope_tags: stringListSchema,
+    target_types: stringListSchema,
+    language_tags: stringListSchema,
+    opportunity_levels: z.array(opportunityLevelSchema).max(4).default(["elite", "hot", "strong", "potential"]),
+    web3: z.boolean().default(false),
+    wildcard: z.boolean().default(false),
+    low_reports: z.boolean().default(true),
+    bounty: z.boolean().default(true),
+    max_public_report_count: z.number().int().min(0).default(15),
+    min_bounty_max: z.number().int().min(0).optional(),
+    min_eligible_targets: z.number().int().min(0).default(1),
+    fresh_launch_days: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).optional(),
+    has_api_scope: z.boolean().default(false),
+    exclude_ctf: z.boolean().default(true),
+    exclude_mobile_only: z.boolean().default(false),
+    exclude_non_web: z.boolean().default(false),
+    updated_since: isoDateTimeSchema.optional(),
+    max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(5),
+    max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
+    include_target_samples: z.boolean().default(true),
+    target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(5),
+    target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(5),
+    output_mode: programListModeSchema.default("compact"),
+    upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(30)
+};
+export function createBbradarServer(client, config) {
+    const server = new McpServer({
+        name: "bbradar.io",
+        version: SERVER_VERSION
+    }, {
+        instructions: [
+            "Use BBRadar only for passive bug bounty intelligence; never scan or contact targets.",
+            "For BBRadar asks, use these tools first and avoid external skills unless methodology is explicitly requested.",
+            "Name + action: run_program_name_action. Name only: resolve_program.",
+            "Freshness: get_latest_added_targets, check_program_new_targets, check_watchlist_new_targets, find_recent_by_type, get_program_scope_delta.",
+            "Discovery: find_program_candidates, find_stack_matches, find_language_programs, find_target_type_programs, find_reward_programs, find_paid_programs, find_vdp_programs, find_web3_contests, find_low_noise_programs.",
+            "Details: get_program_brief, get_program_scope_summary, get_program_target_breakdown, find_programs_by_target, compare_programs_compact.",
+            "Prefer compact/identifier outputs and disclose sampled ranking scope when present."
+        ].join("\n")
+    });
+    const rateLimiter = new FixedWindowRateLimiter();
+    const exportStore = new Map();
+    server.registerTool("search_programs", {
+        title: "Search BBRadar Programs",
+        description: `List active programs. page_size max ${MAX_PROGRAMS_PER_SEARCH}.`,
+        inputSchema: {
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            updated_since: isoDateTimeSchema.optional().describe("ISO datetime."),
+            page: pageSchema,
+            page_size: programsPageSizeSchema
+        },
+        outputSchema: programListOutputShape,
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("search_programs", config, rateLimiter, async () => {
+        const api = await client.listPrograms(toQuery(args));
+        const data = readObject(api.data);
+        const programs = readArray(data?.programs).map((program) => addProgramResourceLinks(sanitizeProgram(program, config.webBaseUrl)));
+        return withApiMetadata(api, {
+            programs,
+            meta: sanitizeJson(data?.meta)
+        });
+    }));
+    server.registerTool("get_program", {
+        title: "Get BBRadar Program",
+        description: "Get one program by id.",
+        inputSchema: {
+            program_id: programIdSchema
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape,
+            program: programOutputSchema.optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("get_program", config, rateLimiter, async () => {
+        const api = await client.getProgram(args.program_id);
+        return withApiMetadata(api, {
+            program: addProgramResourceLinks(sanitizeProgram(api.data, config.webBaseUrl))
+        });
+    }));
+    server.registerTool("resolve_program", {
+        title: "Resolve Program",
+        description: "Resolve name/handle text to likely program_ids.",
+        inputSchema: {
+            query: searchTextSchema,
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            opportunity_levels: z.array(opportunityLevelSchema).max(4).default([]),
+            max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            max_results: z.number().int().min(1).max(25).default(10),
+            output_mode: programListModeSchema.default("compact"),
+            upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
+        },
+        outputSchema: {
+            ...programListOutputShape,
+            source_requests: z.array(jsonRecordSchema).optional(),
+            query: jsonRecordSchema.optional(),
+            matches: z.array(jsonRecordSchema).optional(),
+            warnings: z.array(z.string()).optional(),
+            upstream_budget: jsonRecordSchema.optional(),
+            ranking_scope: jsonRecordSchema.optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("resolve_program", config, rateLimiter, async () => resolveProgram(client, config, args)));
+    server.registerTool("run_program_name_action", {
+        title: "Run Program Name Action",
+        description: "Resolve a name, then run new_targets, scope_delta, brief, or target_breakdown.",
+        inputSchema: {
+            query: searchTextSchema,
+            action: programNameActionSchema.default("new_targets"),
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            opportunity_levels: z.array(opportunityLevelSchema).max(4).default([]),
+            since: isoDateTimeSchema.optional(),
+            target_type: filterValueSchema.optional(),
+            language_tags: stringListSchema,
+            include_out_of_scope: z.boolean().default(false),
+            include_ineligible: z.boolean().default(false),
+            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
+            max_targets: z.number().int().min(1).max(MAX_RECENT_CHANGES).default(25),
+            group_limit: z.number().int().min(1).max(MAX_TARGETS_PER_PROGRAM).default(100),
+            target_list_mode: targetListModeSchema.default("identifiers"),
+            max_resolve_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            output_mode: programListModeSchema.default("compact"),
+            upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape,
+            source_requests: z.array(jsonRecordSchema).optional(),
+            resolved_program: jsonRecordSchema.optional(),
+            action: z.string().optional(),
+            result: jsonRecordSchema.optional(),
+            warnings: z.array(z.string()).optional(),
+            upstream_budget: jsonRecordSchema.optional(),
+            ranking_scope: jsonRecordSchema.optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("run_program_name_action", config, rateLimiter, async () => runProgramNameAction(client, config, args)));
+    server.registerTool("get_program_targets", {
+        title: "Get Program Targets",
+        description: `Get active targets for one program. limit max ${MAX_TARGETS_PER_PROGRAM}.`,
+        inputSchema: {
+            program_id: programIdSchema,
+            include_out_of_scope: z.boolean().default(false),
+            include_ineligible: z.boolean().default(false),
+            strict_scope_filter: z.boolean().default(true),
+            offset: z.number().int().min(0).default(0),
+            limit: z.number().int().min(1).max(MAX_TARGETS_PER_PROGRAM).default(100),
+            output_mode: targetListModeSchema.default("compact")
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape,
+            program_id: z.string().optional(),
+            targets: z.array(z.unknown()).optional(),
+            meta: jsonRecordSchema.optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("get_program_targets", config, rateLimiter, async () => {
+        const api = await client.getProgramTargets(args.program_id);
+        const data = readObject(api.data);
+        const rawTargets = readArray(data?.targets);
+        const sanitizedTargets = rawTargets.map(sanitizeTarget).filter((target) => targetHasAllowedScope(target, args));
+        const targets = sanitizedTargets.slice(args.offset, args.offset + args.limit);
+        return withApiMetadata(api, {
+            program_id: args.program_id,
+            targets: formatTargetList(targets, args.output_mode),
+            meta: {
+                offset: args.offset,
+                limit: args.limit,
+                output_mode: args.output_mode,
+                total_active_targets: rawTargets.length,
+                total_after_filters: sanitizedTargets.length,
+                returned: targets.length,
+                has_more: args.offset + args.limit < sanitizedTargets.length
+            }
+        });
+    }));
+    server.registerTool("get_recent_changes", {
+        title: "Get Recent Target Changes",
+        description: `List recent target changes. page_size max ${MAX_RECENT_CHANGES}.`,
+        inputSchema: {
+            change_type: z.enum(["added", "updated", "removed"]).optional(),
+            include_removed: z.boolean().default(false),
+            include_ineligible: z.boolean().default(false),
+            include_out_of_scope: z.boolean().default(false),
+            search: searchTextSchema.optional(),
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            page: pageSchema,
+            page_size: recentChangesPageSizeSchema,
+            output_mode: changeListModeSchema.default("compact")
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape,
+            changes: z.array(jsonRecordSchema).optional(),
+            meta: jsonRecordSchema.optional(),
+            facets: jsonRecordSchema.optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("get_recent_changes", config, rateLimiter, async () => {
+        const { output_mode, ...filters } = args;
+        const api = await client.getRecentChanges(toQuery(filters));
+        const data = readObject(api.data);
+        const sanitizedMeta = readObject(sanitizeJson(data?.meta));
+        const changes = readArray(data?.results)
+            .map((change) => sanitizeChange(change, config.webBaseUrl))
+            .map((change) => formatChange(change, output_mode));
+        return withApiMetadata(api, {
+            changes,
+            meta: stripUndefined({
+                ...(sanitizedMeta ?? {}),
+                output_mode
+            }),
+            facets: sanitizeJson(data?.facets)
+        });
+    }));
+    server.registerTool("get_latest_added_targets", {
+        title: "Get Latest Added Targets",
+        description: "Latest added targets by type, optionally with that program's target list.",
+        inputSchema: {
+            target_type: filterValueSchema.default("domain"),
+            include_out_of_scope: z.boolean().default(false).describe("Include out-of-scope."),
+            include_ineligible: z.boolean().default(false).describe("Include ineligible."),
+            recent_changes_page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
+            include_full_target_list: z.boolean().default(true),
+            full_target_list_mode: targetListModeSchema.default("identifiers"),
+            full_target_limit: z.number().int().min(1).max(MAX_TARGETS_PER_PROGRAM).default(MAX_TARGETS_PER_PROGRAM),
+            full_list_include_out_of_scope: z.boolean().default(true),
+            full_list_include_ineligible: z.boolean().default(true)
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape,
+            source_requests: z.array(jsonRecordSchema).optional(),
+            query: jsonRecordSchema.optional(),
+            latest_added_at: z.string().optional(),
+            program: programOutputSchema.optional(),
+            new_targets: z.array(z.unknown()).optional(),
+            full_targets: z.array(z.unknown()).optional(),
+            meta: jsonRecordSchema.optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("get_latest_added_targets", config, rateLimiter, async () => getLatestAddedTargets(client, config, args)));
+    server.registerTool("get_program_scope_summary", {
+        title: "Get Program Scope Summary",
+        description: "Grouped compact scope for one program.",
+        inputSchema: {
+            program_id: programIdSchema,
+            target_list_mode: targetListModeSchema.default("identifiers"),
+            group_limit: z.number().int().min(1).max(MAX_TARGETS_PER_PROGRAM).default(MAX_TARGETS_PER_PROGRAM),
+            include_out_of_scope: z.boolean().default(true),
+            include_ineligible: z.boolean().default(true)
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape,
+            source_requests: z.array(jsonRecordSchema).optional(),
+            program: programOutputSchema.optional(),
+            scope: jsonRecordSchema.optional(),
+            meta: jsonRecordSchema.optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("get_program_scope_summary", config, rateLimiter, async () => getProgramScopeSummary(client, config, args)));
+    server.registerTool("get_program_target_breakdown", {
+        title: "Get Program Target Breakdown",
+        description: "Target type, scope tag, language tag, and bucket counts for one program.",
+        inputSchema: {
+            program_id: programIdSchema,
+            target_list_mode: targetListModeSchema.default("identifiers"),
+            group_limit: z.number().int().min(1).max(MAX_TARGETS_PER_PROGRAM).default(100),
+            include_out_of_scope: z.boolean().default(true),
+            include_ineligible: z.boolean().default(true)
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape,
+            source_requests: z.array(jsonRecordSchema).optional(),
+            program: programOutputSchema.optional(),
+            breakdown: jsonRecordSchema.optional(),
+            meta: jsonRecordSchema.optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("get_program_target_breakdown", config, rateLimiter, async () => getProgramTargetBreakdown(client, config, args)));
+    server.registerTool("get_program_scope_delta", {
+        title: "Get Program Scope Delta",
+        description: "Compact recent scope changes for one program.",
+        inputSchema: {
+            program_id: programIdSchema,
+            since: isoDateTimeSchema.optional(),
+            change_type: z.enum(["added", "updated", "removed"]).optional(),
+            target_type: filterValueSchema.optional(),
+            language_tags: stringListSchema,
+            include_removed: z.boolean().default(true),
+            include_out_of_scope: z.boolean().default(false),
+            include_ineligible: z.boolean().default(false),
+            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
+            max_targets: z.number().int().min(1).max(MAX_RECENT_CHANGES).default(50),
+            target_list_mode: targetListModeSchema.default("identifiers")
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape,
+            source_requests: z.array(jsonRecordSchema).optional(),
+            program: programOutputSchema.optional(),
+            delta: jsonRecordSchema.optional(),
+            changes: z.array(jsonRecordSchema).optional(),
+            meta: jsonRecordSchema.optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("get_program_scope_delta", config, rateLimiter, async () => getProgramScopeDelta(client, config, args)));
+    server.registerTool("get_recent_target_activity", {
+        title: "Get Recent Target Activity",
+        description: "Recent target changes grouped by program.",
+        inputSchema: {
+            change_type: z.enum(["added", "updated", "removed"]).optional(),
+            target_type: filterValueSchema.optional(),
+            include_removed: z.boolean().default(true),
+            include_out_of_scope: z.boolean().default(false),
+            include_ineligible: z.boolean().default(false),
+            search: searchTextSchema.optional(),
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            language_tags: stringListSchema,
+            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
+            max_programs: z.number().int().min(1).max(50).default(10),
+            sample_size: z.number().int().min(1).max(20).default(5),
+            target_list_mode: targetListModeSchema.default("identifiers")
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape,
+            source_requests: z.array(jsonRecordSchema).optional(),
+            activity: z.array(jsonRecordSchema).optional(),
+            meta: jsonRecordSchema.optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("get_recent_target_activity", config, rateLimiter, async () => getRecentTargetActivity(client, config, args)));
+    server.registerTool("check_program_new_targets", {
+        title: "Check Program New Targets",
+        description: "Yes/no new in-scope targets for one program.",
+        inputSchema: {
+            program_id: programIdSchema,
+            since: isoDateTimeSchema.optional().describe("ISO datetime."),
+            target_type: filterValueSchema.optional(),
+            include_ineligible: z.boolean().default(false).describe("Include ineligible."),
+            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
+            max_targets: z.number().int().min(1).max(MAX_RECENT_CHANGES).default(25),
+            target_list_mode: targetListModeSchema.default("identifiers")
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape,
+            source_requests: z.array(jsonRecordSchema).optional(),
+            program_id: z.string().optional(),
+            program: programOutputSchema.optional(),
+            has_new_targets: z.boolean().optional(),
+            new_target_count: z.number().int().min(0).optional(),
+            latest_added_at: z.string().optional(),
+            new_targets: z.array(z.unknown()).optional(),
+            meta: jsonRecordSchema.optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("check_program_new_targets", config, rateLimiter, async () => checkProgramNewTargets(client, config, args)));
+    server.registerTool("check_watchlist_new_targets", {
+        title: "Check Watchlist New Targets",
+        description: "New in-scope targets across many known program_ids.",
+        inputSchema: {
+            program_ids: z.array(programIdSchema).min(1).max(50),
+            since: isoDateTimeSchema.optional(),
+            target_type: filterValueSchema.optional(),
+            include_ineligible: z.boolean().default(false),
+            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
+            max_targets_per_program: z.number().int().min(1).max(50).default(10),
+            target_list_mode: targetListModeSchema.default("identifiers")
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape,
+            source_requests: z.array(jsonRecordSchema).optional(),
+            programs: z.array(jsonRecordSchema).optional(),
+            any_new_targets: z.boolean().optional(),
+            meta: jsonRecordSchema.optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("check_watchlist_new_targets", config, rateLimiter, async () => checkWatchlistNewTargets(client, config, args)));
+    server.registerTool("get_opportunities", {
+        title: "Get BBRadar Opportunities",
+        description: `List programs in one opportunity tier. page_size max ${MAX_PROGRAMS_PER_SEARCH}.`,
+        inputSchema: {
+            level: opportunityLevelSchema.default("elite"),
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            updated_since: isoDateTimeSchema.optional(),
+            page: pageSchema,
+            page_size: programsPageSizeSchema
+        },
+        outputSchema: {
+            ...programListOutputShape,
+            level: opportunityLevelSchema.optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("get_opportunities", config, rateLimiter, async () => {
+        const { level, ...filters } = args;
+        const api = await client.getOpportunities(level, toQuery(filters));
+        const data = readObject(api.data);
+        const programs = readArray(data?.programs).map((program) => addProgramResourceLinks(sanitizeProgram(program, config.webBaseUrl)));
+        return withApiMetadata(api, {
+            level,
+            programs,
+            meta: sanitizeJson(data?.meta)
+        });
+    }));
+    server.registerTool("find_programs", {
+        title: "Find BBRadar Programs",
+        description: "Ranked program discovery with filters and compact output.",
+        inputSchema: {
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            scope_tags: stringListSchema.describe("Scope tags."),
+            target_types: stringListSchema.describe("Target-type tags."),
+            language_tags: stringListSchema.describe("Language tags."),
+            web3: z.boolean().default(false).describe("Require Web3 signals."),
+            opportunity_levels: z.array(opportunityLevelSchema).max(4).default([]),
+            updated_since: isoDateTimeSchema.optional(),
+            min_bounty_min: z.number().int().min(0).optional(),
+            min_bounty_max: z.number().int().min(0).optional(),
+            max_bounty_max: z.number().int().min(0).optional(),
+            require_bounty: z.boolean().default(false),
+            max_public_report_count: z.number().int().min(0).optional(),
+            require_known_report_count: z.boolean().default(false),
+            include_unknown_report_count: z.boolean().default(false),
+            exclude_ctf: z.boolean().default(false),
+            exclude_mobile_only: z.boolean().default(false),
+            exclude_non_web: z.boolean().default(false),
+            has_api_scope: z.boolean().default(false),
+            contest_like: z.boolean().default(false).describe("Require contest/audit signals."),
+            vdp_mode: vdpModeSchema.default("include").describe("VDP/no-bounty filter mode."),
+            fresh_launch_days: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).optional(),
+            min_wildcards: z.number().int().min(0).max(1000).default(0),
+            min_eligible_targets: z.number().int().min(0).optional(),
+            min_total_targets: z.number().int().min(0).optional(),
+            min_added_24h: z.number().int().min(0).optional(),
+            min_added_7d: z.number().int().min(0).optional(),
+            max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
+            sort_by: programSortSchema,
+            include_target_samples: z.boolean().default(false),
+            target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(5),
+            only_in_scope_targets: z.boolean().default(true),
+            only_bounty_eligible_targets: z.boolean().default(true),
+            output_mode: programListModeSchema.default("compact"),
+            upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
+        },
+        outputSchema: findProgramsOutputShape,
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("find_programs", config, rateLimiter, async () => findPrograms(client, config, {
+        ...args,
+        target_samples_only_wildcards: args.min_wildcards > 0
+    })));
+    server.registerTool("find_wildcard_programs", {
+        title: "Find Wildcard Programs",
+        description: "Wildcard program shortlist.",
+        inputSchema: {
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            updated_since: isoDateTimeSchema.optional(),
+            max_public_report_count: z.number().int().min(0).default(25),
+            require_known_report_count: z.boolean().default(true),
+            include_unknown_report_count: z.boolean().default(false),
+            exclude_ctf: z.boolean().default(true),
+            require_bounty: z.boolean().default(true),
+            min_wildcards: z.number().int().min(1).max(100).default(1),
+            max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
+            include_target_samples: z.boolean().default(false),
+            target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(5),
+            upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
+        },
+        outputSchema: findProgramsOutputShape,
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("find_wildcard_programs", config, rateLimiter, async () => findPrograms(client, config, {
+        platforms: args.platforms,
+        tags: args.tags,
+        scope_tags: [],
+        target_types: [],
+        language_tags: [],
+        web3: false,
+        opportunity_levels: [],
+        updated_since: args.updated_since,
+        min_bounty_min: undefined,
+        min_bounty_max: undefined,
+        max_bounty_max: undefined,
+        require_bounty: args.require_bounty,
+        max_public_report_count: args.max_public_report_count,
+        require_known_report_count: args.require_known_report_count,
+        include_unknown_report_count: args.include_unknown_report_count,
+        exclude_ctf: args.exclude_ctf,
+        exclude_mobile_only: false,
+        exclude_non_web: false,
+        has_api_scope: false,
+        contest_like: false,
+        fresh_launch_days: undefined,
+        min_wildcards: args.min_wildcards,
+        min_eligible_targets: undefined,
+        min_total_targets: undefined,
+        min_added_24h: undefined,
+        min_added_7d: undefined,
+        max_pages: args.max_pages,
+        max_results: args.max_results,
+        sort_by: "best_hunt_value",
+        include_target_samples: args.include_target_samples,
+        target_sample_programs: args.target_sample_programs,
+        target_sample_size: args.target_sample_size,
+        only_in_scope_targets: true,
+        only_bounty_eligible_targets: true,
+        target_samples_only_wildcards: true,
+        upstream_request_budget: args.upstream_request_budget
+    })));
+    server.registerTool("find_web3_programs", {
+        title: "Find Web3 Programs",
+        description: "Web3/blockchain/smart-contract program shortlist.",
+        inputSchema: {
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            updated_since: isoDateTimeSchema.optional(),
+            max_public_report_count: z.number().int().min(0).optional(),
+            require_known_report_count: z.boolean().default(false),
+            include_unknown_report_count: z.boolean().default(true),
+            require_bounty: z.boolean().default(false),
+            min_bounty_max: z.number().int().min(0).optional(),
+            min_wildcards: z.number().int().min(0).max(1000).default(0),
+            exclude_ctf: z.boolean().default(true),
+            max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(5),
+            max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
+            include_target_samples: z.boolean().default(false),
+            target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(5),
+            upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
+        },
+        outputSchema: findProgramsOutputShape,
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("find_web3_programs", config, rateLimiter, async () => findPrograms(client, config, {
+        platforms: args.platforms,
+        tags: args.tags,
+        scope_tags: [],
+        target_types: [],
+        language_tags: [],
+        web3: true,
+        opportunity_levels: [],
+        updated_since: args.updated_since,
+        min_bounty_min: undefined,
+        min_bounty_max: args.min_bounty_max,
+        max_bounty_max: undefined,
+        require_bounty: args.require_bounty,
+        max_public_report_count: args.max_public_report_count,
+        require_known_report_count: args.require_known_report_count,
+        include_unknown_report_count: args.include_unknown_report_count,
+        exclude_ctf: args.exclude_ctf,
+        exclude_mobile_only: false,
+        exclude_non_web: false,
+        has_api_scope: false,
+        contest_like: false,
+        fresh_launch_days: undefined,
+        min_wildcards: args.min_wildcards,
+        min_eligible_targets: undefined,
+        min_total_targets: undefined,
+        min_added_24h: undefined,
+        min_added_7d: undefined,
+        max_pages: args.max_pages,
+        max_results: args.max_results,
+        sort_by: "best_hunt_value",
+        include_target_samples: args.include_target_samples,
+        target_sample_programs: args.target_sample_programs,
+        target_sample_size: args.target_sample_size,
+        only_in_scope_targets: true,
+        only_bounty_eligible_targets: true,
+        target_samples_only_wildcards: args.min_wildcards > 0,
+        upstream_request_budget: args.upstream_request_budget
+    })));
+    server.registerTool("find_reward_programs", {
+        title: "Find Reward Programs",
+        description: "Programs matching reward thresholds.",
+        inputSchema: {
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            target_types: stringListSchema,
+            language_tags: stringListSchema,
+            min_reward: z.number().int().min(0).default(5_000),
+            reward_threshold_mode: rewardThresholdModeSchema.default("max_at_least"),
+            web3: z.boolean().default(false),
+            max_public_report_count: z.number().int().min(0).optional(),
+            require_known_report_count: z.boolean().default(false),
+            include_unknown_report_count: z.boolean().default(true),
+            min_eligible_targets: z.number().int().min(0).default(1),
+            exclude_ctf: z.boolean().default(true),
+            exclude_mobile_only: z.boolean().default(false),
+            exclude_non_web: z.boolean().default(false),
+            max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
+            include_target_samples: z.boolean().default(false),
+            target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            output_mode: programListModeSchema.default("compact"),
+            upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
+        },
+        outputSchema: findProgramsOutputShape,
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("find_reward_programs", config, rateLimiter, async () => findRewardPrograms(client, config, args)));
