@cortad/connector 0.6.2 → 0.6.3

package/lib/layer.mjs

@@ -1,982 +1,4 @@
 // The parsers Cortad's read runs, bundled for the connector by the backend's build:layer. Not written here: change the backend.
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
-
-var init_retired = __esm({
-  "src/model/retired.mjs"() {
-    "use strict";
-  }
-});
-
-var init_models = __esm({
-  "src/harness/models.mjs"() {
-    "use strict";
-    init_retired();
-  }
-});
-
-var init_fault = __esm({
-  "src/simulate/fault.ts"() {
-    "use strict";
-    init_models();
-  }
-});
-
-var init_door_said = __esm({
-  "src/customer/door-said.ts"() {
-    "use strict";
-  }
-});
-
-var init_body_wire = __esm({
-  "src/customer/body-wire.mjs"() {
-    "use strict";
-  }
-});
-
-var init_retrieved = __esm({
-  "src/simulate/retrieved.ts"() {
-    "use strict";
-    init_fault();
-  }
-});
-
-var init_spec_doors = __esm({
-  "src/harness/spec-doors.mjs"() {
-    "use strict";
-  }
-});
-
-var words, characters;
-var init_shorten = __esm({
-  "src/text/shorten.ts"() {
-    "use strict";
-    words = new Intl.Segmenter(void 0, { granularity: "word" });
-    characters = new Intl.Segmenter(void 0, { granularity: "grapheme" });
-  }
-});
-
-var ENV_NAME, SECRET_GLOBS, SECRET_PATH, RULES;
-var init_redact = __esm({
-  "src/jobs/redact.ts"() {
-    "use strict";
-    init_shorten();
-    ENV_NAME = String.raw`[A-Za-z0-9_]*(?:(?:API|APP|ACCESS|AUTH|CLIENT|ENCRYPTION|MASTER|PRIVATE|SECRET|SIGNING)[_-]?KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|CREDENTIALS?|DSN)`;
-    SECRET_GLOBS = [
-      ".env",
-      ".env.*",
-      ".envrc",
-      ".netrc",
-      ".git-credentials",
-      ".npmrc",
-      ".pgpass",
-      "id_rsa*",
-      "id_dsa*",
-      "id_ecdsa*",
-      "id_ed25519*",
-      "*.pem",
-      "*.key",
-      "*.p12"
-    ];
-    SECRET_PATH = new RegExp(
-      `(^|/)(${SECRET_GLOBS.map((g) => g.replace(/[.+^${}()|[\]\\]/g, String.raw`\$&`).replaceAll("*", ".*")).join("|")})$`,
-      "i"
-    );
-    RULES = [
-      { re: /(\b[a-z][a-z0-9+.-]*:\/\/)[^/?#\s]+@/gi, to: "$1<redacted>@" },
-      { re: /\b(bearer|basic|token)\s+(?=[A-Za-z0-9._~+/=-]*[0-9])[A-Za-z0-9._~+/=-]{12,}/gi, to: "$1 <redacted>" },
-      { re: /\b(authorization|proxy-authorization)\s*[:=]\s*(?![`']?(?:bearer|basic|token)\s+(?:<|\$\{|[^\s<"\\]{1,7}(?:[\s"\\`]|$)))\S+/gi, to: "$1: <redacted>" },
-      { re: /\b(gh[pousr]|github_pat)_[A-Za-z0-9_]{16,}/g, to: "<redacted-github-token>" },
-      { re: /\bsk-[A-Za-z0-9._-]{16,}/g, to: "<redacted-key>" },
-      { re: /\bfw_[A-Za-z0-9]{16,}/g, to: "<redacted-key>" },
-      { re: /\bAIza[A-Za-z0-9_-]{20,}/g, to: "<redacted-key>" },
-      { re: /\bxox[abprs]-[A-Za-z0-9-]{10,}/g, to: "<redacted-key>" },
-      { re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, to: "<redacted-private-key>" },
-      { re: new RegExp(String.raw`\b(${ENV_NAME})\s*=\s*\S{8,}`, "gi"), to: "$1=<redacted>" }
-    ];
-  }
-});
-
-var init_failure = __esm({
-  "src/simulate/failure.ts"() {
-    "use strict";
-    init_redact();
-  }
-});
-
-var init_two_step = __esm({
-  "src/customer/two-step.ts"() {
-    "use strict";
-    init_endpoint();
-  }
-});
-
-function turnSides(choices) {
-  const words2 = choices.filter((c) => typeof c === "string");
-  if (words2.length < 2) return null;
-  const person = words2.find((w) => PERSON_SIDE.test(w)) ?? words2.find((w) => !NEITHER.test(w));
-  const app = words2.find((w) => w !== person && APP_SIDE.test(w)) ?? words2.find((w) => w !== person && !NEITHER.test(w));
-  return person && app ? [person, app] : null;
-}
-var ROLE_KEY, PERSON_SIDE, APP_SIDE, NEITHER;
-var init_turns = __esm({
-  "src/customer/turns.ts"() {
-    "use strict";
-    ROLE_KEY = /^(?:role|sender|from|author|speaker|who|side)$/i;
-    PERSON_SIDE = /^(?:user|human|learner|student|customer|client|person|visitor|guest|player|candidate|patient|member|caller|me|you|question)$/i;
-    APP_SIDE = /^(?:assistant|ai|bot|model|agent|npc|coach|tutor|teacher|mentor|advisor|expert|character|answer|gpt|llm|robot)$/i;
-    NEITHER = /^(?:system|developer|tool|function|event|log|meta|hint|error)$/i;
-  }
-});
-
-var init_document = __esm({
-  "src/customer/document.ts"() {
-    "use strict";
-    init_two_step();
-    init_turns();
-  }
-});
-
-function readsAsAsk(key) {
-  const words2 = key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").split(/[_\-\s]+/).filter(Boolean);
-  return words2.length > 0 && ASK_WORD.test(words2.at(-1)) && !NOT_THE_PERSONS.test(words2[0]);
-}
-function numberFor(key) {
-  if (/tokens?$/i.test(key)) return 1024;
-  if (/(?:max|limit|count|turns|rounds|steps|size|length|total|top_?k|minutes|seconds|days|pages|attempts|questions)/i.test(key)) return 5;
-  return 1;
-}
-function templateFromFields(fields) {
-  const out = {};
-  for (const field of fields) {
-    if (MESSAGE_KEY.test(field)) out[field] = "";
-    else if (CONVERSATION_KEY.test(field)) out[field] = [];
-  }
-  return Object.keys(out).length ? out : null;
-}
-function linkRefs(body) {
-  if (!body || typeof body !== "object" || Array.isArray(body)) return body;
-  const records = /* @__PURE__ */ new Map();
-  const collect = (value) => {
-    if (!value || typeof value !== "object") return;
-    for (const [key, v] of Object.entries(value)) {
-      if (Array.isArray(v)) {
-        const rows = v.filter((r) => Boolean(r) && typeof r === "object" && !Array.isArray(r) && typeof r["id"] === "string");
-        if (rows.length && rows.length === v.length && !CONVERSATION_KEY.test(key)) records.set(singular(key), rows);
-        v.forEach(collect);
-      } else collect(v);
-    }
-  };
-  collect(body);
-  if (!records.size) return body;
-  const out = structuredClone(body);
-  records.clear();
-  collect(out);
-  let changed = false;
-  for (const rows of records.values()) {
-    const seen = /* @__PURE__ */ new Set();
-    rows.forEach((row, i) => {
-      const id = row["id"];
-      if (seen.has(id)) {
-        row["id"] = /^[0-9a-f-]{36}$/i.test(id) ? `${id.slice(0, -4)}${String(i + 1).padStart(4, "0")}` : `${id}-${i + 1}`;
-        changed = true;
-      }
-      seen.add(row["id"]);
-    });
-  }
-  const point = (value) => {
-    if (!value || typeof value !== "object") return;
-    if (Array.isArray(value)) {
-      value.forEach(point);
-      return;
-    }
-    const row = value;
-    for (const [key, v] of Object.entries(row)) {
-      const m = /^(.*?)(?:Id|_id)$/.exec(key);
-      const stem = m?.[1] ? m[1].replace(/([a-z0-9])([A-Z])/g, "$1_$2").split("_").filter(Boolean).at(-1).toLowerCase() : null;
-      const rows = stem ? records.get(stem) : void 0;
-      if (typeof v === "string" && rows && !rows.some((r) => r["id"] === v)) {
-        row[key] = rows[0]["id"];
-        changed = true;
-      } else point(v);
-    }
-  };
-  point(out);
-  return changed ? out : body;
-}
-var CONVERSATION_KEY, MESSAGE_KEY, SESSION_KEY, ASK_WORD, NOT_THE_PERSONS, singular;
-var init_endpoint = __esm({
-  "src/customer/endpoint.ts"() {
-    "use strict";
-    init_fault();
-    init_door_said();
-    init_body_wire();
-    init_retrieved();
-    init_spec_doors();
-    init_failure();
-    init_document();
-    init_two_step();
-    init_turns();
-    CONVERSATION_KEY = /^(messages|history|chat_?history|message_?history|conversation(_?history)?|(?:recent|previous|prior)_?messages|turns)$/i;
-    MESSAGE_KEY = /^(message|prompt|question|input|query|text|content|q|user_?message|msg|user_?input|task|topic|instructions?)$/i;
-    SESSION_KEY = /^(?:(?:session|conversation|thread|chat|dialog(?:ue)?)(?:[_-]?(?:id|key|token|uuid))?|[a-z][a-z0-9]*(?:[_-][a-z0-9]+)*[_-]?(?:conversation|thread|chat|dialog(?:ue)?)[_-]?(?:id|uuid))$/i;
-    ASK_WORD = /^(?:message|prompt|question|query|input|content|text|instructions?|task|topic|ask|request|goal)$/i;
-    NOT_THE_PERSONS = /^(?:system|assistant|developer|default|base|template|reply|response|answer|output|error|title|file|model)/i;
-    singular = (key) => key.toLowerCase().replace(/ies$/, "y").replace(/(?<!s)s$/, "");
-  }
-});
-
-var init_rank = __esm({
-  "src/harness/rank.mjs"() {
-    "use strict";
-  }
-});
-
-var init_stacks = __esm({
-  "src/harness/stacks.mjs"() {
-    "use strict";
-    init_rank();
-  }
-});
-
-var init_devauth = __esm({
-  "src/harness/devauth.mjs"() {
-    "use strict";
-  }
-});
-
-var PROGRAM;
-var init_identities = __esm({
-  "src/harness/identities.mjs"() {
-    "use strict";
-    PROGRAM = String.raw`import base64, hashlib, hmac, http.cookiejar, json, os, re, secrets, time, urllib.error, urllib.request
-
-PLAN = json.loads(base64.b64decode("__PLAN__").decode("utf-8"))
-OUT = "__OUT__"
-FILE = "__FILE__"
-TTL = 6 * 3600
-# A dev server compiles its auth route on the first request: better-chatbot's sign-in timed out at 10s
-# and the caller was filed unreachable. The whole program stays inside the step's two minutes.
