@cejel/cejel 0.4.9 → 0.4.11

package/README.md

@@ -36,7 +36,10 @@ untouched holdout, every preregistered gate to pass, and a separately recorded p
 
 ### Measured recall (bounded)
 
-> **Measured recall (bounded).** Cejel publishes no general detection-recall figure. On a frozen,
+> **Measured recall (bounded).** Cejel publishes one cohort-level in-scope detection-recall
+> figure, for the prospective v22 rubric, in `docs/calibration/v22-detection-recall/`; no general
+> figure exists, and the three quantities called recall are set side by side on
+> cejel.dev/methodology. On a frozen,
 > preregistered, in-scope held-out fixture set of 30 named defects, the released public default
 > (v17, tree `a857f0b3`) cited **16/30**, two-sided 95% Wilson interval **[36.1%, 69.8%]**; the
 > prospective v22 detector (commit `8a289ea`, tree `10960a03`) cited **24/30**, two-sided 95%
@@ -89,7 +92,7 @@ if (-not $expected -or $actual -ne $expected.ToLowerInvariant()) {
 ```
 
 > **Windows signing status:** `cejel-Windows-x86_64.exe` is intentionally unsigned in
-> 0.4.9 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
+> 0.4.11 and may trigger Microsoft SmartScreen. The release build removes Node's inherited
 > signature before SEA injection and fails unless Windows reports the result as `NotSigned`;
 > it does not ship an invalid signature. Before running it, verify `SHA256SUMS` and the
 > GitHub build-provenance attestation. Each binary also has an attached SPDX SBOM and an
@@ -112,7 +115,7 @@ docker run --rm --network=none -v "$PWD:/w" -w /w -v "$PWD/cejel:/cejel:ro" debi
 npx @cejel/cejel@latest .
 ```
 
-> **Distribution note:** Cejel `0.4.9` is the coordinated release version for npm,
+> **Distribution note:** Cejel `0.4.11` is the coordinated release version for npm,
 > standalone binaries, Docker/OCI, GitHub Action, Homebrew, and MCP Registry.
 
 `npx` can reuse a stale cached package. Force the current npm release with the `@latest`
@@ -174,16 +177,16 @@ gh attestation verify ./cejel-Windows-x86_64.exe -R BargLabs/cejel
 This is cryptographically signed provenance. It is distinct from Apple Developer ID or
 Microsoft Authenticode code-signing.
 
-**Docker / OCI.** The current container release is `0.4.9`:
+**Docker / OCI.** The current container release is `0.4.11`:
 
 ```bash
-docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.9
+docker run --rm -i -v "$PWD:/workspace:ro" ghcr.io/barglabs/cejel:0.4.11
 ```
 
 The image defaults to `cejel-mcp` over stdio. To use the CLI instead:
 
 ```bash
-docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.9 .
+docker run --rm -v "$PWD:/workspace:ro" --entrypoint cejel ghcr.io/barglabs/cejel:0.4.11 .
 ```
 
 The OCI image carries an SBOM, maximum-mode build provenance, and a signed registry
@@ -513,7 +516,7 @@ The OCI image is an alternative when Docker is the preferred execution boundary.
 the host path with the repository OpenClaw should allow Cejel to read:
 
 ```bash
-npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.4.9"]}'
+npx -y openclaw@latest mcp set cejel-oci '{"command":"docker","args":["run","--rm","-i","-v","/absolute/path/to/repo:/workspace:ro","ghcr.io/barglabs/cejel:0.4.11"]}'
 npx -y openclaw@latest mcp doctor cejel-oci --probe
 ```
 

package/dist/calibration/llm-detector.js

@@ -5,20 +5,20 @@ import {
   deriveProductIdentity,
   runCejelScan,
   serializeWitanReport
-} from "../chunk-TUUNJP27.js";
+} from "../chunk-UBCIGOIP.js";
 import {
   listCejelLlmPackFiles
-} from "../chunk-IN2LPGGU.js";
-import "../chunk-IHT7B6L7.js";
+} from "../chunk-M6YYPJSN.js";
+import "../chunk-63XQDYQ5.js";
 import {
   external_exports
-} from "../chunk-GKYTLWQK.js";
+} from "../chunk-FSMZV3Y6.js";
 import {
   init_esm_shims,
   readRepoText,
   recordContentSkip,
   recordFilesystemSkip
-} from "../chunk-PTZU6G4E.js";
+} from "../chunk-O3MHSK25.js";
 
