@davesheffer/hunch 1.19.0 → 1.20.0-rc.2

package/dist/extractors/landscapeDiscovery.js

@@ -7,15 +7,30 @@ import { resourceId, resourceRelationshipId } from "../core/ids.js";
 import { parseJsonc } from "../core/jsonc.js";
 import { parseSource } from "./parse.js";
 import { EdgeSchema, ResourceSchema, isCredentialFreeText, } from "../core/types.js";
-import { canonicalRemoteRepositoryIdentity, foreignRepoEnv, gitNullDevice, isGitRepo, } from "./git.js";
+import { canonicalRemoteRepositoryIdentity, foreignRepoEnv, gitNullDevice, } from "./git.js";
 export const LANDSCAPE_DISCOVERY_SCHEMA_VERSION = "hunch.landscape-discovery/1";
 export const LANDSCAPE_CANDIDATE_SCHEMA_VERSION = "hunch.landscape-candidate/1";
 const MAX_MANIFEST_BYTES = 1024 * 1024;
 const MAX_MANIFESTS = 128;
+const MAX_WORKSPACE_DEPENDENCIES = 512;
+const MAX_SUBMODULE_DECLARATION_BYTES = 256 * 1024;
+const MAX_SUBMODULE_DECLARATIONS = 32;
 const MAX_MCP_CONFIG_BYTES = 256 * 1024;
 const MAX_MCP_DECLARATIONS = 128;
 const MAX_DELIVERY_DECLARATION_BYTES = 256 * 1024;
 const MAX_DELIVERY_DECLARATIONS = 128;
+const MAX_API_DECLARATION_BYTES = 1024 * 1024;
+const MAX_API_DECLARATIONS = 128;
+const MAX_MIGRATION_DECLARATION_BYTES = 1024 * 1024;
+const MAX_MIGRATION_DECLARATIONS = 128;
+const MAX_OWNERSHIP_DECLARATION_BYTES = 256 * 1024;
+const MAX_OWNERSHIP_TEAMS = 32;
+const MAX_OPERATIONS_DECLARATION_BYTES = 1024 * 1024;
+const MAX_OPERATIONS_DECLARATIONS = 128;
+const MAX_DASHBOARD_DECLARATION_BYTES = 1024 * 1024;
+const MAX_DASHBOARD_DECLARATIONS = 128;
+const MAX_SLO_DECLARATION_BYTES = 1024 * 1024;
+const MAX_SLO_DECLARATIONS = 128;
 const ORDINARY_BLOB_MODES = new Set(["100644", "100755"]);
 const UTF8_DECODER = new TextDecoder("utf-8", { fatal: true });
 const MCP_CONFIG_SPECS = [
@@ -46,6 +61,16 @@ function gitBuffer(root, args, maxBuffer = 8 * 1024 * 1024) {
         timeout: 15_000,
     });
 }
+function gitBufferInput(root, args, input, maxBuffer, timeout = 15_000) {
+    return execFileSync("git", ["-C", root, ...args], {
+        encoding: "buffer",
+        env: gitEnv(),
+        input: Buffer.from(input, "ascii"),
+        maxBuffer,
+        stdio: ["pipe", "pipe", "ignore"],
+        timeout,
+    });
+}
 function gitText(root, args, maxBuffer = 8 * 1024 * 1024) {
     return gitBuffer(root, args, maxBuffer).toString("utf8").trim();
 }
@@ -61,20 +86,30 @@ function canonical(value) {
         .sort(([left], [right]) => compareCodeUnits(left, right))
         .map(([key, child]) => [key, canonical(child)]));
 }
-function contentHash(value) {
+/** Canonical content identity shared by discovery and its review/adoption seam. */
+export function landscapeContentHash(value) {
     return sha256Bytes(JSON.stringify(canonical(value)));
 }
-function exactRevision(root, ref) {
-    const revision = gitText(root, ["rev-parse", "--verify", `${ref}^{commit}`]).toLowerCase();
+const contentHash = landscapeContentHash;
+function exactCommitSnapshot(root, ref) {
+    let raw;
+    try {
+        // One immutable commit read proves repository availability and binds both
+        // identity and time. These were previously three separate Git processes
+        // (`isGitRepo`, `rev-parse`, `show`) for every discovery.
+        raw = gitBuffer(root, ["show", "-s", "--format=%H%x00%cI", "--end-of-options", `${ref}^{commit}`], 1024 * 1024);
+    }
+    catch {
+        throw new Error("landscape discovery requires a Git repository and an exact Git commit");
+    }
+    const separator = raw.indexOf(0);
+    const revision = separator < 0 ? "" : raw.subarray(0, separator).toString("ascii").trim().toLowerCase();
+    const timestamp = separator < 0 ? "" : raw.subarray(separator + 1).toString("utf8").trim();
     if (!/^[0-9a-f]{40,64}$/.test(revision))
         throw new Error("landscape discovery requires an exact Git commit");
-    return revision;
-}
-function revisionTime(root, revision) {
-    const value = gitText(root, ["show", "-s", "--format=%cI", revision], 1024 * 1024);
-    if (!Number.isFinite(Date.parse(value)))
+    if (!Number.isFinite(Date.parse(timestamp)))
         throw new Error("landscape discovery commit timestamp is invalid");
-    return value;
+    return { revision, timestamp };
 }
 function nulRecords(bytes) {
     const records = [];
@@ -88,46 +123,128 @@ function nulRecords(bytes) {
         records.push(bytes.subarray(start));
     return records;
 }
-function manifestBlobs(root, revision) {
-    const raw = gitBuffer(root, ["ls-tree", "--full-tree", "-r", "-z", revision], 64 * 1024 * 1024);
-    const manifests = [];
+/** Parse the exact commit tree once. Every discovery family classifies this
+ * immutable snapshot, avoiding repeated Git walks and any chance of the source
+ * families observing different path sets. Invalid UTF-8 remains available as
+ * raw bytes so a relevant unsafe declaration can still fail closed. */
+function exactTreeSnapshot(root, revision) {
+    const raw = gitBuffer(root, ["ls-tree", "--full-tree", "-r", "-t", "-l", "-z", revision], 64 * 1024 * 1024);
+    const entries = [];
     for (const record of nulRecords(raw)) {
         const tab = record.indexOf(0x09);
         if (tab < 0)
             continue;
-        const head = record.subarray(0, tab).toString("ascii").match(/^([0-7]{6}) (blob|tree|commit) ([0-9a-f]{40,64})$/i);
+        const head = record.subarray(0, tab).toString("ascii").match(/^([0-7]{6}) (blob|tree|commit) ([0-9a-f]{40,64}) +(-|[0-9]+)$/i);
         if (!head)
             continue;
+        const objectSize = head[4] === "-" ? null : Number(head[4]);
+        if (objectSize !== null && (!Number.isSafeInteger(objectSize) || objectSize < 0))
+            continue;
         const pathBytes = record.subarray(tab + 1);
-        let path;
+        let path = null;
         try {
             path = UTF8_DECODER.decode(pathBytes);
         }
         catch {
+            // Retain the raw path identity for source-specific unsafe-path handling.
+        }
+        entries.push({
+            mode: head[1],
+            kind: head[2].toLowerCase(),
+            oid: head[3].toLowerCase(),
+            objectSize,
+            pathBytes,
+            path,
+        });
+    }
+    return entries;
+}
+function treeEntryMode(entry) {
+    return entry.kind === "blob" ? entry.mode : `${entry.kind}:${entry.mode}`;
+}
+/** Request only bodies whose exact-tree size is inside the source-family
+ * bound. The entire response is itself bounded by selected-count × per-file
+ * limit, preserving the existing memory ceiling without another Git process. */
+function hydrateDeclarationBlobs(root, blobs, maxBytes) {
+    const result = blobs.slice();
+    const eligible = blobs.map((blob, index) => ({ blob, index }))
+        .filter(({ blob }) => blob.mode !== "unsafe-path" && ORDINARY_BLOB_MODES.has(blob.mode));
+    if (!eligible.length)
+        return result;
+    const accepted = [];
+    for (const candidate of eligible) {
+        const size = candidate.blob.objectSize;
+        if (size === null)
+            continue;
+        if (size > maxBytes) {
+            result[candidate.index] = { ...candidate.blob, contentHash: "oversized" };
+            continue;
+        }
+        accepted.push({ ...candidate, size });
+    }
+    if (!accepted.length)
+        return result;
+    const contentInput = `${accepted.map(({ blob }) => blob.oid).join("\n")}\n`;
+    const contentLimit = accepted.reduce((total, item) => total + item.size + 256, 1024);
+    const raw = gitBufferInput(root, ["cat-file", "--batch"], contentInput, contentLimit, 60_000);
+    const hydrated = [];
+    let offset = 0;
+    for (const candidate of accepted) {
+        const newline = raw.indexOf(0x0a, offset);
+        if (newline < 0)
+            return result;
+        const header = raw.subarray(offset, newline).toString("ascii")
+            .match(/^([0-9a-f]{40,64}) blob ([0-9]+)$/i);
+        const size = header ? Number(header[2]) : Number.NaN;
+        const start = newline + 1;
+        const end = start + size;
+        if (!header || header[1].toLowerCase() !== candidate.blob.oid
+            || size !== candidate.size || end >= raw.length || raw[end] !== 0x0a)
+            return result;
+        hydrated.push({ index: candidate.index, bytes: Buffer.from(raw.subarray(start, end)) });
+        offset = end + 1;
+    }
+    if (offset !== raw.length)
+        return result;
+    for (const item of hydrated) {
+        const blob = result[item.index];
+        result[item.index] = { ...blob, bytes: item.bytes, contentHash: sha256Bytes(item.bytes) };
+    }
+    return result;
+}
+function manifestBlobs(tree) {
+    const manifests = [];
+    for (const entry of tree) {
+        if (entry.kind === "tree")
+            continue;
+        const { pathBytes } = entry;
+        if (entry.path === null) {
             const suffix = Buffer.from("package.json", "utf8");
             if (pathBytes.length >= suffix.length && pathBytes.subarray(pathBytes.length - suffix.length).equals(suffix)) {
                 manifests.push({
                     path: `<non-utf8-package-manifest:sha256:${createHash("sha256").update(pathBytes).digest("hex")}>`,
                     mode: "unsafe-path",
-                    oid: head[3].toLowerCase(),
+                    oid: entry.oid,
+                    objectSize: entry.objectSize,
                     bytes: null,
                     contentHash: null,
                 });
             }
             continue;
         }
+        const path = entry.path;
         if (path !== "package.json" && !path.endsWith("/package.json"))
             continue;
-        const mode = head[1];
-        const oid = head[3].toLowerCase();
+        const mode = entry.mode;
+        const oid = entry.oid;
         const segments = path.split("/");
         if (path.length > 1024 || path.startsWith("/") || path.includes("\\")
             || segments.some((segment) => !segment || segment === "." || segment === "..")
             || /[\u0000-\u001f\u007f]/.test(path) || !isCredentialFreeText(path)) {
-            manifests.push({ path: "<unsafe-package-manifest>", mode: "unsafe-path", oid, bytes: null, contentHash: null });
+            manifests.push({ path: "<unsafe-package-manifest>", mode: "unsafe-path", oid, objectSize: entry.objectSize, bytes: null, contentHash: null });
             continue;
         }
-        manifests.push({ path, mode: head[2] === "blob" ? mode : `${head[2]}:${mode}`, oid, bytes: null, contentHash: null });
+        manifests.push({ path, mode: treeEntryMode(entry), oid, objectSize: entry.objectSize, bytes: null, contentHash: null });
     }
     return manifests.sort((left, right) => compareCodeUnits(left.path, right.path));
 }
@@ -137,16 +254,7 @@ function boundedManifestBlobs(root, manifests) {
         ...(rootManifest ? [rootManifest] : []),
         ...manifests.filter((manifest) => manifest !== rootManifest).slice(0, MAX_MANIFESTS - (rootManifest ? 1 : 0)),
     ];
-    return selected.map((manifest) => {
-        if (manifest.mode === "unsafe-path" || !ORDINARY_BLOB_MODES.has(manifest.mode))
-            return manifest;
-        const size = Number(gitText(root, ["cat-file", "-s", manifest.oid], 1024 * 1024));
-        if (!Number.isSafeInteger(size) || size < 0 || size > MAX_MANIFEST_BYTES) {
-            return { ...manifest, contentHash: size > MAX_MANIFEST_BYTES ? "oversized" : null };
-        }
-        const bytes = gitBuffer(root, ["cat-file", "blob", manifest.oid], MAX_MANIFEST_BYTES + 1);
-        return { ...manifest, bytes, contentHash: sha256Bytes(bytes) };
-    });
+    return hydrateDeclarationBlobs(root, selected, MAX_MANIFEST_BYTES);
 }
 function workspacePatterns(value, issues) {
     const raw = Array.isArray(value)
@@ -235,40 +343,17 @@ function parseManifests(blobs, issues) {
     }
     return parsed;
 }
-function mcpConfigBlobs(root, revision) {
-    const raw = gitBuffer(root, [
-        "ls-tree", "--full-tree", "-z", revision, "--", ...MCP_CONFIG_SPECS.map((spec) => spec.path),
-    ], 4 * 1024 * 1024);
+function mcpConfigBlobs(root, tree) {
     const blobs = [];
-    for (const record of nulRecords(raw)) {
-        const tab = record.indexOf(0x09);
-        if (tab < 0)
-            continue;
-        const head = record.subarray(0, tab).toString("ascii").match(/^([0-7]{6}) (blob|tree|commit) ([0-9a-f]{40,64})$/i);
-        if (!head)
+    for (const entry of tree) {
+        const path = entry.path;
+        if (path === null)
             continue;
-        let path;
-        try {
-            path = UTF8_DECODER.decode(record.subarray(tab + 1));
-        }
-        catch {
-            continue;
-        }
         if (!MCP_CONFIG_BY_PATH.has(path))
             continue;
-        const mode = head[2] === "blob" ? head[1] : `${head[2]}:${head[1]}`;
-        blobs.push({ path, mode, oid: head[3].toLowerCase(), bytes: null, contentHash: null });
+        blobs.push({ path, mode: treeEntryMode(entry), oid: entry.oid, objectSize: entry.objectSize, bytes: null, contentHash: null });
     }
-    return blobs.sort((left, right) => compareCodeUnits(left.path, right.path)).map((blob) => {
-        if (!ORDINARY_BLOB_MODES.has(blob.mode))
-            return blob;
-        const size = Number(gitText(root, ["cat-file", "-s", blob.oid], 1024 * 1024));
-        if (!Number.isSafeInteger(size) || size < 0 || size > MAX_MCP_CONFIG_BYTES) {
-            return { ...blob, contentHash: size > MAX_MCP_CONFIG_BYTES ? "oversized" : null };
-        }
-        const bytes = gitBuffer(root, ["cat-file", "blob", blob.oid], MAX_MCP_CONFIG_BYTES + 1);
-        return { ...blob, bytes, contentHash: sha256Bytes(bytes) };
-    });
+    return hydrateDeclarationBlobs(root, blobs.sort((left, right) => compareCodeUnits(left.path, right.path)), MAX_MCP_CONFIG_BYTES);
 }
 function validMcpServerName(value) {
     const name = value.trim();
@@ -697,10 +782,10 @@ function mcpDeclaration(rawName, rawEntry, blob, rootKey, revision, issues) {
         },
     };
 }
-function mcpDeclarations(root, revision, issues) {
+function mcpDeclarations(root, revision, tree, issues) {
     const declarations = [];
     let considered = 0;
-    for (const blob of mcpConfigBlobs(root, revision)) {
+    for (const blob of mcpConfigBlobs(root, tree)) {
         if (!blob.bytes) {
             issues.push({
                 code: blob.contentHash === "oversized" ? "mcp_config_oversized" : "mcp_config_mode",
@@ -851,6 +936,16 @@ function deliveryDeclarationSpec(path) {
             relationship: "deploys",
         };
     }
+    if (/(^|\/)Chart\.yaml$/.test(path)) {
+        return {
+            evidenceKind: "deployment_declaration",
+            resourceKind: "artifact",
+            provider: "helm",
+            format: "yaml",
+            sourceField: "apiVersion/name/version",
+            relationship: "contains",
+        };
+    }
     if (/(^|\/)(?:k8s|kubernetes|manifests|deploy)\/.+\.ya?ml$/.test(path)) {
         return {
             evidenceKind: "deployment_declaration",
@@ -885,238 +980,1295 @@ function safeDeclarationPath(path) {
         && segments.every((segment) => !!segment && segment !== "." && segment !== "..")
