@davesheffer/hunch 1.18.1 → 1.19.0

package/dist/extractors/landscapeDiscovery.js

@@ -4,14 +4,31 @@ import { posix } from "node:path";
 import { TextDecoder } from "node:util";
 import { compareCodeUnits } from "../core/canonicalOrder.js";
 import { resourceId, resourceRelationshipId } from "../core/ids.js";
+import { parseJsonc } from "../core/jsonc.js";
+import { parseSource } from "./parse.js";
 import { EdgeSchema, ResourceSchema, isCredentialFreeText, } from "../core/types.js";
 import { canonicalRemoteRepositoryIdentity, foreignRepoEnv, gitNullDevice, isGitRepo, } from "./git.js";
 export const LANDSCAPE_DISCOVERY_SCHEMA_VERSION = "hunch.landscape-discovery/1";
 export const LANDSCAPE_CANDIDATE_SCHEMA_VERSION = "hunch.landscape-candidate/1";
 const MAX_MANIFEST_BYTES = 1024 * 1024;
 const MAX_MANIFESTS = 128;
+const MAX_MCP_CONFIG_BYTES = 256 * 1024;
+const MAX_MCP_DECLARATIONS = 128;
+const MAX_DELIVERY_DECLARATION_BYTES = 256 * 1024;
+const MAX_DELIVERY_DECLARATIONS = 128;
 const ORDINARY_BLOB_MODES = new Set(["100644", "100755"]);
 const UTF8_DECODER = new TextDecoder("utf-8", { fatal: true });
+const MCP_CONFIG_SPECS = [
+    { path: ".mcp.json", format: "jsonc", rootKey: "mcpServers" },
+    { path: ".agents/mcp_config.json", format: "jsonc", rootKey: "mcpServers" },
+    { path: ".codex/config.toml", format: "codex_toml" },
+    { path: ".cursor/mcp.json", format: "jsonc", rootKey: "mcpServers" },
+    { path: ".vscode/mcp.json", format: "jsonc", rootKey: "servers" },
+    { path: ".windsurf/mcp_config.json", format: "jsonc", rootKey: "mcpServers" },
+    { path: "plugin/.mcp.json", format: "jsonc", rootKey: "mcpServers" },
+    { path: "server.json", format: "registry_json" },
+];
+const MCP_CONFIG_BY_PATH = new Map(MCP_CONFIG_SPECS.map((spec) => [spec.path, spec]));
 function gitEnv() {
     return {
         ...foreignRepoEnv(process.env),
@@ -218,6 +235,1062 @@ function parseManifests(blobs, issues) {
     }
     return parsed;
 }
+function mcpConfigBlobs(root, revision) {
+    const raw = gitBuffer(root, [
+        "ls-tree", "--full-tree", "-z", revision, "--", ...MCP_CONFIG_SPECS.map((spec) => spec.path),
+    ], 4 * 1024 * 1024);
+    const blobs = [];
+    for (const record of nulRecords(raw)) {
+        const tab = record.indexOf(0x09);
+        if (tab < 0)
+            continue;
+        const head = record.subarray(0, tab).toString("ascii").match(/^([0-7]{6}) (blob|tree|commit) ([0-9a-f]{40,64})$/i);
+        if (!head)
+            continue;
+        let path;
+        try {
+            path = UTF8_DECODER.decode(record.subarray(tab + 1));
+        }
+        catch {
+            continue;
+        }
+        if (!MCP_CONFIG_BY_PATH.has(path))
+            continue;
+        const mode = head[2] === "blob" ? head[1] : `${head[2]}:${head[1]}`;
+        blobs.push({ path, mode, oid: head[3].toLowerCase(), bytes: null, contentHash: null });
+    }
+    return blobs.sort((left, right) => compareCodeUnits(left.path, right.path)).map((blob) => {
+        if (!ORDINARY_BLOB_MODES.has(blob.mode))
+            return blob;
+        const size = Number(gitText(root, ["cat-file", "-s", blob.oid], 1024 * 1024));
+        if (!Number.isSafeInteger(size) || size < 0 || size > MAX_MCP_CONFIG_BYTES) {
+            return { ...blob, contentHash: size > MAX_MCP_CONFIG_BYTES ? "oversized" : null };
+        }
+        const bytes = gitBuffer(root, ["cat-file", "blob", blob.oid], MAX_MCP_CONFIG_BYTES + 1);
+        return { ...blob, bytes, contentHash: sha256Bytes(bytes) };
+    });
+}
+function validMcpServerName(value) {
+    const name = value.trim();
+    return name.length > 0 && name.length <= 128
+        && /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name)
+        && isCredentialFreeText(name)
+        ? name
+        : null;
+}
+function safeMcpSourceField(rootKey, rawName) {
+    const name = validMcpServerName(rawName);
+    return name ? `${rootKey}.${name}` : `${rootKey}[sha256:${createHash("sha256").update(rawName).digest("hex")}]`;
+}
+function safeMcpUrl(value) {
+    if (typeof value !== "string" || value.length > 2048 || !isCredentialFreeText(value))
+        return null;
+    try {
+        const url = new URL(value);
+        if (!/^https?:$/.test(url.protocol) || url.username || url.password || url.search || url.hash)
+            return null;
+        return url.href.endsWith("/") ? url.href.slice(0, -1) : url.href;
+    }
+    catch {
+        return null;
+    }
+}
+function stripTomlComment(input) {
+    let quote = null;
+    let escaped = false;
+    for (let index = 0; index < input.length; index += 1) {
+        const char = input[index];
+        if (quote === "\"") {
+            if (escaped)
+                escaped = false;
+            else if (char === "\\")
+                escaped = true;
+            else if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (quote === "'") {
+            if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (char === "\"" || char === "'")
+            quote = char;
+        else if (char === "#")
+            return input.slice(0, index);
+    }
+    return input;
+}
+function tomlStructure(input) {
+    let quote = null;
+    let escaped = false;
+    let depth = 0;
+    for (const char of input) {
+        if (quote === "\"") {
+            if (escaped)
+                escaped = false;
+            else if (char === "\\")
+                escaped = true;
+            else if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (quote === "'") {
+            if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (char === "\"" || char === "'")
+            quote = char;
+        else if (char === "[" || char === "{")
+            depth += 1;
+        else if (char === "]" || char === "}")
+            depth -= 1;
+        if (depth < 0)
+            throw new Error("unbalanced TOML structure");
+    }
+    return { depth, closedQuote: quote === null };
+}
+function tomlStatements(input) {
+    const statements = [];
+    let pending = "";
+    for (const rawLine of input.split(/\r?\n/)) {
+        const line = stripTomlComment(rawLine).trim();
+        if (!line)
+            continue;
+        pending = pending ? `${pending}\n${line}` : line;
+        const state = tomlStructure(pending);
+        if (state.depth === 0 && state.closedQuote) {
+            statements.push(pending);
+            pending = "";
+        }
+    }
+    if (pending)
+        throw new Error("unterminated TOML statement");
+    return statements;
+}
+function parseTomlString(input) {
+    const value = input.trim();