-DEADLINE = time.time() + 100
-SIGNUP = "/identitytoolkit.googleapis.com/v1/accounts:signUp?key=standin"
-
-
-def read_env(path):
-    out = {}
-    try:
-        with open(path, encoding="utf-8", errors="replace") as f:
-            for line in f:
-                m = re.match(r"^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$", line)
-                if not m:
-                    continue
-                v = m.group(2).strip()
-                if len(v) >= 2 and v[0] == v[-1] and v[0] in "\"'":
-                    v = v[1:-1]
-                out[m.group(1)] = v
-    except OSError:
-        pass
-    return out
-
-
-def slug(role):
-    return re.sub(r"[^a-z0-9-]", "-", role)
-
-
-# One account per role, made once and signed into on every later run: a fresh account per run left
-# 1,600 active test logins in one app's own account store.
-def gen(role):
-    if role in PLAN.get("accounts", {}):
-        return PLAN["accounts"][role]
-    tag = secrets.token_hex(4)
-    return {
-        "username": "bl-%s-%s" % (slug(role), tag),
-        "email": "bl-%s-%s@example.invalid" % (slug(role), tag),
-        "password": secrets.token_urlsafe(18) + "A1!",
-        "name": "Brainsless %s" % role,
-    }
-
-
-def source(spec, env, g, role):
-    if spec.startswith("env:"):
-        for name in spec[4:].split("|"):
-            if env.get(name):
-                return env[name]
-        return None
-    return {"gen:username": g["username"], "gen:email": g["email"], "gen:password": g["password"], "gen:name": g["name"], "role": role}.get(spec)
-
-
-def names(spec):
-    return spec[4:].replace("|", " or ") if spec.startswith("env:") else spec
-
-
-def call(path, headers, body, jar, base=None):
-    opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(jar))
-    req = urllib.request.Request((base or PLAN["base"]) + path, data=json.dumps(body).encode("utf-8"), method="POST")
-    for k, v in list(PLAN["headers"].items()) + list(headers.items()):
-        req.add_header(k, v)
-    req.add_header("content-type", "application/json")
-    try:
-        with opener.open(req, timeout=40) as r:
-            return r.status, r.read(200000).decode("utf-8", "replace")
-    except urllib.error.HTTPError as e:
-        # The door's own sentence rides the refusal: a 500 with no body told nobody what the
-        # sign-up died on.
-        try:
-            return e.code, e.read(4000).decode("utf-8", "replace")
-        except Exception:
-            return e.code, ""
-    except Exception as e:
-        return 0, type(e).__name__
-
-
-def token_in(value, depth=0):
-    if isinstance(value, dict):
-        for k, v in value.items():
-            if isinstance(v, str) and v and re.fullmatch(r"(?i)(access_?token|token|jwt|session_?token|id_?token|api_?key)", k):
-                return v
-        if depth < 2:
-            for v in value.values():
-                found = token_in(v, depth + 1)
-                if found:
-                    return found
-    return None
-
-
-def bearer(header, value):
-    if header == "authorization" and not value.lower().startswith("bearer "):
-        return "Bearer " + value
-    return value
-
-
-def minted(header, value, ttl=TTL):
-    return {"status": "minted", "header": header, "line": "%s: %s" % (header, bearer(header, value)), "expires": int(time.time()) + ttl}
-
-
-# The account is named after the identity, not the role slot: staff:sales and sales are two callers
-# at two doors, and their door reads the name back on every login.
-def login(recipe, role, role_value, env):
-    g = gen(role)
-    ways = [recipe["steps"]] + ([recipe["alt"]] if recipe.get("alt") else [])
-    for way in ways:
-        last = ways[-1] is way
-        got = walk(way, recipe, env, g, role_value)
-        if got.get("status") != "refused" or last:
-            return got
-    return got
-
-
-def walk(steps, recipe, env, g, role_value):
-    jar = http.cookiejar.CookieJar()
-    status, token = 0, None
-    for step in steps:
-        headers = {}
-        # A token the previous step minted signs this one: the key route wants the session that
-        # just logged in, and a cookie jar alone does not carry a bearer.
-        if token:
-            headers[recipe["header"]] = bearer(recipe["header"], token)
-        for h, spec in step.get("headers", {}).items():
-            v = source(spec, env, g, role_value)
-            if v is None:
-                return {"status": "absent", "note": names(spec)}
-            headers[h] = v
-        body = {}
-        unset = None
-        for field, spec in step["body"].items():
-            v = source(spec, env, g, role_value)
-            if v is None:
-                if not spec.startswith("env:"):
-                    return {"status": "absent", "note": names(spec)}
-                # A switch in their code may make this one optional: ask without it, and a refusal
-                # is then the variable they did not seal, not their door.
-                unset = names(spec)
-                continue
-            body[field] = v
-        status, text = call(step["route"], headers, body, jar)
-        if status == 0:
-            return {"status": "unreachable", "note": text}
-        if status >= 400 and unset:
-            return {"status": "absent", "note": unset}
-        # The account this role was given on an earlier run is still there: go on and sign in.
-        if status in (400, 409, 422) and step is not steps[-1] and re.search(r"exist|taken|already|duplicate|in use|registered", text or "", re.I):
-            continue
-        if status >= 400:
-            said = re.sub(r"\s+", " ", re.sub(r"<[^>]+>", "", text or "")).strip()[:160]
-            return {"status": "refused", "note": "HTTP %d at %s%s" % (status, step["route"], (": " + said) if said else "")}
-        try:
-            found = token_in(json.loads(text))
-        except ValueError:
-            found = None
-        # A step that mints nothing keeps what the step before it minted.
-        token = found or token
-    cookies = "; ".join("%s=%s" % (c.name, c.value) for c in jar)
-    # A cookie door reads its cookie by name. better-auth's sign-in answers a token AND sets
-    # better-auth.session_token; sending the bare token as the cookie header named nothing, so its
-    # proxy redirected every signed-in knock to the sign-in page.
-    if recipe["header"] == "cookie" and cookies:
-        return minted("cookie", cookies)
-    if token:
-        return minted(recipe["header"], token)
-    if cookies:
-        # ponytail: the cookie alone; a CSRF token their form also wants is the next thing to carry.
-        return minted("cookie", cookies)
-    return {"status": "refused", "note": "HTTP %d with no token in the reply" % status}
-
-
-def b64url(raw):
-    return base64.urlsafe_b64encode(raw).rstrip(b"=").decode("ascii")
-
-
-def jwt(recipe, env):
-    secret = source("env:" + "|".join(recipe["env"]), env, None, None)
-    if not secret:
-        return {"status": "absent", "note": " or ".join(recipe["env"])}
-    now = int(time.time())
-    # ponytail: subject 1, the first account of a restored copy; read a real id off the stand-in
-    # database when a customer's users table does not start there.
-    claims = {"sub": "1", "id": 1, "iat": now, "exp": now + TTL}
-    claim = recipe.get("claim") or "sub"
-    if claim not in claims:
-        claims[claim] = 1
-    head = b64url(json.dumps({"alg": "HS256", "typ": "JWT"}, separators=(",", ":")).encode("utf-8"))
-    body = b64url(json.dumps(claims, separators=(",", ":")).encode("utf-8"))
-    sig = b64url(hmac.new(secret.encode("utf-8"), ("%s.%s" % (head, body)).encode("ascii"), hashlib.sha256).digest())
-    return minted("authorization", "%s.%s.%s" % (head, body, sig))
-
-
-# The Auth emulator the boot raised in place of their Firebase project: it signs any address up
-# under any key, and firebase-admin accepts its tokens while FIREBASE_AUTH_EMULATOR_HOST is set.
-def firebase(recipe, role, env):
-    host = env.get("FIREBASE_AUTH_EMULATOR_HOST", "")
-    if not re.fullmatch(r"[\w.-]+:\d{2,5}", host):
-        return {"status": "upstream", "note": "Firebase"}
-    g = gen(role)
-    status, text = call(SIGNUP, {}, {"email": g["email"], "password": g["password"], "returnSecureToken": True}, http.cookiejar.CookieJar(), "http://" + host)
-    if status == 0:
-        return {"status": "unreachable", "note": text}
-    try:
-        reply = json.loads(text)
-    except ValueError:
-        reply = {}
-    token = reply.get("idToken") if isinstance(reply, dict) else None
-    if not isinstance(token, str) or not token:
-        return {"status": "refused", "note": "HTTP %d at the Firebase emulator" % status}
-    return minted(recipe["header"], token, int(reply.get("expiresIn") or 3600))
-
-
-def sealed(recipe, env):
-    v = source("env:" + "|".join(recipe["env"]), env, None, None)
-    if not v:
-        return {"status": "absent", "note": " or ".join(recipe["env"])}
-    return {"status": "sealed", "header": recipe["header"], "line": "%s: %s" % (recipe["header"], bearer(recipe["header"], v)), "note": " or ".join(recipe["env"])}
-
-
-def keep(path, line):
-    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
-    with os.fdopen(fd, "w", encoding="utf-8") as f:
-        f.write(line + "\n")
-
-
-# A token their door issued earlier and still honours is reused: sign-in doors are rate limited,
-# and a run re-minting on every boot would spend that budget on itself.