         && isCredentialFreeText(path);
 }
-function deliveryDeclarationBlobs(root, revision) {
-    const raw = gitBuffer(root, ["ls-tree", "--full-tree", "-r", "-z", revision], 64 * 1024 * 1024);
+const DEPENDENCY_TREE_SEGMENTS = new Set(["node_modules", "vendor", "third_party", "third-party"]);
+/** Dependency-owned declarations describe the vendored package, not this
+ * repository. Ignore them before per-family caps so committed dependencies
+ * cannot crowd first-party evidence out of the bounded fragment. */
+function firstPartyDeclarationPath(path) {
+    return !path.split("/").some((segment) => DEPENDENCY_TREE_SEGMENTS.has(segment.toLowerCase()));
+}
+function apiDeclarationFormat(path) {
+    const basename = posix.basename(path);
+    if (/\.proto$/i.test(basename))
+        return "protobuf";
+    const extension = basename.match(/\.(json|ya?ml)$/i);
+    if (!extension)
+        return null;
+    const stem = basename.slice(0, -extension[0].length);
+    const apiNamed = /(^|[._-])(openapi|swagger|asyncapi)(?=$|[._-])/i.test(stem);
+    const jsonSchemaNamed = extension[1].toLowerCase() === "json"
+        && /(^|[._-])schema(?=$|[._-])/i.test(stem);
+    if (!apiNamed && !jsonSchemaNamed)
+        return null;
+    return extension[1].toLowerCase() === "json" ? "json" : "yaml";
+}
+function apiDeclarationBlobs(root, tree) {
     const discovered = [];
-    for (const record of nulRecords(raw)) {
-        const tab = record.indexOf(0x09);
-        if (tab < 0)
-            continue;
-        const head = record.subarray(0, tab).toString("ascii").match(/^([0-7]{6}) (blob|tree|commit) ([0-9a-f]{40,64})$/i);
-        if (!head)
+    for (const entry of tree) {
+        if (entry.kind === "tree")
             continue;
-        const pathBytes = record.subarray(tab + 1);
-        let path;
-        try {
-            path = UTF8_DECODER.decode(pathBytes);
-        }
-        catch {
+        const { pathBytes } = entry;
+        if (entry.path === null) {
             const approximate = pathBytes.toString("latin1");
-            if (deliveryDeclarationSpec(approximate)) {
+            if (!firstPartyDeclarationPath(approximate))
+                continue;
+            if (apiDeclarationFormat(approximate)) {
                 discovered.push({
-                    path: `<unsafe-delivery-declaration:sha256:${createHash("sha256").update(pathBytes).digest("hex")}>`,
+                    path: `<unsafe-api-declaration:sha256:${createHash("sha256").update(pathBytes).digest("hex")}>`,
                     mode: "unsafe-path",
-                    oid: head[3].toLowerCase(),
+                    oid: entry.oid,
+                    objectSize: entry.objectSize,
                     bytes: null,
                     contentHash: null,
-                    spec: null,
+                    format: null,
                 });
             }
             continue;
         }
-        const spec = deliveryDeclarationSpec(path);
-        if (!spec)
+        const path = entry.path;
+        if (!firstPartyDeclarationPath(path))
+            continue;
+        const format = apiDeclarationFormat(path);
+        if (!format)
             continue;
         if (!safeDeclarationPath(path)) {
             discovered.push({
-                path: `<unsafe-delivery-declaration:sha256:${createHash("sha256").update(pathBytes).digest("hex")}>`,
+                path: `<unsafe-api-declaration:sha256:${createHash("sha256").update(pathBytes).digest("hex")}>`,
                 mode: "unsafe-path",
-                oid: head[3].toLowerCase(),
+                oid: entry.oid,
+                objectSize: entry.objectSize,
                 bytes: null,
                 contentHash: null,
-                spec: null,
+                format: null,
             });
             continue;
         }
         discovered.push({
             path,
-            mode: head[2] === "blob" ? head[1] : `${head[2]}:${head[1]}`,
-            oid: head[3].toLowerCase(),
+            mode: treeEntryMode(entry),
+            oid: entry.oid,
+            objectSize: entry.objectSize,
             bytes: null,
             contentHash: null,
-            spec,
+            format,
         });
     }
     discovered.sort((left, right) => compareCodeUnits(left.path, right.path));
     const total = discovered.length;
-    const blobs = discovered.slice(0, MAX_DELIVERY_DECLARATIONS).map((blob) => {
-        if (blob.mode === "unsafe-path" || !ORDINARY_BLOB_MODES.has(blob.mode))
-            return blob;
-        const size = Number(gitText(root, ["cat-file", "-s", blob.oid], 1024 * 1024));
-        if (!Number.isSafeInteger(size) || size < 0 || size > MAX_DELIVERY_DECLARATION_BYTES) {
-            return { ...blob, contentHash: size > MAX_DELIVERY_DECLARATION_BYTES ? "oversized" : null };
-        }
-        const bytes = gitBuffer(root, ["cat-file", "blob", blob.oid], MAX_DELIVERY_DECLARATION_BYTES + 1);
-        return { ...blob, bytes, contentHash: sha256Bytes(bytes) };
-    });
+    const blobs = hydrateDeclarationBlobs(root, discovered.slice(0, MAX_API_DECLARATIONS), MAX_API_DECLARATION_BYTES);
     return { blobs, total };
 }
-const KUBERNETES_WORKLOAD_KINDS = new Set(["Deployment", "StatefulSet", "DaemonSet", "Job", "CronJob", "Pod"]);
-function stripYamlScalarComment(input) {
-    let quote = null;
-    let escaped = false;
-    for (let index = 0; index < input.length; index += 1) {
-        const char = input[index];
-        if (quote === "\"") {
-            if (escaped)
-                escaped = false;
-            else if (char === "\\")
-                escaped = true;
-            else if (char === quote)
-                quote = null;
+function validApiVersion(dialect, value) {
+    if (typeof value !== "string")
+        return null;
+    const version = value.trim();
+    if (version.length === 0 || version.length > 128 || !isCredentialFreeText(version))
+        return null;
+    if (dialect === "protobuf")
+        return version === "proto2" || version === "proto3" ? version : null;
+    if (dialect === "jsonschema") {
+        const dialects = {
+            "https://json-schema.org/draft/2020-12/schema": "2020-12",
+            "https://json-schema.org/draft/2019-09/schema": "2019-09",
+            "http://json-schema.org/draft-07/schema#": "draft-07",
+        };
+        return dialects[version] ?? null;
+    }
+    if (dialect === "swagger")
+        return version === "2.0" ? version : null;
+    if (dialect === "asyncapi") {
+        return /^(?:2|3)\.[0-9]+\.[0-9]+(?:-[A-Za-z0-9][A-Za-z0-9.-]{0,63})?$/.test(version) ? version : null;
+    }
+    return /^3\.[0-9]+(?:\.[0-9]+)?(?:-[A-Za-z0-9][A-Za-z0-9.-]{0,63})?$/.test(version) ? version : null;
+}
+function yamlApiIdentity(source) {
+    const values = new Map();
+    let duplicate = false;
+    for (const rawLine of source.split(/\r?\n/)) {
+        if (!rawLine.trim() || rawLine.trimStart().startsWith("#"))
             continue;
-        }
-        if (quote === "'") {
-            if (char === "'" && input[index + 1] === "'")
-                index += 1;
-            else if (char === "'")
-                quote = null;
+        if (rawLine.match(/^ */)[0].length !== 0)
             continue;
-        }
-        if (char === "\"" || char === "'")
-            quote = char;
-        else if (char === "#" && (index === 0 || /\s/.test(input[index - 1])))
-            return input.slice(0, index);
+        const mapping = rawLine.match(/^(openapi|swagger|asyncapi)[ \t]*:(.*)$/);
+        if (!mapping)
+            continue;
+        const dialect = mapping[1];
+        if (values.has(dialect))
+            duplicate = true;
+        values.set(dialect, boundedYamlScalar(mapping[2]));
     }
-    return input;
-}
-function boundedYamlScalar(input) {
-    const value = stripYamlScalarComment(input).trim();
-    if (!value || value.length > 512)
+    if (duplicate || values.size !== 1)
         return null;
-    let parsed;
-    if (value.startsWith("\"")) {
-        if (!value.endsWith("\""))
-            return null;
-        try {
-            const decoded = JSON.parse(value);
-            if (typeof decoded !== "string")
-                return null;
-            parsed = decoded;
+    const [dialect, rawVersion] = [...values.entries()][0];
+    const version = validApiVersion(dialect, rawVersion);
+    return version ? { dialect, version } : null;
+}
+function jsonTopLevelApiKeys(source) {
+    const keys = [];
+    let depth = 0;
+    for (let index = 0; index < source.length; index += 1) {
+        const char = source[index];
+        if (char === "{" || char === "[") {
+            depth += 1;
+            continue;
         }
-        catch {
-            return null;
+        if (char === "}" || char === "]") {
+            depth -= 1;
+            continue;
         }
-    }
-    else if (value.startsWith("'")) {
-        if (!value.endsWith("'"))
-            return null;
-        const inner = value.slice(1, -1);
-        let decoded = "";
-        for (let index = 0; index < inner.length; index += 1) {
-            const char = inner[index];
-            if (char !== "'") {
-                decoded += char;
+        if (char !== '"')
+            continue;
+        const start = index;
+        for (index += 1; index < source.length; index += 1) {
+            if (source[index] === "\\") {
+                index += 1;
                 continue;
             }
-            if (inner[index + 1] !== "'")
-                return null;
-            decoded += "'";
-            index += 1;
+            if (source[index] === '"')
+                break;
         }
-        parsed = decoded;
-    }
-    else {
-        if (!/^[A-Za-z0-9][A-Za-z0-9._/@-]{0,255}$/.test(value))
-            return null;
-        parsed = value;
+        if (depth !== 1 || index >= source.length)
+            continue;
+        let cursor = index + 1;
+        while (cursor < source.length && /\s/.test(source[cursor]))
+            cursor += 1;
+        if (source[cursor] !== ":")
+            continue;
+        const key = JSON.parse(source.slice(start, index + 1));
+        if (key === "openapi" || key === "swagger" || key === "asyncapi" || key === "$schema")
+            keys.push(key);
     }
-    return parsed.length > 0 && parsed.length <= 256
-        && !/[\u0000-\u001f\u007f]/.test(parsed)
-        && isCredentialFreeText(parsed)
-        ? parsed
-        : null;
+    return keys;
 }
-function kubernetesYamlDocuments(source) {
-    return source
-        .split(/^(?:---|\.\.\.)[ \t]*(?:#.*)?\r?$/m)
-        .map((document, index) => ({ index, source: document }))
-        .filter((document) => document.source.split(/\r?\n/)
-        .some((line) => !!line.trim() && !line.trimStart().startsWith("#")));
+function jsonApiIdentity(source) {
+    let value;
+    try {
+        value = JSON.parse(source);
+    }
+    catch {
+        return null;
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const record = value;
+    const dialects = jsonTopLevelApiKeys(source);
+    if (dialects.length !== 1 || !Object.hasOwn(record, dialects[0]))
+        return null;
+    const identityField = dialects[0];
+    const dialect = identityField === "$schema" ? "jsonschema" : identityField;
+    const version = validApiVersion(dialect, record[identityField]);
+    return version ? { dialect, version } : null;
 }
-function kubernetesDocumentHeader(source) {
-    const header = {
-        apiVersion: undefined,
-        kind: undefined,
-        name: undefined,
-        namespace: undefined,
-        duplicate: false,
-    };
-    let metadataIndent = null;
-    let metadataChildIndent = null;
-    const assign = (field, raw) => {
-        if (header[field] !== undefined) {
-            header.duplicate = true;
+function protobufApiIdentity(source) {
+    let state = "normal";
+    let depth = 0;
+    let statement = "";
+    let firstStatement = null;
+    let syntaxCount = 0;
+    let version = null;
+    const acceptStatement = () => {
+        const normalized = statement.trim();
+        statement = "";
+        if (!normalized)
             return;
-        }
-        header[field] = boundedYamlScalar(raw);
+        const complete = `${normalized};`;
+        firstStatement ??= complete;
+        const syntax = complete.match(/^syntax\s*=\s*"(proto2|proto3)"\s*;$/);
+        if (/^syntax\b/.test(complete))
+            syntaxCount += 1;
+        if (syntax)
+            version = syntax[1];
     };
-    for (const rawLine of source.split(/\r?\n/)) {
-        if (!rawLine.trim() || rawLine.trimStart().startsWith("#"))
+    for (let index = 0; index < source.length; index += 1) {
+        const char = source[index];
+        const next = source[index + 1];
+        if (state === "line-comment") {
+            if (char === "\n")
+                state = "normal";
             continue;
-        const indentation = rawLine.match(/^ */)[0].length;
-        const mapping = rawLine.slice(indentation).match(/^([A-Za-z][A-Za-z0-9_-]*)[ \t]*:(.*)$/);
-        if (indentation === 0) {
-            metadataIndent = null;
-            metadataChildIndent = null;
-            if (!mapping)
-                continue;
-            const [_, key, raw] = mapping;
-            if (key === "apiVersion" || key === "kind")
-                assign(key, raw);
-            else if (key === "metadata" && !stripYamlScalarComment(raw).trim())
-                metadataIndent = 0;
+        }
+        if (state === "block-comment") {
+            if (char === "*" && next === "/") {
+                state = "normal";
+                index += 1;
+            }
             continue;
         }
-        if (metadataIndent === null || indentation <= metadataIndent || !mapping)
+        if (state === "string") {
+            if (depth === 0)
+                statement += char;
+            if (char === "\\") {
+                if (depth === 0 && next !== undefined)
+                    statement += next;
+                index += 1;
+            }
+            else if (char === '"') {
+                state = "normal";
+            }
             continue;
-        if (metadataChildIndent === null)
-            metadataChildIndent = indentation;
-        if (indentation !== metadataChildIndent)
+        }
+        if (char === "/" && next === "/") {
+            if (depth === 0)