+    if (value.length < 2)
+        throw new Error("TOML string expected");
+    if (value.startsWith("'")) {
+        if (!value.endsWith("'") || value.slice(1, -1).includes("'"))
+            throw new Error("invalid literal TOML string");
+        return value.slice(1, -1);
+    }
+    if (!value.startsWith("\"") || !value.endsWith("\""))
+        throw new Error("TOML string expected");
+    const parsed = JSON.parse(value);
+    if (typeof parsed !== "string")
+        throw new Error("TOML string expected");
+    return parsed;
+}
+function parseTomlKeyPath(input) {
+    const parts = [];
+    let index = 0;
+    const skipSpace = () => {
+        while (/\s/.test(input[index] ?? ""))
+            index += 1;
+    };
+    while (index < input.length) {
+        skipSpace();
+        const char = input[index];
+        if (char === "\"" || char === "'") {
+            const start = index;
+            index += 1;
+            let escaped = false;
+            for (; index < input.length; index += 1) {
+                const current = input[index];
+                if (char === "\"" && escaped)
+                    escaped = false;
+                else if (char === "\"" && current === "\\")
+                    escaped = true;
+                else if (current === char)
+                    break;
+            }
+            if (index >= input.length)
+                throw new Error("unterminated quoted TOML key");
+            index += 1;
+            parts.push(parseTomlString(input.slice(start, index)));
+        }
+        else {
+            const match = input.slice(index).match(/^[A-Za-z0-9_-]+/);
+            if (!match)
+                throw new Error("invalid TOML key");
+            parts.push(match[0]);
+            index += match[0].length;
+        }
+        skipSpace();
+        if (index === input.length)
+            break;
+        if (input[index] !== ".")
+            throw new Error("invalid dotted TOML key");
+        index += 1;
+    }
+    if (!parts.length)
+        throw new Error("empty TOML key");
+    return parts;
+}
+function splitTomlAssignment(input) {
+    let quote = null;
+    let escaped = false;
+    for (let index = 0; index < input.length; index += 1) {
+        const char = input[index];
+        if (quote === "\"") {
+            if (escaped)
+                escaped = false;
+            else if (char === "\\")
+                escaped = true;
+            else if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (quote === "'") {
+            if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (char === "\"" || char === "'")
+            quote = char;
+        else if (char === "=")
+            return [input.slice(0, index).trim(), input.slice(index + 1).trim()];
+    }
+    throw new Error("TOML assignment expected");
+}
+function parseTomlStringArray(input) {
+    const value = input.trim();
+    if (!value.startsWith("[") || !value.endsWith("]"))
+        throw new Error("TOML string array expected");
+    const body = value.slice(1, -1);
+    const items = [];
+    let start = 0;
+    let quote = null;
+    let escaped = false;
+    for (let index = 0; index <= body.length; index += 1) {
+        const char = body[index];
+        if (quote === "\"") {
+            if (escaped)
+                escaped = false;
+            else if (char === "\\")
+                escaped = true;
+            else if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (quote === "'") {
+            if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (char === "\"" || char === "'") {
+            quote = char;
+            continue;
+        }
+        if (char === "," || index === body.length) {
+            const item = body.slice(start, index).trim();
+            if (item)
+                items.push(parseTomlString(item));
+            start = index + 1;
+        }
+    }
+    if (quote)
+        throw new Error("unterminated TOML array string");
+    return items;
+}
+function parseCodexMcpServers(input) {
+    const servers = {};
+    let current = null;
+    for (const statement of tomlStatements(input)) {
+        if (statement.startsWith("[")) {
+            if (!statement.endsWith("]") || statement.startsWith("[[") || statement.endsWith("]]")) {
+                throw new Error("unsupported TOML table");
+            }
+            const path = parseTomlKeyPath(statement.slice(1, -1));
+            if (path[0] !== "mcp_servers") {
+                current = null;
+                continue;
+            }
+            if (path.length !== 2 || Object.hasOwn(servers, path[1]))
+                throw new Error("invalid MCP TOML table");
+            current = path[1];
+            servers[current] = {};
+            continue;
+        }
+        if (!current)
+            continue;
+        const [rawKey, rawValue] = splitTomlAssignment(statement);
+        const keyPath = parseTomlKeyPath(rawKey);
+        if (keyPath.length !== 1)
+            throw new Error("invalid MCP TOML key");
+        const key = keyPath[0];
+        if (!new Set(["command", "url", "args"]).has(key))
+            continue;
+        if (Object.hasOwn(servers[current], key))
+            throw new Error("duplicate MCP TOML key");
+        servers[current][key] = key === "args" ? parseTomlStringArray(rawValue) : parseTomlString(rawValue);
+    }
+    return servers;
+}
+function validMcpRegistryName(value) {
+    if (typeof value !== "string")
+        return null;
+    const name = value.trim();
+    return name.length > 0 && name.length <= 256
+        && /^[A-Za-z0-9][A-Za-z0-9._-]*(?:\/[A-Za-z0-9][A-Za-z0-9._-]*)+$/.test(name)
+        && isCredentialFreeText(name)
+        ? name
+        : null;
+}
+function safeRegistryText(value, maxLength) {
+    if (typeof value !== "string")
+        return null;
+    const text = value.trim();
+    return text && text.length <= maxLength && !/[\u0000-\u001f\u007f]/.test(text) && isCredentialFreeText(text)
+        ? text
+        : null;
+}
+function registryMcpDeclarations(parsed, blob, revision, issues) {
+    const invalid = () => {
+        issues.push({
+            code: "mcp_declaration_invalid",
+            sourcePath: blob.path,
+            sourceField: "name",
+            detail: "registry MCP data must declare one bounded package or credential-free HTTP remote transport",
+        });
+        return [];
+    };
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return invalid();
+    const manifest = parsed;
+    if (typeof manifest.$schema !== "string"
