@c4a/extract 0.6.18 → 0.7.0

package/bin/c4a-extract-code.js

@@ -101,17 +101,17 @@ var require_visit = __commonJS((exports) => {
   visit.BREAK = BREAK;
   visit.SKIP = SKIP;
   visit.REMOVE = REMOVE;
-  function visit_(key, node2, visitor, path) {
-    const ctrl = callVisitor(key, node2, visitor, path);
+  function visit_(key, node2, visitor, path2) {
+    const ctrl = callVisitor(key, node2, visitor, path2);
     if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-      replaceNode(key, path, ctrl);
-      return visit_(key, ctrl, visitor, path);
+      replaceNode(key, path2, ctrl);
+      return visit_(key, ctrl, visitor, path2);
     }
     if (typeof ctrl !== "symbol") {
       if (identity.isCollection(node2)) {
-        path = Object.freeze(path.concat(node2));
+        path2 = Object.freeze(path2.concat(node2));
         for (let i = 0;i < node2.items.length; ++i) {
-          const ci = visit_(i, node2.items[i], visitor, path);
+          const ci = visit_(i, node2.items[i], visitor, path2);
           if (typeof ci === "number")
             i = ci - 1;
           else if (ci === BREAK)
@@ -122,13 +122,13 @@ var require_visit = __commonJS((exports) => {
           }
         }
       } else if (identity.isPair(node2)) {
-        path = Object.freeze(path.concat(node2));
-        const ck = visit_("key", node2.key, visitor, path);
+        path2 = Object.freeze(path2.concat(node2));
+        const ck = visit_("key", node2.key, visitor, path2);
         if (ck === BREAK)
           return BREAK;
         else if (ck === REMOVE)
           node2.key = null;
-        const cv = visit_("value", node2.value, visitor, path);
+        const cv = visit_("value", node2.value, visitor, path2);
         if (cv === BREAK)
           return BREAK;
         else if (cv === REMOVE)
@@ -149,17 +149,17 @@ var require_visit = __commonJS((exports) => {
   visitAsync.BREAK = BREAK;
   visitAsync.SKIP = SKIP;
   visitAsync.REMOVE = REMOVE;
-  async function visitAsync_(key, node2, visitor, path) {
-    const ctrl = await callVisitor(key, node2, visitor, path);
+  async function visitAsync_(key, node2, visitor, path2) {
+    const ctrl = await callVisitor(key, node2, visitor, path2);
     if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-      replaceNode(key, path, ctrl);
-      return visitAsync_(key, ctrl, visitor, path);
+      replaceNode(key, path2, ctrl);
+      return visitAsync_(key, ctrl, visitor, path2);
     }
     if (typeof ctrl !== "symbol") {
       if (identity.isCollection(node2)) {
-        path = Object.freeze(path.concat(node2));
+        path2 = Object.freeze(path2.concat(node2));
         for (let i = 0;i < node2.items.length; ++i) {
-          const ci = await visitAsync_(i, node2.items[i], visitor, path);
+          const ci = await visitAsync_(i, node2.items[i], visitor, path2);
           if (typeof ci === "number")
             i = ci - 1;
           else if (ci === BREAK)
@@ -170,13 +170,13 @@ var require_visit = __commonJS((exports) => {
           }
         }
       } else if (identity.isPair(node2)) {
-        path = Object.freeze(path.concat(node2));
-        const ck = await visitAsync_("key", node2.key, visitor, path);
+        path2 = Object.freeze(path2.concat(node2));
+        const ck = await visitAsync_("key", node2.key, visitor, path2);
         if (ck === BREAK)
           return BREAK;
         else if (ck === REMOVE)
           node2.key = null;
-        const cv = await visitAsync_("value", node2.value, visitor, path);
+        const cv = await visitAsync_("value", node2.value, visitor, path2);
         if (cv === BREAK)
           return BREAK;
         else if (cv === REMOVE)
@@ -203,23 +203,23 @@ var require_visit = __commonJS((exports) => {
     }
     return visitor;
   }
-  function callVisitor(key, node2, visitor, path) {
+  function callVisitor(key, node2, visitor, path2) {
     if (typeof visitor === "function")
-      return visitor(key, node2, path);
+      return visitor(key, node2, path2);
     if (identity.isMap(node2))
-      return visitor.Map?.(key, node2, path);
+      return visitor.Map?.(key, node2, path2);
     if (identity.isSeq(node2))
-      return visitor.Seq?.(key, node2, path);
+      return visitor.Seq?.(key, node2, path2);
     if (identity.isPair(node2))
-      return visitor.Pair?.(key, node2, path);
+      return visitor.Pair?.(key, node2, path2);
     if (identity.isScalar(node2))
-      return visitor.Scalar?.(key, node2, path);
+      return visitor.Scalar?.(key, node2, path2);
     if (identity.isAlias(node2))
-      return visitor.Alias?.(key, node2, path);
+      return visitor.Alias?.(key, node2, path2);
     return;
   }
-  function replaceNode(key, path, node2) {
-    const parent = path[path.length - 1];
+  function replaceNode(key, path2, node2) {
+    const parent = path2[path2.length - 1];
     if (identity.isCollection(parent)) {
       parent.items[key] = node2;
     } else if (identity.isPair(parent)) {
@@ -776,10 +776,10 @@ var require_Collection = __commonJS((exports) => {
   var createNode = require_createNode();
   var identity = require_identity();
   var Node = require_Node();
-  function collectionFromPath(schema, path, value) {
+  function collectionFromPath(schema, path2, value) {
     let v = value;
-    for (let i = path.length - 1;i >= 0; --i) {
-      const k = path[i];
+    for (let i = path2.length - 1;i >= 0; --i) {
+      const k = path2[i];
       if (typeof k === "number" && Number.isInteger(k) && k >= 0) {
         const a = [];
         a[k] = v;
@@ -798,7 +798,7 @@ var require_Collection = __commonJS((exports) => {
       sourceObjects: new Map
     });
   }
-  var isEmptyPath = (path) => path == null || typeof path === "object" && !!path[Symbol.iterator]().next().done;
+  var isEmptyPath = (path2) => path2 == null || typeof path2 === "object" && !!path2[Symbol.iterator]().next().done;
 
   class Collection extends Node.NodeBase {
     constructor(type, schema) {
@@ -819,11 +819,11 @@ var require_Collection = __commonJS((exports) => {
         copy.range = this.range.slice();
       return copy;
     }
-    addIn(path, value) {
-      if (isEmptyPath(path))
+    addIn(path2, value) {
+      if (isEmptyPath(path2))
         this.add(value);
       else {
-        const [key, ...rest] = path;
+        const [key, ...rest] = path2;
         const node2 = this.get(key, true);
         if (identity.isCollection(node2))
           node2.addIn(rest, value);
@@ -833,8 +833,8 @@ var require_Collection = __commonJS((exports) => {
           throw new Error(`Expected YAML collection at ${key}. Remaining path: ${rest}`);
       }
     }
-    deleteIn(path) {
-      const [key, ...rest] = path;
+    deleteIn(path2) {
+      const [key, ...rest] = path2;
       if (rest.length === 0)
         return this.delete(key);
       const node2 = this.get(key, true);