+                statement += " ";
+            state = "line-comment";
+            index += 1;
             continue;
-        const [_, key, raw] = mapping;
-        if (key === "name" || key === "namespace")
-            assign(key, raw);
-    }
-    return header;
-}
-function validKubernetesApiVersion(value) {
-    return value.length <= 128 && /^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?\/v[0-9][a-z0-9]*$|^v[0-9][a-z0-9]*$/i.test(value);
-}
-function validKubernetesName(value) {
-    return value.length <= 253 && /^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/.test(value);
-}
-function validKubernetesNamespace(value) {
-    return value.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
-}
-function kubernetesDeclarations(blob, source, issues) {
-    const candidates = [];
-    for (const document of kubernetesYamlDocuments(source)) {
-        const header = kubernetesDocumentHeader(document.source);
-        if (header.duplicate) {
-            issues.push({
-                code: "delivery_declaration_invalid",
-                sourcePath: blob.path,
-                sourceField: `documents[${document.index}]`,
-                detail: `${blob.path} document ${document.index} repeats a Kubernetes identity field`,
-            });
+        }
+        if (char === "/" && next === "*") {
+            if (depth === 0)
+                statement += " ";
+            state = "block-comment";
+            index += 1;
             continue;
         }
-        if (typeof header.kind !== "string" || !KUBERNETES_WORKLOAD_KINDS.has(header.kind))
+        if (char === '"') {
+            if (depth === 0)
+                statement += char;
+            state = "string";
             continue;
-        const namespace = header.namespace === undefined ? "default" : header.namespace;
-        if (typeof header.apiVersion !== "string" || !validKubernetesApiVersion(header.apiVersion)
-            || typeof header.name !== "string" || !validKubernetesName(header.name)
-            || typeof namespace !== "string" || !validKubernetesNamespace(namespace)) {
-            issues.push({
-                code: "delivery_declaration_invalid",
-                sourcePath: blob.path,
-                sourceField: `documents[${document.index}].metadata.name`,
-                detail: `${blob.path} document ${document.index} has an incomplete or unsafe Kubernetes workload identity`,
-            });
+        }
+        if (char === "{") {
+            if (depth === 0) {
+                if (statement.trim())
+                    firstStatement ??= `${statement.trim()} {`;
+                statement = "";
+            }
+            depth += 1;
             continue;
         }
-        const identity = `${header.apiVersion.toLowerCase()}/${header.kind.toLowerCase()}/${namespace}/${header.name}`;
+        if (char === "}") {
+            depth -= 1;
+            if (depth < 0)
+                return null;
+            continue;
+        }
+        if (depth !== 0)
+            continue;
+        if (char === ";") {
+            acceptStatement();
+            continue;
+        }
+        statement += char;
+    }
+    if (state === "block-comment" || state === "string" || depth !== 0 || syntaxCount !== 1 || !version)
+        return null;
+    const expected = `syntax = "${version}";`;
+    if (!firstStatement || firstStatement.replace(/\s+/g, " ").replace(/\s*=\s*/, " = ") !== expected)
+        return null;
+    return { dialect: "protobuf", version };
+}
+function apiDeclarations(root, revision, tree, issues) {
+    const discovered = apiDeclarationBlobs(root, tree);
+    if (discovered.total > MAX_API_DECLARATIONS) {
+        issues.push({
+            code: "api_declaration_limit",
+            sourcePath: ".",
+            sourceField: "api",
+            detail: `bounded discovery accepts at most ${MAX_API_DECLARATIONS} API declarations`,
+        });
+    }
+    const declarations = [];
+    for (const blob of discovered.blobs) {
+        if (!blob.bytes || !blob.format) {
+            const code = blob.contentHash === "oversized"
+                ? "api_declaration_oversized"
+                : blob.mode === "unsafe-path"
+                    ? "api_declaration_path"
+                    : "api_declaration_mode";
+            issues.push({
+                code,
+                sourcePath: blob.path,
+                sourceField: "",
+                detail: blob.contentHash === "oversized"
+                    ? `${blob.path} exceeds the ${MAX_API_DECLARATION_BYTES}-byte API declaration limit`
+                    : blob.mode === "unsafe-path"
+                        ? "an API declaration uses an unsafe path"
+                        : `${blob.path} uses unsupported Git mode ${blob.mode}`,
+            });
+            continue;
+        }
+        let source;
+        try {
+            source = UTF8_DECODER.decode(blob.bytes);
+        }
+        catch {
+            issues.push({
+                code: "api_declaration_invalid",
+                sourcePath: blob.path,
+                sourceField: "",
+                detail: `${blob.path} is not valid UTF-8 API declaration data`,
+            });
+            continue;
+        }
+        if (blob.format === "yaml" && !parseSource(blob.path, source)?.parseable) {
+            issues.push({
+                code: "api_declaration_invalid",
+                sourcePath: blob.path,
+                sourceField: "",
+                detail: `${blob.path} is not structurally valid OpenAPI YAML`,
+            });
+            continue;
+        }
+        const identity = blob.format === "json"
+            ? jsonApiIdentity(source)
+            : blob.format === "yaml"
+                ? yamlApiIdentity(source)
+                : protobufApiIdentity(source);
+        if (!identity) {
+            issues.push({
+                code: "api_declaration_invalid",
+                sourcePath: blob.path,
+                sourceField: "openapi|swagger",
+                detail: `${blob.path} must declare exactly one supported OpenAPI, Swagger, AsyncAPI, protobuf or JSON Schema version`,
+            });
+            continue;
+        }
+        declarations.push({
+            path: blob.path,
+            contentHash: blob.contentHash,
+            format: blob.format,
+            ...identity,
+        });
+    }
+    return declarations;
+}
+function migrationDeclarationIdentity(path) {
+    const prisma = path.match(/(?:^|\/)prisma\/migrations\/([A-Za-z0-9][A-Za-z0-9._-]{0,127})\/migration\.sql$/);
+    if (prisma) {
+        return {
+            provider: "prisma",
+            migrationId: prisma[1],
+            migrationType: "versioned",
+            contractVersion: prisma[1],
+        };
+    }
+    const flywayVersioned = path.match(/(?:^|\/)db\/migration\/([VU])([0-9][0-9._-]{0,127})__([A-Za-z0-9][A-Za-z0-9._-]{0,127})\.sql$/);
+    if (flywayVersioned) {
+        return {
+            provider: "flyway",
+            migrationId: `${flywayVersioned[1]}${flywayVersioned[2]}`,
+            migrationType: flywayVersioned[1] === "V" ? "versioned" : "undo",
+            contractVersion: flywayVersioned[2],
+        };
+    }
+    const flywayRepeatable = path.match(/(?:^|\/)db\/migration\/(R)__([A-Za-z0-9][A-Za-z0-9._-]{0,127})\.sql$/);
+    if (flywayRepeatable) {
+        return {
+            provider: "flyway",
+            migrationId: `R__${flywayRepeatable[2]}`,
+            migrationType: "repeatable",
+            contractVersion: null,
+        };
+    }
+    const rails = path.match(/(?:^|\/)db\/migrate\/([0-9]{14})_([a-z0-9][a-z0-9_]{0,127})\.rb$/);
+    if (rails) {
+        return {
+            provider: "rails",
+            migrationId: rails[1],
+            migrationType: "versioned",
+            contractVersion: rails[1],
+        };
+    }
+    const django = path.match(/(?:^|\/)([a-z_][a-z0-9_]*)\/migrations\/([0-9]{4,8})_([a-z][a-z0-9_]{0,119})\.py$/);
+    if (django) {
+        return {
+            provider: "django",
+            migrationId: `${django[2]}_${django[3]}`,
+            migrationType: "versioned",
+            contractVersion: django[2],
+        };
+    }
+    const laravel = path.match(/(?:^|\/)database\/migrations\/([0-9]{4}_[0-9]{2}_[0-9]{2}_[0-9]{6})_([a-z][a-z0-9_]{0,127})\.php$/);
+    if (laravel) {
+        return {
+            provider: "laravel",
+            migrationId: `${laravel[1]}_${laravel[2]}`,
+            migrationType: "versioned",
+            contractVersion: laravel[1],
+        };
+    }
+    const alembic = path.match(/(?:^|\/)alembic\/versions\/([a-f0-9]{12,32})_([a-z][a-z0-9_]{0,119})\.py$/);
+    return alembic
+        ? {
+            provider: "alembic",
+            migrationId: `${alembic[1]}_${alembic[2]}`,
+            migrationType: "versioned",
+            contractVersion: alembic[1],
+        }
+        : null;
+}
+function migrationDeclarationBlobs(root, tree) {
+    const discovered = [];
+    for (const entry of tree) {
+        if (entry.kind === "tree")
+            continue;
+        const { pathBytes } = entry;
+        if (entry.path === null) {
+            const approximate = pathBytes.toString("latin1");
+            if (!firstPartyDeclarationPath(approximate))
+                continue;
+            if (migrationDeclarationIdentity(approximate)) {
+                discovered.push({
+                    path: `<unsafe-migration-declaration:sha256:${createHash("sha256").update(pathBytes).digest("hex")}>`,
+                    mode: "unsafe-path",
+                    oid: entry.oid,
+                    objectSize: entry.objectSize,
+                    bytes: null,
+                    contentHash: null,
+                    provider: null,
+                    migrationId: null,
+                    migrationType: null,
+                    contractVersion: null,
+                });
+            }
+            continue;
+        }
+        const path = entry.path;
+        if (!firstPartyDeclarationPath(path))
+            continue;
+        const identity = migrationDeclarationIdentity(path);
+        if (!identity)
+            continue;
+        if (!safeDeclarationPath(path)) {
+            discovered.push({
+                path: `<unsafe-migration-declaration:sha256:${createHash("sha256").update(pathBytes).digest("hex")}>`,
+                mode: "unsafe-path",
+                oid: entry.oid,
+                objectSize: entry.objectSize,
+                bytes: null,
+                contentHash: null,
+                provider: null,
+                migrationId: null,
+                migrationType: null,
+                contractVersion: null,
+            });
+            continue;
+        }
+        discovered.push({
+            path,
+            mode: treeEntryMode(entry),
+            oid: entry.oid,
+            objectSize: entry.objectSize,
+            bytes: null,
+            contentHash: null,
+            ...identity,
+        });
+    }
+    discovered.sort((left, right) => compareCodeUnits(left.path, right.path));
+    const total = discovered.length;
+    const blobs = hydrateDeclarationBlobs(root, discovered.slice(0, MAX_MIGRATION_DECLARATIONS), MAX_MIGRATION_DECLARATION_BYTES);
+    return { blobs, total };
+}
+function migrationDeclarations(root, revision, tree, issues) {
+    const discovered = migrationDeclarationBlobs(root, tree);
+    if (discovered.total > MAX_MIGRATION_DECLARATIONS) {
+        issues.push({
+            code: "migration_declaration_limit",
+            sourcePath: ".",
+            sourceField: "migration",
+            detail: `bounded discovery accepts at most ${MAX_MIGRATION_DECLARATIONS} migration declarations`,
+        });
+    }
+    const declarations = [];
+    for (const blob of discovered.blobs) {
+        if (!blob.bytes || !blob.provider || !blob.migrationId || !blob.migrationType) {
+            const code = blob.contentHash === "oversized"
+                ? "migration_declaration_oversized"
+                : blob.mode === "unsafe-path"
+                    ? "migration_declaration_path"
+                    : "migration_declaration_mode";
+            issues.push({
+                code,
+                sourcePath: blob.path,
+                sourceField: "path",
+                detail: blob.contentHash === "oversized"
+                    ? `${blob.path} exceeds the ${MAX_MIGRATION_DECLARATION_BYTES}-byte migration declaration limit`
+                    : blob.mode === "unsafe-path"
+                        ? "a migration declaration uses an unsafe path"
+                        : `${blob.path} uses unsupported Git mode ${blob.mode}`,
+            });
+            continue;
+        }
+        let source;
+        try {
+            source = UTF8_DECODER.decode(blob.bytes);
+        }
+        catch {
+            issues.push({
+                code: "migration_declaration_invalid",
+                sourcePath: blob.path,
+                sourceField: "path",
+                detail: `${blob.path} is not valid UTF-8 migration data`,
+            });
+            continue;
+        }
+        if (!source.replace(/^\uFEFF/, "").trim()) {
+            issues.push({
+                code: "migration_declaration_invalid",
+                sourcePath: blob.path,
+                sourceField: "path",
+                detail: `${blob.path} is an empty migration declaration`,
+            });
+            continue;
+        }
+        declarations.push({
+            path: blob.path,
+            contentHash: blob.contentHash,
+            provider: blob.provider,
+            migrationId: blob.migrationId,
+            migrationType: blob.migrationType,
+            contractVersion: blob.contractVersion,
+        });
+    }
+    return declarations;
+}
+const MIGRATION_PROVIDER_NAMES = {
+    prisma: "Prisma",
+    flyway: "Flyway",
+    rails: "Rails",
+    django: "Django",
+    laravel: "Laravel",
+    alembic: "Alembic",
+};
+function migrationProviderName(provider) {
+    return MIGRATION_PROVIDER_NAMES[provider];
+}
+const CODEOWNERS_PATHS = [".github/CODEOWNERS", "CODEOWNERS", "docs/CODEOWNERS"];
+function ownershipDeclarationBlob(root, tree) {
+    const discovered = new Map();
+    for (const entry of tree) {
+        const path = entry.path;
+        if (path === null)
+            continue;
+        if (!CODEOWNERS_PATHS.includes(path))
+            continue;