+        || !/^https:\/\/static\.modelcontextprotocol\.io\/schemas\/.+\/server\.schema\.json$/.test(manifest.$schema)) {
+        return [];
+    }
+    const name = validMcpRegistryName(manifest.name);
+    if (!name) {
+        issues.push({
+            code: "mcp_server_name_invalid",
+            sourcePath: blob.path,
+            sourceField: "name",
+            detail: "the registry manifest uses an invalid or credential-bearing MCP server name",
+        });
+        return [];
+    }
+    const evidence = {
+        kind: "mcp_declaration",
+        sourcePath: blob.path,
+        sourceField: "name",
+        sourceRevision: revision,
+        sourceContentHash: blob.contentHash,
+    };
+    const packages = manifest.packages === undefined ? [] : manifest.packages;
+    const remotes = manifest.remotes === undefined ? [] : manifest.remotes;
+    if (!Array.isArray(packages) || !Array.isArray(remotes) || packages.length > 32 || remotes.length > 32)
+        return invalid();
+    const packageDescriptors = [];
+    for (const value of packages) {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return invalid();
+        const item = value;
+        const transport = item.transport;
+        if (!transport || typeof transport !== "object" || Array.isArray(transport)
+            || transport.type !== "stdio")
+            return invalid();
+        const registryType = safeRegistryText(item.registryType, 64);
+        const identifier = safeRegistryText(item.identifier, 256);
+        const version = safeRegistryText(item.version, 128);
+        if (!registryType || !identifier || !version)
+            return invalid();
+        packageDescriptors.push({ registryType, identifier, version });
+    }
+    const remoteLocators = [];
+    for (const value of remotes) {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return invalid();
+        const item = value;
+        const type = item.type;
+        const locator = safeMcpUrl(item.url);
+        if ((type !== "sse" && type !== "streamable-http") || !locator)
+            return invalid();
+        remoteLocators.push(locator);
+    }
+    const declarations = [];
+    if (packageDescriptors.length) {
+        const descriptors = packageDescriptors.sort((left, right) => compareCodeUnits(`${left.registryType}:${left.identifier}:${left.version}`, `${right.registryType}:${right.identifier}:${right.version}`));
+        declarations.push({
+            key: name.toLowerCase(),
+            name,
+            transport: "stdio",
+            relationship: "provides",
+            locator: null,
+            descriptorHash: contentHash({ transport: "stdio", packages: descriptors }),
+            evidence,
+        });
+    }
+    for (const locator of [...new Set(remoteLocators)].sort(compareCodeUnits)) {
+        declarations.push({
+            key: name.toLowerCase(),
+            name,
+            transport: "http",
+            relationship: "provides",
+            locator,
+            descriptorHash: contentHash({ transport: "http", locator }),
+            evidence,
+        });
+    }
+    return declarations.length ? declarations : invalid();
+}
+function mcpDeclaration(rawName, rawEntry, blob, rootKey, revision, issues) {
+    const sourceField = safeMcpSourceField(rootKey, rawName);
+    const name = validMcpServerName(rawName);
+    if (!name) {
+        issues.push({
+            code: "mcp_server_name_invalid",
+            sourcePath: blob.path,
+            sourceField,
+            detail: "an MCP declaration uses an invalid or credential-bearing server name",
+        });
+        return null;
+    }
+    if (!rawEntry || typeof rawEntry !== "object" || Array.isArray(rawEntry)) {
+        issues.push({ code: "mcp_declaration_invalid", sourcePath: blob.path, sourceField, detail: `MCP server ${name} must be an object declaration` });
+        return null;
+    }
+    const entry = rawEntry;
+    const rawUrl = entry.url ?? entry.serverUrl;
+    const locator = rawUrl === undefined ? null : safeMcpUrl(rawUrl);
+    const command = typeof entry.command === "string" ? entry.command.trim() : null;
+    const args = entry.args === undefined
+        ? []
+        : Array.isArray(entry.args) && entry.args.length <= 64 && entry.args.every((arg) => typeof arg === "string" && arg.length <= 1024)
+            ? entry.args
+            : null;
+    const validCommand = command !== null && command.length > 0 && command.length <= 1024
+        && !/[\u0000-\u001f\u007f]/.test(command) && isCredentialFreeText(command);
+    if ((rawUrl !== undefined && locator === null) || args === null
+        || (rawUrl === undefined && !validCommand) || (rawUrl !== undefined && command !== null)) {
+        issues.push({
+            code: "mcp_declaration_invalid",
+            sourcePath: blob.path,
+            sourceField,
+            detail: `MCP server ${name} must declare one credential-free HTTP URL or one bounded stdio command`,
+        });
+        return null;
+    }
+    const transport = locator ? "http" : "stdio";
+    const descriptorHash = locator
+        ? contentHash({ transport, locator })
+        : contentHash({ transport, command, args });
+    return {
+        key: name.toLowerCase(),
+        name,
+        transport,
+        relationship: "depends_on",
+        locator,
+        descriptorHash,
+        evidence: {
+            kind: "mcp_declaration",
+            sourcePath: blob.path,
+            sourceField,
+            sourceRevision: revision,
+            sourceContentHash: blob.contentHash,
+        },
+    };
+}
+function mcpDeclarations(root, revision, issues) {
+    const declarations = [];
+    let considered = 0;
+    for (const blob of mcpConfigBlobs(root, revision)) {
+        if (!blob.bytes) {
+            issues.push({
+                code: blob.contentHash === "oversized" ? "mcp_config_oversized" : "mcp_config_mode",
+                sourcePath: blob.path,
+                sourceField: "",
+                detail: blob.contentHash === "oversized"
+                    ? `${blob.path} exceeds the ${MAX_MCP_CONFIG_BYTES}-byte MCP configuration limit`
+                    : `${blob.path} uses unsupported Git mode ${blob.mode}`,
+            });
+            continue;
+        }
+        const spec = MCP_CONFIG_BY_PATH.get(blob.path);
+        let parsed;
+        try {
+            parsed = spec.format === "codex_toml"
+                ? parseCodexMcpServers(blob.bytes.toString("utf8"))
+                : spec.format === "registry_json"
+                    ? JSON.parse(blob.bytes.toString("utf8"))
+                    : parseJsonc(blob.bytes.toString("utf8"));