+    server.registerTool("find_web3_contests", {
+        title: "Find Web3 Contests",
+        description: "Web3 contest or competitive audit shortlist.",
+        inputSchema: {
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            min_reward: z.number().int().min(0).optional(),
+            reward_threshold_mode: rewardThresholdModeSchema.default("max_at_least"),
+            require_contest_signal: z.boolean().default(true),
+            require_bounty: z.boolean().default(false),
+            max_public_report_count: z.number().int().min(0).optional(),
+            include_unknown_report_count: z.boolean().default(true),
+            max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(5),
+            max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
+            include_target_samples: z.boolean().default(false),
+            target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            output_mode: programListModeSchema.default("compact"),
+            upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(30)
+        },
+        outputSchema: findProgramsOutputShape,
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("find_web3_contests", config, rateLimiter, async () => findWeb3Contests(client, config, args)));
+    server.registerTool("find_language_programs", {
+        title: "Find Language Programs",
+        description: "Language-specific program shortlist.",
+        inputSchema: {
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            language_tags: z.array(filterValueSchema).min(1).max(50),
+            target_types: stringListSchema,
+            min_reward: z.number().int().min(0).optional(),
+            reward_threshold_mode: rewardThresholdModeSchema.default("max_at_least"),
+            require_bounty: z.boolean().default(false),
+            exclude_vdp: z.boolean().default(false),
+            max_public_report_count: z.number().int().min(0).optional(),
+            require_known_report_count: z.boolean().default(false),
+            include_unknown_report_count: z.boolean().default(true),
+            min_eligible_targets: z.number().int().min(0).optional(),
+            max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
+            include_target_samples: z.boolean().default(false),
+            target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(5),
+            target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            output_mode: programListModeSchema.default("compact"),
+            upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
+        },
+        outputSchema: findProgramsOutputShape,
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("find_language_programs", config, rateLimiter, async () => findLanguagePrograms(client, config, args)));
+    server.registerTool("find_target_type_programs", {
+        title: "Find Target Type Programs",
+        description: "Target-type program shortlist.",
+        inputSchema: {
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            target_types: z.array(filterValueSchema).min(1).max(50),
+            scope_tags: stringListSchema,
+            language_tags: stringListSchema,
+            min_reward: z.number().int().min(0).optional(),
+            reward_threshold_mode: rewardThresholdModeSchema.default("max_at_least"),
+            require_bounty: z.boolean().default(false),
+            fresh_only: z.boolean().default(false),
+            min_added_7d: z.number().int().min(0).optional(),
+            exclude_vdp: z.boolean().default(false),
+            max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
+            include_target_samples: z.boolean().default(false),
+            target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(5),
+            target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            output_mode: programListModeSchema.default("compact"),
+            upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
+        },
+        outputSchema: findProgramsOutputShape,
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("find_target_type_programs", config, rateLimiter, async () => findTargetTypePrograms(client, config, args)));
+    server.registerTool("find_vdp_programs", {
+        title: "Find VDP Programs",
+        description: "VDP/disclosure-only/no-bounty program shortlist.",
+        inputSchema: {
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            target_types: stringListSchema,
+            language_tags: stringListSchema,
+            vdp_mode: z.enum(["only_likely", "only_known_no_bounty"]).default("only_likely"),
+            max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
+            include_target_samples: z.boolean().default(false),
+            target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            output_mode: programListModeSchema.default("compact"),
+            upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
+        },
+        outputSchema: findProgramsOutputShape,
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("find_vdp_programs", config, rateLimiter, async () => findVdpPrograms(client, config, args)));
+    server.registerTool("find_paid_programs", {
+        title: "Find Paid Programs",
+        description: "Paid bounty program shortlist.",
+        inputSchema: {
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            target_types: stringListSchema,
+            language_tags: stringListSchema,
+            min_reward: z.number().int().min(0).optional(),
+            reward_threshold_mode: rewardThresholdModeSchema.default("max_at_least"),
+            min_eligible_targets: z.number().int().min(0).default(1),
+            max_public_report_count: z.number().int().min(0).optional(),
+            max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
+            include_target_samples: z.boolean().default(false),
+            target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            output_mode: programListModeSchema.default("compact"),
+            upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
+        },
+        outputSchema: findProgramsOutputShape,
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("find_paid_programs", config, rateLimiter, async () => findPaidPrograms(client, config, args)));
+    server.registerTool("find_stack_matches", {
+        title: "Find Stack Matches",
+        description: "Combined stack/language/type/reward shortlist.",
+        inputSchema: {
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            language_tags: stringListSchema,
+            target_types: stringListSchema,
+            scope_tags: stringListSchema,
+            min_reward: z.number().int().min(0).optional(),
+            reward_threshold_mode: rewardThresholdModeSchema.default("max_at_least"),
+            web3: z.boolean().default(false),
+            contest_like: z.boolean().default(false),
+            require_bounty: z.boolean().default(false),
+            exclude_vdp: z.boolean().default(false),
+            max_public_report_count: z.number().int().min(0).optional(),
+            min_eligible_targets: z.number().int().min(0).optional(),
+            fresh_only: z.boolean().default(false),
+            min_added_7d: z.number().int().min(0).optional(),
+            max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
+            include_target_samples: z.boolean().default(false),
+            target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(5),
+            target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            output_mode: programListModeSchema.default("compact"),
+            upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(30)
+        },
+        outputSchema: findProgramsOutputShape,
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("find_stack_matches", config, rateLimiter, async () => findStackMatches(client, config, args)));
+    server.registerTool("find_low_noise_programs", {
+        title: "Find Low Noise Programs",
+        description: "Low-public-report program shortlist.",
+        inputSchema: {
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            target_types: stringListSchema,
+            language_tags: stringListSchema,
+            min_reward: z.number().int().min(0).optional(),
+            reward_threshold_mode: rewardThresholdModeSchema.default("max_at_least"),
+            max_public_report_count: z.number().int().min(0).default(5),
+            require_known_report_count: z.boolean().default(true),
+            include_unknown_report_count: z.boolean().default(false),
+            require_bounty: z.boolean().default(true),
+            min_eligible_targets: z.number().int().min(0).default(1),
+            max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
+            include_target_samples: z.boolean().default(false),
+            target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            output_mode: programListModeSchema.default("compact"),
+            upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
+        },
+        outputSchema: findProgramsOutputShape,
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("find_low_noise_programs", config, rateLimiter, async () => findLowNoisePrograms(client, config, args)));
+    server.registerTool("find_recent_by_type", {
+        title: "Find Recent By Type",
+        description: "Recent changes by target type grouped by program.",
+        inputSchema: {
+            target_type: filterValueSchema,
+            change_type: z.enum(["added", "updated", "removed"]).default("added"),
+            include_removed: z.boolean().default(false),
+            include_out_of_scope: z.boolean().default(false),
+            include_ineligible: z.boolean().default(false),
+            search: searchTextSchema.optional(),
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            language_tags: stringListSchema,
+            page_size: recentChangesPageSizeSchema.default(MAX_RECENT_CHANGES),
+            max_programs: z.number().int().min(1).max(50).default(10),
+            sample_size: z.number().int().min(1).max(20).default(5),
+            target_list_mode: targetListModeSchema.default("identifiers")
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape,
+            source_requests: z.array(jsonRecordSchema).optional(),
+            activity: z.array(jsonRecordSchema).optional(),
+            meta: jsonRecordSchema.optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("find_recent_by_type", config, rateLimiter, async () => findRecentByType(client, config, args)));
+    server.registerTool("find_programs_by_target", {
+        title: "Find Programs By Target",
+        description: "Reverse lookup target/domain ownership.",
+        inputSchema: {
+            target_query: searchTextSchema,
+            match_mode: targetMatchModeSchema.default("contains"),
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            use_api_search: z.boolean().default(true),
+            max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(2),
+            max_results: z.number().int().min(1).max(25).default(10),
+            include_out_of_scope: z.boolean().default(true),
+            include_ineligible: z.boolean().default(true),
+            max_targets_per_program: z.number().int().min(1).max(50).default(10),
+            target_list_mode: targetListModeSchema.default("identifiers"),
+            upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(30)
+        },
+        outputSchema: {
+            ...findProgramsOutputShape,
+            matches: z.array(jsonRecordSchema).optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("find_programs_by_target", config, rateLimiter, async () => findProgramsByTarget(client, config, args)));
+    server.registerTool("find_program_candidates", {
+        title: "Find BBRadar Program Candidates",
+        description: "Default ranked BBRadar discovery preset.",
+        inputSchema: programCandidatePresetInputSchema,
+        outputSchema: findProgramsOutputShape,
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("find_program_candidates", config, rateLimiter, async () => findProgramCandidates(client, config, args)));
+    server.registerTool("find_hunt_candidates", {
+        title: "Find BBRadar Hunt Candidates",
+        description: "Legacy alias for find_program_candidates.",
+        inputSchema: programCandidatePresetInputSchema,
+        outputSchema: findProgramsOutputShape,
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("find_hunt_candidates", config, rateLimiter, async () => findProgramCandidates(client, config, args)));
+    server.registerTool("find_fresh_hunt_candidates", {
+        title: "Find Fresh Hunt Candidates",
+        description: "Freshness-first hunt shortlist.",
+        inputSchema: {
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            target_types: z.array(filterValueSchema).max(50).default(["domain"]),
+            language_tags: stringListSchema,
+            opportunity_levels: z.array(opportunityLevelSchema).max(4).default(["elite", "hot", "strong", "potential"]),
+            min_added_7d: z.number().int().min(0).default(1),
+            max_public_report_count: z.number().int().min(0).default(25),
+            require_known_report_count: z.boolean().default(false),
+            include_unknown_report_count: z.boolean().default(false),
+            require_bounty: z.boolean().default(true),
+            min_bounty_max: z.number().int().min(0).optional(),
+            min_eligible_targets: z.number().int().min(0).default(1),
+            has_api_scope: z.boolean().default(false),
+            wildcard: z.boolean().default(false),
+            exclude_ctf: z.boolean().default(true),
+            exclude_mobile_only: z.boolean().default(false),
+            exclude_non_web: z.boolean().default(false),
+            max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
+            include_target_samples: z.boolean().default(true),
+            target_sample_programs: z.number().int().min(0).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(5),
+            target_sample_size: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            output_mode: programListModeSchema.default("compact"),
+            upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(30)
+        },
+        outputSchema: findProgramsOutputShape,
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("find_fresh_hunt_candidates", config, rateLimiter, async () => findPrograms(client, config, {
+        platforms: args.platforms,
+        tags: args.tags,
+        scope_tags: [],
+        target_types: args.target_types,
+        language_tags: args.language_tags,
+        web3: false,
+        opportunity_levels: args.opportunity_levels,
+        updated_since: undefined,
+        min_bounty_min: undefined,
+        min_bounty_max: args.min_bounty_max,
+        max_bounty_max: undefined,
+        require_bounty: args.require_bounty,
+        max_public_report_count: args.max_public_report_count,
+        require_known_report_count: args.require_known_report_count,
+        include_unknown_report_count: args.include_unknown_report_count,
+        exclude_ctf: args.exclude_ctf,
+        exclude_mobile_only: args.exclude_mobile_only,
+        exclude_non_web: args.exclude_non_web,
+        has_api_scope: args.has_api_scope,
+        fresh_launch_days: undefined,
+        min_wildcards: args.wildcard ? 1 : 0,
+        min_eligible_targets: args.min_eligible_targets,
+        min_total_targets: undefined,
+        min_added_24h: undefined,
+        min_added_7d: args.min_added_7d,
+        max_pages: args.max_pages,
+        max_results: args.max_results,
+        sort_by: "most_new_targets",
+        include_target_samples: args.include_target_samples,
+        target_sample_programs: args.target_sample_programs,
+        target_sample_size: args.target_sample_size,
+        only_in_scope_targets: true,
+        only_bounty_eligible_targets: true,
+        target_samples_only_wildcards: args.wildcard,
+        output_mode: args.output_mode,
+        upstream_request_budget: args.upstream_request_budget
+    })));
+    server.registerTool("list_filters", {
+        title: "List BBRadar Filters",
+        description: "Discover observed filter values.",
+        inputSchema: {
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            max_pages: z.number().int().min(1).max(MAX_FILTER_DISCOVERY_PAGES).default(DEFAULT_FILTER_DISCOVERY_PAGES),
+            include_target_facets: z.boolean().default(true),
+            target_sample_programs: z.number().int().min(0).max(MAX_FILTER_TARGET_SAMPLE_PROGRAMS).default(DEFAULT_FILTER_TARGET_SAMPLE_PROGRAMS),
+            upstream_request_budget: z.number().int().min(1).max(MAX_FIND_UPSTREAM_REQUEST_BUDGET).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape,
+            filters: jsonRecordSchema.optional(),
+            observed_from: jsonRecordSchema.optional(),
+            upstream_budget: jsonRecordSchema.optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("list_filters", config, rateLimiter, async () => listFilters(client, args)));
+    server.registerTool("get_mcp_status", {
+        title: "Get BBRadar MCP Status",
+        description: "Local MCP status and timing metrics.",
+        inputSchema: {},
+        outputSchema: {
+            ...apiEnvelopeOutputShape,
+            status: jsonRecordSchema.optional()
+        },
+        annotations: readOnlyAnnotations
+    }, () => runTool("get_mcp_status", config, rateLimiter, async () => ({
+        request_id: randomUUID(),
+        status: {
+            server_name: "bbradar.io",
+            server_version: SERVER_VERSION,
+            sdk_version: SDK_VERSION,
+            api_base_url: config.apiBaseUrl,
+            web_base_url: config.webBaseUrl,
+            response_cache_enabled: config.cacheTtlMs > 0 && config.cacheMaxEntries > 0,
+            cache_ttl_ms: config.cacheTtlMs,
+            cache_max_entries: config.cacheMaxEntries,
+            local_program_index_enabled: false,
+            default_rate_limit_per_minute: config.defaultRateLimitPerMinute,
+            export_rate_limit_per_minute: config.exportRateLimitPerMinute,
+            request_timeout_ms: config.requestTimeoutMs,
+            validate_on_startup: config.validateOnStartup,
+            transport: "stdio",
+            remote_streamable_http: "not_enabled_for_local_setup",
+            tool_metrics: toolMetricsSnapshot(),
+            client: client.diagnostics()
+        }
+    })));
+    server.registerTool("compare_programs", {
+        title: "Compare BBRadar Programs",
+        description: "Compare programs.",
+        inputSchema: {
+            program_ids: z.array(programIdSchema).min(2).max(10),
+            include_target_samples: z.boolean().default(false),
+            target_sample_size: z.number().int().min(1).max(MAX_FIND_TARGET_SAMPLES).default(5),
+            only_in_scope_targets: z.boolean().default(true),
+            only_bounty_eligible_targets: z.boolean().default(true),
+            output_mode: programListModeSchema.default("compact")
+        },
+        outputSchema: decisionOutputShape,
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("compare_programs", config, rateLimiter, async () => comparePrograms(client, config, args)));
+    server.registerTool("compare_programs_compact", {
+        title: "Compare Programs Compact",
+        description: "Compact program comparison.",
+        inputSchema: {
+            program_ids: z.array(programIdSchema).min(2).max(10),
+            include_target_samples: z.boolean().default(false),
+            target_sample_size: z.number().int().min(1).max(5).default(3),
+            only_in_scope_targets: z.boolean().default(true),
+            only_bounty_eligible_targets: z.boolean().default(true)
+        },
+        outputSchema: decisionOutputShape,
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("compare_programs_compact", config, rateLimiter, async () => comparePrograms(client, config, { ...args, output_mode: "compact" })));
+    server.registerTool("summarize_program_activity", {
+        title: "Summarize Program Activity",
+        description: "Summarize one program's activity.",
+        inputSchema: {
+            program_id: programIdSchema,
+            recent_changes_limit: z.number().int().min(0).max(MAX_RECENT_CHANGES).default(25)
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape,
+            program: programOutputSchema.optional(),
+            activity: jsonRecordSchema.optional(),
+            changes: z.array(jsonRecordSchema).optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("summarize_program_activity", config, rateLimiter, async () => summarizeProgramActivity(client, config, args.program_id, args.recent_changes_limit)));
+    server.registerTool("get_program_brief", {
+        title: "Get Program Brief",
+        description: "Compact worth-hunting brief for one program.",
+        inputSchema: {
+            program_id: programIdSchema,
+            target_sample_size: z.number().int().min(1).max(50).default(10),
+            target_list_mode: targetListModeSchema.default("compact"),
+            include_recent_changes: z.boolean().default(true),
+            recent_changes_limit: z.number().int().min(0).max(MAX_RECENT_CHANGES).default(10),
+            include_out_of_scope: z.boolean().default(false),
+            include_ineligible: z.boolean().default(false)
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape,
+            source_requests: z.array(jsonRecordSchema).optional(),
+            program: programOutputSchema.optional(),
+            brief: jsonRecordSchema.optional(),
+            target_samples: jsonRecordSchema.optional(),
+            recent_changes: z.array(jsonRecordSchema).optional(),
+            meta: jsonRecordSchema.optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("get_program_brief", config, rateLimiter, async () => getProgramBrief(client, config, args)));
+    server.registerTool("find_recently_added_wildcards", {
+        title: "Find Recently Added Wildcards",
+        description: "Recently added wildcard programs.",
+        inputSchema: {
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            min_added_7d: z.number().int().min(1).default(1),
+            max_public_report_count: z.number().int().min(0).optional(),
+            require_bounty: z.boolean().default(true),
+            max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
+            upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
+        },
+        outputSchema: findProgramsOutputShape,
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("find_recently_added_wildcards", config, rateLimiter, async () => findPrograms(client, config, {
+        platforms: args.platforms,
+        tags: args.tags,
+        scope_tags: [],
+        target_types: [],
+        language_tags: [],
+        web3: false,
+        opportunity_levels: [],
+        updated_since: undefined,
+        min_bounty_min: undefined,
+        min_bounty_max: undefined,
+        max_bounty_max: undefined,
+        require_bounty: args.require_bounty,
+        max_public_report_count: args.max_public_report_count,
+        require_known_report_count: false,
+        include_unknown_report_count: false,
+        exclude_ctf: true,
+        exclude_mobile_only: false,
+        exclude_non_web: false,
+        has_api_scope: false,
+        fresh_launch_days: undefined,
+        min_wildcards: 1,
+        min_eligible_targets: undefined,
+        min_total_targets: undefined,
+        min_added_24h: undefined,
+        min_added_7d: args.min_added_7d,
+        max_pages: args.max_pages,
+        max_results: args.max_results,
+        sort_by: "best_hunt_value",
+        include_target_samples: true,
+        target_sample_programs: Math.min(args.max_results, MAX_FIND_TARGET_SAMPLE_PROGRAMS),
+        target_sample_size: 5,
+        only_in_scope_targets: true,
+        only_bounty_eligible_targets: true,
+        target_samples_only_wildcards: true,
+        upstream_request_budget: args.upstream_request_budget
+    })));
+    server.registerTool("find_low_competition_high_reward", {
+        title: "Find Low Competition High Reward",
+        description: "Legacy low-report high-reward shortlist.",
+        inputSchema: {
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            target_types: stringListSchema,
+            language_tags: stringListSchema,
+            max_public_report_count: z.number().int().min(0).default(10),
+            min_bounty_max: z.number().int().min(0).default(5_000),
+            min_eligible_targets: z.number().int().min(0).default(1),
+            exclude_ctf: z.boolean().default(true),
+            exclude_mobile_only: z.boolean().default(false),
+            exclude_non_web: z.boolean().default(false),
+            has_api_scope: z.boolean().default(false),
+            fresh_launch_days: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).optional(),
+            max_pages: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(3),
+            max_results: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(10),
+            upstream_request_budget: z.number().int().min(1).max(MAX_ACCEPTED_NUMERIC_LIMIT).default(DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
+        },
+        outputSchema: findProgramsOutputShape,
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("find_low_competition_high_reward", config, rateLimiter, async () => findPrograms(client, config, {
+        platforms: args.platforms,
+        tags: args.tags,
+        scope_tags: [],
+        target_types: args.target_types,
+        language_tags: args.language_tags,
+        web3: false,
+        opportunity_levels: [],
+        updated_since: undefined,
+        min_bounty_min: undefined,
+        min_bounty_max: args.min_bounty_max,
+        max_bounty_max: undefined,
+        require_bounty: true,
+        max_public_report_count: args.max_public_report_count,
+        require_known_report_count: true,
+        include_unknown_report_count: false,
+        exclude_ctf: args.exclude_ctf,
+        exclude_mobile_only: args.exclude_mobile_only,
+        exclude_non_web: args.exclude_non_web,
+        has_api_scope: args.has_api_scope,
+        fresh_launch_days: args.fresh_launch_days,
+        min_wildcards: 0,
+        min_eligible_targets: args.min_eligible_targets,
+        min_total_targets: undefined,
+        min_added_24h: undefined,
+        min_added_7d: undefined,
+        max_pages: args.max_pages,
+        max_results: args.max_results,
+        sort_by: "best_hunt_value",
+        include_target_samples: true,
+        target_sample_programs: Math.min(args.max_results, MAX_FIND_TARGET_SAMPLE_PROGRAMS),
+        target_sample_size: 5,
+        only_in_scope_targets: true,
+        only_bounty_eligible_targets: true,
+        target_samples_only_wildcards: false,
+        upstream_request_budget: args.upstream_request_budget
+    })));
+    server.registerTool("get_program_delta", {
+        title: "Get Program Delta",
+        description: "Recent target changes for one program.",
+        inputSchema: {
+            program_id: programIdSchema,
+            include_removed: z.boolean().default(true),
+            include_ineligible: z.boolean().default(false),
+            include_out_of_scope: z.boolean().default(false),
+            page_size: recentChangesPageSizeSchema.default(50)
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape,
+            program: programOutputSchema.optional(),
+            changes: z.array(jsonRecordSchema).optional(),
+            meta: jsonRecordSchema.optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("get_program_delta", config, rateLimiter, async () => getProgramDelta(client, config, args)));
+    server.registerTool("export_targets", {
+        title: "Export BBRadar Targets",
+        description: `Read-only target export. limit max ${MAX_TARGET_EXPORT}.`,
+        inputSchema: {
+            program_ids: z.array(programIdSchema).max(50).default([]),
+            platforms: stringListSchema,
+            tags: stringListSchema,
+            opportunity_levels: z.array(z.enum(["elite", "hot", "strong", "potential"])).max(4).default([]),
+            include_out_of_scope: z.boolean().default(false),
+            include_ineligible: z.boolean().default(false),
+            format: z.enum(["json", "csv"]).default("json"),
+            limit: z.number().int().min(1).max(MAX_TARGET_EXPORT).default(MAX_TARGET_EXPORT)
+        },
+        outputSchema: {
+            ...apiEnvelopeOutputShape,
+            export: z.unknown().optional()
+        },
+        annotations: readOnlyAnnotations
+    }, (args) => runTool("export_targets", config, rateLimiter, async () => {
+        const api = await client.exportTargets(compactRecord(args));
+        const exportId = randomUUID();
+        const sanitizedExport = sanitizeTargetsForExport(api.data, args.limit);
+        const resourceUri = exportResourceUri(exportId);
+        rememberExport(exportStore, exportId, sanitizedExport);
+        return withApiMetadata(api, {
+            export: {
+                export_id: exportId,
+                resource_uri: resourceUri,
+                preview: previewExportPayload(sanitizedExport),
+                returned_preview_count: previewExportCount(sanitizedExport),
+                limit: args.limit
+            }
+        });
+    }));
+    registerPrompts(server);
+    registerResources(server, client, config, exportStore);
+    return server;
+}
+function registerResources(server, client, config, exportStore) {
+    server.registerResource("target-export", new ResourceTemplate("bbradar://exports{?export_id}", { list: undefined }), {
+        title: "BBRadar Target Export",
+        description: "In-memory local target export payload by export_id query parameter.",
+        mimeType: "application/json"
+    }, async (uri) => {
+        const exportId = uri.searchParams.get("export_id") ?? "";
+        const payload = exportStore.get(exportId);
+        if (!payload) {
+            return jsonResource(uri.toString(), {
+                request_id: randomUUID(),
+                error: {
+                    message: "Export resource not found or expired from local memory."