+        discovered.set(path, {
+            path,
+            mode: treeEntryMode(entry),
+            oid: entry.oid,
+            objectSize: entry.objectSize,
+            bytes: null,
+            contentHash: null,
+        });
+    }
+    const selected = CODEOWNERS_PATHS.map((path) => discovered.get(path)).find((blob) => blob !== undefined);
+    if (!selected || !ORDINARY_BLOB_MODES.has(selected.mode))
+        return selected ?? null;
+    return hydrateDeclarationBlobs(root, [selected], MAX_OWNERSHIP_DECLARATION_BYTES)[0];
+}
+function githubTeamOwner(value) {
+    const match = value.match(/^@([A-Za-z0-9](?:[A-Za-z0-9-]{0,38}))\/([A-Za-z0-9](?:[A-Za-z0-9-]{0,99}))$/);
+    if (!match)
+        return null;
+    const organization = match[1].toLowerCase();
+    const team = match[2].toLowerCase();
+    return { organization, team, handle: `@${organization}/${team}` };
+}
+function ownershipDeclaration(root, revision, tree, issues) {
+    const blob = ownershipDeclarationBlob(root, tree);
+    if (!blob)
+        return null;
+    if (!blob.bytes) {
+        const code = blob.contentHash === "oversized"
+            ? "ownership_declaration_oversized"
+            : "ownership_declaration_mode";
+        issues.push({
+            code,
+            sourcePath: blob.path,
+            sourceField: "default-owner",
+            detail: blob.contentHash === "oversized"
+                ? `${blob.path} exceeds the ${MAX_OWNERSHIP_DECLARATION_BYTES}-byte ownership declaration limit`
+                : `${blob.path} uses unsupported Git mode ${blob.mode}`,
+        });
+        return null;
+    }
+    let source;
+    try {
+        source = UTF8_DECODER.decode(blob.bytes);
+    }
+    catch {
+        issues.push({
+            code: "ownership_declaration_invalid",
+            sourcePath: blob.path,
+            sourceField: "default-owner",
+            detail: `${blob.path} is not valid UTF-8 ownership data`,
+        });
+        return null;
+    }
+    let defaultTeams = [];
+    for (const rawLine of source.replace(/^\uFEFF/, "").split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const fields = line.split(/\s+/);
+        if (fields[0] !== "*")
+            continue;
+        const teams = new Map();
+        for (const owner of fields.slice(1)) {
+            const team = githubTeamOwner(owner);
+            if (team)
+                teams.set(team.handle, team);
+        }
+        defaultTeams = [...teams.values()].sort((left, right) => compareCodeUnits(left.handle, right.handle));
+    }
+    if (defaultTeams.length > MAX_OWNERSHIP_TEAMS) {
+        issues.push({
+            code: "ownership_declaration_limit",
+            sourcePath: blob.path,
+            sourceField: "default-owner",
+            detail: `bounded discovery accepts at most ${MAX_OWNERSHIP_TEAMS} repository-wide GitHub team owners`,
+        });
+    }
+    return {
+        path: blob.path,
+        contentHash: blob.contentHash,
+        teams: defaultTeams.slice(0, MAX_OWNERSHIP_TEAMS),
+    };
+}
+/** Deliberately narrow conventions: a named runbook file is evidence that the
+ * repository contains operational guidance. Arbitrary Markdown and headings do
+ * not become architecture merely because they mention incidents or dashboards. */
+function operationsDeclarationPath(path) {
+    const basename = posix.basename(path);
+    if (/^RUNBOOK\.mdx?$/i.test(path))
+        return true;
+    if (!/(?:^|\/)runbooks?\/.+\.mdx?$/i.test(path))
+        return false;
+    return !/^(?:README|INDEX)\.mdx?$/i.test(basename);
+}
+function operationsDeclarationBlobs(root, tree) {
+    const discovered = [];
+    for (const entry of tree) {
+        if (entry.kind === "tree")
+            continue;
+        const { pathBytes } = entry;
+        if (entry.path === null) {
+            const approximate = pathBytes.toString("latin1");
+            if (!firstPartyDeclarationPath(approximate))
+                continue;
+            if (operationsDeclarationPath(approximate)) {
+                discovered.push({
+                    path: `<unsafe-operations-declaration:sha256:${createHash("sha256").update(pathBytes).digest("hex")}>`,
+                    mode: "unsafe-path",
+                    oid: entry.oid,
+                    objectSize: entry.objectSize,
+                    bytes: null,
+                    contentHash: null,
+                });
+            }
+            continue;
+        }
+        const path = entry.path;
+        if (!firstPartyDeclarationPath(path))
+            continue;
+        if (!operationsDeclarationPath(path))
+            continue;
+        if (!safeDeclarationPath(path)) {
+            discovered.push({
+                path: `<unsafe-operations-declaration:sha256:${createHash("sha256").update(pathBytes).digest("hex")}>`,
+                mode: "unsafe-path",
+                oid: entry.oid,
+                objectSize: entry.objectSize,
+                bytes: null,
+                contentHash: null,
+            });
+            continue;
+        }
+        discovered.push({
+            path,
+            mode: treeEntryMode(entry),
+            oid: entry.oid,
+            objectSize: entry.objectSize,
+            bytes: null,
+            contentHash: null,
+        });
+    }
+    discovered.sort((left, right) => compareCodeUnits(left.path, right.path));
+    const total = discovered.length;
+    const blobs = hydrateDeclarationBlobs(root, discovered.slice(0, MAX_OPERATIONS_DECLARATIONS), MAX_OPERATIONS_DECLARATION_BYTES);
+    return { blobs, total };
+}
+function operationsDeclarations(root, revision, tree, issues) {
+    const discovered = operationsDeclarationBlobs(root, tree);
+    if (discovered.total > MAX_OPERATIONS_DECLARATIONS) {
+        issues.push({
+            code: "operations_declaration_limit",
+            sourcePath: ".",
+            sourceField: "runbook",
+            detail: `bounded discovery accepts at most ${MAX_OPERATIONS_DECLARATIONS} runbook declarations`,
+        });
+    }
+    const declarations = [];
+    for (const blob of discovered.blobs) {
+        if (!blob.bytes) {
+            const code = blob.contentHash === "oversized"
+                ? "operations_declaration_oversized"
+                : blob.mode === "unsafe-path"
+                    ? "operations_declaration_path"
+                    : "operations_declaration_mode";
+            issues.push({
+                code,
+                sourcePath: blob.path,
+                sourceField: "path",
+                detail: blob.contentHash === "oversized"
+                    ? `${blob.path} exceeds the ${MAX_OPERATIONS_DECLARATION_BYTES}-byte runbook declaration limit`
+                    : blob.mode === "unsafe-path"
+                        ? "a runbook declaration uses an unsafe path"
+                        : `${blob.path} uses unsupported Git mode ${blob.mode}`,
+            });
+            continue;
+        }
+        let source;
+        try {
+            source = UTF8_DECODER.decode(blob.bytes);
+        }
+        catch {
+            issues.push({
+                code: "operations_declaration_invalid",
+                sourcePath: blob.path,
+                sourceField: "path",
+                detail: `${blob.path} is not valid UTF-8 runbook data`,
+            });
+            continue;
+        }
+        if (!source.replace(/^\uFEFF/, "").trim()) {
+            issues.push({
+                code: "operations_declaration_invalid",
+                sourcePath: blob.path,
+                sourceField: "path",
+                detail: `${blob.path} is an empty runbook declaration`,
+            });
+            continue;
+        }
+        declarations.push({ path: blob.path, contentHash: blob.contentHash });
+    }
+    return declarations;
+}
+/** An explicit dashboard directory is durable operations evidence. Dashboard
+ * titles, panels, queries, datasource names, variables and links are content,
+ * not safe identity, so only the committed path and content hash survive. */
+function dashboardDeclarationPath(path) {
+    return /(?:^|\/)dashboards\/.+\.json$/i.test(path);
+}
+function dashboardDeclarationBlobs(root, tree) {
+    const discovered = [];
+    for (const entry of tree) {
+        if (entry.kind === "tree")
+            continue;
+        const { pathBytes } = entry;
+        if (entry.path === null) {
+            const approximate = pathBytes.toString("latin1");
+            if (!firstPartyDeclarationPath(approximate))
+                continue;
+            if (dashboardDeclarationPath(approximate)) {
+                discovered.push({
+                    path: `<unsafe-dashboard-declaration:sha256:${createHash("sha256").update(pathBytes).digest("hex")}>`,
+                    mode: "unsafe-path",
+                    oid: entry.oid,
+                    objectSize: entry.objectSize,
+                    bytes: null,
+                    contentHash: null,
+                });
+            }
+            continue;
+        }
+        const path = entry.path;
+        if (!firstPartyDeclarationPath(path) || !dashboardDeclarationPath(path))
+            continue;
+        if (!safeDeclarationPath(path)) {
+            discovered.push({
+                path: `<unsafe-dashboard-declaration:sha256:${createHash("sha256").update(pathBytes).digest("hex")}>`,
+                mode: "unsafe-path",
+                oid: entry.oid,
+                objectSize: entry.objectSize,
+                bytes: null,
+                contentHash: null,
+            });
+            continue;
+        }
+        discovered.push({
+            path,
+            mode: treeEntryMode(entry),
+            oid: entry.oid,
+            objectSize: entry.objectSize,
+            bytes: null,
+            contentHash: null,
+        });
+    }
+    discovered.sort((left, right) => compareCodeUnits(left.path, right.path));
+    const total = discovered.length;
+    const blobs = hydrateDeclarationBlobs(root, discovered.slice(0, MAX_DASHBOARD_DECLARATIONS), MAX_DASHBOARD_DECLARATION_BYTES);
+    return { blobs, total };
+}
+function dashboardDeclarations(root, tree, issues) {
+    const discovered = dashboardDeclarationBlobs(root, tree);
+    if (discovered.total > MAX_DASHBOARD_DECLARATIONS) {
+        issues.push({
+            code: "dashboard_declaration_limit",
+            sourcePath: ".",
+            sourceField: "dashboard",
+            detail: `bounded discovery accepts at most ${MAX_DASHBOARD_DECLARATIONS} dashboard declarations`,
+        });
+    }
+    const declarations = [];
+    for (const blob of discovered.blobs) {
+        if (!blob.bytes) {
+            const code = blob.contentHash === "oversized"
+                ? "dashboard_declaration_oversized"
+                : blob.mode === "unsafe-path"
+                    ? "dashboard_declaration_path"
+                    : "dashboard_declaration_mode";
+            issues.push({
+                code,
+                sourcePath: blob.path,
+                sourceField: "path",
+                detail: blob.contentHash === "oversized"
+                    ? `${blob.path} exceeds the ${MAX_DASHBOARD_DECLARATION_BYTES}-byte dashboard declaration limit`
+                    : blob.mode === "unsafe-path"
+                        ? "a dashboard declaration uses an unsafe path"
+                        : `${blob.path} uses unsupported Git mode ${blob.mode}`,
+            });
+            continue;
+        }
+        try {
+            const value = JSON.parse(UTF8_DECODER.decode(blob.bytes));
+            if (!value || typeof value !== "object" || Array.isArray(value))
+                throw new Error("dashboard root is not an object");
+        }
+        catch {
+            issues.push({
+                code: "dashboard_declaration_invalid",
+                sourcePath: blob.path,
+                sourceField: "path",
+                detail: `${blob.path} is not valid JSON object dashboard data`,
+            });
+            continue;
+        }
+        declarations.push({ path: blob.path, contentHash: blob.contentHash });
+    }
+    return declarations;
+}
+/** OpenSLO is a vendor-neutral, durable SLO declaration. Discovery keeps only
+ * its fixed v1/SLO header plus path/content identity; metadata, objectives,
+ * indicators, queries, services and alert policy bodies never leave parsing. */
+function sloDeclarationFormat(path) {
+    const basename = posix.basename(path);
+    const extension = basename.match(/\.(json|ya?ml)$/i);
+    if (!extension)
+        return null;
+    const stem = basename.slice(0, -extension[0].length);
+    const explicitDirectory = /(?:^|\/)(?:\.openslo|slo|slos)\//i.test(path);
+    const explicitName = /^(?:openslo|slo)(?:[._-].+)?$/i.test(stem);
+    if (!explicitDirectory && !explicitName)
+        return null;
+    return extension[1].toLowerCase() === "json" ? "json" : "yaml";
+}
+function sloDeclarationBlobs(root, tree) {
+    const discovered = [];
+    for (const entry of tree) {
+        if (entry.kind === "tree")
+            continue;
+        const { pathBytes } = entry;
+        if (entry.path === null) {
+            const approximate = pathBytes.toString("latin1");
+            if (!firstPartyDeclarationPath(approximate) || !sloDeclarationFormat(approximate))
+                continue;
+            discovered.push({
+                path: `<unsafe-slo-declaration:sha256:${createHash("sha256").update(pathBytes).digest("hex")}>`,
+                mode: "unsafe-path",
+                oid: entry.oid,
+                objectSize: entry.objectSize,
+                bytes: null,
+                contentHash: null,
+                format: null,
+            });
+            continue;
+        }
+        const path = entry.path;
+        if (!firstPartyDeclarationPath(path))
+            continue;
+        const format = sloDeclarationFormat(path);
+        if (!format)
+            continue;
+        if (!safeDeclarationPath(path)) {
+            discovered.push({
+                path: `<unsafe-slo-declaration:sha256:${createHash("sha256").update(pathBytes).digest("hex")}>`,
+                mode: "unsafe-path",
+                oid: entry.oid,
+                objectSize: entry.objectSize,
+                bytes: null,
+                contentHash: null,
+                format: null,
+            });
+            continue;