-def previous():
-    try:
-        with open(OUT, encoding="utf-8") as f:
-            rows = json.load(f)["identities"]
-    except Exception:
-        return {}
-    now = time.time()
-    out = {}
-    for r in rows:
-        if r.get("status") not in ("minted", "sealed"):
-            continue
-        if not os.path.exists(FILE % (slug(r["role"]), "header" if r["status"] == "minted" else "sealed")):
-            continue
-        if r.get("expires") is not None and r["expires"] < now + 60:
-            continue
-        out[r["role"]] = r
-    return out
-
-
-def main():
-    env = read_env(PLAN["envPath"])
-    kept = previous()
-    rows = []
-    for recipe in PLAN["recipes"]:
-        for role_value in recipe.get("roles") or [None]:
-            role = "%s:%s" % (recipe["role"], role_value) if role_value else recipe["role"]
-            steps = recipe.get("steps") or []
-            base = {
-                "role": role, "kind": recipe["kind"], "header": recipe["header"], "where": recipe["where"],
-                "opens": [o.replace("{role}", role_value or "") for o in recipe.get("opens", [])],
-                "door": steps[-1]["route"] if steps else SIGNUP if recipe["kind"] == "firebase" else recipe["header"],
-            }
-            if role in kept:
-                rows.append(dict(base, **{k: v for k, v in kept[role].items() if k in ("status", "header", "expires", "note")}))
-                continue
-            if time.time() > DEADLINE:
-                rows.append(dict(base, status="unreachable", note="out of time"))
-                continue
-            try:
-                if recipe["kind"] == "header":
-                    got = sealed(recipe, env)
-                elif recipe["kind"] == "jwt":
-                    got = jwt(recipe, env)
-                elif recipe["kind"] == "login":
-                    got = login(recipe, role, role_value, env)
-                elif recipe["kind"] == "firebase":
-                    got = firebase(recipe, role, env)
-                else:
-                    got = {"status": "upstream", "note": " or ".join(recipe["env"]) or recipe["role"]}
-            except Exception as err:
-                got = {"status": "unreachable", "note": type(err).__name__}
-            line = got.pop("line", None)
-            if line:
-                keep(FILE % (slug(role), "header" if got["status"] == "minted" else "sealed"), line)
-            rows.append(dict(base, **got))
-    report = {"identities": rows}
-    with open(OUT, "w", encoding="utf-8") as f:
-        json.dump(report, f)
-    print("BL_IDENTITIES " + json.dumps(report))
-
-
-main()
-`;
-  }
-});
-
-var init_port = __esm({
-  "src/harness/port.mjs"() {
-    "use strict";
-  }
-});
-
-var COMPILED, MANIFESTS;
-var init_library = __esm({
-  "src/harness/library.mjs"() {
-    "use strict";
-    init_rank();
-    COMPILED = ["go.mod", "Gemfile", "composer.json", "pom.xml", "build.gradle", "build.gradle.kts"];
-    MANIFESTS = ["pyproject.toml", "setup.py", "package.json", ...COMPILED];
-  }
-});
-
-var ENV_PREFIXES, WAITS, TRY_BOOT;
-var init_actions = __esm({
-  "src/harness/repair/actions.mjs"() {
-    "use strict";
-    ENV_PREFIXES = /* @__PURE__ */ new Map([
-      ["goproxy-direct", "GOPROXY=direct GOFLAGS=-mod=mod"],
-      ["no-telemetry", "NEXT_TELEMETRY_DISABLED=1 DO_NOT_TRACK=1 SCARF_ANALYTICS=false"],
-      ["bind-all", "HOST=0.0.0.0"],
-      ["dev-mode", "NODE_ENV=development"],
-      ["npm-retries", "npm_config_fetch_retries=5 npm_config_fetch_retry_maxtimeout=120000"]
-    ]);
-    WAITS = /* @__PURE__ */ new Set([120, 180]);
-    TRY_BOOT = {
-      type: "function",
-      function: {
-        name: "try_boot",
-        description: "Run one command from the menu. Pick by id. You cannot write a command; you can only choose one.",
-        parameters: {
-          type: "object",
-          properties: {
-            target: { type: "string", description: "An id from the menu, such as c0 or s3." },
-            env: { type: "string", enum: [...ENV_PREFIXES.keys()], description: "An optional environment preset to run it under." },
-            waitSeconds: { type: "integer", enum: [...WAITS], description: "Only when the log showed the app was still starting." },
-            why: { type: "string", description: "One sentence the customer will read, in their language, about their repository." }
-          },
-          required: ["target", "why"]
-        }
-      }
-    };
-  }
-});
-
-var init_evidence = __esm({
-  "src/harness/repair/evidence.mjs"() {
-    "use strict";
-  }
-});
-
-var BUDGET, READ_TOOLS, FIX_TOOLS, TOOLS;
-var init_repair = __esm({
-  "src/harness/repair.mjs"() {
-    "use strict";
-    init_actions();
-    init_evidence();
-    BUDGET = {
-      attempts: 5,
-      passes: 20,
-      calls: 40,
-      fixes: 8,
-      wallMs: 12 * 6e4,
-      microUsd: 9e5
-    };
-    READ_TOOLS = [
-      {
-        type: "function",
-        function: {
-          name: "list_files",
-          description: "Names of files in the repository. The application may live in a half of the tree the ladder never looked at.",
-          parameters: { type: "object", properties: { dir: { type: "string" }, glob: { type: "string" }, depth: { type: "integer" } } }
-        }
-      },
-      {
-        type: "function",
-        function: {
-          name: "read_file",
-          description: "Read part of a file in the repository. Environment files are never readable.",
-          parameters: { type: "object", properties: { path: { type: "string" }, from: { type: "integer" }, to: { type: "integer" } }, required: ["path"] }
-        }
-      },
-      {
-        type: "function",
-        function: {
-          name: "search_code",
-          description: "Find where something is defined, such as uvicorn, FastAPI( or app.listen.",
-          parameters: { type: "object", properties: { pattern: { type: "string" }, dir: { type: "string" } }, required: ["pattern"] }
-        }
-      }
-    ];
-    FIX_TOOLS = [
-      {
-        type: "function",
-        function: {
-          name: "write_env",
-          description: "Append stand-in NAME=value lines to the app's .env. Append-if-absent: anything the customer set stays. Use for configuration the app refuses to start without. Never a real credential -- a stand-in value like standin-key is the point.",
-          parameters: { type: "object", properties: { lines: { type: "string", description: "NAME=value lines, one per line, at most 8." } }, required: ["lines"] }
-        }
-      },
-      {
-        type: "function",
-        function: {
-          name: "write_config",
-          description: "Create a NEW config file the app needs to start (.json .yaml .toml .ini .cfg .conf .txt .properties). Never code, never .env files, never overwrites an existing file.",
-          parameters: { type: "object", properties: { path: { type: "string" }, content: { type: "string" } }, required: ["path", "content"] }
-        }
-      },
-      {
-        type: "function",
-        function: {
-          name: "install_packages",
-          description: "Install named registry packages the boot showed missing or mismatched, e.g. a version pin the app's own dependency check demands. Plain package specs only.",
-          parameters: {
-            type: "object",
-            properties: {
-              manager: { type: "string", enum: ["pip", "npm"] },
-              packages: { type: "array", items: { type: "string" }, description: 'e.g. ["transformers==4.44.0"] or ["sharp"]' }
-            },
-            required: ["manager", "packages"]
-          }
-        }
-      },
-      {
-        type: "function",
-        function: {
-          name: "run_build",
-          description: "Run a build or prep step the repository declares for itself, before the app can start -- `pnpm build` for a monorepo whose dev server needs its packages built first, `make protogen` for a Go app that generates code. Only a named package.json script or Makefile target the repo already ships. Reach for this when a boot fails because something was not built (a missing dist/, a missing generated module).",
-          parameters: {
-            type: "object",
-            properties: {
-              tool: { type: "string", enum: ["npm", "pnpm", "yarn", "make"] },
-              name: { type: "string", description: "The script or target name, e.g. build or protogen." },
-              dir: { type: "string", description: "Directory to run it in, relative to the repo root. Default the root." }
-            },
-            required: ["tool", "name"]
-          }
-        }
-      },
-      {
-        type: "function",
-        function: {
-          name: "edit_source",
-          description: `Fix a bug in the customer's own source that stops the app importing or listening. Three modes, in order of reliability: (1) ADD A MISSING IMPORT: atTop:true + insert:"from typing import Any" -- goes at the top, no anchor. (2) REPLACE ONE LINE BY NUMBER: line:32 + replace:"    default=8000," -- read_file showed you the numbers; this cannot miss. (3) find/replace with a UNIQUE find string (whole line, never a bare word). The change lives only in the sandbox and returns as a patch. Reach for this when the traceback points at their code; prefer mode 2 whenever you know the line.`,
-          parameters: {
-            type: "object",
-            properties: {
-              path: { type: "string", description: "The repository source file, e.g. gpt_researcher/actions/query_processing.py" },
-              atTop: { type: "boolean", description: "Insert `insert` at the very top of the file (missing imports)." },