+                }
+            });
+        }
+        return jsonResource(uri.toString(), {
+            request_id: randomUUID(),
+            export_id: exportId,
+            export: payload
+        });
+    });
+    server.registerResource("program", new ResourceTemplate("bbradar://program{?program_id}", { list: undefined }), {
+        title: "BBRadar Program",
+        description: "Sanitized BBRadar program details by program_id query parameter.",
+        mimeType: "application/json"
+    }, async (uri) => {
+        const programId = parseProgramIdFromResourceUri(uri);
+        const api = await client.getProgram(programId);
+        const payload = withApiMetadata(api, {
+            program: addProgramResourceLinks(sanitizeProgram(api.data, config.webBaseUrl))
+        });
+        return jsonResource(uri.toString(), payload);
+    });
+    server.registerResource("program-targets", new ResourceTemplate("bbradar://program/targets{?program_id}", { list: undefined }), {
+        title: "BBRadar Program Targets",
+        description: "Sanitized active target list by program_id query parameter.",
+        mimeType: "application/json"
+    }, async (uri) => {
+        const programId = parseProgramIdFromResourceUri(uri);
+        const api = await client.getProgramTargets(programId);
+        const data = readObject(api.data);
+        const targets = readArray(data?.targets).map(sanitizeTarget);
+        const payload = withApiMetadata(api, {
+            program_id: programId,
+            targets,
+            meta: {
+                total_active_targets: targets.length
+            }
+        });
+        return jsonResource(uri.toString(), payload);
+    });
+    server.registerResource("opportunities", new ResourceTemplate("bbradar://opportunities{?level}", { list: undefined }), {
+        title: "BBRadar Opportunities",
+        description: "Sanitized opportunity programs by level query parameter.",
+        mimeType: "application/json"
+    }, async (uri) => {
+        const level = opportunityLevelSchema.parse(uri.searchParams.get("level") ?? "elite");
+        const api = await client.getOpportunities(level, { page: 1, page_size: MAX_PROGRAMS_PER_SEARCH });
+        const data = readObject(api.data);
+        const programs = readArray(data?.programs).map((program) => addProgramResourceLinks(sanitizeProgram(program, config.webBaseUrl)));
+        return jsonResource(uri.toString(), withApiMetadata(api, {
+            level,
+            programs,
+            meta: sanitizeJson(data?.meta)
+        }));
+    });
+    server.registerResource("recent-changes", new ResourceTemplate("bbradar://recent-changes{?change_type}", { list: undefined }), {
+        title: "BBRadar Recent Changes",
+        description: "Sanitized recent target changes with optional change_type query parameter.",
+        mimeType: "application/json"
+    }, async (uri) => {
+        const changeType = uri.searchParams.get("change_type") ?? undefined;
+        const api = await client.getRecentChanges(toQuery({
+            change_type: changeType,
+            page: 1,
+            page_size: MAX_RECENT_CHANGES
+        }));
+        const data = readObject(api.data);
+        const changes = readArray(data?.results).map((change) => sanitizeChange(change, config.webBaseUrl));
+        return jsonResource(uri.toString(), withApiMetadata(api, {
+            changes,
+            meta: sanitizeJson(data?.meta),
+            facets: sanitizeJson(data?.facets)
+        }));
+    });
+}
+async function resolveProgram(client, config, input) {
+    const warnings = [];
+    const budget = {
+        initial: input.upstream_request_budget,
+        remaining: input.upstream_request_budget
+    };
+    const maxPages = clampLimit("max_pages", input.max_pages, MAX_FIND_PROGRAM_PAGES, warnings);
+    const collected = await collectPrograms(client, {
+        platforms: input.platforms,
+        tags: input.tags,
+        updated_since: undefined,
+        opportunity_levels: input.opportunity_levels,
+        max_pages: maxPages,
+        budget,
+        warnings
+    });
+    const matches = collected.programs
+        .map((program) => {
+        const candidate = toProgramCandidate(program, config.webBaseUrl);
+        const match = programResolutionMatch(candidate, input.query);
+        return { candidate, match };
+    })
+        .filter((entry) => entry.match.score > 0)
+        .sort((left, right) => right.match.score - left.match.score || compareProgramCandidates(left.candidate, right.candidate, "best_hunt_value"))
+        .slice(0, input.max_results);
+    const programs = matches.map((entry) => formatProgram(entry.candidate.program, input.output_mode));
+    return stripUndefined({
+        request_id: randomUUID(),
+        source_requests: collected.sourceRequests,
+        warnings: warnings.length > 0 ? warnings : undefined,
+        query: {
+            text: input.query,
+            platforms: input.platforms.length > 0 ? input.platforms : undefined,
+            tags: input.tags.length > 0 ? input.tags : undefined
+        },
+        programs,
+        matches: matches.map((entry) => stripUndefined({
+            program_id: stringField(entry.candidate.program, "id"),
+            score: entry.match.score,
+            matched_fields: entry.match.fields,
+            reasons: entry.match.reasons,
+            program: formatProgram(entry.candidate.program, input.output_mode)
+        })),
+        upstream_budget: {
+            used: budget.initial - budget.remaining,
+            remaining: budget.remaining
+        },
+        ranking_scope: {
+            mode: "sampled",
+            max_pages_scanned_per_source: maxPages,
+            upstream_total_pages: collected.totalPagesBySource,
+            possibly_incomplete: isRankingPossiblyIncomplete(collected.totalPagesBySource, maxPages)
+        },
+        meta: {
+            returned: programs.length,
+            programs_scanned: collected.programsScanned,
+            upstream_requests_scanned: collected.requestsScanned
+        }
+    });
+}
+async function runProgramNameAction(client, config, input) {
+    const resolution = await resolveProgram(client, config, {
+        query: input.query,
+        platforms: input.platforms,
+        tags: input.tags,
+        opportunity_levels: input.opportunity_levels,
+        max_pages: input.max_resolve_pages,
+        max_results: 1,
+        output_mode: input.output_mode,
+        upstream_request_budget: input.upstream_request_budget
+    });
+    const bestMatch = readObject(readArray(resolution.matches)[0]);
+    const programId = stringField(bestMatch, "program_id");
+    const resolvedProgram = readObject(bestMatch?.program);
+    const warnings = readArray(resolution.warnings).filter((warning) => typeof warning === "string");
+    if (!programId) {
+        return stripUndefined({
+            request_id: randomUUID(),
+            source_requests: readArray(resolution.source_requests).filter((request) => readObject(request) !== undefined),
+            warnings: [...warnings, "No matching program_id was resolved for the requested program name."],
+            resolved_program: undefined,
+            action: input.action,
+            result: {
+                found: false
+            },
+            upstream_budget: readObject(resolution.upstream_budget),
+            ranking_scope: readObject(resolution.ranking_scope)
+        });
+    }
+    const actionPayload = await runResolvedProgramAction(client, config, programId, input);
+    const resolutionSourceRequests = readArray(resolution.source_requests).filter((request) => readObject(request) !== undefined);
+    const actionSourceRequests = readArray(actionPayload.source_requests).filter((request) => readObject(request) !== undefined);
+    return stripUndefined({
+        request_id: randomUUID(),
+        source_requests: [...resolutionSourceRequests, ...actionSourceRequests],
+        warnings: warnings.length > 0 ? warnings : undefined,
+        resolved_program: resolvedProgram,
+        action: input.action,
+        result: compactNestedActionResult(actionPayload),
+        upstream_budget: readObject(resolution.upstream_budget),
+        ranking_scope: readObject(resolution.ranking_scope)
+    });
+}
+async function runResolvedProgramAction(client, config, programId, input) {
+    if (input.action === "scope_delta") {
+        return getProgramScopeDelta(client, config, {
+            program_id: programId,
+            since: input.since,
+            change_type: undefined,
+            target_type: input.target_type,
+            language_tags: input.language_tags,
+            include_removed: true,
+            include_out_of_scope: input.include_out_of_scope,
+            include_ineligible: input.include_ineligible,
+            page_size: input.page_size,
+            max_targets: input.max_targets,
+            target_list_mode: input.target_list_mode
+        });
+    }
+    if (input.action === "brief") {
+        return getProgramBrief(client, config, {
+            program_id: programId,
+            target_sample_size: Math.min(input.max_targets, 50),
+            target_list_mode: input.target_list_mode,
+            include_recent_changes: true,
+            recent_changes_limit: Math.min(input.page_size, MAX_RECENT_CHANGES),
+            include_out_of_scope: input.include_out_of_scope,
+            include_ineligible: input.include_ineligible
+        });
+    }
+    if (input.action === "target_breakdown") {
+        return getProgramTargetBreakdown(client, config, {
+            program_id: programId,
+            target_list_mode: input.target_list_mode,
+            group_limit: input.group_limit,
+            include_out_of_scope: input.include_out_of_scope,
+            include_ineligible: input.include_ineligible
+        });
+    }
+    return checkProgramNewTargets(client, config, {
+        program_id: programId,
+        since: input.since,
+        target_type: input.target_type,
+        include_ineligible: input.include_ineligible,
+        page_size: input.page_size,
+        max_targets: input.max_targets,
+        target_list_mode: input.target_list_mode
+    });
+}
+function compactNestedActionResult(payload) {
+    const { source_requests: _sourceRequests, request_id: requestId, ...rest } = payload;
+    return stripUndefined({
+        action_request_id: typeof requestId === "string" ? requestId : undefined,
+        ...rest
+    });
+}
+function findProgramCandidates(client, config, input) {
+    return findPrograms(client, config, {
+        platforms: input.platforms,
+        tags: input.tags,
+        scope_tags: input.scope_tags,
+        target_types: input.target_types,
+        language_tags: input.language_tags,
+        web3: input.web3,
+        opportunity_levels: input.opportunity_levels,
+        updated_since: input.updated_since,
+        min_bounty_min: undefined,
+        min_bounty_max: input.min_bounty_max,
+        max_bounty_max: undefined,
+        require_bounty: input.bounty,
+        max_public_report_count: input.low_reports ? input.max_public_report_count : undefined,
+        require_known_report_count: input.low_reports,
+        include_unknown_report_count: false,
+        exclude_ctf: input.exclude_ctf,
+        exclude_mobile_only: input.exclude_mobile_only,
+        exclude_non_web: input.exclude_non_web,
+        has_api_scope: input.has_api_scope,
+        fresh_launch_days: input.fresh_launch_days,
+        min_wildcards: input.wildcard ? 1 : 0,
+        min_eligible_targets: input.min_eligible_targets,
+        min_total_targets: undefined,
+        min_added_24h: undefined,
+        min_added_7d: undefined,
+        max_pages: input.max_pages,
+        max_results: input.max_results,
+        sort_by: "best_hunt_value",
+        include_target_samples: input.include_target_samples,
+        target_sample_programs: input.target_sample_programs,
+        target_sample_size: input.target_sample_size,
+        only_in_scope_targets: true,
+        only_bounty_eligible_targets: true,
+        target_samples_only_wildcards: input.wildcard,
+        output_mode: input.output_mode ?? "compact",
+        upstream_request_budget: input.upstream_request_budget
+    });
+}
+function findRewardPrograms(client, config, input) {
+    return findPrograms(client, config, {
+        platforms: input.platforms,
+        tags: input.tags,
+        scope_tags: [],
+        target_types: input.target_types,
+        language_tags: input.language_tags,
+        web3: input.web3,
+        opportunity_levels: [],
+        updated_since: undefined,
+        min_bounty_min: input.reward_threshold_mode === "min_at_least" ? input.min_reward : undefined,
+        min_bounty_max: input.reward_threshold_mode === "max_at_least" ? input.min_reward : undefined,
+        max_bounty_max: undefined,
+        require_bounty: true,
+        max_public_report_count: input.max_public_report_count,
+        require_known_report_count: input.require_known_report_count,
+        include_unknown_report_count: input.include_unknown_report_count,
+        exclude_ctf: input.exclude_ctf,
+        exclude_mobile_only: input.exclude_mobile_only,
+        exclude_non_web: input.exclude_non_web,
+        has_api_scope: false,
+        fresh_launch_days: undefined,
+        min_wildcards: 0,
+        min_eligible_targets: input.min_eligible_targets,
+        min_total_targets: undefined,
+        min_added_24h: undefined,
+        min_added_7d: undefined,
+        max_pages: input.max_pages,
+        max_results: input.max_results,
+        sort_by: "highest_reward",
+        include_target_samples: input.include_target_samples,
+        target_sample_programs: input.target_sample_programs,
+        target_sample_size: input.target_sample_size,
+        only_in_scope_targets: true,
+        only_bounty_eligible_targets: true,
+        target_samples_only_wildcards: false,
+        output_mode: input.output_mode,
+        upstream_request_budget: input.upstream_request_budget
+    });
+}
+function findWeb3Contests(client, config, input) {
+    return findPrograms(client, config, {
+        platforms: input.platforms,
+        tags: input.tags,
+        scope_tags: [],
+        target_types: [],
+        language_tags: [],
+        web3: true,
+        opportunity_levels: [],
+        updated_since: undefined,
+        min_bounty_min: input.min_reward !== undefined && input.reward_threshold_mode === "min_at_least" ? input.min_reward : undefined,
+        min_bounty_max: input.min_reward !== undefined && input.reward_threshold_mode === "max_at_least" ? input.min_reward : undefined,
+        max_bounty_max: undefined,
+        require_bounty: input.require_bounty,
+        max_public_report_count: input.max_public_report_count,
+        require_known_report_count: false,
+        include_unknown_report_count: input.include_unknown_report_count,
+        exclude_ctf: false,
+        exclude_mobile_only: false,
+        exclude_non_web: false,
+        has_api_scope: false,
+        contest_like: input.require_contest_signal,
+        fresh_launch_days: undefined,
+        min_wildcards: 0,
+        min_eligible_targets: undefined,
+        min_total_targets: undefined,
+        min_added_24h: undefined,
+        min_added_7d: undefined,
+        max_pages: input.max_pages,
+        max_results: input.max_results,
+        sort_by: input.min_reward !== undefined ? "highest_reward" : "best_hunt_value",
+        include_target_samples: input.include_target_samples,
+        target_sample_programs: input.target_sample_programs,
+        target_sample_size: input.target_sample_size,
+        only_in_scope_targets: true,
+        only_bounty_eligible_targets: true,
+        target_samples_only_wildcards: false,
+        output_mode: input.output_mode,
+        upstream_request_budget: input.upstream_request_budget
+    });
+}
+function findLanguagePrograms(client, config, input) {
+    const rewardFilters = rewardThresholdFilters(input.min_reward, input.reward_threshold_mode);
+    return findPrograms(client, config, {
+        platforms: input.platforms,
+        tags: input.tags,
+        scope_tags: [],
+        target_types: input.target_types,
+        language_tags: input.language_tags,
+        web3: false,
+        opportunity_levels: [],
+        updated_since: undefined,
+        ...rewardFilters,
+        max_bounty_max: undefined,
+        require_bounty: input.require_bounty,
+        max_public_report_count: input.max_public_report_count,
+        require_known_report_count: input.require_known_report_count,
+        include_unknown_report_count: input.include_unknown_report_count,
+        exclude_ctf: true,
+        exclude_mobile_only: false,
+        exclude_non_web: false,
+        has_api_scope: false,
+        vdp_mode: input.exclude_vdp ? "exclude" : "include",
+        fresh_launch_days: undefined,
+        min_wildcards: 0,
+        min_eligible_targets: input.min_eligible_targets,
+        min_total_targets: undefined,
+        min_added_24h: undefined,
+        min_added_7d: undefined,
+        max_pages: input.max_pages,
+        max_results: input.max_results,
+        sort_by: input.min_reward !== undefined ? "highest_reward" : "best_hunt_value",
+        include_target_samples: input.include_target_samples,
+        target_sample_programs: input.target_sample_programs,
+        target_sample_size: input.target_sample_size,
+        only_in_scope_targets: true,
+        only_bounty_eligible_targets: true,
+        target_samples_only_wildcards: false,
+        output_mode: input.output_mode,
+        upstream_request_budget: input.upstream_request_budget
+    });
+}
+function findTargetTypePrograms(client, config, input) {
+    const rewardFilters = rewardThresholdFilters(input.min_reward, input.reward_threshold_mode);
+    return findPrograms(client, config, {
+        platforms: input.platforms,
+        tags: input.tags,
+        scope_tags: input.scope_tags,
+        target_types: input.target_types,
+        language_tags: input.language_tags,
+        web3: false,
+        opportunity_levels: [],
+        updated_since: undefined,
+        ...rewardFilters,
+        max_bounty_max: undefined,
+        require_bounty: input.require_bounty,
+        max_public_report_count: undefined,
+        require_known_report_count: false,
+        include_unknown_report_count: true,
+        exclude_ctf: true,
+        exclude_mobile_only: false,
+        exclude_non_web: false,
+        has_api_scope: input.target_types.some((targetType) => normalizeTag(targetType).includes("api")),
+        vdp_mode: input.exclude_vdp ? "exclude" : "include",
+        fresh_launch_days: undefined,
+        min_wildcards: input.target_types.some((targetType) => normalizeTag(targetType).includes("wildcard")) ? 1 : 0,
+        min_eligible_targets: undefined,
+        min_total_targets: undefined,
+        min_added_24h: undefined,
+        min_added_7d: input.fresh_only ? input.min_added_7d ?? 1 : input.min_added_7d,
+        max_pages: input.max_pages,