+        }
+        discovered.push({
+            path,
+            mode: treeEntryMode(entry),
+            oid: entry.oid,
+            objectSize: entry.objectSize,
+            bytes: null,
+            contentHash: null,
+            format,
+        });
+    }
+    discovered.sort((left, right) => compareCodeUnits(left.path, right.path));
+    const total = discovered.length;
+    const blobs = hydrateDeclarationBlobs(root, discovered.slice(0, MAX_SLO_DECLARATIONS), MAX_SLO_DECLARATION_BYTES);
+    return { blobs, total };
+}
+function validOpenSloName(value) {
+    return typeof value === "string" && value.trim().length > 0 && value.trim().length <= 256;
+}
+function validJsonOpenSlo(source) {
+    const value = JSON.parse(source);
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const record = value;
+    const metadata = record.metadata;
+    return record.apiVersion === "openslo/v1"
+        && record.kind === "SLO"
+        && !!metadata
+        && typeof metadata === "object"
+        && !Array.isArray(metadata)
+        && validOpenSloName(metadata.name);
+}
+function validYamlOpenSlo(path, source) {
+    if (!parseSource(path, source)?.parseable)
+        return false;
+    const topLevel = new Map();
+    let duplicate = false;
+    const lines = source.split(/\r?\n/);
+    const significant = lines.map((line, index) => ({ line: line.trim(), index }))
+        .filter(({ line }) => line && !line.startsWith("#"));
+    const documentStarts = significant.filter(({ line }) => line === "---");
+    const documentEnds = significant.filter(({ line }) => line === "...");
+    if (documentStarts.length > 1
+        || (documentStarts.length === 1 && documentStarts[0].index !== significant[0].index)
+        || documentEnds.length > 1
+        || (documentEnds.length === 1 && documentEnds[0].index !== significant.at(-1).index))
+        return false;
+    for (const line of lines) {
+        if (!line.trim() || line.trimStart().startsWith("#") || line.match(/^ */)[0].length !== 0)
+            continue;
+        const mapping = line.match(/^(apiVersion|kind)[ \t]*:(.*)$/);
+        if (!mapping)
+            continue;
+        if (topLevel.has(mapping[1]))
+            duplicate = true;
+        topLevel.set(mapping[1], boundedYamlScalar(mapping[2]));
+    }
+    if (duplicate || topLevel.get("apiVersion") !== "openslo/v1" || topLevel.get("kind") !== "SLO")
+        return false;
+    const metadataIndex = lines.findIndex((line) => /^metadata[ \t]*:[ \t]*(?:#.*)?$/.test(line));
+    if (metadataIndex < 0)
+        return false;
+    let directIndent = null;
+    for (const line of lines.slice(metadataIndex + 1)) {
+        if (!line.trim() || line.trimStart().startsWith("#"))
+            continue;
+        const indentation = line.match(/^ */)[0].length;
+        if (indentation === 0)
+            break;
+        directIndent ??= indentation;
+        if (indentation !== directIndent)
+            continue;
+        const name = line.trimStart().match(/^name[ \t]*:(.*)$/);
+        if (name)
+            return validOpenSloName(boundedYamlScalar(name[1]));
+    }
+    return false;
+}
+function sloDeclarations(root, tree, issues) {
+    const discovered = sloDeclarationBlobs(root, tree);
+    if (discovered.total > MAX_SLO_DECLARATIONS) {
+        issues.push({
+            code: "slo_declaration_limit",
+            sourcePath: ".",
+            sourceField: "slo",
+            detail: `bounded discovery accepts at most ${MAX_SLO_DECLARATIONS} SLO declarations`,
+        });
+    }
+    const declarations = [];
+    for (const blob of discovered.blobs) {
+        if (!blob.bytes || !blob.format) {
+            const code = blob.contentHash === "oversized"
+                ? "slo_declaration_oversized"
+                : blob.mode === "unsafe-path"
+                    ? "slo_declaration_path"
+                    : "slo_declaration_mode";
+            issues.push({
+                code,
+                sourcePath: blob.path,
+                sourceField: "path",
+                detail: blob.contentHash === "oversized"
+                    ? `${blob.path} exceeds the ${MAX_SLO_DECLARATION_BYTES}-byte SLO declaration limit`
+                    : blob.mode === "unsafe-path"
+                        ? "an SLO declaration uses an unsafe path"
+                        : `${blob.path} uses unsupported Git mode ${blob.mode}`,
+            });
+            continue;
+        }
+        let source;
+        try {
+            source = UTF8_DECODER.decode(blob.bytes);
+        }
+        catch {
+            issues.push({
+                code: "slo_declaration_invalid",
+                sourcePath: blob.path,
+                sourceField: "path",
+                detail: `${blob.path} is not valid UTF-8 SLO data`,
+            });
+            continue;
+        }
+        let valid = false;
+        try {
+            valid = blob.format === "json" ? validJsonOpenSlo(source) : validYamlOpenSlo(blob.path, source);
+        }
+        catch {
+            valid = false;
+        }
+        if (!valid) {
+            issues.push({
+                code: "slo_declaration_invalid",
+                sourcePath: blob.path,
+                sourceField: "apiVersion/kind/metadata.name",
+                detail: `${blob.path} is not a structurally valid OpenSLO v1 SLO declaration`,
+            });
+            continue;
+        }
+        declarations.push({
+            path: blob.path,
+            contentHash: blob.contentHash,
+            format: blob.format,
+            contractVersion: "openslo/v1",
+        });
+    }
+    return declarations;
+}
+function deliveryDeclarationBlobs(root, tree) {
+    const discovered = [];
+    for (const entry of tree) {
+        if (entry.kind === "tree")
+            continue;
+        const { pathBytes } = entry;
+        if (entry.path === null) {
+            const approximate = pathBytes.toString("latin1");
+            if (!firstPartyDeclarationPath(approximate))
+                continue;
+            if (deliveryDeclarationSpec(approximate)) {
+                discovered.push({
+                    path: `<unsafe-delivery-declaration:sha256:${createHash("sha256").update(pathBytes).digest("hex")}>`,
+                    mode: "unsafe-path",
+                    oid: entry.oid,
+                    objectSize: entry.objectSize,
+                    bytes: null,
+                    contentHash: null,
+                    spec: null,
+                });
+            }
+            continue;
+        }
+        const path = entry.path;
+        if (!firstPartyDeclarationPath(path))
+            continue;
+        const spec = deliveryDeclarationSpec(path);
+        if (!spec)
+            continue;
+        if (!safeDeclarationPath(path)) {
+            discovered.push({
+                path: `<unsafe-delivery-declaration:sha256:${createHash("sha256").update(pathBytes).digest("hex")}>`,
+                mode: "unsafe-path",
+                oid: entry.oid,
+                objectSize: entry.objectSize,
+                bytes: null,
+                contentHash: null,
+                spec: null,
+            });
+            continue;
+        }
+        discovered.push({
+            path,
+            mode: treeEntryMode(entry),
+            oid: entry.oid,
+            objectSize: entry.objectSize,
+            bytes: null,
+            contentHash: null,
+            spec,
+        });
+    }
+    discovered.sort((left, right) => compareCodeUnits(left.path, right.path));
+    const total = discovered.length;
+    const blobs = hydrateDeclarationBlobs(root, discovered.slice(0, MAX_DELIVERY_DECLARATIONS), MAX_DELIVERY_DECLARATION_BYTES);
+    return { blobs, total };
+}
+const KUBERNETES_WORKLOAD_KINDS = new Set(["Deployment", "StatefulSet", "DaemonSet", "Job", "CronJob", "Pod"]);
+function stripYamlScalarComment(input) {
+    let quote = null;
+    let escaped = false;
+    for (let index = 0; index < input.length; index += 1) {
+        const char = input[index];
+        if (quote === "\"") {
+            if (escaped)
+                escaped = false;
+            else if (char === "\\")
+                escaped = true;
+            else if (char === quote)
+                quote = null;
+            continue;
+        }
+        if (quote === "'") {
+            if (char === "'" && input[index + 1] === "'")
+                index += 1;
+            else if (char === "'")
+                quote = null;
+            continue;
+        }
+        if (char === "\"" || char === "'")
+            quote = char;
+        else if (char === "#" && (index === 0 || /\s/.test(input[index - 1])))
+            return input.slice(0, index);
+    }
+    return input;
+}
+function boundedYamlScalar(input) {
+    const value = stripYamlScalarComment(input).trim();
+    if (!value || value.length > 512)
+        return null;
+    let parsed;
+    if (value.startsWith("\"")) {
+        if (!value.endsWith("\""))
+            return null;
+        try {
+            const decoded = JSON.parse(value);
+            if (typeof decoded !== "string")
+                return null;
+            parsed = decoded;
+        }
+        catch {
+            return null;
+        }
+    }
+    else if (value.startsWith("'")) {
+        if (!value.endsWith("'"))
+            return null;
+        const inner = value.slice(1, -1);
+        let decoded = "";
+        for (let index = 0; index < inner.length; index += 1) {
+            const char = inner[index];
+            if (char !== "'") {
+                decoded += char;
+                continue;
+            }
+            if (inner[index + 1] !== "'")
+                return null;
+            decoded += "'";
+            index += 1;
+        }
+        parsed = decoded;
+    }
+    else {
+        if (!/^[A-Za-z0-9][A-Za-z0-9._/@-]{0,255}$/.test(value))
+            return null;
+        parsed = value;
+    }
+    return parsed.length > 0 && parsed.length <= 256
+        && !/[\u0000-\u001f\u007f]/.test(parsed)
+        && isCredentialFreeText(parsed)
+        ? parsed
+        : null;
+}
+function kubernetesYamlDocuments(source) {
+    return source
+        .split(/^(?:---|\.\.\.)[ \t]*(?:#.*)?\r?$/m)
+        .map((document, index) => ({ index, source: document }))
+        .filter((document) => document.source.split(/\r?\n/)
+        .some((line) => !!line.trim() && !line.trimStart().startsWith("#")));
+}
+function kubernetesDocumentHeader(source) {
+    const header = {
+        apiVersion: undefined,
+        kind: undefined,
+        name: undefined,
+        namespace: undefined,
+        duplicate: false,
+    };
+    let metadataIndent = null;
+    let metadataChildIndent = null;
+    const assign = (field, raw) => {
+        if (header[field] !== undefined) {
+            header.duplicate = true;
+            return;
+        }
+        header[field] = boundedYamlScalar(raw);
+    };
+    for (const rawLine of source.split(/\r?\n/)) {
+        if (!rawLine.trim() || rawLine.trimStart().startsWith("#"))
+            continue;
+        const indentation = rawLine.match(/^ */)[0].length;
+        const mapping = rawLine.slice(indentation).match(/^([A-Za-z][A-Za-z0-9_-]*)[ \t]*:(.*)$/);
+        if (indentation === 0) {
+            metadataIndent = null;
+            metadataChildIndent = null;
+            if (!mapping)
+                continue;
+            const [_, key, raw] = mapping;
+            if (key === "apiVersion" || key === "kind")
+                assign(key, raw);
+            else if (key === "metadata" && !stripYamlScalarComment(raw).trim())
+                metadataIndent = 0;
+            continue;
+        }
+        if (metadataIndent === null || indentation <= metadataIndent || !mapping)
+            continue;
+        if (metadataChildIndent === null)
+            metadataChildIndent = indentation;
+        if (indentation !== metadataChildIndent)
+            continue;
+        const [_, key, raw] = mapping;
+        if (key === "name" || key === "namespace")
+            assign(key, raw);
+    }
+    return header;
+}
+function validKubernetesApiVersion(value) {
+    return value.length <= 128 && /^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?\/v[0-9][a-z0-9]*$|^v[0-9][a-z0-9]*$/i.test(value);
+}
+function validKubernetesName(value) {
+    return value.length <= 253 && /^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?$/.test(value);
+}
+function validKubernetesNamespace(value) {
+    return value.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(value);
+}
+function kubernetesDeclarations(blob, source, issues) {
+    const candidates = [];
+    for (const document of kubernetesYamlDocuments(source)) {
+        const header = kubernetesDocumentHeader(document.source);
+        if (header.duplicate) {
+            issues.push({
+                code: "delivery_declaration_invalid",
+                sourcePath: blob.path,
+                sourceField: `documents[${document.index}]`,
+                detail: `${blob.path} document ${document.index} repeats a Kubernetes identity field`,
+            });
+            continue;
+        }
+        if (typeof header.kind !== "string" || !KUBERNETES_WORKLOAD_KINDS.has(header.kind))
+            continue;
+        const namespace = header.namespace === undefined ? "default" : header.namespace;
+        if (typeof header.apiVersion !== "string" || !validKubernetesApiVersion(header.apiVersion)
+            || typeof header.name !== "string" || !validKubernetesName(header.name)
+            || typeof namespace !== "string" || !validKubernetesNamespace(namespace)) {
+            issues.push({
+                code: "delivery_declaration_invalid",
+                sourcePath: blob.path,
+                sourceField: `documents[${document.index}].metadata.name`,
+                detail: `${blob.path} document ${document.index} has an incomplete or unsafe Kubernetes workload identity`,
+            });
+            continue;
+        }
+        const identity = `${header.apiVersion.toLowerCase()}/${header.kind.toLowerCase()}/${namespace}/${header.name}`;
         candidates.push({
             path: blob.path,
             contentHash: blob.contentHash,
@@ -1171,6 +2323,8 @@ function validDeliveryDeclaration(path, spec, source) {
     const parsed = parseSource(path, source);
     if (!parsed?.parseable)