-              insert: { type: "string", description: "With atTop, the line(s) to add." },
-              line: { type: "integer", description: "Replace exactly this 1-based line with `replace`. The most reliable way to change a line." },
-              find: { type: "string", description: "Fallback: exact unique text to replace." },
-              replace: { type: "string", description: "The corrected text, for line or find modes." }
-            },
-            required: ["path"]
-          }
-        }
-      }
-    ];
-    TOOLS = [...READ_TOOLS, ...FIX_TOOLS, TRY_BOOT];
-  }
-});
-
-function lineAt(content, index) {
-  let line = 1;
-  for (let i = 0; i < index; i += 1) if (content.charCodeAt(i) === 10) line += 1;
-  return line;
-}
-function commentedAt(content, index) {
-  const start = content.lastIndexOf("\n", index - 1) + 1;
-  return /^\s*(?:\/\/|\*|#)/.test(content.slice(start, index));
-}
-function comparisons(content) {
-  const found = [];
-  MEMBER_COMPARE.lastIndex = 0;
-  for (const match of content.matchAll(MEMBER_COMPARE)) {
-    if (commentedAt(content, match.index)) continue;
-    found.push({ request: match[1], member: match[2], value: match[4], index: match.index, line: lineAt(content, match.index) });
-  }
-  REVERSE_COMPARE.lastIndex = 0;
-  for (const match of content.matchAll(REVERSE_COMPARE)) {
-    if (commentedAt(content, match.index)) continue;
-    found.push({ request: match[3], member: match[4], value: match[2], index: match.index, line: lineAt(content, match.index) });
-  }
-  return found.sort((a, b) => a.index - b.index);
-}
-function sameGuard(content, left, right) {
-  const start = Math.min(left.index, right.index);
-  const end = Math.max(left.index, right.index);
-  return !/[{};]/.test(content.slice(start, end)) && !/\b(?:if|switch|case|return)\s*\b/.test(content.slice(start + 1, end));
-}
-function rawNodeHttpRoutes(content) {
-  if (typeof content !== "string" || !content.includes(".url") || !content.includes(".method")) return [];
-  const facts = comparisons(content);
-  const methods = facts.filter((fact) => fact.member === "method" && HTTP_METHOD.test(fact.value));
-  const routes = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const url of facts) {
-    if (url.member !== "url" || !url.value.startsWith("/") || url.value.length > 120 || url.value.includes("${")) continue;
-    if (!REQUEST_NAME.test(url.request)) continue;
-    const method = methods.filter((candidate) => candidate.request === url.request && Math.abs(candidate.line - url.line) <= 8 && sameGuard(content, candidate, url)).sort((a, b) => Math.abs(a.index - url.index) - Math.abs(b.index - url.index))[0];
-    if (!method) continue;
-    const key = `${method.value.toUpperCase()} ${url.value}`;
-    if (seen.has(key)) continue;
-    seen.add(key);
-    routes.push({ method: method.value.toUpperCase(), path: url.value, line: url.line });
-  }
-  return routes;
-}
-var MEMBER_COMPARE, REVERSE_COMPARE, HTTP_METHOD, REQUEST_NAME;
-var init_raw_node_routes = __esm({
-  "src/discover/raw-node-routes.mjs"() {
-    "use strict";
-    MEMBER_COMPARE = /\b([A-Za-z_$][\w$]*)\s*\.\s*(method|url)\s*(?:===|==|!==|!=)\s*(["'`])([^"'`\n]+)\3/g;
-    REVERSE_COMPARE = /(["'`])([^"'`\n]+)\1\s*(?:===|==|!==|!=)\s*\b([A-Za-z_$][\w$]*)\s*\.\s*(method|url)/g;
-    HTTP_METHOD = /^(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)$/i;
-    REQUEST_NAME = /^(?:req(?:uest)?|httpReq(?:uest)?|incomingReq(?:uest)?)$/i;
-  }
-});
-
-var init_seed = __esm({
-  "src/harness/seed.mjs"() {
-    "use strict";
-  }
-});
-
-var init_dotenv = __esm({
-  "src/harness/dotenv.mjs"() {
-    "use strict";
-  }
-});
-
-var init_socket_door = __esm({
-  "src/harness/socket-door.mjs"() {
-    "use strict";
-  }
-});
-
-var script;
-var init_source_baseline = __esm({
-  "src/harness/source-baseline.mjs"() {
-    "use strict";
-    script = String.raw`
-const fs = require('node:fs');
-const path = require('node:path');
-const { execFileSync } = require('node:child_process');
-const [suppliedRoot, mode, rulesText] = process.argv.slice(1);
-const initialize = mode === 'initialize';
-const fail = (message) => { console.error((initialize ? 'SOURCE_BASELINE_FAILED: ' : 'SOURCE_BASELINE_MISSING: ') + message + ' Recompile from a fresh source archive.'); process.exit(42); };
-const lstat = (p) => { try { return fs.lstatSync(p); } catch (e) { if (e.code === 'ENOENT') return null; throw e; } };
-let stage = 'checking the source directory';
-try {
-  const root = fs.realpathSync(suppliedRoot);
-  if (!fs.statSync(root).isDirectory()) fail('The source root is not a directory.');
-  const gitDir = path.join(root, '.git');
-  const prior = lstat(gitDir);
-  if (initialize && prior) fail('Refusing to initialize a tree that already has Git metadata.');
-  if (!initialize && (!prior || !prior.isDirectory() || prior.isSymbolicLink())) fail('The saved sandbox has no safe Git baseline directory.');
-  const env = { PATH: process.env.PATH || '/usr/local/bin:/usr/bin:/bin', HOME: '/nonexistent', XDG_CONFIG_HOME: '/nonexistent',
-    LC_ALL: 'C', GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_SYSTEM: '/dev/null', GIT_CONFIG_GLOBAL: '/dev/null',
-    GIT_NO_REPLACE_OBJECTS: '1', GIT_TERMINAL_PROMPT: '0', GIT_INDEX_FILE: path.join(gitDir, 'index') };
-  const base = ['--git-dir=' + gitDir, '--work-tree=' + root, '-c', 'safe.directory=' + root,
-    '-c', 'core.hooksPath=/dev/null', '-c', 'core.fsmonitor=false', '-c', 'core.untrackedCache=false',
-    '-c', 'core.autocrlf=false', '-c', 'core.fileMode=true', '-c', 'commit.gpgSign=false'];
-  const git = (...args) => execFileSync('git', [...base, ...args], { cwd: root, env, stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 16 * 1024 * 1024 });
-  const receiptPath = path.join(gitDir, 'brainsless-source-baseline.json');
-  if (initialize) {
-    stage = 'initializing Git';
-    git('init', '-q', '-b', 'main', '--template=');
-    const { secret, output, stores } = JSON.parse(rulesText);
-    fs.mkdirSync(path.join(gitDir, 'info'), { recursive: true });
-    fs.appendFileSync(path.join(gitDir, 'info', 'exclude'), '\n# Runtime capabilities and generated output never enter the source baseline\n' +
-      [...secret, ...output, ...stores.map((name) => name + '/')].join('\n') + '\n');
-    const excluded = [...secret, ...output].flatMap((glob) => [glob, '**/' + glob])
-      .concat(stores.flatMap((name) => [name + '/**', '**/' + name + '/**']))
-      .map((glob) => ':(exclude,icase,glob)' + glob);
-    stage = 'indexing archived source';
-    try {
-      git('add', '-A', '--', '.', ...excluded);
-    } catch (error) {
-      const said = String(error.stderr ?? '');
-      if (!/ignored by one of your \.gitignore files/i.test(said)) throw error;
-    }
-    if (!git('ls-files', '-z').length) fail('The fresh archive has no trackable source files.');
-    if (git('ls-files', '--stage', '-z').toString('utf8').split('\0').some((entry) => entry.startsWith('160000 '))) {
-      fail('The archive contains a nested Git checkout instead of ordinary source files.');
-    }
-    stage = 'committing the source baseline';
-    git('-c', 'user.name=Cortad Sandbox', '-c', 'user.email=sandbox@cortad.com', 'commit', '--no-verify', '-q', '-m', 'Source baseline');
-    const head = git('rev-parse', '--verify', 'HEAD^{commit}').toString('utf8').trim();
-    fs.writeFileSync(receiptPath, JSON.stringify({ version: 1, head }), { flag: 'wx', mode: 0o600 });
-  }
-  stage = 'verifying the source baseline';
-  const receiptStat = lstat(receiptPath);
-  if (!receiptStat || !receiptStat.isFile() || receiptStat.isSymbolicLink()) fail('The saved sandbox has no verified source baseline receipt.');
-  const receipt = JSON.parse(fs.readFileSync(receiptPath, 'utf8'));
-  const head = git('rev-parse', '--verify', 'HEAD^{commit}').toString('utf8').trim();
-  if (receipt.version !== 1 || receipt.head !== head || !/^[a-f0-9]{40,64}$/.test(head)) fail('The saved source baseline no longer matches its original receipt.');
-  const tracked = git('ls-files', '-z').toString('utf8').split('\0').filter(Boolean).length;
-  if (!tracked || !git('ls-tree', '-r', '-z', '--name-only', 'HEAD').length) fail('The source baseline has no tracked files.');
-  console.log('__brainsless_source_baseline_ready__:' + head + ':' + tracked);
-} catch (error) {
-  const reason = (() => {
-    const raw = String(error.stderr ?? '').split('\n').map((l) => l.trim()).filter(Boolean)[0] ?? '';
-    if (!raw) return '';
-    const safe = raw
-      .replace(/'[^']*'/g, "'…'")
-      .replace(/"[^"]*"/g, '"…"')
-      .replace(/(^|\s)[^\s]*[/\\][^\s]*/g, '$1…')
-      .replace(/[^\s]{40,}/g, '…')
-      .slice(0, 160);
-    return safe.length >= 8 ? ' Git said: ' + safe : '';
-  })();
-  const code = typeof error.status === 'number' ? ' (exit ' + error.status + ')' : error.code === 'ENOENT' ? ' (required file or Git executable missing)' : '';
-  fail('Failed while ' + stage + code + '.' + reason);
-}
-`;
-  }
-});
-
-var init_node_install_plan = __esm({
-  "src/harness/node-install-plan.mjs"() {
-    "use strict";
-  }
-});
-
-var init_lanes = __esm({
-  "src/harness/lanes.mjs"() {
-    "use strict";
-  }
-});
-
-import { execFile, execFileSync, execSync } from "node:child_process";
-import { promisify } from "node:util";
-function swapInText(text, swaps) {
-  const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  let out = text;
-  let hits = 0;
-  for (const swap of swaps) {
-    if (!out.includes(swap.from)) continue;
-    const PREFIX2 = "((?:[a-z][\\w.-]*[:/])?)";
-    out = out.replace(new RegExp("([\"'`])" + PREFIX2 + esc(swap.from) + "\\1", "g"), (_, quote, prefix) => {