+        max_results: input.max_results,
+        sort_by: input.fresh_only ? "most_new_targets" : input.min_reward !== undefined ? "highest_reward" : "best_hunt_value",
+        include_target_samples: input.include_target_samples,
+        target_sample_programs: input.target_sample_programs,
+        target_sample_size: input.target_sample_size,
+        only_in_scope_targets: true,
+        only_bounty_eligible_targets: true,
+        target_samples_only_wildcards: input.target_types.some((targetType) => normalizeTag(targetType).includes("wildcard")),
+        output_mode: input.output_mode,
+        upstream_request_budget: input.upstream_request_budget
+    });
+}
+function findVdpPrograms(client, config, input) {
+    return findPrograms(client, config, {
+        platforms: input.platforms,
+        tags: input.tags,
+        scope_tags: [],
+        target_types: input.target_types,
+        language_tags: input.language_tags,
+        web3: false,
+        opportunity_levels: [],
+        updated_since: undefined,
+        min_bounty_min: undefined,
+        min_bounty_max: undefined,
+        max_bounty_max: undefined,
+        require_bounty: false,
+        max_public_report_count: undefined,
+        require_known_report_count: false,
+        include_unknown_report_count: true,
+        exclude_ctf: true,
+        exclude_mobile_only: false,
+        exclude_non_web: false,
+        has_api_scope: false,
+        vdp_mode: input.vdp_mode,
+        fresh_launch_days: undefined,
+        min_wildcards: 0,
+        min_eligible_targets: undefined,
+        min_total_targets: undefined,
+        min_added_24h: undefined,
+        min_added_7d: undefined,
+        max_pages: input.max_pages,
+        max_results: input.max_results,
+        sort_by: "best_hunt_value",
+        include_target_samples: input.include_target_samples,
+        target_sample_programs: input.target_sample_programs,
+        target_sample_size: input.target_sample_size,
+        only_in_scope_targets: true,
+        only_bounty_eligible_targets: false,
+        target_samples_only_wildcards: false,
+        output_mode: input.output_mode,
+        upstream_request_budget: input.upstream_request_budget
+    });
+}
+function findPaidPrograms(client, config, input) {
+    const rewardFilters = rewardThresholdFilters(input.min_reward, input.reward_threshold_mode);
+    return findPrograms(client, config, {
+        platforms: input.platforms,
+        tags: input.tags,
+        scope_tags: [],
+        target_types: input.target_types,
+        language_tags: input.language_tags,
+        web3: false,
+        opportunity_levels: [],
+        updated_since: undefined,
+        ...rewardFilters,
+        max_bounty_max: undefined,
+        require_bounty: true,
+        max_public_report_count: input.max_public_report_count,
+        require_known_report_count: false,
+        include_unknown_report_count: true,
+        exclude_ctf: true,
+        exclude_mobile_only: false,
+        exclude_non_web: false,
+        has_api_scope: false,
+        vdp_mode: "exclude",
+        fresh_launch_days: undefined,
+        min_wildcards: 0,
+        min_eligible_targets: input.min_eligible_targets,
+        min_total_targets: undefined,
+        min_added_24h: undefined,
+        min_added_7d: undefined,
+        max_pages: input.max_pages,
+        max_results: input.max_results,
+        sort_by: input.min_reward !== undefined ? "highest_reward" : "best_hunt_value",
+        include_target_samples: input.include_target_samples,
+        target_sample_programs: input.target_sample_programs,
+        target_sample_size: input.target_sample_size,
+        only_in_scope_targets: true,
+        only_bounty_eligible_targets: true,
+        target_samples_only_wildcards: false,
+        output_mode: input.output_mode,
+        upstream_request_budget: input.upstream_request_budget
+    });
+}
+function findStackMatches(client, config, input) {
+    const rewardFilters = rewardThresholdFilters(input.min_reward, input.reward_threshold_mode);
+    return findPrograms(client, config, {
+        platforms: input.platforms,
+        tags: input.tags,
+        scope_tags: input.scope_tags,
+        target_types: input.target_types,
+        language_tags: input.language_tags,
+        web3: input.web3,
+        opportunity_levels: [],
+        updated_since: undefined,
+        ...rewardFilters,
+        max_bounty_max: undefined,
+        require_bounty: input.require_bounty,
+        max_public_report_count: input.max_public_report_count,
+        require_known_report_count: false,
+        include_unknown_report_count: true,
+        exclude_ctf: true,
+        exclude_mobile_only: false,
+        exclude_non_web: false,
+        has_api_scope: input.target_types.some((targetType) => normalizeTag(targetType).includes("api")),
+        contest_like: input.contest_like,
+        vdp_mode: input.exclude_vdp ? "exclude" : "include",
+        fresh_launch_days: undefined,
+        min_wildcards: input.target_types.some((targetType) => normalizeTag(targetType).includes("wildcard")) ? 1 : 0,
+        min_eligible_targets: input.min_eligible_targets,
+        min_total_targets: undefined,
+        min_added_24h: undefined,
+        min_added_7d: input.fresh_only ? input.min_added_7d ?? 1 : input.min_added_7d,
+        max_pages: input.max_pages,
+        max_results: input.max_results,
+        sort_by: input.fresh_only ? "most_new_targets" : input.min_reward !== undefined ? "highest_reward" : "best_hunt_value",
+        include_target_samples: input.include_target_samples,
+        target_sample_programs: input.target_sample_programs,
+        target_sample_size: input.target_sample_size,
+        only_in_scope_targets: true,
+        only_bounty_eligible_targets: true,
+        target_samples_only_wildcards: input.target_types.some((targetType) => normalizeTag(targetType).includes("wildcard")),
+        output_mode: input.output_mode,
+        upstream_request_budget: input.upstream_request_budget
+    });
+}
+function findLowNoisePrograms(client, config, input) {
+    const rewardFilters = rewardThresholdFilters(input.min_reward, input.reward_threshold_mode);
+    return findPrograms(client, config, {
+        platforms: input.platforms,
+        tags: input.tags,
+        scope_tags: [],
+        target_types: input.target_types,
+        language_tags: input.language_tags,
+        web3: false,
+        opportunity_levels: [],
+        updated_since: undefined,
+        ...rewardFilters,
+        max_bounty_max: undefined,
+        require_bounty: input.require_bounty,
+        max_public_report_count: input.max_public_report_count,
+        require_known_report_count: input.require_known_report_count,
+        include_unknown_report_count: input.include_unknown_report_count,
+        exclude_ctf: true,
+        exclude_mobile_only: false,
+        exclude_non_web: false,
+        has_api_scope: false,
+        vdp_mode: input.require_bounty ? "exclude" : "include",
+        fresh_launch_days: undefined,
+        min_wildcards: 0,
+        min_eligible_targets: input.min_eligible_targets,
+        min_total_targets: undefined,
+        min_added_24h: undefined,
+        min_added_7d: undefined,
+        max_pages: input.max_pages,
+        max_results: input.max_results,
+        sort_by: input.min_reward !== undefined ? "highest_reward" : "best_hunt_value",
+        include_target_samples: input.include_target_samples,
+        target_sample_programs: input.target_sample_programs,
+        target_sample_size: input.target_sample_size,
+        only_in_scope_targets: true,
+        only_bounty_eligible_targets: true,
+        target_samples_only_wildcards: false,
+        output_mode: input.output_mode,
+        upstream_request_budget: input.upstream_request_budget
+    });
+}
+function findRecentByType(client, config, input) {
+    return getRecentTargetActivity(client, config, {
+        change_type: input.change_type,
+        target_type: input.target_type,
+        include_removed: input.include_removed || input.change_type === "removed",
+        include_out_of_scope: input.include_out_of_scope,
+        include_ineligible: input.include_ineligible,
+        search: input.search,
+        platforms: input.platforms,
+        tags: input.tags,
+        language_tags: input.language_tags,
+        page_size: input.page_size,
+        max_programs: input.max_programs,
+        sample_size: input.sample_size,
+        target_list_mode: input.target_list_mode
+    });
+}
+async function findProgramsByTarget(client, config, input) {
+    const warnings = [];
+    if (input.use_api_search) {
+        const directResult = await searchProgramsByTargetApi(client, config, input, warnings);
+        if (directResult) {
+            return directResult;
+        }
+    }
+    const budget = {
+        initial: input.upstream_request_budget,
+        remaining: input.upstream_request_budget
+    };
+    const maxPages = clampLimit("max_pages", input.max_pages, MAX_FIND_PROGRAM_PAGES, warnings);
+    const collected = await collectPrograms(client, {
+        platforms: input.platforms,
+        tags: input.tags,
+        updated_since: undefined,
+        opportunity_levels: [],
+        max_pages: maxPages,
+        budget,
+        warnings
+    });
+    const sourceRequests = [...collected.sourceRequests];
+    const matches = [];
+    const candidates = collected.programs
+        .map((program) => toProgramCandidate(program, config.webBaseUrl))
+        .sort((left, right) => compareProgramCandidates(left, right, "best_hunt_value"));
+    for (const candidate of candidates) {
+        if (matches.length >= input.max_results) {
+            break;
+        }
+        const programId = stringField(candidate.program, "id");
+        if (!programId) {
+            continue;
+        }
+        if (!tryConsumeBudget(budget)) {
+            addUniqueWarning(warnings, "Upstream request budget was exhausted before all candidate target lists could be checked.");
+            break;
+        }
+        const targetsApi = await client.getProgramTargets(programId);
+        refundBudgetIfNoUpstreamRequest(budget, targetsApi);
+        sourceRequests.push({
+            source: "program_targets",
+            program_id: programId,
+            request_id: targetsApi.requestId,
+            upstream_request_id: targetsApi.upstreamRequestId,
+            ...apiSourceMetadata(targetsApi)
+        });
+        const targetsData = readObject(targetsApi.data);
+        const targets = readArray(targetsData?.targets)
+            .map(sanitizeTarget)
+            .filter((target) => targetHasAllowedScope(target, {
+            include_out_of_scope: input.include_out_of_scope,
+            include_ineligible: input.include_ineligible,
+            strict_scope_filter: false
+        }));
+        const matchingTargets = targets.filter((target) => targetMatchesQuery(target, input.target_query, input.match_mode));
+        if (matchingTargets.length === 0) {
+            continue;
+        }
+        matches.push(stripUndefined({
+            program: formatProgram(candidate.program, "compact"),
+            match_count: matchingTargets.length,
+            matching_targets: formatTargetList(matchingTargets.slice(0, input.max_targets_per_program), input.target_list_mode),
+            matching_targets_has_more: matchingTargets.length > input.max_targets_per_program,
+            total_targets_checked: targets.length
+        }));
+    }
+    return stripUndefined({
+        request_id: randomUUID(),
+        source_requests: sourceRequests,
+        warnings: warnings.length > 0 ? warnings : undefined,
+        filters: {
+            target_query: input.target_query,
+            match_mode: input.match_mode,
+            platforms: input.platforms.length > 0 ? input.platforms : undefined,
+            tags: input.tags.length > 0 ? input.tags : undefined,
+            source: "sampled_program_targets",
+            include_out_of_scope: input.include_out_of_scope,
+            include_ineligible: input.include_ineligible,
+            target_list_mode: input.target_list_mode
+        },
+        matches,
+        programs: matches.map((match) => readObject(match.program)).filter((program) => program !== undefined),
+        upstream_budget: {
+            used: budget.initial - budget.remaining,
+            remaining: budget.remaining
+        },
+        ranking_scope: {
+            mode: "sampled",
+            max_pages_scanned_per_source: maxPages,
+            upstream_total_pages: collected.totalPagesBySource,
+            possibly_incomplete: isRankingPossiblyIncomplete(collected.totalPagesBySource, maxPages)
+        },
+        meta: {
+            returned: matches.length,
+            programs_scanned: collected.programsScanned,
+            target_lists_checked: sourceRequests.filter((request) => request.source === "program_targets").length
+        }
+    });
+}
+async function searchProgramsByTargetApi(client, config, input, warnings) {
+    let api;
+    try {
+        api = await client.searchTargets({
+            q: input.target_query,
+            match_mode: input.match_mode,
+            platforms: input.platforms,
+            tags: input.tags,
+            include_out_of_scope: input.include_out_of_scope,
+            include_ineligible: input.include_ineligible,
+            page: 1,
+            page_size: Math.max(input.max_results * input.max_targets_per_program, input.max_results)
+        });
+    }
+    catch (error) {
+        if (error instanceof BBRadarApiError && (error.status === 404 || error.status === 405)) {
+            warnings.push("Direct target search API is unavailable; fell back to sampled program target lists.");
+            return undefined;
+        }
+        throw error;
+    }
+    const data = readObject(api.data);
+    const rawMatches = readTargetSearchRows(data);
+    const grouped = new Map();
+    for (const row of rawMatches) {
+        const program = addProgramResourceLinks(sanitizeProgram(readObject(row.program) ?? readObject(readObject(row.target)?.program) ?? row, config.webBaseUrl));
+        const programId = stringField(program, "id") ?? stringField(row, "program_id");
+        const target = sanitizeTarget(readObject(row.target) ?? row);
+        if (!programId || !targetIdentifier(target)) {
+            continue;
+        }
+        if (!targetHasAllowedScope(target, {
+            include_out_of_scope: input.include_out_of_scope,
+            include_ineligible: input.include_ineligible,
+            strict_scope_filter: false
+        })) {
+            continue;
+        }
+        if (!targetMatchesQuery(target, input.target_query, input.match_mode)) {
+            continue;
+        }
+        const existing = grouped.get(programId) ?? { program: { ...program, id: programId }, targets: [] };
+        existing.targets.push(target);
+        grouped.set(programId, existing);
+    }
+    const matches = [...grouped.values()].slice(0, input.max_results).map((entry) => stripUndefined({
+        program: formatProgram(entry.program, "compact"),
+        match_count: entry.targets.length,
+        matching_targets: formatTargetList(entry.targets.slice(0, input.max_targets_per_program), input.target_list_mode),
+        matching_targets_has_more: entry.targets.length > input.max_targets_per_program
+    }));
+    const sanitizedMeta = readObject(sanitizeJson(data?.meta));
+    return stripUndefined({
+        request_id: randomUUID(),
+        source_requests: [
+            {
+                source: "target_search",
+                request_id: api.requestId,
+                upstream_request_id: api.upstreamRequestId,
+                ...apiSourceMetadata(api)
+            }
+        ],
+        warnings: warnings.length > 0 ? warnings : undefined,
+        filters: {
+            target_query: input.target_query,
+            match_mode: input.match_mode,
+            platforms: input.platforms.length > 0 ? input.platforms : undefined,
+            tags: input.tags.length > 0 ? input.tags : undefined,
+            source: "target_search_api",
+            include_out_of_scope: input.include_out_of_scope,
+            include_ineligible: input.include_ineligible,
+            target_list_mode: input.target_list_mode
+        },
+        matches,
+        programs: matches.map((match) => readObject(match.program)).filter((program) => program !== undefined),
+        meta: stripUndefined({
+            ...(sanitizedMeta ?? {}),
+            returned: matches.length,
+            target_search_rows_scanned: rawMatches.length
+        })
+    });
+}
+function readTargetSearchRows(data) {
+    return [data?.results, data?.matches, data?.targets]
+        .map(readArray)
+        .find((rows) => rows.length > 0)
+        ?.map((row) => readObject(row))
+        .filter((row) => row !== undefined) ?? [];
+}
+function rewardThresholdFilters(minReward, mode) {
+    return {
+        min_bounty_min: minReward !== undefined && mode === "min_at_least" ? minReward : undefined,
+        min_bounty_max: minReward !== undefined && mode === "max_at_least" ? minReward : undefined
+    };
+}
+async function listFilters(client, input) {
+    const budget = {
+        initial: input.upstream_request_budget,
+        remaining: input.upstream_request_budget
+    };
+    const collected = await collectPrograms(client, {
+        platforms: input.platforms,
+        tags: input.tags,
+        updated_since: undefined,
+        opportunity_levels: [],
+        max_pages: input.max_pages,
+        budget
+    });
+    const platforms = new Set();
+    const scopeTags = new Set();
+    const targetTypes = new Set();
+    const languageTags = new Set();
+    const sourceRequests = [...collected.sourceRequests];
+    for (const rawProgram of collected.programs) {
+        const program = sanitizeProgram(rawProgram, "");
+        addSetValue(platforms, stringField(program, "platform"));
+        addSetValues(scopeTags, readStringArrayField(readObject(program.scope_summary) ?? {}, "tags"));
+    }
+    try {
+        if (tryConsumeBudget(budget)) {
+            const changesApi = await client.getRecentChanges({ page: 1, page_size: MAX_RECENT_CHANGES });
+            refundBudgetIfNoUpstreamRequest(budget, changesApi);
+            sourceRequests.push({
+                source: "recent_changes_facets",
+                request_id: changesApi.requestId,
+                upstream_request_id: changesApi.upstreamRequestId,
+                ...apiSourceMetadata(changesApi)
+            });
+            const changesData = readObject(changesApi.data);
+            const facets = readObject(changesData?.facets);
+            for (const platform of readFacetValues(facets?.platforms)) {
+                addSetValue(platforms, platform);
+            }
+            for (const tag of readFacetValues(facets?.tags)) {
+                addSetValue(scopeTags, tag);
+            }
+        }
+    }
+    catch {
+        // Facets are best-effort; list_filters should still return observed program filters.