 // src/calibration/llm-detector.ts
 init_esm_shims();

package/dist/{chunk-IHT7B6L7.js → chunk-63XQDYQ5.js}

@@ -3,7 +3,7 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   init_esm_shims
-} from "./chunk-PTZU6G4E.js";
+} from "./chunk-O3MHSK25.js";
 
 // src/witan/git-exec.ts
 init_esm_shims();

package/dist/{chunk-GKYTLWQK.js → chunk-FSMZV3Y6.js}

@@ -4,7 +4,7 @@ const require = __cejelCreateRequire(import.meta.url);
 import {
   __export,
   init_esm_shims
-} from "./chunk-PTZU6G4E.js";
+} from "./chunk-O3MHSK25.js";
 
 // node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};

package/dist/{chunk-IN2LPGGU.js → chunk-M6YYPJSN.js}

@@ -5,10 +5,10 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-IHT7B6L7.js";
+} from "./chunk-63XQDYQ5.js";
 import {
   init_esm_shims
-} from "./chunk-PTZU6G4E.js";
+} from "./chunk-O3MHSK25.js";
 
 // src/packs/llm/files.ts
 init_esm_shims();

package/dist/{chunk-PTZU6G4E.js → chunk-O3MHSK25.js}

@@ -171,7 +171,8 @@ function trackContentReads(_repoPath, collect) {
     unattributedCriteria: /* @__PURE__ */ new Set(),
     criterionSkipReasons: /* @__PURE__ */ new Map(),
     signalSkipReasons: /* @__PURE__ */ new Map(),
-    withheldPaths: /* @__PURE__ */ new Map()
+    withheldPaths: /* @__PURE__ */ new Map(),
+    withheldPathIntersections: /* @__PURE__ */ new Map()
   };
   activeSession = session;
   try {
@@ -225,16 +226,42 @@ function registerWithheldRepoPath(relativePath, reason) {
   if (!session) return;
   addSkipReason(session.withheldPaths, relativePath, reason);
 }
-function abstainSignalOnWithheldPaths(criterionId, signalId, wouldHaveRead) {
+function withheldRepoPaths() {
+  const session = activeSession;
+  if (!session) return [];
+  return [...session.withheldPaths].map(([path2, reasons]) => {
+    const intersection = session.withheldPathIntersections.get(path2);
+    return {
+      path: path2,
+      reasons,
+      signalsAdmitting: intersection ? [...intersection.signalsAdmitting].sort() : [],
+      actedOn: intersection?.actedOn ?? false
+    };
+  }).sort((left, right) => left.path.localeCompare(right.path));
+}
+function abstainSignalOnWithheldPaths(criterionId, signalId, wouldHaveRead, act) {
   const session = activeSession;
   if (!session) return false;
-  let abstained = false;
+  let admitted = false;
+  const signalKey = `${criterionId}.${signalId}`;
   for (const [path2, reasons] of session.withheldPaths) {
     if (!wouldHaveRead(path2)) continue;
-    abstained = true;
-    for (const reason of reasons) attributeSkip(session, criterionId, [signalId], reason);
+    admitted = true;
+    const existing = session.withheldPathIntersections.get(path2);
+    if (existing) {
+      existing.signalsAdmitting.add(signalKey);
+      if (act) existing.actedOn = true;
+    } else {
+      session.withheldPathIntersections.set(path2, {
+        signalsAdmitting: /* @__PURE__ */ new Set([signalKey]),
+        actedOn: act
+      });
+    }
+    if (act) {
+      for (const reason of reasons) attributeSkip(session, criterionId, [signalId], reason);
+    }
   }
-  return abstained;
+  return admitted && act;
 }
 function recordFilesystemSkip(path2, error, deniedContext = false, deduplicate = true) {
   const errno = errnoClass(error);
@@ -315,6 +342,7 @@ export {
   withContentReadSignals,
   recordContentSkip,
   registerWithheldRepoPath,
+  withheldRepoPaths,
   abstainSignalOnWithheldPaths,
   recordFilesystemSkip,
   readRepoText,

package/dist/{chunk-IQ42TE5H.js → chunk-RH6FKREX.js}

@@ -7,7 +7,7 @@ import {
   __filename,
   __require,
   init_esm_shims
-} from "./chunk-PTZU6G4E.js";
+} from "./chunk-O3MHSK25.js";
 