-      hits += 1;
-      return quote + prefix + swap.to + quote;
-    });
-    out = out.replace(new RegExp("^([ \\t]*(?:export[ \\t]+)?[A-Za-z_][\\w.-]*[ \\t]*[=:][ \\t]*)" + PREFIX2 + esc(swap.from) + "[ \\t]*$", "gm"), (_, head, prefix) => {
-      hits += 1;
-      return head + prefix + swap.to;
-    });
-  }
-  return { text: out, hits };
-}
-var execFileP, ALLOW_CANARY, FOLD_PORTS, MODEL_SWAP_SCRIPT, FB_CONFIG;
-var init_boot = __esm({
-  "src/harness/boot.mjs"() {
-    "use strict";
-    init_body_wire();
-    init_endpoint();
-    init_retired();
-    init_stacks();
-    init_rank();
-    init_models();
-    init_devauth();
-    init_identities();
-    init_port();
-    init_library();
-    init_repair();
-    init_raw_node_routes();
-    init_seed();
-    init_dotenv();
-    init_spec_doors();
-    init_socket_door();
-    init_source_baseline();
-    init_node_install_plan();
-    init_lanes();
-    execFileP = promisify(execFile);
-    ALLOW_CANARY = "registry.npmjs.org/-/ping";
-    FOLD_PORTS = [
-      `H=${ALLOW_CANARY.split("/")[0]}`,
-      `command -v ip6tables-legacy >/dev/null || { echo no-iptables; exit 0; }`,
-      `A6=$(getent ahostsv6 "$H" | awk '{print $1; exit}'); A4=$(getent ahostsv4 "$H" | awk '{print $1; exit}')`,
-      `[ -n "$A6" ] && ip6tables-legacy -t nat -A OUTPUT -p tcp -d "$A6" ! --dport 443 -j DNAT --to-destination :443`,
-      `[ -n "$A4" ] && iptables-legacy -t nat -A OUTPUT -p tcp -d "$A4" ! --dport 443 -j DNAT --to-destination :443`,
-      `echo folded`
-    ].join("\n");
-    MODEL_SWAP_SCRIPT = `const fs = require("fs"), path = require("path");
-${swapInText.toString()}
-const swaps = JSON.parse(fs.readFileSync("/tmp/bl-swaps.json", "utf8"));
-const SKIP = new Set(["node_modules", ".git", ".venv", "venv", "__pycache__", ".cache", ".pnpm-store"]);
-let files = 0, hits = 0;
-const walk = (dir) => {
-  let entries = [];
-  try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
-  for (const entry of entries) {
-    if (SKIP.has(entry.name)) continue;
-    const at = path.join(dir, entry.name);
-    if (entry.isDirectory()) { walk(at); continue; }
-    if (!entry.isFile()) continue;
-    let buf;
-    try {
-      if (fs.statSync(at).size > 2000000) continue;
-      buf = fs.readFileSync(at);
-    } catch { continue; }
-    if (buf.includes(0)) continue;
-    const before = buf.toString("utf8");
-    const swapped = swapInText(before, swaps);
-    if (swapped.text === before) continue;
-    try { fs.writeFileSync(at, swapped.text); files += 1; hits += swapped.hits; } catch {}
-  }
-};
-walk("/workspace/repo");
-process.stdout.write(JSON.stringify({ files, hits }));
-`;
-    FB_CONFIG = JSON.stringify({ emulators: { ui: { enabled: false }, auth: { host: "127.0.0.1", port: 9099 }, firestore: { host: "127.0.0.1", port: 8080 } }, firestore: { rules: "/workspace/repo/firestore.rules" } });
-  }
-});
-
-var SLOT, SLOTS;
-var init_request_cell = __esm({
-  "src/simulate/request-cell.ts"() {
-    "use strict";
-    init_endpoint();
-    init_boot();
-    SLOT = /\/(?::(\w+)(?:\([^)]*\))?[?*]?|\{(\w+)[^}]*\}|\[(?:\.\.\.)?(\w+)\]|<(?:\w+:)?(\w+)>)(?=\/|$)/;
-    SLOTS = new RegExp(SLOT.source, "g");
-  }
-});
-
 function dynamicToolDiscovery(files) {
   const sites = [];
   for (const file of files) {
@@ -1337,8 +359,141 @@ var NEGATIVE = new RegExp(`${bounded(NEGATIVE_BOUNDED)}|${bare(NEGATIVE_BARE)}`,
 var NEGATIVE_START = new RegExp(`^(?:${bounded(NEGATIVE_BOUNDED)}|${bare(NEGATIVE_BARE)})`, "iu");
 var SPEAKS_TO_A_MODEL = new RegExp(`${ADDRESS.source}|${OBLIGATION.source}`, "giu");
 
-init_endpoint();
-init_turns();
+var words = new Intl.Segmenter(void 0, { granularity: "word" });
+var characters = new Intl.Segmenter(void 0, { granularity: "grapheme" });
+
+var INGEST_PREFIX = "ct_ing_";
+var PUBLIC_PREFIX = "ct_pub_";
+var MACHINE_PREFIX = "ct_mcp_";
+var LIVE_PREFIX = "bl_live_";
+
+var OUR_PREFIXES = [MACHINE_PREFIX, INGEST_PREFIX, PUBLIC_PREFIX, LIVE_PREFIX].map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`));
+var ENV_NAME = String.raw`[A-Za-z0-9_]*(?:(?:API|APP|ACCESS|AUTH|CLIENT|ENCRYPTION|MASTER|PRIVATE|SECRET|SIGNING)[_-]?KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|CREDENTIALS?|DSN)`;
+var SECRET_GLOBS = [
+  ".env",
+  ".env.*",
+  ".envrc",
+  ".netrc",
+  ".git-credentials",
+  ".npmrc",
+  ".pgpass",
+  "id_rsa*",
+  "id_dsa*",
+  "id_ecdsa*",
+  "id_ed25519*",
+  "*.pem",
+  "*.key",
+  "*.p12"
+];
+var SECRET_PATH = new RegExp(
+  `(^|/)(${SECRET_GLOBS.map((g) => g.replace(/[.+^${}()|[\]\\]/g, String.raw`\$&`).replaceAll("*", ".*")).join("|")})$`,
+  "i"
+);
+var RULES = [
+  { re: /(\b[a-z][a-z0-9+.-]*:\/\/)[^/?#\s]+@/gi, to: "$1<redacted>@" },
+  { re: /\b(bearer|basic|token)\s+(?=[A-Za-z0-9._~+/=-]*[0-9])[A-Za-z0-9._~+/=-]{12,}/gi, to: "$1 <redacted>" },
+  { re: /\b(authorization|proxy-authorization)\s*[:=]\s*(?![`']?(?:bearer|basic|token)\s+(?:<|\$\{|[^\s<"\\]{1,7}(?:[\s"\\`]|$)))\S+/gi, to: "$1: <redacted>" },
+  { re: /\b(gh[pousr]|github_pat)_[A-Za-z0-9_]{16,}/g, to: "<redacted-github-token>" },
+  { re: /\bsk-[A-Za-z0-9._-]{16,}/g, to: "<redacted-key>" },
+  { re: /\bfw_[A-Za-z0-9]{16,}/g, to: "<redacted-key>" },
+  { re: /\bAIza[A-Za-z0-9_-]{20,}/g, to: "<redacted-key>" },
+  { re: /\bxox[abprs]-[A-Za-z0-9-]{10,}/g, to: "<redacted-key>" },
+  { re: new RegExp(String.raw`\b(?:${OUR_PREFIXES.join("|")})[A-Za-z0-9._-]{8,}`, "g"), to: "<redacted-key>" },
+  { re: /\bpscale_(?:pw|tkn)_[A-Za-z0-9._-]{16,}/g, to: "<redacted-key>" },
+  { re: /\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{16,}/g, to: "<redacted-key>" },
+  { re: /\bwhsec_[A-Za-z0-9+/=]{16,}/g, to: "<redacted-key>" },
+  { re: /\bAKIA[0-9A-Z]{16}\b/g, to: "<redacted-key>" },
+  { re: /\bglpat-[A-Za-z0-9_-]{16,}/g, to: "<redacted-key>" },
+  { re: /\bhf_[A-Za-z0-9]{30,}/g, to: "<redacted-key>" },
+  { re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, to: "<redacted-private-key>" },
+  { re: new RegExp(String.raw`\b(${ENV_NAME})\s*=\s*\S{8,}`, "gi"), to: "$1=<redacted>" }
+];
+
+var ROLE_KEY = /^(?:role|sender|from|author|speaker|who|side)$/i;
+var PERSON_SIDE = /^(?:user|human|learner|student|customer|client|person|visitor|guest|player|candidate|patient|member|caller|me|you|question)$/i;
+var APP_SIDE = /^(?:assistant|ai|bot|model|agent|npc|coach|tutor|teacher|mentor|advisor|expert|character|answer|gpt|llm|robot)$/i;
+var NEITHER = /^(?:system|developer|tool|function|event|log|meta|hint|error)$/i;
+function turnSides(choices) {
+  const words2 = choices.filter((c) => typeof c === "string");
+  if (words2.length < 2) return null;
+  const person = words2.find((w) => PERSON_SIDE.test(w)) ?? words2.find((w) => !NEITHER.test(w));
+  const app = words2.find((w) => w !== person && APP_SIDE.test(w)) ?? words2.find((w) => w !== person && !NEITHER.test(w));
+  return person && app ? [person, app] : null;
+}
+
+var CONVERSATION_KEY = /^(messages|history|chat_?history|message_?history|conversation(_?history)?|(?:recent|previous|prior)_?messages|turns)$/i;
+var MESSAGE_KEY = /^(message|prompt|question|input|query|text|content|q|user_?message|msg|user_?input|task|topic|instructions?)$/i;
+var SESSION_KEY = /^(?:(?:session|conversation|thread|chat|dialog(?:ue)?)(?:[_-]?(?:id|key|token|uuid))?|[a-z][a-z0-9]*(?:[_-][a-z0-9]+)*[_-]?(?:conversation|thread|chat|dialog(?:ue)?)[_-]?(?:id|uuid))$/i;
+var ASK_WORD = /^(?:message|prompt|question|query|input|content|text|instructions?|task|topic|ask|request|goal)$/i;
+var NOT_THE_PERSONS = /^(?:system|assistant|developer|default|base|template|reply|response|answer|output|error|title|file|model)/i;
+function readsAsAsk(key) {
+  const words2 = key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").split(/[_\-\s]+/).filter(Boolean);
+  return words2.length > 0 && ASK_WORD.test(words2.at(-1)) && !NOT_THE_PERSONS.test(words2[0]);
+}
+function numberFor(key) {
+  if (/tokens?$/i.test(key)) return 1024;
+  if (/(?:max|limit|count|turns|rounds|steps|size|length|total|top_?k|minutes|seconds|days|pages|attempts|questions)/i.test(key)) return 5;
+  return 1;
+}
+function templateFromFields(fields) {
+  const out = {};
+  for (const field of fields) {
+    if (MESSAGE_KEY.test(field)) out[field] = "";
+    else if (CONVERSATION_KEY.test(field)) out[field] = [];
+  }
+  return Object.keys(out).length ? out : null;
+}
+function linkRefs(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return body;
+  const records = /* @__PURE__ */ new Map();
+  const collect = (value) => {
+    if (!value || typeof value !== "object") return;
+    for (const [key, v] of Object.entries(value)) {
+      if (Array.isArray(v)) {
+        const rows = v.filter((r) => Boolean(r) && typeof r === "object" && !Array.isArray(r) && typeof r["id"] === "string");
+        if (rows.length && rows.length === v.length && !CONVERSATION_KEY.test(key)) records.set(singular(key), rows);
+        v.forEach(collect);
+      } else collect(v);
+    }
+  };
+  collect(body);
+  if (!records.size) return body;
+  const out = structuredClone(body);
+  records.clear();
+  collect(out);
+  let changed = false;
+  for (const rows of records.values()) {
+    const seen = /* @__PURE__ */ new Set();
+    rows.forEach((row, i) => {
+      const id = row["id"];
+      if (seen.has(id)) {
+        row["id"] = /^[0-9a-f-]{36}$/i.test(id) ? `${id.slice(0, -4)}${String(i + 1).padStart(4, "0")}` : `${id}-${i + 1}`;
+        changed = true;
+      }
+      seen.add(row["id"]);
+    });
+  }
+  const point = (value) => {
+    if (!value || typeof value !== "object") return;
+    if (Array.isArray(value)) {
+      value.forEach(point);