+        }
+        catch {
+            issues.push({
+                code: "mcp_config_invalid",
+                sourcePath: blob.path,
+                sourceField: "",
+                detail: `${blob.path} is not valid ${spec.format === "codex_toml" ? "bounded MCP TOML" : spec.format === "registry_json" ? "JSON" : "JSON/JSONC"}`,
+            });
+            continue;
+        }
+        if (spec.format === "registry_json") {
+            const registryDeclarations = registryMcpDeclarations(parsed, blob, revision, issues);
+            if (!registryDeclarations.length)
+                continue;
+            const logicalCount = registryDeclarations.length;
+            if (considered + logicalCount > MAX_MCP_DECLARATIONS) {
+                issues.push({
+                    code: "mcp_declaration_limit",
+                    sourcePath: blob.path,
+                    sourceField: "name",
+                    detail: `bounded discovery accepts at most ${MAX_MCP_DECLARATIONS} MCP declarations`,
+                });
+                continue;
+            }
+            considered += logicalCount;
+            declarations.push(...registryDeclarations);
+            continue;
+        }
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            issues.push({ code: "mcp_config_invalid", sourcePath: blob.path, sourceField: "", detail: `${blob.path} must contain MCP table data` });
+            continue;
+        }
+        const rootKey = spec.format === "codex_toml" ? "mcp_servers" : spec.rootKey;
+        const servers = spec.format === "codex_toml" ? parsed : parsed[rootKey];
+        if (!servers || typeof servers !== "object" || Array.isArray(servers)) {
+            if (spec.format !== "codex_toml") {
+                issues.push({ code: "mcp_config_invalid", sourcePath: blob.path, sourceField: rootKey, detail: `${blob.path} must contain an object at ${rootKey}` });
+            }
+            continue;
+        }
+        const entries = Object.entries(servers).sort(([left], [right]) => compareCodeUnits(left, right));
+        if (considered + entries.length > MAX_MCP_DECLARATIONS) {
+            issues.push({
+                code: "mcp_declaration_limit",
+                sourcePath: blob.path,
+                sourceField: rootKey,
+                detail: `bounded discovery accepts at most ${MAX_MCP_DECLARATIONS} MCP declarations`,
+            });
+        }
+        const remaining = Math.max(0, MAX_MCP_DECLARATIONS - considered);
+        const selectedEntries = entries.slice(0, remaining);
+        considered += selectedEntries.length;
+        for (const [name, entry] of selectedEntries) {
+            const declaration = mcpDeclaration(name, entry, blob, rootKey, revision, issues);
+            if (declaration)
+                declarations.push(declaration);
+        }
+    }
+    return declarations.sort((left, right) => compareCodeUnits(`${left.key}:${left.descriptorHash}:${left.evidence.sourcePath}`, `${right.key}:${right.descriptorHash}:${right.evidence.sourcePath}`));
+}
+function deliveryDeclarationSpec(path) {
+    if (/^\.github\/workflows\/[^/]+\.ya?ml$/.test(path)) {
+        return {
+            evidenceKind: "ci_declaration",
+            resourceKind: "pipeline",
+            provider: "github_actions",
+            format: "yaml",
+            sourceField: "jobs",
+            relationship: "contains",
+        };
+    }
+    if (path === ".gitlab-ci.yml") {
+        return {
+            evidenceKind: "ci_declaration",
+            resourceKind: "pipeline",
+            provider: "gitlab_ci",
+            format: "yaml",
+            sourceField: "$",
+            relationship: "contains",
+        };
+    }
+    if (path === ".circleci/config.yml") {
+        return {
+            evidenceKind: "ci_declaration",
+            resourceKind: "pipeline",
+            provider: "circleci",
+            format: "yaml",
+            sourceField: "jobs",
+            relationship: "contains",
+        };
+    }
+    if (/^\.buildkite\/pipeline\.ya?ml$/.test(path)) {
+        return {
+            evidenceKind: "ci_declaration",
+            resourceKind: "pipeline",
+            provider: "buildkite",
+            format: "yaml",
+            sourceField: "steps",
+            relationship: "contains",
+        };
+    }
+    if (path === "Jenkinsfile") {
+        return {
+            evidenceKind: "ci_declaration",
+            resourceKind: "pipeline",
+            provider: "jenkins",
+            format: "jenkinsfile",
+            sourceField: "pipeline",
+            relationship: "contains",
+        };
+    }
+    if (/(^|\/)Dockerfile(?:\.[A-Za-z0-9][A-Za-z0-9._-]{0,127})?$/.test(path)) {
+        return {
+            evidenceKind: "deployment_declaration",
+            resourceKind: "artifact",
+            provider: "docker",
+            format: "dockerfile",
+            sourceField: "FROM",
+            relationship: "builds",
+        };
+    }
+    if (/(^|\/)(?:compose|docker-compose)\.ya?ml$/.test(path)) {
+        return {
+            evidenceKind: "deployment_declaration",
+            resourceKind: "deployment_target",
+            provider: "docker_compose",
+            format: "yaml",
+            sourceField: "services",
+            relationship: "deploys",
+        };
+    }
+    if (/(^|\/)(?:k8s|kubernetes|manifests|deploy)\/.+\.ya?ml$/.test(path)) {
+        return {
+            evidenceKind: "deployment_declaration",
+            resourceKind: "deployment_target",
+            provider: "kubernetes",
+            format: "kubernetes_yaml",
+            sourceField: "metadata.name",
+            relationship: "deploys",
+        };
+    }
+    if (/(^|\/)[^/]+\.service$/.test(path)) {
+        return {
+            evidenceKind: "deployment_declaration",
+            resourceKind: "deployment_target",
+            provider: "systemd",
+            format: "systemd_unit",
+            sourceField: "[Service]",
+            relationship: "deploys",
+        };
+    }
+    return null;
+}
+function safeDeclarationPath(path) {
+    const segments = path.split("/");
+    return path.length > 0
+        && path.length <= 1024
+        && !path.startsWith("/")
+        && !path.includes("\\")
+        && !/^[A-Za-z]:/.test(path)
+        && !/[\u0000-\u001f\u007f]/.test(path)
+        && !/(^|[._/-])(authorization|bearer|credential|password|passwd|private[_-]?key|secret|token|api[_-]?key)\s*[:=]/i.test(path)
+        && segments.every((segment) => !!segment && segment !== "." && segment !== "..")