+    }
+    if (input.include_target_facets && input.target_sample_programs > 0) {
+        const programIds = collected.programs
+            .map((program) => readString(readObject(program)?.id))
+            .filter((id) => id !== undefined)
+            .slice(0, input.target_sample_programs);
+        await mapWithConcurrency(programIds, TARGET_SAMPLE_CONCURRENCY, async (programId) => {
+            if (!tryConsumeBudget(budget)) {
+                return;
+            }
+            const targetsApi = await client.getProgramTargets(programId);
+            refundBudgetIfNoUpstreamRequest(budget, targetsApi);
+            const targetsData = readObject(targetsApi.data);
+            sourceRequests.push({
+                source: "target_facets",
+                program_id: programId,
+                request_id: targetsApi.requestId,
+                upstream_request_id: targetsApi.upstreamRequestId,
+                ...apiSourceMetadata(targetsApi)
+            });
+            for (const target of readArray(targetsData?.targets).map(sanitizeTarget)) {
+                addSetValue(targetTypes, stringField(target, "target_type"));
+                addSetValues(scopeTags, readStringArrayField(target, "scope_tags"));
+                addSetValues(languageTags, readStringArrayField(target, "language_tags"));
+            }
+        });
+    }
+    return {
+        request_id: randomUUID(),
+        filters: {
+            platforms: sortedValues(platforms),
+            tags: sortedValues(scopeTags),
+            scope_tags: sortedValues(scopeTags),
+            target_types: sortedValues(targetTypes),
+            language_tags: sortedValues(languageTags),
+            opportunity_levels: opportunityLevelSchema.options
+        },
+        observed_from: {
+            programs_scanned: collected.programsScanned,
+            max_pages_scanned: input.max_pages,
+            target_facets_enabled: input.include_target_facets,
+            source_requests: sourceRequests
+        },
+        upstream_budget: {
+            used: budget.initial - budget.remaining,
+            remaining: budget.remaining
+        }
+    };
+}
+async function comparePrograms(client, config, input) {
+    const candidates = [];
+    const sourceRequests = [];
+    const errors = [];
+    await mapWithConcurrency(input.program_ids, TARGET_SAMPLE_CONCURRENCY, async (programId) => {
+        try {
+            const api = await client.getProgram(programId);
+            candidates.push(toProgramCandidate(api.data, config.webBaseUrl));
+            sourceRequests.push({
+                source: "program",
+                program_id: programId,
+                request_id: api.requestId,
+                upstream_request_id: api.upstreamRequestId,
+                ...apiSourceMetadata(api)
+            });
+        }
+        catch (error) {
+            errors.push(programFetchError(programId, error));
+        }
+    });
+    candidates.sort((left, right) => compareProgramCandidates(left, right, "best_hunt_value"));
+    const sampleInput = {
+        platforms: [],
+        tags: [],
+        scope_tags: [],
+        target_types: [],
+        language_tags: [],
+        web3: false,
+        opportunity_levels: [],
+        updated_since: undefined,
+        min_bounty_min: undefined,
+        min_bounty_max: undefined,
+        max_bounty_max: undefined,
+        require_bounty: false,
+        max_public_report_count: undefined,
+        require_known_report_count: false,
+        include_unknown_report_count: true,
+        exclude_ctf: false,
+        exclude_mobile_only: false,
+        exclude_non_web: false,
+        has_api_scope: false,
+        fresh_launch_days: undefined,
+        min_wildcards: 0,
+        min_eligible_targets: undefined,
+        min_total_targets: undefined,
+        min_added_24h: undefined,
+        min_added_7d: undefined,
+        max_pages: 1,
+        max_results: candidates.length,
+        sort_by: "best_match",
+        include_target_samples: input.include_target_samples,
+        target_sample_programs: input.include_target_samples ? candidates.length : 0,
+        target_sample_size: input.target_sample_size,
+        only_in_scope_targets: input.only_in_scope_targets,
+        only_bounty_eligible_targets: input.only_bounty_eligible_targets,
+        target_samples_only_wildcards: false,
+        output_mode: input.output_mode ?? "compact",
+        upstream_request_budget: Math.max(candidates.length + 1, DEFAULT_FIND_UPSTREAM_REQUEST_BUDGET)
+    };
+    const budget = {
+        initial: sampleInput.upstream_request_budget,
+        remaining: sampleInput.upstream_request_budget
+    };
+    const targetSamples = input.include_target_samples ? await collectTargetSamples(client, candidates, sampleInput, budget) : {};
+    return stripUndefined({
+        request_id: randomUUID(),
+        partial_success: errors.length > 0,
+        program_ids_requested: input.program_ids,
+        failed_program_ids: errors.map((error) => error.program_id).filter((id) => typeof id === "string"),
+        errors: errors.length > 0 ? errors : undefined,
+        source_requests: sourceRequests,
+        compared_programs: candidates.map((candidate, index) => candidateOutput(candidate, index, targetSamples, input.output_mode ?? "compact")),
+        upstream_budget: {
+            used: budget.initial - budget.remaining,
+            remaining: budget.remaining
+        }
+    });
+}
+async function summarizeProgramActivity(client, config, programId, recentChangesLimit) {
+    const programApi = await client.getProgram(programId);
+    const program = addProgramResourceLinks(sanitizeProgram(programApi.data, config.webBaseUrl));
+    const scopeSummary = readObject(program.scope_summary);
+    const targetActivity = readObject(scopeSummary?.target_activity);
+    const changes = recentChangesLimit > 0 ? await fetchProgramChanges(client, config, programId, recentChangesLimit, true, true, true) : undefined;
+    return {
+        request_id: randomUUID(),
+        source_requests: [
+            {
+                source: "program",
+                request_id: programApi.requestId,
+                upstream_request_id: programApi.upstreamRequestId,
+                ...apiSourceMetadata(programApi)
+            },
+            ...(changes?.sourceRequests ?? [])
+        ],
+        program,
+        activity: stripUndefined({
+            target_counts: readObject(scopeSummary?.target_counts),
+            target_activity: targetActivity,
+            recent_change_count: changes?.changes.length
+        }),
+        changes: changes?.changes ?? []
+    };
+}
+async function getLatestAddedTargets(client, config, input) {
+    const recentApi = await client.getRecentChanges({
+        change_type: "added",
+        include_removed: false,
+        include_ineligible: input.include_ineligible,
+        include_out_of_scope: input.include_out_of_scope,
+        tags: [input.target_type],
+        page: 1,
+        page_size: input.recent_changes_page_size
+    });
+    const recentData = readObject(recentApi.data);
+    const changes = readArray(recentData?.results).map((change) => sanitizeChange(change, config.webBaseUrl));
+    const matchingChanges = changes
+        .filter((change) => {
+        const target = readObject(change.target);
+        const programId = stringField(readObject(change.program), "id");
+        return (stringField(change, "change_type") === "added" &&
+            programId !== undefined &&
+            target !== undefined &&
+            targetMatchesRequestedType(target, input.target_type) &&
+            targetHasAllowedScope(target, {
+                include_out_of_scope: input.include_out_of_scope,
+                include_ineligible: input.include_ineligible,
+                strict_scope_filter: true
+            }));
+    })
+        .sort((left, right) => timestampField(right, "changed_at") - timestampField(left, "changed_at"));
+    const latest = matchingChanges[0];
+    const sourceRequests = [
+        {
+            source: "recent_changes",
+            request_id: recentApi.requestId,
+            upstream_request_id: recentApi.upstreamRequestId,
+            ...apiSourceMetadata(recentApi)
+        }
+    ];
+    if (!latest) {
+        return {
+            request_id: randomUUID(),
+            source_requests: sourceRequests,
+            query: latestAddedTargetsQuery(input),
+            new_targets: [],
+            meta: {
+                recent_changes_scanned: changes.length,
+                no_match: true
+            }
+        };
+    }
+    const latestAddedAt = stringField(latest, "changed_at");
+    const programId = stringField(readObject(latest.program), "id");
+    const program = addProgramResourceLinks(readObject(latest.program) ?? {});
+    const latestNewTargets = matchingChanges
+        .filter((change) => stringField(change, "changed_at") === latestAddedAt && stringField(readObject(change.program), "id") === programId)
+        .map((change) => readObject(change.target))
+        .filter((target) => target !== undefined);
+    let fullTargets = [];
+    let totalActiveTargets;
+    let totalAfterFilters;
+    if (input.include_full_target_list && programId) {
+        const targetsApi = await client.getProgramTargets(programId);
+        const targetsData = readObject(targetsApi.data);
+        const rawTargets = readArray(targetsData?.targets);
+        fullTargets = rawTargets
+            .map(sanitizeTarget)
+            .filter((target) => targetHasAllowedScope(target, {
+            include_out_of_scope: input.full_list_include_out_of_scope,
+            include_ineligible: input.full_list_include_ineligible,
+            strict_scope_filter: false
+        }));
+        totalActiveTargets = rawTargets.length;
+        totalAfterFilters = fullTargets.length;
+        sourceRequests.push({
+            source: "program_targets",
+            program_id: programId,
+            request_id: targetsApi.requestId,
+            upstream_request_id: targetsApi.upstreamRequestId,
+            ...apiSourceMetadata(targetsApi)
+        });
+    }
+    const limitedFullTargets = fullTargets.slice(0, input.full_target_limit);
+    return stripUndefined({
+        request_id: randomUUID(),
+        source_requests: sourceRequests,
+        query: latestAddedTargetsQuery(input),
+        latest_added_at: latestAddedAt,
+        program,
+        new_targets: formatTargetList(latestNewTargets, input.full_target_list_mode),
+        full_targets: input.include_full_target_list ? formatTargetList(limitedFullTargets, input.full_target_list_mode) : undefined,
+        meta: stripUndefined({
+            recent_changes_scanned: changes.length,
+            matching_changes_scanned: matchingChanges.length,
+            new_targets_returned: formatTargetList(latestNewTargets, input.full_target_list_mode).length,
+            full_targets_total_active: totalActiveTargets,
+            full_targets_total_after_filters: totalAfterFilters,
+            full_targets_returned: input.include_full_target_list ? formatTargetList(limitedFullTargets, input.full_target_list_mode).length : undefined,
+            full_targets_has_more: input.include_full_target_list ? limitedFullTargets.length < fullTargets.length : undefined
+        })
+    });
+}
+async function getProgramScopeSummary(client, config, input) {
+    const [programApi, targetsApi] = await Promise.all([client.getProgram(input.program_id), client.getProgramTargets(input.program_id)]);
+    const targetsData = readObject(targetsApi.data);
+    const rawTargets = readArray(targetsData?.targets);
+    const targets = rawTargets.map(sanitizeTarget);
+    return {
+        request_id: randomUUID(),
+        source_requests: [
+            {
+                source: "program",
+                request_id: programApi.requestId,
+                upstream_request_id: programApi.upstreamRequestId,
+                ...apiSourceMetadata(programApi)
+            },
+            {
+                source: "program_targets",
+                request_id: targetsApi.requestId,
+                upstream_request_id: targetsApi.upstreamRequestId,
+                ...apiSourceMetadata(targetsApi)
+            }
+        ],
+        program: formatProgram(addProgramResourceLinks(sanitizeProgram(programApi.data, config.webBaseUrl)), "compact"),
+        scope: buildTargetScopeSummary(targets, input.target_list_mode, input.group_limit, input.include_out_of_scope, input.include_ineligible),
+        meta: {
+            total_active_targets: rawTargets.length,
+            target_list_mode: input.target_list_mode,
+            group_limit: input.group_limit
+        }
+    };
+}
+async function getProgramTargetBreakdown(client, config, input) {
+    const [programApi, targetsApi] = await Promise.all([client.getProgram(input.program_id), client.getProgramTargets(input.program_id)]);
+    const targetsData = readObject(targetsApi.data);
+    const rawTargets = readArray(targetsData?.targets);
+    const targets = rawTargets
+        .map(sanitizeTarget)
+        .filter((target) => targetHasAllowedScope(target, {
+        include_out_of_scope: input.include_out_of_scope,
+        include_ineligible: input.include_ineligible,
+        strict_scope_filter: false
+    }));
+    const scope = buildTargetScopeSummary(targets, input.target_list_mode, input.group_limit, input.include_out_of_scope, input.include_ineligible);
+    return {
+        request_id: randomUUID(),
+        source_requests: [
+            {
+                source: "program",
+                request_id: programApi.requestId,
+                upstream_request_id: programApi.upstreamRequestId,
+                ...apiSourceMetadata(programApi)
+            },
+            {
+                source: "program_targets",
+                request_id: targetsApi.requestId,
+                upstream_request_id: targetsApi.upstreamRequestId,
+                ...apiSourceMetadata(targetsApi)
+            }
+        ],
+        program: formatProgram(addProgramResourceLinks(sanitizeProgram(programApi.data, config.webBaseUrl)), "compact"),
+        breakdown: {
+            target_counts: readObject(scope.target_counts),
+            by_target_type: countTargetValues(targets, (target) => stringField(target, "target_type")),
+            by_scope_tag: countTargetValues(targets, (target) => readStringArrayField(target, "scope_tags")),
+            by_language_tag: countTargetValues(targets, (target) => readStringArrayField(target, "language_tags")),
+            group_counts: readObject(scope.group_counts),
+            group_has_more: readObject(scope.group_has_more),
+            groups: readObject(scope.groups)
+        },
+        meta: {
+            total_active_targets: rawTargets.length,
+            total_after_filters: targets.length,
+            target_list_mode: input.target_list_mode,
+            group_limit: input.group_limit
+        }
+    };
+}
+async function getProgramScopeDelta(client, config, input) {
+    const programApi = await client.getProgram(input.program_id);
+    const program = addProgramResourceLinks(sanitizeProgram(programApi.data, config.webBaseUrl));
+    const changesPayload = await fetchProgramChanges(client, config, input.program_id, input.page_size, input.include_removed || input.change_type === "removed", input.include_ineligible, input.include_out_of_scope);
+    const sinceTimestamp = input.since ? Date.parse(input.since) : undefined;
+    const filteredChanges = changesPayload.changes
+        .filter((change) => !input.change_type || stringField(change, "change_type") === input.change_type)
+        .filter((change) => sinceTimestamp === undefined || timestampField(change, "changed_at") >= sinceTimestamp)
+        .filter((change) => {
+        const target = readObject(change.target);
+        return !input.target_type || (target !== undefined && targetMatchesRequestedType(target, input.target_type));
+    })
+        .filter((change) => {
+        const target = readObject(change.target);
+        return input.language_tags.length === 0 || (target !== undefined && targetMatchesAnySignal(target, input.language_tags));
+    });
+    const limitedChanges = filteredChanges.slice(0, input.max_targets);
+    return stripUndefined({
+        request_id: randomUUID(),
+        source_requests: [
+            {
+                source: "program",
+                request_id: programApi.requestId,
+                upstream_request_id: programApi.upstreamRequestId,
+                ...apiSourceMetadata(programApi)
+            },
+            ...changesPayload.sourceRequests
+        ],
+        program: formatProgram(program, "compact"),
+        delta: buildScopeDelta(limitedChanges, input.target_list_mode),
+        changes: limitedChanges.map((change) => formatChange(change, "compact")),
+        meta: stripUndefined({
+            recent_changes_scanned: changesPayload.changes.length,
+            changes_after_filters: filteredChanges.length,
+            returned: limitedChanges.length,
+            has_more: filteredChanges.length > limitedChanges.length,
+            since: input.since,
+            change_type: input.change_type,
+            target_type: input.target_type,
+            language_tags: input.language_tags.length > 0 ? input.language_tags : undefined,
+            target_list_mode: input.target_list_mode
+        })
+    });
+}
+async function getRecentTargetActivity(client, config, input) {
+    const query = toQuery({
+        change_type: input.change_type,
+        include_removed: input.include_removed,
+        include_ineligible: input.include_ineligible,
+        include_out_of_scope: input.include_out_of_scope,
+        search: input.search,
+        platforms: input.platforms,
+        tags: uniqueStrings([...input.tags, ...(input.target_type ? [input.target_type] : []), ...input.language_tags]),
+        page: 1,
+        page_size: input.page_size
+    });
+    const api = await client.getRecentChanges(query);
+    const data = readObject(api.data);
+    const changes = readArray(data?.results)
+        .map((change) => sanitizeChange(change, config.webBaseUrl))
+        .filter((change) => {
+        const target = readObject(change.target);
+        return !input.target_type || (target !== undefined && targetMatchesRequestedType(target, input.target_type));
+    })
+        .filter((change) => {
+        const target = readObject(change.target);
+        return input.language_tags.length === 0 || (target !== undefined && targetMatchesAnySignal(target, input.language_tags));
+    });
+    const grouped = new Map();
+    for (const change of changes) {
+        const program = readObject(change.program);
+        const programId = stringField(program, "id");
+        const target = readObject(change.target);
+        if (!program || !programId || !target) {
+            continue;
+        }
+        const existing = grouped.get(programId) ??
+            {
+                program: addProgramResourceLinks(program),
+                latestChangedAt: undefined,
+                latestTimestamp: 0,
+                changes: [],
+                targets: [],
+                targetTypes: new Set(),
+                changeCounts: {}
+            };
+        const changedAt = stringField(change, "changed_at");
+        const timestamp = timestampField(change, "changed_at");
+        const changeType = stringField(change, "change_type") ?? "unknown";
+        existing.changes.push(change);
+        existing.targets.push(target);
+        existing.targetTypes.add(stringField(target, "target_type") ?? "unknown");
+        existing.changeCounts[changeType] = (existing.changeCounts[changeType] ?? 0) + 1;
+        if (timestamp >= existing.latestTimestamp) {
+            existing.latestTimestamp = timestamp;
+            existing.latestChangedAt = changedAt;
+        }
+        grouped.set(programId, existing);
+    }
+    const activity = [...grouped.values()]
+        .sort((left, right) => right.latestTimestamp - left.latestTimestamp)
+        .slice(0, input.max_programs)
+        .map((entry) => stripUndefined({
+        program: formatProgram(entry.program, "compact"),
+        latest_changed_at: entry.latestChangedAt,
+        change_counts: entry.changeCounts,
+        target_types: sortedValues(entry.targetTypes),
+        sample_targets: formatTargetList(entry.targets.slice(0, input.sample_size), input.target_list_mode),
+        sample_changes: entry.changes.slice(0, input.sample_size).map((change) => formatChange(change, "compact"))
+    }));
+    return {
+        request_id: randomUUID(),
+        source_requests: [
+            {
+                source: "recent_changes",
+                request_id: api.requestId,
+                upstream_request_id: api.upstreamRequestId,
+                ...apiSourceMetadata(api)
+            }
+        ],
+        activity,
+        meta: {
+            recent_changes_scanned: changes.length,
+            programs_matched: grouped.size,
+            returned: activity.length,
+            target_list_mode: input.target_list_mode
+        }
+    };
+}
+async function checkProgramNewTargets(client, config, input) {
+    const handle = programSearchText(input.program_id);
+    const api = await client.getRecentChanges({
+        change_type: "added",
+        include_removed: false,
+        include_ineligible: input.include_ineligible,
+        include_out_of_scope: false,
+        search: handle.length >= 2 ? handle : input.program_id,
+        tags: input.target_type ? [input.target_type] : [],
+        page: 1,
+        page_size: input.page_size
+    });
+    const data = readObject(api.data);
+    const upstreamMeta = readObject(sanitizeJson(data?.meta));
+    const sinceTimestamp = input.since ? Date.parse(input.since) : undefined;
+    const changes = readArray(data?.results).map((change) => sanitizeChange(change, config.webBaseUrl));
+    const matchingChanges = changes
+        .filter((change) => {
+        const target = readObject(change.target);
+        const changedAt = timestampField(change, "changed_at");
+        return (stringField(change, "change_type") === "added" &&
+            stringField(readObject(change.program), "id") === input.program_id &&
+            target !== undefined &&
+            (sinceTimestamp === undefined || changedAt >= sinceTimestamp) &&
+            (!input.target_type || targetMatchesRequestedType(target, input.target_type)) &&
+            targetHasAllowedScope(target, {
+                include_out_of_scope: false,
+                include_ineligible: input.include_ineligible,
+                strict_scope_filter: true
+            }));
+    })
+        .sort((left, right) => timestampField(right, "changed_at") - timestampField(left, "changed_at"));
+    const limitedChanges = matchingChanges.slice(0, input.max_targets);
+    const targets = limitedChanges
+        .map((change) => readObject(change.target))
+        .filter((target) => target !== undefined);
+    const latest = matchingChanges[0];
+    return stripUndefined({
+        request_id: randomUUID(),
+        source_requests: [
+            {
+                source: "recent_changes",
+                request_id: api.requestId,
+                upstream_request_id: api.upstreamRequestId,
+                ...apiSourceMetadata(api)
+            }
+        ],
+        program_id: input.program_id,
+        program: latest ? formatProgram(addProgramResourceLinks(readObject(latest.program) ?? {}), "compact") : undefined,
+        has_new_targets: matchingChanges.length > 0,
+        new_target_count: matchingChanges.length,
+        latest_added_at: latest ? stringField(latest, "changed_at") : undefined,
+        new_targets: formatTargetList(targets, input.target_list_mode),
+        meta: stripUndefined({
+            recent_changes_scanned: changes.length,
+            returned: targets.length,
+            has_more: matchingChanges.length > targets.length,
+            since: input.since,
+            target_type: input.target_type,
+            in_scope_only: true,
+            include_ineligible: input.include_ineligible,
+            target_list_mode: input.target_list_mode,
+            upstream_total_pages: readNumber(upstreamMeta?.total_pages),
+            scan_may_be_incomplete: (readNumber(upstreamMeta?.total_pages) ?? 1) > 1
+        })
+    });
+}
+async function checkWatchlistNewTargets(client, config, input) {
+    const watchlist = new Set(input.program_ids);
+    const api = await client.getRecentChanges({
+        change_type: "added",
+        include_removed: false,
+        include_ineligible: input.include_ineligible,
+        include_out_of_scope: false,
+        tags: input.target_type ? [input.target_type] : [],
+        page: 1,
+        page_size: input.page_size
+    });
+    const data = readObject(api.data);
+    const upstreamMeta = readObject(sanitizeJson(data?.meta));
+    const sinceTimestamp = input.since ? Date.parse(input.since) : undefined;
+    const changes = readArray(data?.results).map((change) => sanitizeChange(change, config.webBaseUrl));
+    const grouped = new Map();
+    for (const programId of input.program_ids) {
+        grouped.set(programId, {
+            program: undefined,
+            changes: [],
+            targets: [],
+            latestTimestamp: 0,
+            latestAddedAt: undefined
+        });
+    }
+    for (const change of changes) {
+        const program = readObject(change.program);
+        const programId = stringField(program, "id");
+        const target = readObject(change.target);
+        const changedAt = timestampField(change, "changed_at");
+        if (!programId ||
+            !watchlist.has(programId) ||
+            !target ||
+            stringField(change, "change_type") !== "added" ||
+            (sinceTimestamp !== undefined && changedAt < sinceTimestamp) ||
+            (input.target_type && !targetMatchesRequestedType(target, input.target_type)) ||
+            !targetHasAllowedScope(target, {
+                include_out_of_scope: false,
+                include_ineligible: input.include_ineligible,
+                strict_scope_filter: true
+            })) {
+            continue;
+        }
+        const existing = grouped.get(programId);
+        if (!existing) {
+            continue;
+        }
+        existing.program = program ? addProgramResourceLinks(program) : undefined;
+        existing.changes.push(change);
+        existing.targets.push(target);
+        if (changedAt >= existing.latestTimestamp) {
+            existing.latestTimestamp = changedAt;
+            existing.latestAddedAt = stringField(change, "changed_at");
+        }
+    }
+    const programs = input.program_ids.map((programId) => {
+        const entry = grouped.get(programId);
+        const targets = entry?.targets ?? [];
+        const limitedTargets = targets.slice(0, input.max_targets_per_program);
+        return stripUndefined({
+            program_id: programId,
+            program: entry?.program ? formatProgram(entry.program, "compact") : undefined,
+            has_new_targets: targets.length > 0,
+            new_target_count: targets.length,
+            latest_added_at: entry?.latestAddedAt,
+            new_targets: formatTargetList(limitedTargets, input.target_list_mode),
+            has_more: targets.length > limitedTargets.length
+        });
+    });
+    return stripUndefined({
+        request_id: randomUUID(),
+        source_requests: [
+            {
+                source: "recent_changes",
+                request_id: api.requestId,
+                upstream_request_id: api.upstreamRequestId,
+                ...apiSourceMetadata(api)
+            }
+        ],
+        any_new_targets: programs.some((program) => program.has_new_targets === true),
+        programs,
+        meta: stripUndefined({
+            recent_changes_scanned: changes.length,
+            watchlist_size: input.program_ids.length,
+            programs_with_new_targets: programs.filter((program) => program.has_new_targets === true).length,