         return false;
+    if (spec.provider === "helm")
+        return helmChartApiVersion(source) !== null;
     if (spec.provider === "github_actions" || spec.provider === "circleci")
         return /^jobs\s*:/m.test(source);
     if (spec.provider === "buildkite")
@@ -1179,8 +2333,35 @@ function validDeliveryDeclaration(path, spec, source) {
         return /^services\s*:/m.test(source);
     return source.trim().length > 0;
 }
-function deliveryDeclarations(root, revision, issues) {
-    const discovered = deliveryDeclarationBlobs(root, revision);
+function helmChartApiVersion(source) {
+    const values = new Map();
+    let duplicate = false;
+    for (const rawLine of source.split(/\r?\n/)) {
+        if (!rawLine.trim() || rawLine.trimStart().startsWith("#"))
+            continue;
+        if (rawLine.match(/^ */)[0].length !== 0)
+            continue;
+        const mapping = rawLine.match(/^(apiVersion|name|version)[ \t]*:(.*)$/);
+        if (!mapping)
+            continue;
+        const field = mapping[1];
+        if (values.has(field))
+            duplicate = true;
+        values.set(field, boundedYamlScalar(mapping[2]));
+    }
+    const apiVersion = values.get("apiVersion");
+    const name = values.get("name");
+    const version = values.get("version");
+    if (duplicate || (apiVersion !== "v1" && apiVersion !== "v2"))
+        return null;
+    if (typeof name !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(name))
+        return null;
+    if (typeof version !== "string" || !/^(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.test(version))
+        return null;
+    return apiVersion;
+}
+function deliveryDeclarations(root, revision, tree, issues) {
+    const discovered = deliveryDeclarationBlobs(root, tree);
     let limitReported = false;
     const reportLimit = (sourcePath) => {
         if (limitReported)
@@ -1264,6 +2445,7 @@ function deliveryDeclarations(root, revision, issues) {
             path: blob.path,
             contentHash: blob.contentHash,
             spec: blob.spec,
+            contractVersion: blob.spec.provider === "helm" ? helmChartApiVersion(source) : undefined,
             metadata: blob.spec.provider === "systemd" ? { unit_name: posix.basename(blob.path) } : undefined,
         });
     }
@@ -1285,7 +2467,9 @@ function deliveryResourceName(declaration) {
     const label = declaration.spec.resourceKind === "pipeline"
         ? `${declaration.spec.provider.replaceAll("_", " ")} pipeline: ${base}`
         : declaration.spec.resourceKind === "artifact"
-            ? `container image declared by ${base}`
+            ? declaration.spec.provider === "helm"
+                ? `Helm chart: ${declaration.path}`
+                : `container image declared by ${base}`
             : declaration.spec.provider === "systemd"
                 ? `systemd service: ${base}`
                 : `Docker Compose deployment: ${base}`;
@@ -1308,29 +2492,348 @@ function repositoryKey(identity) {
     if (identity.startsWith("file:")) {
         return { key: `local/sha256/${createHash("sha256").update(identity).digest("hex")}`, locator: null };
     }
-    if (identity.startsWith("net:any://")) {
-        return safe(identity.slice("net:any://".length), null);
+    if (identity.startsWith("net:any://")) {
+        return safe(identity.slice("net:any://".length), null);
+    }
+    return safe(identity, null);
+}
+function gitmodulesBlob(root, tree) {
+    const entry = tree.find((candidate) => candidate.path === ".gitmodules");
+    if (!entry)
+        return null;
+    const blob = {
+        path: ".gitmodules",
+        mode: treeEntryMode(entry),
+        oid: entry.oid,
+        objectSize: entry.objectSize,
+        bytes: null,
+        contentHash: null,
+    };
+    if (!ORDINARY_BLOB_MODES.has(blob.mode))
+        return blob;
+    return hydrateDeclarationBlobs(root, [blob], MAX_SUBMODULE_DECLARATION_BYTES)[0];
+}
+function submoduleConfigGroups(root, blob) {
+    let raw;
+    try {
+        raw = gitBuffer(root, [
+            "config", `--blob=${blob.oid}`, "--null", "--get-regexp", "^submodule\\..*\\.(path|url)$",
+        ], MAX_SUBMODULE_DECLARATION_BYTES * 2);
+    }
+    catch {
+        return null;
+    }
+    const groups = new Map();
+    for (const record of nulRecords(raw)) {
+        const newline = record.indexOf(0x0a);
+        if (newline <= 0)
+            return null;
+        let key;
+        let value;
+        try {
+            key = UTF8_DECODER.decode(record.subarray(0, newline));
+            value = UTF8_DECODER.decode(record.subarray(newline + 1));
+        }
+        catch {
+            return null;
+        }
+        const match = key.match(/^submodule\.(.+)\.(path|url)$/i);
+        if (!match || match[1].length > 1024 || /[\u0000-\u001f\u007f]/.test(match[1]))
+            return null;
+        const group = groups.get(match[1]) ?? { key: match[1], paths: [], urls: [] };
+        if (match[2].toLowerCase() === "path")
+            group.paths.push(value);
+        else
+            group.urls.push(value);
+        groups.set(group.key, group);
+    }
+    return [...groups.values()].sort((left, right) => {
+        const safeKey = (group) => {
+            const path = group.paths.length === 1 && safeDeclarationPath(group.paths[0]) ? group.paths[0] : null;
+            return path ?? `~${sha256Bytes(group.key)}`;
+        };
+        return compareCodeUnits(safeKey(left), safeKey(right));
+    });
+}
+function exactGitlinks(tree, paths) {
+    const gitlinks = new Map();
+    for (const entry of tree) {
+        if (entry.mode !== "160000" || entry.kind !== "commit" || entry.path === null)
+            continue;
+        if (paths.has(entry.path))
+            gitlinks.set(entry.path, entry.oid);
+    }
+    return gitlinks;
+}
+function canonicalSubmoduleRepository(url, root) {
+    const value = url.trim();
+    if (!value || value.length > 4096 || /[\u0000-\u001f\u007f]/.test(value))
+        return null;
+    if (/^(?:data|file|ftp|javascript|mailto):/i.test(value))
+        return null;
+    const scp = !value.includes("://") && /^(?:[^@/]+@)?[^:/]+:.+$/.test(value);
+    if (!scp) {
+        try {
+            const parsed = new URL(value);
+            if (!new Set(["http:", "https:", "ssh:", "git:", "git+ssh:", "ssh+git:"]).has(parsed.protocol)
+                || !parsed.hostname || !parsed.pathname.replace(/^\/+/, ""))
+                return null;
+        }
+        catch {
+            return null;
+        }
+    }
+    const identity = canonicalRemoteRepositoryIdentity(value, root);
+    if (!identity.startsWith("provider:") && !identity.startsWith("net:any://"))
+        return null;
+    const normalized = repositoryKey(identity);
+    if (normalized.key.startsWith("opaque/"))
+        return null;
+    return { identity, ...normalized };
+}
+function submoduleDeclarations(root, revision, tree, rootRepositoryIdentity, issues) {
+    const blob = gitmodulesBlob(root, tree);
+    if (!blob)
+        return [];
+    if (!blob.bytes) {
+        issues.push({
+            code: blob.contentHash === "oversized" ? "submodule_declaration_oversized" : "submodule_declaration_mode",
+            sourcePath: blob.path,
+            sourceField: "submodule",
+            detail: blob.contentHash === "oversized"
+                ? `${blob.path} exceeds the ${MAX_SUBMODULE_DECLARATION_BYTES}-byte submodule declaration limit`
+                : `${blob.path} uses unsupported Git mode ${blob.mode}`,
+        });
+        return [];
+    }
+    const groups = submoduleConfigGroups(root, blob);
+    if (!groups) {
+        issues.push({
+            code: "submodule_declaration_invalid",
+            sourcePath: blob.path,
+            sourceField: "submodule",
+            detail: `${blob.path} is not valid bounded Git submodule configuration`,
+        });
+        return [];
+    }
+    if (groups.length > MAX_SUBMODULE_DECLARATIONS) {
+        issues.push({
+            code: "submodule_declaration_limit",
+            sourcePath: blob.path,
+            sourceField: "submodule",
+            detail: `bounded discovery accepts at most ${MAX_SUBMODULE_DECLARATIONS} Git submodule declarations`,
+        });
+    }
+    const selectedGroups = groups.slice(0, MAX_SUBMODULE_DECLARATIONS);
+    const safePaths = new Set(selectedGroups
+        .flatMap((group) => group.paths.length === 1 && safeDeclarationPath(group.paths[0]) ? [group.paths[0]] : []));
+    const gitlinks = exactGitlinks(tree, safePaths);
+    const byPath = new Map();
+    for (const group of selectedGroups) {
+        if (group.paths.length !== 1 || group.urls.length !== 1 || !safeDeclarationPath(group.paths[0])) {
+            issues.push({
+                code: "submodule_declaration_invalid",
+                sourcePath: blob.path,
+                sourceField: "submodule",
+                detail: `${blob.path} contains an incomplete, duplicate or unsafe submodule declaration`,
+            });
+            continue;
+        }
+        const path = group.paths[0];
+        const url = group.urls[0];
+        const gitlinkRevision = gitlinks.get(path);
+        const repository = canonicalSubmoduleRepository(url, root);
+        if (!gitlinkRevision || !repository || repository.identity === rootRepositoryIdentity) {
+            issues.push({
+                code: "submodule_declaration_invalid",
+                sourcePath: blob.path,
+                sourceField: `submodule[${path}]`,
+                detail: `${blob.path} submodule ${path} lacks a distinct credential-free network repository and matching committed gitlink`,
+            });
+            continue;
+        }
+        const configEvidence = {
+            kind: "submodule_declaration",
+            sourcePath: blob.path,
+            sourceField: `submodule[${path}].url`,
+            sourceRevision: revision,
+            sourceContentHash: blob.contentHash,
+        };
+        const gitlinkEvidence = {
+            kind: "submodule_declaration",
+            sourcePath: path,
+            sourceField: "gitlink",
+            sourceRevision: revision,
+            sourceContentHash: sha256Bytes(`gitlink:${gitlinkRevision}`),
+        };
+        const declaration = {
+            path,
+            gitlinkRevision,
+            repository: { ...repository, evidence: configEvidence },
+            evidence: [configEvidence, gitlinkEvidence],
+        };
+        const pathGroup = byPath.get(path) ?? [];
+        pathGroup.push(declaration);
+        byPath.set(path, pathGroup);
+    }
+    const declarations = [];
+    for (const path of [...byPath.keys()].sort(compareCodeUnits)) {
+        const pathGroup = byPath.get(path);
+        if (pathGroup.length !== 1) {
+            issues.push({
+                code: "submodule_declaration_invalid",
+                sourcePath: blob.path,
+                sourceField: `submodule[${path}]`,
+                detail: `${blob.path} repeats submodule path ${path}; identity remains unresolved`,
+            });
+            continue;
+        }
+        declarations.push(pathGroup[0]);
+    }
+    return declarations;
+}
+function packageRepositoryValue(value) {
+    if (typeof value === "string")
+        return value;
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const url = value.url;
+    return typeof url === "string" ? url : null;
+}
+function validPackageName(value) {
+    if (typeof value !== "string")
+        return null;
+    const name = value.trim();
+    return name
+        && name.length <= 214
+        && !/[\u0000-\u001f\u007f\s]/.test(name)
+        && /^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/i.test(name)
+        ? name
+        : null;
+}
+function workspacePackageDeclarations(manifests, issues) {
+    const byName = new Map();
+    for (const manifest of manifests) {
+        const rawName = typeof manifest.value.name === "string" ? manifest.value.name.trim() : "";
+        if (!rawName) {
+            issues.push({
+                code: "package_name_missing",
+                sourcePath: manifest.path,
+                sourceField: "name",
+                detail: `${manifest.path} has no package name`,
+            });
+            continue;
+        }
+        const name = validPackageName(rawName);
+        if (!name) {
+            issues.push({
+                code: "package_name_invalid",
+                sourcePath: manifest.path,
+                sourceField: "name",
+                detail: `${manifest.path} has an invalid package name`,
+            });
+            continue;
+        }
+        const group = byName.get(name) ?? [];
+        group.push({ manifest, name });
+        byName.set(name, group);
+    }
+    const declarations = [];
+    for (const name of [...byName.keys()].sort(compareCodeUnits)) {
+        const group = byName.get(name).sort((left, right) => compareCodeUnits(left.manifest.path, right.manifest.path));
+        if (group.length > 1) {
+            issues.push({
+                code: "package_identity_conflict",
+                sourcePath: group[0].manifest.path,
+                sourceField: "name",
+                detail: `package ${name} is declared by ${group.length} workspace manifests; identity remains unresolved`,
+            });
+            continue;
+        }
+        declarations.push(group[0]);
+    }
+    return declarations;
+}
+const WORKSPACE_DEPENDENCY_FIELDS = [
+    "dependencies",
+    "devDependencies",
+    "peerDependencies",
+    "optionalDependencies",
+];
+function workspaceDependencyDeclarations(packages, revision, issues) {
+    const byName = new Map(packages.map((declaration) => [declaration.name, declaration]));
+    const byRelationship = new Map();
+    for (const from of packages) {
+        for (const field of WORKSPACE_DEPENDENCY_FIELDS) {
+            const raw = from.manifest.value[field];
+            if (raw === undefined)
+                continue;
+            if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+                issues.push({
+                    code: "package_dependency_invalid",
+                    sourcePath: from.manifest.path,
+                    sourceField: field,
+                    detail: `${from.manifest.path} must declare ${field} as an object`,
+                });
+                continue;
+            }