+        && isCredentialFreeText(path);
+}
+function deliveryDeclarationBlobs(root, revision) {
+    const raw = gitBuffer(root, ["ls-tree", "--full-tree", "-r", "-z", revision], 64 * 1024 * 1024);
+    const discovered = [];
+    for (const record of nulRecords(raw)) {
+        const tab = record.indexOf(0x09);
+        if (tab < 0)
+            continue;
+        const head = record.subarray(0, tab).toString("ascii").match(/^([0-7]{6}) (blob|tree|commit) ([0-9a-f]{40,64})$/i);
+        if (!head)
+            continue;
+        const pathBytes = record.subarray(tab + 1);
+        let path;
+        try {
+            path = UTF8_DECODER.decode(pathBytes);
+        }
+        catch {
+            const approximate = pathBytes.toString("latin1");
+            if (deliveryDeclarationSpec(approximate)) {
+                discovered.push({
+                    path: `<unsafe-delivery-declaration:sha256:${createHash("sha256").update(pathBytes).digest("hex")}>`,
+                    mode: "unsafe-path",
+                    oid: head[3].toLowerCase(),
+                    bytes: null,
+                    contentHash: null,
+                    spec: null,
+                });
+            }
+            continue;
+        }
+        const spec = deliveryDeclarationSpec(path);
+        if (!spec)
+            continue;
+        if (!safeDeclarationPath(path)) {
+            discovered.push({
+                path: `<unsafe-delivery-declaration:sha256:${createHash("sha256").update(pathBytes).digest("hex")}>`,
+                mode: "unsafe-path",
+                oid: head[3].toLowerCase(),
+                bytes: null,
+                contentHash: null,
+                spec: null,
+            });
+            continue;
+        }
+        discovered.push({
+            path,
+            mode: head[2] === "blob" ? head[1] : `${head[2]}:${head[1]}`,
+            oid: head[3].toLowerCase(),
+            bytes: null,
+            contentHash: null,
+            spec,
+        });
+    }
+    discovered.sort((left, right) => compareCodeUnits(left.path, right.path));
+    const total = discovered.length;
+    const blobs = discovered.slice(0, MAX_DELIVERY_DECLARATIONS).map((blob) => {
+        if (blob.mode === "unsafe-path" || !ORDINARY_BLOB_MODES.has(blob.mode))
+            return blob;
+        const size = Number(gitText(root, ["cat-file", "-s", blob.oid], 1024 * 1024));
+        if (!Number.isSafeInteger(size) || size < 0 || size > MAX_DELIVERY_DECLARATION_BYTES) {
+            return { ...blob, contentHash: size > MAX_DELIVERY_DECLARATION_BYTES ? "oversized" : null };
+        }
+        const bytes = gitBuffer(root, ["cat-file", "blob", blob.oid], MAX_DELIVERY_DECLARATION_BYTES + 1);
+        return { ...blob, bytes, contentHash: sha256Bytes(bytes) };
+    });
+    return { blobs, total };
+}
+const KUBERNETES_WORKLOAD_KINDS = new Set(["Deployment", "StatefulSet", "DaemonSet", "Job", "CronJob", "Pod"]);
+function stripYamlScalarComment(input) {
+    let quote = null;
+    let escaped = false;
+    for (let index = 0; index < input.length; index += 1) {
+        const char = input[index];
+        if (quote === "\"") {
+            if (escaped)
+                escaped = false;
+            else if (char === "\\")
+                escaped = true;
+            else if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (quote === "'") {
+            if (char === "'" && input[index + 1] === "'")
+                index += 1;
+            else if (char === "'")
+                quote = null;
+            continue;
+        }
+        if (char === "\"" || char === "'")
+            quote = char;
+        else if (char === "#" && (index === 0 || /\s/.test(input[index - 1])))
+            return input.slice(0, index);
+    }
+    return input;
+}
+function boundedYamlScalar(input) {
+    const value = stripYamlScalarComment(input).trim();
+    if (!value || value.length > 512)
+        return null;
+    let parsed;
+    if (value.startsWith("\"")) {
+        if (!value.endsWith("\""))
+            return null;
+        try {
+            const decoded = JSON.parse(value);
+            if (typeof decoded !== "string")
+                return null;
+            parsed = decoded;
+        }
+        catch {
+            return null;
+        }
+    }
+    else if (value.startsWith("'")) {
+        if (!value.endsWith("'"))
+            return null;
+        const inner = value.slice(1, -1);
+        let decoded = "";
+        for (let index = 0; index < inner.length; index += 1) {
+            const char = inner[index];
+            if (char !== "'") {
+                decoded += char;
+                continue;
+            }
+            if (inner[index + 1] !== "'")
+                return null;
+            decoded += "'";
+            index += 1;
+        }
+        parsed = decoded;
+    }
+    else {
+        if (!/^[A-Za-z0-9][A-Za-z0-9._/@-]{0,255}$/.test(value))
+            return null;
+        parsed = value;
+    }
+    return parsed.length > 0 && parsed.length <= 256
+        && !/[\u0000-\u001f\u007f]/.test(parsed)
+        && isCredentialFreeText(parsed)
+        ? parsed
+        : null;
+}
+function kubernetesYamlDocuments(source) {
+    return source
+        .split(/^(?:---|\.\.\.)[ \t]*(?:#.*)?\r?$/m)
+        .map((document, index) => ({ index, source: document }))
+        .filter((document) => document.source.split(/\r?\n/)
+        .some((line) => !!line.trim() && !line.trimStart().startsWith("#")));
+}
+function kubernetesDocumentHeader(source) {
+    const header = {
+        apiVersion: undefined,
+        kind: undefined,
+        name: undefined,
+        namespace: undefined,
+        duplicate: false,
+    };
+    let metadataIndent = null;
+    let metadataChildIndent = null;
+    const assign = (field, raw) => {
+        if (header[field] !== undefined) {
+            header.duplicate = true;
+            return;
+        }
+        header[field] = boundedYamlScalar(raw);
+    };
+    for (const rawLine of source.split(/\r?\n/)) {