@@ -843,8 +843,8 @@ var require_Collection = __commonJS((exports) => {
       else
         throw new Error(`Expected YAML collection at ${key}. Remaining path: ${rest}`);
     }
-    getIn(path, keepScalar) {
-      const [key, ...rest] = path;
+    getIn(path2, keepScalar) {
+      const [key, ...rest] = path2;
       const node2 = this.get(key, true);
       if (rest.length === 0)
         return !keepScalar && identity.isScalar(node2) ? node2.value : node2;
@@ -859,15 +859,15 @@ var require_Collection = __commonJS((exports) => {
         return n == null || allowScalar && identity.isScalar(n) && n.value == null && !n.commentBefore && !n.comment && !n.tag;
       });
     }
-    hasIn(path) {
-      const [key, ...rest] = path;
+    hasIn(path2) {
+      const [key, ...rest] = path2;
       if (rest.length === 0)
         return this.has(key);
       const node2 = this.get(key, true);
       return identity.isCollection(node2) ? node2.hasIn(rest) : false;
     }
-    setIn(path, value) {
-      const [key, ...rest] = path;
+    setIn(path2, value) {
+      const [key, ...rest] = path2;
       if (rest.length === 0) {
         this.set(key, value);
       } else {
@@ -3249,9 +3249,9 @@ var require_Document = __commonJS((exports) => {
       if (assertCollection(this.contents))
         this.contents.add(value);
     }
-    addIn(path, value) {
+    addIn(path2, value) {
       if (assertCollection(this.contents))
-        this.contents.addIn(path, value);
+        this.contents.addIn(path2, value);
     }
     createAlias(node2, name) {
       if (!node2.anchor) {
@@ -3300,30 +3300,30 @@ var require_Document = __commonJS((exports) => {
     delete(key) {
       return assertCollection(this.contents) ? this.contents.delete(key) : false;
     }
-    deleteIn(path) {
-      if (Collection.isEmptyPath(path)) {
+    deleteIn(path2) {
+      if (Collection.isEmptyPath(path2)) {
         if (this.contents == null)
           return false;
         this.contents = null;
         return true;
       }
-      return assertCollection(this.contents) ? this.contents.deleteIn(path) : false;
+      return assertCollection(this.contents) ? this.contents.deleteIn(path2) : false;
     }
     get(key, keepScalar) {
       return identity.isCollection(this.contents) ? this.contents.get(key, keepScalar) : undefined;
     }
-    getIn(path, keepScalar) {
-      if (Collection.isEmptyPath(path))
+    getIn(path2, keepScalar) {
+      if (Collection.isEmptyPath(path2))
         return !keepScalar && identity.isScalar(this.contents) ? this.contents.value : this.contents;
-      return identity.isCollection(this.contents) ? this.contents.getIn(path, keepScalar) : undefined;
+      return identity.isCollection(this.contents) ? this.contents.getIn(path2, keepScalar) : undefined;
     }
     has(key) {
       return identity.isCollection(this.contents) ? this.contents.has(key) : false;
     }
-    hasIn(path) {
-      if (Collection.isEmptyPath(path))
+    hasIn(path2) {
+      if (Collection.isEmptyPath(path2))
         return this.contents !== undefined;
-      return identity.isCollection(this.contents) ? this.contents.hasIn(path) : false;
+      return identity.isCollection(this.contents) ? this.contents.hasIn(path2) : false;
     }
     set(key, value) {
       if (this.contents == null) {
@@ -3332,13 +3332,13 @@ var require_Document = __commonJS((exports) => {
         this.contents.set(key, value);
       }
     }
-    setIn(path, value) {
-      if (Collection.isEmptyPath(path)) {
+    setIn(path2, value) {
+      if (Collection.isEmptyPath(path2)) {
         this.contents = value;
       } else if (this.contents == null) {
-        this.contents = Collection.collectionFromPath(this.schema, Array.from(path), value);
+        this.contents = Collection.collectionFromPath(this.schema, Array.from(path2), value);
       } else if (assertCollection(this.contents)) {
-        this.contents.setIn(path, value);
+        this.contents.setIn(path2, value);
       }
     }
     setSchema(version, options = {}) {
@@ -5227,9 +5227,9 @@ var require_cst_visit = __commonJS((exports) => {
   visit.BREAK = BREAK;
   visit.SKIP = SKIP;
   visit.REMOVE = REMOVE;
-  visit.itemAtPath = (cst, path) => {
+  visit.itemAtPath = (cst, path2) => {
     let item = cst;
-    for (const [field, index] of path) {
+    for (const [field, index] of path2) {
       const tok = item?.[field];
       if (tok && "items" in tok) {
         item = tok.items[index];
@@ -5238,23 +5238,23 @@ var require_cst_visit = __commonJS((exports) => {
     }
     return item;
   };
-  visit.parentCollection = (cst, path) => {
-    const parent = visit.itemAtPath(cst, path.slice(0, -1));
-    const field = path[path.length - 1][0];
+  visit.parentCollection = (cst, path2) => {
+    const parent = visit.itemAtPath(cst, path2.slice(0, -1));
+    const field = path2[path2.length - 1][0];
     const coll = parent?.[field];
     if (coll && "items" in coll)
       return coll;
     throw new Error("Parent collection not found");
   };
-  function _visit(path, item, visitor) {
-    let ctrl = visitor(item, path);
+  function _visit(path2, item, visitor) {
+    let ctrl = visitor(item, path2);
     if (typeof ctrl === "symbol")
       return ctrl;
     for (const field of ["key", "value"]) {
       const token = item[field];
       if (token && "items" in token) {
         for (let i = 0;i < token.items.length; ++i) {
-          const ci = _visit(Object.freeze(path.concat([[field, i]])), token.items[i], visitor);
+          const ci = _visit(Object.freeze(path2.concat([[field, i]])), token.items[i], visitor);
           if (typeof ci === "number")
             i = ci - 1;
           else if (ci === BREAK)
@@ -5265,10 +5265,10 @@ var require_cst_visit = __commonJS((exports) => {
           }
         }
         if (typeof ctrl === "function" && field === "key")
-          ctrl = ctrl(item, path);
+          ctrl = ctrl(item, path2);
       }
     }
-    return typeof ctrl === "function" ? ctrl(item, path) : ctrl;
+    return typeof ctrl === "function" ? ctrl(item, path2) : ctrl;
   }
   exports.visit = visit;
 });
@@ -7178,8 +7178,8 @@ var require_utils = __commonJS((exports) => {
     }
     return output;
   };
-  exports.basename = (path, { windows } = {}) => {
-    const segs = path.split(windows ? /[\\/]/ : "/");
+  exports.basename = (path2, { windows } = {}) => {
+    const segs = path2.split(windows ? /[\\/]/ : "/");
     const last = segs[segs.length - 1];
     if (last === "") {
       return segs[segs.length - 2];
@@ -8662,7 +8662,7 @@ var require_picomatch2 = __commonJS((exports, module) => {
 // src/runner.ts
 import { readFile as readFile3 } from "node:fs/promises";
 import { createRequire as createRequire2 } from "node:module";
-import path3 from "node:path";
+import path4 from "node:path";