 // node_modules/.pnpm/typescript@5.9.3/node_modules/typescript/lib/typescript.js
 var require_typescript = __commonJS({

package/dist/{chunk-TUUNJP27.js → chunk-UBCIGOIP.js}

@@ -5,10 +5,10 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-IHT7B6L7.js";
+} from "./chunk-63XQDYQ5.js";
 import {
   external_exports
-} from "./chunk-GKYTLWQK.js";
+} from "./chunk-FSMZV3Y6.js";
 import {
   MAX_REPOSITORY_CONTENT_BYTES,
   abstainSignalOnWithheldPaths,
@@ -23,8 +23,9 @@ import {
   trackContentReads,
   withContentReadCriterion,
   withContentReadSignal,
-  withContentReadSignals
-} from "./chunk-PTZU6G4E.js";
+  withContentReadSignals,
+  withheldRepoPaths
+} from "./chunk-O3MHSK25.js";
 
 // src/witan/schemas.ts
 init_esm_shims();
@@ -226,6 +227,12 @@ var WitanContentReadSummarySchema = external_exports.object({
     });
   }
 });
+var WitanWithheldPathSchema = external_exports.object({
+  path: external_exports.string().min(1).max(700),
+  reason: WitanContentReadSkipReasonSchema,
+  signalsAdmitting: external_exports.array(external_exports.string().min(1).max(160)),
+  actedOn: external_exports.boolean()
+}).strict();
 var WitanRepoRefSchema = external_exports.object({
   // Retained for backward-compatible verification of reports emitted through v0.4.0.
   // New reports omit the checkout path so their bytes are independent of run location.
@@ -243,7 +250,11 @@ var WitanReportInputSchema = external_exports.object({
   archetype: WitanRepoArchetypeSchema.optional(),
   insufficientSourceReason: external_exports.string().min(1).max(2e3).optional(),
   scanLimitations: external_exports.array(external_exports.string().min(1).max(1e3)).max(16).default([]),
-  contentReadSummary: WitanContentReadSummarySchema.optional()
+  contentReadSummary: WitanContentReadSummarySchema.optional(),
+  // Always populated by buildWitanInputFromRepo, including as [] when nothing was withheld —
+  // presence with an empty array is itself the "nothing withheld" statement, distinct from
+  // absence (a report predating this field, which does not claim one way or the other).
+  withheldPaths: external_exports.array(WitanWithheldPathSchema).default([])
 }).strict();
 var WitanCriterionScoreSchema = external_exports.object({
   id: WitanCriterionIdSchema,
@@ -331,6 +342,10 @@ var WitanReportCommonSchema = external_exports.object({
   archetype: WitanRepoArchetypeSchema.optional(),
   scanLimitations: external_exports.array(external_exports.string().min(1).max(1e3)).max(16).optional(),
   contentReadSummary: WitanContentReadSummarySchema.optional(),
+  // Additive-optional (report format 1.3): absent means a report produced before this field
+  // existed, never "nothing withheld" — createWitanReport always sets it (possibly to []) on any
+  // report it builds, so absence here is a legacy-report signal, not a claim about the scan.
+  withheldPaths: external_exports.array(WitanWithheldPathSchema).optional(),
   // The @cejel/cejel version that produced this report. Absent on reports from before this
   // field existed and on any caller that does not supply one (createWitanReport never defaults
   // it). Constant within an installed version, so re-running the same version on the same
@@ -378,7 +393,7 @@ var WitanReportSchema = external_exports.preprocess((value) => {
 }, StrictWitanReportSchema);
 var WITAN_ATTESTATION_STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
 var WITAN_ATTESTATION_PREDICATE_TYPE = "https://cejel.dev/attestations/scan/v1";
-var WITAN_REPORT_FORMAT_VERSION = "1.2";