+        if (!rawLine.trim() || rawLine.trimStart().startsWith("#"))
+            continue;
+        const indentation = rawLine.match(/^ */)[0].length;
+        const mapping = rawLine.slice(indentation).match(/^([A-Za-z][A-Za-z0-9_-]*)[ \t]*:(.*)$/);
+        if (indentation === 0) {
+            metadataIndent = null;
+            metadataChildIndent = null;
+            if (!mapping)
+                continue;
+            const [_, key, raw] = mapping;
+            if (key === "apiVersion" || key === "kind")
+                assign(key, raw);
+            else if (key === "metadata" && !stripYamlScalarComment(raw).trim())
+                metadataIndent = 0;
+            continue;
+        }
+        if (metadataIndent === null || indentation <= metadataIndent || !mapping)
+            continue;
+        if (metadataChildIndent === null)
+            metadataChildIndent = indentation;
+        if (indentation !== metadataChildIndent)
+            continue;
+        const [_, key, raw] = mapping;
+        if (key === "name" || key === "namespace")
+            assign(key, raw);
+    }
+    return header;
+}
+function validKubernetesApiVersion(value) {
+    return value.length <= 128 && /^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?\/v[0-9][a-z0-9]*$|^v[0-9][a-z0-9]*$/i.test(value);
+}
+function validKubernetesName(value) {
+    return value.length <= 253 && /^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/.test(value);
+}
+function validKubernetesNamespace(value) {
+    return value.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+}
+function kubernetesDeclarations(blob, source, issues) {
+    const candidates = [];
+    for (const document of kubernetesYamlDocuments(source)) {
+        const header = kubernetesDocumentHeader(document.source);
+        if (header.duplicate) {
+            issues.push({
+                code: "delivery_declaration_invalid",
+                sourcePath: blob.path,
+                sourceField: `documents[${document.index}]`,
+                detail: `${blob.path} document ${document.index} repeats a Kubernetes identity field`,
+            });
+            continue;
+        }
+        if (typeof header.kind !== "string" || !KUBERNETES_WORKLOAD_KINDS.has(header.kind))
+            continue;
+        const namespace = header.namespace === undefined ? "default" : header.namespace;
+        if (typeof header.apiVersion !== "string" || !validKubernetesApiVersion(header.apiVersion)
+            || typeof header.name !== "string" || !validKubernetesName(header.name)
+            || typeof namespace !== "string" || !validKubernetesNamespace(namespace)) {
+            issues.push({
+                code: "delivery_declaration_invalid",
+                sourcePath: blob.path,
+                sourceField: `documents[${document.index}].metadata.name`,
+                detail: `${blob.path} document ${document.index} has an incomplete or unsafe Kubernetes workload identity`,
+            });
+            continue;
+        }
+        const identity = `${header.apiVersion.toLowerCase()}/${header.kind.toLowerCase()}/${namespace}/${header.name}`;
+        candidates.push({
+            path: blob.path,
+            contentHash: blob.contentHash,
+            spec: blob.spec,
+            sourceField: `documents[${document.index}].metadata.name`,
+            identitySuffix: identity,
+            displayName: `Kubernetes ${header.kind}: ${namespace}/${header.name}`,
+            locatorSuffix: `#document=${document.index}`,
+            contractVersion: header.apiVersion,
+            metadata: {
+                document_index: document.index,
+                kubernetes_kind: header.kind,
+                kubernetes_namespace: namespace,
+            },
+            identity,
+            documentIndex: document.index,
+        });
+    }
+    const byIdentity = new Map();
+    for (const declaration of candidates) {
+        const group = byIdentity.get(declaration.identity) ?? [];
+        group.push(declaration);
+        byIdentity.set(declaration.identity, group);
+    }
+    const declarations = [];
+    for (const identity of [...byIdentity.keys()].sort(compareCodeUnits)) {
+        const group = byIdentity.get(identity);
+        if (group.length > 1) {
+            issues.push({
+                code: "delivery_declaration_conflict",
+                sourcePath: blob.path,
+                sourceField: "documents.metadata.name",
+                detail: `${blob.path} repeats one Kubernetes workload identity across ${group.length} documents; identity remains unresolved`,
+            });
+            continue;
+        }
+        const { identity: _, documentIndex: __, ...declaration } = group[0];
+        declarations.push(declaration);
+    }
+    return declarations;
+}
+function validDeliveryDeclaration(path, spec, source) {
+    if (spec.format === "dockerfile") {
+        return /^\s*FROM(?:\s+--platform=(?:"[^"]*"|'[^']*'|\S+))?\s+\S+/im.test(source);
+    }
+    if (spec.format === "jenkinsfile") {
+        return /^\s*(?:pipeline|node)\s*\{/m.test(source);
+    }
+    if (spec.format === "systemd_unit") {
+        return source.split(/\r?\n/).some((line) => /^\s*\[Service\]\s*$/.test(line));
+    }
+    const parsed = parseSource(path, source);
+    if (!parsed?.parseable)
+        return false;
+    if (spec.provider === "github_actions" || spec.provider === "circleci")
+        return /^jobs\s*:/m.test(source);
+    if (spec.provider === "buildkite")
+        return /^steps\s*:/m.test(source);
+    if (spec.provider === "docker_compose")
+        return /^services\s*:/m.test(source);
+    return source.trim().length > 0;
+}
+function deliveryDeclarations(root, revision, issues) {
+    const discovered = deliveryDeclarationBlobs(root, revision);
+    let limitReported = false;
+    const reportLimit = (sourcePath) => {
+        if (limitReported)
+            return;
+        limitReported = true;
+        issues.push({
+            code: "delivery_declaration_limit",
+            sourcePath,