 import { pathToFileURL } from "node:url";
 
 // ../../node_modules/.bun/zod@3.25.76/node_modules/zod/v3/external.js
@@ -12755,6 +12755,51 @@ var FactRelation;
   FactRelation2["Supersedes"] = "supersedes";
   FactRelation2["References"] = "references";
 })(FactRelation ||= {});
+// ../core/src/types/refPointer.ts
+var REF_POINTER_PATTERN = /^ref:(entity|relation|content):(.+)$/;
+function parseRef(pointer) {
+  const match = REF_POINTER_PATTERN.exec(pointer);
+  if (!match) {
+    return null;
+  }
+  const [, type, id] = match;
+  if (!id) {
+    return null;
+  }
+  return { type, id };
+}
+function buildRef(type, id) {
+  return `ref:${type}:${id}`;
+}
+function isRefPointer(value) {
+  return typeof value === "string" && parseRef(value) !== null;
+}
+function extractAllRefs(data) {
+  const results = [];
+  const visit = (value, path) => {
+    if (typeof value === "string") {
+      if (isRefPointer(value)) {
+        results.push({ pointer: value, fieldPath: path });
+      }
+      return;
+    }
+    if (Array.isArray(value)) {
+      value.forEach((item, index) => {
+        const nextPath = path ? `${path}[${index}]` : `[${index}]`;
+        visit(item, nextPath);
+      });
+      return;
+    }
+    if (value && typeof value === "object") {
+      for (const [key, entry] of Object.entries(value)) {
+        const nextPath = path ? `${path}.${key}` : key;
+        visit(entry, nextPath);
+      }
+    }
+  };
+  visit(data, "");
+  return results;
+}
 // ../core/src/types/docDigest.ts
 var confidenceAtomSchema = exports_external.number().min(0).max(1).optional().catch(undefined);
 var entityAtomSchema = exports_external.object({
@@ -12936,6 +12981,34 @@ var PathFilterConfigSchema = exports_external.object({
     exclude: exports_external.array(exports_external.string()).default([])
   }).default({})
 });
+var DEFAULT_PATH_FILTER = {
+  package: {
+    include: [
+      "**/{package.json,pyproject.toml,setup.py,go.mod,Cargo.toml,pom.xml,build.gradle}"
+    ]
+  },
+  code: {
+    include: ["**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}"],
+    exclude: [
+      "**/__{tests,test,e2e,mocks,fixtures,snapshots}__/**",
+      "**/*.{test,spec}.{ts,tsx,mts,cts,js,jsx,mjs,cjs}",
+      "**/*.d.{ts,mts,cts}"
+    ]
+  },
+  doc: {
+    include: ["*.md", "docs/**/*.md"],
+    exclude: ["**/CHANGELOG.md"]
+  }
+};
+function resolvePathFilter(metadata) {
+  const raw = metadata?.path_filter;
+  if (raw == null)
+    return { config: DEFAULT_PATH_FILTER, isDefault: true };
+  const parsed = PathFilterConfigSchema.safeParse(raw);
+  if (!parsed.success)
+    return { config: DEFAULT_PATH_FILTER, isDefault: true };
+  return { config: parsed.data, isDefault: false };
+}
 // ../core/src/schemas/baseSchema.ts
 var sourceRefSpanSchema = exports_external.object({
   start: exports_external.number().int().min(1),
@@ -13061,6 +13134,501 @@ var factSchema = exports_external.union([
   activeFactSchema,
   deprecatedFactSchema
 ]);
+// ../core/src/schemas/indexerEvidenceAdapterSchema.ts
+import { createHash } from "node:crypto";
+
+// ../core/src/indexerOutputRedaction.ts
+var INDEXER_OUTPUT_REDACTION_MARKER = "[REDACTED:indexer-output]";
+var SECRET_TOKEN = /^(?:password|passwd|pwd|secret|token|credential|credentials|cookie)$/u;
+var SECRET_COMPOUND = /^(?:api-key|access-key|private-key|client-secret|access-token|refresh-token)$/u;
+var NON_SECRET_SUFFIX = new Set([
+  "budget",
+  "count",
+  "digest",
+  "fingerprint",
+  "hash",
+  "index",
+  "kind",
+  "length",
+  "limit",
+  "name",
+  "ref",
+  "reference",
+  "references",
+  "refs",
+  "status",
+  "type"
+]);
+function keyTokens(key) {
+  return key.replace(/([a-z0-9])([A-Z])/gu, "$1-$2").replace(/[^A-Za-z0-9]+/gu, "-").toLowerCase().split("-").filter(Boolean);
+}
+function sensitiveKey(key, value) {
+  const tokens = keyTokens(key);
+  if (tokens.length === 0)
+    return false;
+  const normalized = tokens.join("-");
+  if (normalized === "authorization" && value !== null && typeof value === "object") {
+    return false;
+  }
+  if (NON_SECRET_SUFFIX.has(tokens.at(-1)))
+    return false;
+  return SECRET_COMPOUND.test(normalized) || tokens.some((token) => SECRET_TOKEN.test(token)) || normalized === "authorization";
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+}
+function normalizedBlockedScalars(policy) {
+  const identities = new Set;
+  const values = [];
+  for (const value of policy.blocked_scalars ?? []) {
+    if (typeof value === "number" && !Number.isFinite(value))
+      continue;
+    if (typeof value === "string" && value.length === 0)
+      continue;
+    const identity = `${typeof value}:${String(value)}`;
+    if (identities.has(identity))
+      continue;
+    identities.add(identity);
+    values.push(value);
+  }
+  return values.sort((left, right) => String(right).length - String(left).length);
+}
+function replaceWithCount(value, pattern, replacement, count) {
+  return value.replace(pattern, (...args) => {
+    count.replacements += 1;
+    if (typeof replacement === "string")
+      return replacement;
+    return replacement(...args.slice(0, -2));
+  });
+}
+function redactKnownText(value, count) {
+  let output = value;
+  output = replaceWithCount(output, /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/gu, INDEXER_OUTPUT_REDACTION_MARKER, count);
+  output = replaceWithCount(output, /(\bauthorization\s*:\s*(?:bearer|basic)\s+)[^\s,;]+/giu, (_match, prefix) => `${prefix}${INDEXER_OUTPUT_REDACTION_MARKER}`, count);
+  output = replaceWithCount(output, /([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/giu, (_match, prefix) => `${prefix}${INDEXER_OUTPUT_REDACTION_MARKER}@`, count);
+  output = replaceWithCount(output, /([?&](?:access_token|refresh_token|api_key|password|secret)=)[^&#\s]+/giu, (_match, prefix) => `${prefix}${INDEXER_OUTPUT_REDACTION_MARKER}`, count);
+  const key = "(?:[A-Za-z0-9_.-]*(?:password|passwd|pwd|secret|token|credential|cookie)[A-Za-z0-9_.-]*|api[-_]?key|access[-_]?(?:key|token)|private[-_]?key|client[-_]?secret|authorization)";
+  const assignment = `(?:=\\s*|:\\s+(?=\\S)|:\\s*(?=["']))`;
+  output = replaceWithCount(output, new RegExp(`((?:["']?${key}["']?)\\s*${assignment})(?:"(?:\\\\.|[^"])*"|'(?:\\\\.|[^'])*'|[^\\s,;}\\]]+)`, "giu"), (_match, prefix) => `${prefix}"${INDEXER_OUTPUT_REDACTION_MARKER}"`, count);
+  return output;
+}
+function redactBlockedText(value, blocked, count) {
+  let output = value;
+  for (const scalar of blocked) {
+    const pattern = typeof scalar === "number" ? new RegExp(`(?<![0-9.])${escapeRegExp(String(scalar))}(?![0-9.])`, "gu") : new RegExp(escapeRegExp(scalar), "gu");
+    output = replaceWithCount(output, pattern, INDEXER_OUTPUT_REDACTION_MARKER, count);
+  }
+  return output;
+}
+function redactText(value, blocked, count) {
+  return redactBlockedText(redactKnownText(value, count), blocked, count);