+            for (const [rawTarget, specifier] of Object.entries(raw).sort(([left], [right]) => compareCodeUnits(left, right))) {
+                const targetName = validPackageName(rawTarget);
+                const to = targetName ? byName.get(targetName) : undefined;
+                if (!to)
+                    continue;
+                if (typeof specifier !== "string" || !specifier.trim() || from.name === to.name) {
+                    issues.push({
+                        code: "package_dependency_invalid",
+                        sourcePath: from.manifest.path,
+                        sourceField: `${field}.${targetName}`,
+                        detail: from.name === to.name
+                            ? `${from.manifest.path} declares a self-dependency on its own workspace package identity`
+                            : `${from.manifest.path} declares a non-string workspace dependency specifier`,
+                    });
+                    continue;
+                }
+                const relationshipKey = `${from.name}\u0000${to.name}`;
+                const evidence = {
+                    kind: "package_manifest",
+                    sourcePath: from.manifest.path,
+                    sourceField: `${field}.${to.name}`,
+                    sourceRevision: revision,
+                    sourceContentHash: from.manifest.contentHash,
+                };
+                const existing = byRelationship.get(relationshipKey);
+                if (existing) {
+                    existing.evidence.push(evidence);
+                }
+                else {
+                    byRelationship.set(relationshipKey, {
+                        from,
+                        to,
+                        evidence: [
+                            evidence,
+                            {
+                                kind: "package_manifest",
+                                sourcePath: to.manifest.path,
+                                sourceField: "name",
+                                sourceRevision: revision,
+                                sourceContentHash: to.manifest.contentHash,
+                            },
+                        ],
+                    });
+                }
+            }
+        }
+    }
+    const declarations = [...byRelationship.values()].sort((left, right) => compareCodeUnits(`${left.from.name}:${left.to.name}`, `${right.from.name}:${right.to.name}`));
+    if (declarations.length > MAX_WORKSPACE_DEPENDENCIES) {
+        issues.push({
+            code: "package_dependency_limit",
+            sourcePath: "package.json",
+            sourceField: "workspaces",
+            detail: `bounded discovery accepts at most ${MAX_WORKSPACE_DEPENDENCIES} internal workspace dependency relationships`,
+        });
     }
-    return safe(identity, null);
-}
-function packageRepositoryValue(value) {
-    if (typeof value === "string")
-        return value;
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        return null;
-    const url = value.url;
-    return typeof url === "string" ? url : null;
-}
-function validPackageName(value) {
-    if (typeof value !== "string")
-        return null;
-    const name = value.trim();
-    return name
-        && name.length <= 214
-        && !/[\u0000-\u001f\u007f\s]/.test(name)
-        && /^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/i.test(name)
-        ? name
-        : null;
+    return declarations.slice(0, MAX_WORKSPACE_DEPENDENCIES);
 }
 function configuredRemotes(root, revision) {
     let output = "";
@@ -1427,12 +2930,10 @@ function rootHistoryIdentity(root, revision) {
  * never writes Hunch graph state: candidate authority remains explicit until a
  * normal review/capture path accepts the records. */
 export function discoverRepositoryLandscape(root, ref = "HEAD") {
-    if (!isGitRepo(root))
-        throw new Error("landscape discovery requires a Git repository");
-    const revision = exactRevision(root, ref);
-    const timestamp = revisionTime(root, revision);
+    const { revision, timestamp } = exactCommitSnapshot(root, ref);
+    const tree = exactTreeSnapshot(root, revision);
     const issues = [];
-    const blobs = manifestBlobs(root, revision);
+    const blobs = manifestBlobs(tree);
     if (blobs.length > MAX_MANIFESTS) {
         issues.push({
             code: "manifest_limit",
@@ -1448,9 +2949,16 @@ export function discoverRepositoryLandscape(root, ref = "HEAD") {
     }
     const patterns = workspacePatterns(rootManifest?.value.workspaces, issues);
     const manifests = parsed.filter((manifest) => isWorkspaceManifest(manifest.path, patterns));
+    const discoveredPackages = workspacePackageDeclarations(manifests, issues);
+    const discoveredWorkspaceDependencies = workspaceDependencyDeclarations(discoveredPackages, revision, issues);
     const declarations = repositoryDeclarations(root, revision, rootManifest);
-    const discoveredMcp = mcpDeclarations(root, revision, issues);
-    const discoveredDelivery = deliveryDeclarations(root, revision, issues);
+    const discoveredMcp = mcpDeclarations(root, revision, tree, issues);
+    const discoveredDelivery = deliveryDeclarations(root, revision, tree, issues);
+    const discoveredApi = apiDeclarations(root, revision, tree, issues);
+    const discoveredMigrations = migrationDeclarations(root, revision, tree, issues);
+    const discoveredOperations = operationsDeclarations(root, revision, tree, issues);
+    const discoveredDashboards = dashboardDeclarations(root, tree, issues);
+    const discoveredSlos = sloDeclarations(root, tree, issues);
     const identities = [...new Set(declarations.map((declaration) => declaration.identity))].sort(compareCodeUnits);
     let selected = null;
     if (identities.length > 1) {
@@ -1467,6 +2975,10 @@ export function discoverRepositoryLandscape(root, ref = "HEAD") {
     else {
         selected = rootHistoryIdentity(root, revision);
     }
+    const discoveredSubmodules = submoduleDeclarations(root, revision, tree, selected?.identity ?? null, issues);
+    const discoveredOwnership = selected?.key.startsWith("github.com/")
+        ? ownershipDeclaration(root, revision, tree, issues)
+        : null;
     const resources = [];
     const relationships = [];
     let repositoryRecord = null;
@@ -1495,6 +3007,274 @@ export function discoverRepositoryLandscape(root, ref = "HEAD") {
         });
         resources.push(candidate(repositoryRecord, repositoryEvidence));
     }
+    if (repositoryRecord) {
+        const submodulesByRepository = new Map();
+        for (const declaration of discoveredSubmodules) {
+            const group = submodulesByRepository.get(declaration.repository.key) ?? [];
+            group.push(declaration);
+            submodulesByRepository.set(declaration.repository.key, group);
+        }
+        for (const key of [...submodulesByRepository.keys()].sort(compareCodeUnits)) {
+            const group = submodulesByRepository.get(key)
+                .sort((left, right) => compareCodeUnits(left.path, right.path));
+            const first = group[0];
+            const evidence = group.flatMap((declaration) => declaration.evidence);
+            const declarationPaths = group.map((declaration) => declaration.path);
+            const gitlinkRevisions = [...new Set(group.map((declaration) => declaration.gitlinkRevision))].sort(compareCodeUnits);
+            const submoduleRecord = ResourceSchema.parse({
+                schema: "hunch.resource/1",
+                id: resourceId("repository", key),
+                kind: "repository",
+                name: key.slice(0, 256),
+                scope: [repositoryRecord.id],
+                locator: first.repository.locator,
+                lifecycle: "active",
+                provenance: {
+                    source: "extracted:git-submodule",
+                    confidence: 0.9,
+                    evidence: evidence.map(provenanceEvidence),
+                },
+                currentness: resourceCurrentness(revision, evidence.map((item) => item.sourceContentHash)),
+                metadata: {
+                    discovery_authority: "candidate",
+                    declaration_paths: declarationPaths,
+                    gitlink_revisions: gitlinkRevisions,
+                },
+                created_at: timestamp,
+                updated_at: timestamp,
+            });
+            resources.push(candidate(submoduleRecord, evidence));
+            const relationship = EdgeSchema.parse({
+                schema: "hunch.resource-relationship/1",
+                id: resourceRelationshipId(repositoryRecord.id, submoduleRecord.id, "depends_on"),
+                from: repositoryRecord.id,
+                to: submoduleRecord.id,
+                type: "depends_on",
+                reason: `committed Git submodule declarations reference repository ${key}`,
+                strength: 0.9,
+                provenance: {
+                    source: "extracted:git-submodule",
+                    confidence: 0.9,
+                    evidence: evidence.map(provenanceEvidence),
+                },
+                currentness: resourceCurrentness(revision, evidence.map((item) => item.sourceContentHash)),
+                environment: null,
+                metadata: { discovery_authority: "candidate", declaration_paths: declarationPaths },
+            });
+            relationships.push(candidate(relationship, evidence));
+        }
+    }
+    if (repositoryRecord && discoveredOwnership) {
+        for (const team of discoveredOwnership.teams) {
+            const evidence = {
+                kind: "ownership_declaration",
+                sourcePath: discoveredOwnership.path,
+                sourceField: "default-owner",
+                sourceRevision: revision,
+                sourceContentHash: discoveredOwnership.contentHash,
+            };
+            const teamRecord = ResourceSchema.parse({
+                schema: "hunch.resource/1",
+                id: resourceId("team_ref", `github.com/${team.organization}/${team.team}`),
+                kind: "team_ref",
+                name: team.handle,
+                scope: [],
+                locator: `https://github.com/orgs/${team.organization}/teams/${team.team}`,
+                lifecycle: "active",
+                provenance: {
+                    source: "extracted:codeowners-default-team",
+                    confidence: 0.8,
+                    evidence: [provenanceEvidence(evidence)],
+                },
+                currentness: resourceCurrentness(revision, [discoveredOwnership.contentHash]),
+                metadata: {
+                    discovery_authority: "candidate",
+                    provider: "github",
+                    declaration_path: discoveredOwnership.path,
+                },
+                created_at: timestamp,
+                updated_at: timestamp,
+            });
+            resources.push(candidate(teamRecord, [evidence]));
+            const relationship = EdgeSchema.parse({
+                schema: "hunch.resource-relationship/1",
+                id: resourceRelationshipId(repositoryRecord.id, teamRecord.id, "owned_by"),
+                from: repositoryRecord.id,
+                to: teamRecord.id,
+                type: "owned_by",
+                reason: `${discoveredOwnership.path} declares ${team.handle} as a repository-wide owner`,
+                strength: 0.8,
+                provenance: {
+                    source: "extracted:codeowners-default-team",
+                    confidence: 0.8,
+                    evidence: [provenanceEvidence(evidence)],
+                },
+                currentness: resourceCurrentness(revision, [discoveredOwnership.contentHash]),
+                environment: null,
+                metadata: { discovery_authority: "candidate", declaration_path: discoveredOwnership.path },
+            });
+            relationships.push(candidate(relationship, [evidence]));
+        }
+    }
+    for (const declaration of discoveredOperations) {
+        const evidence = {
+            kind: "operations_declaration",
+            sourcePath: declaration.path,
+            sourceField: "path",
+            sourceRevision: revision,
+            sourceContentHash: declaration.contentHash,
+        };
+        const runbookRecord = ResourceSchema.parse({
+            schema: "hunch.resource/1",
+            id: resourceId("runbook", `repository/${declaration.path}`),
+            kind: "runbook",
+            name: `Runbook: ${declaration.path}`.slice(0, 256),
+            scope: repositoryRecord ? [repositoryRecord.id] : [],
+            locator: declaration.path,
+            lifecycle: "active",
+            provenance: {
+                source: "extracted:runbook-declaration",
+                confidence: 0.85,
+                evidence: [provenanceEvidence(evidence)],
+            },
+            currentness: resourceCurrentness(revision, [declaration.contentHash]),
+            metadata: {
+                discovery_authority: "candidate",
+                declaration_path: declaration.path,
+                declaration_format: /\.mdx$/i.test(declaration.path) ? "mdx" : "markdown",
+            },
+            created_at: timestamp,
+            updated_at: timestamp,
+        });
+        resources.push(candidate(runbookRecord, [evidence]));
+        if (!repositoryRecord)
+            continue;
+        const relationship = EdgeSchema.parse({
+            schema: "hunch.resource-relationship/1",
+            id: resourceRelationshipId(repositoryRecord.id, runbookRecord.id, "contains"),
+            from: repositoryRecord.id,
+            to: runbookRecord.id,
+            type: "contains",
+            reason: `${declaration.path} declares repository operational guidance`,
+            strength: 0.85,
+            provenance: {
+                source: "extracted:runbook-declaration",
+                confidence: 0.85,
+                evidence: [provenanceEvidence(evidence)],
+            },
+            currentness: resourceCurrentness(revision, [declaration.contentHash]),
+            environment: null,
+            metadata: { discovery_authority: "candidate", declaration_path: declaration.path },
+        });
+        relationships.push(candidate(relationship, [evidence]));
+    }
+    for (const declaration of discoveredDashboards) {