+            since: input.since,
+            target_type: input.target_type,
+            in_scope_only: true,
+            include_ineligible: input.include_ineligible,
+            target_list_mode: input.target_list_mode,
+            upstream_total_pages: readNumber(upstreamMeta?.total_pages),
+            scan_may_be_incomplete: (readNumber(upstreamMeta?.total_pages) ?? 1) > 1
+        })
+    });
+}
+async function getProgramBrief(client, config, input) {
+    const programPromise = client.getProgram(input.program_id);
+    const targetsPromise = client.getProgramTargets(input.program_id);
+    const changesPromise = input.include_recent_changes && input.recent_changes_limit > 0
+        ? fetchProgramChanges(client, config, input.program_id, input.recent_changes_limit, true, input.include_ineligible, input.include_out_of_scope)
+        : Promise.resolve(undefined);
+    const [programApi, targetsApi, changes] = await Promise.all([programPromise, targetsPromise, changesPromise]);
+    const candidate = toProgramCandidate(programApi.data, config.webBaseUrl);
+    const targetsData = readObject(targetsApi.data);
+    const rawTargets = readArray(targetsData?.targets);
+    const targets = rawTargets
+        .map(sanitizeTarget)
+        .filter((target) => targetHasAllowedScope(target, {
+        include_out_of_scope: input.include_out_of_scope,
+        include_ineligible: input.include_ineligible,
+        strict_scope_filter: false
+    }));
+    const scope = buildTargetScopeSummary(targets, input.target_list_mode, input.target_sample_size, input.include_out_of_scope, input.include_ineligible);
+    return stripUndefined({
+        request_id: randomUUID(),
+        source_requests: [
+            {
+                source: "program",
+                request_id: programApi.requestId,
+                upstream_request_id: programApi.upstreamRequestId,
+                ...apiSourceMetadata(programApi)
+            },
+            {
+                source: "program_targets",
+                request_id: targetsApi.requestId,
+                upstream_request_id: targetsApi.upstreamRequestId,
+                ...apiSourceMetadata(targetsApi)
+            },
+            ...(changes?.sourceRequests ?? [])
+        ],
+        program: formatProgram(candidate.program, "compact"),
+        brief: {
+            rank_factors: rankFactors(candidate),
+            target_surface_score: targetSurfaceScore(candidate),
+            hunt_value_score: huntValueScore(candidate),
+            why_ranked_here: candidateWhy(candidate),
+            tradeoffs: candidateTradeoffs(candidate),
+            next_action: candidateNextAction(candidate)
+        },
+        target_samples: scope,
+        recent_changes: changes?.changes.map((change) => formatChange(change, "compact")),
+        meta: {
+            total_active_targets: rawTargets.length,
+            total_targets_after_filters: targets.length,
+            recent_changes_returned: changes?.changes.length ?? 0,
+            target_list_mode: input.target_list_mode
+        }
+    });
+}
+async function getProgramDelta(client, config, input) {
+    const programApi = await client.getProgram(input.program_id);
+    const program = addProgramResourceLinks(sanitizeProgram(programApi.data, config.webBaseUrl));
+    const changes = await fetchProgramChanges(client, config, input.program_id, input.page_size, input.include_removed, input.include_ineligible, input.include_out_of_scope);
+    return {
+        request_id: randomUUID(),
+        source_requests: [
+            {
+                source: "program",
+                request_id: programApi.requestId,
+                upstream_request_id: programApi.upstreamRequestId,
+                ...apiSourceMetadata(programApi)
+            },
+            ...changes.sourceRequests
+        ],
+        program,
+        changes: changes.changes,
+        meta: changes.meta
+    };
+}
+async function fetchProgramChanges(client, config, programId, pageSize, includeRemoved, includeIneligible, includeOutOfScope) {
+    const handle = programSearchText(programId);
+    const api = await client.getRecentChanges({
+        search: handle.length >= 2 ? handle : programId,
+        include_removed: includeRemoved,
+        include_ineligible: includeIneligible,
+        include_out_of_scope: includeOutOfScope,
+        page: 1,
+        page_size: pageSize
+    });
+    const data = readObject(api.data);
+    const changes = readArray(data?.results)
+        .map((change) => sanitizeChange(change, config.webBaseUrl))
+        .filter((change) => stringField(readObject(change.program), "id") === programId);
+    return {
+        changes,
+        meta: sanitizeJson(data?.meta),
+        sourceRequests: [
+            {
+                source: "recent_changes",
+                request_id: api.requestId,
+                upstream_request_id: api.upstreamRequestId,
+                ...apiSourceMetadata(api)
+            }
+        ]
+    };
+}
+function addProgramResourceLinks(program) {
+    const id = stringField(program, "id");
+    if (!id) {
+        return program;
+    }
+    return {
+        ...program,
+        resource_links: {
+            program: programResourceUri(id),
+            targets: programTargetsResourceUri(id)
+        }
+    };
+}
+function parseProgramIdFromResourceUri(uri) {
+    return programIdSchema.parse(uri.searchParams.get("program_id") ?? "");
+}
+function programResourceUri(programId) {
+    return `bbradar://program?program_id=${encodeURIComponent(programId)}`;
+}
+function programTargetsResourceUri(programId) {
+    return `bbradar://program/targets?program_id=${encodeURIComponent(programId)}`;
+}
+function exportResourceUri(exportId) {
+    return `bbradar://exports?export_id=${encodeURIComponent(exportId)}`;
+}
+function jsonResource(uri, payload) {
+    return {
+        contents: [
+            {
+                uri,
+                mimeType: "application/json",
+                text: JSON.stringify(payload)
+            }
+        ]
+    };
+}
+function rememberExport(exportStore, exportId, payload) {
+    if (exportStore.has(exportId)) {
+        exportStore.delete(exportId);
+    }
+    while (exportStore.size >= MAX_LOCAL_EXPORT_RESOURCES) {
+        const oldestKey = exportStore.keys().next().value;
+        if (oldestKey === undefined) {
+            break;
+        }
+        exportStore.delete(oldestKey);
+    }
+    exportStore.set(exportId, payload);
+}
+function previewExportPayload(payload) {
+    if (Array.isArray(payload)) {
+        return payload.slice(0, EXPORT_PREVIEW_LIMIT);
+    }
+    if (readObject(payload) && Array.isArray(payload.targets)) {
+        return {
+            ...payload,
+            targets: payload.targets.slice(0, EXPORT_PREVIEW_LIMIT)
+        };
+    }
+    return payload;
+}
+function previewExportCount(payload) {
+    if (Array.isArray(payload)) {
+        return Math.min(payload.length, EXPORT_PREVIEW_LIMIT);
+    }
+    const object = readObject(payload);
+    const targets = object?.targets;
+    if (Array.isArray(targets)) {
+        return Math.min(targets.length, EXPORT_PREVIEW_LIMIT);
+    }
+    return payload === undefined || payload === null ? 0 : 1;
+}
+function collectResourceLinks(payload) {
+    const links = new Map();
+    for (const program of extractProgramsFromPayload(payload)) {
+        const id = stringField(program, "id");
+        const resourceLinks = readObject(program.resource_links);
+        const programUri = stringField(resourceLinks, "program");
+        const targetsUri = stringField(resourceLinks, "targets");
+        if (id && programUri) {
+            links.set(programUri, {
+                type: "resource_link",
+                uri: programUri,
+                name: `${id} program`,
+                title: `${stringField(program, "name") ?? id} program`,
+                description: "Read sanitized BBRadar program details.",
+                mimeType: "application/json"
+            });
+        }
+        if (id && targetsUri) {
+            links.set(targetsUri, {
+                type: "resource_link",
+                uri: targetsUri,
+                name: `${id} targets`,
+                title: `${stringField(program, "name") ?? id} targets`,
+                description: "Read sanitized BBRadar program targets.",
+                mimeType: "application/json"
+            });
+        }
+    }
+    const exportObject = readObject(payload.export);
+    const exportUri = stringField(exportObject, "resource_uri");
+    const exportId = stringField(exportObject, "export_id");
+    if (exportUri && exportId) {
+        links.set(exportUri, {
+            type: "resource_link",
+            uri: exportUri,
+            name: `${exportId} export`,
+            title: "Target export",
+            description: "Read the full local target export payload.",
+            mimeType: "application/json"
+        });
+    }
+    return [...links.values()];
+}
+function extractProgramsFromPayload(payload) {
+    const programs = [];
+    const program = readObject(payload.program);
+    if (program) {
+        programs.push(program);
+    }
+    for (const entry of readArray(payload.programs)) {
+        const object = readObject(entry);
+        if (object) {
+            programs.push(object);
+        }
+    }
+    for (const entry of readArray(payload.compared_programs)) {
+        const object = readObject(entry);
+        if (object) {
+            programs.push(object);
+        }
+    }
+    return programs;
+}
+function readFacetValues(value) {
+    return readArray(value)
+        .map((entry) => readString(readObject(entry)?.value) ?? readString(entry))
+        .filter((entry) => entry !== undefined);
+}
+function addSetValue(values, value) {
+    if (value) {
+        values.add(value);
+    }
+}
+function addSetValues(values, entries) {
+    for (const entry of entries) {
+        addSetValue(values, entry);
+    }
+}
+function sortedValues(values) {
+    return [...values].sort((left, right) => left.localeCompare(right));
+}
+function formatProgram(program, mode) {
+    return mode === "full" ? program : compactProgram(program);
+}
+function compactProgram(program) {
+    return stripUndefined({
+        id: stringField(program, "id"),
+        handle: stringField(program, "handle"),
+        name: stringField(program, "name"),
+        platform: stringField(program, "platform"),
+        platform_url: stringField(program, "platform_url"),
+        bbradar_url: stringField(program, "bbradar_url"),
+        opportunity_tag: readObject(program.opportunity_tag),
+        reward_range: readObject(program.reward_range),
+        public_report_count: readNumber(program.public_report_count),
+        public_report_count_label: stringField(program, "public_report_count_label"),
+        first_seen_date: stringField(program, "first_seen_date"),
+        last_updated: stringField(program, "last_updated"),
+        targets_updated_at: stringField(program, "targets_updated_at"),
+        scope_summary: readObject(program.scope_summary),
+        resource_links: readObject(program.resource_links)
+    });
+}
+function candidateOutput(candidate, index, targetSamples, mode) {
+    const id = stringField(candidate.program, "id");
+    const samples = id ? targetSamples[id] : undefined;
+    const formattedSamples = samples ? formatTargetList(samples, mode === "full" ? "full" : "identifiers") : undefined;
+    if (mode === "full") {
+        return stripUndefined({
+            rank: index + 1,
+            ...candidate.program,
+            rank_factors: rankFactors(candidate),
+            target_surface_score: targetSurfaceScore(candidate),
+            why_ranked_here: candidateWhy(candidate),
+            tradeoffs: candidateTradeoffs(candidate),
+            next_action: candidateNextAction(candidate),
+            target_samples: formattedSamples
+        });
+    }
+    return stripUndefined({
+        rank: index + 1,
+        ...compactProgram(candidate.program),
+        rank_factors: rankFactors(candidate),
+        why_ranked_here: candidateWhy(candidate),
+        tradeoffs: candidateTradeoffs(candidate),
+        next_action: candidateNextAction(candidate),
+        target_samples: formattedSamples
+    });
+}
+function formatChange(change, mode) {
+    if (mode === "full") {
+        return change;
+    }
+    const target = readObject(change.target);
+    return stripUndefined({
+        id: change.id,
+        change_type: stringField(change, "change_type"),
+        changed_at: stringField(change, "changed_at"),
+        program: formatProgram(readObject(change.program) ?? {}, "compact"),
+        target: target ? compactTarget(target) : undefined
+    });
+}
+function buildTargetScopeSummary(targets, mode, groupLimit, includeOutOfScope, includeIneligible) {
+    const bountyTargets = targets.filter((target) => target.in_scope === true && target.eligible_for_bounty === true);
+    const groups = {
+        in_scope_bounty_domains: bountyTargets.filter(targetIsDomain),
+        wildcards: bountyTargets.filter(targetIsWildcard),
+        apis: bountyTargets.filter(targetIsApi),
+        mobile: bountyTargets.filter(targetIsMobile),
+        source_code: bountyTargets.filter(targetIsSourceCode)
+    };
+    const classified = new Set(Object.values(groups).flat());
+    groups.other_in_scope_bounty = bountyTargets.filter((target) => !classified.has(target));
+    if (includeOutOfScope) {
+        groups.out_of_scope = targets.filter((target) => target.in_scope === false);
+    }
+    if (includeIneligible) {
+        groups.ineligible = targets.filter((target) => target.eligible_for_bounty === false);
+    }
+    const groupCounts = Object.fromEntries(Object.entries(groups).map(([name, entries]) => [name, entries.length]));
+    const formattedGroups = Object.fromEntries(Object.entries(groups).map(([name, entries]) => [name, formatTargetList(entries.slice(0, groupLimit), mode)]));
+    const groupHasMore = Object.fromEntries(Object.entries(groups).map(([name, entries]) => [name, entries.length > groupLimit]));
+    return {
+        target_counts: {
+            total: targets.length,
+            in_scope: targets.filter((target) => target.in_scope === true).length,
+            out_of_scope: targets.filter((target) => target.in_scope === false).length,
+            eligible_for_bounty: targets.filter((target) => target.eligible_for_bounty === true).length,
+            in_scope_bounty: bountyTargets.length,
+            wildcard: targets.filter(targetIsWildcard).length,
+            api: targets.filter(targetIsApi).length,
+            mobile: targets.filter(targetIsMobile).length,
+            source_code: targets.filter(targetIsSourceCode).length
+        },
+        group_counts: groupCounts,
+        group_has_more: groupHasMore,
+        groups: formattedGroups
+    };
+}
+function countTargetValues(targets, readValues) {
+    const counts = new Map();
+    for (const target of targets) {
+        const rawValues = readValues(target);
+        const values = Array.isArray(rawValues) ? rawValues : rawValues === undefined ? [] : [rawValues];
+        for (const value of values) {
+            const normalized = value.trim();
+            if (normalized.length > 0) {
+                counts.set(normalized, (counts.get(normalized) ?? 0) + 1);
+            }
+        }
+    }
+    return Object.fromEntries([...counts.entries()].sort((left, right) => right[1] - left[1] || left[0].localeCompare(right[0])));
+}
+function buildScopeDelta(changes, targetListMode) {
+    const byChangeType = new Map();
+    let latestTimestamp = 0;
+    let latestChangedAt;
+    for (const change of changes) {
+        const changeType = stringField(change, "change_type") ?? "unknown";
+        const target = readObject(change.target);
+        const timestamp = timestampField(change, "changed_at");
+        const existing = byChangeType.get(changeType) ??
+            {
+                changes: [],
+                targets: [],
+                latestTimestamp: 0,
+                latestChangedAt: undefined
+            };
+        existing.changes.push(change);
+        if (target) {
+            existing.targets.push(target);
+        }
+        if (timestamp >= existing.latestTimestamp) {
+            existing.latestTimestamp = timestamp;
+            existing.latestChangedAt = stringField(change, "changed_at");
+        }
+        if (timestamp >= latestTimestamp) {
+            latestTimestamp = timestamp;
+            latestChangedAt = stringField(change, "changed_at");
+        }
+        byChangeType.set(changeType, existing);
+    }
+    return stripUndefined({
+        total_changes: changes.length,
+        latest_changed_at: latestChangedAt,
+        change_counts: Object.fromEntries([...byChangeType.entries()].map(([changeType, entry]) => [changeType, entry.changes.length])),
+        targets_by_change_type: Object.fromEntries([...byChangeType.entries()].map(([changeType, entry]) => [changeType, formatTargetList(entry.targets, targetListMode)])),
+        latest_by_change_type: Object.fromEntries([...byChangeType.entries()].map(([changeType, entry]) => [changeType, entry.latestChangedAt]))
+    });
+}
+function rankFactors(candidate) {
+    return stripUndefined({
+        public_report_count: candidate.publicReportCount,
+        public_report_count_label: stringField(candidate.program, "public_report_count_label"),
+        bounty_min: candidate.bountyMin,
+        bounty_max: candidate.bountyMax,
+        total_targets: candidate.totalTargetCount,
+        in_scope_targets: candidate.inScopeTargetCount,
+        eligible_targets: candidate.eligibleTargetCount,
+        wildcard_targets: candidate.wildcardCount,
+        added_24h: candidate.added24h,
+        added_7d: candidate.added7d,
+        opportunity_tier: candidate.opportunityTier,
+        opportunity_score: candidate.opportunityScore,
+        target_surface_score: targetSurfaceScore(candidate),
+        hunt_value_score: huntValueScore(candidate)
+    });
+}
+function candidateWhy(candidate) {
+    const reasons = [];
+    if (candidate.publicReportCount !== undefined) {
+        const label = stringField(candidate.program, "public_report_count_label");
+        reasons.push(label ? `${candidate.publicReportCount} ${label}` : `${candidate.publicReportCount} public reports`);
+    }
+    if (candidate.bountyMax !== undefined) {
+        reasons.push(`max bounty ${candidate.bountyMax}`);
+    }
+    if (candidate.eligibleTargetCount !== undefined) {
+        reasons.push(`${candidate.eligibleTargetCount} eligible targets`);
+    }
+    if (candidate.wildcardCount > 0) {
+        reasons.push(`${candidate.wildcardCount} wildcard targets`);
+    }
+    if (candidateHasWeb3Surface(candidate)) {
+        reasons.push("Web3/blockchain scope signals");
+    }
+    if (candidate.added7d !== undefined && candidate.added7d > 0) {
+        reasons.push(`${candidate.added7d} targets added in 7d`);
+    }
+    if (candidate.opportunityTier) {
+        reasons.push(`${candidate.opportunityTier} opportunity tier`);
+    }
+    return reasons;
+}
+function candidateTradeoffs(candidate) {
+    const tradeoffs = [];
+    if (candidate.publicReportCount === undefined) {
+        tradeoffs.push("public report count is unknown");
+    }
+    if ((candidate.bountyMax ?? candidate.bountyMin ?? 0) <= 0) {
+        tradeoffs.push("no bounty range exposed");
+    }
+    else if ((candidate.bountyMax ?? 0) < 1_000) {
+        tradeoffs.push("lower reward ceiling");
+    }
+    if (candidate.wildcardCount === 0) {
+        tradeoffs.push("no wildcard targets in BBRadar counts");
+    }
+    else if (candidate.wildcardCount === 1) {
+        tradeoffs.push("only one wildcard target in BBRadar counts");
+    }
+    if ((candidate.eligibleTargetCount ?? 0) <= 0) {
+        tradeoffs.push("no bounty-eligible target count exposed");
+    }
+    if (candidateLooksLikeCtf(candidate)) {
+        tradeoffs.push("program appears CTF-like");
+    }
+    if (candidateLooksMobileOnly(candidate)) {
+        tradeoffs.push("appears mobile-only from available tags");
+    }
+    return tradeoffs;
+}
+function candidateNextAction(candidate) {
+    if (candidate.wildcardCount > 0) {
+        return "Review in-scope wildcard targets with get_program_targets and keep follow-up analysis passive and BBRadar-data-backed.";
+    }
+    if (candidateHasApiSurface(candidate)) {
+        return "Review API targets with get_program_targets and summarize the allowed API scope from BBRadar data.";
+    }
+    if (candidateHasWebSurface(candidate)) {
+        return "Review web/domain targets with get_program_targets and summarize freshness, reward, and report-count signals.";
+    }
+    return "Fetch exact scope with get_program_targets before making recommendations.";
+}
+function targetSurfaceScore(candidate) {
+    return candidate.targetSurfaceScore;
+}
+function calculateTargetSurfaceScore(candidate) {
+    let score = 0;
+    score += Math.min(candidate.wildcardCount, 10) * 10;
+    score += Math.min(candidate.eligibleTargetCount ?? 0, 25) * 2;
+    if (candidateHasApiSurface(candidate)) {
+        score += 20;
+    }
+    if (candidateHasWebSurface(candidate)) {
+        score += 15;
+    }
+    if (candidateHasWeb3Surface(candidate)) {
+        score += 15;
+    }
+    if (candidateHasMobileSurface(candidate)) {
+        score += 8;
+    }
+    return score;
+}
+function huntValueScore(candidate) {
+    return candidate.huntValueScore;
+}
+function calculateHuntValueScore(candidate) {
+    const reports = candidate.publicReportCount;
+    const competitionScore = reports === undefined ? 20 : Math.max(0, 100 - Math.min(reports, 100));
+    const rewardScore = Math.min(candidate.bountyMax ?? candidate.bountyMin ?? 0, 50_000) / 500;
+    const freshnessScore = freshnessScoreFor(candidate);
+    const opportunityScore = candidate.opportunityScore ?? 0;
+    const surfaceScore = Math.min(targetSurfaceScore(candidate), 100);
+    const platformScore = platformWeight(candidate);
+    const ctfPenalty = candidateLooksLikeCtf(candidate) ? 50 : 0;
+    return Math.round((competitionScore * 0.3 + rewardScore * 0.2 + surfaceScore * 0.2 + freshnessScore * 0.15 + opportunityScore * 0.1 + platformScore * 0.05 - ctfPenalty) * 100) / 100;
+}
+function freshnessScoreFor(candidate) {
+    const timestamps = [candidate.firstSeenTime, candidate.lastUpdatedTime, candidate.latestChangeTime].filter((value) => value > 0);
+    if (timestamps.length === 0) {
+        return 0;
+    }
+    const newest = Math.max(...timestamps);
+    const ageDays = Math.max(0, (Date.now() - newest) / (24 * 60 * 60 * 1000));
+    return Math.max(0, 100 - ageDays);
+}
+function platformWeight(candidate) {
+    const platform = normalizeTag(stringField(candidate.program, "platform") ?? "");
+    const weights = {
+        hackerone: 100,
+        bugcrowd: 95,
+        intigriti: 90,
+        yeswehack: 85,
+        hackenproof: 80,
+        issuehunt: 70,
+        bugrap: 60
+    };
+    return weights[platform] ?? 50;
+}
+function candidateHasApiSurface(candidate) {
+    return candidate.hasApiSurface;
+}
+function candidateHasWebSurface(candidate) {
+    return candidate.hasWebSurface;
+}
+function candidateHasWeb3Surface(candidate) {
+    return candidate.hasWeb3Surface;
+}
+function candidateHasMobileSurface(candidate) {
+    return candidate.hasMobileSurface;
+}
+function candidateLooksMobileOnly(candidate) {
+    return candidate.looksMobileOnly;
+}
+function candidateLooksLikeCtf(candidate) {
+    return candidate.looksLikeCtf;
+}
+function candidateLooksContestLike(candidate) {
+    return tagIncludesAnyNormalized(candidate.normalizedSearchSignals, WEB3_CONTEST_SIGNALS);
+}
+function candidateHasKnownNoBounty(candidate) {
+    if (candidate.bountyMin === undefined && candidate.bountyMax === undefined) {
+        return false;
+    }
+    return (candidate.bountyMin ?? 0) <= 0 && (candidate.bountyMax ?? 0) <= 0;
+}
+function candidateLooksLikeVdp(candidate) {
+    return candidateHasKnownNoBounty(candidate) || tagIncludesAnyNormalized(candidate.normalizedSearchSignals, VDP_SIGNALS);
+}
+function programResolutionMatch(candidate, query) {
+    const normalizedQuery = normalizeTag(query);
+    const queryTokens = tokenSet(normalizedQuery);
+    const fields = [
+        { name: "id", value: stringField(candidate.program, "id") },
+        { name: "handle", value: stringField(candidate.program, "handle") },
+        { name: "name", value: stringField(candidate.program, "name") },
+        { name: "platform", value: stringField(candidate.program, "platform") },
+        { name: "platform_url", value: stringField(candidate.program, "platform_url") },
+        { name: "bbradar_url", value: stringField(candidate.program, "bbradar_url") }
+    ];
+    let score = 0;
+    const matchedFields = new Set();
+    const reasons = new Set();
+    for (const field of fields) {
+        if (!field.value) {
+            continue;
+        }
+        const normalizedValue = normalizeTag(field.value);
+        const fieldTokens = tokenSet(normalizedValue);
+        if (normalizedValue === normalizedQuery) {
+            score = Math.max(score, field.name === "id" || field.name === "handle" ? 100 : 95);
+            matchedFields.add(field.name);
+            reasons.add(`${field.name} exact match`);
+            continue;
+        }
+        if (normalizedValue.includes(normalizedQuery)) {
+            score = Math.max(score, field.name === "name" || field.name === "handle" ? 80 : 65);
+            matchedFields.add(field.name);
+            reasons.add(`${field.name} contains query`);
+        }
+        const tokenOverlap = [...queryTokens].filter((token) => fieldTokens.has(token)).length;
+        if (tokenOverlap > 0) {
+            const tokenScore = Math.round((tokenOverlap / Math.max(queryTokens.size, 1)) * 70);
+            score = Math.max(score, tokenScore);
+            matchedFields.add(field.name);
+            reasons.add(`${field.name} token match`);
+        }
+    }
+    if (candidate.normalizedSearchSignals.some((signal) => signal.includes(normalizedQuery))) {
+        score = Math.max(score, 55);
+        matchedFields.add("search_signals");
+        reasons.add("program search signals contain query");
+    }
+    return {
+        score,
+        fields: [...matchedFields],
+        reasons: [...reasons]
+    };
+}
+function normalizedCandidateValues(program, normalizedScopeTags) {
+    return [
+        stringField(program, "id"),
+        stringField(program, "handle"),
+        stringField(program, "name"),
+        stringField(program, "platform"),
+        stringField(program, "platform_url"),
+        stringField(program, "bbradar_url")
+    ]
+        .filter((value) => value !== undefined)
+        .map(normalizeTag)
+        .concat(normalizedScopeTags);
+}
+function tagIncludesAnyNormalized(normalizedTags, needles) {
+    return needles.some((needle) => normalizedTags.some((tag) => tag === needle || tag.includes(needle)));
+}
+function candidateMatchesAnyTag(candidate, values) {
+    const normalizedValues = values.map(normalizeTag);
+    return normalizedValues.some((value) => candidate.normalizedScopeTags.some((tag) => tag === value || tag.includes(value) || value.includes(tag)) ||
+        candidate.normalizedSearchSignals.some((signal) => signal === value || signal.includes(value)));
+}
+function programFetchError(programId, error) {
+    if (error instanceof BBRadarApiError) {
+        return stripUndefined({
+            program_id: programId,
+            request_id: error.requestId,
+            upstream_request_id: error.upstreamRequestId,
+            status: error.status,
+            message: error.message,
+            detail: sanitizeJson(error.detail),
+            errors: sanitizeJson(error.errors),
+            suggested_fix: "Check that the program_id uses BBRadar platform:handle format. Spaces and slashes are supported and are encoded by the MCP server."