+}
+function blockedScalar(value, blocked) {
+  return blocked.some((candidate) => typeof candidate === typeof value && Object.is(candidate, value));
+}
+function redactStructured(value, blocked, count, seen) {
+  if (blockedScalar(value, blocked)) {
+    count.replacements += 1;
+    return INDEXER_OUTPUT_REDACTION_MARKER;
+  }
+  if (typeof value === "string")
+    return redactText(value, blocked, count);
+  if (value === null || typeof value !== "object")
+    return value;
+  if (seen.has(value))
+    throw new TypeError("Indexer output redaction requires an acyclic value");
+  seen.add(value);
+  if (value instanceof Date) {
+    const redacted2 = redactText(value.toISOString(), blocked, count);
+    seen.delete(value);
+    return redacted2;
+  }
+  if (value instanceof Error) {
+    const redacted2 = {
+      name: redactText(value.name, blocked, count),
+      message: redactText(value.message, blocked, count)
+    };
+    seen.delete(value);
+    return redacted2;
+  }
+  if (Array.isArray(value)) {
+    const redacted2 = value.map((item) => redactStructured(item, blocked, count, seen));
+    seen.delete(value);
+    return redacted2;
+  }
+  const redacted = {};
+  for (const [key, item] of Object.entries(value)) {
+    const safeKey = redactText(key, blocked, count);
+    if (sensitiveKey(key, item)) {
+      count.replacements += 1;
+      redacted[safeKey] = INDEXER_OUTPUT_REDACTION_MARKER;
+    } else {
+      redacted[safeKey] = redactStructured(item, blocked, count, seen);
+    }
+  }
+  seen.delete(value);
+  return redacted;
+}
+function redactIndexerOutput(input) {
+  const count = { replacements: 0 };
+  const blocked = normalizedBlockedScalars(input.policy ?? {});
+  const value = typeof input.value === "string" ? redactText(input.value, blocked, count) : redactStructured(input.value, blocked, count, new WeakSet);
+  return {
+    value,
+    redacted: count.replacements > 0,
+    replacement_count: count.replacements
+  };
+}
+function redactIndexerOutputText(input) {
+  return redactIndexerOutput(input).value;
+}
+function assertIndexerOutputSafe(input) {
+  const result = redactIndexerOutput(input);
+  if (result.redacted) {
+    throw new TypeError(`Indexer ${input.channel} was blocked by the common output redaction boundary`);
+  }
+  return input.value;
+}
+
+// ../core/src/schemas/indexerEvidenceAdapterSchema.ts
+var digestSchema = exports_external.string().regex(/^sha256:[a-f0-9]{64}$/u);
+var idSchema = exports_external.string().regex(/^[a-z0-9][a-z0-9._/-]*$/u).superRefine((value, context) => {
+  if (value.split("/").some((segment) => segment.length === 0 || segment === "." || segment === "..")) {
+    context.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      message: "must not contain empty, current-directory, or parent-directory segments"
+    });
+  }
+});
+var semverSchema = exports_external.string().regex(/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u);
+var canonicalRefSchema = exports_external.string().regex(/^[a-z][a-z0-9.-]*:[A-Za-z0-9][A-Za-z0-9._~:/#@+-]*$/u);
+var packageCoordinateSchema = exports_external.string().regex(/^(?:@[a-z0-9._-]+\/)?[a-z0-9][a-z0-9._-]*$/u);
+var portablePathSchema = exports_external.string().superRefine((value, context) => {
+  const segments = value.split("/");
+  if (value.length === 0 || value.includes("\x00") || value.includes("\\") || value.startsWith("/") || /^[A-Za-z]:\//u.test(value) || segments.some((segment) => segment.length === 0 || segment === "." || segment === "..")) {
+    context.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      message: "must be a portable relative path"
+    });
+  }
+});
+function addDuplicateIssues(values, context, field) {
+  const seen = new Set;
+  values.forEach((value, index) => {
+    if (seen.has(value)) {
+      context.addIssue({
+        code: exports_external.ZodIssueCode.custom,
+        message: `${field} must not contain duplicate value ${value}`,
+        path: [index]
+      });
+    }
+    seen.add(value);
+  });
+}
+var adapterIdentitySchema = exports_external.object({
+  id: idSchema,
+  package: packageCoordinateSchema,
+  export: exports_external.string().regex(/^[A-Za-z_$][A-Za-z0-9_$.-]*$/u),
+  version: semverSchema,
+  digest: digestSchema
+}).strict();
+var adapterLocatorSchema = exports_external.object({
+  source_ref: canonicalRefSchema,
+  module_ref: canonicalRefSchema.nullable(),
+  normalized_path: portablePathSchema,
+  qualified_item_path: exports_external.string().min(1).max(1024),
+  signature_digest: digestSchema
+}).strict();
+var indexerEvidenceAdapterFactSchema = exports_external.object({
+  fact_ref: canonicalRefSchema,
+  kind: idSchema,
+  locator: adapterLocatorSchema,
+  payload_digest: digestSchema,
+  denominator: exports_external.enum(["none", "eligible-file", "loc", "symbol", "protocol-item"])
+}).strict();
+var indexerEvidenceAdapterFileSchema = exports_external.object({
+  file_ref: canonicalRefSchema,
+  source_ref: canonicalRefSchema,
+  module_ref: canonicalRefSchema.nullable(),
+  normalized_path: portablePathSchema,
+  role: exports_external.enum(["primary-owner", "enricher"]),
+  coverage_tier: exports_external.enum(["ast-catalog", "lightweight-evidence"]),
+  disposition: exports_external.enum(["analyzed", "unsupported", "excluded"]),
+  facts: exports_external.array(indexerEvidenceAdapterFactSchema)
+}).strict().superRefine((value, context) => {
+  addDuplicateIssues(value.facts.map((fact2) => fact2.fact_ref), context, "facts");
+  if (value.disposition !== "analyzed" && value.facts.length > 0) {
+    context.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      message: "unsupported or excluded files cannot publish facts",
+      path: ["facts"]
+    });
+  }
+  if ((value.role === "enricher" || value.coverage_tier === "lightweight-evidence") && value.facts.some((fact2) => fact2.denominator !== "none")) {
+    context.addIssue({
+      code: exports_external.ZodIssueCode.custom,
+      message: "enricher and lightweight evidence facts cannot contribute denominators",
+      path: ["facts"]
+    });
+  }
+});
+var toolchainStepSchema = exports_external.object({
+  step: idSchema,
+  package: packageCoordinateSchema,
+  export: exports_external.string().regex(/^[A-Za-z_$][A-Za-z0-9_$.-]*$/u),
+  version: semverSchema,
+  digest: digestSchema,
+  capabilities: exports_external.array(idSchema).min(1),
+  input_digest: digestSchema,
+  output_digest: digestSchema
+}).strict().superRefine((value, context) => {
+  addDuplicateIssues(value.capabilities, context, "capabilities");
+});
+var adapterDiagnosticSchema = exports_external.object({
+  code: idSchema,
+  fact_ref: canonicalRefSchema.optional(),
+  severity: exports_external.enum(["info", "warning", "error"]),
+  detail_digest: digestSchema
+}).strict();