+      return;
+    }
+    const row = value;
+    for (const [key, v] of Object.entries(row)) {
+      const m = /^(.*?)(?:Id|_id)$/.exec(key);
+      const stem = m?.[1] ? m[1].replace(/([a-z0-9])([A-Z])/g, "$1_$2").split("_").filter(Boolean).at(-1).toLowerCase() : null;
+      const rows = stem ? records.get(stem) : void 0;
+      if (typeof v === "string" && rows && !rows.some((r) => r["id"] === v)) {
+        row[key] = rows[0]["id"];
+        changed = true;
+      } else point(v);
+    }
+  };
+  point(out);
+  return changed ? out : body;
+}
+var singular = (key) => key.toLowerCase().replace(/ies$/, "y").replace(/(?<!s)s$/, "");
 
 var DECLS = [
   /^(\s*)(?:export\s+)?(?:default\s+)?(?:async\s+)?function\s*\*?\s*([A-Za-z_$][\w$]*)/,
@@ -1614,9 +769,6 @@ function moduleFile(module, from, paths) {
   return hits.length === 1 ? hits[0] : null;
 }
 
-init_endpoint();
-init_turns();
-
 var PROVIDER = new RegExp(
   [
     String.raw`['"](openai|groq-sdk|cohere-ai|ollama|litellm|@anthropic-ai\/[\w-]+|@google\/generative-ai|@mistralai\/[\w-]+|@aws-sdk\/client-bedrock-runtime)['"]`,
@@ -1627,8 +779,6 @@ var PROVIDER = new RegExp(
 var NON_PRODUCT = /(^|\/)(__tests__|tests?|bench|benchmark|sims?|eval|evals|mocks?|fixtures?|scripts|examples?)(\/|_|-)|[._-](test|spec|bench|benchmark|mock|fixture)\.[a-z]+$|(^|\/)bench_/i;
 var isProductPath = (path) => !NON_PRODUCT.test(path);
 
-init_request_cell();
-
 var emptyOwn = () => ({ typed: /* @__PURE__ */ new Map(), rows: [], factories: /* @__PURE__ */ new Map(), memo: /* @__PURE__ */ new Map() });
 var uncommented = (text) => text.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:\\])\/\/[^\n]*/g, "$1");
 var DECL = /^(?:export\s+)?(?:const|let|var)\s+[\w$]+\s*(?::\s*([\w$]+)\s*(\[\])?\s*)?=\s*(?=[[{])|^export\s+default\s+(?=[[{])/gm;
@@ -2823,6 +1973,32 @@ function lineStart(text, line) {
   return at;
 }
 
+var VERB = "GET|POST|PUT|PATCH|DELETE|Get|Post|Put|Patch|Delete|get|post|put|patch|delete";
+var PATTERNS = [
+  { file: /\.go$/, line: /\.Handle(?:Func)?\(\s*"(?:(GET|POST|PUT|PATCH|DELETE)\s+)?(\/[^"]*)"/, method: 1, path: 2 },
+  { file: /\.go$/, line: new RegExp(`\\.(${VERB})\\(\\s*"(\\/[^"]*)"`), method: 1, path: 2 },
+  { file: /\.(?:java|kt|scala)$/, line: /@(Get|Post|Put|Patch|Delete)(?:Mapping)?\(\s*(?:(?:value|path)\s*=\s*)?\{?\s*"([^"]*)"/, method: 1, path: 2 },
+  { file: /\.cs$/, line: /\.Map(Get|Post|Put|Patch|Delete)\(\s*@?"([^"]*)"/, method: 1, path: 2 },
+  { file: /\.cs$/, line: /\[Http(Get|Post|Put|Patch|Delete)\(\s*"([^"]*)"/, method: 1, path: 2 },
+  { file: /\.(?:rb|ex|exs)$/, line: /^\s*(get|post|put|patch|delete)\s*\(?\s*['"]([^'"\s]+)['"]/, method: 1, path: 2 },
+  { file: /\.php$/, line: /Route::(get|post|put|patch|delete)\(\s*['"]([^'"]+)['"]/, method: 1, path: 2 },
+  { file: /\.php$/, line: /\$\w+->(get|post|put|patch|delete)\(\s*['"](\/[^'"]*)['"]/, method: 1, path: 2 },
+  { file: /\.php$/, line: /REQUEST_METHOD['"]\]\s*[!=]==?\s*['"](GET|POST|PUT|PATCH|DELETE)['"].*?[!=]==?\s*['"](\/[\w/.-]*)['"]/, method: 1, path: 2 },
+  { file: /\.rs$/, line: /\.route\(\s*"([^"]+)"\s*,\s*(?:web::)?(get|post|put|patch|delete)\b/, method: 2, path: 1 },
+  { file: /\.rs$/, line: /#\[(get|post|put|patch|delete)\(\s*"([^"]+)"/, method: 1, path: 2 }
+];
+function frameworkRoute(path, line) {
+  for (const p of PATTERNS) {
+    if (!p.file.test(path)) continue;
+    const m = p.line.exec(line);
+    if (!m) continue;
+    const route = m[p.path];
+    if (/^https?:/.test(route)) continue;
+    return [m[0], (p.method && m[p.method] ? m[p.method] : "ALL").toUpperCase(), route.startsWith("/") ? route : `/${route}`];
+  }
+  return null;
+}
+
 function fileRoutes(path, content) {
   const matched = /(?:^|\/)src\/routes\/(.*?)\+server\.[cm]?[jt]s$/.exec(path);
   if (!matched) return [];
@@ -2964,7 +2140,57 @@ function joinPath(importer, spec) {
   return parts.join("/");
 }
 
-init_raw_node_routes();
+var MEMBER_COMPARE = /\b([A-Za-z_$][\w$]*)\s*\.\s*(method|url)\s*(?:===|==|!==|!=)\s*(["'`])([^"'`\n]+)\3/g;
+var REVERSE_COMPARE = /(["'`])([^"'`\n]+)\1\s*(?:===|==|!==|!=)\s*\b([A-Za-z_$][\w$]*)\s*\.\s*(method|url)/g;
+var HTTP_METHOD = /^(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)$/i;
+var REQUEST_NAME = /^(?:req(?:uest)?|httpReq(?:uest)?|incomingReq(?:uest)?)$/i;
+function lineAt(content, index) {
+  let line = 1;
+  for (let i = 0; i < index; i += 1) if (content.charCodeAt(i) === 10) line += 1;
+  return line;
+}
+function commentedAt(content, index) {
+  const start = content.lastIndexOf("\n", index - 1) + 1;
+  return /^\s*(?:\/\/|\*|#)/.test(content.slice(start, index));
+}
+function comparisons(content) {
+  const found = [];
+  MEMBER_COMPARE.lastIndex = 0;
+  for (const match of content.matchAll(MEMBER_COMPARE)) {
+    if (commentedAt(content, match.index)) continue;
+    found.push({ request: match[1], member: match[2], value: match[4], index: match.index, line: lineAt(content, match.index) });
+  }
+  REVERSE_COMPARE.lastIndex = 0;
+  for (const match of content.matchAll(REVERSE_COMPARE)) {
+    if (commentedAt(content, match.index)) continue;
+    found.push({ request: match[3], member: match[4], value: match[2], index: match.index, line: lineAt(content, match.index) });
+  }
+  return found.sort((a, b) => a.index - b.index);
+}
+function sameGuard(content, left, right) {
+  const start = Math.min(left.index, right.index);
+  const end = Math.max(left.index, right.index);
+  return !/[{};]/.test(content.slice(start, end)) && !/\b(?:if|switch|case|return)\s*\b/.test(content.slice(start + 1, end));
+}
+function rawNodeHttpRoutes(content) {
+  if (typeof content !== "string" || !content.includes(".url") || !content.includes(".method")) return [];
+  const facts = comparisons(content);
+  const methods = facts.filter((fact) => fact.member === "method" && HTTP_METHOD.test(fact.value));
+  const routes = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const url of facts) {
+    if (url.member !== "url" || !url.value.startsWith("/") || url.value.length > 120 || url.value.includes("${")) continue;
+    if (!REQUEST_NAME.test(url.request)) continue;
+    const method = methods.filter((candidate) => candidate.request === url.request && Math.abs(candidate.line - url.line) <= 8 && sameGuard(content, candidate, url)).sort((a, b) => Math.abs(a.index - url.index) - Math.abs(b.index - url.index))[0];
+    if (!method) continue;
+    const key = `${method.value.toUpperCase()} ${url.value}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    routes.push({ method: method.value.toUpperCase(), path: url.value, line: url.line });
+  }
+  return routes;
+}
+
 var HTTP = /\b(?:app|router|api|server|r)\s*\.\s*(get|post|put|patch|delete|all|ws)\s*\(\s*[`'"]([^`'"]+)/;
 var CALLBACK_HTTP = /^[ \t]*[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*\s*\.\s*(get|post|put|patch|delete|all|ws)\s*\(\s*(["'`])([^"'`\n]+)\2\s*,\s*(?:async\s+)?(?:function\s*\w*\s*\(|\([^)]*\)\s*=>|[A-Za-z_$][\w$]*\s*=>)/;
 function callbackRoute(lines, at) {
@@ -3058,8 +2284,9 @@ var FAMILIES = [
   { test: /llama[\w.-]*/g, provider: "Meta" }
 ];
 var PROSE_TOOL = /(?:\[?CMD:?\s*)?\{?\s*["']tool["']\s*:\s*["']([a-z_]{3,40})["']|\[TOOL_CALL:\s*([a-z_]{3,40})\]|^\s*[-*]?\s*`?([a-z_]{3,40})`?\s*[—:-]\s+(?:use|call|when|emits?|sends?|sets?|creates?)\b/i;
-var JSON_TOOL = /["']?name["']?\s*:\s*["']([a-z][a-z0-9_]{2,40})["']/;
-var FN_OPEN = /\bfunction["']?\s*:\s*\{/;
+var KEY_OF = (key) => String.raw`(?:["']?${key}["']?\s*(?::|=>)|["']${key}["']\s*(?:,|\bto\b))\s*`;
+var JSON_TOOL = new RegExp(`${KEY_OF("name")}["']([a-z][a-z0-9_]{2,40})["']`);
+var FN_OPEN = new RegExp(String.raw`(?<![\w$])${KEY_OF("function")}(?:\{|\[|[\w.]*(?:of|Of)\s*\()`);
 var SDK_TOOL = /(?:\b([a-zA-Z_$][\w$]*)\s*:|(?<!\b(?:module|exports|this))\.\s*([a-zA-Z_$][\w$]*)\s*=(?!=)|\[\s*["']([\w-]+)["']\s*\]\s*=(?!=))\s*tool\s*\(/g;
 var DECORATOR = /^\s*@(?:tool|function_tool|mcp\.tool|server\.tool|agent\.tool)\b\s*\(?\s*["\x27]?([a-z][\w]*)?["\x27]?/;
 var PY_DEF2 = /^\s*(?:async\s+)?def\s+([a-z][\w]*)\s*\(/;
@@ -3069,7 +2296,7 @@ var RETURNS_NAME = /^\s*return\s+["\x27]([a-z][\w]*)["\x27]\s*$/;
 var TOOL_FILE = /BaseTool|crewai[._]tools|langchain[._]tools|llama_index\.core\.tools|from mcp\b|@tool\b/;
 var MANIFEST_ID = /"(?:pluginKey|plugin_key|toolId|tool_id|tool_name|slug)"\s*:\s*"([a-z][a-z0-9_-]{2,40})"/g;
 var REGISTERED = /\b(?:server|mcp|agent|registry)\.tool\s*\(\s*["\x27]([a-z][\w]*)["\x27]/g;
-var FN_NAME = /["']?name["']?\s*:\s*["']([a-z_][a-z0-9_]{1,40})["']/;
+var FN_NAME = new RegExp(`${KEY_OF("name")}["']([a-z_][a-z0-9_]{1,40})["']`);
 var PY_CALLABLE_DEF = /^\s*(?:async\s+)?def\s+([A-Za-z_]\w*)\s*\(/;
 var TS_ENUM = /^\s*(?:export\s+)?(?:const\s+)?enum\s+([A-Za-z_]\w*)\s*\{/;
 var TS_ENUM_MEMBER = /^\s*([A-Za-z_]\w*)\s*=\s*["'`]([\w.-]{2,60})["'`]/;
@@ -3087,7 +2314,7 @@ function boundNames(content) {
   return names;
 }
 var PY_REGISTRY = /\b(?:bind_tools|ToolNode|create_react_agent)\s*\([^\n]*?\[([^\]\n]*)\]|\b(?:TOOLS?|tools)\s*(?::[^=\n]+)?=\s*\[([^\]\n]*)\]/;
-var TOOL_BLOCK = /\btools?\s*[:=]\s*\[|["']?type["']?\s*:\s*["']function["']|function_declarations|tool_definitions|ACTIONS\s*[:=]|_TOOLS?\s*=\s*[[{]|\b(?:TOOLS?|SKILLS?|FUNCTIONS?|AGENT_TOOLS|TOOL_REGISTRY|AVAILABLE_TOOLS)\s*=\s*[[{]/;
+var TOOL_BLOCK = new RegExp(String.raw`\btools?\s*[:=]\s*\[|${KEY_OF("type")}["']function["']|function_declarations|tool_definitions|ACTIONS\s*[:=]|_TOOLS?\s*=\s*[[{]|\b(?:TOOLS?|SKILLS?|FUNCTIONS?|AGENT_TOOLS|TOOL_REGISTRY|AVAILABLE_TOOLS)\s*=\s*[[{]`);
 var CLI_MODULE = /@click\.command|@app\.cli|@cli\.command|\.command\s*\(\s*\)|\badd_command\s*\(|\bimport click\b|\bfrom click\b|argparse\.ArgumentParser/;