+var WITAN_REPORT_FORMAT_VERSION = "1.3";
 var WitanAttestationOutcomeSchema = external_exports.discriminatedUnion("status", [
   external_exports.object({
     status: external_exports.literal("scored"),
@@ -1066,6 +1081,44 @@ function buildNextSteps(report, unmeasured, notApplicable, a1, coverageMetric) {
   }
   return steps;
 }
+var WITHHELD_PATH_READ_FAILURE_REASONS = /* @__PURE__ */ new Set([
+  "unreadable",
+  "denied_path"
+]);
+var WITHHELD_PATH_REASON_LABELS = {
+  too_large: "too large",
+  non_regular_file: "not a regular file",
+  unreadable: "unreadable",
+  denied_path: "denied path",
+  excluded_by_extension: "excluded by extension"
+};
+function describeWithheldReasons(entries) {
+  return [...new Set(entries.map((entry) => WITHHELD_PATH_REASON_LABELS[entry.reason]))].sort().join(", ");
+}
+function buildWithheldPathsGapSentence(report) {
+  const withheldPaths = report.withheldPaths;
+  if (withheldPaths === void 0) return void 0;
+  if (withheldPaths.length === 0) {
+    return "No content was withheld from any signal.";
+  }
+  const count = withheldPaths.length;
+  const entryWord = count === 1 ? "content entry was" : "content entries were";
+  const pronoun = count === 1 ? "it" : "them";
+  const reasonLabel = describeWithheldReasons(withheldPaths);
+  const intersecting = withheldPaths.filter((entry) => entry.signalsAdmitting.length > 0);
+  if (intersecting.length === 0) {
+    return `${count} ${entryWord} withheld (${reasonLabel}); no signal that would have read ${pronoun} selected ${pronoun}, so no result depends on ${pronoun}.`;
+  }
+  const signals = [...new Set(intersecting.flatMap((entry) => entry.signalsAdmitting))].sort();
+  const signalList = signals.join(", ");
+  const actedOn = intersecting.some((entry) => entry.actedOn);
+  if (actedOn) {
+    const qualifier = intersecting.every((entry) => !WITHHELD_PATH_READ_FAILURE_REASONS.has(entry.reason)) ? "a disclosed coverage limit, not a read failure" : "content Cejel could not read";
+    return `${count} ${entryWord} withheld (${reasonLabel}); ${signalList} abstained on ${pronoun} rather than assert an absence \u2014 ${qualifier}.`;
+  }
+  const reportsOnWhatItRead = signals.length === 1 ? "that signal reports on what it read" : "these signals report on what they read";
+  return `${count} ${entryWord} withheld (${reasonLabel}); ${signalList} would have read ${pronoun}. Under this rubric ${reportsOnWhatItRead}; the prospective v23 rubric abstains instead.`;
+}
 function buildRelyingPartySummary(report) {
   const applicable = report.criteria.filter((criterion) => criterion.status !== "not_applicable");
   const measured = applicable.filter((criterion) => criterion.status !== "insufficient_data");
@@ -1106,6 +1159,10 @@ function buildRelyingPartySummary(report) {
       `${skipped} content entr${skipped === 1 ? "y was" : "ies were"} skipped for the reasons itemized in the certificate.`
     );
   }
+  const withheldPathsSentence = buildWithheldPathsGapSentence(report);
+  if (withheldPathsSentence !== void 0) {
+    gaps.push(withheldPathsSentence);
+  }
   gaps.push(
     "Anything absent from the measured evidence was not established: no measurement and no finding are not clearance."
   );
@@ -2200,6 +2257,14 @@ function buildWitanInputFromRepo(options) {
     contentReadSummary: tracked.summary
   };
 }
+function buildWithheldPathsReportField() {
+  return withheldRepoPaths().map(({ path, reasons, signalsAdmitting, actedOn }) => ({
+    path,