+var indexerEvidenceAdapterResultSchema = exports_external.object({
+  protocol: exports_external.literal("context.indexer.evidence-adapter-result/v1"),
+  adapter: adapterIdentitySchema,
+  authorized_scope: exports_external.object({
+    source_ref: canonicalRefSchema,
+    module_refs: exports_external.array(canonicalRefSchema),
+    scope_digest: digestSchema
+  }).strict(),
+  input_digest: digestSchema,
+  precedence: exports_external.number().int().nonnegative(),
+  files: exports_external.array(indexerEvidenceAdapterFileSchema).min(1),
+  diagnostics: exports_external.array(adapterDiagnosticSchema),
+  toolchain: exports_external.array(toolchainStepSchema).min(1),
+  output_digest: digestSchema
+}).strict().superRefine((value, context) => {
+  addDuplicateIssues(value.authorized_scope.module_refs, context, "authorized_scope.module_refs");
+  addDuplicateIssues(value.files.map((file) => file.file_ref), context, "files");
+  addDuplicateIssues(value.toolchain.map((step) => step.step), context, "toolchain");
+});
+var FACT_PAYLOADS = new WeakMap;
+function canonicalFactPayload(value, seen = new WeakSet, path = "$") {
+  if (value === null || typeof value === "boolean" || typeof value === "string") {
+    return value;
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new TypeError("Indexer Evidence Adapter fact payload numbers must be finite");
+    }
+    return value;
+  }
+  if (typeof value !== "object") {
+    throw new TypeError(`Indexer Evidence Adapter fact payload ${path} must contain only JSON values`);
+  }
+  if (seen.has(value)) {
+    throw new TypeError(`Indexer Evidence Adapter fact payload ${path} must be acyclic`);
+  }
+  seen.add(value);
+  if (Array.isArray(value)) {
+    const output2 = value.map((item, index) => canonicalFactPayload(item, seen, `${path}[${index}]`));
+    seen.delete(value);
+    return output2;
+  }
+  if (Object.prototype.toString.call(value) !== "[object Object]") {
+    throw new TypeError(`Indexer Evidence Adapter fact payload ${path} must use plain JSON objects; received ${Object.prototype.toString.call(value)}`);
+  }
+  const output = {};
+  for (const [key, item] of Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)) {
+    output[key] = canonicalFactPayload(item, seen, `${path}.${key}`);
+  }
+  seen.delete(value);
+  return output;
+}
+function canonicalize(value) {
+  if (Array.isArray(value))
+    return value.map(canonicalize);
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, item]) => [key, canonicalize(item)]));
+  }
+  return value;
+}
+function indexerEvidenceAdapterProtocolDigest(value) {
+  const canonical = JSON.stringify(canonicalize(value));
+  return `sha256:${createHash("sha256").update(canonical).digest("hex")}`;
+}
+function indexerEvidenceAdapterFileRef(input) {
+  return `adapter-file:${indexerEvidenceAdapterProtocolDigest(input)}`;
+}
+function indexerEvidenceAdapterFactRef(input) {
+  return `adapter-fact:${indexerEvidenceAdapterProtocolDigest(input)}`;
+}
+function createIndexerEvidenceAdapterFact(input) {
+  const payload = canonicalFactPayload(input.payload);
+  const qualifiedItemPath = input.qualified_item_path.length <= 1024 ? input.qualified_item_path : `${input.qualified_item_path.slice(0, 950)}#${indexerEvidenceAdapterProtocolDigest(input.qualified_item_path)}`;
+  const locator = {
+    source_ref: input.source_ref,
+    module_ref: input.module_ref,
+    normalized_path: input.normalized_path,
+    qualified_item_path: qualifiedItemPath,
+    signature_digest: indexerEvidenceAdapterProtocolDigest(input.signature)
+  };
+  const fact2 = {
+    fact_ref: indexerEvidenceAdapterFactRef({ ...locator, kind: input.kind }),
+    kind: input.kind,
+    locator,
+    payload_digest: indexerEvidenceAdapterProtocolDigest(payload),
+    denominator: input.denominator
+  };
+  FACT_PAYLOADS.set(fact2, payload);
+  return fact2;
+}
+function indexerEvidenceAdapterFactPayloads(result) {
+  const payloads = result.files.flatMap((file) => file.facts.map((fact2) => {
+    const payload = FACT_PAYLOADS.get(fact2);
+    if (payload === undefined) {
+      throw new TypeError(`Evidence Adapter fact payload ${fact2.fact_ref} is no longer materialized in this process`);
+    }
+    if (indexerEvidenceAdapterProtocolDigest(payload) !== fact2.payload_digest) {
+      throw new TypeError(`Evidence Adapter fact payload ${fact2.fact_ref} is stale`);
+    }
+    return { fact_ref: fact2.fact_ref, payload };
+  })).sort((left, right) => compareCanonicalText(left.fact_ref, right.fact_ref));
+  return assertIndexerOutputSafe({ channel: "ipc-envelope", value: payloads });
+}
+function materializeIndexerEvidenceAdapterResult(result) {
+  return {
+    result,
+    fact_payloads: indexerEvidenceAdapterFactPayloads(result)
+  };
+}
+function indexerEvidenceAdapterOutputDigest(value) {
+  return indexerEvidenceAdapterProtocolDigest(value);
+}
+function compareCanonicalText(left, right) {
+  if (left < right)
+    return -1;
+  if (left > right)
+    return 1;
+  return 0;
+}
+function buildIndexerEvidenceAdapterResult(input) {
+  const canonical = {
+    ...input,
+    authorized_scope: {
+      ...input.authorized_scope,
+      module_refs: [...input.authorized_scope.module_refs].sort(compareCanonicalText)
+    },
+    files: input.files.map((file) => ({
+      ...file,
+      facts: [...file.facts].sort((left, right) => compareCanonicalText(left.fact_ref, right.fact_ref))
+    })).sort((left, right) => compareCanonicalText(left.file_ref, right.file_ref)),
+    diagnostics: [...input.diagnostics].sort((left, right) => compareCanonicalText(left.fact_ref ?? "", right.fact_ref ?? "") || compareCanonicalText(left.code, right.code) || compareCanonicalText(left.severity, right.severity) || compareCanonicalText(left.detail_digest, right.detail_digest)),
+    toolchain: input.toolchain.map((step) => ({
+      ...step,
+      capabilities: [...step.capabilities].sort(compareCanonicalText)
+    }))
+  };
+  const payloads = new Map;
+  for (const file of canonical.files) {
+    for (const fact2 of file.facts) {
+      const payload = FACT_PAYLOADS.get(fact2);
+      if (payload !== undefined)
+        payloads.set(fact2.fact_ref, payload);
+    }
+  }
+  const parsed = indexerEvidenceAdapterResultSchema.parse({
+    ...canonical,
+    output_digest: indexerEvidenceAdapterOutputDigest(canonical)
+  });
+  for (const file of parsed.files) {
+    for (const fact2 of file.facts) {
+      const payload = payloads.get(fact2.fact_ref);
+      if (payload !== undefined)
+        FACT_PAYLOADS.set(fact2, payload);
+    }
+  }
+  return assertIndexerOutputSafe({ channel: "success-payload", value: parsed });
+}
+// ../core/src/errors/c4aError.ts
+class C4AError extends Error {
+  code;
+  details;
+  constructor(code, message, details, options) {
+    super(message, options);
+    this.name = "C4AError";
+    this.code = code;