 var PY_ACTION_SET = /^\s*["']([a-z_]{3,40})["']\s*,?\s*(?:#.*)?$/;
 var EMPHASIS = /(NON-?NEGOTIABLE|FORBIDDEN|NEVER|MUST NOT|DO NOT|ALWAYS|CRITICAL|🚨|⛔|MANDATORY|REQUIRED)/;
@@ -3201,11 +2428,11 @@ var submodule = (imp) => imp.name ? `${imp.module}${imp.module.endsWith(".") ? "
 function applyPythonMounts(out, paths) {
   const py = out.python;
   if (py.routeOf.size === 0) return;
-  const moduleFile3 = pyModules(paths);
+  const moduleFile2 = pyModules(paths);
   const routerAt = (file, name, hops = 0) => {
     if (py.routers.get(file)?.has(name)) return [file, name];
     const imp = py.imports.get(file)?.get(name);
-    const from = imp && hops < 4 ? moduleFile3(imp.module, file) : void 0;
+    const from = imp && hops < 4 ? moduleFile2(imp.module, file) : void 0;
     return from && imp.name ? routerAt(from, imp.name, hops + 1) : void 0;
   };
   const included = (file, target) => {
@@ -3213,7 +2440,7 @@ function applyPythonMounts(out, paths) {
     if (dot < 0) return routerAt(file, target);
     const head = target.slice(0, dot);
     const imp = head.includes(".") ? void 0 : py.imports.get(file)?.get(head);
-    const module = moduleFile3(imp ? submodule(imp) : head, file);
+    const module = moduleFile2(imp ? submodule(imp) : head, file);
     return module ? routerAt(module, target.slice(dot + 1)) : void 0;
   };
   const includedAs = /* @__PURE__ */ new Map();
@@ -3399,7 +2626,7 @@ function scanFile(path, content, out) {
     openMethod = (WRAPPED_METHOD.exec(line) ?? (chained ? CHAIN_OPEN.exec(line) : null))?.[1]?.toUpperCase() ?? "";
     const flask = FLASK_ROUTE.exec(line);
     const js = HTTP.exec(line) ?? (chained ? CHAIN_ROUTE.exec(line) ?? callbackRoute(lines, i) : null);
-    const http = js ?? FASTAPI.exec(line) ?? (flask ? [flask[0], flaskMethod(lines, i, flask[3]), flask[2]] : null);
+    const http = js ?? FASTAPI.exec(line) ?? (flask ? [flask[0], flaskMethod(lines, i, flask[3]), flask[2]] : null) ?? frameworkRoute(path, line);
     if (http) {
       const socket = /^(?:websocket|ws)$/i.test(http[1]);
       const at = js ? underOwn(ownPrefix, http[2]) : { route: http[2] };
@@ -3542,7 +2769,7 @@ var QUOTED = /["'`]([^"'`\n]{2,80})["'`]/g;
 var SCHEME = /^\w+:\/\//;
 var REF = /^([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)$/;
 var GENERIC = /* @__PURE__ */ new Set(["model", "engine", "deployment", "name", "id", "self", "config", "options"]);
-var SLOT2 = /^(?:model|modelId|model_id|model_name|modelName|deployment|deployment_name|deploymentName|engine)$/;
+var SLOT = /^(?:model|modelId|model_id|model_name|modelName|deployment|deployment_name|deploymentName|engine)$/;
 var ID_FIELD = /model[_-]?id/i;
 var NOT_A_NAME = /* @__PURE__ */ new Set(["true", "false", "null", "undefined", "None", "True", "False", "this", "cls", "string", "str", "number", "any", "unknown"]);
 function wrappedRefs(span) {
@@ -3552,7 +2779,7 @@ function wrappedRefs(span) {
     for (let peeled = 0; value !== null && !REF.test(value) && peeled < 4; peeled++) value = calledWith(value);
     const path = value === null ? void 0 : REF.exec(value)?.[1];
     const name = path?.slice(path.lastIndexOf(".") + 1) ?? "";
-    if (path && !GENERIC.has(name) && !(path.includes(".") && SLOT2.test(name)) && !NOT_A_NAME.has(path)) out.push(path);
+    if (path && !GENERIC.has(name) && !(path.includes(".") && SLOT.test(name)) && !NOT_A_NAME.has(path)) out.push(path);
   }
   return out;
 }
@@ -3705,7 +2932,7 @@ function readModels(line, idIsModel = false) {
     const path = REF.exec(span.trim())?.[1];
     if (path) {
       const name = path.slice(path.lastIndexOf(".") + 1);
-      const copy = path.includes(".") && SLOT2.test(name);
+      const copy = path.includes(".") && SLOT.test(name);
       if (!GENERIC.has(name) && !NOT_A_NAME.has(path)) refs.push({ ref: path, env: ENV_HOLDER.test(path), at: match.index, ...copy ? { copy } : {} });
       continue;
     }
@@ -4329,8 +3556,6 @@ function routesFor(index, path, fn) {
   return { named, module: named.length ? [] : (index.byModule.get(dir) ?? []).slice(0, 8) };
 }
 
-init_endpoint();
-
 import { existsSync, readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { join } from "node:path";
@@ -4356,7 +3581,7 @@ function loadCompiler() {
 var JS = /\.(?:[cm]?[jt]sx?)$/;
 var EXT = /\.([cm]?[jt]sx?)$/;
 var MOST_FILES = 6e3;
-var keyOf2 = (node) => `${node.path}:${node.span.line}`;
+var keyOf = (node) => `${node.path}:${node.span.line}`;
 function tsGraph(read, paths) {
   const files = paths.filter((p) => JS.test(p) && !/\.d\.ts$/.test(p) && !/(^|\/)node_modules\//.test(p));
   if (!files.length || files.length > MOST_FILES) return null;
@@ -4444,13 +3669,13 @@ function tsGraph(read, paths) {
     const inner = enclosing(spansOf2(p), line).at(-1);
     if (!inner) return null;
     const node = { path: p, span: inner };
-    const k = keyOf2(node);
+    const k = keyOf(node);
     if (!nodes.has(k)) nodes.set(k, node);
     return nodes.get(k);
   };
   const edges = /* @__PURE__ */ new Map();
   const link = (from, to) => {
-    const a = keyOf2(from), b = keyOf2(to);
+    const a = keyOf(from), b = keyOf(to);
     if (a === b) return;
     if (!edges.has(a)) edges.set(a, /* @__PURE__ */ new Set());
     edges.get(a).add(b);
@@ -4483,7 +3708,7 @@ function tsGraph(read, paths) {
     visit(sf);
   }
   const within = (path, span) => [...nodes.values()].filter((n) => n.path === path && n.span.line >= span.line && n.span.end <= span.end);
-  return { edges, nodes, key: keyOf2, within };
+  return { edges, nodes, key: keyOf, within };
 }
 function reachBy(graph, start, isEnd, hops = 8) {
   const first = graph.within(start.path, start.span);
@@ -4510,7 +3735,7 @@ import { fileURLToPath } from "node:url";
 var PY = /\.py$/;
 var MOST_FILES2 = 6e3;
 var SCRIPT = fileURLToPath(new URL("./py/pyreach.py", import.meta.url));
-var keyOf3 = (node) => `${node.path}:${node.span.line}`;
+var keyOf2 = (node) => `${node.path}:${node.span.line}`;
 function pyGraph(read, paths) {
   const files = paths.filter((p) => PY.test(p) && !/(^|\/)(?:node_modules|\.venv|venv|site-packages)\//.test(p));
   if (!files.length || files.length > MOST_FILES2) return null;
@@ -4537,7 +3762,7 @@ function pyGraph(read, paths) {
     const inner = enclosing(spansOf2(p), line).at(-1);
     if (!inner) return null;
     const node = { path: p, span: inner };
-    const k = keyOf3(node);
+    const k = keyOf2(node);
     if (!nodes.has(k)) nodes.set(k, node);
     return nodes.get(k);
   };
@@ -4545,13 +3770,13 @@ function pyGraph(read, paths) {
   for (const e of parsed.edges) {
     const from = nodeAt(e.from.path, e.from.line), to = nodeAt(e.to.path, e.to.line);
     if (!from || !to) continue;
-    const a = keyOf3(from), b = keyOf3(to);
+    const a = keyOf2(from), b = keyOf2(to);
     if (a === b) continue;
     if (!edges.has(a)) edges.set(a, /* @__PURE__ */ new Set());
     edges.get(a).add(b);
   }
   const within = (path, span) => [...nodes.values()].filter((n) => n.path === path && n.span.line >= span.line && n.span.end <= span.end);
-  return { edges, nodes, key: keyOf3, within };
+  return { edges, nodes, key: keyOf2, within };
 }
 
 var TOOLING2 = /(^|\/)(tests?|__tests__|bench(mark)?s?|evals?|examples?|scripts?|docs?|node_modules)(\/|$)/;
@@ -5026,7 +4251,7 @@ function clientCalls(files) {
   return [...byDoor.values()];
 }
 
-var RULES3 = [
+var RULES2 = [
   { shape: "websocket", re: /@\w+\.websocket\(|\.websocket\(|websocket\.accept\(|new WebSocketServer\b|\bwss?\.on\(\s*["']connection|handleUpgrade\(|\bws\.send\(/ },
   { shape: "sse", re: /["']Content-Type["']\s*[:,]\s*["']text\/event-stream|media_type\s*=\s*["']text\/event-stream|EventSourceResponse\(|\.write\(\s*`(?:data|event):|yield\s+f?["'](?:data|event):|`data: \$\{JSON\.stringify/ },
   { shape: "openai", re: /to_openai_sse_stream|OpenAICompletion\b|chat\.completion(?:\.chunk)?["']|choices\s*[:=]\s*\[\s*\{|["']choices["']\s*:\s*\[/ },
@@ -5065,7 +4290,7 @@ function replyShapesOf(index, read) {
 function shapeOfChain(route, chain, routes, read) {
   const ordered = [...chain.filter((r) => r.start), ...chain.filter((r) => !r.start)];
   const texts = ordered.map((r) => ({ path: r.path, from: r.span.line, lines: read(r.path).slice(r.span.line - 1, r.span.end), start: Boolean(r.start) }));
-  const hits = texts.map(classify2).filter((h) => h !== null);
+  const hits = texts.map(classify).filter((h) => h !== null);
   if (!hits.length) return null;
   const hit = hits.reduce((a, b) => b.rank < a.rank ? b : a);
   const joined = texts.map((t) => t.lines.join("\n")).join("\n");
@@ -5090,14 +4315,14 @@ function shapeOfChain(route, chain, routes, read) {
   }
   return found;
 }
-function classify2(text) {
+function classify(text) {
   let best = null;
   text.lines.forEach((line, i) => {
     if (GUARD.test(line) || !text.start && RETURNS.test(line)) return;
-    const rank = RULES3.findIndex((r) => r.re.test(line));
+    const rank = RULES2.findIndex((r) => r.re.test(line));
     if (rank < 0 || best && best.rank <= rank) return;
     const contentType = /["']((?:audio|image|video)\/[\w.+-]+|application\/(?:pdf|octet-stream))["']/.exec(line)?.[1];
-    best = { shape: RULES3[rank].shape, rank, evidence: `${text.path}:${text.from + i}: ${line.trim().slice(0, 140)}`, text, ...contentType ? { contentType } : {} };
+    best = { shape: RULES2[rank].shape, rank, evidence: `${text.path}:${text.from + i}: ${line.trim().slice(0, 140)}`, text, ...contentType ? { contentType } : {} };
   });
   return best;
 }
@@ -5426,6 +4651,9 @@ function callName(source, scope) {
 