+            sourceField: "delivery",
+            detail: `bounded discovery accepts at most ${MAX_DELIVERY_DECLARATIONS} delivery declarations`,
+        });
+    };
+    if (discovered.total > MAX_DELIVERY_DECLARATIONS) {
+        reportLimit(".");
+    }
+    const declarations = [];
+    for (const blob of discovered.blobs) {
+        if (!blob.bytes || !blob.spec) {
+            const code = blob.contentHash === "oversized"
+                ? "delivery_declaration_oversized"
+                : blob.mode === "unsafe-path"
+                    ? "delivery_declaration_path"
+                    : "delivery_declaration_mode";
+            issues.push({
+                code,
+                sourcePath: blob.path,
+                sourceField: "",
+                detail: blob.contentHash === "oversized"
+                    ? `${blob.path} exceeds the ${MAX_DELIVERY_DECLARATION_BYTES}-byte delivery declaration limit`
+                    : blob.mode === "unsafe-path"
+                        ? "a delivery declaration uses an unsafe path"
+                        : `${blob.path} uses unsupported Git mode ${blob.mode}`,
+            });
+            continue;
+        }
+        if (declarations.length >= MAX_DELIVERY_DECLARATIONS) {
+            reportLimit(blob.path);
+            continue;
+        }
+        let source;
+        try {
+            source = UTF8_DECODER.decode(blob.bytes);
+        }
+        catch {
+            issues.push({
+                code: "delivery_declaration_invalid",
+                sourcePath: blob.path,
+                sourceField: blob.spec.sourceField,
+                detail: `${blob.path} is not valid UTF-8 declaration data`,
+            });
+            continue;
+        }
+        if (blob.spec.format === "kubernetes_yaml") {
+            const parsed = parseSource(blob.path, source);
+            if (!parsed?.parseable) {
+                issues.push({
+                    code: "delivery_declaration_invalid",
+                    sourcePath: blob.path,
+                    sourceField: blob.spec.sourceField,
+                    detail: `${blob.path} is not structurally valid Kubernetes YAML`,
+                });
+                continue;
+            }
+            const workloads = kubernetesDeclarations(blob, source, issues);
+            const remaining = MAX_DELIVERY_DECLARATIONS - declarations.length;
+            if (workloads.length > remaining)
+                reportLimit(blob.path);
+            declarations.push(...workloads.slice(0, remaining));
+            continue;
+        }
+        if (!validDeliveryDeclaration(blob.path, blob.spec, source)) {
+            issues.push({
+                code: "delivery_declaration_invalid",
+                sourcePath: blob.path,
+                sourceField: blob.spec.sourceField,
+                detail: `${blob.path} is not a structurally valid ${blob.spec.provider} declaration`,
+            });
+            continue;
+        }
+        declarations.push({
+            path: blob.path,
+            contentHash: blob.contentHash,
+            spec: blob.spec,
+            metadata: blob.spec.provider === "systemd" ? { unit_name: posix.basename(blob.path) } : undefined,
+        });
+    }
+    return declarations;
+}
+function deliveryResourceKey(declaration) {
+    const prefix = declaration.spec.provider === "docker"
+        ? "container-image"
+        : declaration.spec.provider === "docker_compose"
+            ? "docker-compose"
+            : declaration.spec.provider.replaceAll("_", "-");
+    const pathKey = `${prefix}/${declaration.path}`;
+    return declaration.identitySuffix ? `${pathKey}#${declaration.identitySuffix}` : pathKey;
+}
+function deliveryResourceName(declaration) {
+    if (declaration.displayName)
+        return declaration.displayName.slice(0, 256);
+    const base = posix.basename(declaration.path).replace(/\.ya?ml$/, "");
+    const label = declaration.spec.resourceKind === "pipeline"
+        ? `${declaration.spec.provider.replaceAll("_", " ")} pipeline: ${base}`
+        : declaration.spec.resourceKind === "artifact"
+            ? `container image declared by ${base}`
+            : declaration.spec.provider === "systemd"
+                ? `systemd service: ${base}`
+                : `Docker Compose deployment: ${base}`;
+    return label.slice(0, 256);
+}
 function repositoryKey(identity) {
     const safe = (key, locator) => {
         if (key.length > 1900 || /[\u0000-\u001f\u007f]/.test(key) || !isCredentialFreeText(key)) {
@@ -376,6 +1449,8 @@ export function discoverRepositoryLandscape(root, ref = "HEAD") {
     const patterns = workspacePatterns(rootManifest?.value.workspaces, issues);
     const manifests = parsed.filter((manifest) => isWorkspaceManifest(manifest.path, patterns));
     const declarations = repositoryDeclarations(root, revision, rootManifest);
+    const discoveredMcp = mcpDeclarations(root, revision, issues);
+    const discoveredDelivery = deliveryDeclarations(root, revision, issues);
     const identities = [...new Set(declarations.map((declaration) => declaration.identity))].sort(compareCodeUnits);
     let selected = null;
     if (identities.length > 1) {
@@ -420,6 +1495,136 @@ export function discoverRepositoryLandscape(root, ref = "HEAD") {
         });
         resources.push(candidate(repositoryRecord, repositoryEvidence));
     }
+    const mcpByKey = new Map();
+    for (const declaration of discoveredMcp) {
+        const group = mcpByKey.get(declaration.key) ?? [];
+        group.push(declaration);
+        mcpByKey.set(declaration.key, group);
+    }
+    for (const key of [...mcpByKey.keys()].sort(compareCodeUnits)) {
+        const group = mcpByKey.get(key);
+        const descriptorHashes = [...new Set(group.map((item) => item.descriptorHash))].sort(compareCodeUnits);
+        if (descriptorHashes.length > 1) {
+            const first = group[0];
+            issues.push({
+                code: "mcp_declaration_conflict",
+                sourcePath: first.evidence.sourcePath,