+    reason: [...reasons].sort()[0],
+    signalsAdmitting: [...signalsAdmitting],
+    actedOn
+  }));
+}
 function buildWitanInputFromRepoUntracked(options) {
   assertRepoPathExists(options.repoPath);
   const generatedAt = options.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
@@ -2283,6 +2348,9 @@ function buildWitanInputFromRepoUntracked(options) {
     archetype: archetype.archetype,
     ...ignoredTargetReason ?? archetype.insufficientSourceReason ? { insufficientSourceReason: ignoredTargetReason ?? archetype.insufficientSourceReason } : {},
     ...scanLimitations.size > 0 ? { scanLimitations: [...scanLimitations] } : {},
+    // Always present, even as [] — presence is the "nothing was withheld" statement itself, not
+    // merely the absence of a limitation (goal_cejel_withheld_paths_always_disclosed_2026-09-22).
+    withheldPaths: buildWithheldPathsReportField(),
     signals: [
       ...coreSignals,
       ...(options.domainCollectors ?? []).map((collect) => collect(options.repoPath, repoFiles)),
@@ -3807,7 +3875,7 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
     )
   );
   const healthCheck = healthChecks[0];
-  const healthReadinessRouteReads = (file) => isAuthoredProductionPath(file) && isImplementationFile(file);
+  const healthReadinessRouteReads = (file) => isAuthoredProductionPath(file) && (isImplementationFile(file) || HEALTH_ROUTE_FUNCTIONS_DIR_PATTERN.test(file));
   const observabilityDepthReads = (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && isImplementationFile(file);
   const { hasV20HealthOrReadinessRoute, hasV22PackageStartHealthOrReadinessRoute } = withContentReadSignal("A3", "health_readiness_route", () => ({
     hasV20HealthOrReadinessRoute: useV20ExplicitGaps && repoFiles.some(
@@ -3819,22 +3887,33 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
       V20_HEALTH_OR_READINESS_ROUTE_PATTERN
     )
   }));
-  const healthReadinessRouteWithheld = useV23WithheldPathAbstention && useV20ExplicitGaps && abstainSignalOnWithheldPaths("A3", "health_readiness_route", healthReadinessRouteReads);
+  const healthReadinessRouteWithheld = useV20ExplicitGaps && abstainSignalOnWithheldPaths(
+    "A3",
+    "health_readiness_route",
+    healthReadinessRouteReads,
+    useV23WithheldPathAbstention
+  );
   const serverEntrypoint = v22PackageStartHttpEntrypoint ?? findServerEntrypointFile(repoPath, repoFiles, useV27Detectors) ?? v20DirectHttpEntrypoint ?? null;
   const runtimeContainer = useV27Detectors ? findRuntimeContainerEntrypointFile(repoPath, repoFiles, useV20ExplicitGaps) : null;
   const errorBoundaries = repoFiles.filter(
     (file) => (!useV27Detectors || isAuthoredProductionPath(file)) && /error-boundary|error\.(tsx|jsx|ts|js)$/.test(file)
   );
+  const errorBoundaryFileReads = (file) => observabilityDepthReads(file) || (!useV27Detectors || isAuthoredProductionPath(file)) && /(^|\/)server\//.test(file) && /\.(?:mjs|cjs)$/.test(file);
   const expressErrorMiddlewareFile = errorBoundaries.length > 0 ? void 0 : withContentReadSignal(
     "A3",
     "prod_readiness_primitives",
     () => repoFiles.find(
-      (file) => observabilityDepthReads(file) && fileContains(repoPath, file, EXPRESS_ERROR_MIDDLEWARE_PATTERN) && fileContains(repoPath, file, EXPRESS_MIDDLEWARE_REACHABLE_PATTERN)
+      (file) => errorBoundaryFileReads(file) && fileContains(repoPath, file, EXPRESS_ERROR_MIDDLEWARE_PATTERN) && fileMatchesOutsideLineComments(repoPath, file, EXPRESS_MIDDLEWARE_REACHABLE_PATTERN)
     )
   );