+    this.details = details;
+  }
+  toResponse() {
+    if (this.details === undefined) {
+      return { code: this.code, message: this.message };
+    }
+    return { code: this.code, message: this.message, details: this.details };
+  }
+}
+// ../core/src/errors/errorCodes.ts
+var ErrorCode;
+((ErrorCode2) => {
+  ErrorCode2["VALIDATION_FAILED"] = "VALIDATION_FAILED";
+  ErrorCode2["VALIDATION_SCHEMA"] = "VALIDATION_SCHEMA";
+  ErrorCode2["STORAGE_FAILED"] = "STORAGE_FAILED";
+  ErrorCode2["STORAGE_NOT_FOUND"] = "STORAGE_NOT_FOUND";
+  ErrorCode2["STORAGE_CONFLICT"] = "STORAGE_CONFLICT";
+  ErrorCode2["PARSE_FAILED"] = "PARSE_FAILED";
+  ErrorCode2["PARSE_YAML"] = "PARSE_YAML";
+  ErrorCode2["API_NOT_IMPLEMENTED"] = "API_NOT_IMPLEMENTED";
+  ErrorCode2["API_UNAUTHORIZED"] = "API_UNAUTHORIZED";
+  ErrorCode2["API_RATE_LIMITED"] = "API_RATE_LIMITED";
+  ErrorCode2["ENTITY_NOT_FOUND"] = "ENTITY_NOT_FOUND";
+  ErrorCode2["ENTITY_DUPLICATE"] = "ENTITY_DUPLICATE";
+  ErrorCode2["RELATION_INVALID"] = "RELATION_INVALID";
+  ErrorCode2["BATCH_PARTIAL_FAILURE"] = "BATCH_PARTIAL_FAILURE";
+  ErrorCode2["QUERY_INVALID_PARAMS"] = "QUERY_INVALID_PARAMS";
+  ErrorCode2["BACKUP_FAILED"] = "BACKUP_FAILED";
+  ErrorCode2["RESTORE_FAILED"] = "RESTORE_FAILED";
+  ErrorCode2["PURGE_FAILED"] = "PURGE_FAILED";
+  ErrorCode2["BACKUP_VERSION_INCOMPATIBLE"] = "BACKUP_VERSION_INCOMPATIBLE";
+  ErrorCode2["BACKUP_MANIFEST_INVALID"] = "BACKUP_MANIFEST_INVALID";
+  ErrorCode2["BACKUP_DIR_NOT_FOUND"] = "BACKUP_DIR_NOT_FOUND";
+  ErrorCode2["EMBEDDING_NOT_AVAILABLE"] = "EMBEDDING_NOT_AVAILABLE";
+  ErrorCode2["EMBEDDING_FAILED"] = "EMBEDDING_FAILED";
+  ErrorCode2["LLM_NOT_AVAILABLE"] = "LLM_NOT_AVAILABLE";
+  ErrorCode2["LLM_CALL_FAILED"] = "LLM_CALL_FAILED";
+  ErrorCode2["LLM_AUTH_FAILED"] = "LLM_AUTH_FAILED";
+  ErrorCode2["AUTH_REQUIRED"] = "AUTH_REQUIRED";
+  ErrorCode2["AUTH_INVALID_TOKEN"] = "AUTH_INVALID_TOKEN";
+  ErrorCode2["AUTH_INVALID_API_KEY"] = "AUTH_INVALID_API_KEY";
+  ErrorCode2["AUTH_PROVIDER_ERROR"] = "AUTH_PROVIDER_ERROR";
+  ErrorCode2["AUTH_RESERVED_NAME"] = "AUTH_RESERVED_NAME";
+  ErrorCode2["DAEMON_OFFLINE"] = "DAEMON_OFFLINE";
+  ErrorCode2["SOURCE_NOT_FOUND"] = "SOURCE_NOT_FOUND";
+  ErrorCode2["REPO_PATH_NOT_FOUND"] = "REPO_PATH_NOT_FOUND";
+  ErrorCode2["COMMIT_NOT_FOUND"] = "COMMIT_NOT_FOUND";
+  ErrorCode2["INDEX_IN_PROGRESS"] = "INDEX_IN_PROGRESS";
+  ErrorCode2["DIGEST_NOT_FOUND"] = "DIGEST_NOT_FOUND";
+  ErrorCode2["INVALID_REGEX"] = "INVALID_REGEX";
+  ErrorCode2["SOURCE_ACCESS_DENIED"] = "SOURCE_ACCESS_DENIED";
+  ErrorCode2["NOT_INDEXED"] = "NOT_INDEXED";
+  ErrorCode2["QUERY_TIMEOUT"] = "QUERY_TIMEOUT";
+  ErrorCode2["INTENT_NOT_AVAILABLE"] = "INTENT_NOT_AVAILABLE";
+  ErrorCode2["SUB_PATH_CONFLICT"] = "SUB_PATH_CONFLICT";
+  ErrorCode2["WORKSPACE_ISOLATION"] = "WORKSPACE_ISOLATION";
+  ErrorCode2["VECTOR_DIMENSION_MISMATCH"] = "VECTOR_DIMENSION_MISMATCH";
+  ErrorCode2["VECTOR_REBUILD_PARTIAL"] = "VECTOR_REBUILD_PARTIAL";
+  ErrorCode2["COMMIT_NOT_AVAILABLE"] = "COMMIT_NOT_AVAILABLE";
+  ErrorCode2["DAEMON_AUTO_START_FAILED"] = "DAEMON_AUTO_START_FAILED";
+  ErrorCode2["GIT_ARCHIVE_FAILED"] = "GIT_ARCHIVE_FAILED";
+  ErrorCode2["GIT_HOST_NOT_CONFIGURED"] = "GIT_HOST_NOT_CONFIGURED";
+  ErrorCode2["GIT_API_RATE_LIMITED"] = "GIT_API_RATE_LIMITED";
+  ErrorCode2["GIT_API_TREE_TRUNCATED"] = "GIT_API_TREE_TRUNCATED";
+  ErrorCode2["GIT_API_AUTH_FAILED"] = "GIT_API_AUTH_FAILED";
+  ErrorCode2["GIT_API_REPO_NOT_FOUND"] = "GIT_API_REPO_NOT_FOUND";
+  ErrorCode2["GIT_API_NETWORK_ERROR"] = "GIT_API_NETWORK_ERROR";
+  ErrorCode2["DOC_INDEX_LLM_UNAVAILABLE"] = "DOC_INDEX_LLM_UNAVAILABLE";
+  ErrorCode2["DOC_INDEX_EMBEDDING_UNAVAILABLE"] = "DOC_INDEX_EMBEDDING_UNAVAILABLE";
+  ErrorCode2["DOC_INDEX_CONTENT_MISSING"] = "DOC_INDEX_CONTENT_MISSING";
+  ErrorCode2["DOC_INDEX_PARSE_FAILED"] = "DOC_INDEX_PARSE_FAILED";
+  ErrorCode2["DOC_INDEX_LLM_EXHAUSTED"] = "DOC_INDEX_LLM_EXHAUSTED";
+  ErrorCode2["UNKNOWN"] = "UNKNOWN";
+})(ErrorCode ||= {});
 // ../core/src/errors/httpStatus.ts
 var ERROR_CODE_HTTP_STATUS = {
   ["VALIDATION_FAILED" /* VALIDATION_FAILED */]: 400,
@@ -13125,21 +13693,102 @@ var ERROR_CODE_HTTP_STATUS = {
   ["UNKNOWN" /* UNKNOWN */]: 500,
   ["WORKSPACE_ISOLATION" /* WORKSPACE_ISOLATION */]: 400
 };
+function mapErrorCodeToStatus(code) {
+  return ERROR_CODE_HTTP_STATUS[code] ?? 500;
+}
+// ../core/src/utils/id.ts
+import { createHash as createHash2, randomUUID } from "node:crypto";
+function generateId(type, parentId, name) {
+  const input = `${type}:${parentId}:${name}`;
+  const hash = createHash2("sha256").update(input).digest("hex");
+  const hex32 = hash.slice(0, 32);
+  return `${type}_${hex32}`;
+}
+function generateUUID() {
+  return randomUUID();
+}
 // ../core/src/utils/hash.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 function contentHash(content) {
-  return createHash("sha256").update(content).digest("hex");
+  return createHash3("sha256").update(content).digest("hex");
+}
+// ../core/src/utils/object.ts
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function mergeDefaults(defaults, override) {
+  const result = { ...defaults };
+  for (const [key, value] of Object.entries(override)) {
+    if (!(key in defaults))
+      continue;
+    const defaultValue = defaults[key];
+    if (isPlainObject(defaultValue)) {
+      if (isPlainObject(value)) {
+        result[key] = mergeDefaults(defaultValue, value);
+      }
+    } else if (value !== undefined && value !== null) {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+// ../core/src/utils/path.ts
+import path from "node:path";
+function isPathSafe(inputPath) {
+  if (inputPath.length === 0) {
+    return false;
+  }
+  if (inputPath.includes("\x00")) {
+    return false;
+  }
+  if (path.isAbsolute(inputPath)) {
+    return false;
+  }
+  if (/^[a-zA-Z]:/.test(inputPath)) {
+    return false;
+  }
+  if (inputPath.startsWith("~")) {
+    return false;
+  }
+  const normalized = path.posix.normalize(inputPath.replaceAll("\\", "/"));
+  const parts = normalized.split("/");
+  return !parts.some((part) => part === ".." || part === "");
 }
 // ../core/src/utils/yaml.ts
 var import_yaml = __toESM(require_dist(), 1);
+function serializeYaml(value) {
+  return import_yaml.default.stringify(value);
+}
+function parseYaml(value) {
+  try {
+    return import_yaml.default.parse(value);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Failed to parse YAML";
+    throw new C4AError("PARSE_YAML" /* PARSE_YAML */, message, { input: value });
+  }
+}
 // ../core/src/utils/glob.ts
 var import_picomatch = __toESM(require_picomatch2(), 1);
+var globToRegex = (glob) => import_picomatch.default.makeRe(glob, { dot: false });
 function createPathMatcher(rules) {
   if (rules.include.length === 0)
     return () => false;
   const isIncluded = import_picomatch.default(rules.include, { dot: false });