 var literalName = ({ name, owner }) => name ? owner ? `${owner}.${name}` : name : null;
 var MIN_TEXT = 60;
+var SPANNING_QUOTES = /\.(?:rs|php|rb|ex|exs|pl|sh)$/i;
+var HEREDOC_FILE = /\.(?:rb|php|pl|sh)$/i;
+var HEREDOC = /^<<(?:<|[~-])?(["']?)([A-Z_][A-Z0-9_]*)\1/;
 function findLiterals(source, path = "") {
   const out = [];
   const fields = [];
@@ -5435,6 +4663,9 @@ function findLiterals(source, path = "") {
   let line = 1;
   const inJsLike = /\.(ts|tsx|js|jsx|mjs|cjs|mts|cts)$/i.test(path);
   const python = !inJsLike;
+  const spans = SPANNING_QUOTES.test(path);
+  const rust = /\.rs$/i.test(path);
+  const heredocs = HEREDOC_FILE.test(path);
   const at = (offset) => source.slice(i, i + offset);
   while (i < source.length) {
     const ch = source[i];
@@ -5443,6 +4674,39 @@ function findLiterals(source, path = "") {
       i++;
       continue;
     }
+    if (rust && ch === "r" && !/[\w$]/.test(source[i - 1] ?? "")) {
+      const raw = /^r(#*)"/.exec(at(12));
+      if (raw) {
+        const close = source.indexOf(`"${raw[1]}`, i + raw[0].length);
+        if (close > 0) {
+          const text = source.slice(i + raw[0].length, close);
+          const assigned = assignedName(source, i, openers, python);
+          out.push({ line, text, kind: "template", ...assigned.name ? { name: assigned.name } : {} });
+          line += text.split("\n").length - 1;
+          i = close + 1 + raw[1].length;
+          continue;
+        }
+      }
+    }
+    if (rust && ch === "'") {
+      i += /^'(?:\\.|[^\\'\n])'/.exec(at(12))?.[0].length ?? 1;
+      continue;
+    }
+    if (heredocs && ch === "<") {
+      const doc = HEREDOC.exec(at(80));
+      if (doc) {
+        const body = source.indexOf("\n", i) + 1;
+        const end = body > 0 ? new RegExp(`^[ \\t]*${doc[2]}\\b`, "m").exec(source.slice(body)) : null;
+        if (end) {
+          const text = source.slice(body, body + end.index);
+          const assigned = assignedName(source, i, openers, python);
+          out.push({ line: line + 1, text, kind: "template", ...assigned.name ? { name: assigned.name } : {} });
+          line += text.split("\n").length;
+          i = body + end.index + end[0].length;
+          continue;
+        }
+      }
+    }
     if (at(2) === "//") {
       while (i < source.length && source[i] !== "\n") i++;
       continue;
@@ -5461,13 +4725,13 @@ function findLiterals(source, path = "") {
       continue;
     }
     if (at(3) === '"""' || at(3) === "'''") {
-      const fence2 = at(3);
+      const fence = at(3);
       const startLine = line;
       const direct = fieldBefore(source.slice(Math.max(0, i - 120), i), python);
       const field = direct ? { name: direct.name, scope: stack } : wrapperField(source, stack, python);
       i += 3;
       const from = i;
-      while (i < source.length && at(3) !== fence2) {
+      while (i < source.length && at(3) !== fence) {
         if (source[i] === "\n") line++;
         i++;
       }
@@ -5490,7 +4754,7 @@ function findLiterals(source, path = "") {
       const field = assigned.field ? { name: assigned.name, scope: stack } : assigned.name ? void 0 : wrapperField(source, stack, python);
       const name = assigned.name ?? field?.name;
       const owner = assigned.owner;
-      const first = readLiteral(source, i, ch);
+      const first = readLiteral(source, i, ch, spans);
       if (first) {
         let { text, end } = first;
         line += first.newlines;
@@ -5589,7 +4853,7 @@ function skipRegex(source, start) {
   }
   return start;
 }
-function readLiteral(source, start, quote) {
+function readLiteral(source, start, quote, spans = false) {
   let i = start + 1;
   let newlines = 0;
   const parts = [];
@@ -5602,7 +4866,7 @@ function readLiteral(source, start, quote) {
       continue;
     }
     if (ch === "\n") {
-      if (quote !== "`") return null;
+      if (quote !== "`" && !spans) return null;
       newlines++;
       i++;
       continue;
@@ -5828,8 +5092,9 @@ var SCAFFOLDING = /(^|\/)(bench|benchmarks?|sims?|tests?|__tests__|spec|specs|fi
 var DATA_FILE = /\.(?:json|jsonl|ndjson|csv|tsv|xml|html?|parquet|arrow|ipynb)$/i;
 var VENDORED = /(^|\/)(vendor|vendored|third[_-]?party|public|static|assets|dist|build|out|\.next|\.nuxt|generated|node_modules|\.venv|venv|site-packages|__pycache__|swagger|openapi)(\/|$)/i;
 var MINIFIED = /\.min\.(?:js|css|mjs)$/i;
-function isScaffolding2(path) {
-  return SCAFFOLDING.test(path) || VENDORED.test(path) || MINIFIED.test(path);
+var DOCUMENT_ROOT = /(^|\/)(public|static)\/(?:[^/]+\/)*[^/]+\.php$/i;
+function isScaffolding(path) {
+  return SCAFFOLDING.test(path) || VENDORED.test(path) && !(DOCUMENT_ROOT.test(path) && !/(^|\/)vendor\//.test(path)) || MINIFIED.test(path);
 }
 function looksMinified(text) {
   const lines = text.split("\n");
@@ -5890,8 +5155,8 @@ function searchPrompts(candidates, limit = 64) {
   }
   const own = found.filter((p) => !oneLiners.has(p) || !found.some((q) => q !== p && q.path === p.path && q.text.includes(p.text)));
   const ranked = own.sort((a, b) => b.score - a.score);
-  const reachable = ranked.filter((p) => p.uses > 0 && !isScaffolding2(p.path));
-  const scaffolding = ranked.filter((p) => p.uses > 0 && isScaffolding2(p.path));
+  const reachable = ranked.filter((p) => p.uses > 0 && !isScaffolding(p.path));
+  const scaffolding = ranked.filter((p) => p.uses > 0 && isScaffolding(p.path));
   const running = reachable.slice(0, limit);
   for (const prompt of running) {
     prompt.appends = appendedTo(read, prompt);
@@ -6220,7 +5485,7 @@ ${p.text.slice(0, PROMPT_HEAD)}${p.text.length > PROMPT_HEAD ? `
   const procedures = new Map(served2.entries.flatMap((e) => e.procedure ? [[`${e.method.toUpperCase()} ${e.route}`, e.procedure]] : []));
   const routes = /* @__PURE__ */ new Set([...Object.keys(bodies), ...Object.keys(fields), ...validated, ...shapes.keys(), ...conventionOf.keys(), ...procedures.keys()]);
   const edge = new Set(served2.entries.filter((e) => e.runtime === "edge").map((e) => `${e.method.toUpperCase()} ${e.route}`));
-  const contract2 = [...routes].sort().map((route) => {
+  const contract = [...routes].sort().map((route) => {
     const shape2 = shapes.get(route);
     const conv = conventionOf.get(route);
     return {
@@ -6238,13 +5503,13 @@ ${p.text.slice(0, PROMPT_HEAD)}${p.text.length > PROMPT_HEAD ? `
     };
   });
   const named = (row) => [...Object.keys(row.body ?? {}).filter((k) => typeof row.body[k] === "string"), ...row.fields ?? []];
-  const values = ownValues(candidates.map((c) => ({ path: c.path, content: c.full ?? c.head })), new Set(contract2.flatMap(named)));
-  for (const row of contract2) {
+  const values = ownValues(candidates.map((c) => ({ path: c.path, content: c.full ?? c.head })), new Set(contract.flatMap(named)));
+  for (const row of contract) {
     const own = Object.fromEntries(named(row).filter((k) => values[k]).map((k) => [k, values[k]]));
     if (Object.keys(own).length) row.values = own;
   }
   const toolServers = toolServersOf(reaching, read, calls).filter((route) => !reached.some((r) => r.route === route));
-  return { text, chars: text.length, sites: calls.length, prompts: prompts.length, calls: siteList, doors, aiRoutes, bodies, fields, validated, requests, contract: contract2, toolServers };
+  return { text, chars: text.length, sites: calls.length, prompts: prompts.length, calls: siteList, doors, aiRoutes, bodies, fields, validated, requests, contract, toolServers };
 }
 var LISTS_TOOLS = /ListToolsRequestSchema|["'`]tools\/list["'`]|\blist_tools\b/;
 var CALLS_TOOLS = /CallToolRequestSchema|ToolCallRequestSchema|["'`]tools\/call["'`]|\bcall_tool\b/;
@@ -6352,11 +5617,13 @@ var WRITER = `You read one file of an AI product's own evaluation suite and list
 - "turns": the case's later user messages in order, VERBATIM; [] when there is one message.
 - "reference": the author's expected answer or rubric for the reply when the file gives one in words, VERBATIM; "" when none.
 - "must": phrases the file says the reply must contain, VERBATIM; [] when none. "mustAny": groups of phrases of which one must appear, each group a list; [] when none. "mustNot": phrases the file says must not appear; [] when none.
+- Phrases go in "must", "mustAny" or "mustNot" only when the file's own check passes or fails a case on them. A list the file only counts or prints for a person to judge (a coverage share, hits shown beside the answer) goes in none of them.
+- "least": how many of "must" the file's check needs in the reply to pass the case. The number of "must" when it needs every one; fewer when it passes on some of them (half of them rounded up, any one).
 - "refuse": true only when the file says the reply should refuse, decline or ask for clarification instead of answering.
 - "store": the collection, index, dataset, grade or namespace this case is sent under, when the file names one on the case (collectionId, gradePrefix, namespace), VERBATIM; "" when none.
 - "endpoint": the path the file posts its cases to ("/v1/chat") when the file says; "" when it does not.
 - At most ${CASES_PER_FILE} cases, in the file's order.
-Return ONLY JSON: {"endpoint":"","cases":[{"id":"","input":"","turns":[],"reference":"","must":[],"mustAny":[],"mustNot":[],"refuse":false,"store":""}]}`;
+Return ONLY JSON: {"endpoint":"","cases":[{"id":"","input":"","turns":[],"reference":"","must":[],"least":0,"mustAny":[],"mustNot":[],"refuse":false,"store":""}]}`;
 
 var TEST = /(?:^|\/)(?:tests?|__tests__|spec|e2e)\/|[._-](?:test|spec)\.[^/]+$|(?:^|\/)(?:test_[^/]+|conftest)\.py$/;
 var README = /(?:^|\/)(?:readme|contributing|architecture|design)[^/]*\.(?:md|mdx|txt|rst)$|^docs\/[^/]+\.(?:md|mdx)$/i;