   const errorBoundary = errorBoundaries[0] ?? expressErrorMiddlewareFile;
-  if (useV23WithheldPathAbstention && errorBoundaries.length === 0) {
-    abstainSignalOnWithheldPaths("A3", "prod_readiness_primitives", observabilityDepthReads);
+  if (errorBoundaries.length === 0) {
+    abstainSignalOnWithheldPaths(
+      "A3",
+      "prod_readiness_primitives",
+      errorBoundaryFileReads,
+      useV23WithheldPathAbstention
+    );
   }
   const observabilityCount = withContentReadSignal(
     "A3",
@@ -3844,9 +3923,12 @@ function collectA3ProdReadinessEvidence(repoPath, repoFiles, useV27Detectors, us
       /\b(?:pino|winston|bunyan|morgan)\b/
     ])
   );
-  if (useV23WithheldPathAbstention) {
-    abstainSignalOnWithheldPaths("A3", "observability_depth", observabilityDepthReads);
-  }
+  abstainSignalOnWithheldPaths(
+    "A3",
+    "observability_depth",
+    observabilityDepthReads,
+    useV23WithheldPathAbstention
+  );
   const rollbackSafetyCount = withContentReadSignal(
     "A3",
     "rollback_safety_depth",
@@ -4279,24 +4361,30 @@ function hasDeclaredVersionConstraint(dependency) {
 }
 function collectA5ClaimRealityEvidence(repoPath, repoFiles, useV27Detectors, useV23WithheldPathAbstention, inventoryAbsenceContext = LEGACY_INVENTORY_ABSENCE_CONTEXT) {
   const claimImplementationReads = claimImplementationFileReads(useV27Detectors);
-  if (useV23WithheldPathAbstention) {
-    abstainSignalOnWithheldPaths(
-      "A5",
-      "claim_match_rate",
-      (file) => claimImplementationReads(file) || isClaimSourceFile(file)
-    );
-    abstainSignalOnWithheldPaths("A5", "claim_source_depth", isClaimSourceFile);
-    abstainSignalOnWithheldPaths(
-      "A5",
-      "reconciliation_artifact_depth",
-      isClaimRealityReconciliationPath
-    );
-    abstainSignalOnWithheldPaths(
-      "A5",
-      "negative_space_documentation",
-      isNegativeSpaceDocCandidate
-    );
-  }
+  abstainSignalOnWithheldPaths(
+    "A5",
+    "claim_match_rate",
+    (file) => claimImplementationReads(file) || isClaimSourceFile(file),
+    useV23WithheldPathAbstention
+  );
+  abstainSignalOnWithheldPaths(
+    "A5",
+    "claim_source_depth",
+    isClaimSourceFile,
+    useV23WithheldPathAbstention
+  );
+  abstainSignalOnWithheldPaths(
+    "A5",
+    "reconciliation_artifact_depth",
+    isClaimRealityReconciliationPath,
+    useV23WithheldPathAbstention
+  );
+  abstainSignalOnWithheldPaths(
+    "A5",
+    "negative_space_documentation",
+    isNegativeSpaceDocCandidate,
+    useV23WithheldPathAbstention
+  );
   const reconciliationArtifacts = useV27Detectors ? findClaimRealityReconciliationArtifacts(repoPath, repoFiles) : [];
   const claimSourceFiles = useV27Detectors ? findClaimSourceFiles(repoFiles) : repoFiles.filter(
     (file) => /^(?:README|readme)\.md$/.test(file) || /^docs\/[^/]+\.(?:md|mdx)$/.test(file)
@@ -7031,9 +7119,10 @@ var MAIN_ENTRYPOINT_FILE_PATTERN = /(^|\/)(main|server|app|wsgi|asgi|index|entry
 var RACK_ENTRYPOINT_FILE_PATTERN = /(^|\/)(?:config\.ru|(?:main|server|app|start|run)\.rb)$/i;
 var SERVER_ENTRYPOINT_PATTERN = /\bapp\.listen\s*\(|\bserver\.listen\s*\(\s*(?:PORT|port|\d+)|http\.ListenAndServe\s*\(|http\.ListenAndServeTLS\s*\(|axum::Server(?:::|\.)|actix_web::HttpServer(?:::|\.)|uvicorn\.run\s*\(/;
 var V20_DIRECT_HTTP_SERVER_PATTERN = /\b(?:http|https)\.createServer\s*\([\s\S]{0,1500}?\)\.listen\s*\(\s*(?:PORT|port|\d+)/;
-var V20_HEALTH_OR_READINESS_ROUTE_PATTERN = /["'`][\w${}./-]{0,60}\/(?:(?:health|ready|live)z?|readiness|liveness)(?=["'`/])/i;