   const isExcluded = rules.exclude.length > 0 ? import_picomatch.default(rules.exclude, { dot: false }) : () => false;
-  return (path) => isIncluded(path) && !isExcluded(path);
+  return (path2) => isIncluded(path2) && !isExcluded(path2);
+}
+function matchesPathFilter(path2, category, config) {
+  const section = config[category];
+  const include = section.include;
+  const exclude = "exclude" in section ? section.exclude : [];
+  if (include.length === 0)
+    return false;
+  const isIncluded = import_picomatch.default.isMatch(path2, include, { dot: false });
+  if (!isIncluded)
+    return false;
+  if (exclude.length > 0 && import_picomatch.default.isMatch(path2, exclude, { dot: false }))
+    return false;
+  return true;
 }
 // ../core/src/utils/version.ts
 var VERSION_LABEL_REGEX = /^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-(alpha|beta|rc)\.(0|[1-9]\d*))?$/i;
@@ -13176,7 +13825,38 @@ function encodeVersionLabel(label) {
   }
   return major * 1e6 + minor * 1e4 + patch * 100 + prerelease;
 }
+function isVersionVisible(record, versionCode) {
+  if (versionCode == null) {
+    return true;
+  }
+  return (record.valid_from == null || record.valid_from <= versionCode) && (record.valid_until == null || record.valid_until > versionCode);
+}
+// ../core/src/utils/factContent.ts
+var SEARCH_PREFIX_RE = /^\[c4a:search [^\]\n]+\]\n\n/;
+function buildSearchPrefix(keywords) {
+  if (!keywords || keywords.length === 0)
+    return "";
+  const cleaned = keywords.map((k) => k.trim()).filter((k) => k.length > 0);
+  if (cleaned.length === 0)
+    return "";
+  return `[c4a:search ${cleaned.join(" ")}]
+
+`;
+}
+function stripSearchPrefix(content) {
+  if (!content)
+    return content ?? "";
+  return content.replace(SEARCH_PREFIX_RE, "");
+}
 // ../core/src/constants.ts
+var DEFAULT_WORKSPACE_NAME = "My Brain";
+var DEFAULT_CLOUD_LIBRARY_NAME = "My Drive";
+var SUPERTEST_EMAIL = "supertest@context4ai.org";
+var SUPERTEST_USER_NAME = "SuperTest";
+var RESERVED_USER_NAMES = ["SuperTest"];
+var DAEMON_HEARTBEAT_INTERVAL = 30000;
+var DAEMON_OFFLINE_THRESHOLD = 60000;
+var CLOUD_DAEMON_IDLE_TIMEOUT = 300000;
 var SCAN_EXCLUDED_DIRS = new Set([
   ".git",
   ".svn",
@@ -13212,6 +13892,17 @@ var SCAN_EXCLUDED_DIRS = new Set([
   "fixtures",
   ".tmp"
 ]);
+var CODE_DIGEST_TYPE = "code_tc_b";
+var hasExcludedSegment = (filePath) => {
+  const segments = filePath.split("/");
+  for (let i = 0;i < segments.length - 1; i++) {
+    const seg = segments[i];
+    if (SCAN_EXCLUDED_DIRS.has(seg) || seg.startsWith(".") && seg !== "." || seg.endsWith(".egg-info")) {
+      return true;
+    }
+  }
+  return false;
+};
 // ../core/src/contentTypeRegistry.ts
 var DEFAULT_CONTENT_TYPES = [
   {
@@ -13225,7 +13916,15 @@ var DEFAULT_CONTENT_TYPES = [
   {
     id: "typescript",
     category: "code",
-    match: { extensions: [".ts", ".tsx"] },
+    match: { extensions: [".ts", ".tsx", ".mts", ".cts"] },
+    cas: { encoding: "utf8", hashInput: "content" },
+    pipeline: { digest: ["ast", "summary"], extraction: ["entities", "relations"] },
+    display: { icon: "\uD83D\uDCDC", renderer: "code" }
+  },
+  {
+    id: "javascript",
+    category: "code",
+    match: { extensions: [".js", ".jsx", ".mjs", ".cjs"] },
     cas: { encoding: "utf8", hashInput: "content" },
     pipeline: { digest: ["ast", "summary"], extraction: ["entities", "relations"] },
     display: { icon: "\uD83D\uDCDC", renderer: "code" }
@@ -13333,6 +14032,15 @@ var INDEXABLE_EXTENSIONS = new Set([
 var UPLOAD_ALLOWED_EXTENSIONS = collectExtensions(() => true);
 var TEXT_EXTENSIONS = collectExtensions((definition) => definition.cas.encoding === "utf8");
 var UPLOAD_MAX_FILE_SIZE = 5 * 1024 * 1024;
+var UPLOAD_MAX_FILES = 20;
+function getFileExtension(name) {
+  const dot = name.lastIndexOf(".");
+  return dot >= 0 ? name.slice(dot).toLowerCase() : "";
+}
+function isIndexableFile(fileName, manifestFiles) {
+  const baseName = fileName.includes("/") ? fileName.split("/").pop() : fileName;
+  return defaultRegistry.resolve(baseName) !== null;
+}
 // src/digest.ts
 var sortUniqueNames = (symbols) => [...new Set(symbols.map((symbol) => symbol.name))].sort((left, right) => left.localeCompare(right));
 var deduplicateSymbols = (symbols) => {
@@ -13356,6 +14064,7 @@ var generateDigest = (result) => {
     files: result.files,
     symbols: allSymbols,
     relations: result.relations,
+    ...result.coverage ? { coverage: result.coverage } : {},
     stats: {
       files: result.stats.files,
       lines: result.stats.lines,
@@ -13699,7 +14408,7 @@ var buildCodeSnapshot = (input) => {
 
 // src/repository.ts
 import { readFile as readFile2, readdir as readdir2, stat } from "node:fs/promises";
-import path2 from "node:path";
+import path3 from "node:path";
 
 // src/registry.ts
 var MANIFEST_LANGUAGE_CANDIDATES = {
@@ -13748,11 +14457,20 @@ import { promisify } from "node:util";
 var execFileAsync = promisify(execFile);
 var isScanExcludedDir = (name) => SCAN_EXCLUDED_DIRS.has(name) || name.startsWith(".") && name !== "." || name.endsWith(".egg-info");
 var DEFAULT_EXCLUDED_FILE_PATTERNS = [
-  /\.test\.ts$/i,
-  /\.spec\.ts$/i,
-  /\.d\.ts$/i
+  /\.test\.(?:[cm]?[jt]sx?)$/i,
+  /\.spec\.(?:[cm]?[jt]sx?)$/i,
+  /\.d\.(?:ts|mts|cts)$/i
 ];
-var SUPPORTED_EXTENSIONS = new Set([".ts", ".tsx"]);
+var SUPPORTED_EXTENSIONS = new Set([
+  ".ts",
+  ".tsx",
+  ".mts",
+  ".cts",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs"
+]);
 var toPosixPath = (value) => value.split(sep).join("/");
 var shouldExcludeFile = (fileName) => DEFAULT_EXCLUDED_FILE_PATTERNS.some((pattern) => pattern.test(fileName));
 var isSupportedSourceFile = (fileName) => SUPPORTED_EXTENSIONS.has(extname(fileName));
@@ -13904,11 +14622,7 @@ var countFileLines = async (filePath) => {
   const contents = await readFile(filePath, "utf-8");
   if (contents === "")
     return 0;
-  const lines = contents.split(/\r\n|\r|\n/);
-  if (lines[lines.length - 1] === "") {
-    lines.pop();
-  }
-  return lines.length;
+  return contents.split(/\r\n|\r|\n/).filter((line) => line.trim().length > 0).length;
 };
 var MANIFEST_FILES = [
   "package.json",
@@ -14054,13 +14768,19 @@ var findSubModuleDirs = async (rootDir, excludeDirs, gitFiles, pathFilter2) => {
 var buildModule = async (repoRoot, moduleDir, moduleName, childModuleDirs, ref, pathFilter2, gitFiles) => {
   const excludes = childModuleDirs.size > 0 ? childModuleDirs : undefined;
   const moduleFiles = gitFiles !== undefined && gitFiles !== null && gitFiles.size > 0 ? filterGitSourceFiles(resolve(moduleDir), gitFiles, excludes, pathFilter2) : await scanSourceFiles(moduleDir, excludes, ref, pathFilter2);
+  const broadPathFilter = pathFilter2 === undefined ? undefined : { ...pathFilter2, code: { ...pathFilter2.code, exclude: [] } };