+        const evidence = {
+            kind: "dashboard_declaration",
+            sourcePath: declaration.path,
+            sourceField: "path",
+            sourceRevision: revision,
+            sourceContentHash: declaration.contentHash,
+        };
+        const dashboardRecord = ResourceSchema.parse({
+            schema: "hunch.resource/1",
+            id: resourceId("dashboard", `repository/${declaration.path}`),
+            kind: "dashboard",
+            name: `Dashboard: ${declaration.path}`.slice(0, 256),
+            scope: repositoryRecord ? [repositoryRecord.id] : [],
+            locator: declaration.path,
+            lifecycle: "active",
+            provenance: {
+                source: "extracted:dashboard-declaration",
+                confidence: 0.85,
+                evidence: [provenanceEvidence(evidence)],
+            },
+            currentness: resourceCurrentness(revision, [declaration.contentHash]),
+            metadata: {
+                discovery_authority: "candidate",
+                declaration_path: declaration.path,
+                declaration_format: "json",
+            },
+            created_at: timestamp,
+            updated_at: timestamp,
+        });
+        resources.push(candidate(dashboardRecord, [evidence]));
+        if (!repositoryRecord)
+            continue;
+        const relationship = EdgeSchema.parse({
+            schema: "hunch.resource-relationship/1",
+            id: resourceRelationshipId(repositoryRecord.id, dashboardRecord.id, "contains"),
+            from: repositoryRecord.id,
+            to: dashboardRecord.id,
+            type: "contains",
+            reason: `${declaration.path} declares a repository dashboard`,
+            strength: 0.85,
+            provenance: {
+                source: "extracted:dashboard-declaration",
+                confidence: 0.85,
+                evidence: [provenanceEvidence(evidence)],
+            },
+            currentness: resourceCurrentness(revision, [declaration.contentHash]),
+            environment: null,
+            metadata: { discovery_authority: "candidate", declaration_path: declaration.path },
+        });
+        relationships.push(candidate(relationship, [evidence]));
+    }
+    for (const declaration of discoveredSlos) {
+        const evidence = {
+            kind: "slo_declaration",
+            sourcePath: declaration.path,
+            sourceField: "apiVersion/kind",
+            sourceRevision: revision,
+            sourceContentHash: declaration.contentHash,
+        };
+        const sloRecord = ResourceSchema.parse({
+            schema: "hunch.resource/1",
+            id: resourceId("slo", `repository/${declaration.path}`),
+            kind: "slo",
+            name: `SLO declaration: ${declaration.path}`.slice(0, 256),
+            scope: repositoryRecord ? [repositoryRecord.id] : [],
+            locator: declaration.path,
+            lifecycle: "active",
+            contract_version: declaration.contractVersion,
+            provenance: {
+                source: "extracted:openslo-declaration",
+                confidence: 0.9,
+                evidence: [provenanceEvidence(evidence)],
+            },
+            currentness: resourceCurrentness(revision, [declaration.contentHash]),
+            metadata: {
+                discovery_authority: "candidate",
+                declaration_path: declaration.path,
+                declaration_format: declaration.format,
+                slo_dialect: "openslo",
+            },
+            created_at: timestamp,
+            updated_at: timestamp,
+        });
+        resources.push(candidate(sloRecord, [evidence]));
+        if (!repositoryRecord)
+            continue;
+        const relationship = EdgeSchema.parse({
+            schema: "hunch.resource-relationship/1",
+            id: resourceRelationshipId(repositoryRecord.id, sloRecord.id, "contains"),
+            from: repositoryRecord.id,
+            to: sloRecord.id,
+            type: "contains",
+            reason: `${declaration.path} declares a repository OpenSLO v1 objective`,
+            strength: 0.9,
+            provenance: {
+                source: "extracted:openslo-declaration",
+                confidence: 0.9,
+                evidence: [provenanceEvidence(evidence)],
+            },
+            currentness: resourceCurrentness(revision, [declaration.contentHash]),
+            environment: null,
+            contract_version: declaration.contractVersion,
+            metadata: { discovery_authority: "candidate", declaration_path: declaration.path },
+        });
+        relationships.push(candidate(relationship, [evidence]));
+    }
     const mcpByKey = new Map();
     for (const declaration of discoveredMcp) {
         const group = mcpByKey.get(declaration.key) ?? [];
@@ -1625,17 +3405,142 @@ export function discoverRepositoryLandscape(root, ref = "HEAD") {
         });
         relationships.push(candidate(relationship, [evidence]));
     }
-    for (const manifest of manifests) {
-        const rawName = typeof manifest.value.name === "string" ? manifest.value.name.trim() : "";
-        if (!rawName) {
-            issues.push({ code: "package_name_missing", sourcePath: manifest.path, sourceField: "name", detail: `${manifest.path} has no package name` });
+    for (const declaration of discoveredApi) {
+        const evidence = {
+            kind: "api_declaration",
+            sourcePath: declaration.path,
+            sourceField: declaration.dialect === "protobuf"
+                ? "syntax"
+                : declaration.dialect === "jsonschema"
+                    ? "$schema"
+                    : declaration.dialect,
+            sourceRevision: revision,
+            sourceContentHash: declaration.contentHash,
+        };
+        const family = declaration.dialect === "asyncapi"
+            ? "asyncapi"
+            : declaration.dialect === "protobuf"
+                ? "protobuf"
+                : declaration.dialect === "jsonschema"
+                    ? "json-schema"
+                    : "openapi";
+        const displayName = declaration.dialect === "swagger"
+            ? "Swagger"
+            : declaration.dialect === "asyncapi"
+                ? "AsyncAPI"
+                : declaration.dialect === "protobuf"
+                    ? "Protobuf"
+                    : declaration.dialect === "jsonschema"
+                        ? "JSON Schema"
+                        : "OpenAPI";
+        const apiRecord = ResourceSchema.parse({
+            schema: "hunch.resource/1",
+            id: resourceId("api", `${family}/${declaration.path}`),
+            kind: "api",
+            name: `${displayName} contract: ${posix.basename(declaration.path)}`,
+            scope: repositoryRecord ? [repositoryRecord.id] : [],
+            locator: declaration.path,
+            lifecycle: "active",
+            contract_version: declaration.version,
+            provenance: {
+                source: "extracted:api-declaration",
+                confidence: 0.85,
+                evidence: [provenanceEvidence(evidence)],
+            },
+            currentness: resourceCurrentness(revision, [declaration.contentHash]),
+            metadata: {
+                discovery_authority: "candidate",
+                declaration_path: declaration.path,
+                declaration_format: declaration.format,
+                api_dialect: declaration.dialect,
+            },
+            created_at: timestamp,
+            updated_at: timestamp,
+        });
+        resources.push(candidate(apiRecord, [evidence]));
+        if (!repositoryRecord)
             continue;
-        }
-        const name = validPackageName(rawName);
-        if (!name) {
-            issues.push({ code: "package_name_invalid", sourcePath: manifest.path, sourceField: "name", detail: `${manifest.path} has an invalid package name` });
+        const relationship = EdgeSchema.parse({
+            schema: "hunch.resource-relationship/1",
+            id: resourceRelationshipId(repositoryRecord.id, apiRecord.id, "contains"),
+            from: repositoryRecord.id,
+            to: apiRecord.id,
+            type: "contains",
+            reason: `${declaration.path} declares an ${declaration.dialect === "swagger" ? "OpenAPI 2.0 (Swagger)" : displayName} contract`,
+            strength: 0.85,
+            provenance: {
+                source: "extracted:api-declaration",
+                confidence: 0.85,
+                evidence: [provenanceEvidence(evidence)],
+            },
+            currentness: resourceCurrentness(revision, [declaration.contentHash]),
+            environment: null,
+            contract_version: declaration.version,
+            metadata: { discovery_authority: "candidate", declaration_path: declaration.path },
+        });
+        relationships.push(candidate(relationship, [evidence]));
+    }
+    for (const declaration of discoveredMigrations) {
+        const evidence = {
+            kind: "migration_declaration",
+            sourcePath: declaration.path,
+            sourceField: "path",
+            sourceRevision: revision,
+            sourceContentHash: declaration.contentHash,
+        };
+        const migrationRecord = ResourceSchema.parse({
+            schema: "hunch.resource/1",
+            id: resourceId("artifact", `migration/${declaration.provider}/${declaration.path}`),
+            kind: "artifact",
+            name: `${migrationProviderName(declaration.provider)} ${declaration.migrationType} migration: ${declaration.migrationId}`,
+            scope: repositoryRecord ? [repositoryRecord.id] : [],
+            locator: declaration.path,
+            lifecycle: "active",
+            contract_version: declaration.contractVersion ?? undefined,
+            provenance: {
+                source: "extracted:migration-declaration",
+                confidence: 0.9,
+                evidence: [provenanceEvidence(evidence)],
+            },
+            currentness: resourceCurrentness(revision, [declaration.contentHash]),
+            metadata: {
+                discovery_authority: "candidate",
+                artifact_type: "database_migration",
+                migration_framework: declaration.provider,
+                migration_type: declaration.migrationType,
+                declaration_path: declaration.path,
+                declaration_format: "sql",
+                migration_id: declaration.migrationId,
+            },
+            created_at: timestamp,
+            updated_at: timestamp,
+        });
+        resources.push(candidate(migrationRecord, [evidence]));
+        if (!repositoryRecord)
             continue;
-        }
+        const relationship = EdgeSchema.parse({
+            schema: "hunch.resource-relationship/1",
+            id: resourceRelationshipId(repositoryRecord.id, migrationRecord.id, "contains"),
+            from: repositoryRecord.id,
+            to: migrationRecord.id,
+            type: "contains",
+            reason: `${declaration.path} declares a ${migrationProviderName(declaration.provider)} database migration artifact`,
+            strength: 0.9,
+            provenance: {
+                source: "extracted:migration-declaration",
+                confidence: 0.9,
+                evidence: [provenanceEvidence(evidence)],
+            },
+            currentness: resourceCurrentness(revision, [declaration.contentHash]),
+            environment: null,
+            contract_version: declaration.contractVersion ?? undefined,
+            metadata: { discovery_authority: "candidate", declaration_path: declaration.path },
+        });
+        relationships.push(candidate(relationship, [evidence]));
+    }
+    const packageRecords = new Map();
+    for (const declaration of discoveredPackages) {
+        const { manifest, name } = declaration;
         const evidence = {
             kind: "package_manifest",
             sourcePath: manifest.path,
@@ -1662,6 +3567,7 @@ export function discoverRepositoryLandscape(root, ref = "HEAD") {
             created_at: timestamp,
             updated_at: timestamp,
         });
+        packageRecords.set(name, packageRecord);
         resources.push(candidate(packageRecord, [evidence]));
         if (!repositoryRecord)
             continue;
@@ -1680,6 +3586,37 @@ export function discoverRepositoryLandscape(root, ref = "HEAD") {
         });
         relationships.push(candidate(relationship, [evidence]));
     }
+    for (const declaration of discoveredWorkspaceDependencies) {
+        const from = packageRecords.get(declaration.from.name);
+        const to = packageRecords.get(declaration.to.name);
+        if (!from || !to)
+            continue;
+        const evidence = declaration.evidence;
+        const dependencyFields = [...new Set(evidence
+                .filter((item) => item.sourcePath === declaration.from.manifest.path && item.sourceField !== "name")
+                .map((item) => item.sourceField.split(".", 1)[0]))].sort(compareCodeUnits);
+        const relationship = EdgeSchema.parse({
+            schema: "hunch.resource-relationship/1",
+            id: resourceRelationshipId(from.id, to.id, "depends_on"),
+            from: from.id,
+            to: to.id,
+            type: "depends_on",
+            reason: `${declaration.from.name} declares an internal workspace dependency on ${declaration.to.name}`,
+            strength: 1,
+            provenance: {
+                source: "extracted:workspace-dependency",
+                confidence: 0.95,
+                evidence: evidence.map(provenanceEvidence),
+            },
+            currentness: resourceCurrentness(revision, evidence.map((item) => item.sourceContentHash)),
+            environment: null,
+            metadata: {
+                discovery_authority: "candidate",
+                dependency_fields: dependencyFields,
+            },
+        });
+        relationships.push(candidate(relationship, evidence));
+    }
     resources.sort((left, right) => compareCodeUnits(left.record.id, right.record.id));
     relationships.sort((left, right) => compareCodeUnits(left.record.id, right.record.id));
     issues.sort((left, right) => compareCodeUnits(`${left.code}:${left.sourcePath}:${left.sourceField}:${left.detail}`, `${right.code}:${right.sourcePath}:${right.sourceField}:${right.detail}`));