+        });
+    }
+    return {
+        program_id: programId,
+        message: error instanceof Error ? error.message : String(error),
+        suggested_fix: "Retry the program lookup or verify the BBRadar program id."
+    };
+}
+function programSearchText(programId) {
+    const colonIndex = programId.indexOf(":");
+    const handle = colonIndex >= 0 ? programId.slice(colonIndex + 1) : programId;
+    const lastPathSegment = handle.split("/").filter(Boolean).at(-1) ?? handle;
+    return lastPathSegment.length >= 2 ? lastPathSegment : handle;
+}
+function normalizeFindProgramsInput(input) {
+    const warnings = [];
+    const normalized = { ...input };
+    normalized.max_pages = clampLimit("max_pages", normalized.max_pages, MAX_FIND_PROGRAM_PAGES, warnings);
+    normalized.max_results = clampLimit("max_results", normalized.max_results, MAX_FIND_PROGRAM_RESULTS, warnings);
+    normalized.target_sample_programs = clampLimit("target_sample_programs", normalized.target_sample_programs, MAX_FIND_TARGET_SAMPLE_PROGRAMS, warnings);
+    normalized.target_sample_size = clampLimit("target_sample_size", normalized.target_sample_size, MAX_FIND_TARGET_SAMPLES, warnings);
+    normalized.upstream_request_budget = clampLimit("upstream_request_budget", normalized.upstream_request_budget, MAX_FIND_UPSTREAM_REQUEST_BUDGET, warnings);
+    if (normalized.target_samples_only_wildcards) {
+        normalized.target_sample_programs = clampLimit("target_sample_programs", normalized.target_sample_programs, MAX_WILDCARD_TARGET_SAMPLE_PROGRAMS, warnings);
+        normalized.target_sample_size = clampLimit("target_sample_size", normalized.target_sample_size, MAX_WILDCARD_TARGET_SAMPLES, warnings);
+    }
+    return { input: normalized, warnings };
+}
+function clampLimit(name, value, max, warnings) {
+    if (value <= max) {
+        return value;
+    }
+    warnings.push(`${name} was clamped from ${value} to ${max}.`);
+    return max;
+}
+async function findPrograms(client, config, input) {
+    const normalized = normalizeFindProgramsInput(input);
+    const warnings = normalized.warnings;
+    input = normalized.input;
+    const budget = {
+        initial: input.upstream_request_budget,
+        remaining: input.upstream_request_budget
+    };
+    const upstreamTags = uniqueStrings([...input.tags, ...input.scope_tags, ...input.target_types, ...input.language_tags]);
+    const collected = await collectPrograms(client, {
+        platforms: input.platforms,
+        tags: upstreamTags,
+        updated_since: input.updated_since,
+        opportunity_levels: input.opportunity_levels,
+        max_pages: input.max_pages,
+        budget,
+        warnings
+    });
+    const filteredCandidates = collected.programs
+        .map((program) => toProgramCandidate(program, config.webBaseUrl))
+        .filter((program) => programCandidateMatches(program, input))
+        .sort((left, right) => compareProgramCandidates(left, right, input.sort_by));
+    const candidates = filteredCandidates.slice(0, input.max_results);
+    const targetSamplePrograms = Math.min(input.target_sample_programs, candidates.length, Math.max(0, budget.remaining));
+    if (input.include_target_samples && input.target_sample_programs > targetSamplePrograms) {
+        warnings.push(`target_sample_programs was reduced from ${input.target_sample_programs} to ${targetSamplePrograms} to stay within the upstream request budget.`);
+    }
+    const targetSamples = input.include_target_samples && targetSamplePrograms > 0
+        ? await collectTargetSamples(client, candidates, { ...input, target_sample_programs: targetSamplePrograms }, budget)
+        : {};
+    const outputMode = input.output_mode ?? "compact";
+    const programs = candidates.map((candidate, index) => candidateOutput(candidate, index, targetSamples, outputMode));
+    return stripUndefined({
+        request_id: randomUUID(),
+        source_requests: collected.sourceRequests,
+        fetched_at: new Date().toISOString(),
+        warnings: warnings.length > 0 ? warnings : undefined,
+        filters: stripUndefined({
+            platforms: input.platforms.length > 0 ? input.platforms : undefined,
+            tags: upstreamTags.length > 0 ? upstreamTags : undefined,
+            web3: input.web3 ? true : undefined,
+            opportunity_levels: input.opportunity_levels.length > 0 ? input.opportunity_levels : undefined,
+            updated_since: input.updated_since,
+            min_bounty_min: input.min_bounty_min,
+            min_bounty_max: input.min_bounty_max,
+            max_bounty_max: input.max_bounty_max,
+            require_bounty: input.require_bounty,
+            max_public_report_count: input.max_public_report_count,
+            require_known_report_count: input.require_known_report_count,
+            include_unknown_report_count: input.include_unknown_report_count,
+            exclude_ctf: input.exclude_ctf,
+            exclude_mobile_only: input.exclude_mobile_only,
+            exclude_non_web: input.exclude_non_web,
+            has_api_scope: input.has_api_scope,
+            contest_like: input.contest_like ? true : undefined,
+            vdp_mode: input.vdp_mode && input.vdp_mode !== "include" ? input.vdp_mode : undefined,
+            fresh_launch_days: input.fresh_launch_days,
+            min_wildcards: input.min_wildcards,
+            min_eligible_targets: input.min_eligible_targets,
+            min_total_targets: input.min_total_targets,
+            min_added_24h: input.min_added_24h,
+            min_added_7d: input.min_added_7d,
+            sort_by: input.sort_by,
+            output_mode: outputMode
+        }),
+        upstream_budget: {
+            used: budget.initial - budget.remaining,
+            remaining: budget.remaining
+        },
+        ranking_scope: {
+            mode: "sampled",
+            max_pages_scanned_per_source: input.max_pages,
+            upstream_total_pages: collected.totalPagesBySource,
+            possibly_incomplete: isRankingPossiblyIncomplete(collected.totalPagesBySource, input.max_pages)
+        },
+        programs,
+        meta: {
+            returned: programs.length,
+            total_candidates_after_filters: filteredCandidates.length,
+            upstream_requests_scanned: collected.requestsScanned,
+            programs_scanned: collected.programsScanned,
+            upstream_total_pages: collected.totalPagesBySource
+        }
+    });
+}
+async function collectPrograms(client, options) {
+    const sources = options.opportunity_levels.length > 0
+        ? options.opportunity_levels.map((level) => ({ kind: "opportunity", level }))
+        : [{ kind: "programs" }];
+    const collectionOptions = {
+        ...options,
+        runWithProgramPageSlot: createAsyncLimiter(PROGRAM_COLLECTION_CONCURRENCY)
+    };
+    const pagesBySource = await collectProgramSources(client, sources, collectionOptions);
+    const programs = new Map();
+    const sourceRequests = [];
+    const totalPagesBySource = {};
+    for (const page of pagesBySource.sort(compareProgramPageResults)) {
+        for (const program of page.programs) {
+            programs.set(programKey(program, programs.size), program);
+        }
+        totalPagesBySource[page.sourceName] = page.totalPages;
+        sourceRequests.push(page.sourceRequest);
+    }
+    return {
+        programs: [...programs.values()],
+        sourceRequests,
+        requestsScanned: pagesBySource.length,
+        programsScanned: programs.size,
+        totalPagesBySource
+    };
+}
+async function collectProgramSources(client, sources, options) {
+    const pages = [];
+    await mapWithConcurrency(sources.map((source, sourceIndex) => ({ source, sourceIndex })), PROGRAM_COLLECTION_CONCURRENCY, async ({ source, sourceIndex }) => {
+        pages.push(...(await collectProgramSource(client, source, sourceIndex, options)));
+    });
+    return pages;
+}
+async function collectProgramSource(client, source, sourceIndex, options) {
+    const firstPage = await fetchProgramPage(client, source, sourceIndex, 1, options);
+    if (!firstPage) {
+        return [];
+    }
+    if (firstPage.programs.length === 0 || firstPage.totalPages === 1 || options.max_pages === 1) {
+        return [firstPage];
+    }
+    const maxKnownPage = firstPage.totalPages === undefined ? undefined : Math.min(firstPage.totalPages, options.max_pages);
+    if (maxKnownPage === undefined) {
+        const pages = [firstPage];
+        for (let page = 2; page <= options.max_pages; page += 1) {
+            const nextPage = await fetchProgramPage(client, source, sourceIndex, page, options);
+            if (!nextPage) {
+                break;
+            }
+            pages.push(nextPage);
+            if (nextPage.programs.length === 0 || (nextPage.totalPages !== undefined && page >= nextPage.totalPages)) {
+                break;
+            }
+        }
+        return pages;
+    }
+    const remainingPageNumbers = Array.from({ length: Math.max(0, maxKnownPage - 1) }, (_, index) => index + 2);
+    const remainingPages = [];
+    await mapWithConcurrency(remainingPageNumbers, PROGRAM_COLLECTION_CONCURRENCY, async (page) => {
+        const result = await fetchProgramPage(client, source, sourceIndex, page, options);
+        if (result) {
+            remainingPages.push(result);
+        }
+    });
+    return [firstPage, ...remainingPages];
+}
+async function fetchProgramPage(client, source, sourceIndex, page, options) {
+    const runWithSlot = options.runWithProgramPageSlot ?? runImmediately;
+    return runWithSlot(async () => {
+        const query = toQuery({
+            platforms: options.platforms,
+            tags: options.tags,
+            updated_since: options.updated_since,
+            page,
+            page_size: MAX_PROGRAMS_PER_SEARCH
+        });
+        if (!tryConsumeBudget(options.budget)) {
+            addUniqueWarning(options.warnings, "Upstream request budget was exhausted before all requested program pages could be fetched.");
+            return undefined;
+        }
+        const api = source.kind === "opportunity" ? await client.getOpportunities(source.level, query) : await client.listPrograms(query);
+        refundBudgetIfNoUpstreamRequest(options.budget, api);
+        const data = readObject(api.data);
+        const meta = readObject(data?.meta);
+        const sourceName = source.kind === "opportunity" ? `opportunities:${source.level}` : "programs";
+        return {
+            sourceName,
+            sourceIndex,
+            page,
+            programs: readArray(data?.programs),
+            totalPages: readNumber(meta?.total_pages),
+            sourceRequest: stripUndefined({
+                source: sourceName,
+                request_id: api.requestId,
+                upstream_request_id: api.upstreamRequestId,
+                ...apiSourceMetadata(api),
+                page
+            })
+        };
+    });
+}
+function compareProgramPageResults(left, right) {
+    return left.sourceIndex - right.sourceIndex || left.page - right.page;
+}
+function toProgramCandidate(rawProgram, webBaseUrl) {
+    const program = addProgramResourceLinks(sanitizeProgram(rawProgram, webBaseUrl));
+    const scopeSummary = readObject(program.scope_summary);
+    const targetCounts = readObject(scopeSummary?.target_counts);
+    const targetActivity = readObject(scopeSummary?.target_activity);
+    const rewardRange = readObject(program.reward_range);
+    const opportunityTag = readObject(program.opportunity_tag);
+    const scopeTags = readStringArrayField(scopeSummary ?? {}, "tags");
+    const normalizedScopeTags = scopeTags.map(normalizeTag);
+    const normalizedSearchSignals = normalizedCandidateValues(program, normalizedScopeTags);
+    const hasApiSurface = tagIncludesAnyNormalized(normalizedScopeTags, ["api", "graphql", "rest"]);
+    const hasWebSurface = (numberField(targetCounts, "wildcard") ?? 0) > 0 ||
+        tagIncludesAnyNormalized(normalizedScopeTags, ["domain", "web", "url", "api", "http", "javascript"]);
+    const hasWeb3Surface = tagIncludesAnyNormalized(normalizedScopeTags, WEB3_TAGS) ||
+        tagIncludesAnyNormalized(normalizedSearchSignals, WEB3_TAGS);
+    const hasMobileSurface = tagIncludesAnyNormalized(normalizedScopeTags, ["android", "ios", "mobile"]);
+    const looksLikeCtf = normalizedSearchSignals.some((value) => value.includes("ctf") || value.includes("capture the flag"));
+    const candidate = {
+        program,
+        scopeTags,
+        normalizedScopeTags,
+        normalizedSearchSignals,
+        publicReportCount: numberField(program, "public_report_count"),
+        bountyMin: numberField(rewardRange, "min"),
+        bountyMax: numberField(rewardRange, "max"),
+        totalTargetCount: numberField(targetCounts, "total"),
+        inScopeTargetCount: numberField(targetCounts, "in_scope"),
+        outOfScopeTargetCount: numberField(targetCounts, "out_of_scope"),
+        eligibleTargetCount: numberField(targetCounts, "eligible_for_bounty"),
+        wildcardCount: numberField(targetCounts, "wildcard") ?? 0,
+        added24h: numberField(targetActivity, "added_24h"),
+        added7d: numberField(targetActivity, "added_7d"),
+        removed7d: numberField(targetActivity, "removed_7d"),
+        opportunityScore: numberField(opportunityTag, "opportunity_score"),
+        opportunityTier: stringField(opportunityTag, "tier"),
+        lastUpdatedTime: timestampField(program, "last_updated"),
+        firstSeenTime: timestampField(program, "first_seen_date"),
+        latestChangeTime: timestampField(targetActivity ?? {}, "latest_change_at"),
+        hasApiSurface,
+        hasWebSurface,
+        hasWeb3Surface,
+        hasMobileSurface,
+        looksMobileOnly: hasMobileSurface && !tagIncludesAnyNormalized(normalizedScopeTags, ["domain", "web", "url", "api", "http", "javascript"]),
+        looksLikeCtf,
+        targetSurfaceScore: 0,
+        huntValueScore: 0
+    };
+    candidate.targetSurfaceScore = calculateTargetSurfaceScore(candidate);
+    candidate.huntValueScore = calculateHuntValueScore(candidate);
+    return candidate;
+}
+function programCandidateMatches(candidate, filters) {
+    if (filters.platforms.length > 0 && !filters.platforms.map(normalizeTag).includes(normalizeTag(stringField(candidate.program, "platform") ?? ""))) {
+        return false;
+    }
+    if (filters.tags.length > 0 && !candidateMatchesAnyTag(candidate, filters.tags)) {
+        return false;
+    }
+    if (filters.web3 && !candidateHasWeb3Surface(candidate)) {
+        return false;
+    }
+    if (filters.scope_tags.length > 0 && !candidateMatchesAnyTag(candidate, filters.scope_tags)) {
+        return false;
+    }
+    if (filters.target_types.length > 0 && !candidateMatchesAnyTag(candidate, filters.target_types)) {
+        return false;
+    }
+    if (filters.language_tags.length > 0 && !candidateMatchesAnyTag(candidate, filters.language_tags)) {
+        return false;
+    }
+    if (candidate.wildcardCount < filters.min_wildcards) {
+        return false;
+    }
+    if (filters.require_bounty && (candidate.bountyMax ?? candidate.bountyMin ?? 0) <= 0) {
+        return false;
+    }
+    if (filters.min_bounty_min !== undefined && (candidate.bountyMin ?? 0) < filters.min_bounty_min) {
+        return false;
+    }
+    if (filters.min_bounty_max !== undefined && (candidate.bountyMax ?? 0) < filters.min_bounty_max) {
+        return false;
+    }
+    if (filters.max_bounty_max !== undefined && (candidate.bountyMax ?? Number.POSITIVE_INFINITY) > filters.max_bounty_max) {
+        return false;
+    }
+    if (filters.require_known_report_count && candidate.publicReportCount === undefined) {
+        return false;
+    }
+    if (filters.max_public_report_count !== undefined) {
+        if (candidate.publicReportCount === undefined) {
+            return filters.include_unknown_report_count;
+        }
+        if (candidate.publicReportCount > filters.max_public_report_count) {
+            return false;
+        }
+    }
+    if (filters.exclude_ctf && candidateLooksLikeCtf(candidate)) {
+        return false;
+    }
+    if (filters.exclude_mobile_only && candidateLooksMobileOnly(candidate)) {
+        return false;
+    }
+    if (filters.exclude_non_web && !candidateHasWebSurface(candidate)) {
+        return false;
+    }
+    if (filters.has_api_scope && !candidateHasApiSurface(candidate)) {
+        return false;
+    }
+    if (filters.contest_like === true && !candidateLooksContestLike(candidate)) {
+        return false;
+    }
+    if (filters.vdp_mode === "exclude" && candidateLooksLikeVdp(candidate)) {
+        return false;
+    }
+    if (filters.vdp_mode === "only_likely" && !candidateLooksLikeVdp(candidate)) {
+        return false;
+    }
+    if (filters.vdp_mode === "only_known_no_bounty" && !candidateHasKnownNoBounty(candidate)) {
+        return false;
+    }
+    if (filters.fresh_launch_days !== undefined) {
+        const firstSeen = candidate.firstSeenTime;
+        const cutoff = Date.now() - filters.fresh_launch_days * 24 * 60 * 60 * 1000;
+        if (firstSeen <= 0 || firstSeen < cutoff) {
+            return false;
+        }
+    }
+    if (filters.min_eligible_targets !== undefined && (candidate.eligibleTargetCount ?? 0) < filters.min_eligible_targets) {
+        return false;
+    }
+    if (filters.min_total_targets !== undefined && (candidate.totalTargetCount ?? 0) < filters.min_total_targets) {
+        return false;
+    }
+    if (filters.min_added_24h !== undefined && (candidate.added24h ?? 0) < filters.min_added_24h) {
+        return false;
+    }
+    if (filters.min_added_7d !== undefined && (candidate.added7d ?? 0) < filters.min_added_7d) {
+        return false;
+    }
+    return true;
+}
+function compareProgramCandidates(left, right, sortBy) {
+    if (sortBy === "best_hunt_value") {
+        return compareNumbersDesc(huntValueScore(left), huntValueScore(right)) || compareLowestReports(left, right);
+    }
+    if (sortBy === "lowest_reports") {
+        return compareLowestReports(left, right);
+    }
+    if (sortBy === "highest_reward") {
+        return compareNumbersDesc(left.bountyMax, right.bountyMax) || compareLowestReports(left, right);
+    }
+    if (sortBy === "most_wildcards") {
+        return compareNumbersDesc(left.wildcardCount, right.wildcardCount) || compareLowestReports(left, right);
+    }
+    if (sortBy === "most_eligible_targets") {
+        return compareNumbersDesc(left.eligibleTargetCount, right.eligibleTargetCount) || compareLowestReports(left, right);
+    }
+    if (sortBy === "freshest") {
+        return right.firstSeenTime - left.firstSeenTime || compareLowestReports(left, right);
+    }
+    if (sortBy === "recently_updated") {
+        return Math.max(right.lastUpdatedTime, right.latestChangeTime) - Math.max(left.lastUpdatedTime, left.latestChangeTime) || compareLowestReports(left, right);
+    }
+    if (sortBy === "highest_opportunity_score") {
+        return compareNumbersDesc(left.opportunityScore, right.opportunityScore) || compareLowestReports(left, right);
+    }
+    if (sortBy === "most_new_targets") {
+        return compareNumbersDesc(left.added7d, right.added7d) || compareNumbersDesc(left.added24h, right.added24h) || compareLowestReports(left, right);
+    }
+    return (compareNumbersDesc(huntValueScore(left), huntValueScore(right)) ||
+        compareNumbersDesc(left.opportunityScore, right.opportunityScore) ||
+        compareLowestReports(left, right) ||
+        compareNumbersDesc(left.bountyMax, right.bountyMax) ||
+        compareNumbersDesc(left.wildcardCount, right.wildcardCount) ||
+        compareNumbersDesc(left.eligibleTargetCount, right.eligibleTargetCount) ||
+        right.firstSeenTime - left.firstSeenTime ||
+        right.lastUpdatedTime - left.lastUpdatedTime);
+}
+async function collectTargetSamples(client, candidates, input, budget) {
+    const samples = {};
+    const sampleCandidates = candidates.slice(0, input.target_sample_programs);
+    const sampleFilters = targetSampleFilters(input);
+    await mapWithConcurrency(sampleCandidates, TARGET_SAMPLE_CONCURRENCY, async (candidate) => {
+        const programId = stringField(candidate.program, "id");
+        if (!programId) {
+            return;
+        }
+        try {
+            if (!tryConsumeBudget(budget)) {
+                samples[programId] = [];
+                return;
+            }
+            const api = await client.getProgramTargets(programId);
+            refundBudgetIfNoUpstreamRequest(budget, api);
+            const data = readObject(api.data);
+            const targets = readArray(data?.targets)
+                .map(sanitizeTarget)