+  const allMatchedFiles = broadPathFilter === undefined ? moduleFiles : gitFiles !== undefined && gitFiles !== null && gitFiles.size > 0 ? filterGitSourceFiles(resolve(moduleDir), gitFiles, excludes, broadPathFilter) : await scanSourceFiles(moduleDir, excludes, ref, broadPathFilter);
+  const included = new Set(moduleFiles);
+  const excludedModuleFiles = allMatchedFiles.filter((file) => !included.has(file));
   const modulePath = toPosixPath(relative(repoRoot, moduleDir)) || ".";
   const totalLines = await Promise.all(moduleFiles.map((file) => countFileLines(join(moduleDir, file))));
   const files = modulePath === "." ? moduleFiles : moduleFiles.map((file) => toPosixPath(join(modulePath, file)));
+  const excludedFiles = modulePath === "." ? excludedModuleFiles : excludedModuleFiles.map((file) => toPosixPath(join(modulePath, file)));
   return {
     name: moduleName,
     path: modulePath,
     files,
+    ...excludedFiles.length === 0 ? {} : { excludedFiles },
     fileCount: files.length,
     totalLines: totalLines.reduce((sum, value) => sum + value, 0)
   };
@@ -14172,10 +14892,10 @@ class ExtractionInputError extends Error {
 // src/repository.ts
 var PACKAGE_JSON = "package.json";
 var GO_MOD = "go.mod";
-var toPosixPath2 = (value) => value.split(path2.sep).join("/");
+var toPosixPath2 = (value) => value.split(path3.sep).join("/");
 function safeSourceRelativePath(value) {
   const slashPath = value.trim().replace(/\\/gu, "/");
-  const normalized = path2.posix.normalize(slashPath).replace(/^\.\//u, "");
+  const normalized = path3.posix.normalize(slashPath).replace(/^\.\//u, "");
   if (normalized.length === 0 || normalized === "." || normalized === ".." || normalized.startsWith("../") || normalized.startsWith("/") || /^[A-Za-z]:\//u.test(normalized)) {
     throw new Error(`Extraction entry must be a source-relative file path: ${value}`);
   }
@@ -14193,7 +14913,7 @@ function moduleRelativeEntryPath(modulePath, sourcePath) {
 function entrySubpath(filePath, index) {
   if (index === 0)
     return ".";
-  const withoutExtension = filePath.replace(/\.(?:d\.)?(?:ts|tsx|mts|cts|go)$/u, "");
+  const withoutExtension = filePath.replace(/\.(?:d\.)?(?:ts|tsx|mts|cts|js|jsx|mjs|cjs|go)$/u, "");
   return `./${withoutExtension}`;
 }
 function selectedEntryFiles(input) {
@@ -14239,11 +14959,11 @@ var resolveRepoRelativePath = (modulePath, value) => {
     return normalizedValue;
   return `${normalizeRelativePath(modulePath)}/${normalizedValue}`;
 };
-var resolveModuleDir = (repoPath, modulePath) => modulePath === "." ? repoPath : path2.join(repoPath, modulePath);
+var resolveModuleDir = (repoPath, modulePath) => modulePath === "." ? repoPath : path3.join(repoPath, modulePath);
 var resolveModuleFsPath = (moduleDir, filePath) => {
-  const candidate = path2.isAbsolute(filePath) ? filePath : path2.resolve(moduleDir, filePath);
-  const relativePath = path2.relative(moduleDir, candidate);
-  if (relativePath.startsWith("..") || path2.isAbsolute(relativePath)) {
+  const candidate = path3.isAbsolute(filePath) ? filePath : path3.resolve(moduleDir, filePath);
+  const relativePath = path3.relative(moduleDir, candidate);
+  if (relativePath.startsWith("..") || path3.isAbsolute(relativePath)) {
     throw new Error(`Path escapes module root: ${filePath}`);
   }
   return candidate;
@@ -14323,7 +15043,20 @@ var prefixExtractionPaths = (extraction, modulePath, commitHash) => ({
     ...file,
     path: resolveRepoRelativePath(modulePath, file.path)
   })),
-  symbols: extraction.symbols.map((symbol) => prefixSymbolPaths(symbol, modulePath))
+  symbols: extraction.symbols.map((symbol) => prefixSymbolPaths(symbol, modulePath)),
+  ...extraction.coverage ? {
+    coverage: {
+      ...extraction.coverage,
+      files: extraction.coverage.files.map((file) => ({
+        ...file,
+        path: resolveRepoRelativePath(modulePath, file.path)
+      })),
+      diagnostics: extraction.coverage.diagnostics.map((diagnostic) => ({
+        ...diagnostic,
+        file: resolveRepoRelativePath(modulePath, diagnostic.file)
+      }))
+    }
+  } : {}
 });
 var normalizeExtractionPaths = (extraction, entryDetection, modulePath, commitHash) => ({
   entryDetection: prefixEntryDetectionPaths(entryDetection, modulePath),
@@ -14375,7 +15108,7 @@ var resolveRequestedModules = async (repoPath, modulePaths, ref, pathFilter2) =>
   return { modules, moduleErrors };
 };
 var runRepositoryExtraction = async (input) => {
-  const repoPath = path2.resolve(input.repoPath);
+  const repoPath = path3.resolve(input.repoPath);
   input.onProgress?.({ phase: "scanning", progress: 0, message: "detecting modules" });
   const { modules, moduleErrors } = await resolveRequestedModules(repoPath, input.modules, input.ref, input.pathFilter);
   const registry = new ExtractionPluginRegistry;
@@ -14436,7 +15169,6 @@ var runRepositoryExtraction = async (input) => {
   }
   return { repoPath, results, moduleErrors };
 };
-
 // src/runner.ts
 var pluginSpecSchema = exports_external.object({
   package: exports_external.string().min(1),
@@ -14487,9 +15219,9 @@ var isPlugin = (value) => {
 var resolvePluginModule = (packageName, cwd) => {
   if (packageName.startsWith(".") || packageName.startsWith("/") || packageName.startsWith("file:")) {
     const filePath = packageName.startsWith("file:") ? packageName.slice("file:".length) : packageName;
-    return path3.resolve(cwd, filePath);
+    return path4.resolve(cwd, filePath);
   }
-  const require2 = createRequire2(path3.join(cwd, "package.json"));
+  const require2 = createRequire2(path4.join(cwd, "package.json"));
   return require2.resolve(packageName);
 };
 var loadRunnerPlugins = async (pluginSpecs, cwd = process.cwd()) => {
@@ -14559,11 +15291,15 @@ var runCodeExtractCli = async () => {
     const input = stdin.trim() ? JSON.parse(stdin) : {};
     const events = await runCodeExtractRunner(input);
     for (const event of events) {
-      process.stdout.write(JSON.stringify(event) + `
+      const filtered = redactIndexerOutput({ channel: "stdout", value: event });
+      process.stdout.write(JSON.stringify(filtered.value) + `
 `);
     }
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
+    const message = redactIndexerOutputText({
+      channel: "exception-message",
+      value: error instanceof Error ? error.message : String(error)
+    });
     process.stdout.write(JSON.stringify({ type: "error", code: "runner-failed", message }) + `
 `);
     process.exitCode = 1;
@@ -14571,7 +15307,7 @@ var runCodeExtractCli = async () => {
 };
 var runCodeExtractCliFromFile = async (inputFile) => {
   const content = await readFile3(inputFile, "utf-8");
-  return runCodeExtractRunner(JSON.parse(content), path3.dirname(path3.resolve(inputFile)));
+  return runCodeExtractRunner(JSON.parse(content), path4.dirname(path4.resolve(inputFile)));
 };
 
 // src/bin/c4a-extract-code.ts