+                sourceField: first.evidence.sourceField,
+                detail: `MCP server ${first.name} has conflicting committed declarations; identity remains unresolved`,
+            });
+            continue;
+        }
+        const first = group[0];
+        const evidence = group.map((item) => item.evidence);
+        const declarationPaths = [...new Set(evidence.map((item) => item.sourcePath))].sort(compareCodeUnits);
+        const mcpRecord = ResourceSchema.parse({
+            schema: "hunch.resource/1",
+            id: resourceId("mcp_server", `declared/${key}`),
+            kind: "mcp_server",
+            name: first.name,
+            scope: repositoryRecord ? [repositoryRecord.id] : [],
+            locator: first.locator,
+            lifecycle: "active",
+            provenance: {
+                source: "extracted:mcp-declaration",
+                confidence: 0.8,
+                evidence: evidence.map(provenanceEvidence),
+            },
+            currentness: resourceCurrentness(revision, evidence.map((item) => item.sourceContentHash)),
+            metadata: {
+                discovery_authority: "candidate",
+                transport: first.transport,
+                declaration_paths: declarationPaths,
+            },
+            created_at: timestamp,
+            updated_at: timestamp,
+        });
+        resources.push(candidate(mcpRecord, evidence));
+        if (!repositoryRecord)
+            continue;
+        for (const relationshipType of ["depends_on", "provides"]) {
+            const relationshipDeclarations = group.filter((item) => item.relationship === relationshipType);
+            if (!relationshipDeclarations.length)
+                continue;
+            const relationshipEvidence = relationshipDeclarations.map((item) => item.evidence);
+            const relationshipPaths = [...new Set(relationshipEvidence.map((item) => item.sourcePath))].sort(compareCodeUnits);
+            const relationship = EdgeSchema.parse({
+                schema: "hunch.resource-relationship/1",
+                id: resourceRelationshipId(repositoryRecord.id, mcpRecord.id, relationshipType),
+                from: repositoryRecord.id,
+                to: mcpRecord.id,
+                type: relationshipType,
+                reason: relationshipType === "provides"
+                    ? `committed registry configuration declares repository-provided MCP server ${first.name}`
+                    : `committed project configuration declares MCP server dependency ${first.name}`,
+                strength: 0.8,
+                provenance: {
+                    source: "extracted:mcp-declaration",
+                    confidence: 0.8,
+                    evidence: relationshipEvidence.map(provenanceEvidence),
+                },
+                currentness: resourceCurrentness(revision, relationshipEvidence.map((item) => item.sourceContentHash)),
+                environment: null,
+                metadata: { discovery_authority: "candidate", declaration_paths: relationshipPaths },
+            });
+            relationships.push(candidate(relationship, relationshipEvidence));
+        }
+    }
+    for (const declaration of discoveredDelivery) {
+        const evidence = {
+            kind: declaration.spec.evidenceKind,
+            sourcePath: declaration.path,
+            sourceField: declaration.sourceField ?? declaration.spec.sourceField,
+            sourceRevision: revision,
+            sourceContentHash: declaration.contentHash,
+        };
+        const deliveryRecord = ResourceSchema.parse({
+            schema: "hunch.resource/1",
+            id: resourceId(declaration.spec.resourceKind, deliveryResourceKey(declaration)),
+            kind: declaration.spec.resourceKind,
+            name: deliveryResourceName(declaration),
+            scope: repositoryRecord ? [repositoryRecord.id] : [],
+            locator: `${declaration.path}${declaration.locatorSuffix ?? ""}`,
+            lifecycle: "active",
+            contract_version: declaration.contractVersion,
+            provenance: {
+                source: `extracted:${declaration.spec.evidenceKind}`,
+                confidence: 0.8,
+                evidence: [provenanceEvidence(evidence)],
+            },
+            currentness: resourceCurrentness(revision, [declaration.contentHash]),
+            metadata: {
+                discovery_authority: "candidate",
+                declaration_path: declaration.path,
+                declaration_format: declaration.spec.format,
+                provider: declaration.spec.provider,
+                ...declaration.metadata,
+            },
+            created_at: timestamp,
+            updated_at: timestamp,
+        });
+        resources.push(candidate(deliveryRecord, [evidence]));
+        if (!repositoryRecord)
+            continue;
+        const relationship = EdgeSchema.parse({
+            schema: "hunch.resource-relationship/1",
+            id: resourceRelationshipId(repositoryRecord.id, deliveryRecord.id, declaration.spec.relationship),
+            from: repositoryRecord.id,
+            to: deliveryRecord.id,
+            type: declaration.spec.relationship,
+            reason: `${declaration.path} declares ${declaration.spec.provider} ${declaration.spec.resourceKind}`,
+            strength: 0.8,
+            provenance: {
+                source: `extracted:${declaration.spec.evidenceKind}`,
+                confidence: 0.8,
+                evidence: [provenanceEvidence(evidence)],
+            },
+            currentness: resourceCurrentness(revision, [declaration.contentHash]),
+            environment: null,
+            metadata: { discovery_authority: "candidate", declaration_path: declaration.path },
+        });
+        relationships.push(candidate(relationship, [evidence]));
+    }
     for (const manifest of manifests) {
         const rawName = typeof manifest.value.name === "string" ? manifest.value.name.trim() : "";
         if (!rawName) {