+                .filter((target) => targetMatchesSampleFilters(target, sampleFilters))
+                .slice(0, input.target_sample_size);
+            samples[programId] = targets;
+        }
+        catch {
+            samples[programId] = [];
+        }
+    });
+    return samples;
+}
+function targetSampleFilters(input) {
+    return {
+        targetSamplesOnlyWildcards: input.target_samples_only_wildcards,
+        onlyInScopeTargets: input.only_in_scope_targets,
+        onlyBountyEligibleTargets: input.only_bounty_eligible_targets,
+        targetTypes: new Set(input.target_types.map(normalizeTag)),
+        scopeTags: new Set(input.scope_tags.map(normalizeTag)),
+        languageTags: new Set(input.language_tags.map(normalizeTag))
+    };
+}
+function targetMatchesSampleFilters(target, filters) {
+    if (filters.targetSamplesOnlyWildcards && readBoolean(target.wildcard) !== true) {
+        return false;
+    }
+    if (filters.onlyInScopeTargets && target.in_scope !== true) {
+        return false;
+    }
+    if (filters.onlyBountyEligibleTargets && target.eligible_for_bounty !== true) {
+        return false;
+    }
+    if (filters.targetTypes.size > 0 && !filters.targetTypes.has(normalizeTag(readString(target.target_type) ?? ""))) {
+        return false;
+    }
+    if (filters.scopeTags.size > 0 && !arraysIntersectNormalized(filters.scopeTags, readStringArrayField(target, "scope_tags"))) {
+        return false;
+    }
+    if (filters.languageTags.size > 0 && !arraysIntersectNormalized(filters.languageTags, readStringArrayField(target, "language_tags"))) {
+        return false;
+    }
+    return true;
+}
+function compareLowestReports(left, right) {
+    return (compareNumbersAsc(left.publicReportCount, right.publicReportCount) ||
+        compareNumbersDesc(left.bountyMax, right.bountyMax) ||
+        compareNumbersDesc(left.wildcardCount, right.wildcardCount) ||
+        compareNumbersDesc(left.eligibleTargetCount, right.eligibleTargetCount) ||
+        compareNumbersDesc(left.opportunityScore, right.opportunityScore) ||
+        right.lastUpdatedTime - left.lastUpdatedTime ||
+        right.firstSeenTime - left.firstSeenTime);
+}
+function programKey(program, fallback) {
+    const object = readObject(program);
+    const id = readString(object?.id);
+    return id ?? `program:${fallback}`;
+}
+function tryConsumeBudget(budget, cost = 1) {
+    if (budget.remaining < cost) {
+        return false;
+    }
+    budget.remaining -= cost;
+    return true;
+}
+function refundBudgetIfNoUpstreamRequest(budget, api, cost = 1) {
+    if (api.cached || api.coalesced) {
+        budget.remaining = Math.min(budget.initial, budget.remaining + cost);
+    }
+}
+function addUniqueWarning(warnings, warning) {
+    if (warnings && !warnings.includes(warning)) {
+        warnings.push(warning);
+    }
+}
+function runImmediately(callback) {
+    return callback();
+}
+function createAsyncLimiter(concurrency) {
+    const limit = Math.max(1, concurrency);
+    let active = 0;
+    const queue = [];
+    return async (callback) => {
+        if (active >= limit) {
+            await new Promise((resolve) => queue.push(resolve));
+        }
+        else {
+            active += 1;
+        }
+        try {
+            return await callback();
+        }
+        finally {
+            const next = queue.shift();
+            if (next) {
+                next();
+            }
+            else {
+                active -= 1;
+            }
+        }
+    };
+}
+async function mapWithConcurrency(items, concurrency, mapper) {
+    let index = 0;
+    async function worker() {
+        while (index < items.length) {
+            const current = index;
+            index += 1;
+            const item = items[current];
+            if (item !== undefined) {
+                await mapper(item);
+            }
+        }
+    }
+    await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, () => worker()));
+}
+function isRankingPossiblyIncomplete(totalPagesBySource, maxPages) {
+    const totals = Object.values(totalPagesBySource);
+    if (totals.length === 0) {
+        return true;
+    }
+    return totals.some((value) => typeof value !== "number" || value > maxPages);
+}
+function numberField(value, field) {
+    return value ? readNumber(value[field]) : undefined;
+}
+function stringField(value, field) {
+    return value ? readString(value[field]) : undefined;
+}
+function timestampField(value, field) {
+    const text = stringField(value, field);
+    if (!text) {
+        return 0;
+    }
+    const timestamp = Date.parse(text);
+    return Number.isFinite(timestamp) ? timestamp : 0;
+}
+function compareNumbersAsc(left, right) {
+    if (left === undefined && right === undefined) {
+        return 0;
+    }
+    if (left === undefined) {
+        return 1;
+    }
+    if (right === undefined) {
+        return -1;
+    }
+    return left - right;
+}
+function compareNumbersDesc(left, right) {
+    return compareNumbersAsc(right, left);
+}
+function uniqueStrings(values) {
+    return [...new Map(values.map((value) => [normalizeTag(value), value.trim()])).values()].filter(Boolean);
+}
+function normalizeTag(value) {
+    return value.trim().toLowerCase();
+}
+function tokenSet(value) {
+    return new Set(value.split(/[^a-z0-9]+/).filter((token) => token.length >= 2));
+}
+function arraysIntersectNormalized(left, right) {
+    return right.some((value) => left.has(normalizeTag(value)));
+}
+function readStringArrayField(value, field) {
+    const fieldValue = value[field];
+    return Array.isArray(fieldValue) ? fieldValue.filter((entry) => typeof entry === "string") : [];
+}
+function registerPrompts(server) {
+    server.registerPrompt("find_best_programs_to_hunt", {
+        title: "Find Best Programs To Hunt",
+        description: "Rank fresh BBRadar program data only. Do not invoke external bug bounty skills unless the user explicitly asks for methodology.",
+        argsSchema: {
+            opportunity_level: opportunityLevelSchema.optional(),
+            platforms: z.string().optional().describe("Optional comma-separated platform filters."),
+            tags: z.string().optional().describe("Optional comma-separated scope/language/target-type tags."),
+            max_programs: z.string().optional().describe("Optional maximum shortlist size.")
+        }
+    }, (args) => promptResult(`Use the BBRadar MCP tools only. Do not invoke local bug bounty skills, methodology files, worklogs, or non-BBRadar tools unless the user explicitly asks for methodology. Do not perform active scanning or contact third-party targets. Treat results as fresh API reads; do not describe them as cached.
+
+Find the best BBRadar program candidates.
+- Start with find_program_candidates unless the user needs custom filters; pass opportunity_levels from this JSON array unless the user asked for a broader search: ${promptJson([args.opportunity_level ?? "elite"])}.
+- Use find_language_programs for language asks, find_target_type_programs for API/mobile/source-code/domain asks, find_reward_programs or find_paid_programs for reward asks, find_vdp_programs for VDP/no-bounty asks, find_web3_contests for Web3 contest/audit asks, find_web3_programs for general Web3 requests, and find_wildcard_programs for wildcard-specific requests.
+- Apply platform filters from this JSON string if provided: ${promptJson(args.platforms ?? "")}.
+- Apply tag filters from this JSON string if provided: ${promptJson(args.tags ?? "")}.
+- Keep the shortlist to this JSON value: ${promptJson(args.max_programs ?? "10")}.
+- Compare freshness, opportunity score, reward range, public report count, target counts, and scope tags.
+- For exact scope details on one candidate, call get_program_scope_summary or get_program_target_breakdown before falling back to get_program_targets.
+- Return a ranked list with concise rationale, likely target themes, and BBRadar URLs.
+- Stay passive-only; do not recommend scanning, probing, exploit attempts, or direct contact with targets.`));
+    server.registerPrompt("summarize_program_scope", {
+        title: "Summarize Program Scope",
+        description: "Summarize in-scope and out-of-scope BBRadar target data for one program.",
+        argsSchema: {
+            program_id: programIdSchema
+        }
+    }, (args) => promptResult(`Use get_program for the program_id in this JSON string: ${promptJson(args.program_id)}. Then use get_program_targets with include_out_of_scope=true, include_ineligible=true, and limit=${MAX_TARGETS_PER_PROGRAM}.
+
+Summarize the program scope:
+- Program name, platform, reward range, public report count, first seen date, last updated date, and BBRadar URL.
+- In-scope bounty-eligible target categories.
+- Out-of-scope or ineligible target categories.
+- Wildcards, high-severity target labels, and notable language or scope tags.
+- Recent target update signals if present.
+- Do not contact, scan, probe, or validate any listed target.`));
+    server.registerPrompt("prepare_recon_plan", {
+        title: "Prepare Passive Recon Plan",
+        description: "Create a passive-only plan from BBRadar program and target data. Use only when planning is explicitly requested.",
+        argsSchema: {
+            program_id: programIdSchema.optional(),
+            focus: z.string().optional().describe("Optional focus area such as APIs, domains, mobile, or cloud.")
+        }
+    }, (args) => promptResult(`Prepare a passive-only plan from BBRadar data. Program id JSON string, if present: ${promptJson(args.program_id ?? "")}.
+
+Do not invoke local bug bounty skills, methodology files, worklogs, or non-BBRadar tools unless the user explicitly asks for external methodology.
+
+Use BBRadar MCP data first:
+- If a program_id is provided, call get_program and get_program_targets.
+- If no program_id is provided, call get_opportunities and select a small set of candidate programs before planning.
+- Focus area JSON string: ${promptJson(args.focus ?? "highest-signal in-scope bounty-eligible targets")}.
+
+The plan must:
+- Avoid active scanning, probing, exploit attempts, brute force, or third-party target calls.
+- Separate allowed passive enrichment ideas from actions that need explicit program authorization.
+- Prioritize targets by bounty eligibility, freshness, wildcard status, target type, and severity labels.
+- Include a short checklist of BBRadar follow-up tool calls and decision points.`));
+}
+async function runTool(toolName, config, rateLimiter, callback) {
+    const startedAt = Date.now();
+    const decision = rateLimiter.consume(toolName, rateLimitForTool(toolName, config));
+    if (!decision.allowed) {
+        const durationMs = Date.now() - startedAt;
+        recordToolMetric(toolName, durationMs, "rate_limited");
+        return toolResult({
+            request_id: randomUUID(),
+            error: {
+                message: `MCP rate limit exceeded for ${toolName}. Try again after ${decision.resetAt}.`
+            },
+            mcp_rate_limit: toRateLimitPayload(decision),
+            mcp_timing: toolTimingPayload(toolName, durationMs)
+        }, true);
+    }
+    try {
+        const payload = await callback();
+        const durationMs = Date.now() - startedAt;
+        recordToolMetric(toolName, durationMs, "ok");
+        return toolResult({
+            ...payload,
+            mcp_rate_limit: toRateLimitPayload(decision),
+            mcp_timing: toolTimingPayload(toolName, durationMs)
+        });
+    }
+    catch (error) {
+        const durationMs = Date.now() - startedAt;
+        recordToolMetric(toolName, durationMs, "error");
+        return toolResult(errorPayload(error, decision, toolName, durationMs), true);
+    }
+}
+function toolResult(payload, isError = false) {
+    const resourceLinks = collectResourceLinks(payload);
+    return {
+        content: [
+            {
+                type: "text",
+                text: JSON.stringify(payload)
+            },
+            ...resourceLinks
+        ],
+        structuredContent: payload,
+        ...(isError ? { isError: true } : {})
+    };
+}
+function promptResult(text) {
+    return {
+        messages: [
+            {
+                role: "user",
+                content: {
+                    type: "text",
+                    text
+                }
+            }
+        ]
+    };
+}
+function promptJson(value) {
+    return JSON.stringify(value);
+}
+function withApiMetadata(api, payload) {
+    return stripUndefined({
+        request_id: api.requestId,
+        upstream_request_id: api.upstreamRequestId,
+        cache: stripUndefined({
+            hit: api.cached,
+            coalesced_live_request: api.coalesced,
+            expires_at: api.cacheExpiresAt
+        }),
+        fetched_at: api.fetchedAt,
+        ...payload
+    });
+}
+function apiSourceMetadata(api) {
+    return stripUndefined({
+        cache_hit: api.cached,
+        cache_expires_at: api.cacheExpiresAt,
+        coalesced_live_request: api.coalesced
+    });
+}
+function errorPayload(error, decision, toolName, durationMs) {
+    if (error instanceof BBRadarApiError) {
+        return stripUndefined({
+            request_id: error.requestId,
+            upstream_request_id: error.upstreamRequestId,
+            error: stripUndefined({
+                message: error.message,
+                status: error.status,
+                detail: sanitizeJson(error.detail),
+                errors: sanitizeJson(error.errors)
+            }),
+            mcp_rate_limit: toRateLimitPayload(decision),
+            mcp_timing: toolTimingPayload(toolName, durationMs)
+        });
+    }
+    return {
+        request_id: randomUUID(),
+        error: {
+            message: error instanceof Error ? error.message : String(error)
+        },
+        mcp_rate_limit: toRateLimitPayload(decision),
+        mcp_timing: toolTimingPayload(toolName, durationMs)
+    };
+}
+function recordToolMetric(toolName, durationMs, status) {
+    const existing = TOOL_METRICS.get(toolName) ??
+        {
+            calls: 0,
+            errors: 0,
+            totalMs: 0,
+            maxMs: 0,
+            lastMs: 0,
+            lastStatus: status,
+            lastAt: new Date(0).toISOString()
+        };
+    existing.calls += 1;
+    existing.errors += status === "error" || status === "rate_limited" ? 1 : 0;
+    existing.totalMs += durationMs;
+    existing.maxMs = Math.max(existing.maxMs, durationMs);
+    existing.lastMs = durationMs;
+    existing.lastStatus = status;
+    existing.lastAt = new Date().toISOString();
+    TOOL_METRICS.set(toolName, existing);
+}
+function toolTimingPayload(toolName, durationMs) {
+    return {
+        tool_name: toolName,
+        duration_ms: durationMs
+    };
+}
+function toolMetricsSnapshot() {
+    return Object.fromEntries([...TOOL_METRICS.entries()].map(([toolName, metric]) => [
+        toolName,
+        {
+            calls: metric.calls,
+            errors: metric.errors,
+            avg_ms: metric.calls > 0 ? Math.round(metric.totalMs / metric.calls) : 0,
+            max_ms: metric.maxMs,
+            last_ms: metric.lastMs,
+            last_status: metric.lastStatus,
+            last_at: metric.lastAt
+        }
+    ]));
+}
+function toRateLimitPayload(decision) {
+    return {
+        remaining: decision.remaining,
+        reset_at: decision.resetAt
+    };
+}
+function rateLimitForTool(toolName, config) {
+    return toolName === "export_targets" ? config.exportRateLimitPerMinute : config.defaultRateLimitPerMinute;
+}
+function toQuery(values) {
+    return compactRecord(values);
+}
+function compactRecord(values) {
+    return Object.fromEntries(Object.entries(values).filter(([, value]) => {
+        if (value === undefined || value === null) {
+            return false;
+        }
+        if (Array.isArray(value)) {
+            return value.length > 0;
+        }
+        return true;
+    }));
+}
+function latestAddedTargetsQuery(input) {
+    return {
+        change_type: "added",
+        target_type: input.target_type,
+        include_out_of_scope: input.include_out_of_scope,
+        include_ineligible: input.include_ineligible,
+        recent_changes_page_size: input.recent_changes_page_size,
+        include_full_target_list: input.include_full_target_list,
+        full_target_list_mode: input.full_target_list_mode,
+        full_target_limit: input.full_target_limit,
+        full_list_include_out_of_scope: input.full_list_include_out_of_scope,
+        full_list_include_ineligible: input.full_list_include_ineligible
+    };
+}
+function formatTargetList(targets, mode) {
+    if (mode === "identifiers") {
+        return uniqueStrings(targets.map(targetIdentifier).filter((identifier) => identifier !== undefined));
+    }
+    if (mode === "compact") {
+        return targets.map(compactTarget);
+    }
+    return targets;
+}
+function compactTarget(target) {
+    return stripUndefined({
+        identifier: targetIdentifier(target),
+        target_type: stringField(target, "target_type"),
+        in_scope: readBoolean(target.in_scope),
+        eligible_for_bounty: readBoolean(target.eligible_for_bounty),
+        wildcard: readBoolean(target.wildcard)
+    });
+}
+function targetIdentifier(target) {
+    return stringField(target, "identifier") ?? stringField(target, "display_name") ?? stringField(target, "normalized_identifier");
+}
+function targetMatchesRequestedType(target, targetType) {
+    const normalizedTargetType = normalizeTag(targetType);
+    const actualTargetType = normalizeTag(stringField(target, "target_type") ?? "");
+    return actualTargetType === normalizedTargetType || readStringArrayField(target, "scope_tags").map(normalizeTag).includes(normalizedTargetType);
+}
+function targetMatchesQuery(target, query, mode) {
+    const identifier = targetIdentifier(target);
+    if (!identifier) {
+        return false;
+    }
+    const normalizedIdentifier = normalizeTargetIdentifierForMatch(identifier);
+    const normalizedQuery = normalizeTargetIdentifierForMatch(query);
+    if (mode === "exact") {
+        return normalizedIdentifier === normalizedQuery;
+    }
+    if (mode === "suffix") {
+        return (normalizedIdentifier === normalizedQuery ||
+            normalizedIdentifier.endsWith(`.${normalizedQuery}`) ||
+            normalizedQuery.endsWith(`.${normalizedIdentifier}`));
+    }
+    if (mode === "wildcard") {
+        return wildcardTargetMatch(normalizedQuery, normalizedIdentifier) || wildcardTargetMatch(normalizedIdentifier, normalizedQuery);
+    }
+    return normalizedIdentifier.includes(normalizedQuery) || normalizedQuery.includes(normalizedIdentifier);
+}
+function normalizeTargetIdentifierForMatch(value) {
+    return value
+        .trim()
+        .toLowerCase()
+        .replace(/^https?:\/\//, "")
+        .replace(/^www\./, "")
+        .replace(/\/+$/, "");
+}
+function wildcardTargetMatch(pattern, value) {
+    if (!pattern.includes("*")) {
+        return pattern === value || value.endsWith(`.${pattern}`);
+    }
+    const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+    return new RegExp(`^${escaped}$`).test(value);
+}
+function targetIsWildcard(target) {
+    return readBoolean(target.wildcard) === true || (targetIdentifier(target)?.includes("*.") ?? false);
+}
+function targetIsDomain(target) {
+    return targetMatchesAnySignal(target, ["domain", "url", "web", "http"]);
+}
+function targetIsApi(target) {
+    return targetMatchesAnySignal(target, ["api", "graphql", "rest"]);
+}
+function targetIsMobile(target) {
+    return targetMatchesAnySignal(target, ["android", "ios", "mobile"]);
+}
+function targetIsSourceCode(target) {
+    return targetMatchesAnySignal(target, ["source-code", "source code", "repository", "repo", "code"]);
+}
+function targetMatchesAnySignal(target, signals) {
+    const values = [
+        stringField(target, "target_type"),
+        targetIdentifier(target),
+        ...readStringArrayField(target, "scope_tags"),
+        ...readStringArrayField(target, "language_tags")
+    ]
+        .filter((value) => value !== undefined)
+        .map(normalizeTag);
+    return signals.some((signal) => values.some((value) => value === signal || value.includes(signal)));
+}
+function targetHasAllowedScope(target, options) {
+    if (!options.include_out_of_scope && (options.strict_scope_filter ? target.in_scope !== true : target.in_scope === false)) {
+        return false;
+    }
+    if (!options.include_ineligible && (options.strict_scope_filter ? target.eligible_for_bounty !== true : target.eligible_for_bounty === false)) {
+        return false;
+    }
+    return true;
+}
+//# sourceMappingURL=server.js.map