-var EXPRESS_ERROR_MIDDLEWARE_PATTERN = /\(\s*(?:err|error)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*(?:req|request)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*(?:res|response)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*next(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*\)\s*(?:=>|\{)/i;
-var EXPRESS_MIDDLEWARE_REACHABLE_PATTERN = /\.use\s*\(|\bmodule\.exports\b|\bexport\s+(?:default\b|function\b|const\b)/;
+var HEALTH_ROUTE_FUNCTIONS_DIR_PATTERN = /(^|\/)functions\/.*\.(?:ts|tsx|js|jsx|py|go|rs|java|rb|cpp|cc|cxx|c|h|hpp|kt|swift|php)$/;
+var V20_HEALTH_OR_READINESS_ROUTE_PATTERN = /["'`](?:[\w${}./-]{0,60}\/[_-]?(?:(?:health|ready|live)z?|readiness|liveness|up)(?=["'`/])|(?:healthz|readiness|liveness)(?=["'`]))|@Get\s*\(\s*(["'`])health\1\s*\)/i;
+var EXPRESS_ERROR_MIDDLEWARE_PATTERN = /\(\s*(?:_?err|_?error)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*(?:req|request)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*(?:res|response)(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*,\s*_?next(?:\s*:\s*(?:[^,()<]|<[^<>]*>)*)?\s*\)\s*(?:=>|\{)/i;
+var EXPRESS_MIDDLEWARE_REACHABLE_PATTERN = /\.use\s*\(|\bmodule\.exports\b|\bexport\s+(?:default\b|function\b|const\b|class\b)/;
 var RACK_SERVER_ENTRYPOINT_PATTERN = /Rack::(?:Server|Handler(?:::\w+)?)\.(?:start|run)\s*\(/;
 var RACK_CONFIG_RUN_PATTERN = /^\s*run\s+(?:(?:[A-Z]\w*(?:::\w+)*(?:\.new)?|lambda)\b|->)/m;
 var RUNTIME_CONTAINER_COMMAND_PATTERN = /^\s*(?:CMD|ENTRYPOINT)\s+.*(?:\b(?:start|serve|server|qgis|nginx|apache|gunicorn|uvicorn)\b|manage\.py\s+runserver).*$/im;
@@ -7225,6 +7314,12 @@ function fileContains(repoPath, file, pattern) {
   if (!isRegularFile(fullPath)) return false;
   return pattern.test(readRepoText(fullPath, "utf8"));
 }
+function fileMatchesOutsideLineComments(repoPath, file, pattern) {
+  const fullPath = join(repoPath, file);
+  if (!isRegularFile(fullPath)) return false;
+  const withoutLineComments = readRepoText(fullPath, "utf8").replace(/(?<!:)\/\/.*$/gm, "");
+  return pattern.test(withoutLineComments);
+}
 var PEM_PRIVATE_KEY_ASSIGNMENT_PATTERN = /(?:["'])?([A-Za-z_$][\w$.-]*)(?:["'])?\s*[:=]\s*(?:\|[-+0-9]*\s*\r?\n[ \t]*)?["'`]?-----BEGIN((?: (?:RSA|DSA|EC|OPENSSH|ENCRYPTED))? PRIVATE KEY)-----([\s\S]{0,32768}?)-----END\2-----/g;
 var BARE_PEM_PRIVATE_KEY_PATTERN = /["'`]?-----BEGIN((?: (?:RSA|DSA|EC|OPENSSH|ENCRYPTED))? PRIVATE KEY)-----([\s\S]{0,32768}?)-----END\1-----/g;
 var BARE_PEM_KEY_FILE_PATTERN = /(?:^|\/)id_(?:rsa|dsa|ecdsa|ed25519)$|\.(?:pem|key)$/i;
@@ -7308,6 +7403,8 @@ function findCommittedSecretInFile(repoPath, file, useV36Detectors = false, useV
     if (pemSecret) return pemSecret;
   }
   if (useV39Detectors && isEnvHistoryPath(file, useV36Detectors)) {
+    const databaseUrlCredential = findDatabaseUrlUserinfoCredential(secretScanContents);
+    if (databaseUrlCredential) return databaseUrlCredential;
     const weakCredential = findWeakExplicitEnvCredential(secretScanContents);
     if (weakCredential) return weakCredential;
   }
@@ -7421,6 +7518,8 @@ function findSecretFingerprintsInFile(repoPath, file, useV36Detectors = false, u
     if (pemSecret) fingerprints.push(pemSecret.valueFingerprint);
   }
   if (useV39Detectors && isEnvHistoryPath(file, useV36Detectors)) {
+    const databaseUrlCredential = findDatabaseUrlUserinfoCredential(scanContents);
+    if (databaseUrlCredential) fingerprints.push(databaseUrlCredential.valueFingerprint);
     const weakCredential = findWeakExplicitEnvCredential(scanContents);
     if (weakCredential) fingerprints.push(weakCredential.valueFingerprint);
   }
@@ -7531,6 +7630,46 @@ function findWeakExplicitEnvCredential(contents) {
   }
   return null;
 }
+function findDatabaseUrlUserinfoCredential(contents) {
+  const lines = contents.split(/\r?\n/);
+  for (const [index, line] of lines.entries()) {
+    if (/^\s*#/.test(line)) continue;
+    const match = /^\s*(?:export\s+)?(DATABASE_URL)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s#]+))/i.exec(line);
+    const identifier = match?.[1];
+    const rawValue = match?.[2] ?? match?.[3] ?? match?.[4];
+    if (!identifier || !rawValue) continue;
+    let parsed;
+    try {
+      parsed = new URL(rawValue);
+    } catch {
+      continue;
+    }
+    if (parsed.protocol !== "postgres:" && parsed.protocol !== "postgresql:" || !parsed.username || !parsed.password) {
+      continue;
+    }
+    let password;
+    try {
+      password = decodeURIComponent(parsed.password);
+    } catch {
+      continue;
+    }
+    if (isPlaceholderSecretValue(password)) continue;
+    const characterClasses = [
+      /[a-z]/.test(password) ? "lower" : "",
+      /[A-Z]/.test(password) ? "upper" : "",
+      /\d/.test(password) ? "digit" : "",
+      /[^A-Za-z0-9]/.test(password) ? "symbol" : ""
+    ].filter(Boolean).join("+");
+    return {
+      identifier,
+      line: index + 1,
+      valueLength: password.length,
+      characterClasses: characterClasses || "other",
+      valueFingerprint: createHash2("sha256").update(password).digest("hex")
+    };
+  }
+  return null;
+}
 function findDefaultAdministrativeCredential(contents) {
   const lines = contents.split(/\r?\n/);
   for (const [index, line] of lines.entries()) {
@@ -7608,6 +7747,12 @@ function collectHistorySecretEvidence(repoPath, excludeHead, currentSecretFinger
         secretMatch = pemMatch;
       }
     }
+    if (!secretMatch && useV39Detectors && isEnvHistoryPath(entry.path, useV36Detectors, useV47Detectors)) {
+      const databaseUrlCredential = findDatabaseUrlUserinfoCredential(scanContents);
+      if (databaseUrlCredential && !currentFingerprints.has(databaseUrlCredential.valueFingerprint)) {
+        secretMatch = databaseUrlCredential;
+      }
+    }
     if (!secretMatch && useV39Detectors && isEnvHistoryPath(entry.path, useV36Detectors, useV47Detectors)) {
       const weakCredential = findWeakExplicitEnvCredential(scanContents);
       if (weakCredential && !currentFingerprints.has(weakCredential.valueFingerprint)) {
@@ -8684,6 +8829,10 @@ function createWitanReport(input, inputSignals, rubric = WITAN_RUBRIC, toolVersi
     ...consumedSignals.length > 0 ? { consumedSignals } : {},
     ...parsedInput.scanLimitations.length > 0 ? { scanLimitations: parsedInput.scanLimitations } : {},
     ...parsedInput.contentReadSummary ? { contentReadSummary: parsedInput.contentReadSummary } : {},
+    // Always set alongside contentReadSummary: parsedInput.withheldPaths defaults to [] on the
+    // input schema, so this is never omitted for a report this build produces — its presence
+    // (even empty) is the disclosure itself (goal_cejel_withheld_paths_always_disclosed_2026-09-22).
+    withheldPaths: parsedInput.withheldPaths,
     // Only surface the full per-category map for rubrics with more than two buckets —
     // the default two-category rubric is fully represented by codeTrustScore/processTrustScore.
     ...!abstained && categoryOrder.length > 2 ? { categoryScores: categoryScoreMap } : {},